pc: Require xen when initializing xenfv machine
[qemu/cris-port.git] / target-arm / helper.c
blobe7fda374661d18f69ac62ce88c0a73d9b66b7ab7
1 #include "cpu.h"
2 #include "internals.h"
3 #include "exec/gdbstub.h"
4 #include "exec/helper-proto.h"
5 #include "qemu/host-utils.h"
6 #include "sysemu/arch_init.h"
7 #include "sysemu/sysemu.h"
8 #include "qemu/bitops.h"
9 #include "qemu/crc32c.h"
10 #include "exec/cpu_ldst.h"
11 #include "arm_ldst.h"
12 #include <zlib.h> /* For crc32 */
13 #include "exec/semihost.h"
15 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
17 #ifndef CONFIG_USER_ONLY
18 static inline bool get_phys_addr(CPUARMState *env, target_ulong address,
19 int access_type, ARMMMUIdx mmu_idx,
20 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
21 target_ulong *page_size, uint32_t *fsr);
23 /* Definitions for the PMCCNTR and PMCR registers */
24 #define PMCRD 0x8
25 #define PMCRC 0x4
26 #define PMCRE 0x1
27 #endif
29 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
31 int nregs;
33 /* VFP data registers are always little-endian. */
34 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
35 if (reg < nregs) {
36 stfq_le_p(buf, env->vfp.regs[reg]);
37 return 8;
39 if (arm_feature(env, ARM_FEATURE_NEON)) {
40 /* Aliases for Q regs. */
41 nregs += 16;
42 if (reg < nregs) {
43 stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
44 stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
45 return 16;
48 switch (reg - nregs) {
49 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
50 case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
51 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
53 return 0;
56 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
58 int nregs;
60 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
61 if (reg < nregs) {
62 env->vfp.regs[reg] = ldfq_le_p(buf);
63 return 8;
65 if (arm_feature(env, ARM_FEATURE_NEON)) {
66 nregs += 16;
67 if (reg < nregs) {
68 env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
69 env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
70 return 16;
73 switch (reg - nregs) {
74 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
75 case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
76 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
78 return 0;
81 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
83 switch (reg) {
84 case 0 ... 31:
85 /* 128 bit FP register */
86 stfq_le_p(buf, env->vfp.regs[reg * 2]);
87 stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
88 return 16;
89 case 32:
90 /* FPSR */
91 stl_p(buf, vfp_get_fpsr(env));
92 return 4;
93 case 33:
94 /* FPCR */
95 stl_p(buf, vfp_get_fpcr(env));
96 return 4;
97 default:
98 return 0;
102 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
104 switch (reg) {
105 case 0 ... 31:
106 /* 128 bit FP register */
107 env->vfp.regs[reg * 2] = ldfq_le_p(buf);
108 env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
109 return 16;
110 case 32:
111 /* FPSR */
112 vfp_set_fpsr(env, ldl_p(buf));
113 return 4;
114 case 33:
115 /* FPCR */
116 vfp_set_fpcr(env, ldl_p(buf));
117 return 4;
118 default:
119 return 0;
123 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
125 assert(ri->fieldoffset);
126 if (cpreg_field_is_64bit(ri)) {
127 return CPREG_FIELD64(env, ri);
128 } else {
129 return CPREG_FIELD32(env, ri);
133 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
134 uint64_t value)
136 assert(ri->fieldoffset);
137 if (cpreg_field_is_64bit(ri)) {
138 CPREG_FIELD64(env, ri) = value;
139 } else {
140 CPREG_FIELD32(env, ri) = value;
144 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
146 return (char *)env + ri->fieldoffset;
149 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
151 /* Raw read of a coprocessor register (as needed for migration, etc). */
152 if (ri->type & ARM_CP_CONST) {
153 return ri->resetvalue;
154 } else if (ri->raw_readfn) {
155 return ri->raw_readfn(env, ri);
156 } else if (ri->readfn) {
157 return ri->readfn(env, ri);
158 } else {
159 return raw_read(env, ri);
163 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
164 uint64_t v)
166 /* Raw write of a coprocessor register (as needed for migration, etc).
167 * Note that constant registers are treated as write-ignored; the
168 * caller should check for success by whether a readback gives the
169 * value written.
171 if (ri->type & ARM_CP_CONST) {
172 return;
173 } else if (ri->raw_writefn) {
174 ri->raw_writefn(env, ri, v);
175 } else if (ri->writefn) {
176 ri->writefn(env, ri, v);
177 } else {
178 raw_write(env, ri, v);
182 static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
184 /* Return true if the regdef would cause an assertion if you called
185 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
186 * program bug for it not to have the NO_RAW flag).
187 * NB that returning false here doesn't necessarily mean that calling
188 * read/write_raw_cp_reg() is safe, because we can't distinguish "has
189 * read/write access functions which are safe for raw use" from "has
190 * read/write access functions which have side effects but has forgotten
191 * to provide raw access functions".
192 * The tests here line up with the conditions in read/write_raw_cp_reg()
193 * and assertions in raw_read()/raw_write().
195 if ((ri->type & ARM_CP_CONST) ||
196 ri->fieldoffset ||
197 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
198 return false;
200 return true;
203 bool write_cpustate_to_list(ARMCPU *cpu)
205 /* Write the coprocessor state from cpu->env to the (index,value) list. */
206 int i;
207 bool ok = true;
209 for (i = 0; i < cpu->cpreg_array_len; i++) {
210 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
211 const ARMCPRegInfo *ri;
213 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
214 if (!ri) {
215 ok = false;
216 continue;
218 if (ri->type & ARM_CP_NO_RAW) {
219 continue;
221 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
223 return ok;
226 bool write_list_to_cpustate(ARMCPU *cpu)
228 int i;
229 bool ok = true;
231 for (i = 0; i < cpu->cpreg_array_len; i++) {
232 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
233 uint64_t v = cpu->cpreg_values[i];
234 const ARMCPRegInfo *ri;
236 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
237 if (!ri) {
238 ok = false;
239 continue;
241 if (ri->type & ARM_CP_NO_RAW) {
242 continue;
244 /* Write value and confirm it reads back as written
245 * (to catch read-only registers and partially read-only
246 * registers where the incoming migration value doesn't match)
248 write_raw_cp_reg(&cpu->env, ri, v);
249 if (read_raw_cp_reg(&cpu->env, ri) != v) {
250 ok = false;
253 return ok;
256 static void add_cpreg_to_list(gpointer key, gpointer opaque)
258 ARMCPU *cpu = opaque;
259 uint64_t regidx;
260 const ARMCPRegInfo *ri;
262 regidx = *(uint32_t *)key;
263 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
265 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
266 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
267 /* The value array need not be initialized at this point */
268 cpu->cpreg_array_len++;
272 static void count_cpreg(gpointer key, gpointer opaque)
274 ARMCPU *cpu = opaque;
275 uint64_t regidx;
276 const ARMCPRegInfo *ri;
278 regidx = *(uint32_t *)key;
279 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
281 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
282 cpu->cpreg_array_len++;
286 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
288 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
289 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
291 if (aidx > bidx) {
292 return 1;
294 if (aidx < bidx) {
295 return -1;
297 return 0;
300 void init_cpreg_list(ARMCPU *cpu)
302 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
303 * Note that we require cpreg_tuples[] to be sorted by key ID.
305 GList *keys;
306 int arraylen;
308 keys = g_hash_table_get_keys(cpu->cp_regs);
309 keys = g_list_sort(keys, cpreg_key_compare);
311 cpu->cpreg_array_len = 0;
313 g_list_foreach(keys, count_cpreg, cpu);
315 arraylen = cpu->cpreg_array_len;
316 cpu->cpreg_indexes = g_new(uint64_t, arraylen);
317 cpu->cpreg_values = g_new(uint64_t, arraylen);
318 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
319 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
320 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
321 cpu->cpreg_array_len = 0;
323 g_list_foreach(keys, add_cpreg_to_list, cpu);
325 assert(cpu->cpreg_array_len == arraylen);
327 g_list_free(keys);
331 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but
332 * they are accessible when EL3 is using AArch64 regardless of EL3.NS.
334 * access_el3_aa32ns: Used to check AArch32 register views.
335 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views.
337 static CPAccessResult access_el3_aa32ns(CPUARMState *env,
338 const ARMCPRegInfo *ri)
340 bool secure = arm_is_secure_below_el3(env);
342 assert(!arm_el_is_aa64(env, 3));
343 if (secure) {
344 return CP_ACCESS_TRAP_UNCATEGORIZED;
346 return CP_ACCESS_OK;
349 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env,
350 const ARMCPRegInfo *ri)
352 if (!arm_el_is_aa64(env, 3)) {
353 return access_el3_aa32ns(env, ri);
355 return CP_ACCESS_OK;
358 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
360 ARMCPU *cpu = arm_env_get_cpu(env);
362 raw_write(env, ri, value);
363 tlb_flush(CPU(cpu), 1); /* Flush TLB as domain not tracked in TLB */
366 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
368 ARMCPU *cpu = arm_env_get_cpu(env);
370 if (raw_read(env, ri) != value) {
371 /* Unlike real hardware the qemu TLB uses virtual addresses,
372 * not modified virtual addresses, so this causes a TLB flush.
374 tlb_flush(CPU(cpu), 1);
375 raw_write(env, ri, value);
379 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
380 uint64_t value)
382 ARMCPU *cpu = arm_env_get_cpu(env);
384 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
385 && !extended_addresses_enabled(env)) {
386 /* For VMSA (when not using the LPAE long descriptor page table
387 * format) this register includes the ASID, so do a TLB flush.
388 * For PMSA it is purely a process ID and no action is needed.
390 tlb_flush(CPU(cpu), 1);
392 raw_write(env, ri, value);
395 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
396 uint64_t value)
398 /* Invalidate all (TLBIALL) */
399 ARMCPU *cpu = arm_env_get_cpu(env);
401 tlb_flush(CPU(cpu), 1);
404 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
405 uint64_t value)
407 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
408 ARMCPU *cpu = arm_env_get_cpu(env);
410 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
413 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
414 uint64_t value)
416 /* Invalidate by ASID (TLBIASID) */
417 ARMCPU *cpu = arm_env_get_cpu(env);
419 tlb_flush(CPU(cpu), value == 0);
422 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
423 uint64_t value)
425 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
426 ARMCPU *cpu = arm_env_get_cpu(env);
428 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
431 /* IS variants of TLB operations must affect all cores */
432 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
433 uint64_t value)
435 CPUState *other_cs;
437 CPU_FOREACH(other_cs) {
438 tlb_flush(other_cs, 1);
442 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
443 uint64_t value)
445 CPUState *other_cs;
447 CPU_FOREACH(other_cs) {
448 tlb_flush(other_cs, value == 0);
452 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
453 uint64_t value)
455 CPUState *other_cs;
457 CPU_FOREACH(other_cs) {
458 tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
462 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
463 uint64_t value)
465 CPUState *other_cs;
467 CPU_FOREACH(other_cs) {
468 tlb_flush_page(other_cs, value & TARGET_PAGE_MASK);
472 static const ARMCPRegInfo cp_reginfo[] = {
473 /* Define the secure and non-secure FCSE identifier CP registers
474 * separately because there is no secure bank in V8 (no _EL3). This allows
475 * the secure register to be properly reset and migrated. There is also no
476 * v8 EL1 version of the register so the non-secure instance stands alone.
478 { .name = "FCSEIDR(NS)",
479 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
480 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
481 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
482 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
483 { .name = "FCSEIDR(S)",
484 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
485 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
486 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
487 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
488 /* Define the secure and non-secure context identifier CP registers
489 * separately because there is no secure bank in V8 (no _EL3). This allows
490 * the secure register to be properly reset and migrated. In the
491 * non-secure case, the 32-bit register will have reset and migration
492 * disabled during registration as it is handled by the 64-bit instance.
494 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
495 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
496 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
497 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
498 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
499 { .name = "CONTEXTIDR(S)", .state = ARM_CP_STATE_AA32,
500 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
501 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
502 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
503 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
504 REGINFO_SENTINEL
507 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
508 /* NB: Some of these registers exist in v8 but with more precise
509 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
511 /* MMU Domain access control / MPU write buffer control */
512 { .name = "DACR",
513 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
514 .access = PL1_RW, .resetvalue = 0,
515 .writefn = dacr_write, .raw_writefn = raw_write,
516 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
517 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
518 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
519 * For v6 and v5, these mappings are overly broad.
521 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
522 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
523 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
524 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
525 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
526 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
527 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
528 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
529 /* Cache maintenance ops; some of this space may be overridden later. */
530 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
531 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
532 .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
533 REGINFO_SENTINEL
536 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
537 /* Not all pre-v6 cores implemented this WFI, so this is slightly
538 * over-broad.
540 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
541 .access = PL1_W, .type = ARM_CP_WFI },
542 REGINFO_SENTINEL
545 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
546 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
547 * is UNPREDICTABLE; we choose to NOP as most implementations do).
549 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
550 .access = PL1_W, .type = ARM_CP_WFI },
551 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
552 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
553 * OMAPCP will override this space.
555 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
556 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
557 .resetvalue = 0 },
558 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
559 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
560 .resetvalue = 0 },
561 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
562 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
563 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
564 .resetvalue = 0 },
565 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
566 * implementing it as RAZ means the "debug architecture version" bits
567 * will read as a reserved value, which should cause Linux to not try
568 * to use the debug hardware.
570 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
571 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
572 /* MMU TLB control. Note that the wildcarding means we cover not just
573 * the unified TLB ops but also the dside/iside/inner-shareable variants.
575 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
576 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
577 .type = ARM_CP_NO_RAW },
578 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
579 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
580 .type = ARM_CP_NO_RAW },
581 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
582 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
583 .type = ARM_CP_NO_RAW },
584 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
585 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
586 .type = ARM_CP_NO_RAW },
587 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
588 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
589 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
590 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
591 REGINFO_SENTINEL
594 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
595 uint64_t value)
597 uint32_t mask = 0;
599 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
600 if (!arm_feature(env, ARM_FEATURE_V8)) {
601 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
602 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
603 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
605 if (arm_feature(env, ARM_FEATURE_VFP)) {
606 /* VFP coprocessor: cp10 & cp11 [23:20] */
607 mask |= (1 << 31) | (1 << 30) | (0xf << 20);
609 if (!arm_feature(env, ARM_FEATURE_NEON)) {
610 /* ASEDIS [31] bit is RAO/WI */
611 value |= (1 << 31);
614 /* VFPv3 and upwards with NEON implement 32 double precision
615 * registers (D0-D31).
617 if (!arm_feature(env, ARM_FEATURE_NEON) ||
618 !arm_feature(env, ARM_FEATURE_VFP3)) {
619 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
620 value |= (1 << 30);
623 value &= mask;
625 env->cp15.cpacr_el1 = value;
628 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri)
630 if (arm_feature(env, ARM_FEATURE_V8)) {
631 /* Check if CPACR accesses are to be trapped to EL2 */
632 if (arm_current_el(env) == 1 &&
633 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
634 return CP_ACCESS_TRAP_EL2;
635 /* Check if CPACR accesses are to be trapped to EL3 */
636 } else if (arm_current_el(env) < 3 &&
637 (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
638 return CP_ACCESS_TRAP_EL3;
642 return CP_ACCESS_OK;
645 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri)
647 /* Check if CPTR accesses are set to trap to EL3 */
648 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
649 return CP_ACCESS_TRAP_EL3;
652 return CP_ACCESS_OK;
655 static const ARMCPRegInfo v6_cp_reginfo[] = {
656 /* prefetch by MVA in v6, NOP in v7 */
657 { .name = "MVA_prefetch",
658 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
659 .access = PL1_W, .type = ARM_CP_NOP },
660 /* We need to break the TB after ISB to execute self-modifying code
661 * correctly and also to take any pending interrupts immediately.
662 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag.
664 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
665 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore },
666 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
667 .access = PL0_W, .type = ARM_CP_NOP },
668 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
669 .access = PL0_W, .type = ARM_CP_NOP },
670 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
671 .access = PL1_RW,
672 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
673 offsetof(CPUARMState, cp15.ifar_ns) },
674 .resetvalue = 0, },
675 /* Watchpoint Fault Address Register : should actually only be present
676 * for 1136, 1176, 11MPCore.
678 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
679 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
680 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
681 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
682 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
683 .resetvalue = 0, .writefn = cpacr_write },
684 REGINFO_SENTINEL
687 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri)
689 /* Performance monitor registers user accessibility is controlled
690 * by PMUSERENR.
692 if (arm_current_el(env) == 0 && !env->cp15.c9_pmuserenr) {
693 return CP_ACCESS_TRAP;
695 return CP_ACCESS_OK;
698 #ifndef CONFIG_USER_ONLY
700 static inline bool arm_ccnt_enabled(CPUARMState *env)
702 /* This does not support checking PMCCFILTR_EL0 register */
704 if (!(env->cp15.c9_pmcr & PMCRE)) {
705 return false;
708 return true;
711 void pmccntr_sync(CPUARMState *env)
713 uint64_t temp_ticks;
715 temp_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
716 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
718 if (env->cp15.c9_pmcr & PMCRD) {
719 /* Increment once every 64 processor clock cycles */
720 temp_ticks /= 64;
723 if (arm_ccnt_enabled(env)) {
724 env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
728 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
729 uint64_t value)
731 pmccntr_sync(env);
733 if (value & PMCRC) {
734 /* The counter has been reset */
735 env->cp15.c15_ccnt = 0;
738 /* only the DP, X, D and E bits are writable */
739 env->cp15.c9_pmcr &= ~0x39;
740 env->cp15.c9_pmcr |= (value & 0x39);
742 pmccntr_sync(env);
745 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
747 uint64_t total_ticks;
749 if (!arm_ccnt_enabled(env)) {
750 /* Counter is disabled, do not change value */
751 return env->cp15.c15_ccnt;
754 total_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
755 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
757 if (env->cp15.c9_pmcr & PMCRD) {
758 /* Increment once every 64 processor clock cycles */
759 total_ticks /= 64;
761 return total_ticks - env->cp15.c15_ccnt;
764 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
765 uint64_t value)
767 uint64_t total_ticks;
769 if (!arm_ccnt_enabled(env)) {
770 /* Counter is disabled, set the absolute value */
771 env->cp15.c15_ccnt = value;
772 return;
775 total_ticks = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
776 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
778 if (env->cp15.c9_pmcr & PMCRD) {
779 /* Increment once every 64 processor clock cycles */
780 total_ticks /= 64;
782 env->cp15.c15_ccnt = total_ticks - value;
785 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
786 uint64_t value)
788 uint64_t cur_val = pmccntr_read(env, NULL);
790 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
793 #else /* CONFIG_USER_ONLY */
795 void pmccntr_sync(CPUARMState *env)
799 #endif
801 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
802 uint64_t value)
804 pmccntr_sync(env);
805 env->cp15.pmccfiltr_el0 = value & 0x7E000000;
806 pmccntr_sync(env);
809 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
810 uint64_t value)
812 value &= (1 << 31);
813 env->cp15.c9_pmcnten |= value;
816 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
817 uint64_t value)
819 value &= (1 << 31);
820 env->cp15.c9_pmcnten &= ~value;
823 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
824 uint64_t value)
826 env->cp15.c9_pmovsr &= ~value;
829 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
830 uint64_t value)
832 env->cp15.c9_pmxevtyper = value & 0xff;
835 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
836 uint64_t value)
838 env->cp15.c9_pmuserenr = value & 1;
841 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
842 uint64_t value)
844 /* We have no event counters so only the C bit can be changed */
845 value &= (1 << 31);
846 env->cp15.c9_pminten |= value;
849 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
850 uint64_t value)
852 value &= (1 << 31);
853 env->cp15.c9_pminten &= ~value;
856 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
857 uint64_t value)
859 /* Note that even though the AArch64 view of this register has bits
860 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
861 * architectural requirements for bits which are RES0 only in some
862 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
863 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
865 raw_write(env, ri, value & ~0x1FULL);
868 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
870 /* We only mask off bits that are RES0 both for AArch64 and AArch32.
871 * For bits that vary between AArch32/64, code needs to check the
872 * current execution mode before directly using the feature bit.
874 uint32_t valid_mask = SCR_AARCH64_MASK | SCR_AARCH32_MASK;
876 if (!arm_feature(env, ARM_FEATURE_EL2)) {
877 valid_mask &= ~SCR_HCE;
879 /* On ARMv7, SMD (or SCD as it is called in v7) is only
880 * supported if EL2 exists. The bit is UNK/SBZP when
881 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
882 * when EL2 is unavailable.
883 * On ARMv8, this bit is always available.
885 if (arm_feature(env, ARM_FEATURE_V7) &&
886 !arm_feature(env, ARM_FEATURE_V8)) {
887 valid_mask &= ~SCR_SMD;
891 /* Clear all-context RES0 bits. */
892 value &= valid_mask;
893 raw_write(env, ri, value);
896 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
898 ARMCPU *cpu = arm_env_get_cpu(env);
900 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR
901 * bank
903 uint32_t index = A32_BANKED_REG_GET(env, csselr,
904 ri->secure & ARM_CP_SECSTATE_S);
906 return cpu->ccsidr[index];
909 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
910 uint64_t value)
912 raw_write(env, ri, value & 0xf);
915 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
917 CPUState *cs = ENV_GET_CPU(env);
918 uint64_t ret = 0;
920 if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
921 ret |= CPSR_I;
923 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
924 ret |= CPSR_F;
926 /* External aborts are not possible in QEMU so A bit is always clear */
927 return ret;
930 static const ARMCPRegInfo v7_cp_reginfo[] = {
931 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
932 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
933 .access = PL1_W, .type = ARM_CP_NOP },
934 /* Performance monitors are implementation defined in v7,
935 * but with an ARM recommended set of registers, which we
936 * follow (although we don't actually implement any counters)
938 * Performance registers fall into three categories:
939 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
940 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
941 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
942 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
943 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
945 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
946 .access = PL0_RW, .type = ARM_CP_ALIAS,
947 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
948 .writefn = pmcntenset_write,
949 .accessfn = pmreg_access,
950 .raw_writefn = raw_write },
951 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
952 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
953 .access = PL0_RW, .accessfn = pmreg_access,
954 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
955 .writefn = pmcntenset_write, .raw_writefn = raw_write },
956 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
957 .access = PL0_RW,
958 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
959 .accessfn = pmreg_access,
960 .writefn = pmcntenclr_write,
961 .type = ARM_CP_ALIAS },
962 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
963 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
964 .access = PL0_RW, .accessfn = pmreg_access,
965 .type = ARM_CP_ALIAS,
966 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
967 .writefn = pmcntenclr_write },
968 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
969 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
970 .accessfn = pmreg_access,
971 .writefn = pmovsr_write,
972 .raw_writefn = raw_write },
973 /* Unimplemented so WI. */
974 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
975 .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
976 /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
977 * We choose to RAZ/WI.
979 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
980 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
981 .accessfn = pmreg_access },
982 #ifndef CONFIG_USER_ONLY
983 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
984 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
985 .readfn = pmccntr_read, .writefn = pmccntr_write32,
986 .accessfn = pmreg_access },
987 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
988 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
989 .access = PL0_RW, .accessfn = pmreg_access,
990 .type = ARM_CP_IO,
991 .readfn = pmccntr_read, .writefn = pmccntr_write, },
992 #endif
993 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
994 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
995 .writefn = pmccfiltr_write,
996 .access = PL0_RW, .accessfn = pmreg_access,
997 .type = ARM_CP_IO,
998 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
999 .resetvalue = 0, },
1000 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
1001 .access = PL0_RW,
1002 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
1003 .accessfn = pmreg_access, .writefn = pmxevtyper_write,
1004 .raw_writefn = raw_write },
1005 /* Unimplemented, RAZ/WI. */
1006 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
1007 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
1008 .accessfn = pmreg_access },
1009 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
1010 .access = PL0_R | PL1_RW,
1011 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
1012 .resetvalue = 0,
1013 .writefn = pmuserenr_write, .raw_writefn = raw_write },
1014 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
1015 .access = PL1_RW,
1016 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
1017 .resetvalue = 0,
1018 .writefn = pmintenset_write, .raw_writefn = raw_write },
1019 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
1020 .access = PL1_RW, .type = ARM_CP_ALIAS,
1021 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
1022 .writefn = pmintenclr_write, },
1023 { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
1024 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
1025 .access = PL1_RW, .writefn = vbar_write,
1026 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
1027 offsetof(CPUARMState, cp15.vbar_ns) },
1028 .resetvalue = 0 },
1029 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
1030 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
1031 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
1032 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
1033 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
1034 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0,
1035 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
1036 offsetof(CPUARMState, cp15.csselr_ns) } },
1037 /* Auxiliary ID register: this actually has an IMPDEF value but for now
1038 * just RAZ for all cores:
1040 { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
1041 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
1042 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
1043 /* Auxiliary fault status registers: these also are IMPDEF, and we
1044 * choose to RAZ/WI for all cores.
1046 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
1047 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
1048 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
1049 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
1050 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
1051 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
1052 /* MAIR can just read-as-written because we don't implement caches
1053 * and so don't need to care about memory attributes.
1055 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
1056 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
1057 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
1058 .resetvalue = 0 },
1059 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
1060 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
1061 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
1062 .resetvalue = 0 },
1063 /* For non-long-descriptor page tables these are PRRR and NMRR;
1064 * regardless they still act as reads-as-written for QEMU.
1066 /* MAIR0/1 are defined separately from their 64-bit counterpart which
1067 * allows them to assign the correct fieldoffset based on the endianness
1068 * handled in the field definitions.
1070 { .name = "MAIR0", .state = ARM_CP_STATE_AA32,
1071 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
1072 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
1073 offsetof(CPUARMState, cp15.mair0_ns) },
1074 .resetfn = arm_cp_reset_ignore },
1075 { .name = "MAIR1", .state = ARM_CP_STATE_AA32,
1076 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
1077 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
1078 offsetof(CPUARMState, cp15.mair1_ns) },
1079 .resetfn = arm_cp_reset_ignore },
1080 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
1081 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
1082 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
1083 /* 32 bit ITLB invalidates */
1084 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
1085 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1086 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
1087 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1088 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
1089 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1090 /* 32 bit DTLB invalidates */
1091 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
1092 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1093 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
1094 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1095 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
1096 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1097 /* 32 bit TLB invalidates */
1098 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
1099 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
1100 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
1101 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
1102 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
1103 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
1104 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
1105 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
1106 REGINFO_SENTINEL
1109 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
1110 /* 32 bit TLB invalidates, Inner Shareable */
1111 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
1112 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write },
1113 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
1114 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
1115 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
1116 .type = ARM_CP_NO_RAW, .access = PL1_W,
1117 .writefn = tlbiasid_is_write },
1118 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
1119 .type = ARM_CP_NO_RAW, .access = PL1_W,
1120 .writefn = tlbimvaa_is_write },
1121 REGINFO_SENTINEL
1124 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1125 uint64_t value)
1127 value &= 1;
1128 env->teecr = value;
1131 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri)
1133 if (arm_current_el(env) == 0 && (env->teecr & 1)) {
1134 return CP_ACCESS_TRAP;
1136 return CP_ACCESS_OK;
1139 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
1140 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
1141 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
1142 .resetvalue = 0,
1143 .writefn = teecr_write },
1144 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
1145 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
1146 .accessfn = teehbr_access, .resetvalue = 0 },
1147 REGINFO_SENTINEL
1150 static const ARMCPRegInfo v6k_cp_reginfo[] = {
1151 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
1152 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
1153 .access = PL0_RW,
1154 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
1155 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
1156 .access = PL0_RW,
1157 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
1158 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
1159 .resetfn = arm_cp_reset_ignore },
1160 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
1161 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
1162 .access = PL0_R|PL1_W,
1163 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
1164 .resetvalue = 0},
1165 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
1166 .access = PL0_R|PL1_W,
1167 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
1168 offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
1169 .resetfn = arm_cp_reset_ignore },
1170 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
1171 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
1172 .access = PL1_RW,
1173 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
1174 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
1175 .access = PL1_RW,
1176 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
1177 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
1178 .resetvalue = 0 },
1179 REGINFO_SENTINEL
1182 #ifndef CONFIG_USER_ONLY
1184 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri)
1186 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
1187 if (arm_current_el(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) {
1188 return CP_ACCESS_TRAP;
1190 return CP_ACCESS_OK;
1193 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx)
1195 unsigned int cur_el = arm_current_el(env);
1196 bool secure = arm_is_secure(env);
1198 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
1199 if (cur_el == 0 &&
1200 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
1201 return CP_ACCESS_TRAP;
1204 if (arm_feature(env, ARM_FEATURE_EL2) &&
1205 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
1206 !extract32(env->cp15.cnthctl_el2, 0, 1)) {
1207 return CP_ACCESS_TRAP_EL2;
1209 return CP_ACCESS_OK;
1212 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx)
1214 unsigned int cur_el = arm_current_el(env);
1215 bool secure = arm_is_secure(env);
1217 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
1218 * EL0[PV]TEN is zero.
1220 if (cur_el == 0 &&
1221 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
1222 return CP_ACCESS_TRAP;
1225 if (arm_feature(env, ARM_FEATURE_EL2) &&
1226 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
1227 !extract32(env->cp15.cnthctl_el2, 1, 1)) {
1228 return CP_ACCESS_TRAP_EL2;
1230 return CP_ACCESS_OK;
1233 static CPAccessResult gt_pct_access(CPUARMState *env,
1234 const ARMCPRegInfo *ri)
1236 return gt_counter_access(env, GTIMER_PHYS);
1239 static CPAccessResult gt_vct_access(CPUARMState *env,
1240 const ARMCPRegInfo *ri)
1242 return gt_counter_access(env, GTIMER_VIRT);
1245 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1247 return gt_timer_access(env, GTIMER_PHYS);
1250 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
1252 return gt_timer_access(env, GTIMER_VIRT);
1255 static CPAccessResult gt_stimer_access(CPUARMState *env,
1256 const ARMCPRegInfo *ri)
1258 /* The AArch64 register view of the secure physical timer is
1259 * always accessible from EL3, and configurably accessible from
1260 * Secure EL1.
1262 switch (arm_current_el(env)) {
1263 case 1:
1264 if (!arm_is_secure(env)) {
1265 return CP_ACCESS_TRAP;
1267 if (!(env->cp15.scr_el3 & SCR_ST)) {
1268 return CP_ACCESS_TRAP_EL3;
1270 return CP_ACCESS_OK;
1271 case 0:
1272 case 2:
1273 return CP_ACCESS_TRAP;
1274 case 3:
1275 return CP_ACCESS_OK;
1276 default:
1277 g_assert_not_reached();
1281 static uint64_t gt_get_countervalue(CPUARMState *env)
1283 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
1286 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
1288 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
1290 if (gt->ctl & 1) {
1291 /* Timer enabled: calculate and set current ISTATUS, irq, and
1292 * reset timer to when ISTATUS next has to change
1294 uint64_t offset = timeridx == GTIMER_VIRT ?
1295 cpu->env.cp15.cntvoff_el2 : 0;
1296 uint64_t count = gt_get_countervalue(&cpu->env);
1297 /* Note that this must be unsigned 64 bit arithmetic: */
1298 int istatus = count - offset >= gt->cval;
1299 uint64_t nexttick;
1301 gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
1302 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1303 (istatus && !(gt->ctl & 2)));
1304 if (istatus) {
1305 /* Next transition is when count rolls back over to zero */
1306 nexttick = UINT64_MAX;
1307 } else {
1308 /* Next transition is when we hit cval */
1309 nexttick = gt->cval + offset;
1311 /* Note that the desired next expiry time might be beyond the
1312 * signed-64-bit range of a QEMUTimer -- in this case we just
1313 * set the timer for as far in the future as possible. When the
1314 * timer expires we will reset the timer for any remaining period.
1316 if (nexttick > INT64_MAX / GTIMER_SCALE) {
1317 nexttick = INT64_MAX / GTIMER_SCALE;
1319 timer_mod(cpu->gt_timer[timeridx], nexttick);
1320 } else {
1321 /* Timer disabled: ISTATUS and timer output always clear */
1322 gt->ctl &= ~4;
1323 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
1324 timer_del(cpu->gt_timer[timeridx]);
1328 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
1329 int timeridx)
1331 ARMCPU *cpu = arm_env_get_cpu(env);
1333 timer_del(cpu->gt_timer[timeridx]);
1336 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1338 return gt_get_countervalue(env);
1341 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1343 return gt_get_countervalue(env) - env->cp15.cntvoff_el2;
1346 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1347 int timeridx,
1348 uint64_t value)
1350 env->cp15.c14_timer[timeridx].cval = value;
1351 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1354 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
1355 int timeridx)
1357 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
1359 return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
1360 (gt_get_countervalue(env) - offset));
1363 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1364 int timeridx,
1365 uint64_t value)
1367 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
1369 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
1370 sextract64(value, 0, 32);
1371 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1374 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1375 int timeridx,
1376 uint64_t value)
1378 ARMCPU *cpu = arm_env_get_cpu(env);
1379 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
1381 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
1382 if ((oldval ^ value) & 1) {
1383 /* Enable toggled */
1384 gt_recalc_timer(cpu, timeridx);
1385 } else if ((oldval ^ value) & 2) {
1386 /* IMASK toggled: don't need to recalculate,
1387 * just set the interrupt line based on ISTATUS
1389 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1390 (oldval & 4) && !(value & 2));
1394 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1396 gt_timer_reset(env, ri, GTIMER_PHYS);
1399 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1400 uint64_t value)
1402 gt_cval_write(env, ri, GTIMER_PHYS, value);
1405 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1407 return gt_tval_read(env, ri, GTIMER_PHYS);
1410 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1411 uint64_t value)
1413 gt_tval_write(env, ri, GTIMER_PHYS, value);
1416 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1417 uint64_t value)
1419 gt_ctl_write(env, ri, GTIMER_PHYS, value);
1422 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1424 gt_timer_reset(env, ri, GTIMER_VIRT);
1427 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1428 uint64_t value)
1430 gt_cval_write(env, ri, GTIMER_VIRT, value);
1433 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1435 return gt_tval_read(env, ri, GTIMER_VIRT);
1438 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1439 uint64_t value)
1441 gt_tval_write(env, ri, GTIMER_VIRT, value);
1444 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1445 uint64_t value)
1447 gt_ctl_write(env, ri, GTIMER_VIRT, value);
1450 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
1451 uint64_t value)
1453 ARMCPU *cpu = arm_env_get_cpu(env);
1455 raw_write(env, ri, value);
1456 gt_recalc_timer(cpu, GTIMER_VIRT);
1459 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1461 gt_timer_reset(env, ri, GTIMER_HYP);
1464 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1465 uint64_t value)
1467 gt_cval_write(env, ri, GTIMER_HYP, value);
1470 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1472 return gt_tval_read(env, ri, GTIMER_HYP);
1475 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1476 uint64_t value)
1478 gt_tval_write(env, ri, GTIMER_HYP, value);
1481 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1482 uint64_t value)
1484 gt_ctl_write(env, ri, GTIMER_HYP, value);
1487 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1489 gt_timer_reset(env, ri, GTIMER_SEC);
1492 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1493 uint64_t value)
1495 gt_cval_write(env, ri, GTIMER_SEC, value);
1498 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1500 return gt_tval_read(env, ri, GTIMER_SEC);
1503 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1504 uint64_t value)
1506 gt_tval_write(env, ri, GTIMER_SEC, value);
1509 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1510 uint64_t value)
1512 gt_ctl_write(env, ri, GTIMER_SEC, value);
1515 void arm_gt_ptimer_cb(void *opaque)
1517 ARMCPU *cpu = opaque;
1519 gt_recalc_timer(cpu, GTIMER_PHYS);
1522 void arm_gt_vtimer_cb(void *opaque)
1524 ARMCPU *cpu = opaque;
1526 gt_recalc_timer(cpu, GTIMER_VIRT);
1529 void arm_gt_htimer_cb(void *opaque)
1531 ARMCPU *cpu = opaque;
1533 gt_recalc_timer(cpu, GTIMER_HYP);
1536 void arm_gt_stimer_cb(void *opaque)
1538 ARMCPU *cpu = opaque;
1540 gt_recalc_timer(cpu, GTIMER_SEC);
1543 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1544 /* Note that CNTFRQ is purely reads-as-written for the benefit
1545 * of software; writing it doesn't actually change the timer frequency.
1546 * Our reset value matches the fixed frequency we implement the timer at.
1548 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
1549 .type = ARM_CP_ALIAS,
1550 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1551 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
1553 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
1554 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
1555 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1556 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
1557 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
1559 /* overall control: mostly access permissions */
1560 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
1561 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
1562 .access = PL1_RW,
1563 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
1564 .resetvalue = 0,
1566 /* per-timer control */
1567 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1568 .secure = ARM_CP_SECSTATE_NS,
1569 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1570 .accessfn = gt_ptimer_access,
1571 .fieldoffset = offsetoflow32(CPUARMState,
1572 cp15.c14_timer[GTIMER_PHYS].ctl),
1573 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
1575 { .name = "CNTP_CTL(S)",
1576 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1577 .secure = ARM_CP_SECSTATE_S,
1578 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1579 .accessfn = gt_ptimer_access,
1580 .fieldoffset = offsetoflow32(CPUARMState,
1581 cp15.c14_timer[GTIMER_SEC].ctl),
1582 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
1584 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
1585 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
1586 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1587 .accessfn = gt_ptimer_access,
1588 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
1589 .resetvalue = 0,
1590 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
1592 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
1593 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
1594 .accessfn = gt_vtimer_access,
1595 .fieldoffset = offsetoflow32(CPUARMState,
1596 cp15.c14_timer[GTIMER_VIRT].ctl),
1597 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
1599 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
1600 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
1601 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1602 .accessfn = gt_vtimer_access,
1603 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
1604 .resetvalue = 0,
1605 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
1607 /* TimerValue views: a 32 bit downcounting view of the underlying state */
1608 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1609 .secure = ARM_CP_SECSTATE_NS,
1610 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1611 .accessfn = gt_ptimer_access,
1612 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
1614 { .name = "CNTP_TVAL(S)",
1615 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1616 .secure = ARM_CP_SECSTATE_S,
1617 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1618 .accessfn = gt_ptimer_access,
1619 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
1621 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1622 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
1623 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1624 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
1625 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
1627 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
1628 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1629 .accessfn = gt_vtimer_access,
1630 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
1632 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1633 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
1634 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
1635 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
1636 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
1638 /* The counter itself */
1639 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
1640 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
1641 .accessfn = gt_pct_access,
1642 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1644 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
1645 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
1646 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
1647 .accessfn = gt_pct_access, .readfn = gt_cnt_read,
1649 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
1650 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
1651 .accessfn = gt_vct_access,
1652 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
1654 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
1655 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
1656 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
1657 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
1659 /* Comparison value, indicating when the timer goes off */
1660 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
1661 .secure = ARM_CP_SECSTATE_NS,
1662 .access = PL1_RW | PL0_R,
1663 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1664 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1665 .accessfn = gt_ptimer_access,
1666 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
1668 { .name = "CNTP_CVAL(S)", .cp = 15, .crm = 14, .opc1 = 2,
1669 .secure = ARM_CP_SECSTATE_S,
1670 .access = PL1_RW | PL0_R,
1671 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1672 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
1673 .accessfn = gt_ptimer_access,
1674 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
1676 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1677 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
1678 .access = PL1_RW | PL0_R,
1679 .type = ARM_CP_IO,
1680 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1681 .resetvalue = 0, .accessfn = gt_ptimer_access,
1682 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
1684 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
1685 .access = PL1_RW | PL0_R,
1686 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
1687 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1688 .accessfn = gt_vtimer_access,
1689 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
1691 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1692 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
1693 .access = PL1_RW | PL0_R,
1694 .type = ARM_CP_IO,
1695 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1696 .resetvalue = 0, .accessfn = gt_vtimer_access,
1697 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
1699 /* Secure timer -- this is actually restricted to only EL3
1700 * and configurably Secure-EL1 via the accessfn.
1702 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
1703 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
1704 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW,
1705 .accessfn = gt_stimer_access,
1706 .readfn = gt_sec_tval_read,
1707 .writefn = gt_sec_tval_write,
1708 .resetfn = gt_sec_timer_reset,
1710 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
1711 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
1712 .type = ARM_CP_IO, .access = PL1_RW,
1713 .accessfn = gt_stimer_access,
1714 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
1715 .resetvalue = 0,
1716 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
1718 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
1719 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
1720 .type = ARM_CP_IO, .access = PL1_RW,
1721 .accessfn = gt_stimer_access,
1722 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
1723 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
1725 REGINFO_SENTINEL
1728 #else
1729 /* In user-mode none of the generic timer registers are accessible,
1730 * and their implementation depends on QEMU_CLOCK_VIRTUAL and qdev gpio outputs,
1731 * so instead just don't register any of them.
1733 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1734 REGINFO_SENTINEL
1737 #endif
1739 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1741 if (arm_feature(env, ARM_FEATURE_LPAE)) {
1742 raw_write(env, ri, value);
1743 } else if (arm_feature(env, ARM_FEATURE_V7)) {
1744 raw_write(env, ri, value & 0xfffff6ff);
1745 } else {
1746 raw_write(env, ri, value & 0xfffff1ff);
1750 #ifndef CONFIG_USER_ONLY
1751 /* get_phys_addr() isn't present for user-mode-only targets */
1753 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri)
1755 if (ri->opc2 & 4) {
1756 /* The ATS12NSO* operations must trap to EL3 if executed in
1757 * Secure EL1 (which can only happen if EL3 is AArch64).
1758 * They are simply UNDEF if executed from NS EL1.
1759 * They function normally from EL2 or EL3.
1761 if (arm_current_el(env) == 1) {
1762 if (arm_is_secure_below_el3(env)) {
1763 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3;
1765 return CP_ACCESS_TRAP_UNCATEGORIZED;
1768 return CP_ACCESS_OK;
1771 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
1772 int access_type, ARMMMUIdx mmu_idx)
1774 hwaddr phys_addr;
1775 target_ulong page_size;
1776 int prot;
1777 uint32_t fsr;
1778 bool ret;
1779 uint64_t par64;
1780 MemTxAttrs attrs = {};
1782 ret = get_phys_addr(env, value, access_type, mmu_idx,
1783 &phys_addr, &attrs, &prot, &page_size, &fsr);
1784 if (extended_addresses_enabled(env)) {
1785 /* fsr is a DFSR/IFSR value for the long descriptor
1786 * translation table format, but with WnR always clear.
1787 * Convert it to a 64-bit PAR.
1789 par64 = (1 << 11); /* LPAE bit always set */
1790 if (!ret) {
1791 par64 |= phys_addr & ~0xfffULL;
1792 if (!attrs.secure) {
1793 par64 |= (1 << 9); /* NS */
1795 /* We don't set the ATTR or SH fields in the PAR. */
1796 } else {
1797 par64 |= 1; /* F */
1798 par64 |= (fsr & 0x3f) << 1; /* FS */
1799 /* Note that S2WLK and FSTAGE are always zero, because we don't
1800 * implement virtualization and therefore there can't be a stage 2
1801 * fault.
1804 } else {
1805 /* fsr is a DFSR/IFSR value for the short descriptor
1806 * translation table format (with WnR always clear).
1807 * Convert it to a 32-bit PAR.
1809 if (!ret) {
1810 /* We do not set any attribute bits in the PAR */
1811 if (page_size == (1 << 24)
1812 && arm_feature(env, ARM_FEATURE_V7)) {
1813 par64 = (phys_addr & 0xff000000) | (1 << 1);
1814 } else {
1815 par64 = phys_addr & 0xfffff000;
1817 if (!attrs.secure) {
1818 par64 |= (1 << 9); /* NS */
1820 } else {
1821 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
1822 ((fsr & 0xf) << 1) | 1;
1825 return par64;
1828 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1830 int access_type = ri->opc2 & 1;
1831 uint64_t par64;
1832 ARMMMUIdx mmu_idx;
1833 int el = arm_current_el(env);
1834 bool secure = arm_is_secure_below_el3(env);
1836 switch (ri->opc2 & 6) {
1837 case 0:
1838 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */
1839 switch (el) {
1840 case 3:
1841 mmu_idx = ARMMMUIdx_S1E3;
1842 break;
1843 case 2:
1844 mmu_idx = ARMMMUIdx_S1NSE1;
1845 break;
1846 case 1:
1847 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
1848 break;
1849 default:
1850 g_assert_not_reached();
1852 break;
1853 case 2:
1854 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
1855 switch (el) {
1856 case 3:
1857 mmu_idx = ARMMMUIdx_S1SE0;
1858 break;
1859 case 2:
1860 mmu_idx = ARMMMUIdx_S1NSE0;
1861 break;
1862 case 1:
1863 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
1864 break;
1865 default:
1866 g_assert_not_reached();
1868 break;
1869 case 4:
1870 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
1871 mmu_idx = ARMMMUIdx_S12NSE1;
1872 break;
1873 case 6:
1874 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
1875 mmu_idx = ARMMMUIdx_S12NSE0;
1876 break;
1877 default:
1878 g_assert_not_reached();
1881 par64 = do_ats_write(env, value, access_type, mmu_idx);
1883 A32_BANKED_CURRENT_REG_SET(env, par, par64);
1886 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
1887 uint64_t value)
1889 int access_type = ri->opc2 & 1;
1890 uint64_t par64;
1892 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S2NS);
1894 A32_BANKED_CURRENT_REG_SET(env, par, par64);
1897 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri)
1899 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) {
1900 return CP_ACCESS_TRAP;
1902 return CP_ACCESS_OK;
1905 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
1906 uint64_t value)
1908 int access_type = ri->opc2 & 1;
1909 ARMMMUIdx mmu_idx;
1910 int secure = arm_is_secure_below_el3(env);
1912 switch (ri->opc2 & 6) {
1913 case 0:
1914 switch (ri->opc1) {
1915 case 0: /* AT S1E1R, AT S1E1W */
1916 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
1917 break;
1918 case 4: /* AT S1E2R, AT S1E2W */
1919 mmu_idx = ARMMMUIdx_S1E2;
1920 break;
1921 case 6: /* AT S1E3R, AT S1E3W */
1922 mmu_idx = ARMMMUIdx_S1E3;
1923 break;
1924 default:
1925 g_assert_not_reached();
1927 break;
1928 case 2: /* AT S1E0R, AT S1E0W */
1929 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
1930 break;
1931 case 4: /* AT S12E1R, AT S12E1W */
1932 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1;
1933 break;
1934 case 6: /* AT S12E0R, AT S12E0W */
1935 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0;
1936 break;
1937 default:
1938 g_assert_not_reached();
1941 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
1943 #endif
1945 static const ARMCPRegInfo vapa_cp_reginfo[] = {
1946 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
1947 .access = PL1_RW, .resetvalue = 0,
1948 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
1949 offsetoflow32(CPUARMState, cp15.par_ns) },
1950 .writefn = par_write },
1951 #ifndef CONFIG_USER_ONLY
1952 /* This underdecoding is safe because the reginfo is NO_RAW. */
1953 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
1954 .access = PL1_W, .accessfn = ats_access,
1955 .writefn = ats_write, .type = ARM_CP_NO_RAW },
1956 #endif
1957 REGINFO_SENTINEL
1960 /* Return basic MPU access permission bits. */
1961 static uint32_t simple_mpu_ap_bits(uint32_t val)
1963 uint32_t ret;
1964 uint32_t mask;
1965 int i;
1966 ret = 0;
1967 mask = 3;
1968 for (i = 0; i < 16; i += 2) {
1969 ret |= (val >> i) & mask;
1970 mask <<= 2;
1972 return ret;
1975 /* Pad basic MPU access permission bits to extended format. */
1976 static uint32_t extended_mpu_ap_bits(uint32_t val)
1978 uint32_t ret;
1979 uint32_t mask;
1980 int i;
1981 ret = 0;
1982 mask = 3;
1983 for (i = 0; i < 16; i += 2) {
1984 ret |= (val & mask) << i;
1985 mask <<= 2;
1987 return ret;
1990 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1991 uint64_t value)
1993 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
1996 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1998 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
2001 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
2002 uint64_t value)
2004 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
2007 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
2009 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
2012 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
2014 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
2016 if (!u32p) {
2017 return 0;
2020 u32p += env->cp15.c6_rgnr;
2021 return *u32p;
2024 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
2025 uint64_t value)
2027 ARMCPU *cpu = arm_env_get_cpu(env);
2028 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
2030 if (!u32p) {
2031 return;
2034 u32p += env->cp15.c6_rgnr;
2035 tlb_flush(CPU(cpu), 1); /* Mappings may have changed - purge! */
2036 *u32p = value;
2039 static void pmsav7_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2041 ARMCPU *cpu = arm_env_get_cpu(env);
2042 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
2044 if (!u32p) {
2045 return;
2048 memset(u32p, 0, sizeof(*u32p) * cpu->pmsav7_dregion);
2051 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2052 uint64_t value)
2054 ARMCPU *cpu = arm_env_get_cpu(env);
2055 uint32_t nrgs = cpu->pmsav7_dregion;
2057 if (value >= nrgs) {
2058 qemu_log_mask(LOG_GUEST_ERROR,
2059 "PMSAv7 RGNR write >= # supported regions, %" PRIu32
2060 " > %" PRIu32 "\n", (uint32_t)value, nrgs);
2061 return;
2064 raw_write(env, ri, value);
2067 static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
2068 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
2069 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2070 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
2071 .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2072 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
2073 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2074 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
2075 .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2076 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
2077 .access = PL1_RW, .type = ARM_CP_NO_RAW,
2078 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
2079 .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
2080 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
2081 .access = PL1_RW,
2082 .fieldoffset = offsetof(CPUARMState, cp15.c6_rgnr),
2083 .writefn = pmsav7_rgnr_write },
2084 REGINFO_SENTINEL
2087 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
2088 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2089 .access = PL1_RW, .type = ARM_CP_ALIAS,
2090 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2091 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
2092 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2093 .access = PL1_RW, .type = ARM_CP_ALIAS,
2094 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2095 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
2096 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
2097 .access = PL1_RW,
2098 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2099 .resetvalue = 0, },
2100 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
2101 .access = PL1_RW,
2102 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2103 .resetvalue = 0, },
2104 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
2105 .access = PL1_RW,
2106 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
2107 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
2108 .access = PL1_RW,
2109 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
2110 /* Protection region base and size registers */
2111 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
2112 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2113 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
2114 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
2115 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2116 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
2117 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
2118 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2119 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
2120 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
2121 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2122 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
2123 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
2124 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2125 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
2126 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
2127 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2128 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
2129 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
2130 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2131 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
2132 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
2133 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2134 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
2135 REGINFO_SENTINEL
2138 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
2139 uint64_t value)
2141 TCR *tcr = raw_ptr(env, ri);
2142 int maskshift = extract32(value, 0, 3);
2144 if (!arm_feature(env, ARM_FEATURE_V8)) {
2145 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
2146 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
2147 * using Long-desciptor translation table format */
2148 value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
2149 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
2150 /* In an implementation that includes the Security Extensions
2151 * TTBCR has additional fields PD0 [4] and PD1 [5] for
2152 * Short-descriptor translation table format.
2154 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
2155 } else {
2156 value &= TTBCR_N;
2160 /* Update the masks corresponding to the TCR bank being written
2161 * Note that we always calculate mask and base_mask, but
2162 * they are only used for short-descriptor tables (ie if EAE is 0);
2163 * for long-descriptor tables the TCR fields are used differently
2164 * and the mask and base_mask values are meaningless.
2166 tcr->raw_tcr = value;
2167 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
2168 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
2171 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2172 uint64_t value)
2174 ARMCPU *cpu = arm_env_get_cpu(env);
2176 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2177 /* With LPAE the TTBCR could result in a change of ASID
2178 * via the TTBCR.A1 bit, so do a TLB flush.
2180 tlb_flush(CPU(cpu), 1);
2182 vmsa_ttbcr_raw_write(env, ri, value);
2185 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2187 TCR *tcr = raw_ptr(env, ri);
2189 /* Reset both the TCR as well as the masks corresponding to the bank of
2190 * the TCR being reset.
2192 tcr->raw_tcr = 0;
2193 tcr->mask = 0;
2194 tcr->base_mask = 0xffffc000u;
2197 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2198 uint64_t value)
2200 ARMCPU *cpu = arm_env_get_cpu(env);
2201 TCR *tcr = raw_ptr(env, ri);
2203 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
2204 tlb_flush(CPU(cpu), 1);
2205 tcr->raw_tcr = value;
2208 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2209 uint64_t value)
2211 /* 64 bit accesses to the TTBRs can change the ASID and so we
2212 * must flush the TLB.
2214 if (cpreg_field_is_64bit(ri)) {
2215 ARMCPU *cpu = arm_env_get_cpu(env);
2217 tlb_flush(CPU(cpu), 1);
2219 raw_write(env, ri, value);
2222 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2223 uint64_t value)
2225 ARMCPU *cpu = arm_env_get_cpu(env);
2226 CPUState *cs = CPU(cpu);
2228 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */
2229 if (raw_read(env, ri) != value) {
2230 tlb_flush_by_mmuidx(cs, ARMMMUIdx_S12NSE1, ARMMMUIdx_S12NSE0,
2231 ARMMMUIdx_S2NS, -1);
2232 raw_write(env, ri, value);
2236 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
2237 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2238 .access = PL1_RW, .type = ARM_CP_ALIAS,
2239 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
2240 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
2241 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2242 .access = PL1_RW, .resetvalue = 0,
2243 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
2244 offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
2245 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
2246 .access = PL1_RW, .resetvalue = 0,
2247 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
2248 offsetof(CPUARMState, cp15.dfar_ns) } },
2249 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
2250 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
2251 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
2252 .resetvalue = 0, },
2253 REGINFO_SENTINEL
2256 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
2257 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
2258 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
2259 .access = PL1_RW,
2260 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
2261 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
2262 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
2263 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
2264 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
2265 offsetof(CPUARMState, cp15.ttbr0_ns) } },
2266 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
2267 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
2268 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
2269 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
2270 offsetof(CPUARMState, cp15.ttbr1_ns) } },
2271 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
2272 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2273 .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
2274 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
2275 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
2276 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2277 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
2278 .raw_writefn = vmsa_ttbcr_raw_write,
2279 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
2280 offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
2281 REGINFO_SENTINEL
2284 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
2285 uint64_t value)
2287 env->cp15.c15_ticonfig = value & 0xe7;
2288 /* The OS_TYPE bit in this register changes the reported CPUID! */
2289 env->cp15.c0_cpuid = (value & (1 << 5)) ?
2290 ARM_CPUID_TI915T : ARM_CPUID_TI925T;
2293 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
2294 uint64_t value)
2296 env->cp15.c15_threadid = value & 0xffff;
2299 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
2300 uint64_t value)
2302 /* Wait-for-interrupt (deprecated) */
2303 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT);
2306 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
2307 uint64_t value)
2309 /* On OMAP there are registers indicating the max/min index of dcache lines
2310 * containing a dirty line; cache flush operations have to reset these.
2312 env->cp15.c15_i_max = 0x000;
2313 env->cp15.c15_i_min = 0xff0;
2316 static const ARMCPRegInfo omap_cp_reginfo[] = {
2317 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
2318 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
2319 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
2320 .resetvalue = 0, },
2321 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
2322 .access = PL1_RW, .type = ARM_CP_NOP },
2323 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
2324 .access = PL1_RW,
2325 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
2326 .writefn = omap_ticonfig_write },
2327 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
2328 .access = PL1_RW,
2329 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
2330 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
2331 .access = PL1_RW, .resetvalue = 0xff0,
2332 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
2333 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
2334 .access = PL1_RW,
2335 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
2336 .writefn = omap_threadid_write },
2337 { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
2338 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
2339 .type = ARM_CP_NO_RAW,
2340 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
2341 /* TODO: Peripheral port remap register:
2342 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
2343 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
2344 * when MMU is off.
2346 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
2347 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
2348 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW,
2349 .writefn = omap_cachemaint_write },
2350 { .name = "C9", .cp = 15, .crn = 9,
2351 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
2352 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
2353 REGINFO_SENTINEL
2356 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
2357 uint64_t value)
2359 env->cp15.c15_cpar = value & 0x3fff;
2362 static const ARMCPRegInfo xscale_cp_reginfo[] = {
2363 { .name = "XSCALE_CPAR",
2364 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
2365 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
2366 .writefn = xscale_cpar_write, },
2367 { .name = "XSCALE_AUXCR",
2368 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
2369 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
2370 .resetvalue = 0, },
2371 /* XScale specific cache-lockdown: since we have no cache we NOP these
2372 * and hope the guest does not really rely on cache behaviour.
2374 { .name = "XSCALE_LOCK_ICACHE_LINE",
2375 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
2376 .access = PL1_W, .type = ARM_CP_NOP },
2377 { .name = "XSCALE_UNLOCK_ICACHE",
2378 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
2379 .access = PL1_W, .type = ARM_CP_NOP },
2380 { .name = "XSCALE_DCACHE_LOCK",
2381 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
2382 .access = PL1_RW, .type = ARM_CP_NOP },
2383 { .name = "XSCALE_UNLOCK_DCACHE",
2384 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
2385 .access = PL1_W, .type = ARM_CP_NOP },
2386 REGINFO_SENTINEL
2389 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
2390 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
2391 * implementation of this implementation-defined space.
2392 * Ideally this should eventually disappear in favour of actually
2393 * implementing the correct behaviour for all cores.
2395 { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
2396 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
2397 .access = PL1_RW,
2398 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
2399 .resetvalue = 0 },
2400 REGINFO_SENTINEL
2403 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
2404 /* Cache status: RAZ because we have no cache so it's always clean */
2405 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
2406 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2407 .resetvalue = 0 },
2408 REGINFO_SENTINEL
2411 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
2412 /* We never have a a block transfer operation in progress */
2413 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
2414 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2415 .resetvalue = 0 },
2416 /* The cache ops themselves: these all NOP for QEMU */
2417 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
2418 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2419 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
2420 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2421 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
2422 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2423 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
2424 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2425 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
2426 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2427 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
2428 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
2429 REGINFO_SENTINEL
2432 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
2433 /* The cache test-and-clean instructions always return (1 << 30)
2434 * to indicate that there are no dirty cache lines.
2436 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
2437 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2438 .resetvalue = (1 << 30) },
2439 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
2440 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
2441 .resetvalue = (1 << 30) },
2442 REGINFO_SENTINEL
2445 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
2446 /* Ignore ReadBuffer accesses */
2447 { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
2448 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
2449 .access = PL1_RW, .resetvalue = 0,
2450 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
2451 REGINFO_SENTINEL
2454 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2456 ARMCPU *cpu = arm_env_get_cpu(env);
2457 unsigned int cur_el = arm_current_el(env);
2458 bool secure = arm_is_secure(env);
2460 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
2461 return env->cp15.vpidr_el2;
2463 return raw_read(env, ri);
2466 static uint64_t mpidr_read_val(CPUARMState *env)
2468 ARMCPU *cpu = ARM_CPU(arm_env_get_cpu(env));
2469 uint64_t mpidr = cpu->mp_affinity;
2471 if (arm_feature(env, ARM_FEATURE_V7MP)) {
2472 mpidr |= (1U << 31);
2473 /* Cores which are uniprocessor (non-coherent)
2474 * but still implement the MP extensions set
2475 * bit 30. (For instance, Cortex-R5).
2477 if (cpu->mp_is_up) {
2478 mpidr |= (1u << 30);
2481 return mpidr;
2484 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2486 unsigned int cur_el = arm_current_el(env);
2487 bool secure = arm_is_secure(env);
2489 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
2490 return env->cp15.vmpidr_el2;
2492 return mpidr_read_val(env);
2495 static const ARMCPRegInfo mpidr_cp_reginfo[] = {
2496 { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
2497 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
2498 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
2499 REGINFO_SENTINEL
2502 static const ARMCPRegInfo lpae_cp_reginfo[] = {
2503 /* NOP AMAIR0/1 */
2504 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
2505 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
2506 .access = PL1_RW, .type = ARM_CP_CONST,
2507 .resetvalue = 0 },
2508 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
2509 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
2510 .access = PL1_RW, .type = ARM_CP_CONST,
2511 .resetvalue = 0 },
2512 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
2513 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
2514 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
2515 offsetof(CPUARMState, cp15.par_ns)} },
2516 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
2517 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
2518 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
2519 offsetof(CPUARMState, cp15.ttbr0_ns) },
2520 .writefn = vmsa_ttbr_write, },
2521 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
2522 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
2523 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
2524 offsetof(CPUARMState, cp15.ttbr1_ns) },
2525 .writefn = vmsa_ttbr_write, },
2526 REGINFO_SENTINEL
2529 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2531 return vfp_get_fpcr(env);
2534 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2535 uint64_t value)
2537 vfp_set_fpcr(env, value);
2540 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2542 return vfp_get_fpsr(env);
2545 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2546 uint64_t value)
2548 vfp_set_fpsr(env, value);
2551 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri)
2553 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
2554 return CP_ACCESS_TRAP;
2556 return CP_ACCESS_OK;
2559 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
2560 uint64_t value)
2562 env->daif = value & PSTATE_DAIF;
2565 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
2566 const ARMCPRegInfo *ri)
2568 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
2569 * SCTLR_EL1.UCI is set.
2571 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) {
2572 return CP_ACCESS_TRAP;
2574 return CP_ACCESS_OK;
2577 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
2578 * Page D4-1736 (DDI0487A.b)
2581 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2582 uint64_t value)
2584 ARMCPU *cpu = arm_env_get_cpu(env);
2585 CPUState *cs = CPU(cpu);
2587 if (arm_is_secure_below_el3(env)) {
2588 tlb_flush_by_mmuidx(cs, ARMMMUIdx_S1SE1, ARMMMUIdx_S1SE0, -1);
2589 } else {
2590 tlb_flush_by_mmuidx(cs, ARMMMUIdx_S12NSE1, ARMMMUIdx_S12NSE0, -1);
2594 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2595 uint64_t value)
2597 bool sec = arm_is_secure_below_el3(env);
2598 CPUState *other_cs;
2600 CPU_FOREACH(other_cs) {
2601 if (sec) {
2602 tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S1SE1, ARMMMUIdx_S1SE0, -1);
2603 } else {
2604 tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S12NSE1,
2605 ARMMMUIdx_S12NSE0, -1);
2610 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2611 uint64_t value)
2613 /* Note that the 'ALL' scope must invalidate both stage 1 and
2614 * stage 2 translations, whereas most other scopes only invalidate
2615 * stage 1 translations.
2617 ARMCPU *cpu = arm_env_get_cpu(env);
2618 CPUState *cs = CPU(cpu);
2620 if (arm_is_secure_below_el3(env)) {
2621 tlb_flush_by_mmuidx(cs, ARMMMUIdx_S1SE1, ARMMMUIdx_S1SE0, -1);
2622 } else {
2623 if (arm_feature(env, ARM_FEATURE_EL2)) {
2624 tlb_flush_by_mmuidx(cs, ARMMMUIdx_S12NSE1, ARMMMUIdx_S12NSE0,
2625 ARMMMUIdx_S2NS, -1);
2626 } else {
2627 tlb_flush_by_mmuidx(cs, ARMMMUIdx_S12NSE1, ARMMMUIdx_S12NSE0, -1);
2632 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
2633 uint64_t value)
2635 ARMCPU *cpu = arm_env_get_cpu(env);
2636 CPUState *cs = CPU(cpu);
2638 tlb_flush_by_mmuidx(cs, ARMMMUIdx_S1E2, -1);
2641 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
2642 uint64_t value)
2644 ARMCPU *cpu = arm_env_get_cpu(env);
2645 CPUState *cs = CPU(cpu);
2647 tlb_flush_by_mmuidx(cs, ARMMMUIdx_S1E3, -1);
2650 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2651 uint64_t value)
2653 /* Note that the 'ALL' scope must invalidate both stage 1 and
2654 * stage 2 translations, whereas most other scopes only invalidate
2655 * stage 1 translations.
2657 bool sec = arm_is_secure_below_el3(env);
2658 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2);
2659 CPUState *other_cs;
2661 CPU_FOREACH(other_cs) {
2662 if (sec) {
2663 tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S1SE1, ARMMMUIdx_S1SE0, -1);
2664 } else if (has_el2) {
2665 tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S12NSE1,
2666 ARMMMUIdx_S12NSE0, ARMMMUIdx_S2NS, -1);
2667 } else {
2668 tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S12NSE1,
2669 ARMMMUIdx_S12NSE0, -1);
2674 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2675 uint64_t value)
2677 CPUState *other_cs;
2679 CPU_FOREACH(other_cs) {
2680 tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S1E2, -1);
2684 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2685 uint64_t value)
2687 CPUState *other_cs;
2689 CPU_FOREACH(other_cs) {
2690 tlb_flush_by_mmuidx(other_cs, ARMMMUIdx_S1E3, -1);
2694 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2695 uint64_t value)
2697 /* Invalidate by VA, EL1&0 (AArch64 version).
2698 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1,
2699 * since we don't support flush-for-specific-ASID-only or
2700 * flush-last-level-only.
2702 ARMCPU *cpu = arm_env_get_cpu(env);
2703 CPUState *cs = CPU(cpu);
2704 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2706 if (arm_is_secure_below_el3(env)) {
2707 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S1SE1,
2708 ARMMMUIdx_S1SE0, -1);
2709 } else {
2710 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S12NSE1,
2711 ARMMMUIdx_S12NSE0, -1);
2715 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
2716 uint64_t value)
2718 /* Invalidate by VA, EL2
2719 * Currently handles both VAE2 and VALE2, since we don't support
2720 * flush-last-level-only.
2722 ARMCPU *cpu = arm_env_get_cpu(env);
2723 CPUState *cs = CPU(cpu);
2724 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2726 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S1E2, -1);
2729 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
2730 uint64_t value)
2732 /* Invalidate by VA, EL3
2733 * Currently handles both VAE3 and VALE3, since we don't support
2734 * flush-last-level-only.
2736 ARMCPU *cpu = arm_env_get_cpu(env);
2737 CPUState *cs = CPU(cpu);
2738 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2740 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S1E3, -1);
2743 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2744 uint64_t value)
2746 bool sec = arm_is_secure_below_el3(env);
2747 CPUState *other_cs;
2748 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2750 CPU_FOREACH(other_cs) {
2751 if (sec) {
2752 tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S1SE1,
2753 ARMMMUIdx_S1SE0, -1);
2754 } else {
2755 tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S12NSE1,
2756 ARMMMUIdx_S12NSE0, -1);
2761 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2762 uint64_t value)
2764 CPUState *other_cs;
2765 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2767 CPU_FOREACH(other_cs) {
2768 tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S1E2, -1);
2772 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2773 uint64_t value)
2775 CPUState *other_cs;
2776 uint64_t pageaddr = sextract64(value << 12, 0, 56);
2778 CPU_FOREACH(other_cs) {
2779 tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S1E3, -1);
2783 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
2784 uint64_t value)
2786 /* Invalidate by IPA. This has to invalidate any structures that
2787 * contain only stage 2 translation information, but does not need
2788 * to apply to structures that contain combined stage 1 and stage 2
2789 * translation information.
2790 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
2792 ARMCPU *cpu = arm_env_get_cpu(env);
2793 CPUState *cs = CPU(cpu);
2794 uint64_t pageaddr;
2796 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
2797 return;
2800 pageaddr = sextract64(value << 12, 0, 48);
2802 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdx_S2NS, -1);
2805 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
2806 uint64_t value)
2808 CPUState *other_cs;
2809 uint64_t pageaddr;
2811 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
2812 return;
2815 pageaddr = sextract64(value << 12, 0, 48);
2817 CPU_FOREACH(other_cs) {
2818 tlb_flush_page_by_mmuidx(other_cs, pageaddr, ARMMMUIdx_S2NS, -1);
2822 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri)
2824 /* We don't implement EL2, so the only control on DC ZVA is the
2825 * bit in the SCTLR which can prohibit access for EL0.
2827 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
2828 return CP_ACCESS_TRAP;
2830 return CP_ACCESS_OK;
2833 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
2835 ARMCPU *cpu = arm_env_get_cpu(env);
2836 int dzp_bit = 1 << 4;
2838 /* DZP indicates whether DC ZVA access is allowed */
2839 if (aa64_zva_access(env, NULL) == CP_ACCESS_OK) {
2840 dzp_bit = 0;
2842 return cpu->dcz_blocksize | dzp_bit;
2845 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
2847 if (!(env->pstate & PSTATE_SP)) {
2848 /* Access to SP_EL0 is undefined if it's being used as
2849 * the stack pointer.
2851 return CP_ACCESS_TRAP_UNCATEGORIZED;
2853 return CP_ACCESS_OK;
2856 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
2858 return env->pstate & PSTATE_SP;
2861 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
2863 update_spsel(env, val);
2866 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2867 uint64_t value)
2869 ARMCPU *cpu = arm_env_get_cpu(env);
2871 if (raw_read(env, ri) == value) {
2872 /* Skip the TLB flush if nothing actually changed; Linux likes
2873 * to do a lot of pointless SCTLR writes.
2875 return;
2878 raw_write(env, ri, value);
2879 /* ??? Lots of these bits are not implemented. */
2880 /* This may enable/disable the MMU, so do a TLB flush. */
2881 tlb_flush(CPU(cpu), 1);
2884 static const ARMCPRegInfo v8_cp_reginfo[] = {
2885 /* Minimal set of EL0-visible registers. This will need to be expanded
2886 * significantly for system emulation of AArch64 CPUs.
2888 { .name = "NZCV", .state = ARM_CP_STATE_AA64,
2889 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
2890 .access = PL0_RW, .type = ARM_CP_NZCV },
2891 { .name = "DAIF", .state = ARM_CP_STATE_AA64,
2892 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
2893 .type = ARM_CP_NO_RAW,
2894 .access = PL0_RW, .accessfn = aa64_daif_access,
2895 .fieldoffset = offsetof(CPUARMState, daif),
2896 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
2897 { .name = "FPCR", .state = ARM_CP_STATE_AA64,
2898 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
2899 .access = PL0_RW, .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
2900 { .name = "FPSR", .state = ARM_CP_STATE_AA64,
2901 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
2902 .access = PL0_RW, .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
2903 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
2904 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
2905 .access = PL0_R, .type = ARM_CP_NO_RAW,
2906 .readfn = aa64_dczid_read },
2907 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
2908 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
2909 .access = PL0_W, .type = ARM_CP_DC_ZVA,
2910 #ifndef CONFIG_USER_ONLY
2911 /* Avoid overhead of an access check that always passes in user-mode */
2912 .accessfn = aa64_zva_access,
2913 #endif
2915 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
2916 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
2917 .access = PL1_R, .type = ARM_CP_CURRENTEL },
2918 /* Cache ops: all NOPs since we don't emulate caches */
2919 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
2920 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2921 .access = PL1_W, .type = ARM_CP_NOP },
2922 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
2923 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2924 .access = PL1_W, .type = ARM_CP_NOP },
2925 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
2926 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
2927 .access = PL0_W, .type = ARM_CP_NOP,
2928 .accessfn = aa64_cacheop_access },
2929 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
2930 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2931 .access = PL1_W, .type = ARM_CP_NOP },
2932 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
2933 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2934 .access = PL1_W, .type = ARM_CP_NOP },
2935 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
2936 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
2937 .access = PL0_W, .type = ARM_CP_NOP,
2938 .accessfn = aa64_cacheop_access },
2939 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
2940 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2941 .access = PL1_W, .type = ARM_CP_NOP },
2942 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
2943 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
2944 .access = PL0_W, .type = ARM_CP_NOP,
2945 .accessfn = aa64_cacheop_access },
2946 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
2947 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
2948 .access = PL0_W, .type = ARM_CP_NOP,
2949 .accessfn = aa64_cacheop_access },
2950 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
2951 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2952 .access = PL1_W, .type = ARM_CP_NOP },
2953 /* TLBI operations */
2954 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
2955 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2956 .access = PL1_W, .type = ARM_CP_NO_RAW,
2957 .writefn = tlbi_aa64_vmalle1is_write },
2958 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
2959 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2960 .access = PL1_W, .type = ARM_CP_NO_RAW,
2961 .writefn = tlbi_aa64_vae1is_write },
2962 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
2963 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2964 .access = PL1_W, .type = ARM_CP_NO_RAW,
2965 .writefn = tlbi_aa64_vmalle1is_write },
2966 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
2967 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2968 .access = PL1_W, .type = ARM_CP_NO_RAW,
2969 .writefn = tlbi_aa64_vae1is_write },
2970 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
2971 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2972 .access = PL1_W, .type = ARM_CP_NO_RAW,
2973 .writefn = tlbi_aa64_vae1is_write },
2974 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
2975 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2976 .access = PL1_W, .type = ARM_CP_NO_RAW,
2977 .writefn = tlbi_aa64_vae1is_write },
2978 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
2979 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2980 .access = PL1_W, .type = ARM_CP_NO_RAW,
2981 .writefn = tlbi_aa64_vmalle1_write },
2982 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
2983 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2984 .access = PL1_W, .type = ARM_CP_NO_RAW,
2985 .writefn = tlbi_aa64_vae1_write },
2986 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
2987 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2988 .access = PL1_W, .type = ARM_CP_NO_RAW,
2989 .writefn = tlbi_aa64_vmalle1_write },
2990 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
2991 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2992 .access = PL1_W, .type = ARM_CP_NO_RAW,
2993 .writefn = tlbi_aa64_vae1_write },
2994 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
2995 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2996 .access = PL1_W, .type = ARM_CP_NO_RAW,
2997 .writefn = tlbi_aa64_vae1_write },
2998 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
2999 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
3000 .access = PL1_W, .type = ARM_CP_NO_RAW,
3001 .writefn = tlbi_aa64_vae1_write },
3002 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
3003 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
3004 .access = PL2_W, .type = ARM_CP_NO_RAW,
3005 .writefn = tlbi_aa64_ipas2e1is_write },
3006 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
3007 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
3008 .access = PL2_W, .type = ARM_CP_NO_RAW,
3009 .writefn = tlbi_aa64_ipas2e1is_write },
3010 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
3011 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
3012 .access = PL2_W, .type = ARM_CP_NO_RAW,
3013 .writefn = tlbi_aa64_alle1is_write },
3014 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64,
3015 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6,
3016 .access = PL2_W, .type = ARM_CP_NO_RAW,
3017 .writefn = tlbi_aa64_alle1is_write },
3018 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
3019 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
3020 .access = PL2_W, .type = ARM_CP_NO_RAW,
3021 .writefn = tlbi_aa64_ipas2e1_write },
3022 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
3023 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
3024 .access = PL2_W, .type = ARM_CP_NO_RAW,
3025 .writefn = tlbi_aa64_ipas2e1_write },
3026 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
3027 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
3028 .access = PL2_W, .type = ARM_CP_NO_RAW,
3029 .writefn = tlbi_aa64_alle1_write },
3030 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64,
3031 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6,
3032 .access = PL2_W, .type = ARM_CP_NO_RAW,
3033 .writefn = tlbi_aa64_alle1is_write },
3034 #ifndef CONFIG_USER_ONLY
3035 /* 64 bit address translation operations */
3036 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
3037 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
3038 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3039 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
3040 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
3041 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3042 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
3043 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
3044 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3045 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
3046 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
3047 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3048 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
3049 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
3050 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3051 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
3052 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
3053 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3054 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
3055 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
3056 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3057 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
3058 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
3059 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3060 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
3061 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
3062 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
3063 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3064 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
3065 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
3066 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3067 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
3068 .type = ARM_CP_ALIAS,
3069 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
3070 .access = PL1_RW, .resetvalue = 0,
3071 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
3072 .writefn = par_write },
3073 #endif
3074 /* TLB invalidate last level of translation table walk */
3075 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
3076 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
3077 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
3078 .type = ARM_CP_NO_RAW, .access = PL1_W,
3079 .writefn = tlbimvaa_is_write },
3080 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
3081 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
3082 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
3083 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
3084 /* 32 bit cache operations */
3085 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
3086 .type = ARM_CP_NOP, .access = PL1_W },
3087 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
3088 .type = ARM_CP_NOP, .access = PL1_W },
3089 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
3090 .type = ARM_CP_NOP, .access = PL1_W },
3091 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
3092 .type = ARM_CP_NOP, .access = PL1_W },
3093 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
3094 .type = ARM_CP_NOP, .access = PL1_W },
3095 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
3096 .type = ARM_CP_NOP, .access = PL1_W },
3097 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
3098 .type = ARM_CP_NOP, .access = PL1_W },
3099 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
3100 .type = ARM_CP_NOP, .access = PL1_W },
3101 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
3102 .type = ARM_CP_NOP, .access = PL1_W },
3103 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
3104 .type = ARM_CP_NOP, .access = PL1_W },
3105 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
3106 .type = ARM_CP_NOP, .access = PL1_W },
3107 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
3108 .type = ARM_CP_NOP, .access = PL1_W },
3109 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
3110 .type = ARM_CP_NOP, .access = PL1_W },
3111 /* MMU Domain access control / MPU write buffer control */
3112 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
3113 .access = PL1_RW, .resetvalue = 0,
3114 .writefn = dacr_write, .raw_writefn = raw_write,
3115 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
3116 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
3117 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
3118 .type = ARM_CP_ALIAS,
3119 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
3120 .access = PL1_RW,
3121 .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
3122 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
3123 .type = ARM_CP_ALIAS,
3124 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
3125 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[1]) },
3126 /* We rely on the access checks not allowing the guest to write to the
3127 * state field when SPSel indicates that it's being used as the stack
3128 * pointer.
3130 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
3131 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
3132 .access = PL1_RW, .accessfn = sp_el0_access,
3133 .type = ARM_CP_ALIAS,
3134 .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
3135 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
3136 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
3137 .access = PL2_RW, .type = ARM_CP_ALIAS,
3138 .fieldoffset = offsetof(CPUARMState, sp_el[1]) },
3139 { .name = "SPSel", .state = ARM_CP_STATE_AA64,
3140 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
3141 .type = ARM_CP_NO_RAW,
3142 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
3143 REGINFO_SENTINEL
3146 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
3147 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
3148 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
3149 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
3150 .access = PL2_RW,
3151 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
3152 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
3153 .type = ARM_CP_NO_RAW,
3154 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
3155 .access = PL2_RW,
3156 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
3157 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
3158 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
3159 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3160 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
3161 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
3162 .access = PL2_RW, .type = ARM_CP_CONST,
3163 .resetvalue = 0 },
3164 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3165 .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
3166 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3167 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
3168 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
3169 .access = PL2_RW, .type = ARM_CP_CONST,
3170 .resetvalue = 0 },
3171 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3172 .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
3173 .access = PL2_RW, .type = ARM_CP_CONST,
3174 .resetvalue = 0 },
3175 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
3176 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
3177 .access = PL2_RW, .type = ARM_CP_CONST,
3178 .resetvalue = 0 },
3179 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
3180 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
3181 .access = PL2_RW, .type = ARM_CP_CONST,
3182 .resetvalue = 0 },
3183 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
3184 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
3185 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3186 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,
3187 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
3188 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
3189 .type = ARM_CP_CONST, .resetvalue = 0 },
3190 { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
3191 .cp = 15, .opc1 = 6, .crm = 2,
3192 .access = PL2_RW, .accessfn = access_el3_aa32ns,
3193 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
3194 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
3195 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
3196 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3197 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
3198 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
3199 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3200 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
3201 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
3202 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3203 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
3204 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
3205 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3206 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
3207 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3208 .resetvalue = 0 },
3209 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
3210 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
3211 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3212 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
3213 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
3214 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3215 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
3216 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3217 .resetvalue = 0 },
3218 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
3219 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
3220 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3221 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
3222 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
3223 .resetvalue = 0 },
3224 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
3225 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
3226 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3227 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
3228 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
3229 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3230 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
3231 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
3232 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
3233 REGINFO_SENTINEL
3236 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
3238 ARMCPU *cpu = arm_env_get_cpu(env);
3239 uint64_t valid_mask = HCR_MASK;
3241 if (arm_feature(env, ARM_FEATURE_EL3)) {
3242 valid_mask &= ~HCR_HCD;
3243 } else {
3244 valid_mask &= ~HCR_TSC;
3247 /* Clear RES0 bits. */
3248 value &= valid_mask;
3250 /* These bits change the MMU setup:
3251 * HCR_VM enables stage 2 translation
3252 * HCR_PTW forbids certain page-table setups
3253 * HCR_DC Disables stage1 and enables stage2 translation
3255 if ((raw_read(env, ri) ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) {
3256 tlb_flush(CPU(cpu), 1);
3258 raw_write(env, ri, value);
3261 static const ARMCPRegInfo el2_cp_reginfo[] = {
3262 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
3263 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
3264 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
3265 .writefn = hcr_write },
3266 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
3267 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
3268 .access = PL2_RW, .resetvalue = 0,
3269 .writefn = dacr_write, .raw_writefn = raw_write,
3270 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
3271 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
3272 .type = ARM_CP_ALIAS,
3273 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
3274 .access = PL2_RW,
3275 .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
3276 { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
3277 .type = ARM_CP_ALIAS,
3278 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
3279 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
3280 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
3281 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
3282 .access = PL2_RW, .resetvalue = 0,
3283 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
3284 { .name = "FAR_EL2", .state = ARM_CP_STATE_AA64,
3285 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
3286 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
3287 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
3288 .type = ARM_CP_ALIAS,
3289 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
3290 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[6]) },
3291 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
3292 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
3293 .access = PL2_RW, .writefn = vbar_write,
3294 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
3295 .resetvalue = 0 },
3296 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
3297 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
3298 .access = PL3_RW, .type = ARM_CP_ALIAS,
3299 .fieldoffset = offsetof(CPUARMState, sp_el[2]) },
3300 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
3301 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
3302 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
3303 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]) },
3304 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
3305 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
3306 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
3307 .resetvalue = 0 },
3308 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3309 .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
3310 .access = PL2_RW, .type = ARM_CP_ALIAS,
3311 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
3312 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
3313 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
3314 .access = PL2_RW, .type = ARM_CP_CONST,
3315 .resetvalue = 0 },
3316 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
3317 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
3318 .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
3319 .access = PL2_RW, .type = ARM_CP_CONST,
3320 .resetvalue = 0 },
3321 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
3322 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
3323 .access = PL2_RW, .type = ARM_CP_CONST,
3324 .resetvalue = 0 },
3325 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
3326 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
3327 .access = PL2_RW, .type = ARM_CP_CONST,
3328 .resetvalue = 0 },
3329 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
3330 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
3331 .access = PL2_RW, .writefn = vmsa_tcr_el1_write,
3332 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
3333 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
3334 { .name = "VTCR", .state = ARM_CP_STATE_AA32,
3335 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
3336 .access = PL2_RW, .accessfn = access_el3_aa32ns,
3337 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
3338 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
3339 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
3340 .access = PL2_RW, .type = ARM_CP_ALIAS,
3341 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
3342 { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
3343 .cp = 15, .opc1 = 6, .crm = 2,
3344 .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3345 .access = PL2_RW, .accessfn = access_el3_aa32ns,
3346 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
3347 .writefn = vttbr_write },
3348 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
3349 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
3350 .access = PL2_RW, .writefn = vttbr_write,
3351 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
3352 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
3353 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
3354 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
3355 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
3356 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
3357 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
3358 .access = PL2_RW, .resetvalue = 0,
3359 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
3360 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
3361 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
3362 .access = PL2_RW, .resetvalue = 0,
3363 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
3364 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
3365 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3366 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
3367 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
3368 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
3369 .type = ARM_CP_NO_RAW, .access = PL2_W,
3370 .writefn = tlbi_aa64_alle2_write },
3371 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
3372 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
3373 .type = ARM_CP_NO_RAW, .access = PL2_W,
3374 .writefn = tlbi_aa64_vae2_write },
3375 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
3376 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
3377 .access = PL2_W, .type = ARM_CP_NO_RAW,
3378 .writefn = tlbi_aa64_vae2_write },
3379 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
3380 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
3381 .access = PL2_W, .type = ARM_CP_NO_RAW,
3382 .writefn = tlbi_aa64_alle2is_write },
3383 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
3384 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
3385 .type = ARM_CP_NO_RAW, .access = PL2_W,
3386 .writefn = tlbi_aa64_vae2is_write },
3387 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
3388 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
3389 .access = PL2_W, .type = ARM_CP_NO_RAW,
3390 .writefn = tlbi_aa64_vae2is_write },
3391 #ifndef CONFIG_USER_ONLY
3392 /* Unlike the other EL2-related AT operations, these must
3393 * UNDEF from EL3 if EL2 is not implemented, which is why we
3394 * define them here rather than with the rest of the AT ops.
3396 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
3397 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
3398 .access = PL2_W, .accessfn = at_s1e2_access,
3399 .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3400 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
3401 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
3402 .access = PL2_W, .accessfn = at_s1e2_access,
3403 .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
3404 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
3405 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
3406 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
3407 * to behave as if SCR.NS was 1.
3409 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
3410 .access = PL2_W,
3411 .writefn = ats1h_write, .type = ARM_CP_NO_RAW },
3412 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
3413 .access = PL2_W,
3414 .writefn = ats1h_write, .type = ARM_CP_NO_RAW },
3415 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
3416 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
3417 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
3418 * reset values as IMPDEF. We choose to reset to 3 to comply with
3419 * both ARMv7 and ARMv8.
3421 .access = PL2_RW, .resetvalue = 3,
3422 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
3423 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
3424 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
3425 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
3426 .writefn = gt_cntvoff_write,
3427 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
3428 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
3429 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO,
3430 .writefn = gt_cntvoff_write,
3431 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
3432 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
3433 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
3434 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
3435 .type = ARM_CP_IO, .access = PL2_RW,
3436 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
3437 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
3438 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
3439 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO,
3440 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
3441 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
3442 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
3443 .type = ARM_CP_IO, .access = PL2_RW,
3444 .resetfn = gt_hyp_timer_reset,
3445 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
3446 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
3447 .type = ARM_CP_IO,
3448 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
3449 .access = PL2_RW,
3450 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
3451 .resetvalue = 0,
3452 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
3453 #endif
3454 /* The only field of MDCR_EL2 that has a defined architectural reset value
3455 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we
3456 * don't impelment any PMU event counters, so using zero as a reset
3457 * value for MDCR_EL2 is okay
3459 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
3460 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
3461 .access = PL2_RW, .resetvalue = 0,
3462 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
3463 REGINFO_SENTINEL
3466 static const ARMCPRegInfo el3_cp_reginfo[] = {
3467 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
3468 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
3469 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
3470 .resetvalue = 0, .writefn = scr_write },
3471 { .name = "SCR", .type = ARM_CP_ALIAS,
3472 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
3473 .access = PL3_RW, .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
3474 .writefn = scr_write },
3475 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
3476 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
3477 .access = PL3_RW, .resetvalue = 0,
3478 .fieldoffset = offsetof(CPUARMState, cp15.sder) },
3479 { .name = "SDER",
3480 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
3481 .access = PL3_RW, .resetvalue = 0,
3482 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
3483 /* TODO: Implement NSACR trapping of secure EL1 accesses to EL3 */
3484 { .name = "NSACR", .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
3485 .access = PL3_W | PL1_R, .resetvalue = 0,
3486 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) },
3487 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
3488 .access = PL3_RW, .writefn = vbar_write, .resetvalue = 0,
3489 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
3490 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
3491 .type = ARM_CP_ALIAS, /* reset handled by AArch32 view */
3492 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
3493 .access = PL3_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
3494 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]) },
3495 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
3496 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
3497 .access = PL3_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3498 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
3499 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
3500 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
3501 .access = PL3_RW, .writefn = vmsa_tcr_el1_write,
3502 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
3503 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
3504 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
3505 .type = ARM_CP_ALIAS,
3506 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
3507 .access = PL3_RW,
3508 .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
3509 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
3510 .type = ARM_CP_ALIAS,
3511 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
3512 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
3513 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
3514 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
3515 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
3516 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
3517 .type = ARM_CP_ALIAS,
3518 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
3519 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[7]) },
3520 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
3521 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
3522 .access = PL3_RW, .writefn = vbar_write,
3523 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
3524 .resetvalue = 0 },
3525 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
3526 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
3527 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
3528 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
3529 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
3530 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
3531 .access = PL3_RW, .resetvalue = 0,
3532 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
3533 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
3534 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
3535 .access = PL3_RW, .type = ARM_CP_CONST,
3536 .resetvalue = 0 },
3537 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH,
3538 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0,
3539 .access = PL3_RW, .type = ARM_CP_CONST,
3540 .resetvalue = 0 },
3541 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH,
3542 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1,
3543 .access = PL3_RW, .type = ARM_CP_CONST,
3544 .resetvalue = 0 },
3545 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64,
3546 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0,
3547 .access = PL3_W, .type = ARM_CP_NO_RAW,
3548 .writefn = tlbi_aa64_alle3is_write },
3549 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64,
3550 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1,
3551 .access = PL3_W, .type = ARM_CP_NO_RAW,
3552 .writefn = tlbi_aa64_vae3is_write },
3553 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64,
3554 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5,
3555 .access = PL3_W, .type = ARM_CP_NO_RAW,
3556 .writefn = tlbi_aa64_vae3is_write },
3557 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64,
3558 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0,
3559 .access = PL3_W, .type = ARM_CP_NO_RAW,
3560 .writefn = tlbi_aa64_alle3_write },
3561 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64,
3562 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1,
3563 .access = PL3_W, .type = ARM_CP_NO_RAW,
3564 .writefn = tlbi_aa64_vae3_write },
3565 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64,
3566 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
3567 .access = PL3_W, .type = ARM_CP_NO_RAW,
3568 .writefn = tlbi_aa64_vae3_write },
3569 REGINFO_SENTINEL
3572 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
3574 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
3575 * but the AArch32 CTR has its own reginfo struct)
3577 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
3578 return CP_ACCESS_TRAP;
3580 return CP_ACCESS_OK;
3583 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
3584 uint64_t value)
3586 /* Writes to OSLAR_EL1 may update the OS lock status, which can be
3587 * read via a bit in OSLSR_EL1.
3589 int oslock;
3591 if (ri->state == ARM_CP_STATE_AA32) {
3592 oslock = (value == 0xC5ACCE55);
3593 } else {
3594 oslock = value & 1;
3597 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
3600 static const ARMCPRegInfo debug_cp_reginfo[] = {
3601 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
3602 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
3603 * unlike DBGDRAR it is never accessible from EL0.
3604 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
3605 * accessor.
3607 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
3608 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3609 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
3610 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
3611 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3612 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
3613 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
3614 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
3615 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
3616 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
3617 .access = PL1_RW,
3618 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
3619 .resetvalue = 0 },
3620 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
3621 * We don't implement the configurable EL0 access.
3623 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
3624 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
3625 .type = ARM_CP_ALIAS,
3626 .access = PL1_R,
3627 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
3628 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
3629 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
3630 .access = PL1_W, .type = ARM_CP_NO_RAW,
3631 .writefn = oslar_write },
3632 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
3633 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
3634 .access = PL1_R, .resetvalue = 10,
3635 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
3636 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
3637 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
3638 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
3639 .access = PL1_RW, .type = ARM_CP_NOP },
3640 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
3641 * implement vector catch debug events yet.
3643 { .name = "DBGVCR",
3644 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
3645 .access = PL1_RW, .type = ARM_CP_NOP },
3646 REGINFO_SENTINEL
3649 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
3650 /* 64 bit access versions of the (dummy) debug registers */
3651 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
3652 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
3653 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
3654 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
3655 REGINFO_SENTINEL
3658 void hw_watchpoint_update(ARMCPU *cpu, int n)
3660 CPUARMState *env = &cpu->env;
3661 vaddr len = 0;
3662 vaddr wvr = env->cp15.dbgwvr[n];
3663 uint64_t wcr = env->cp15.dbgwcr[n];
3664 int mask;
3665 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
3667 if (env->cpu_watchpoint[n]) {
3668 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
3669 env->cpu_watchpoint[n] = NULL;
3672 if (!extract64(wcr, 0, 1)) {
3673 /* E bit clear : watchpoint disabled */
3674 return;
3677 switch (extract64(wcr, 3, 2)) {
3678 case 0:
3679 /* LSC 00 is reserved and must behave as if the wp is disabled */
3680 return;
3681 case 1:
3682 flags |= BP_MEM_READ;
3683 break;
3684 case 2:
3685 flags |= BP_MEM_WRITE;
3686 break;
3687 case 3:
3688 flags |= BP_MEM_ACCESS;
3689 break;
3692 /* Attempts to use both MASK and BAS fields simultaneously are
3693 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
3694 * thus generating a watchpoint for every byte in the masked region.
3696 mask = extract64(wcr, 24, 4);
3697 if (mask == 1 || mask == 2) {
3698 /* Reserved values of MASK; we must act as if the mask value was
3699 * some non-reserved value, or as if the watchpoint were disabled.
3700 * We choose the latter.
3702 return;
3703 } else if (mask) {
3704 /* Watchpoint covers an aligned area up to 2GB in size */
3705 len = 1ULL << mask;
3706 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
3707 * whether the watchpoint fires when the unmasked bits match; we opt
3708 * to generate the exceptions.
3710 wvr &= ~(len - 1);
3711 } else {
3712 /* Watchpoint covers bytes defined by the byte address select bits */
3713 int bas = extract64(wcr, 5, 8);
3714 int basstart;
3716 if (bas == 0) {
3717 /* This must act as if the watchpoint is disabled */
3718 return;
3721 if (extract64(wvr, 2, 1)) {
3722 /* Deprecated case of an only 4-aligned address. BAS[7:4] are
3723 * ignored, and BAS[3:0] define which bytes to watch.
3725 bas &= 0xf;
3727 /* The BAS bits are supposed to be programmed to indicate a contiguous
3728 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
3729 * we fire for each byte in the word/doubleword addressed by the WVR.
3730 * We choose to ignore any non-zero bits after the first range of 1s.
3732 basstart = ctz32(bas);
3733 len = cto32(bas >> basstart);
3734 wvr += basstart;
3737 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
3738 &env->cpu_watchpoint[n]);
3741 void hw_watchpoint_update_all(ARMCPU *cpu)
3743 int i;
3744 CPUARMState *env = &cpu->env;
3746 /* Completely clear out existing QEMU watchpoints and our array, to
3747 * avoid possible stale entries following migration load.
3749 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
3750 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
3752 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
3753 hw_watchpoint_update(cpu, i);
3757 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3758 uint64_t value)
3760 ARMCPU *cpu = arm_env_get_cpu(env);
3761 int i = ri->crm;
3763 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
3764 * register reads and behaves as if values written are sign extended.
3765 * Bits [1:0] are RES0.
3767 value = sextract64(value, 0, 49) & ~3ULL;
3769 raw_write(env, ri, value);
3770 hw_watchpoint_update(cpu, i);
3773 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3774 uint64_t value)
3776 ARMCPU *cpu = arm_env_get_cpu(env);
3777 int i = ri->crm;
3779 raw_write(env, ri, value);
3780 hw_watchpoint_update(cpu, i);
3783 void hw_breakpoint_update(ARMCPU *cpu, int n)
3785 CPUARMState *env = &cpu->env;
3786 uint64_t bvr = env->cp15.dbgbvr[n];
3787 uint64_t bcr = env->cp15.dbgbcr[n];
3788 vaddr addr;
3789 int bt;
3790 int flags = BP_CPU;
3792 if (env->cpu_breakpoint[n]) {
3793 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
3794 env->cpu_breakpoint[n] = NULL;
3797 if (!extract64(bcr, 0, 1)) {
3798 /* E bit clear : watchpoint disabled */
3799 return;
3802 bt = extract64(bcr, 20, 4);
3804 switch (bt) {
3805 case 4: /* unlinked address mismatch (reserved if AArch64) */
3806 case 5: /* linked address mismatch (reserved if AArch64) */
3807 qemu_log_mask(LOG_UNIMP,
3808 "arm: address mismatch breakpoint types not implemented");
3809 return;
3810 case 0: /* unlinked address match */
3811 case 1: /* linked address match */
3813 /* Bits [63:49] are hardwired to the value of bit [48]; that is,
3814 * we behave as if the register was sign extended. Bits [1:0] are
3815 * RES0. The BAS field is used to allow setting breakpoints on 16
3816 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
3817 * a bp will fire if the addresses covered by the bp and the addresses
3818 * covered by the insn overlap but the insn doesn't start at the
3819 * start of the bp address range. We choose to require the insn and
3820 * the bp to have the same address. The constraints on writing to
3821 * BAS enforced in dbgbcr_write mean we have only four cases:
3822 * 0b0000 => no breakpoint
3823 * 0b0011 => breakpoint on addr
3824 * 0b1100 => breakpoint on addr + 2
3825 * 0b1111 => breakpoint on addr
3826 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
3828 int bas = extract64(bcr, 5, 4);
3829 addr = sextract64(bvr, 0, 49) & ~3ULL;
3830 if (bas == 0) {
3831 return;
3833 if (bas == 0xc) {
3834 addr += 2;
3836 break;
3838 case 2: /* unlinked context ID match */
3839 case 8: /* unlinked VMID match (reserved if no EL2) */
3840 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
3841 qemu_log_mask(LOG_UNIMP,
3842 "arm: unlinked context breakpoint types not implemented");
3843 return;
3844 case 9: /* linked VMID match (reserved if no EL2) */
3845 case 11: /* linked context ID and VMID match (reserved if no EL2) */
3846 case 3: /* linked context ID match */
3847 default:
3848 /* We must generate no events for Linked context matches (unless
3849 * they are linked to by some other bp/wp, which is handled in
3850 * updates for the linking bp/wp). We choose to also generate no events
3851 * for reserved values.
3853 return;
3856 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
3859 void hw_breakpoint_update_all(ARMCPU *cpu)
3861 int i;
3862 CPUARMState *env = &cpu->env;
3864 /* Completely clear out existing QEMU breakpoints and our array, to
3865 * avoid possible stale entries following migration load.
3867 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
3868 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
3870 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
3871 hw_breakpoint_update(cpu, i);
3875 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3876 uint64_t value)
3878 ARMCPU *cpu = arm_env_get_cpu(env);
3879 int i = ri->crm;
3881 raw_write(env, ri, value);
3882 hw_breakpoint_update(cpu, i);
3885 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3886 uint64_t value)
3888 ARMCPU *cpu = arm_env_get_cpu(env);
3889 int i = ri->crm;
3891 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
3892 * copy of BAS[0].
3894 value = deposit64(value, 6, 1, extract64(value, 5, 1));
3895 value = deposit64(value, 8, 1, extract64(value, 7, 1));
3897 raw_write(env, ri, value);
3898 hw_breakpoint_update(cpu, i);
3901 static void define_debug_regs(ARMCPU *cpu)
3903 /* Define v7 and v8 architectural debug registers.
3904 * These are just dummy implementations for now.
3906 int i;
3907 int wrps, brps, ctx_cmps;
3908 ARMCPRegInfo dbgdidr = {
3909 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
3910 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
3913 /* Note that all these register fields hold "number of Xs minus 1". */
3914 brps = extract32(cpu->dbgdidr, 24, 4);
3915 wrps = extract32(cpu->dbgdidr, 28, 4);
3916 ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
3918 assert(ctx_cmps <= brps);
3920 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
3921 * of the debug registers such as number of breakpoints;
3922 * check that if they both exist then they agree.
3924 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
3925 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
3926 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
3927 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
3930 define_one_arm_cp_reg(cpu, &dbgdidr);
3931 define_arm_cp_regs(cpu, debug_cp_reginfo);
3933 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
3934 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
3937 for (i = 0; i < brps + 1; i++) {
3938 ARMCPRegInfo dbgregs[] = {
3939 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
3940 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
3941 .access = PL1_RW,
3942 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
3943 .writefn = dbgbvr_write, .raw_writefn = raw_write
3945 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
3946 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
3947 .access = PL1_RW,
3948 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
3949 .writefn = dbgbcr_write, .raw_writefn = raw_write
3951 REGINFO_SENTINEL
3953 define_arm_cp_regs(cpu, dbgregs);
3956 for (i = 0; i < wrps + 1; i++) {
3957 ARMCPRegInfo dbgregs[] = {
3958 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
3959 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
3960 .access = PL1_RW,
3961 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
3962 .writefn = dbgwvr_write, .raw_writefn = raw_write
3964 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
3965 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
3966 .access = PL1_RW,
3967 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
3968 .writefn = dbgwcr_write, .raw_writefn = raw_write
3970 REGINFO_SENTINEL
3972 define_arm_cp_regs(cpu, dbgregs);
3976 void register_cp_regs_for_features(ARMCPU *cpu)
3978 /* Register all the coprocessor registers based on feature bits */
3979 CPUARMState *env = &cpu->env;
3980 if (arm_feature(env, ARM_FEATURE_M)) {
3981 /* M profile has no coprocessor registers */
3982 return;
3985 define_arm_cp_regs(cpu, cp_reginfo);
3986 if (!arm_feature(env, ARM_FEATURE_V8)) {
3987 /* Must go early as it is full of wildcards that may be
3988 * overridden by later definitions.
3990 define_arm_cp_regs(cpu, not_v8_cp_reginfo);
3993 if (arm_feature(env, ARM_FEATURE_V6)) {
3994 /* The ID registers all have impdef reset values */
3995 ARMCPRegInfo v6_idregs[] = {
3996 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
3997 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
3998 .access = PL1_R, .type = ARM_CP_CONST,
3999 .resetvalue = cpu->id_pfr0 },
4000 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
4001 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
4002 .access = PL1_R, .type = ARM_CP_CONST,
4003 .resetvalue = cpu->id_pfr1 },
4004 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
4005 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
4006 .access = PL1_R, .type = ARM_CP_CONST,
4007 .resetvalue = cpu->id_dfr0 },
4008 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
4009 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
4010 .access = PL1_R, .type = ARM_CP_CONST,
4011 .resetvalue = cpu->id_afr0 },
4012 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
4013 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
4014 .access = PL1_R, .type = ARM_CP_CONST,
4015 .resetvalue = cpu->id_mmfr0 },
4016 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
4017 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
4018 .access = PL1_R, .type = ARM_CP_CONST,
4019 .resetvalue = cpu->id_mmfr1 },
4020 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
4021 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
4022 .access = PL1_R, .type = ARM_CP_CONST,
4023 .resetvalue = cpu->id_mmfr2 },
4024 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
4025 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
4026 .access = PL1_R, .type = ARM_CP_CONST,
4027 .resetvalue = cpu->id_mmfr3 },
4028 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
4029 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
4030 .access = PL1_R, .type = ARM_CP_CONST,
4031 .resetvalue = cpu->id_isar0 },
4032 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
4033 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
4034 .access = PL1_R, .type = ARM_CP_CONST,
4035 .resetvalue = cpu->id_isar1 },
4036 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
4037 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
4038 .access = PL1_R, .type = ARM_CP_CONST,
4039 .resetvalue = cpu->id_isar2 },
4040 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
4041 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
4042 .access = PL1_R, .type = ARM_CP_CONST,
4043 .resetvalue = cpu->id_isar3 },
4044 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
4045 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
4046 .access = PL1_R, .type = ARM_CP_CONST,
4047 .resetvalue = cpu->id_isar4 },
4048 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
4049 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
4050 .access = PL1_R, .type = ARM_CP_CONST,
4051 .resetvalue = cpu->id_isar5 },
4052 /* 6..7 are as yet unallocated and must RAZ */
4053 { .name = "ID_ISAR6", .cp = 15, .crn = 0, .crm = 2,
4054 .opc1 = 0, .opc2 = 6, .access = PL1_R, .type = ARM_CP_CONST,
4055 .resetvalue = 0 },
4056 { .name = "ID_ISAR7", .cp = 15, .crn = 0, .crm = 2,
4057 .opc1 = 0, .opc2 = 7, .access = PL1_R, .type = ARM_CP_CONST,
4058 .resetvalue = 0 },
4059 REGINFO_SENTINEL
4061 define_arm_cp_regs(cpu, v6_idregs);
4062 define_arm_cp_regs(cpu, v6_cp_reginfo);
4063 } else {
4064 define_arm_cp_regs(cpu, not_v6_cp_reginfo);
4066 if (arm_feature(env, ARM_FEATURE_V6K)) {
4067 define_arm_cp_regs(cpu, v6k_cp_reginfo);
4069 if (arm_feature(env, ARM_FEATURE_V7MP) &&
4070 !arm_feature(env, ARM_FEATURE_MPU)) {
4071 define_arm_cp_regs(cpu, v7mp_cp_reginfo);
4073 if (arm_feature(env, ARM_FEATURE_V7)) {
4074 /* v7 performance monitor control register: same implementor
4075 * field as main ID register, and we implement only the cycle
4076 * count register.
4078 #ifndef CONFIG_USER_ONLY
4079 ARMCPRegInfo pmcr = {
4080 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
4081 .access = PL0_RW,
4082 .type = ARM_CP_IO | ARM_CP_ALIAS,
4083 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
4084 .accessfn = pmreg_access, .writefn = pmcr_write,
4085 .raw_writefn = raw_write,
4087 ARMCPRegInfo pmcr64 = {
4088 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
4089 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
4090 .access = PL0_RW, .accessfn = pmreg_access,
4091 .type = ARM_CP_IO,
4092 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
4093 .resetvalue = cpu->midr & 0xff000000,
4094 .writefn = pmcr_write, .raw_writefn = raw_write,
4096 define_one_arm_cp_reg(cpu, &pmcr);
4097 define_one_arm_cp_reg(cpu, &pmcr64);
4098 #endif
4099 ARMCPRegInfo clidr = {
4100 .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
4101 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
4102 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
4104 define_one_arm_cp_reg(cpu, &clidr);
4105 define_arm_cp_regs(cpu, v7_cp_reginfo);
4106 define_debug_regs(cpu);
4107 } else {
4108 define_arm_cp_regs(cpu, not_v7_cp_reginfo);
4110 if (arm_feature(env, ARM_FEATURE_V8)) {
4111 /* AArch64 ID registers, which all have impdef reset values */
4112 ARMCPRegInfo v8_idregs[] = {
4113 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
4114 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
4115 .access = PL1_R, .type = ARM_CP_CONST,
4116 .resetvalue = cpu->id_aa64pfr0 },
4117 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
4118 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
4119 .access = PL1_R, .type = ARM_CP_CONST,
4120 .resetvalue = cpu->id_aa64pfr1},
4121 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
4122 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
4123 .access = PL1_R, .type = ARM_CP_CONST,
4124 /* We mask out the PMUVer field, because we don't currently
4125 * implement the PMU. Not advertising it prevents the guest
4126 * from trying to use it and getting UNDEFs on registers we
4127 * don't implement.
4129 .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
4130 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
4131 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
4132 .access = PL1_R, .type = ARM_CP_CONST,
4133 .resetvalue = cpu->id_aa64dfr1 },
4134 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
4135 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
4136 .access = PL1_R, .type = ARM_CP_CONST,
4137 .resetvalue = cpu->id_aa64afr0 },
4138 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
4139 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
4140 .access = PL1_R, .type = ARM_CP_CONST,
4141 .resetvalue = cpu->id_aa64afr1 },
4142 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
4143 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
4144 .access = PL1_R, .type = ARM_CP_CONST,
4145 .resetvalue = cpu->id_aa64isar0 },
4146 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
4147 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
4148 .access = PL1_R, .type = ARM_CP_CONST,
4149 .resetvalue = cpu->id_aa64isar1 },
4150 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
4151 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
4152 .access = PL1_R, .type = ARM_CP_CONST,
4153 .resetvalue = cpu->id_aa64mmfr0 },
4154 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
4155 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
4156 .access = PL1_R, .type = ARM_CP_CONST,
4157 .resetvalue = cpu->id_aa64mmfr1 },
4158 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
4159 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
4160 .access = PL1_R, .type = ARM_CP_CONST,
4161 .resetvalue = cpu->mvfr0 },
4162 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
4163 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
4164 .access = PL1_R, .type = ARM_CP_CONST,
4165 .resetvalue = cpu->mvfr1 },
4166 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
4167 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
4168 .access = PL1_R, .type = ARM_CP_CONST,
4169 .resetvalue = cpu->mvfr2 },
4170 REGINFO_SENTINEL
4172 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
4173 if (!arm_feature(env, ARM_FEATURE_EL3) &&
4174 !arm_feature(env, ARM_FEATURE_EL2)) {
4175 ARMCPRegInfo rvbar = {
4176 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
4177 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
4178 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
4180 define_one_arm_cp_reg(cpu, &rvbar);
4182 define_arm_cp_regs(cpu, v8_idregs);
4183 define_arm_cp_regs(cpu, v8_cp_reginfo);
4185 if (arm_feature(env, ARM_FEATURE_EL2)) {
4186 uint64_t vmpidr_def = mpidr_read_val(env);
4187 ARMCPRegInfo vpidr_regs[] = {
4188 { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
4189 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
4190 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4191 .resetvalue = cpu->midr,
4192 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
4193 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
4194 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
4195 .access = PL2_RW, .resetvalue = cpu->midr,
4196 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
4197 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
4198 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
4199 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4200 .resetvalue = vmpidr_def,
4201 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
4202 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
4203 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
4204 .access = PL2_RW,
4205 .resetvalue = vmpidr_def,
4206 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
4207 REGINFO_SENTINEL
4209 define_arm_cp_regs(cpu, vpidr_regs);
4210 define_arm_cp_regs(cpu, el2_cp_reginfo);
4211 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
4212 if (!arm_feature(env, ARM_FEATURE_EL3)) {
4213 ARMCPRegInfo rvbar = {
4214 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
4215 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
4216 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
4218 define_one_arm_cp_reg(cpu, &rvbar);
4220 } else {
4221 /* If EL2 is missing but higher ELs are enabled, we need to
4222 * register the no_el2 reginfos.
4224 if (arm_feature(env, ARM_FEATURE_EL3)) {
4225 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
4226 * of MIDR_EL1 and MPIDR_EL1.
4228 ARMCPRegInfo vpidr_regs[] = {
4229 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4230 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
4231 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4232 .type = ARM_CP_CONST, .resetvalue = cpu->midr,
4233 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
4234 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4235 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
4236 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4237 .type = ARM_CP_NO_RAW,
4238 .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
4239 REGINFO_SENTINEL
4241 define_arm_cp_regs(cpu, vpidr_regs);
4242 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
4245 if (arm_feature(env, ARM_FEATURE_EL3)) {
4246 define_arm_cp_regs(cpu, el3_cp_reginfo);
4247 ARMCPRegInfo rvbar = {
4248 .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
4249 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
4250 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar
4252 define_one_arm_cp_reg(cpu, &rvbar);
4254 if (arm_feature(env, ARM_FEATURE_MPU)) {
4255 if (arm_feature(env, ARM_FEATURE_V6)) {
4256 /* PMSAv6 not implemented */
4257 assert(arm_feature(env, ARM_FEATURE_V7));
4258 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
4259 define_arm_cp_regs(cpu, pmsav7_cp_reginfo);
4260 } else {
4261 define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
4263 } else {
4264 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
4265 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
4267 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
4268 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
4270 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
4271 define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
4273 if (arm_feature(env, ARM_FEATURE_VAPA)) {
4274 define_arm_cp_regs(cpu, vapa_cp_reginfo);
4276 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
4277 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
4279 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
4280 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
4282 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
4283 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
4285 if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
4286 define_arm_cp_regs(cpu, omap_cp_reginfo);
4288 if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
4289 define_arm_cp_regs(cpu, strongarm_cp_reginfo);
4291 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
4292 define_arm_cp_regs(cpu, xscale_cp_reginfo);
4294 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
4295 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
4297 if (arm_feature(env, ARM_FEATURE_LPAE)) {
4298 define_arm_cp_regs(cpu, lpae_cp_reginfo);
4300 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
4301 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
4302 * be read-only (ie write causes UNDEF exception).
4305 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
4306 /* Pre-v8 MIDR space.
4307 * Note that the MIDR isn't a simple constant register because
4308 * of the TI925 behaviour where writes to another register can
4309 * cause the MIDR value to change.
4311 * Unimplemented registers in the c15 0 0 0 space default to
4312 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
4313 * and friends override accordingly.
4315 { .name = "MIDR",
4316 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
4317 .access = PL1_R, .resetvalue = cpu->midr,
4318 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
4319 .readfn = midr_read,
4320 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
4321 .type = ARM_CP_OVERRIDE },
4322 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
4323 { .name = "DUMMY",
4324 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
4325 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4326 { .name = "DUMMY",
4327 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
4328 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4329 { .name = "DUMMY",
4330 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
4331 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4332 { .name = "DUMMY",
4333 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
4334 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4335 { .name = "DUMMY",
4336 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
4337 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4338 REGINFO_SENTINEL
4340 ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
4341 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
4342 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
4343 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr,
4344 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
4345 .readfn = midr_read },
4346 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */
4347 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
4348 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
4349 .access = PL1_R, .resetvalue = cpu->midr },
4350 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
4351 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7,
4352 .access = PL1_R, .resetvalue = cpu->midr },
4353 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
4354 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
4355 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
4356 REGINFO_SENTINEL
4358 ARMCPRegInfo id_cp_reginfo[] = {
4359 /* These are common to v8 and pre-v8 */
4360 { .name = "CTR",
4361 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
4362 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
4363 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
4364 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
4365 .access = PL0_R, .accessfn = ctr_el0_access,
4366 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
4367 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
4368 { .name = "TCMTR",
4369 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
4370 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
4371 REGINFO_SENTINEL
4373 /* TLBTR is specific to VMSA */
4374 ARMCPRegInfo id_tlbtr_reginfo = {
4375 .name = "TLBTR",
4376 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
4377 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0,
4379 /* MPUIR is specific to PMSA V6+ */
4380 ARMCPRegInfo id_mpuir_reginfo = {
4381 .name = "MPUIR",
4382 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
4383 .access = PL1_R, .type = ARM_CP_CONST,
4384 .resetvalue = cpu->pmsav7_dregion << 8
4386 ARMCPRegInfo crn0_wi_reginfo = {
4387 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
4388 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
4389 .type = ARM_CP_NOP | ARM_CP_OVERRIDE
4391 if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
4392 arm_feature(env, ARM_FEATURE_STRONGARM)) {
4393 ARMCPRegInfo *r;
4394 /* Register the blanket "writes ignored" value first to cover the
4395 * whole space. Then update the specific ID registers to allow write
4396 * access, so that they ignore writes rather than causing them to
4397 * UNDEF.
4399 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
4400 for (r = id_pre_v8_midr_cp_reginfo;
4401 r->type != ARM_CP_SENTINEL; r++) {
4402 r->access = PL1_RW;
4404 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
4405 r->access = PL1_RW;
4407 id_tlbtr_reginfo.access = PL1_RW;
4408 id_tlbtr_reginfo.access = PL1_RW;
4410 if (arm_feature(env, ARM_FEATURE_V8)) {
4411 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
4412 } else {
4413 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
4415 define_arm_cp_regs(cpu, id_cp_reginfo);
4416 if (!arm_feature(env, ARM_FEATURE_MPU)) {
4417 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
4418 } else if (arm_feature(env, ARM_FEATURE_V7)) {
4419 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
4423 if (arm_feature(env, ARM_FEATURE_MPIDR)) {
4424 define_arm_cp_regs(cpu, mpidr_cp_reginfo);
4427 if (arm_feature(env, ARM_FEATURE_AUXCR)) {
4428 ARMCPRegInfo auxcr_reginfo[] = {
4429 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
4430 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
4431 .access = PL1_RW, .type = ARM_CP_CONST,
4432 .resetvalue = cpu->reset_auxcr },
4433 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH,
4434 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1,
4435 .access = PL2_RW, .type = ARM_CP_CONST,
4436 .resetvalue = 0 },
4437 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64,
4438 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
4439 .access = PL3_RW, .type = ARM_CP_CONST,
4440 .resetvalue = 0 },
4441 REGINFO_SENTINEL
4443 define_arm_cp_regs(cpu, auxcr_reginfo);
4446 if (arm_feature(env, ARM_FEATURE_CBAR)) {
4447 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
4448 /* 32 bit view is [31:18] 0...0 [43:32]. */
4449 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
4450 | extract64(cpu->reset_cbar, 32, 12);
4451 ARMCPRegInfo cbar_reginfo[] = {
4452 { .name = "CBAR",
4453 .type = ARM_CP_CONST,
4454 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
4455 .access = PL1_R, .resetvalue = cpu->reset_cbar },
4456 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
4457 .type = ARM_CP_CONST,
4458 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
4459 .access = PL1_R, .resetvalue = cbar32 },
4460 REGINFO_SENTINEL
4462 /* We don't implement a r/w 64 bit CBAR currently */
4463 assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
4464 define_arm_cp_regs(cpu, cbar_reginfo);
4465 } else {
4466 ARMCPRegInfo cbar = {
4467 .name = "CBAR",
4468 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
4469 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
4470 .fieldoffset = offsetof(CPUARMState,
4471 cp15.c15_config_base_address)
4473 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
4474 cbar.access = PL1_R;
4475 cbar.fieldoffset = 0;
4476 cbar.type = ARM_CP_CONST;
4478 define_one_arm_cp_reg(cpu, &cbar);
4482 /* Generic registers whose values depend on the implementation */
4484 ARMCPRegInfo sctlr = {
4485 .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
4486 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
4487 .access = PL1_RW,
4488 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
4489 offsetof(CPUARMState, cp15.sctlr_ns) },
4490 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
4491 .raw_writefn = raw_write,
4493 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
4494 /* Normally we would always end the TB on an SCTLR write, but Linux
4495 * arch/arm/mach-pxa/sleep.S expects two instructions following
4496 * an MMU enable to execute from cache. Imitate this behaviour.
4498 sctlr.type |= ARM_CP_SUPPRESS_TB_END;
4500 define_one_arm_cp_reg(cpu, &sctlr);
4504 ARMCPU *cpu_arm_init(const char *cpu_model)
4506 return ARM_CPU(cpu_generic_init(TYPE_ARM_CPU, cpu_model));
4509 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
4511 CPUState *cs = CPU(cpu);
4512 CPUARMState *env = &cpu->env;
4514 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
4515 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
4516 aarch64_fpu_gdb_set_reg,
4517 34, "aarch64-fpu.xml", 0);
4518 } else if (arm_feature(env, ARM_FEATURE_NEON)) {
4519 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
4520 51, "arm-neon.xml", 0);
4521 } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
4522 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
4523 35, "arm-vfp3.xml", 0);
4524 } else if (arm_feature(env, ARM_FEATURE_VFP)) {
4525 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
4526 19, "arm-vfp.xml", 0);
4530 /* Sort alphabetically by type name, except for "any". */
4531 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
4533 ObjectClass *class_a = (ObjectClass *)a;
4534 ObjectClass *class_b = (ObjectClass *)b;
4535 const char *name_a, *name_b;
4537 name_a = object_class_get_name(class_a);
4538 name_b = object_class_get_name(class_b);
4539 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
4540 return 1;
4541 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
4542 return -1;
4543 } else {
4544 return strcmp(name_a, name_b);
4548 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
4550 ObjectClass *oc = data;
4551 CPUListState *s = user_data;
4552 const char *typename;
4553 char *name;
4555 typename = object_class_get_name(oc);
4556 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
4557 (*s->cpu_fprintf)(s->file, " %s\n",
4558 name);
4559 g_free(name);
4562 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf)
4564 CPUListState s = {
4565 .file = f,
4566 .cpu_fprintf = cpu_fprintf,
4568 GSList *list;
4570 list = object_class_get_list(TYPE_ARM_CPU, false);
4571 list = g_slist_sort(list, arm_cpu_list_compare);
4572 (*cpu_fprintf)(f, "Available CPUs:\n");
4573 g_slist_foreach(list, arm_cpu_list_entry, &s);
4574 g_slist_free(list);
4575 #ifdef CONFIG_KVM
4576 /* The 'host' CPU type is dynamically registered only if KVM is
4577 * enabled, so we have to special-case it here:
4579 (*cpu_fprintf)(f, " host (only available in KVM mode)\n");
4580 #endif
4583 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
4585 ObjectClass *oc = data;
4586 CpuDefinitionInfoList **cpu_list = user_data;
4587 CpuDefinitionInfoList *entry;
4588 CpuDefinitionInfo *info;
4589 const char *typename;
4591 typename = object_class_get_name(oc);
4592 info = g_malloc0(sizeof(*info));
4593 info->name = g_strndup(typename,
4594 strlen(typename) - strlen("-" TYPE_ARM_CPU));
4596 entry = g_malloc0(sizeof(*entry));
4597 entry->value = info;
4598 entry->next = *cpu_list;
4599 *cpu_list = entry;
4602 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
4604 CpuDefinitionInfoList *cpu_list = NULL;
4605 GSList *list;
4607 list = object_class_get_list(TYPE_ARM_CPU, false);
4608 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
4609 g_slist_free(list);
4611 return cpu_list;
4614 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
4615 void *opaque, int state, int secstate,
4616 int crm, int opc1, int opc2)
4618 /* Private utility function for define_one_arm_cp_reg_with_opaque():
4619 * add a single reginfo struct to the hash table.
4621 uint32_t *key = g_new(uint32_t, 1);
4622 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
4623 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
4624 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
4626 /* Reset the secure state to the specific incoming state. This is
4627 * necessary as the register may have been defined with both states.
4629 r2->secure = secstate;
4631 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
4632 /* Register is banked (using both entries in array).
4633 * Overwriting fieldoffset as the array is only used to define
4634 * banked registers but later only fieldoffset is used.
4636 r2->fieldoffset = r->bank_fieldoffsets[ns];
4639 if (state == ARM_CP_STATE_AA32) {
4640 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
4641 /* If the register is banked then we don't need to migrate or
4642 * reset the 32-bit instance in certain cases:
4644 * 1) If the register has both 32-bit and 64-bit instances then we
4645 * can count on the 64-bit instance taking care of the
4646 * non-secure bank.
4647 * 2) If ARMv8 is enabled then we can count on a 64-bit version
4648 * taking care of the secure bank. This requires that separate
4649 * 32 and 64-bit definitions are provided.
4651 if ((r->state == ARM_CP_STATE_BOTH && ns) ||
4652 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
4653 r2->type |= ARM_CP_ALIAS;
4655 } else if ((secstate != r->secure) && !ns) {
4656 /* The register is not banked so we only want to allow migration of
4657 * the non-secure instance.
4659 r2->type |= ARM_CP_ALIAS;
4662 if (r->state == ARM_CP_STATE_BOTH) {
4663 /* We assume it is a cp15 register if the .cp field is left unset.
4665 if (r2->cp == 0) {
4666 r2->cp = 15;
4669 #ifdef HOST_WORDS_BIGENDIAN
4670 if (r2->fieldoffset) {
4671 r2->fieldoffset += sizeof(uint32_t);
4673 #endif
4676 if (state == ARM_CP_STATE_AA64) {
4677 /* To allow abbreviation of ARMCPRegInfo
4678 * definitions, we treat cp == 0 as equivalent to
4679 * the value for "standard guest-visible sysreg".
4680 * STATE_BOTH definitions are also always "standard
4681 * sysreg" in their AArch64 view (the .cp value may
4682 * be non-zero for the benefit of the AArch32 view).
4684 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
4685 r2->cp = CP_REG_ARM64_SYSREG_CP;
4687 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
4688 r2->opc0, opc1, opc2);
4689 } else {
4690 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
4692 if (opaque) {
4693 r2->opaque = opaque;
4695 /* reginfo passed to helpers is correct for the actual access,
4696 * and is never ARM_CP_STATE_BOTH:
4698 r2->state = state;
4699 /* Make sure reginfo passed to helpers for wildcarded regs
4700 * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
4702 r2->crm = crm;
4703 r2->opc1 = opc1;
4704 r2->opc2 = opc2;
4705 /* By convention, for wildcarded registers only the first
4706 * entry is used for migration; the others are marked as
4707 * ALIAS so we don't try to transfer the register
4708 * multiple times. Special registers (ie NOP/WFI) are
4709 * never migratable and not even raw-accessible.
4711 if ((r->type & ARM_CP_SPECIAL)) {
4712 r2->type |= ARM_CP_NO_RAW;
4714 if (((r->crm == CP_ANY) && crm != 0) ||
4715 ((r->opc1 == CP_ANY) && opc1 != 0) ||
4716 ((r->opc2 == CP_ANY) && opc2 != 0)) {
4717 r2->type |= ARM_CP_ALIAS;
4720 /* Check that raw accesses are either forbidden or handled. Note that
4721 * we can't assert this earlier because the setup of fieldoffset for
4722 * banked registers has to be done first.
4724 if (!(r2->type & ARM_CP_NO_RAW)) {
4725 assert(!raw_accessors_invalid(r2));
4728 /* Overriding of an existing definition must be explicitly
4729 * requested.
4731 if (!(r->type & ARM_CP_OVERRIDE)) {
4732 ARMCPRegInfo *oldreg;
4733 oldreg = g_hash_table_lookup(cpu->cp_regs, key);
4734 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
4735 fprintf(stderr, "Register redefined: cp=%d %d bit "
4736 "crn=%d crm=%d opc1=%d opc2=%d, "
4737 "was %s, now %s\n", r2->cp, 32 + 32 * is64,
4738 r2->crn, r2->crm, r2->opc1, r2->opc2,
4739 oldreg->name, r2->name);
4740 g_assert_not_reached();
4743 g_hash_table_insert(cpu->cp_regs, key, r2);
4747 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
4748 const ARMCPRegInfo *r, void *opaque)
4750 /* Define implementations of coprocessor registers.
4751 * We store these in a hashtable because typically
4752 * there are less than 150 registers in a space which
4753 * is 16*16*16*8*8 = 262144 in size.
4754 * Wildcarding is supported for the crm, opc1 and opc2 fields.
4755 * If a register is defined twice then the second definition is
4756 * used, so this can be used to define some generic registers and
4757 * then override them with implementation specific variations.
4758 * At least one of the original and the second definition should
4759 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
4760 * against accidental use.
4762 * The state field defines whether the register is to be
4763 * visible in the AArch32 or AArch64 execution state. If the
4764 * state is set to ARM_CP_STATE_BOTH then we synthesise a
4765 * reginfo structure for the AArch32 view, which sees the lower
4766 * 32 bits of the 64 bit register.
4768 * Only registers visible in AArch64 may set r->opc0; opc0 cannot
4769 * be wildcarded. AArch64 registers are always considered to be 64
4770 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
4771 * the register, if any.
4773 int crm, opc1, opc2, state;
4774 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
4775 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
4776 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
4777 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
4778 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
4779 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
4780 /* 64 bit registers have only CRm and Opc1 fields */
4781 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
4782 /* op0 only exists in the AArch64 encodings */
4783 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
4784 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
4785 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
4786 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
4787 * encodes a minimum access level for the register. We roll this
4788 * runtime check into our general permission check code, so check
4789 * here that the reginfo's specified permissions are strict enough
4790 * to encompass the generic architectural permission check.
4792 if (r->state != ARM_CP_STATE_AA32) {
4793 int mask = 0;
4794 switch (r->opc1) {
4795 case 0: case 1: case 2:
4796 /* min_EL EL1 */
4797 mask = PL1_RW;
4798 break;
4799 case 3:
4800 /* min_EL EL0 */
4801 mask = PL0_RW;
4802 break;
4803 case 4:
4804 /* min_EL EL2 */
4805 mask = PL2_RW;
4806 break;
4807 case 5:
4808 /* unallocated encoding, so not possible */
4809 assert(false);
4810 break;
4811 case 6:
4812 /* min_EL EL3 */
4813 mask = PL3_RW;
4814 break;
4815 case 7:
4816 /* min_EL EL1, secure mode only (we don't check the latter) */
4817 mask = PL1_RW;
4818 break;
4819 default:
4820 /* broken reginfo with out-of-range opc1 */
4821 assert(false);
4822 break;
4824 /* assert our permissions are not too lax (stricter is fine) */
4825 assert((r->access & ~mask) == 0);
4828 /* Check that the register definition has enough info to handle
4829 * reads and writes if they are permitted.
4831 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
4832 if (r->access & PL3_R) {
4833 assert((r->fieldoffset ||
4834 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
4835 r->readfn);
4837 if (r->access & PL3_W) {
4838 assert((r->fieldoffset ||
4839 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
4840 r->writefn);
4843 /* Bad type field probably means missing sentinel at end of reg list */
4844 assert(cptype_valid(r->type));
4845 for (crm = crmmin; crm <= crmmax; crm++) {
4846 for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
4847 for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
4848 for (state = ARM_CP_STATE_AA32;
4849 state <= ARM_CP_STATE_AA64; state++) {
4850 if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
4851 continue;
4853 if (state == ARM_CP_STATE_AA32) {
4854 /* Under AArch32 CP registers can be common
4855 * (same for secure and non-secure world) or banked.
4857 switch (r->secure) {
4858 case ARM_CP_SECSTATE_S:
4859 case ARM_CP_SECSTATE_NS:
4860 add_cpreg_to_hashtable(cpu, r, opaque, state,
4861 r->secure, crm, opc1, opc2);
4862 break;
4863 default:
4864 add_cpreg_to_hashtable(cpu, r, opaque, state,
4865 ARM_CP_SECSTATE_S,
4866 crm, opc1, opc2);
4867 add_cpreg_to_hashtable(cpu, r, opaque, state,
4868 ARM_CP_SECSTATE_NS,
4869 crm, opc1, opc2);
4870 break;
4872 } else {
4873 /* AArch64 registers get mapped to non-secure instance
4874 * of AArch32 */
4875 add_cpreg_to_hashtable(cpu, r, opaque, state,
4876 ARM_CP_SECSTATE_NS,
4877 crm, opc1, opc2);
4885 void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
4886 const ARMCPRegInfo *regs, void *opaque)
4888 /* Define a whole list of registers */
4889 const ARMCPRegInfo *r;
4890 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
4891 define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
4895 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
4897 return g_hash_table_lookup(cpregs, &encoded_cp);
4900 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
4901 uint64_t value)
4903 /* Helper coprocessor write function for write-ignore registers */
4906 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
4908 /* Helper coprocessor write function for read-as-zero registers */
4909 return 0;
4912 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
4914 /* Helper coprocessor reset function for do-nothing-on-reset registers */
4917 static int bad_mode_switch(CPUARMState *env, int mode)
4919 /* Return true if it is not valid for us to switch to
4920 * this CPU mode (ie all the UNPREDICTABLE cases in
4921 * the ARM ARM CPSRWriteByInstr pseudocode).
4923 switch (mode) {
4924 case ARM_CPU_MODE_USR:
4925 case ARM_CPU_MODE_SYS:
4926 case ARM_CPU_MODE_SVC:
4927 case ARM_CPU_MODE_ABT:
4928 case ARM_CPU_MODE_UND:
4929 case ARM_CPU_MODE_IRQ:
4930 case ARM_CPU_MODE_FIQ:
4931 return 0;
4932 case ARM_CPU_MODE_MON:
4933 return !arm_is_secure(env);
4934 default:
4935 return 1;
4939 uint32_t cpsr_read(CPUARMState *env)
4941 int ZF;
4942 ZF = (env->ZF == 0);
4943 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
4944 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
4945 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
4946 | ((env->condexec_bits & 0xfc) << 8)
4947 | (env->GE << 16) | (env->daif & CPSR_AIF);
4950 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
4952 uint32_t changed_daif;
4954 if (mask & CPSR_NZCV) {
4955 env->ZF = (~val) & CPSR_Z;
4956 env->NF = val;
4957 env->CF = (val >> 29) & 1;
4958 env->VF = (val << 3) & 0x80000000;
4960 if (mask & CPSR_Q)
4961 env->QF = ((val & CPSR_Q) != 0);
4962 if (mask & CPSR_T)
4963 env->thumb = ((val & CPSR_T) != 0);
4964 if (mask & CPSR_IT_0_1) {
4965 env->condexec_bits &= ~3;
4966 env->condexec_bits |= (val >> 25) & 3;
4968 if (mask & CPSR_IT_2_7) {
4969 env->condexec_bits &= 3;
4970 env->condexec_bits |= (val >> 8) & 0xfc;
4972 if (mask & CPSR_GE) {
4973 env->GE = (val >> 16) & 0xf;
4976 /* In a V7 implementation that includes the security extensions but does
4977 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
4978 * whether non-secure software is allowed to change the CPSR_F and CPSR_A
4979 * bits respectively.
4981 * In a V8 implementation, it is permitted for privileged software to
4982 * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
4984 if (!arm_feature(env, ARM_FEATURE_V8) &&
4985 arm_feature(env, ARM_FEATURE_EL3) &&
4986 !arm_feature(env, ARM_FEATURE_EL2) &&
4987 !arm_is_secure(env)) {
4989 changed_daif = (env->daif ^ val) & mask;
4991 if (changed_daif & CPSR_A) {
4992 /* Check to see if we are allowed to change the masking of async
4993 * abort exceptions from a non-secure state.
4995 if (!(env->cp15.scr_el3 & SCR_AW)) {
4996 qemu_log_mask(LOG_GUEST_ERROR,
4997 "Ignoring attempt to switch CPSR_A flag from "
4998 "non-secure world with SCR.AW bit clear\n");
4999 mask &= ~CPSR_A;
5003 if (changed_daif & CPSR_F) {
5004 /* Check to see if we are allowed to change the masking of FIQ
5005 * exceptions from a non-secure state.
5007 if (!(env->cp15.scr_el3 & SCR_FW)) {
5008 qemu_log_mask(LOG_GUEST_ERROR,
5009 "Ignoring attempt to switch CPSR_F flag from "
5010 "non-secure world with SCR.FW bit clear\n");
5011 mask &= ~CPSR_F;
5014 /* Check whether non-maskable FIQ (NMFI) support is enabled.
5015 * If this bit is set software is not allowed to mask
5016 * FIQs, but is allowed to set CPSR_F to 0.
5018 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) &&
5019 (val & CPSR_F)) {
5020 qemu_log_mask(LOG_GUEST_ERROR,
5021 "Ignoring attempt to enable CPSR_F flag "
5022 "(non-maskable FIQ [NMFI] support enabled)\n");
5023 mask &= ~CPSR_F;
5028 env->daif &= ~(CPSR_AIF & mask);
5029 env->daif |= val & CPSR_AIF & mask;
5031 if ((env->uncached_cpsr ^ val) & mask & CPSR_M) {
5032 if (bad_mode_switch(env, val & CPSR_M)) {
5033 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE.
5034 * We choose to ignore the attempt and leave the CPSR M field
5035 * untouched.
5037 mask &= ~CPSR_M;
5038 } else {
5039 switch_mode(env, val & CPSR_M);
5042 mask &= ~CACHED_CPSR_BITS;
5043 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
5046 /* Sign/zero extend */
5047 uint32_t HELPER(sxtb16)(uint32_t x)
5049 uint32_t res;
5050 res = (uint16_t)(int8_t)x;
5051 res |= (uint32_t)(int8_t)(x >> 16) << 16;
5052 return res;
5055 uint32_t HELPER(uxtb16)(uint32_t x)
5057 uint32_t res;
5058 res = (uint16_t)(uint8_t)x;
5059 res |= (uint32_t)(uint8_t)(x >> 16) << 16;
5060 return res;
5063 uint32_t HELPER(clz)(uint32_t x)
5065 return clz32(x);
5068 int32_t HELPER(sdiv)(int32_t num, int32_t den)
5070 if (den == 0)
5071 return 0;
5072 if (num == INT_MIN && den == -1)
5073 return INT_MIN;
5074 return num / den;
5077 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
5079 if (den == 0)
5080 return 0;
5081 return num / den;
5084 uint32_t HELPER(rbit)(uint32_t x)
5086 return revbit32(x);
5089 #if defined(CONFIG_USER_ONLY)
5091 /* These should probably raise undefined insn exceptions. */
5092 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
5094 ARMCPU *cpu = arm_env_get_cpu(env);
5096 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg);
5099 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
5101 ARMCPU *cpu = arm_env_get_cpu(env);
5103 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg);
5104 return 0;
5107 void switch_mode(CPUARMState *env, int mode)
5109 ARMCPU *cpu = arm_env_get_cpu(env);
5111 if (mode != ARM_CPU_MODE_USR) {
5112 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
5116 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
5118 ARMCPU *cpu = arm_env_get_cpu(env);
5120 cpu_abort(CPU(cpu), "banked r13 write\n");
5123 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
5125 ARMCPU *cpu = arm_env_get_cpu(env);
5127 cpu_abort(CPU(cpu), "banked r13 read\n");
5128 return 0;
5131 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
5132 uint32_t cur_el, bool secure)
5134 return 1;
5137 void aarch64_sync_64_to_32(CPUARMState *env)
5139 g_assert_not_reached();
5142 #else
5144 /* Map CPU modes onto saved register banks. */
5145 int bank_number(int mode)
5147 switch (mode) {
5148 case ARM_CPU_MODE_USR:
5149 case ARM_CPU_MODE_SYS:
5150 return 0;
5151 case ARM_CPU_MODE_SVC:
5152 return 1;
5153 case ARM_CPU_MODE_ABT:
5154 return 2;
5155 case ARM_CPU_MODE_UND:
5156 return 3;
5157 case ARM_CPU_MODE_IRQ:
5158 return 4;
5159 case ARM_CPU_MODE_FIQ:
5160 return 5;
5161 case ARM_CPU_MODE_HYP:
5162 return 6;
5163 case ARM_CPU_MODE_MON:
5164 return 7;
5166 g_assert_not_reached();
5169 void switch_mode(CPUARMState *env, int mode)
5171 int old_mode;
5172 int i;
5174 old_mode = env->uncached_cpsr & CPSR_M;
5175 if (mode == old_mode)
5176 return;
5178 if (old_mode == ARM_CPU_MODE_FIQ) {
5179 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
5180 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
5181 } else if (mode == ARM_CPU_MODE_FIQ) {
5182 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
5183 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
5186 i = bank_number(old_mode);
5187 env->banked_r13[i] = env->regs[13];
5188 env->banked_r14[i] = env->regs[14];
5189 env->banked_spsr[i] = env->spsr;
5191 i = bank_number(mode);
5192 env->regs[13] = env->banked_r13[i];
5193 env->regs[14] = env->banked_r14[i];
5194 env->spsr = env->banked_spsr[i];
5197 /* Physical Interrupt Target EL Lookup Table
5199 * [ From ARM ARM section G1.13.4 (Table G1-15) ]
5201 * The below multi-dimensional table is used for looking up the target
5202 * exception level given numerous condition criteria. Specifically, the
5203 * target EL is based on SCR and HCR routing controls as well as the
5204 * currently executing EL and secure state.
5206 * Dimensions:
5207 * target_el_table[2][2][2][2][2][4]
5208 * | | | | | +--- Current EL
5209 * | | | | +------ Non-secure(0)/Secure(1)
5210 * | | | +--------- HCR mask override
5211 * | | +------------ SCR exec state control
5212 * | +--------------- SCR mask override
5213 * +------------------ 32-bit(0)/64-bit(1) EL3
5215 * The table values are as such:
5216 * 0-3 = EL0-EL3
5217 * -1 = Cannot occur
5219 * The ARM ARM target EL table includes entries indicating that an "exception
5220 * is not taken". The two cases where this is applicable are:
5221 * 1) An exception is taken from EL3 but the SCR does not have the exception
5222 * routed to EL3.
5223 * 2) An exception is taken from EL2 but the HCR does not have the exception
5224 * routed to EL2.
5225 * In these two cases, the below table contain a target of EL1. This value is
5226 * returned as it is expected that the consumer of the table data will check
5227 * for "target EL >= current EL" to ensure the exception is not taken.
5229 * SCR HCR
5230 * 64 EA AMO From
5231 * BIT IRQ IMO Non-secure Secure
5232 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3
5234 static const int8_t target_el_table[2][2][2][2][2][4] = {
5235 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
5236 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},
5237 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
5238 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},},
5239 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
5240 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},
5241 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
5242 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},},
5243 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },},
5244 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},
5245 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },},
5246 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},},
5247 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
5248 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},
5249 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
5250 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},},
5254 * Determine the target EL for physical exceptions
5256 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
5257 uint32_t cur_el, bool secure)
5259 CPUARMState *env = cs->env_ptr;
5260 int rw;
5261 int scr;
5262 int hcr;
5263 int target_el;
5264 /* Is the highest EL AArch64? */
5265 int is64 = arm_feature(env, ARM_FEATURE_AARCH64);
5267 if (arm_feature(env, ARM_FEATURE_EL3)) {
5268 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
5269 } else {
5270 /* Either EL2 is the highest EL (and so the EL2 register width
5271 * is given by is64); or there is no EL2 or EL3, in which case
5272 * the value of 'rw' does not affect the table lookup anyway.
5274 rw = is64;
5277 switch (excp_idx) {
5278 case EXCP_IRQ:
5279 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ);
5280 hcr = ((env->cp15.hcr_el2 & HCR_IMO) == HCR_IMO);
5281 break;
5282 case EXCP_FIQ:
5283 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ);
5284 hcr = ((env->cp15.hcr_el2 & HCR_FMO) == HCR_FMO);
5285 break;
5286 default:
5287 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA);
5288 hcr = ((env->cp15.hcr_el2 & HCR_AMO) == HCR_AMO);
5289 break;
5292 /* If HCR.TGE is set then HCR is treated as being 1 */
5293 hcr |= ((env->cp15.hcr_el2 & HCR_TGE) == HCR_TGE);
5295 /* Perform a table-lookup for the target EL given the current state */
5296 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
5298 assert(target_el > 0);
5300 return target_el;
5303 static void v7m_push(CPUARMState *env, uint32_t val)
5305 CPUState *cs = CPU(arm_env_get_cpu(env));
5307 env->regs[13] -= 4;
5308 stl_phys(cs->as, env->regs[13], val);
5311 static uint32_t v7m_pop(CPUARMState *env)
5313 CPUState *cs = CPU(arm_env_get_cpu(env));
5314 uint32_t val;
5316 val = ldl_phys(cs->as, env->regs[13]);
5317 env->regs[13] += 4;
5318 return val;
5321 /* Switch to V7M main or process stack pointer. */
5322 static void switch_v7m_sp(CPUARMState *env, int process)
5324 uint32_t tmp;
5325 if (env->v7m.current_sp != process) {
5326 tmp = env->v7m.other_sp;
5327 env->v7m.other_sp = env->regs[13];
5328 env->regs[13] = tmp;
5329 env->v7m.current_sp = process;
5333 static void do_v7m_exception_exit(CPUARMState *env)
5335 uint32_t type;
5336 uint32_t xpsr;
5338 type = env->regs[15];
5339 if (env->v7m.exception != 0)
5340 armv7m_nvic_complete_irq(env->nvic, env->v7m.exception);
5342 /* Switch to the target stack. */
5343 switch_v7m_sp(env, (type & 4) != 0);
5344 /* Pop registers. */
5345 env->regs[0] = v7m_pop(env);
5346 env->regs[1] = v7m_pop(env);
5347 env->regs[2] = v7m_pop(env);
5348 env->regs[3] = v7m_pop(env);
5349 env->regs[12] = v7m_pop(env);
5350 env->regs[14] = v7m_pop(env);
5351 env->regs[15] = v7m_pop(env);
5352 if (env->regs[15] & 1) {
5353 qemu_log_mask(LOG_GUEST_ERROR,
5354 "M profile return from interrupt with misaligned "
5355 "PC is UNPREDICTABLE\n");
5356 /* Actual hardware seems to ignore the lsbit, and there are several
5357 * RTOSes out there which incorrectly assume the r15 in the stack
5358 * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
5360 env->regs[15] &= ~1U;
5362 xpsr = v7m_pop(env);
5363 xpsr_write(env, xpsr, 0xfffffdff);
5364 /* Undo stack alignment. */
5365 if (xpsr & 0x200)
5366 env->regs[13] |= 4;
5367 /* ??? The exception return type specifies Thread/Handler mode. However
5368 this is also implied by the xPSR value. Not sure what to do
5369 if there is a mismatch. */
5370 /* ??? Likewise for mismatches between the CONTROL register and the stack
5371 pointer. */
5374 void arm_v7m_cpu_do_interrupt(CPUState *cs)
5376 ARMCPU *cpu = ARM_CPU(cs);
5377 CPUARMState *env = &cpu->env;
5378 uint32_t xpsr = xpsr_read(env);
5379 uint32_t lr;
5380 uint32_t addr;
5382 arm_log_exception(cs->exception_index);
5384 lr = 0xfffffff1;
5385 if (env->v7m.current_sp)
5386 lr |= 4;
5387 if (env->v7m.exception == 0)
5388 lr |= 8;
5390 /* For exceptions we just mark as pending on the NVIC, and let that
5391 handle it. */
5392 /* TODO: Need to escalate if the current priority is higher than the
5393 one we're raising. */
5394 switch (cs->exception_index) {
5395 case EXCP_UDEF:
5396 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
5397 return;
5398 case EXCP_SWI:
5399 /* The PC already points to the next instruction. */
5400 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
5401 return;
5402 case EXCP_PREFETCH_ABORT:
5403 case EXCP_DATA_ABORT:
5404 /* TODO: if we implemented the MPU registers, this is where we
5405 * should set the MMFAR, etc from exception.fsr and exception.vaddress.
5407 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
5408 return;
5409 case EXCP_BKPT:
5410 if (semihosting_enabled()) {
5411 int nr;
5412 nr = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
5413 if (nr == 0xab) {
5414 env->regs[15] += 2;
5415 qemu_log_mask(CPU_LOG_INT,
5416 "...handling as semihosting call 0x%x\n",
5417 env->regs[0]);
5418 env->regs[0] = do_arm_semihosting(env);
5419 return;
5422 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG);
5423 return;
5424 case EXCP_IRQ:
5425 env->v7m.exception = armv7m_nvic_acknowledge_irq(env->nvic);
5426 break;
5427 case EXCP_EXCEPTION_EXIT:
5428 do_v7m_exception_exit(env);
5429 return;
5430 default:
5431 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
5432 return; /* Never happens. Keep compiler happy. */
5435 /* Align stack pointer. */
5436 /* ??? Should only do this if Configuration Control Register
5437 STACKALIGN bit is set. */
5438 if (env->regs[13] & 4) {
5439 env->regs[13] -= 4;
5440 xpsr |= 0x200;
5442 /* Switch to the handler mode. */
5443 v7m_push(env, xpsr);
5444 v7m_push(env, env->regs[15]);
5445 v7m_push(env, env->regs[14]);
5446 v7m_push(env, env->regs[12]);
5447 v7m_push(env, env->regs[3]);
5448 v7m_push(env, env->regs[2]);
5449 v7m_push(env, env->regs[1]);
5450 v7m_push(env, env->regs[0]);
5451 switch_v7m_sp(env, 0);
5452 /* Clear IT bits */
5453 env->condexec_bits = 0;
5454 env->regs[14] = lr;
5455 addr = ldl_phys(cs->as, env->v7m.vecbase + env->v7m.exception * 4);
5456 env->regs[15] = addr & 0xfffffffe;
5457 env->thumb = addr & 1;
5460 /* Function used to synchronize QEMU's AArch64 register set with AArch32
5461 * register set. This is necessary when switching between AArch32 and AArch64
5462 * execution state.
5464 void aarch64_sync_32_to_64(CPUARMState *env)
5466 int i;
5467 uint32_t mode = env->uncached_cpsr & CPSR_M;
5469 /* We can blanket copy R[0:7] to X[0:7] */
5470 for (i = 0; i < 8; i++) {
5471 env->xregs[i] = env->regs[i];
5474 /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
5475 * Otherwise, they come from the banked user regs.
5477 if (mode == ARM_CPU_MODE_FIQ) {
5478 for (i = 8; i < 13; i++) {
5479 env->xregs[i] = env->usr_regs[i - 8];
5481 } else {
5482 for (i = 8; i < 13; i++) {
5483 env->xregs[i] = env->regs[i];
5487 /* Registers x13-x23 are the various mode SP and FP registers. Registers
5488 * r13 and r14 are only copied if we are in that mode, otherwise we copy
5489 * from the mode banked register.
5491 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
5492 env->xregs[13] = env->regs[13];
5493 env->xregs[14] = env->regs[14];
5494 } else {
5495 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)];
5496 /* HYP is an exception in that it is copied from r14 */
5497 if (mode == ARM_CPU_MODE_HYP) {
5498 env->xregs[14] = env->regs[14];
5499 } else {
5500 env->xregs[14] = env->banked_r14[bank_number(ARM_CPU_MODE_USR)];
5504 if (mode == ARM_CPU_MODE_HYP) {
5505 env->xregs[15] = env->regs[13];
5506 } else {
5507 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)];
5510 if (mode == ARM_CPU_MODE_IRQ) {
5511 env->xregs[16] = env->regs[14];
5512 env->xregs[17] = env->regs[13];
5513 } else {
5514 env->xregs[16] = env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)];
5515 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
5518 if (mode == ARM_CPU_MODE_SVC) {
5519 env->xregs[18] = env->regs[14];
5520 env->xregs[19] = env->regs[13];
5521 } else {
5522 env->xregs[18] = env->banked_r14[bank_number(ARM_CPU_MODE_SVC)];
5523 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
5526 if (mode == ARM_CPU_MODE_ABT) {
5527 env->xregs[20] = env->regs[14];
5528 env->xregs[21] = env->regs[13];
5529 } else {
5530 env->xregs[20] = env->banked_r14[bank_number(ARM_CPU_MODE_ABT)];
5531 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
5534 if (mode == ARM_CPU_MODE_UND) {
5535 env->xregs[22] = env->regs[14];
5536 env->xregs[23] = env->regs[13];
5537 } else {
5538 env->xregs[22] = env->banked_r14[bank_number(ARM_CPU_MODE_UND)];
5539 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
5542 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
5543 * mode, then we can copy from r8-r14. Otherwise, we copy from the
5544 * FIQ bank for r8-r14.
5546 if (mode == ARM_CPU_MODE_FIQ) {
5547 for (i = 24; i < 31; i++) {
5548 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */
5550 } else {
5551 for (i = 24; i < 29; i++) {
5552 env->xregs[i] = env->fiq_regs[i - 24];
5554 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
5555 env->xregs[30] = env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)];
5558 env->pc = env->regs[15];
5561 /* Function used to synchronize QEMU's AArch32 register set with AArch64
5562 * register set. This is necessary when switching between AArch32 and AArch64
5563 * execution state.
5565 void aarch64_sync_64_to_32(CPUARMState *env)
5567 int i;
5568 uint32_t mode = env->uncached_cpsr & CPSR_M;
5570 /* We can blanket copy X[0:7] to R[0:7] */
5571 for (i = 0; i < 8; i++) {
5572 env->regs[i] = env->xregs[i];
5575 /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
5576 * Otherwise, we copy x8-x12 into the banked user regs.
5578 if (mode == ARM_CPU_MODE_FIQ) {
5579 for (i = 8; i < 13; i++) {
5580 env->usr_regs[i - 8] = env->xregs[i];
5582 } else {
5583 for (i = 8; i < 13; i++) {
5584 env->regs[i] = env->xregs[i];
5588 /* Registers r13 & r14 depend on the current mode.
5589 * If we are in a given mode, we copy the corresponding x registers to r13
5590 * and r14. Otherwise, we copy the x register to the banked r13 and r14
5591 * for the mode.
5593 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
5594 env->regs[13] = env->xregs[13];
5595 env->regs[14] = env->xregs[14];
5596 } else {
5597 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13];
5599 /* HYP is an exception in that it does not have its own banked r14 but
5600 * shares the USR r14
5602 if (mode == ARM_CPU_MODE_HYP) {
5603 env->regs[14] = env->xregs[14];
5604 } else {
5605 env->banked_r14[bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
5609 if (mode == ARM_CPU_MODE_HYP) {
5610 env->regs[13] = env->xregs[15];
5611 } else {
5612 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15];
5615 if (mode == ARM_CPU_MODE_IRQ) {
5616 env->regs[14] = env->xregs[16];
5617 env->regs[13] = env->xregs[17];
5618 } else {
5619 env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
5620 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
5623 if (mode == ARM_CPU_MODE_SVC) {
5624 env->regs[14] = env->xregs[18];
5625 env->regs[13] = env->xregs[19];
5626 } else {
5627 env->banked_r14[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
5628 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
5631 if (mode == ARM_CPU_MODE_ABT) {
5632 env->regs[14] = env->xregs[20];
5633 env->regs[13] = env->xregs[21];
5634 } else {
5635 env->banked_r14[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
5636 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
5639 if (mode == ARM_CPU_MODE_UND) {
5640 env->regs[14] = env->xregs[22];
5641 env->regs[13] = env->xregs[23];
5642 } else {
5643 env->banked_r14[bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
5644 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
5647 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
5648 * mode, then we can copy to r8-r14. Otherwise, we copy to the
5649 * FIQ bank for r8-r14.
5651 if (mode == ARM_CPU_MODE_FIQ) {
5652 for (i = 24; i < 31; i++) {
5653 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */
5655 } else {
5656 for (i = 24; i < 29; i++) {
5657 env->fiq_regs[i - 24] = env->xregs[i];
5659 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
5660 env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
5663 env->regs[15] = env->pc;
5666 /* Handle a CPU exception. */
5667 void arm_cpu_do_interrupt(CPUState *cs)
5669 ARMCPU *cpu = ARM_CPU(cs);
5670 CPUARMState *env = &cpu->env;
5671 uint32_t addr;
5672 uint32_t mask;
5673 int new_mode;
5674 uint32_t offset;
5675 uint32_t moe;
5677 assert(!IS_M(env));
5679 arm_log_exception(cs->exception_index);
5681 if (arm_is_psci_call(cpu, cs->exception_index)) {
5682 arm_handle_psci_call(cpu);
5683 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
5684 return;
5687 /* If this is a debug exception we must update the DBGDSCR.MOE bits */
5688 switch (env->exception.syndrome >> ARM_EL_EC_SHIFT) {
5689 case EC_BREAKPOINT:
5690 case EC_BREAKPOINT_SAME_EL:
5691 moe = 1;
5692 break;
5693 case EC_WATCHPOINT:
5694 case EC_WATCHPOINT_SAME_EL:
5695 moe = 10;
5696 break;
5697 case EC_AA32_BKPT:
5698 moe = 3;
5699 break;
5700 case EC_VECTORCATCH:
5701 moe = 5;
5702 break;
5703 default:
5704 moe = 0;
5705 break;
5708 if (moe) {
5709 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
5712 /* TODO: Vectored interrupt controller. */
5713 switch (cs->exception_index) {
5714 case EXCP_UDEF:
5715 new_mode = ARM_CPU_MODE_UND;
5716 addr = 0x04;
5717 mask = CPSR_I;
5718 if (env->thumb)
5719 offset = 2;
5720 else
5721 offset = 4;
5722 break;
5723 case EXCP_SWI:
5724 if (semihosting_enabled()) {
5725 /* Check for semihosting interrupt. */
5726 if (env->thumb) {
5727 mask = arm_lduw_code(env, env->regs[15] - 2, env->bswap_code)
5728 & 0xff;
5729 } else {
5730 mask = arm_ldl_code(env, env->regs[15] - 4, env->bswap_code)
5731 & 0xffffff;
5733 /* Only intercept calls from privileged modes, to provide some
5734 semblance of security. */
5735 if (((mask == 0x123456 && !env->thumb)
5736 || (mask == 0xab && env->thumb))
5737 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
5738 qemu_log_mask(CPU_LOG_INT,
5739 "...handling as semihosting call 0x%x\n",
5740 env->regs[0]);
5741 env->regs[0] = do_arm_semihosting(env);
5742 return;
5745 new_mode = ARM_CPU_MODE_SVC;
5746 addr = 0x08;
5747 mask = CPSR_I;
5748 /* The PC already points to the next instruction. */
5749 offset = 0;
5750 break;
5751 case EXCP_BKPT:
5752 /* See if this is a semihosting syscall. */
5753 if (env->thumb && semihosting_enabled()) {
5754 mask = arm_lduw_code(env, env->regs[15], env->bswap_code) & 0xff;
5755 if (mask == 0xab
5756 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
5757 env->regs[15] += 2;
5758 qemu_log_mask(CPU_LOG_INT,
5759 "...handling as semihosting call 0x%x\n",
5760 env->regs[0]);
5761 env->regs[0] = do_arm_semihosting(env);
5762 return;
5765 env->exception.fsr = 2;
5766 /* Fall through to prefetch abort. */
5767 case EXCP_PREFETCH_ABORT:
5768 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr);
5769 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress);
5770 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
5771 env->exception.fsr, (uint32_t)env->exception.vaddress);
5772 new_mode = ARM_CPU_MODE_ABT;
5773 addr = 0x0c;
5774 mask = CPSR_A | CPSR_I;
5775 offset = 4;
5776 break;
5777 case EXCP_DATA_ABORT:
5778 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
5779 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress);
5780 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
5781 env->exception.fsr,
5782 (uint32_t)env->exception.vaddress);
5783 new_mode = ARM_CPU_MODE_ABT;
5784 addr = 0x10;
5785 mask = CPSR_A | CPSR_I;
5786 offset = 8;
5787 break;
5788 case EXCP_IRQ:
5789 new_mode = ARM_CPU_MODE_IRQ;
5790 addr = 0x18;
5791 /* Disable IRQ and imprecise data aborts. */
5792 mask = CPSR_A | CPSR_I;
5793 offset = 4;
5794 if (env->cp15.scr_el3 & SCR_IRQ) {
5795 /* IRQ routed to monitor mode */
5796 new_mode = ARM_CPU_MODE_MON;
5797 mask |= CPSR_F;
5799 break;
5800 case EXCP_FIQ:
5801 new_mode = ARM_CPU_MODE_FIQ;
5802 addr = 0x1c;
5803 /* Disable FIQ, IRQ and imprecise data aborts. */
5804 mask = CPSR_A | CPSR_I | CPSR_F;
5805 if (env->cp15.scr_el3 & SCR_FIQ) {
5806 /* FIQ routed to monitor mode */
5807 new_mode = ARM_CPU_MODE_MON;
5809 offset = 4;
5810 break;
5811 case EXCP_SMC:
5812 new_mode = ARM_CPU_MODE_MON;
5813 addr = 0x08;
5814 mask = CPSR_A | CPSR_I | CPSR_F;
5815 offset = 0;
5816 break;
5817 default:
5818 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
5819 return; /* Never happens. Keep compiler happy. */
5822 if (new_mode == ARM_CPU_MODE_MON) {
5823 addr += env->cp15.mvbar;
5824 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
5825 /* High vectors. When enabled, base address cannot be remapped. */
5826 addr += 0xffff0000;
5827 } else {
5828 /* ARM v7 architectures provide a vector base address register to remap
5829 * the interrupt vector table.
5830 * This register is only followed in non-monitor mode, and is banked.
5831 * Note: only bits 31:5 are valid.
5833 addr += A32_BANKED_CURRENT_REG_GET(env, vbar);
5836 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
5837 env->cp15.scr_el3 &= ~SCR_NS;
5840 switch_mode (env, new_mode);
5841 /* For exceptions taken to AArch32 we must clear the SS bit in both
5842 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
5844 env->uncached_cpsr &= ~PSTATE_SS;
5845 env->spsr = cpsr_read(env);
5846 /* Clear IT bits. */
5847 env->condexec_bits = 0;
5848 /* Switch to the new mode, and to the correct instruction set. */
5849 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
5850 env->daif |= mask;
5851 /* this is a lie, as the was no c1_sys on V4T/V5, but who cares
5852 * and we should just guard the thumb mode on V4 */
5853 if (arm_feature(env, ARM_FEATURE_V4T)) {
5854 env->thumb = (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0;
5856 env->regs[14] = env->regs[15] + offset;
5857 env->regs[15] = addr;
5858 cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
5862 /* Return the exception level which controls this address translation regime */
5863 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
5865 switch (mmu_idx) {
5866 case ARMMMUIdx_S2NS:
5867 case ARMMMUIdx_S1E2:
5868 return 2;
5869 case ARMMMUIdx_S1E3:
5870 return 3;
5871 case ARMMMUIdx_S1SE0:
5872 return arm_el_is_aa64(env, 3) ? 1 : 3;
5873 case ARMMMUIdx_S1SE1:
5874 case ARMMMUIdx_S1NSE0:
5875 case ARMMMUIdx_S1NSE1:
5876 return 1;
5877 default:
5878 g_assert_not_reached();
5882 /* Return true if this address translation regime is secure */
5883 static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
5885 switch (mmu_idx) {
5886 case ARMMMUIdx_S12NSE0:
5887 case ARMMMUIdx_S12NSE1:
5888 case ARMMMUIdx_S1NSE0:
5889 case ARMMMUIdx_S1NSE1:
5890 case ARMMMUIdx_S1E2:
5891 case ARMMMUIdx_S2NS:
5892 return false;
5893 case ARMMMUIdx_S1E3:
5894 case ARMMMUIdx_S1SE0:
5895 case ARMMMUIdx_S1SE1:
5896 return true;
5897 default:
5898 g_assert_not_reached();
5902 /* Return the SCTLR value which controls this address translation regime */
5903 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
5905 return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
5908 /* Return true if the specified stage of address translation is disabled */
5909 static inline bool regime_translation_disabled(CPUARMState *env,
5910 ARMMMUIdx mmu_idx)
5912 if (mmu_idx == ARMMMUIdx_S2NS) {
5913 return (env->cp15.hcr_el2 & HCR_VM) == 0;
5915 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
5918 /* Return the TCR controlling this translation regime */
5919 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
5921 if (mmu_idx == ARMMMUIdx_S2NS) {
5922 return &env->cp15.vtcr_el2;
5924 return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
5927 /* Return the TTBR associated with this translation regime */
5928 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
5929 int ttbrn)
5931 if (mmu_idx == ARMMMUIdx_S2NS) {
5932 return env->cp15.vttbr_el2;
5934 if (ttbrn == 0) {
5935 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
5936 } else {
5937 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
5941 /* Return true if the translation regime is using LPAE format page tables */
5942 static inline bool regime_using_lpae_format(CPUARMState *env,
5943 ARMMMUIdx mmu_idx)
5945 int el = regime_el(env, mmu_idx);
5946 if (el == 2 || arm_el_is_aa64(env, el)) {
5947 return true;
5949 if (arm_feature(env, ARM_FEATURE_LPAE)
5950 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
5951 return true;
5953 return false;
5956 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
5958 switch (mmu_idx) {
5959 case ARMMMUIdx_S1SE0:
5960 case ARMMMUIdx_S1NSE0:
5961 return true;
5962 default:
5963 return false;
5964 case ARMMMUIdx_S12NSE0:
5965 case ARMMMUIdx_S12NSE1:
5966 g_assert_not_reached();
5970 /* Translate section/page access permissions to page
5971 * R/W protection flags
5973 * @env: CPUARMState
5974 * @mmu_idx: MMU index indicating required translation regime
5975 * @ap: The 3-bit access permissions (AP[2:0])
5976 * @domain_prot: The 2-bit domain access permissions
5978 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
5979 int ap, int domain_prot)
5981 bool is_user = regime_is_user(env, mmu_idx);
5983 if (domain_prot == 3) {
5984 return PAGE_READ | PAGE_WRITE;
5987 switch (ap) {
5988 case 0:
5989 if (arm_feature(env, ARM_FEATURE_V7)) {
5990 return 0;
5992 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
5993 case SCTLR_S:
5994 return is_user ? 0 : PAGE_READ;
5995 case SCTLR_R:
5996 return PAGE_READ;
5997 default:
5998 return 0;
6000 case 1:
6001 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
6002 case 2:
6003 if (is_user) {
6004 return PAGE_READ;
6005 } else {
6006 return PAGE_READ | PAGE_WRITE;
6008 case 3:
6009 return PAGE_READ | PAGE_WRITE;
6010 case 4: /* Reserved. */
6011 return 0;
6012 case 5:
6013 return is_user ? 0 : PAGE_READ;
6014 case 6:
6015 return PAGE_READ;
6016 case 7:
6017 if (!arm_feature(env, ARM_FEATURE_V6K)) {
6018 return 0;
6020 return PAGE_READ;
6021 default:
6022 g_assert_not_reached();
6026 /* Translate section/page access permissions to page
6027 * R/W protection flags.
6029 * @ap: The 2-bit simple AP (AP[2:1])
6030 * @is_user: TRUE if accessing from PL0
6032 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
6034 switch (ap) {
6035 case 0:
6036 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
6037 case 1:
6038 return PAGE_READ | PAGE_WRITE;
6039 case 2:
6040 return is_user ? 0 : PAGE_READ;
6041 case 3:
6042 return PAGE_READ;
6043 default:
6044 g_assert_not_reached();
6048 static inline int
6049 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
6051 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
6054 /* Translate section/page access permissions to protection flags
6056 * @env: CPUARMState
6057 * @mmu_idx: MMU index indicating required translation regime
6058 * @is_aa64: TRUE if AArch64
6059 * @ap: The 2-bit simple AP (AP[2:1])
6060 * @ns: NS (non-secure) bit
6061 * @xn: XN (execute-never) bit
6062 * @pxn: PXN (privileged execute-never) bit
6064 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
6065 int ap, int ns, int xn, int pxn)
6067 bool is_user = regime_is_user(env, mmu_idx);
6068 int prot_rw, user_rw;
6069 bool have_wxn;
6070 int wxn = 0;
6072 assert(mmu_idx != ARMMMUIdx_S2NS);
6074 user_rw = simple_ap_to_rw_prot_is_user(ap, true);
6075 if (is_user) {
6076 prot_rw = user_rw;
6077 } else {
6078 prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
6081 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
6082 return prot_rw;
6085 /* TODO have_wxn should be replaced with
6086 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
6087 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
6088 * compatible processors have EL2, which is required for [U]WXN.
6090 have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
6092 if (have_wxn) {
6093 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
6096 if (is_aa64) {
6097 switch (regime_el(env, mmu_idx)) {
6098 case 1:
6099 if (!is_user) {
6100 xn = pxn || (user_rw & PAGE_WRITE);
6102 break;
6103 case 2:
6104 case 3:
6105 break;
6107 } else if (arm_feature(env, ARM_FEATURE_V7)) {
6108 switch (regime_el(env, mmu_idx)) {
6109 case 1:
6110 case 3:
6111 if (is_user) {
6112 xn = xn || !(user_rw & PAGE_READ);
6113 } else {
6114 int uwxn = 0;
6115 if (have_wxn) {
6116 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
6118 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
6119 (uwxn && (user_rw & PAGE_WRITE));
6121 break;
6122 case 2:
6123 break;
6125 } else {
6126 xn = wxn = 0;
6129 if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
6130 return prot_rw;
6132 return prot_rw | PAGE_EXEC;
6135 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
6136 uint32_t *table, uint32_t address)
6138 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
6139 TCR *tcr = regime_tcr(env, mmu_idx);
6141 if (address & tcr->mask) {
6142 if (tcr->raw_tcr & TTBCR_PD1) {
6143 /* Translation table walk disabled for TTBR1 */
6144 return false;
6146 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
6147 } else {
6148 if (tcr->raw_tcr & TTBCR_PD0) {
6149 /* Translation table walk disabled for TTBR0 */
6150 return false;
6152 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
6154 *table |= (address >> 18) & 0x3ffc;
6155 return true;
6158 /* All loads done in the course of a page table walk go through here.
6159 * TODO: rather than ignoring errors from physical memory reads (which
6160 * are external aborts in ARM terminology) we should propagate this
6161 * error out so that we can turn it into a Data Abort if this walk
6162 * was being done for a CPU load/store or an address translation instruction
6163 * (but not if it was for a debug access).
6165 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure)
6167 MemTxAttrs attrs = {};
6169 attrs.secure = is_secure;
6170 return address_space_ldl(cs->as, addr, attrs, NULL);
6173 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure)
6175 MemTxAttrs attrs = {};
6177 attrs.secure = is_secure;
6178 return address_space_ldq(cs->as, addr, attrs, NULL);
6181 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
6182 int access_type, ARMMMUIdx mmu_idx,
6183 hwaddr *phys_ptr, int *prot,
6184 target_ulong *page_size, uint32_t *fsr)
6186 CPUState *cs = CPU(arm_env_get_cpu(env));
6187 int code;
6188 uint32_t table;
6189 uint32_t desc;
6190 int type;
6191 int ap;
6192 int domain = 0;
6193 int domain_prot;
6194 hwaddr phys_addr;
6195 uint32_t dacr;
6197 /* Pagetable walk. */
6198 /* Lookup l1 descriptor. */
6199 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
6200 /* Section translation fault if page walk is disabled by PD0 or PD1 */
6201 code = 5;
6202 goto do_fault;
6204 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
6205 type = (desc & 3);
6206 domain = (desc >> 5) & 0x0f;
6207 if (regime_el(env, mmu_idx) == 1) {
6208 dacr = env->cp15.dacr_ns;
6209 } else {
6210 dacr = env->cp15.dacr_s;
6212 domain_prot = (dacr >> (domain * 2)) & 3;
6213 if (type == 0) {
6214 /* Section translation fault. */
6215 code = 5;
6216 goto do_fault;
6218 if (domain_prot == 0 || domain_prot == 2) {
6219 if (type == 2)
6220 code = 9; /* Section domain fault. */
6221 else
6222 code = 11; /* Page domain fault. */
6223 goto do_fault;
6225 if (type == 2) {
6226 /* 1Mb section. */
6227 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
6228 ap = (desc >> 10) & 3;
6229 code = 13;
6230 *page_size = 1024 * 1024;
6231 } else {
6232 /* Lookup l2 entry. */
6233 if (type == 1) {
6234 /* Coarse pagetable. */
6235 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
6236 } else {
6237 /* Fine pagetable. */
6238 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
6240 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
6241 switch (desc & 3) {
6242 case 0: /* Page translation fault. */
6243 code = 7;
6244 goto do_fault;
6245 case 1: /* 64k page. */
6246 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
6247 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
6248 *page_size = 0x10000;
6249 break;
6250 case 2: /* 4k page. */
6251 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
6252 ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
6253 *page_size = 0x1000;
6254 break;
6255 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
6256 if (type == 1) {
6257 /* ARMv6/XScale extended small page format */
6258 if (arm_feature(env, ARM_FEATURE_XSCALE)
6259 || arm_feature(env, ARM_FEATURE_V6)) {
6260 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
6261 *page_size = 0x1000;
6262 } else {
6263 /* UNPREDICTABLE in ARMv5; we choose to take a
6264 * page translation fault.
6266 code = 7;
6267 goto do_fault;
6269 } else {
6270 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
6271 *page_size = 0x400;
6273 ap = (desc >> 4) & 3;
6274 break;
6275 default:
6276 /* Never happens, but compiler isn't smart enough to tell. */
6277 abort();
6279 code = 15;
6281 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
6282 *prot |= *prot ? PAGE_EXEC : 0;
6283 if (!(*prot & (1 << access_type))) {
6284 /* Access permission fault. */
6285 goto do_fault;
6287 *phys_ptr = phys_addr;
6288 return false;
6289 do_fault:
6290 *fsr = code | (domain << 4);
6291 return true;
6294 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
6295 int access_type, ARMMMUIdx mmu_idx,
6296 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
6297 target_ulong *page_size, uint32_t *fsr)
6299 CPUState *cs = CPU(arm_env_get_cpu(env));
6300 int code;
6301 uint32_t table;
6302 uint32_t desc;
6303 uint32_t xn;
6304 uint32_t pxn = 0;
6305 int type;
6306 int ap;
6307 int domain = 0;
6308 int domain_prot;
6309 hwaddr phys_addr;
6310 uint32_t dacr;
6311 bool ns;
6313 /* Pagetable walk. */
6314 /* Lookup l1 descriptor. */
6315 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
6316 /* Section translation fault if page walk is disabled by PD0 or PD1 */
6317 code = 5;
6318 goto do_fault;
6320 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
6321 type = (desc & 3);
6322 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
6323 /* Section translation fault, or attempt to use the encoding
6324 * which is Reserved on implementations without PXN.
6326 code = 5;
6327 goto do_fault;
6329 if ((type == 1) || !(desc & (1 << 18))) {
6330 /* Page or Section. */
6331 domain = (desc >> 5) & 0x0f;
6333 if (regime_el(env, mmu_idx) == 1) {
6334 dacr = env->cp15.dacr_ns;
6335 } else {
6336 dacr = env->cp15.dacr_s;
6338 domain_prot = (dacr >> (domain * 2)) & 3;
6339 if (domain_prot == 0 || domain_prot == 2) {
6340 if (type != 1) {
6341 code = 9; /* Section domain fault. */
6342 } else {
6343 code = 11; /* Page domain fault. */
6345 goto do_fault;
6347 if (type != 1) {
6348 if (desc & (1 << 18)) {
6349 /* Supersection. */
6350 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
6351 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
6352 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
6353 *page_size = 0x1000000;
6354 } else {
6355 /* Section. */
6356 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
6357 *page_size = 0x100000;
6359 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
6360 xn = desc & (1 << 4);
6361 pxn = desc & 1;
6362 code = 13;
6363 ns = extract32(desc, 19, 1);
6364 } else {
6365 if (arm_feature(env, ARM_FEATURE_PXN)) {
6366 pxn = (desc >> 2) & 1;
6368 ns = extract32(desc, 3, 1);
6369 /* Lookup l2 entry. */
6370 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
6371 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx));
6372 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
6373 switch (desc & 3) {
6374 case 0: /* Page translation fault. */
6375 code = 7;
6376 goto do_fault;
6377 case 1: /* 64k page. */
6378 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
6379 xn = desc & (1 << 15);
6380 *page_size = 0x10000;
6381 break;
6382 case 2: case 3: /* 4k page. */
6383 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
6384 xn = desc & 1;
6385 *page_size = 0x1000;
6386 break;
6387 default:
6388 /* Never happens, but compiler isn't smart enough to tell. */
6389 abort();
6391 code = 15;
6393 if (domain_prot == 3) {
6394 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
6395 } else {
6396 if (pxn && !regime_is_user(env, mmu_idx)) {
6397 xn = 1;
6399 if (xn && access_type == 2)
6400 goto do_fault;
6402 if (arm_feature(env, ARM_FEATURE_V6K) &&
6403 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
6404 /* The simplified model uses AP[0] as an access control bit. */
6405 if ((ap & 1) == 0) {
6406 /* Access flag fault. */
6407 code = (code == 15) ? 6 : 3;
6408 goto do_fault;
6410 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
6411 } else {
6412 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
6414 if (*prot && !xn) {
6415 *prot |= PAGE_EXEC;
6417 if (!(*prot & (1 << access_type))) {
6418 /* Access permission fault. */
6419 goto do_fault;
6422 if (ns) {
6423 /* The NS bit will (as required by the architecture) have no effect if
6424 * the CPU doesn't support TZ or this is a non-secure translation
6425 * regime, because the attribute will already be non-secure.
6427 attrs->secure = false;
6429 *phys_ptr = phys_addr;
6430 return false;
6431 do_fault:
6432 *fsr = code | (domain << 4);
6433 return true;
6436 /* Fault type for long-descriptor MMU fault reporting; this corresponds
6437 * to bits [5..2] in the STATUS field in long-format DFSR/IFSR.
6439 typedef enum {
6440 translation_fault = 1,
6441 access_fault = 2,
6442 permission_fault = 3,
6443 } MMUFaultType;
6445 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
6446 int access_type, ARMMMUIdx mmu_idx,
6447 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
6448 target_ulong *page_size_ptr, uint32_t *fsr)
6450 CPUState *cs = CPU(arm_env_get_cpu(env));
6451 /* Read an LPAE long-descriptor translation table. */
6452 MMUFaultType fault_type = translation_fault;
6453 uint32_t level = 1;
6454 uint32_t epd = 0;
6455 int32_t tsz;
6456 uint32_t tg;
6457 uint64_t ttbr;
6458 int ttbr_select;
6459 hwaddr descaddr, descmask;
6460 uint32_t tableattrs;
6461 target_ulong page_size;
6462 uint32_t attrs;
6463 int32_t granule_sz = 9;
6464 int32_t va_size = 32;
6465 int32_t tbi = 0;
6466 TCR *tcr = regime_tcr(env, mmu_idx);
6467 int ap, ns, xn, pxn;
6468 uint32_t el = regime_el(env, mmu_idx);
6469 bool ttbr1_valid = true;
6471 /* TODO:
6472 * This code does not handle the different format TCR for VTCR_EL2.
6473 * This code also does not support shareability levels.
6474 * Attribute and permission bit handling should also be checked when adding
6475 * support for those page table walks.
6477 if (arm_el_is_aa64(env, el)) {
6478 va_size = 64;
6479 if (el > 1) {
6480 if (mmu_idx != ARMMMUIdx_S2NS) {
6481 tbi = extract64(tcr->raw_tcr, 20, 1);
6483 } else {
6484 if (extract64(address, 55, 1)) {
6485 tbi = extract64(tcr->raw_tcr, 38, 1);
6486 } else {
6487 tbi = extract64(tcr->raw_tcr, 37, 1);
6490 tbi *= 8;
6492 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
6493 * invalid.
6495 if (el > 1) {
6496 ttbr1_valid = false;
6498 } else {
6499 /* There is no TTBR1 for EL2 */
6500 if (el == 2) {
6501 ttbr1_valid = false;
6505 /* Determine whether this address is in the region controlled by
6506 * TTBR0 or TTBR1 (or if it is in neither region and should fault).
6507 * This is a Non-secure PL0/1 stage 1 translation, so controlled by
6508 * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
6510 uint32_t t0sz = extract32(tcr->raw_tcr, 0, 6);
6511 if (va_size == 64) {
6512 t0sz = MIN(t0sz, 39);
6513 t0sz = MAX(t0sz, 16);
6515 uint32_t t1sz = extract32(tcr->raw_tcr, 16, 6);
6516 if (va_size == 64) {
6517 t1sz = MIN(t1sz, 39);
6518 t1sz = MAX(t1sz, 16);
6520 if (t0sz && !extract64(address, va_size - t0sz, t0sz - tbi)) {
6521 /* there is a ttbr0 region and we are in it (high bits all zero) */
6522 ttbr_select = 0;
6523 } else if (ttbr1_valid && t1sz &&
6524 !extract64(~address, va_size - t1sz, t1sz - tbi)) {
6525 /* there is a ttbr1 region and we are in it (high bits all one) */
6526 ttbr_select = 1;
6527 } else if (!t0sz) {
6528 /* ttbr0 region is "everything not in the ttbr1 region" */
6529 ttbr_select = 0;
6530 } else if (!t1sz && ttbr1_valid) {
6531 /* ttbr1 region is "everything not in the ttbr0 region" */
6532 ttbr_select = 1;
6533 } else {
6534 /* in the gap between the two regions, this is a Translation fault */
6535 fault_type = translation_fault;
6536 goto do_fault;
6539 /* Note that QEMU ignores shareability and cacheability attributes,
6540 * so we don't need to do anything with the SH, ORGN, IRGN fields
6541 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
6542 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
6543 * implement any ASID-like capability so we can ignore it (instead
6544 * we will always flush the TLB any time the ASID is changed).
6546 if (ttbr_select == 0) {
6547 ttbr = regime_ttbr(env, mmu_idx, 0);
6548 if (el < 2) {
6549 epd = extract32(tcr->raw_tcr, 7, 1);
6551 tsz = t0sz;
6553 tg = extract32(tcr->raw_tcr, 14, 2);
6554 if (tg == 1) { /* 64KB pages */
6555 granule_sz = 13;
6557 if (tg == 2) { /* 16KB pages */
6558 granule_sz = 11;
6560 } else {
6561 /* We should only be here if TTBR1 is valid */
6562 assert(ttbr1_valid);
6564 ttbr = regime_ttbr(env, mmu_idx, 1);
6565 epd = extract32(tcr->raw_tcr, 23, 1);
6566 tsz = t1sz;
6568 tg = extract32(tcr->raw_tcr, 30, 2);
6569 if (tg == 3) { /* 64KB pages */
6570 granule_sz = 13;
6572 if (tg == 1) { /* 16KB pages */
6573 granule_sz = 11;
6577 /* Here we should have set up all the parameters for the translation:
6578 * va_size, ttbr, epd, tsz, granule_sz, tbi
6581 if (epd) {
6582 /* Translation table walk disabled => Translation fault on TLB miss
6583 * Note: This is always 0 on 64-bit EL2 and EL3.
6585 goto do_fault;
6588 /* The starting level depends on the virtual address size (which can be
6589 * up to 48 bits) and the translation granule size. It indicates the number
6590 * of strides (granule_sz bits at a time) needed to consume the bits
6591 * of the input address. In the pseudocode this is:
6592 * level = 4 - RoundUp((inputsize - grainsize) / stride)
6593 * where their 'inputsize' is our 'va_size - tsz', 'grainsize' is
6594 * our 'granule_sz + 3' and 'stride' is our 'granule_sz'.
6595 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
6596 * = 4 - (va_size - tsz - granule_sz - 3 + granule_sz - 1) / granule_sz
6597 * = 4 - (va_size - tsz - 4) / granule_sz;
6599 level = 4 - (va_size - tsz - 4) / granule_sz;
6601 /* Clear the vaddr bits which aren't part of the within-region address,
6602 * so that we don't have to special case things when calculating the
6603 * first descriptor address.
6605 if (tsz) {
6606 address &= (1ULL << (va_size - tsz)) - 1;
6609 descmask = (1ULL << (granule_sz + 3)) - 1;
6611 /* Now we can extract the actual base address from the TTBR */
6612 descaddr = extract64(ttbr, 0, 48);
6613 descaddr &= ~((1ULL << (va_size - tsz - (granule_sz * (4 - level)))) - 1);
6615 /* Secure accesses start with the page table in secure memory and
6616 * can be downgraded to non-secure at any step. Non-secure accesses
6617 * remain non-secure. We implement this by just ORing in the NSTable/NS
6618 * bits at each step.
6620 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
6621 for (;;) {
6622 uint64_t descriptor;
6623 bool nstable;
6625 descaddr |= (address >> (granule_sz * (4 - level))) & descmask;
6626 descaddr &= ~7ULL;
6627 nstable = extract32(tableattrs, 4, 1);
6628 descriptor = arm_ldq_ptw(cs, descaddr, !nstable);
6629 if (!(descriptor & 1) ||
6630 (!(descriptor & 2) && (level == 3))) {
6631 /* Invalid, or the Reserved level 3 encoding */
6632 goto do_fault;
6634 descaddr = descriptor & 0xfffffff000ULL;
6636 if ((descriptor & 2) && (level < 3)) {
6637 /* Table entry. The top five bits are attributes which may
6638 * propagate down through lower levels of the table (and
6639 * which are all arranged so that 0 means "no effect", so
6640 * we can gather them up by ORing in the bits at each level).
6642 tableattrs |= extract64(descriptor, 59, 5);
6643 level++;
6644 continue;
6646 /* Block entry at level 1 or 2, or page entry at level 3.
6647 * These are basically the same thing, although the number
6648 * of bits we pull in from the vaddr varies.
6650 page_size = (1ULL << ((granule_sz * (4 - level)) + 3));
6651 descaddr |= (address & (page_size - 1));
6652 /* Extract attributes from the descriptor and merge with table attrs */
6653 attrs = extract64(descriptor, 2, 10)
6654 | (extract64(descriptor, 52, 12) << 10);
6655 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */
6656 attrs |= extract32(tableattrs, 3, 1) << 5; /* APTable[1] => AP[2] */
6657 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
6658 * means "force PL1 access only", which means forcing AP[1] to 0.
6660 if (extract32(tableattrs, 2, 1)) {
6661 attrs &= ~(1 << 4);
6663 attrs |= nstable << 3; /* NS */
6664 break;
6666 /* Here descaddr is the final physical address, and attributes
6667 * are all in attrs.
6669 fault_type = access_fault;
6670 if ((attrs & (1 << 8)) == 0) {
6671 /* Access flag */
6672 goto do_fault;
6675 ap = extract32(attrs, 4, 2);
6676 ns = extract32(attrs, 3, 1);
6677 xn = extract32(attrs, 12, 1);
6678 pxn = extract32(attrs, 11, 1);
6680 *prot = get_S1prot(env, mmu_idx, va_size == 64, ap, ns, xn, pxn);
6682 fault_type = permission_fault;
6683 if (!(*prot & (1 << access_type))) {
6684 goto do_fault;
6687 if (ns) {
6688 /* The NS bit will (as required by the architecture) have no effect if
6689 * the CPU doesn't support TZ or this is a non-secure translation
6690 * regime, because the attribute will already be non-secure.
6692 txattrs->secure = false;
6694 *phys_ptr = descaddr;
6695 *page_size_ptr = page_size;
6696 return false;
6698 do_fault:
6699 /* Long-descriptor format IFSR/DFSR value */
6700 *fsr = (1 << 9) | (fault_type << 2) | level;
6701 return true;
6704 static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
6705 ARMMMUIdx mmu_idx,
6706 int32_t address, int *prot)
6708 *prot = PAGE_READ | PAGE_WRITE;
6709 switch (address) {
6710 case 0xF0000000 ... 0xFFFFFFFF:
6711 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { /* hivecs execing is ok */
6712 *prot |= PAGE_EXEC;
6714 break;
6715 case 0x00000000 ... 0x7FFFFFFF:
6716 *prot |= PAGE_EXEC;
6717 break;
6722 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
6723 int access_type, ARMMMUIdx mmu_idx,
6724 hwaddr *phys_ptr, int *prot, uint32_t *fsr)
6726 ARMCPU *cpu = arm_env_get_cpu(env);
6727 int n;
6728 bool is_user = regime_is_user(env, mmu_idx);
6730 *phys_ptr = address;
6731 *prot = 0;
6733 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
6734 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
6735 } else { /* MPU enabled */
6736 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
6737 /* region search */
6738 uint32_t base = env->pmsav7.drbar[n];
6739 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
6740 uint32_t rmask;
6741 bool srdis = false;
6743 if (!(env->pmsav7.drsr[n] & 0x1)) {
6744 continue;
6747 if (!rsize) {
6748 qemu_log_mask(LOG_GUEST_ERROR, "DRSR.Rsize field can not be 0");
6749 continue;
6751 rsize++;
6752 rmask = (1ull << rsize) - 1;
6754 if (base & rmask) {
6755 qemu_log_mask(LOG_GUEST_ERROR, "DRBAR %" PRIx32 " misaligned "
6756 "to DRSR region size, mask = %" PRIx32,
6757 base, rmask);
6758 continue;
6761 if (address < base || address > base + rmask) {
6762 continue;
6765 /* Region matched */
6767 if (rsize >= 8) { /* no subregions for regions < 256 bytes */
6768 int i, snd;
6769 uint32_t srdis_mask;
6771 rsize -= 3; /* sub region size (power of 2) */
6772 snd = ((address - base) >> rsize) & 0x7;
6773 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
6775 srdis_mask = srdis ? 0x3 : 0x0;
6776 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
6777 /* This will check in groups of 2, 4 and then 8, whether
6778 * the subregion bits are consistent. rsize is incremented
6779 * back up to give the region size, considering consistent
6780 * adjacent subregions as one region. Stop testing if rsize
6781 * is already big enough for an entire QEMU page.
6783 int snd_rounded = snd & ~(i - 1);
6784 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
6785 snd_rounded + 8, i);
6786 if (srdis_mask ^ srdis_multi) {
6787 break;
6789 srdis_mask = (srdis_mask << i) | srdis_mask;
6790 rsize++;
6793 if (rsize < TARGET_PAGE_BITS) {
6794 qemu_log_mask(LOG_UNIMP, "No support for MPU (sub)region"
6795 "alignment of %" PRIu32 " bits. Minimum is %d\n",
6796 rsize, TARGET_PAGE_BITS);
6797 continue;
6799 if (srdis) {
6800 continue;
6802 break;
6805 if (n == -1) { /* no hits */
6806 if (cpu->pmsav7_dregion &&
6807 (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR))) {
6808 /* background fault */
6809 *fsr = 0;
6810 return true;
6812 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
6813 } else { /* a MPU hit! */
6814 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
6816 if (is_user) { /* User mode AP bit decoding */
6817 switch (ap) {
6818 case 0:
6819 case 1:
6820 case 5:
6821 break; /* no access */
6822 case 3:
6823 *prot |= PAGE_WRITE;
6824 /* fall through */
6825 case 2:
6826 case 6:
6827 *prot |= PAGE_READ | PAGE_EXEC;
6828 break;
6829 default:
6830 qemu_log_mask(LOG_GUEST_ERROR,
6831 "Bad value for AP bits in DRACR %"
6832 PRIx32 "\n", ap);
6834 } else { /* Priv. mode AP bits decoding */
6835 switch (ap) {
6836 case 0:
6837 break; /* no access */
6838 case 1:
6839 case 2:
6840 case 3:
6841 *prot |= PAGE_WRITE;
6842 /* fall through */
6843 case 5:
6844 case 6:
6845 *prot |= PAGE_READ | PAGE_EXEC;
6846 break;
6847 default:
6848 qemu_log_mask(LOG_GUEST_ERROR,
6849 "Bad value for AP bits in DRACR %"
6850 PRIx32 "\n", ap);
6854 /* execute never */
6855 if (env->pmsav7.dracr[n] & (1 << 12)) {
6856 *prot &= ~PAGE_EXEC;
6861 *fsr = 0x00d; /* Permission fault */
6862 return !(*prot & (1 << access_type));
6865 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
6866 int access_type, ARMMMUIdx mmu_idx,
6867 hwaddr *phys_ptr, int *prot, uint32_t *fsr)
6869 int n;
6870 uint32_t mask;
6871 uint32_t base;
6872 bool is_user = regime_is_user(env, mmu_idx);
6874 *phys_ptr = address;
6875 for (n = 7; n >= 0; n--) {
6876 base = env->cp15.c6_region[n];
6877 if ((base & 1) == 0) {
6878 continue;
6880 mask = 1 << ((base >> 1) & 0x1f);
6881 /* Keep this shift separate from the above to avoid an
6882 (undefined) << 32. */
6883 mask = (mask << 1) - 1;
6884 if (((base ^ address) & ~mask) == 0) {
6885 break;
6888 if (n < 0) {
6889 *fsr = 2;
6890 return true;
6893 if (access_type == 2) {
6894 mask = env->cp15.pmsav5_insn_ap;
6895 } else {
6896 mask = env->cp15.pmsav5_data_ap;
6898 mask = (mask >> (n * 4)) & 0xf;
6899 switch (mask) {
6900 case 0:
6901 *fsr = 1;
6902 return true;
6903 case 1:
6904 if (is_user) {
6905 *fsr = 1;
6906 return true;
6908 *prot = PAGE_READ | PAGE_WRITE;
6909 break;
6910 case 2:
6911 *prot = PAGE_READ;
6912 if (!is_user) {
6913 *prot |= PAGE_WRITE;
6915 break;
6916 case 3:
6917 *prot = PAGE_READ | PAGE_WRITE;
6918 break;
6919 case 5:
6920 if (is_user) {
6921 *fsr = 1;
6922 return true;
6924 *prot = PAGE_READ;
6925 break;
6926 case 6:
6927 *prot = PAGE_READ;
6928 break;
6929 default:
6930 /* Bad permission. */
6931 *fsr = 1;
6932 return true;
6934 *prot |= PAGE_EXEC;
6935 return false;
6938 /* get_phys_addr - get the physical address for this virtual address
6940 * Find the physical address corresponding to the given virtual address,
6941 * by doing a translation table walk on MMU based systems or using the
6942 * MPU state on MPU based systems.
6944 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
6945 * prot and page_size may not be filled in, and the populated fsr value provides
6946 * information on why the translation aborted, in the format of a
6947 * DFSR/IFSR fault register, with the following caveats:
6948 * * we honour the short vs long DFSR format differences.
6949 * * the WnR bit is never set (the caller must do this).
6950 * * for PSMAv5 based systems we don't bother to return a full FSR format
6951 * value.
6953 * @env: CPUARMState
6954 * @address: virtual address to get physical address for
6955 * @access_type: 0 for read, 1 for write, 2 for execute
6956 * @mmu_idx: MMU index indicating required translation regime
6957 * @phys_ptr: set to the physical address corresponding to the virtual address
6958 * @attrs: set to the memory transaction attributes to use
6959 * @prot: set to the permissions for the page containing phys_ptr
6960 * @page_size: set to the size of the page containing phys_ptr
6961 * @fsr: set to the DFSR/IFSR value on failure
6963 static inline bool get_phys_addr(CPUARMState *env, target_ulong address,
6964 int access_type, ARMMMUIdx mmu_idx,
6965 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
6966 target_ulong *page_size, uint32_t *fsr)
6968 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
6969 /* TODO: when we support EL2 we should here call ourselves recursively
6970 * to do the stage 1 and then stage 2 translations. The arm_ld*_ptw
6971 * functions will also need changing to perform ARMMMUIdx_S2NS loads
6972 * rather than direct physical memory loads when appropriate.
6973 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
6975 assert(!arm_feature(env, ARM_FEATURE_EL2));
6976 mmu_idx += ARMMMUIdx_S1NSE0;
6979 /* The page table entries may downgrade secure to non-secure, but
6980 * cannot upgrade an non-secure translation regime's attributes
6981 * to secure.
6983 attrs->secure = regime_is_secure(env, mmu_idx);
6984 attrs->user = regime_is_user(env, mmu_idx);
6986 /* Fast Context Switch Extension. This doesn't exist at all in v8.
6987 * In v7 and earlier it affects all stage 1 translations.
6989 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS
6990 && !arm_feature(env, ARM_FEATURE_V8)) {
6991 if (regime_el(env, mmu_idx) == 3) {
6992 address += env->cp15.fcseidr_s;
6993 } else {
6994 address += env->cp15.fcseidr_ns;
6998 /* pmsav7 has special handling for when MPU is disabled so call it before
6999 * the common MMU/MPU disabled check below.
7001 if (arm_feature(env, ARM_FEATURE_MPU) &&
7002 arm_feature(env, ARM_FEATURE_V7)) {
7003 *page_size = TARGET_PAGE_SIZE;
7004 return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
7005 phys_ptr, prot, fsr);
7008 if (regime_translation_disabled(env, mmu_idx)) {
7009 /* MMU/MPU disabled. */
7010 *phys_ptr = address;
7011 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
7012 *page_size = TARGET_PAGE_SIZE;
7013 return 0;
7016 if (arm_feature(env, ARM_FEATURE_MPU)) {
7017 /* Pre-v7 MPU */
7018 *page_size = TARGET_PAGE_SIZE;
7019 return get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
7020 phys_ptr, prot, fsr);
7023 if (regime_using_lpae_format(env, mmu_idx)) {
7024 return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
7025 attrs, prot, page_size, fsr);
7026 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
7027 return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
7028 attrs, prot, page_size, fsr);
7029 } else {
7030 return get_phys_addr_v5(env, address, access_type, mmu_idx, phys_ptr,
7031 prot, page_size, fsr);
7035 /* Walk the page table and (if the mapping exists) add the page
7036 * to the TLB. Return false on success, or true on failure. Populate
7037 * fsr with ARM DFSR/IFSR fault register format value on failure.
7039 bool arm_tlb_fill(CPUState *cs, vaddr address,
7040 int access_type, int mmu_idx, uint32_t *fsr)
7042 ARMCPU *cpu = ARM_CPU(cs);
7043 CPUARMState *env = &cpu->env;
7044 hwaddr phys_addr;
7045 target_ulong page_size;
7046 int prot;
7047 int ret;
7048 MemTxAttrs attrs = {};
7050 ret = get_phys_addr(env, address, access_type, mmu_idx, &phys_addr,
7051 &attrs, &prot, &page_size, fsr);
7052 if (!ret) {
7053 /* Map a single [sub]page. */
7054 phys_addr &= TARGET_PAGE_MASK;
7055 address &= TARGET_PAGE_MASK;
7056 tlb_set_page_with_attrs(cs, address, phys_addr, attrs,
7057 prot, mmu_idx, page_size);
7058 return 0;
7061 return ret;
7064 hwaddr arm_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
7066 ARMCPU *cpu = ARM_CPU(cs);
7067 CPUARMState *env = &cpu->env;
7068 hwaddr phys_addr;
7069 target_ulong page_size;
7070 int prot;
7071 bool ret;
7072 uint32_t fsr;
7073 MemTxAttrs attrs = {};
7075 ret = get_phys_addr(env, addr, 0, cpu_mmu_index(env, false), &phys_addr,
7076 &attrs, &prot, &page_size, &fsr);
7078 if (ret) {
7079 return -1;
7082 return phys_addr;
7085 void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val)
7087 if ((env->uncached_cpsr & CPSR_M) == mode) {
7088 env->regs[13] = val;
7089 } else {
7090 env->banked_r13[bank_number(mode)] = val;
7094 uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode)
7096 if ((env->uncached_cpsr & CPSR_M) == mode) {
7097 return env->regs[13];
7098 } else {
7099 return env->banked_r13[bank_number(mode)];
7103 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
7105 ARMCPU *cpu = arm_env_get_cpu(env);
7107 switch (reg) {
7108 case 0: /* APSR */
7109 return xpsr_read(env) & 0xf8000000;
7110 case 1: /* IAPSR */
7111 return xpsr_read(env) & 0xf80001ff;
7112 case 2: /* EAPSR */
7113 return xpsr_read(env) & 0xff00fc00;
7114 case 3: /* xPSR */
7115 return xpsr_read(env) & 0xff00fdff;
7116 case 5: /* IPSR */
7117 return xpsr_read(env) & 0x000001ff;
7118 case 6: /* EPSR */
7119 return xpsr_read(env) & 0x0700fc00;
7120 case 7: /* IEPSR */
7121 return xpsr_read(env) & 0x0700edff;
7122 case 8: /* MSP */
7123 return env->v7m.current_sp ? env->v7m.other_sp : env->regs[13];
7124 case 9: /* PSP */
7125 return env->v7m.current_sp ? env->regs[13] : env->v7m.other_sp;
7126 case 16: /* PRIMASK */
7127 return (env->daif & PSTATE_I) != 0;
7128 case 17: /* BASEPRI */
7129 case 18: /* BASEPRI_MAX */
7130 return env->v7m.basepri;
7131 case 19: /* FAULTMASK */
7132 return (env->daif & PSTATE_F) != 0;
7133 case 20: /* CONTROL */
7134 return env->v7m.control;
7135 default:
7136 /* ??? For debugging only. */
7137 cpu_abort(CPU(cpu), "Unimplemented system register read (%d)\n", reg);
7138 return 0;
7142 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
7144 ARMCPU *cpu = arm_env_get_cpu(env);
7146 switch (reg) {
7147 case 0: /* APSR */
7148 xpsr_write(env, val, 0xf8000000);
7149 break;
7150 case 1: /* IAPSR */
7151 xpsr_write(env, val, 0xf8000000);
7152 break;
7153 case 2: /* EAPSR */
7154 xpsr_write(env, val, 0xfe00fc00);
7155 break;
7156 case 3: /* xPSR */
7157 xpsr_write(env, val, 0xfe00fc00);
7158 break;
7159 case 5: /* IPSR */
7160 /* IPSR bits are readonly. */
7161 break;
7162 case 6: /* EPSR */
7163 xpsr_write(env, val, 0x0600fc00);
7164 break;
7165 case 7: /* IEPSR */
7166 xpsr_write(env, val, 0x0600fc00);
7167 break;
7168 case 8: /* MSP */
7169 if (env->v7m.current_sp)
7170 env->v7m.other_sp = val;
7171 else
7172 env->regs[13] = val;
7173 break;
7174 case 9: /* PSP */
7175 if (env->v7m.current_sp)
7176 env->regs[13] = val;
7177 else
7178 env->v7m.other_sp = val;
7179 break;
7180 case 16: /* PRIMASK */
7181 if (val & 1) {
7182 env->daif |= PSTATE_I;
7183 } else {
7184 env->daif &= ~PSTATE_I;
7186 break;
7187 case 17: /* BASEPRI */
7188 env->v7m.basepri = val & 0xff;
7189 break;
7190 case 18: /* BASEPRI_MAX */
7191 val &= 0xff;
7192 if (val != 0 && (val < env->v7m.basepri || env->v7m.basepri == 0))
7193 env->v7m.basepri = val;
7194 break;
7195 case 19: /* FAULTMASK */
7196 if (val & 1) {
7197 env->daif |= PSTATE_F;
7198 } else {
7199 env->daif &= ~PSTATE_F;
7201 break;
7202 case 20: /* CONTROL */
7203 env->v7m.control = val & 3;
7204 switch_v7m_sp(env, (val & 2) != 0);
7205 break;
7206 default:
7207 /* ??? For debugging only. */
7208 cpu_abort(CPU(cpu), "Unimplemented system register write (%d)\n", reg);
7209 return;
7213 #endif
7215 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
7217 /* Implement DC ZVA, which zeroes a fixed-length block of memory.
7218 * Note that we do not implement the (architecturally mandated)
7219 * alignment fault for attempts to use this on Device memory
7220 * (which matches the usual QEMU behaviour of not implementing either
7221 * alignment faults or any memory attribute handling).
7224 ARMCPU *cpu = arm_env_get_cpu(env);
7225 uint64_t blocklen = 4 << cpu->dcz_blocksize;
7226 uint64_t vaddr = vaddr_in & ~(blocklen - 1);
7228 #ifndef CONFIG_USER_ONLY
7230 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than
7231 * the block size so we might have to do more than one TLB lookup.
7232 * We know that in fact for any v8 CPU the page size is at least 4K
7233 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
7234 * 1K as an artefact of legacy v5 subpage support being present in the
7235 * same QEMU executable.
7237 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
7238 void *hostaddr[maxidx];
7239 int try, i;
7240 unsigned mmu_idx = cpu_mmu_index(env, false);
7241 TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
7243 for (try = 0; try < 2; try++) {
7245 for (i = 0; i < maxidx; i++) {
7246 hostaddr[i] = tlb_vaddr_to_host(env,
7247 vaddr + TARGET_PAGE_SIZE * i,
7248 1, mmu_idx);
7249 if (!hostaddr[i]) {
7250 break;
7253 if (i == maxidx) {
7254 /* If it's all in the TLB it's fair game for just writing to;
7255 * we know we don't need to update dirty status, etc.
7257 for (i = 0; i < maxidx - 1; i++) {
7258 memset(hostaddr[i], 0, TARGET_PAGE_SIZE);
7260 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE));
7261 return;
7263 /* OK, try a store and see if we can populate the tlb. This
7264 * might cause an exception if the memory isn't writable,
7265 * in which case we will longjmp out of here. We must for
7266 * this purpose use the actual register value passed to us
7267 * so that we get the fault address right.
7269 helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETRA());
7270 /* Now we can populate the other TLB entries, if any */
7271 for (i = 0; i < maxidx; i++) {
7272 uint64_t va = vaddr + TARGET_PAGE_SIZE * i;
7273 if (va != (vaddr_in & TARGET_PAGE_MASK)) {
7274 helper_ret_stb_mmu(env, va, 0, oi, GETRA());
7279 /* Slow path (probably attempt to do this to an I/O device or
7280 * similar, or clearing of a block of code we have translations
7281 * cached for). Just do a series of byte writes as the architecture
7282 * demands. It's not worth trying to use a cpu_physical_memory_map(),
7283 * memset(), unmap() sequence here because:
7284 * + we'd need to account for the blocksize being larger than a page
7285 * + the direct-RAM access case is almost always going to be dealt
7286 * with in the fastpath code above, so there's no speed benefit
7287 * + we would have to deal with the map returning NULL because the
7288 * bounce buffer was in use
7290 for (i = 0; i < blocklen; i++) {
7291 helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETRA());
7294 #else
7295 memset(g2h(vaddr), 0, blocklen);
7296 #endif
7299 /* Note that signed overflow is undefined in C. The following routines are
7300 careful to use unsigned types where modulo arithmetic is required.
7301 Failure to do so _will_ break on newer gcc. */
7303 /* Signed saturating arithmetic. */
7305 /* Perform 16-bit signed saturating addition. */
7306 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
7308 uint16_t res;
7310 res = a + b;
7311 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
7312 if (a & 0x8000)
7313 res = 0x8000;
7314 else
7315 res = 0x7fff;
7317 return res;
7320 /* Perform 8-bit signed saturating addition. */
7321 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
7323 uint8_t res;
7325 res = a + b;
7326 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
7327 if (a & 0x80)
7328 res = 0x80;
7329 else
7330 res = 0x7f;
7332 return res;
7335 /* Perform 16-bit signed saturating subtraction. */
7336 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
7338 uint16_t res;
7340 res = a - b;
7341 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
7342 if (a & 0x8000)
7343 res = 0x8000;
7344 else
7345 res = 0x7fff;
7347 return res;
7350 /* Perform 8-bit signed saturating subtraction. */
7351 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
7353 uint8_t res;
7355 res = a - b;
7356 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
7357 if (a & 0x80)
7358 res = 0x80;
7359 else
7360 res = 0x7f;
7362 return res;
7365 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
7366 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
7367 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
7368 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
7369 #define PFX q
7371 #include "op_addsub.h"
7373 /* Unsigned saturating arithmetic. */
7374 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
7376 uint16_t res;
7377 res = a + b;
7378 if (res < a)
7379 res = 0xffff;
7380 return res;
7383 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
7385 if (a > b)
7386 return a - b;
7387 else
7388 return 0;
7391 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
7393 uint8_t res;
7394 res = a + b;
7395 if (res < a)
7396 res = 0xff;
7397 return res;
7400 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
7402 if (a > b)
7403 return a - b;
7404 else
7405 return 0;
7408 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
7409 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
7410 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
7411 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
7412 #define PFX uq
7414 #include "op_addsub.h"
7416 /* Signed modulo arithmetic. */
7417 #define SARITH16(a, b, n, op) do { \
7418 int32_t sum; \
7419 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
7420 RESULT(sum, n, 16); \
7421 if (sum >= 0) \
7422 ge |= 3 << (n * 2); \
7423 } while(0)
7425 #define SARITH8(a, b, n, op) do { \
7426 int32_t sum; \
7427 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
7428 RESULT(sum, n, 8); \
7429 if (sum >= 0) \
7430 ge |= 1 << n; \
7431 } while(0)
7434 #define ADD16(a, b, n) SARITH16(a, b, n, +)
7435 #define SUB16(a, b, n) SARITH16(a, b, n, -)
7436 #define ADD8(a, b, n) SARITH8(a, b, n, +)
7437 #define SUB8(a, b, n) SARITH8(a, b, n, -)
7438 #define PFX s
7439 #define ARITH_GE
7441 #include "op_addsub.h"
7443 /* Unsigned modulo arithmetic. */
7444 #define ADD16(a, b, n) do { \
7445 uint32_t sum; \
7446 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
7447 RESULT(sum, n, 16); \
7448 if ((sum >> 16) == 1) \
7449 ge |= 3 << (n * 2); \
7450 } while(0)
7452 #define ADD8(a, b, n) do { \
7453 uint32_t sum; \
7454 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
7455 RESULT(sum, n, 8); \
7456 if ((sum >> 8) == 1) \
7457 ge |= 1 << n; \
7458 } while(0)
7460 #define SUB16(a, b, n) do { \
7461 uint32_t sum; \
7462 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
7463 RESULT(sum, n, 16); \
7464 if ((sum >> 16) == 0) \
7465 ge |= 3 << (n * 2); \
7466 } while(0)
7468 #define SUB8(a, b, n) do { \
7469 uint32_t sum; \
7470 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
7471 RESULT(sum, n, 8); \
7472 if ((sum >> 8) == 0) \
7473 ge |= 1 << n; \
7474 } while(0)
7476 #define PFX u
7477 #define ARITH_GE
7479 #include "op_addsub.h"
7481 /* Halved signed arithmetic. */
7482 #define ADD16(a, b, n) \
7483 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
7484 #define SUB16(a, b, n) \
7485 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
7486 #define ADD8(a, b, n) \
7487 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
7488 #define SUB8(a, b, n) \
7489 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
7490 #define PFX sh
7492 #include "op_addsub.h"
7494 /* Halved unsigned arithmetic. */
7495 #define ADD16(a, b, n) \
7496 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
7497 #define SUB16(a, b, n) \
7498 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
7499 #define ADD8(a, b, n) \
7500 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
7501 #define SUB8(a, b, n) \
7502 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
7503 #define PFX uh
7505 #include "op_addsub.h"
7507 static inline uint8_t do_usad(uint8_t a, uint8_t b)
7509 if (a > b)
7510 return a - b;
7511 else
7512 return b - a;
7515 /* Unsigned sum of absolute byte differences. */
7516 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
7518 uint32_t sum;
7519 sum = do_usad(a, b);
7520 sum += do_usad(a >> 8, b >> 8);
7521 sum += do_usad(a >> 16, b >>16);
7522 sum += do_usad(a >> 24, b >> 24);
7523 return sum;
7526 /* For ARMv6 SEL instruction. */
7527 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
7529 uint32_t mask;
7531 mask = 0;
7532 if (flags & 1)
7533 mask |= 0xff;
7534 if (flags & 2)
7535 mask |= 0xff00;
7536 if (flags & 4)
7537 mask |= 0xff0000;
7538 if (flags & 8)
7539 mask |= 0xff000000;
7540 return (a & mask) | (b & ~mask);
7543 /* VFP support. We follow the convention used for VFP instructions:
7544 Single precision routines have a "s" suffix, double precision a
7545 "d" suffix. */
7547 /* Convert host exception flags to vfp form. */
7548 static inline int vfp_exceptbits_from_host(int host_bits)
7550 int target_bits = 0;
7552 if (host_bits & float_flag_invalid)
7553 target_bits |= 1;
7554 if (host_bits & float_flag_divbyzero)
7555 target_bits |= 2;
7556 if (host_bits & float_flag_overflow)
7557 target_bits |= 4;
7558 if (host_bits & (float_flag_underflow | float_flag_output_denormal))
7559 target_bits |= 8;
7560 if (host_bits & float_flag_inexact)
7561 target_bits |= 0x10;
7562 if (host_bits & float_flag_input_denormal)
7563 target_bits |= 0x80;
7564 return target_bits;
7567 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
7569 int i;
7570 uint32_t fpscr;
7572 fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
7573 | (env->vfp.vec_len << 16)
7574 | (env->vfp.vec_stride << 20);
7575 i = get_float_exception_flags(&env->vfp.fp_status);
7576 i |= get_float_exception_flags(&env->vfp.standard_fp_status);
7577 fpscr |= vfp_exceptbits_from_host(i);
7578 return fpscr;
7581 uint32_t vfp_get_fpscr(CPUARMState *env)
7583 return HELPER(vfp_get_fpscr)(env);
7586 /* Convert vfp exception flags to target form. */
7587 static inline int vfp_exceptbits_to_host(int target_bits)
7589 int host_bits = 0;
7591 if (target_bits & 1)
7592 host_bits |= float_flag_invalid;
7593 if (target_bits & 2)
7594 host_bits |= float_flag_divbyzero;
7595 if (target_bits & 4)
7596 host_bits |= float_flag_overflow;
7597 if (target_bits & 8)
7598 host_bits |= float_flag_underflow;
7599 if (target_bits & 0x10)
7600 host_bits |= float_flag_inexact;
7601 if (target_bits & 0x80)
7602 host_bits |= float_flag_input_denormal;
7603 return host_bits;
7606 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
7608 int i;
7609 uint32_t changed;
7611 changed = env->vfp.xregs[ARM_VFP_FPSCR];
7612 env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
7613 env->vfp.vec_len = (val >> 16) & 7;
7614 env->vfp.vec_stride = (val >> 20) & 3;
7616 changed ^= val;
7617 if (changed & (3 << 22)) {
7618 i = (val >> 22) & 3;
7619 switch (i) {
7620 case FPROUNDING_TIEEVEN:
7621 i = float_round_nearest_even;
7622 break;
7623 case FPROUNDING_POSINF:
7624 i = float_round_up;
7625 break;
7626 case FPROUNDING_NEGINF:
7627 i = float_round_down;
7628 break;
7629 case FPROUNDING_ZERO:
7630 i = float_round_to_zero;
7631 break;
7633 set_float_rounding_mode(i, &env->vfp.fp_status);
7635 if (changed & (1 << 24)) {
7636 set_flush_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
7637 set_flush_inputs_to_zero((val & (1 << 24)) != 0, &env->vfp.fp_status);
7639 if (changed & (1 << 25))
7640 set_default_nan_mode((val & (1 << 25)) != 0, &env->vfp.fp_status);
7642 i = vfp_exceptbits_to_host(val);
7643 set_float_exception_flags(i, &env->vfp.fp_status);
7644 set_float_exception_flags(0, &env->vfp.standard_fp_status);
7647 void vfp_set_fpscr(CPUARMState *env, uint32_t val)
7649 HELPER(vfp_set_fpscr)(env, val);
7652 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p))
7654 #define VFP_BINOP(name) \
7655 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \
7657 float_status *fpst = fpstp; \
7658 return float32_ ## name(a, b, fpst); \
7660 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \
7662 float_status *fpst = fpstp; \
7663 return float64_ ## name(a, b, fpst); \
7665 VFP_BINOP(add)
7666 VFP_BINOP(sub)
7667 VFP_BINOP(mul)
7668 VFP_BINOP(div)
7669 VFP_BINOP(min)
7670 VFP_BINOP(max)
7671 VFP_BINOP(minnum)
7672 VFP_BINOP(maxnum)
7673 #undef VFP_BINOP
7675 float32 VFP_HELPER(neg, s)(float32 a)
7677 return float32_chs(a);
7680 float64 VFP_HELPER(neg, d)(float64 a)
7682 return float64_chs(a);
7685 float32 VFP_HELPER(abs, s)(float32 a)
7687 return float32_abs(a);
7690 float64 VFP_HELPER(abs, d)(float64 a)
7692 return float64_abs(a);
7695 float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env)
7697 return float32_sqrt(a, &env->vfp.fp_status);
7700 float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)
7702 return float64_sqrt(a, &env->vfp.fp_status);
7705 /* XXX: check quiet/signaling case */
7706 #define DO_VFP_cmp(p, type) \
7707 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env) \
7709 uint32_t flags; \
7710 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
7711 case 0: flags = 0x6; break; \
7712 case -1: flags = 0x8; break; \
7713 case 1: flags = 0x2; break; \
7714 default: case 2: flags = 0x3; break; \
7716 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
7717 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
7719 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
7721 uint32_t flags; \
7722 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
7723 case 0: flags = 0x6; break; \
7724 case -1: flags = 0x8; break; \
7725 case 1: flags = 0x2; break; \
7726 default: case 2: flags = 0x3; break; \
7728 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
7729 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
7731 DO_VFP_cmp(s, float32)
7732 DO_VFP_cmp(d, float64)
7733 #undef DO_VFP_cmp
7735 /* Integer to float and float to integer conversions */
7737 #define CONV_ITOF(name, fsz, sign) \
7738 float##fsz HELPER(name)(uint32_t x, void *fpstp) \
7740 float_status *fpst = fpstp; \
7741 return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
7744 #define CONV_FTOI(name, fsz, sign, round) \
7745 uint32_t HELPER(name)(float##fsz x, void *fpstp) \
7747 float_status *fpst = fpstp; \
7748 if (float##fsz##_is_any_nan(x)) { \
7749 float_raise(float_flag_invalid, fpst); \
7750 return 0; \
7752 return float##fsz##_to_##sign##int32##round(x, fpst); \
7755 #define FLOAT_CONVS(name, p, fsz, sign) \
7756 CONV_ITOF(vfp_##name##to##p, fsz, sign) \
7757 CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
7758 CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
7760 FLOAT_CONVS(si, s, 32, )
7761 FLOAT_CONVS(si, d, 64, )
7762 FLOAT_CONVS(ui, s, 32, u)
7763 FLOAT_CONVS(ui, d, 64, u)
7765 #undef CONV_ITOF
7766 #undef CONV_FTOI
7767 #undef FLOAT_CONVS
7769 /* floating point conversion */
7770 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env)
7772 float64 r = float32_to_float64(x, &env->vfp.fp_status);
7773 /* ARM requires that S<->D conversion of any kind of NaN generates
7774 * a quiet NaN by forcing the most significant frac bit to 1.
7776 return float64_maybe_silence_nan(r);
7779 float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env)
7781 float32 r = float64_to_float32(x, &env->vfp.fp_status);
7782 /* ARM requires that S<->D conversion of any kind of NaN generates
7783 * a quiet NaN by forcing the most significant frac bit to 1.
7785 return float32_maybe_silence_nan(r);
7788 /* VFP3 fixed point conversion. */
7789 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
7790 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t x, uint32_t shift, \
7791 void *fpstp) \
7793 float_status *fpst = fpstp; \
7794 float##fsz tmp; \
7795 tmp = itype##_to_##float##fsz(x, fpst); \
7796 return float##fsz##_scalbn(tmp, -(int)shift, fpst); \
7799 /* Notice that we want only input-denormal exception flags from the
7800 * scalbn operation: the other possible flags (overflow+inexact if
7801 * we overflow to infinity, output-denormal) aren't correct for the
7802 * complete scale-and-convert operation.
7804 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, round) \
7805 uint##isz##_t HELPER(vfp_to##name##p##round)(float##fsz x, \
7806 uint32_t shift, \
7807 void *fpstp) \
7809 float_status *fpst = fpstp; \
7810 int old_exc_flags = get_float_exception_flags(fpst); \
7811 float##fsz tmp; \
7812 if (float##fsz##_is_any_nan(x)) { \
7813 float_raise(float_flag_invalid, fpst); \
7814 return 0; \
7816 tmp = float##fsz##_scalbn(x, shift, fpst); \
7817 old_exc_flags |= get_float_exception_flags(fpst) \
7818 & float_flag_input_denormal; \
7819 set_float_exception_flags(old_exc_flags, fpst); \
7820 return float##fsz##_to_##itype##round(tmp, fpst); \
7823 #define VFP_CONV_FIX(name, p, fsz, isz, itype) \
7824 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
7825 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, _round_to_zero) \
7826 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
7828 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype) \
7829 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \
7830 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, )
7832 VFP_CONV_FIX(sh, d, 64, 64, int16)
7833 VFP_CONV_FIX(sl, d, 64, 64, int32)
7834 VFP_CONV_FIX_A64(sq, d, 64, 64, int64)
7835 VFP_CONV_FIX(uh, d, 64, 64, uint16)
7836 VFP_CONV_FIX(ul, d, 64, 64, uint32)
7837 VFP_CONV_FIX_A64(uq, d, 64, 64, uint64)
7838 VFP_CONV_FIX(sh, s, 32, 32, int16)
7839 VFP_CONV_FIX(sl, s, 32, 32, int32)
7840 VFP_CONV_FIX_A64(sq, s, 32, 64, int64)
7841 VFP_CONV_FIX(uh, s, 32, 32, uint16)
7842 VFP_CONV_FIX(ul, s, 32, 32, uint32)
7843 VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
7844 #undef VFP_CONV_FIX
7845 #undef VFP_CONV_FIX_FLOAT
7846 #undef VFP_CONV_FLOAT_FIX_ROUND
7848 /* Set the current fp rounding mode and return the old one.
7849 * The argument is a softfloat float_round_ value.
7851 uint32_t HELPER(set_rmode)(uint32_t rmode, CPUARMState *env)
7853 float_status *fp_status = &env->vfp.fp_status;
7855 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
7856 set_float_rounding_mode(rmode, fp_status);
7858 return prev_rmode;
7861 /* Set the current fp rounding mode in the standard fp status and return
7862 * the old one. This is for NEON instructions that need to change the
7863 * rounding mode but wish to use the standard FPSCR values for everything
7864 * else. Always set the rounding mode back to the correct value after
7865 * modifying it.
7866 * The argument is a softfloat float_round_ value.
7868 uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)
7870 float_status *fp_status = &env->vfp.standard_fp_status;
7872 uint32_t prev_rmode = get_float_rounding_mode(fp_status);
7873 set_float_rounding_mode(rmode, fp_status);
7875 return prev_rmode;
7878 /* Half precision conversions. */
7879 static float32 do_fcvt_f16_to_f32(uint32_t a, CPUARMState *env, float_status *s)
7881 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7882 float32 r = float16_to_float32(make_float16(a), ieee, s);
7883 if (ieee) {
7884 return float32_maybe_silence_nan(r);
7886 return r;
7889 static uint32_t do_fcvt_f32_to_f16(float32 a, CPUARMState *env, float_status *s)
7891 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7892 float16 r = float32_to_float16(a, ieee, s);
7893 if (ieee) {
7894 r = float16_maybe_silence_nan(r);
7896 return float16_val(r);
7899 float32 HELPER(neon_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
7901 return do_fcvt_f16_to_f32(a, env, &env->vfp.standard_fp_status);
7904 uint32_t HELPER(neon_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
7906 return do_fcvt_f32_to_f16(a, env, &env->vfp.standard_fp_status);
7909 float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, CPUARMState *env)
7911 return do_fcvt_f16_to_f32(a, env, &env->vfp.fp_status);
7914 uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, CPUARMState *env)
7916 return do_fcvt_f32_to_f16(a, env, &env->vfp.fp_status);
7919 float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, CPUARMState *env)
7921 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7922 float64 r = float16_to_float64(make_float16(a), ieee, &env->vfp.fp_status);
7923 if (ieee) {
7924 return float64_maybe_silence_nan(r);
7926 return r;
7929 uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, CPUARMState *env)
7931 int ieee = (env->vfp.xregs[ARM_VFP_FPSCR] & (1 << 26)) == 0;
7932 float16 r = float64_to_float16(a, ieee, &env->vfp.fp_status);
7933 if (ieee) {
7934 r = float16_maybe_silence_nan(r);
7936 return float16_val(r);
7939 #define float32_two make_float32(0x40000000)
7940 #define float32_three make_float32(0x40400000)
7941 #define float32_one_point_five make_float32(0x3fc00000)
7943 float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env)
7945 float_status *s = &env->vfp.standard_fp_status;
7946 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
7947 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
7948 if (!(float32_is_zero(a) || float32_is_zero(b))) {
7949 float_raise(float_flag_input_denormal, s);
7951 return float32_two;
7953 return float32_sub(float32_two, float32_mul(a, b, s), s);
7956 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env)
7958 float_status *s = &env->vfp.standard_fp_status;
7959 float32 product;
7960 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) ||
7961 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) {
7962 if (!(float32_is_zero(a) || float32_is_zero(b))) {
7963 float_raise(float_flag_input_denormal, s);
7965 return float32_one_point_five;
7967 product = float32_mul(a, b, s);
7968 return float32_div(float32_sub(float32_three, product, s), float32_two, s);
7971 /* NEON helpers. */
7973 /* Constants 256 and 512 are used in some helpers; we avoid relying on
7974 * int->float conversions at run-time. */
7975 #define float64_256 make_float64(0x4070000000000000LL)
7976 #define float64_512 make_float64(0x4080000000000000LL)
7977 #define float32_maxnorm make_float32(0x7f7fffff)
7978 #define float64_maxnorm make_float64(0x7fefffffffffffffLL)
7980 /* Reciprocal functions
7982 * The algorithm that must be used to calculate the estimate
7983 * is specified by the ARM ARM, see FPRecipEstimate()
7986 static float64 recip_estimate(float64 a, float_status *real_fp_status)
7988 /* These calculations mustn't set any fp exception flags,
7989 * so we use a local copy of the fp_status.
7991 float_status dummy_status = *real_fp_status;
7992 float_status *s = &dummy_status;
7993 /* q = (int)(a * 512.0) */
7994 float64 q = float64_mul(float64_512, a, s);
7995 int64_t q_int = float64_to_int64_round_to_zero(q, s);
7997 /* r = 1.0 / (((double)q + 0.5) / 512.0) */
7998 q = int64_to_float64(q_int, s);
7999 q = float64_add(q, float64_half, s);
8000 q = float64_div(q, float64_512, s);
8001 q = float64_div(float64_one, q, s);
8003 /* s = (int)(256.0 * r + 0.5) */
8004 q = float64_mul(q, float64_256, s);
8005 q = float64_add(q, float64_half, s);
8006 q_int = float64_to_int64_round_to_zero(q, s);
8008 /* return (double)s / 256.0 */
8009 return float64_div(int64_to_float64(q_int, s), float64_256, s);
8012 /* Common wrapper to call recip_estimate */
8013 static float64 call_recip_estimate(float64 num, int off, float_status *fpst)
8015 uint64_t val64 = float64_val(num);
8016 uint64_t frac = extract64(val64, 0, 52);
8017 int64_t exp = extract64(val64, 52, 11);
8018 uint64_t sbit;
8019 float64 scaled, estimate;
8021 /* Generate the scaled number for the estimate function */
8022 if (exp == 0) {
8023 if (extract64(frac, 51, 1) == 0) {
8024 exp = -1;
8025 frac = extract64(frac, 0, 50) << 2;
8026 } else {
8027 frac = extract64(frac, 0, 51) << 1;
8031 /* scaled = '0' : '01111111110' : fraction<51:44> : Zeros(44); */
8032 scaled = make_float64((0x3feULL << 52)
8033 | extract64(frac, 44, 8) << 44);
8035 estimate = recip_estimate(scaled, fpst);
8037 /* Build new result */
8038 val64 = float64_val(estimate);
8039 sbit = 0x8000000000000000ULL & val64;
8040 exp = off - exp;
8041 frac = extract64(val64, 0, 52);
8043 if (exp == 0) {
8044 frac = 1ULL << 51 | extract64(frac, 1, 51);
8045 } else if (exp == -1) {
8046 frac = 1ULL << 50 | extract64(frac, 2, 50);
8047 exp = 0;
8050 return make_float64(sbit | (exp << 52) | frac);
8053 static bool round_to_inf(float_status *fpst, bool sign_bit)
8055 switch (fpst->float_rounding_mode) {
8056 case float_round_nearest_even: /* Round to Nearest */
8057 return true;
8058 case float_round_up: /* Round to +Inf */
8059 return !sign_bit;
8060 case float_round_down: /* Round to -Inf */
8061 return sign_bit;
8062 case float_round_to_zero: /* Round to Zero */
8063 return false;
8066 g_assert_not_reached();
8069 float32 HELPER(recpe_f32)(float32 input, void *fpstp)
8071 float_status *fpst = fpstp;
8072 float32 f32 = float32_squash_input_denormal(input, fpst);
8073 uint32_t f32_val = float32_val(f32);
8074 uint32_t f32_sbit = 0x80000000ULL & f32_val;
8075 int32_t f32_exp = extract32(f32_val, 23, 8);
8076 uint32_t f32_frac = extract32(f32_val, 0, 23);
8077 float64 f64, r64;
8078 uint64_t r64_val;
8079 int64_t r64_exp;
8080 uint64_t r64_frac;
8082 if (float32_is_any_nan(f32)) {
8083 float32 nan = f32;
8084 if (float32_is_signaling_nan(f32)) {
8085 float_raise(float_flag_invalid, fpst);
8086 nan = float32_maybe_silence_nan(f32);
8088 if (fpst->default_nan_mode) {
8089 nan = float32_default_nan;
8091 return nan;
8092 } else if (float32_is_infinity(f32)) {
8093 return float32_set_sign(float32_zero, float32_is_neg(f32));
8094 } else if (float32_is_zero(f32)) {
8095 float_raise(float_flag_divbyzero, fpst);
8096 return float32_set_sign(float32_infinity, float32_is_neg(f32));
8097 } else if ((f32_val & ~(1ULL << 31)) < (1ULL << 21)) {
8098 /* Abs(value) < 2.0^-128 */
8099 float_raise(float_flag_overflow | float_flag_inexact, fpst);
8100 if (round_to_inf(fpst, f32_sbit)) {
8101 return float32_set_sign(float32_infinity, float32_is_neg(f32));
8102 } else {
8103 return float32_set_sign(float32_maxnorm, float32_is_neg(f32));
8105 } else if (f32_exp >= 253 && fpst->flush_to_zero) {
8106 float_raise(float_flag_underflow, fpst);
8107 return float32_set_sign(float32_zero, float32_is_neg(f32));
8111 f64 = make_float64(((int64_t)(f32_exp) << 52) | (int64_t)(f32_frac) << 29);
8112 r64 = call_recip_estimate(f64, 253, fpst);
8113 r64_val = float64_val(r64);
8114 r64_exp = extract64(r64_val, 52, 11);
8115 r64_frac = extract64(r64_val, 0, 52);
8117 /* result = sign : result_exp<7:0> : fraction<51:29>; */
8118 return make_float32(f32_sbit |
8119 (r64_exp & 0xff) << 23 |
8120 extract64(r64_frac, 29, 24));
8123 float64 HELPER(recpe_f64)(float64 input, void *fpstp)
8125 float_status *fpst = fpstp;
8126 float64 f64 = float64_squash_input_denormal(input, fpst);
8127 uint64_t f64_val = float64_val(f64);
8128 uint64_t f64_sbit = 0x8000000000000000ULL & f64_val;
8129 int64_t f64_exp = extract64(f64_val, 52, 11);
8130 float64 r64;
8131 uint64_t r64_val;
8132 int64_t r64_exp;
8133 uint64_t r64_frac;
8135 /* Deal with any special cases */
8136 if (float64_is_any_nan(f64)) {
8137 float64 nan = f64;
8138 if (float64_is_signaling_nan(f64)) {
8139 float_raise(float_flag_invalid, fpst);
8140 nan = float64_maybe_silence_nan(f64);
8142 if (fpst->default_nan_mode) {
8143 nan = float64_default_nan;
8145 return nan;
8146 } else if (float64_is_infinity(f64)) {
8147 return float64_set_sign(float64_zero, float64_is_neg(f64));
8148 } else if (float64_is_zero(f64)) {
8149 float_raise(float_flag_divbyzero, fpst);
8150 return float64_set_sign(float64_infinity, float64_is_neg(f64));
8151 } else if ((f64_val & ~(1ULL << 63)) < (1ULL << 50)) {
8152 /* Abs(value) < 2.0^-1024 */
8153 float_raise(float_flag_overflow | float_flag_inexact, fpst);
8154 if (round_to_inf(fpst, f64_sbit)) {
8155 return float64_set_sign(float64_infinity, float64_is_neg(f64));
8156 } else {
8157 return float64_set_sign(float64_maxnorm, float64_is_neg(f64));
8159 } else if (f64_exp >= 2045 && fpst->flush_to_zero) {
8160 float_raise(float_flag_underflow, fpst);
8161 return float64_set_sign(float64_zero, float64_is_neg(f64));
8164 r64 = call_recip_estimate(f64, 2045, fpst);
8165 r64_val = float64_val(r64);
8166 r64_exp = extract64(r64_val, 52, 11);
8167 r64_frac = extract64(r64_val, 0, 52);
8169 /* result = sign : result_exp<10:0> : fraction<51:0> */
8170 return make_float64(f64_sbit |
8171 ((r64_exp & 0x7ff) << 52) |
8172 r64_frac);
8175 /* The algorithm that must be used to calculate the estimate
8176 * is specified by the ARM ARM.
8178 static float64 recip_sqrt_estimate(float64 a, float_status *real_fp_status)
8180 /* These calculations mustn't set any fp exception flags,
8181 * so we use a local copy of the fp_status.
8183 float_status dummy_status = *real_fp_status;
8184 float_status *s = &dummy_status;
8185 float64 q;
8186 int64_t q_int;
8188 if (float64_lt(a, float64_half, s)) {
8189 /* range 0.25 <= a < 0.5 */
8191 /* a in units of 1/512 rounded down */
8192 /* q0 = (int)(a * 512.0); */
8193 q = float64_mul(float64_512, a, s);
8194 q_int = float64_to_int64_round_to_zero(q, s);
8196 /* reciprocal root r */
8197 /* r = 1.0 / sqrt(((double)q0 + 0.5) / 512.0); */
8198 q = int64_to_float64(q_int, s);
8199 q = float64_add(q, float64_half, s);
8200 q = float64_div(q, float64_512, s);
8201 q = float64_sqrt(q, s);
8202 q = float64_div(float64_one, q, s);
8203 } else {
8204 /* range 0.5 <= a < 1.0 */
8206 /* a in units of 1/256 rounded down */
8207 /* q1 = (int)(a * 256.0); */
8208 q = float64_mul(float64_256, a, s);
8209 int64_t q_int = float64_to_int64_round_to_zero(q, s);
8211 /* reciprocal root r */
8212 /* r = 1.0 /sqrt(((double)q1 + 0.5) / 256); */
8213 q = int64_to_float64(q_int, s);
8214 q = float64_add(q, float64_half, s);
8215 q = float64_div(q, float64_256, s);
8216 q = float64_sqrt(q, s);
8217 q = float64_div(float64_one, q, s);
8219 /* r in units of 1/256 rounded to nearest */
8220 /* s = (int)(256.0 * r + 0.5); */
8222 q = float64_mul(q, float64_256,s );
8223 q = float64_add(q, float64_half, s);
8224 q_int = float64_to_int64_round_to_zero(q, s);
8226 /* return (double)s / 256.0;*/
8227 return float64_div(int64_to_float64(q_int, s), float64_256, s);
8230 float32 HELPER(rsqrte_f32)(float32 input, void *fpstp)
8232 float_status *s = fpstp;
8233 float32 f32 = float32_squash_input_denormal(input, s);
8234 uint32_t val = float32_val(f32);
8235 uint32_t f32_sbit = 0x80000000 & val;
8236 int32_t f32_exp = extract32(val, 23, 8);
8237 uint32_t f32_frac = extract32(val, 0, 23);
8238 uint64_t f64_frac;
8239 uint64_t val64;
8240 int result_exp;
8241 float64 f64;
8243 if (float32_is_any_nan(f32)) {
8244 float32 nan = f32;
8245 if (float32_is_signaling_nan(f32)) {
8246 float_raise(float_flag_invalid, s);
8247 nan = float32_maybe_silence_nan(f32);
8249 if (s->default_nan_mode) {
8250 nan = float32_default_nan;
8252 return nan;
8253 } else if (float32_is_zero(f32)) {
8254 float_raise(float_flag_divbyzero, s);
8255 return float32_set_sign(float32_infinity, float32_is_neg(f32));
8256 } else if (float32_is_neg(f32)) {
8257 float_raise(float_flag_invalid, s);
8258 return float32_default_nan;
8259 } else if (float32_is_infinity(f32)) {
8260 return float32_zero;
8263 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
8264 * preserving the parity of the exponent. */
8266 f64_frac = ((uint64_t) f32_frac) << 29;
8267 if (f32_exp == 0) {
8268 while (extract64(f64_frac, 51, 1) == 0) {
8269 f64_frac = f64_frac << 1;
8270 f32_exp = f32_exp-1;
8272 f64_frac = extract64(f64_frac, 0, 51) << 1;
8275 if (extract64(f32_exp, 0, 1) == 0) {
8276 f64 = make_float64(((uint64_t) f32_sbit) << 32
8277 | (0x3feULL << 52)
8278 | f64_frac);
8279 } else {
8280 f64 = make_float64(((uint64_t) f32_sbit) << 32
8281 | (0x3fdULL << 52)
8282 | f64_frac);
8285 result_exp = (380 - f32_exp) / 2;
8287 f64 = recip_sqrt_estimate(f64, s);
8289 val64 = float64_val(f64);
8291 val = ((result_exp & 0xff) << 23)
8292 | ((val64 >> 29) & 0x7fffff);
8293 return make_float32(val);
8296 float64 HELPER(rsqrte_f64)(float64 input, void *fpstp)
8298 float_status *s = fpstp;
8299 float64 f64 = float64_squash_input_denormal(input, s);
8300 uint64_t val = float64_val(f64);
8301 uint64_t f64_sbit = 0x8000000000000000ULL & val;
8302 int64_t f64_exp = extract64(val, 52, 11);
8303 uint64_t f64_frac = extract64(val, 0, 52);
8304 int64_t result_exp;
8305 uint64_t result_frac;
8307 if (float64_is_any_nan(f64)) {
8308 float64 nan = f64;
8309 if (float64_is_signaling_nan(f64)) {
8310 float_raise(float_flag_invalid, s);
8311 nan = float64_maybe_silence_nan(f64);
8313 if (s->default_nan_mode) {
8314 nan = float64_default_nan;
8316 return nan;
8317 } else if (float64_is_zero(f64)) {
8318 float_raise(float_flag_divbyzero, s);
8319 return float64_set_sign(float64_infinity, float64_is_neg(f64));
8320 } else if (float64_is_neg(f64)) {
8321 float_raise(float_flag_invalid, s);
8322 return float64_default_nan;
8323 } else if (float64_is_infinity(f64)) {
8324 return float64_zero;
8327 /* Scale and normalize to a double-precision value between 0.25 and 1.0,
8328 * preserving the parity of the exponent. */
8330 if (f64_exp == 0) {
8331 while (extract64(f64_frac, 51, 1) == 0) {
8332 f64_frac = f64_frac << 1;
8333 f64_exp = f64_exp - 1;
8335 f64_frac = extract64(f64_frac, 0, 51) << 1;
8338 if (extract64(f64_exp, 0, 1) == 0) {
8339 f64 = make_float64(f64_sbit
8340 | (0x3feULL << 52)
8341 | f64_frac);
8342 } else {
8343 f64 = make_float64(f64_sbit
8344 | (0x3fdULL << 52)
8345 | f64_frac);
8348 result_exp = (3068 - f64_exp) / 2;
8350 f64 = recip_sqrt_estimate(f64, s);
8352 result_frac = extract64(float64_val(f64), 0, 52);
8354 return make_float64(f64_sbit |
8355 ((result_exp & 0x7ff) << 52) |
8356 result_frac);
8359 uint32_t HELPER(recpe_u32)(uint32_t a, void *fpstp)
8361 float_status *s = fpstp;
8362 float64 f64;
8364 if ((a & 0x80000000) == 0) {
8365 return 0xffffffff;
8368 f64 = make_float64((0x3feULL << 52)
8369 | ((int64_t)(a & 0x7fffffff) << 21));
8371 f64 = recip_estimate(f64, s);
8373 return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
8376 uint32_t HELPER(rsqrte_u32)(uint32_t a, void *fpstp)
8378 float_status *fpst = fpstp;
8379 float64 f64;
8381 if ((a & 0xc0000000) == 0) {
8382 return 0xffffffff;
8385 if (a & 0x80000000) {
8386 f64 = make_float64((0x3feULL << 52)
8387 | ((uint64_t)(a & 0x7fffffff) << 21));
8388 } else { /* bits 31-30 == '01' */
8389 f64 = make_float64((0x3fdULL << 52)
8390 | ((uint64_t)(a & 0x3fffffff) << 22));
8393 f64 = recip_sqrt_estimate(f64, fpst);
8395 return 0x80000000 | ((float64_val(f64) >> 21) & 0x7fffffff);
8398 /* VFPv4 fused multiply-accumulate */
8399 float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp)
8401 float_status *fpst = fpstp;
8402 return float32_muladd(a, b, c, 0, fpst);
8405 float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp)
8407 float_status *fpst = fpstp;
8408 return float64_muladd(a, b, c, 0, fpst);
8411 /* ARMv8 round to integral */
8412 float32 HELPER(rints_exact)(float32 x, void *fp_status)
8414 return float32_round_to_int(x, fp_status);
8417 float64 HELPER(rintd_exact)(float64 x, void *fp_status)
8419 return float64_round_to_int(x, fp_status);
8422 float32 HELPER(rints)(float32 x, void *fp_status)
8424 int old_flags = get_float_exception_flags(fp_status), new_flags;
8425 float32 ret;
8427 ret = float32_round_to_int(x, fp_status);
8429 /* Suppress any inexact exceptions the conversion produced */
8430 if (!(old_flags & float_flag_inexact)) {
8431 new_flags = get_float_exception_flags(fp_status);
8432 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
8435 return ret;
8438 float64 HELPER(rintd)(float64 x, void *fp_status)
8440 int old_flags = get_float_exception_flags(fp_status), new_flags;
8441 float64 ret;
8443 ret = float64_round_to_int(x, fp_status);
8445 new_flags = get_float_exception_flags(fp_status);
8447 /* Suppress any inexact exceptions the conversion produced */
8448 if (!(old_flags & float_flag_inexact)) {
8449 new_flags = get_float_exception_flags(fp_status);
8450 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status);
8453 return ret;
8456 /* Convert ARM rounding mode to softfloat */
8457 int arm_rmode_to_sf(int rmode)
8459 switch (rmode) {
8460 case FPROUNDING_TIEAWAY:
8461 rmode = float_round_ties_away;
8462 break;
8463 case FPROUNDING_ODD:
8464 /* FIXME: add support for TIEAWAY and ODD */
8465 qemu_log_mask(LOG_UNIMP, "arm: unimplemented rounding mode: %d\n",
8466 rmode);
8467 case FPROUNDING_TIEEVEN:
8468 default:
8469 rmode = float_round_nearest_even;
8470 break;
8471 case FPROUNDING_POSINF:
8472 rmode = float_round_up;
8473 break;
8474 case FPROUNDING_NEGINF:
8475 rmode = float_round_down;
8476 break;
8477 case FPROUNDING_ZERO:
8478 rmode = float_round_to_zero;
8479 break;
8481 return rmode;
8484 /* CRC helpers.
8485 * The upper bytes of val (above the number specified by 'bytes') must have
8486 * been zeroed out by the caller.
8488 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
8490 uint8_t buf[4];
8492 stl_le_p(buf, val);
8494 /* zlib crc32 converts the accumulator and output to one's complement. */
8495 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
8498 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
8500 uint8_t buf[4];
8502 stl_le_p(buf, val);
8504 /* Linux crc32c converts the output to one's complement. */
8505 return crc32c(acc, buf, bytes) ^ 0xffffffff;