1 | /* |
2 | * ARM virtual CPU header |
3 | * |
4 | * Copyright (c) 2003 Fabrice Bellard |
5 | * |
6 | * This library is free software; you can redistribute it and/or |
7 | * modify it under the terms of the GNU Lesser General Public |
8 | * License as published by the Free Software Foundation; either |
9 | * version 2 of the License, or (at your option) any later version. |
10 | * |
11 | * This library is distributed in the hope that it will be useful, |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
14 | * Lesser General Public License for more details. |
15 | * |
16 | * You should have received a copy of the GNU Lesser General Public |
17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. |
18 | */ |
19 | |
20 | #ifndef ARM_CPU_H |
21 | #define ARM_CPU_H |
22 | |
23 | #include "kvm-consts.h" |
24 | #include "hw/registerfields.h" |
25 | #include "cpu-qom.h" |
26 | #include "exec/cpu-defs.h" |
27 | |
28 | /* ARM processors have a weak memory model */ |
29 | #define TCG_GUEST_DEFAULT_MO (0) |
30 | |
31 | #define EXCP_UDEF 1 /* undefined instruction */ |
32 | #define EXCP_SWI 2 /* software interrupt */ |
33 | #define EXCP_PREFETCH_ABORT 3 |
34 | #define EXCP_DATA_ABORT 4 |
35 | #define EXCP_IRQ 5 |
36 | #define EXCP_FIQ 6 |
37 | #define EXCP_BKPT 7 |
38 | #define EXCP_EXCEPTION_EXIT 8 /* Return from v7M exception. */ |
39 | #define EXCP_KERNEL_TRAP 9 /* Jumped to kernel code page. */ |
40 | #define EXCP_HVC 11 /* HyperVisor Call */ |
41 | #define EXCP_HYP_TRAP 12 |
42 | #define EXCP_SMC 13 /* Secure Monitor Call */ |
43 | #define EXCP_VIRQ 14 |
44 | #define EXCP_VFIQ 15 |
45 | #define EXCP_SEMIHOST 16 /* semihosting call */ |
46 | #define EXCP_NOCP 17 /* v7M NOCP UsageFault */ |
47 | #define EXCP_INVSTATE 18 /* v7M INVSTATE UsageFault */ |
48 | #define EXCP_STKOF 19 /* v8M STKOF UsageFault */ |
49 | #define EXCP_LAZYFP 20 /* v7M fault during lazy FP stacking */ |
50 | #define EXCP_LSERR 21 /* v8M LSERR SecureFault */ |
51 | #define EXCP_UNALIGNED 22 /* v7M UNALIGNED UsageFault */ |
52 | /* NB: add new EXCP_ defines to the array in arm_log_exception() too */ |
53 | |
54 | #define ARMV7M_EXCP_RESET 1 |
55 | #define ARMV7M_EXCP_NMI 2 |
56 | #define ARMV7M_EXCP_HARD 3 |
57 | #define ARMV7M_EXCP_MEM 4 |
58 | #define ARMV7M_EXCP_BUS 5 |
59 | #define ARMV7M_EXCP_USAGE 6 |
60 | #define ARMV7M_EXCP_SECURE 7 |
61 | #define ARMV7M_EXCP_SVC 11 |
62 | #define ARMV7M_EXCP_DEBUG 12 |
63 | #define ARMV7M_EXCP_PENDSV 14 |
64 | #define ARMV7M_EXCP_SYSTICK 15 |
65 | |
66 | /* For M profile, some registers are banked secure vs non-secure; |
67 | * these are represented as a 2-element array where the first element |
68 | * is the non-secure copy and the second is the secure copy. |
69 | * When the CPU does not have implement the security extension then |
70 | * only the first element is used. |
71 | * This means that the copy for the current security state can be |
72 | * accessed via env->registerfield[env->v7m.secure] (whether the security |
73 | * extension is implemented or not). |
74 | */ |
75 | enum { |
76 | M_REG_NS = 0, |
77 | M_REG_S = 1, |
78 | M_REG_NUM_BANKS = 2, |
79 | }; |
80 | |
81 | /* ARM-specific interrupt pending bits. */ |
82 | #define CPU_INTERRUPT_FIQ CPU_INTERRUPT_TGT_EXT_1 |
83 | #define CPU_INTERRUPT_VIRQ CPU_INTERRUPT_TGT_EXT_2 |
84 | #define CPU_INTERRUPT_VFIQ CPU_INTERRUPT_TGT_EXT_3 |
85 | |
86 | /* The usual mapping for an AArch64 system register to its AArch32 |
87 | * counterpart is for the 32 bit world to have access to the lower |
88 | * half only (with writes leaving the upper half untouched). It's |
89 | * therefore useful to be able to pass TCG the offset of the least |
90 | * significant half of a uint64_t struct member. |
91 | */ |
92 | #ifdef HOST_WORDS_BIGENDIAN |
93 | #define offsetoflow32(S, M) (offsetof(S, M) + sizeof(uint32_t)) |
94 | #define offsetofhigh32(S, M) offsetof(S, M) |
95 | #else |
96 | #define offsetoflow32(S, M) offsetof(S, M) |
97 | #define offsetofhigh32(S, M) (offsetof(S, M) + sizeof(uint32_t)) |
98 | #endif |
99 | |
100 | /* Meanings of the ARMCPU object's four inbound GPIO lines */ |
101 | #define ARM_CPU_IRQ 0 |
102 | #define ARM_CPU_FIQ 1 |
103 | #define ARM_CPU_VIRQ 2 |
104 | #define ARM_CPU_VFIQ 3 |
105 | |
106 | /* ARM-specific extra insn start words: |
107 | * 1: Conditional execution bits |
108 | * 2: Partial exception syndrome for data aborts |
109 | */ |
110 | #define 2 |
111 | |
112 | /* The 2nd extra word holding syndrome info for data aborts does not use |
113 | * the upper 6 bits nor the lower 14 bits. We mask and shift it down to |
114 | * help the sleb128 encoder do a better job. |
115 | * When restoring the CPU state, we shift it back up. |
116 | */ |
117 | #define ARM_INSN_START_WORD2_MASK ((1 << 26) - 1) |
118 | #define ARM_INSN_START_WORD2_SHIFT 14 |
119 | |
120 | /* We currently assume float and double are IEEE single and double |
121 | precision respectively. |
122 | Doing runtime conversions is tricky because VFP registers may contain |
123 | integer values (eg. as the result of a FTOSI instruction). |
124 | s<2n> maps to the least significant half of d<n> |
125 | s<2n+1> maps to the most significant half of d<n> |
126 | */ |
127 | |
128 | /** |
129 | * DynamicGDBXMLInfo: |
130 | * @desc: Contains the XML descriptions. |
131 | * @num_cpregs: Number of the Coprocessor registers seen by GDB. |
132 | * @cpregs_keys: Array that contains the corresponding Key of |
133 | * a given cpreg with the same order of the cpreg in the XML description. |
134 | */ |
135 | typedef struct DynamicGDBXMLInfo { |
136 | char *desc; |
137 | int num_cpregs; |
138 | uint32_t *cpregs_keys; |
139 | } DynamicGDBXMLInfo; |
140 | |
141 | /* CPU state for each instance of a generic timer (in cp15 c14) */ |
142 | typedef struct ARMGenericTimer { |
143 | uint64_t cval; /* Timer CompareValue register */ |
144 | uint64_t ctl; /* Timer Control register */ |
145 | } ARMGenericTimer; |
146 | |
147 | #define GTIMER_PHYS 0 |
148 | #define GTIMER_VIRT 1 |
149 | #define GTIMER_HYP 2 |
150 | #define GTIMER_SEC 3 |
151 | #define NUM_GTIMERS 4 |
152 | |
153 | typedef struct { |
154 | uint64_t raw_tcr; |
155 | uint32_t mask; |
156 | uint32_t base_mask; |
157 | } TCR; |
158 | |
159 | /* Define a maximum sized vector register. |
160 | * For 32-bit, this is a 128-bit NEON/AdvSIMD register. |
161 | * For 64-bit, this is a 2048-bit SVE register. |
162 | * |
163 | * Note that the mapping between S, D, and Q views of the register bank |
164 | * differs between AArch64 and AArch32. |
165 | * In AArch32: |
166 | * Qn = regs[n].d[1]:regs[n].d[0] |
167 | * Dn = regs[n / 2].d[n & 1] |
168 | * Sn = regs[n / 4].d[n % 4 / 2], |
169 | * bits 31..0 for even n, and bits 63..32 for odd n |
170 | * (and regs[16] to regs[31] are inaccessible) |
171 | * In AArch64: |
172 | * Zn = regs[n].d[*] |
173 | * Qn = regs[n].d[1]:regs[n].d[0] |
174 | * Dn = regs[n].d[0] |
175 | * Sn = regs[n].d[0] bits 31..0 |
176 | * Hn = regs[n].d[0] bits 15..0 |
177 | * |
178 | * This corresponds to the architecturally defined mapping between |
179 | * the two execution states, and means we do not need to explicitly |
180 | * map these registers when changing states. |
181 | * |
182 | * Align the data for use with TCG host vector operations. |
183 | */ |
184 | |
185 | #ifdef TARGET_AARCH64 |
186 | # define ARM_MAX_VQ 16 |
187 | #else |
188 | # define ARM_MAX_VQ 1 |
189 | #endif |
190 | |
191 | typedef struct ARMVectorReg { |
192 | uint64_t d[2 * ARM_MAX_VQ] QEMU_ALIGNED(16); |
193 | } ARMVectorReg; |
194 | |
195 | #ifdef TARGET_AARCH64 |
196 | /* In AArch32 mode, predicate registers do not exist at all. */ |
197 | typedef struct ARMPredicateReg { |
198 | uint64_t p[DIV_ROUND_UP(2 * ARM_MAX_VQ, 8)] QEMU_ALIGNED(16); |
199 | } ARMPredicateReg; |
200 | |
201 | /* In AArch32 mode, PAC keys do not exist at all. */ |
202 | typedef struct ARMPACKey { |
203 | uint64_t lo, hi; |
204 | } ARMPACKey; |
205 | #endif |
206 | |
207 | |
208 | typedef struct CPUARMState { |
209 | /* Regs for current mode. */ |
210 | uint32_t regs[16]; |
211 | |
212 | /* 32/64 switch only happens when taking and returning from |
213 | * exceptions so the overlap semantics are taken care of then |
214 | * instead of having a complicated union. |
215 | */ |
216 | /* Regs for A64 mode. */ |
217 | uint64_t xregs[32]; |
218 | uint64_t pc; |
219 | /* PSTATE isn't an architectural register for ARMv8. However, it is |
220 | * convenient for us to assemble the underlying state into a 32 bit format |
221 | * identical to the architectural format used for the SPSR. (This is also |
222 | * what the Linux kernel's 'pstate' field in signal handlers and KVM's |
223 | * 'pstate' register are.) Of the PSTATE bits: |
224 | * NZCV are kept in the split out env->CF/VF/NF/ZF, (which have the same |
225 | * semantics as for AArch32, as described in the comments on each field) |
226 | * nRW (also known as M[4]) is kept, inverted, in env->aarch64 |
227 | * DAIF (exception masks) are kept in env->daif |
228 | * BTYPE is kept in env->btype |
229 | * all other bits are stored in their correct places in env->pstate |
230 | */ |
231 | uint32_t pstate; |
232 | uint32_t aarch64; /* 1 if CPU is in aarch64 state; inverse of PSTATE.nRW */ |
233 | |
234 | /* Frequently accessed CPSR bits are stored separately for efficiency. |
235 | This contains all the other bits. Use cpsr_{read,write} to access |
236 | the whole CPSR. */ |
237 | uint32_t uncached_cpsr; |
238 | uint32_t spsr; |
239 | |
240 | /* Banked registers. */ |
241 | uint64_t banked_spsr[8]; |
242 | uint32_t banked_r13[8]; |
243 | uint32_t banked_r14[8]; |
244 | |
245 | /* These hold r8-r12. */ |
246 | uint32_t usr_regs[5]; |
247 | uint32_t fiq_regs[5]; |
248 | |
249 | /* cpsr flag cache for faster execution */ |
250 | uint32_t CF; /* 0 or 1 */ |
251 | uint32_t VF; /* V is the bit 31. All other bits are undefined */ |
252 | uint32_t NF; /* N is bit 31. All other bits are undefined. */ |
253 | uint32_t ZF; /* Z set if zero. */ |
254 | uint32_t QF; /* 0 or 1 */ |
255 | uint32_t GE; /* cpsr[19:16] */ |
256 | uint32_t thumb; /* cpsr[5]. 0 = arm mode, 1 = thumb mode. */ |
257 | uint32_t condexec_bits; /* IT bits. cpsr[15:10,26:25]. */ |
258 | uint32_t btype; /* BTI branch type. spsr[11:10]. */ |
259 | uint64_t daif; /* exception masks, in the bits they are in PSTATE */ |
260 | |
261 | uint64_t elr_el[4]; /* AArch64 exception link regs */ |
262 | uint64_t sp_el[4]; /* AArch64 banked stack pointers */ |
263 | |
264 | /* System control coprocessor (cp15) */ |
265 | struct { |
266 | uint32_t c0_cpuid; |
267 | union { /* Cache size selection */ |
268 | struct { |
269 | uint64_t _unused_csselr0; |
270 | uint64_t csselr_ns; |
271 | uint64_t _unused_csselr1; |
272 | uint64_t csselr_s; |
273 | }; |
274 | uint64_t csselr_el[4]; |
275 | }; |
276 | union { /* System control register. */ |
277 | struct { |
278 | uint64_t _unused_sctlr; |
279 | uint64_t sctlr_ns; |
280 | uint64_t hsctlr; |
281 | uint64_t sctlr_s; |
282 | }; |
283 | uint64_t sctlr_el[4]; |
284 | }; |
285 | uint64_t cpacr_el1; /* Architectural feature access control register */ |
286 | uint64_t cptr_el[4]; /* ARMv8 feature trap registers */ |
287 | uint32_t c1_xscaleauxcr; /* XScale auxiliary control register. */ |
288 | uint64_t sder; /* Secure debug enable register. */ |
289 | uint32_t nsacr; /* Non-secure access control register. */ |
290 | union { /* MMU translation table base 0. */ |
291 | struct { |
292 | uint64_t _unused_ttbr0_0; |
293 | uint64_t ttbr0_ns; |
294 | uint64_t _unused_ttbr0_1; |
295 | uint64_t ttbr0_s; |
296 | }; |
297 | uint64_t ttbr0_el[4]; |
298 | }; |
299 | union { /* MMU translation table base 1. */ |
300 | struct { |
301 | uint64_t _unused_ttbr1_0; |
302 | uint64_t ttbr1_ns; |
303 | uint64_t _unused_ttbr1_1; |
304 | uint64_t ttbr1_s; |
305 | }; |
306 | uint64_t ttbr1_el[4]; |
307 | }; |
308 | uint64_t vttbr_el2; /* Virtualization Translation Table Base. */ |
309 | /* MMU translation table base control. */ |
310 | TCR tcr_el[4]; |
311 | TCR vtcr_el2; /* Virtualization Translation Control. */ |
312 | uint32_t c2_data; /* MPU data cacheable bits. */ |
313 | uint32_t c2_insn; /* MPU instruction cacheable bits. */ |
314 | union { /* MMU domain access control register |
315 | * MPU write buffer control. |
316 | */ |
317 | struct { |
318 | uint64_t dacr_ns; |
319 | uint64_t dacr_s; |
320 | }; |
321 | struct { |
322 | uint64_t dacr32_el2; |
323 | }; |
324 | }; |
325 | uint32_t pmsav5_data_ap; /* PMSAv5 MPU data access permissions */ |
326 | uint32_t pmsav5_insn_ap; /* PMSAv5 MPU insn access permissions */ |
327 | uint64_t hcr_el2; /* Hypervisor configuration register */ |
328 | uint64_t scr_el3; /* Secure configuration register. */ |
329 | union { /* Fault status registers. */ |
330 | struct { |
331 | uint64_t ifsr_ns; |
332 | uint64_t ifsr_s; |
333 | }; |
334 | struct { |
335 | uint64_t ifsr32_el2; |
336 | }; |
337 | }; |
338 | union { |
339 | struct { |
340 | uint64_t _unused_dfsr; |
341 | uint64_t dfsr_ns; |
342 | uint64_t hsr; |
343 | uint64_t dfsr_s; |
344 | }; |
345 | uint64_t esr_el[4]; |
346 | }; |
347 | uint32_t c6_region[8]; /* MPU base/size registers. */ |
348 | union { /* Fault address registers. */ |
349 | struct { |
350 | uint64_t _unused_far0; |
351 | #ifdef HOST_WORDS_BIGENDIAN |
352 | uint32_t ifar_ns; |
353 | uint32_t dfar_ns; |
354 | uint32_t ifar_s; |
355 | uint32_t dfar_s; |
356 | #else |
357 | uint32_t dfar_ns; |
358 | uint32_t ifar_ns; |
359 | uint32_t dfar_s; |
360 | uint32_t ifar_s; |
361 | #endif |
362 | uint64_t _unused_far3; |
363 | }; |
364 | uint64_t far_el[4]; |
365 | }; |
366 | uint64_t hpfar_el2; |
367 | uint64_t hstr_el2; |
368 | union { /* Translation result. */ |
369 | struct { |
370 | uint64_t _unused_par_0; |
371 | uint64_t par_ns; |
372 | uint64_t _unused_par_1; |
373 | uint64_t par_s; |
374 | }; |
375 | uint64_t par_el[4]; |
376 | }; |
377 | |
378 | uint32_t c9_insn; /* Cache lockdown registers. */ |
379 | uint32_t c9_data; |
380 | uint64_t c9_pmcr; /* performance monitor control register */ |
381 | uint64_t c9_pmcnten; /* perf monitor counter enables */ |
382 | uint64_t c9_pmovsr; /* perf monitor overflow status */ |
383 | uint64_t c9_pmuserenr; /* perf monitor user enable */ |
384 | uint64_t c9_pmselr; /* perf monitor counter selection register */ |
385 | uint64_t c9_pminten; /* perf monitor interrupt enables */ |
386 | union { /* Memory attribute redirection */ |
387 | struct { |
388 | #ifdef HOST_WORDS_BIGENDIAN |
389 | uint64_t _unused_mair_0; |
390 | uint32_t mair1_ns; |
391 | uint32_t mair0_ns; |
392 | uint64_t _unused_mair_1; |
393 | uint32_t mair1_s; |
394 | uint32_t mair0_s; |
395 | #else |
396 | uint64_t _unused_mair_0; |
397 | uint32_t mair0_ns; |
398 | uint32_t mair1_ns; |
399 | uint64_t _unused_mair_1; |
400 | uint32_t mair0_s; |
401 | uint32_t mair1_s; |
402 | #endif |
403 | }; |
404 | uint64_t mair_el[4]; |
405 | }; |
406 | union { /* vector base address register */ |
407 | struct { |
408 | uint64_t _unused_vbar; |
409 | uint64_t vbar_ns; |
410 | uint64_t hvbar; |
411 | uint64_t vbar_s; |
412 | }; |
413 | uint64_t vbar_el[4]; |
414 | }; |
415 | uint32_t mvbar; /* (monitor) vector base address register */ |
416 | struct { /* FCSE PID. */ |
417 | uint32_t fcseidr_ns; |
418 | uint32_t fcseidr_s; |
419 | }; |
420 | union { /* Context ID. */ |
421 | struct { |
422 | uint64_t _unused_contextidr_0; |
423 | uint64_t contextidr_ns; |
424 | uint64_t _unused_contextidr_1; |
425 | uint64_t contextidr_s; |
426 | }; |
427 | uint64_t contextidr_el[4]; |
428 | }; |
429 | union { /* User RW Thread register. */ |
430 | struct { |
431 | uint64_t tpidrurw_ns; |
432 | uint64_t tpidrprw_ns; |
433 | uint64_t htpidr; |
434 | uint64_t _tpidr_el3; |
435 | }; |
436 | uint64_t tpidr_el[4]; |
437 | }; |
438 | /* The secure banks of these registers don't map anywhere */ |
439 | uint64_t tpidrurw_s; |
440 | uint64_t tpidrprw_s; |
441 | uint64_t tpidruro_s; |
442 | |
443 | union { /* User RO Thread register. */ |
444 | uint64_t tpidruro_ns; |
445 | uint64_t tpidrro_el[1]; |
446 | }; |
447 | uint64_t c14_cntfrq; /* Counter Frequency register */ |
448 | uint64_t c14_cntkctl; /* Timer Control register */ |
449 | uint32_t cnthctl_el2; /* Counter/Timer Hyp Control register */ |
450 | uint64_t cntvoff_el2; /* Counter Virtual Offset register */ |
451 | ARMGenericTimer c14_timer[NUM_GTIMERS]; |
452 | uint32_t c15_cpar; /* XScale Coprocessor Access Register */ |
453 | uint32_t c15_ticonfig; /* TI925T configuration byte. */ |
454 | uint32_t c15_i_max; /* Maximum D-cache dirty line index. */ |
455 | uint32_t c15_i_min; /* Minimum D-cache dirty line index. */ |
456 | uint32_t c15_threadid; /* TI debugger thread-ID. */ |
457 | uint32_t c15_config_base_address; /* SCU base address. */ |
458 | uint32_t c15_diagnostic; /* diagnostic register */ |
459 | uint32_t c15_power_diagnostic; |
460 | uint32_t c15_power_control; /* power control */ |
461 | uint64_t dbgbvr[16]; /* breakpoint value registers */ |
462 | uint64_t dbgbcr[16]; /* breakpoint control registers */ |
463 | uint64_t dbgwvr[16]; /* watchpoint value registers */ |
464 | uint64_t dbgwcr[16]; /* watchpoint control registers */ |
465 | uint64_t mdscr_el1; |
466 | uint64_t oslsr_el1; /* OS Lock Status */ |
467 | uint64_t mdcr_el2; |
468 | uint64_t mdcr_el3; |
469 | /* Stores the architectural value of the counter *the last time it was |
470 | * updated* by pmccntr_op_start. Accesses should always be surrounded |
471 | * by pmccntr_op_start/pmccntr_op_finish to guarantee the latest |
472 | * architecturally-correct value is being read/set. |
473 | */ |
474 | uint64_t c15_ccnt; |
475 | /* Stores the delta between the architectural value and the underlying |
476 | * cycle count during normal operation. It is used to update c15_ccnt |
477 | * to be the correct architectural value before accesses. During |
478 | * accesses, c15_ccnt_delta contains the underlying count being used |
479 | * for the access, after which it reverts to the delta value in |
480 | * pmccntr_op_finish. |
481 | */ |
482 | uint64_t c15_ccnt_delta; |
483 | uint64_t c14_pmevcntr[31]; |
484 | uint64_t c14_pmevcntr_delta[31]; |
485 | uint64_t c14_pmevtyper[31]; |
486 | uint64_t pmccfiltr_el0; /* Performance Monitor Filter Register */ |
487 | uint64_t vpidr_el2; /* Virtualization Processor ID Register */ |
488 | uint64_t vmpidr_el2; /* Virtualization Multiprocessor ID Register */ |
489 | } cp15; |
490 | |
491 | struct { |
492 | /* M profile has up to 4 stack pointers: |
493 | * a Main Stack Pointer and a Process Stack Pointer for each |
494 | * of the Secure and Non-Secure states. (If the CPU doesn't support |
495 | * the security extension then it has only two SPs.) |
496 | * In QEMU we always store the currently active SP in regs[13], |
497 | * and the non-active SP for the current security state in |
498 | * v7m.other_sp. The stack pointers for the inactive security state |
499 | * are stored in other_ss_msp and other_ss_psp. |
500 | * switch_v7m_security_state() is responsible for rearranging them |
501 | * when we change security state. |
502 | */ |
503 | uint32_t other_sp; |
504 | uint32_t other_ss_msp; |
505 | uint32_t other_ss_psp; |
506 | uint32_t vecbase[M_REG_NUM_BANKS]; |
507 | uint32_t basepri[M_REG_NUM_BANKS]; |
508 | uint32_t control[M_REG_NUM_BANKS]; |
509 | uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */ |
510 | uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */ |
511 | uint32_t hfsr; /* HardFault Status */ |
512 | uint32_t dfsr; /* Debug Fault Status Register */ |
513 | uint32_t sfsr; /* Secure Fault Status Register */ |
514 | uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */ |
515 | uint32_t bfar; /* BusFault Address */ |
516 | uint32_t sfar; /* Secure Fault Address Register */ |
517 | unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */ |
518 | int exception; |
519 | uint32_t primask[M_REG_NUM_BANKS]; |
520 | uint32_t faultmask[M_REG_NUM_BANKS]; |
521 | uint32_t aircr; /* only holds r/w state if security extn implemented */ |
522 | uint32_t secure; /* Is CPU in Secure state? (not guest visible) */ |
523 | uint32_t csselr[M_REG_NUM_BANKS]; |
524 | uint32_t scr[M_REG_NUM_BANKS]; |
525 | uint32_t msplim[M_REG_NUM_BANKS]; |
526 | uint32_t psplim[M_REG_NUM_BANKS]; |
527 | uint32_t fpcar[M_REG_NUM_BANKS]; |
528 | uint32_t fpccr[M_REG_NUM_BANKS]; |
529 | uint32_t fpdscr[M_REG_NUM_BANKS]; |
530 | uint32_t cpacr[M_REG_NUM_BANKS]; |
531 | uint32_t nsacr; |
532 | } v7m; |
533 | |
534 | /* Information associated with an exception about to be taken: |
535 | * code which raises an exception must set cs->exception_index and |
536 | * the relevant parts of this structure; the cpu_do_interrupt function |
537 | * will then set the guest-visible registers as part of the exception |
538 | * entry process. |
539 | */ |
540 | struct { |
541 | uint32_t syndrome; /* AArch64 format syndrome register */ |
542 | uint32_t fsr; /* AArch32 format fault status register info */ |
543 | uint64_t vaddress; /* virtual addr associated with exception, if any */ |
544 | uint32_t target_el; /* EL the exception should be targeted for */ |
545 | /* If we implement EL2 we will also need to store information |
546 | * about the intermediate physical address for stage 2 faults. |
547 | */ |
548 | } exception; |
549 | |
550 | /* Information associated with an SError */ |
551 | struct { |
552 | uint8_t pending; |
553 | uint8_t has_esr; |
554 | uint64_t esr; |
555 | } serror; |
556 | |
557 | /* State of our input IRQ/FIQ/VIRQ/VFIQ lines */ |
558 | uint32_t irq_line_state; |
559 | |
560 | /* Thumb-2 EE state. */ |
561 | uint32_t teecr; |
562 | uint32_t teehbr; |
563 | |
564 | /* VFP coprocessor state. */ |
565 | struct { |
566 | ARMVectorReg zregs[32]; |
567 | |
568 | #ifdef TARGET_AARCH64 |
569 | /* Store FFR as pregs[16] to make it easier to treat as any other. */ |
570 | #define FFR_PRED_NUM 16 |
571 | ARMPredicateReg pregs[17]; |
572 | /* Scratch space for aa64 sve predicate temporary. */ |
573 | ARMPredicateReg preg_tmp; |
574 | #endif |
575 | |
576 | /* We store these fpcsr fields separately for convenience. */ |
577 | uint32_t qc[4] QEMU_ALIGNED(16); |
578 | int vec_len; |
579 | int vec_stride; |
580 | |
581 | uint32_t xregs[16]; |
582 | |
583 | /* Scratch space for aa32 neon expansion. */ |
584 | uint32_t scratch[8]; |
585 | |
586 | /* There are a number of distinct float control structures: |
587 | * |
588 | * fp_status: is the "normal" fp status. |
589 | * fp_status_fp16: used for half-precision calculations |
590 | * standard_fp_status : the ARM "Standard FPSCR Value" |
591 | * |
592 | * Half-precision operations are governed by a separate |
593 | * flush-to-zero control bit in FPSCR:FZ16. We pass a separate |
594 | * status structure to control this. |
595 | * |
596 | * The "Standard FPSCR", ie default-NaN, flush-to-zero, |
597 | * round-to-nearest and is used by any operations (generally |
598 | * Neon) which the architecture defines as controlled by the |
599 | * standard FPSCR value rather than the FPSCR. |
600 | * |
601 | * To avoid having to transfer exception bits around, we simply |
602 | * say that the FPSCR cumulative exception flags are the logical |
603 | * OR of the flags in the three fp statuses. This relies on the |
604 | * only thing which needs to read the exception flags being |
605 | * an explicit FPSCR read. |
606 | */ |
607 | float_status fp_status; |
608 | float_status fp_status_f16; |
609 | float_status standard_fp_status; |
610 | |
611 | /* ZCR_EL[1-3] */ |
612 | uint64_t zcr_el[4]; |
613 | } vfp; |
614 | uint64_t exclusive_addr; |
615 | uint64_t exclusive_val; |
616 | uint64_t exclusive_high; |
617 | |
618 | /* iwMMXt coprocessor state. */ |
619 | struct { |
620 | uint64_t regs[16]; |
621 | uint64_t val; |
622 | |
623 | uint32_t cregs[16]; |
624 | } iwmmxt; |
625 | |
626 | #ifdef TARGET_AARCH64 |
627 | struct { |
628 | ARMPACKey apia; |
629 | ARMPACKey apib; |
630 | ARMPACKey apda; |
631 | ARMPACKey apdb; |
632 | ARMPACKey apga; |
633 | } keys; |
634 | #endif |
635 | |
636 | #if defined(CONFIG_USER_ONLY) |
637 | /* For usermode syscall translation. */ |
638 | int eabi; |
639 | #endif |
640 | |
641 | struct CPUBreakpoint *cpu_breakpoint[16]; |
642 | struct CPUWatchpoint *cpu_watchpoint[16]; |
643 | |
644 | /* Fields up to this point are cleared by a CPU reset */ |
645 | struct {} end_reset_fields; |
646 | |
647 | /* Fields after this point are preserved across CPU reset. */ |
648 | |
649 | /* Internal CPU feature flags. */ |
650 | uint64_t features; |
651 | |
652 | /* PMSAv7 MPU */ |
653 | struct { |
654 | uint32_t *drbar; |
655 | uint32_t *drsr; |
656 | uint32_t *dracr; |
657 | uint32_t rnr[M_REG_NUM_BANKS]; |
658 | } pmsav7; |
659 | |
660 | /* PMSAv8 MPU */ |
661 | struct { |
662 | /* The PMSAv8 implementation also shares some PMSAv7 config |
663 | * and state: |
664 | * pmsav7.rnr (region number register) |
665 | * pmsav7_dregion (number of configured regions) |
666 | */ |
667 | uint32_t *rbar[M_REG_NUM_BANKS]; |
668 | uint32_t *rlar[M_REG_NUM_BANKS]; |
669 | uint32_t mair0[M_REG_NUM_BANKS]; |
670 | uint32_t mair1[M_REG_NUM_BANKS]; |
671 | } pmsav8; |
672 | |
673 | /* v8M SAU */ |
674 | struct { |
675 | uint32_t *rbar; |
676 | uint32_t *rlar; |
677 | uint32_t rnr; |
678 | uint32_t ctrl; |
679 | } sau; |
680 | |
681 | void *nvic; |
682 | const struct arm_boot_info *boot_info; |
683 | /* Store GICv3CPUState to access from this struct */ |
684 | void *gicv3state; |
685 | } CPUARMState; |
686 | |
687 | /** |
688 | * ARMELChangeHookFn: |
689 | * type of a function which can be registered via arm_register_el_change_hook() |
690 | * to get callbacks when the CPU changes its exception level or mode. |
691 | */ |
692 | typedef void ARMELChangeHookFn(ARMCPU *cpu, void *opaque); |
693 | typedef struct ARMELChangeHook ARMELChangeHook; |
694 | struct ARMELChangeHook { |
695 | ARMELChangeHookFn *hook; |
696 | void *opaque; |
697 | QLIST_ENTRY(ARMELChangeHook) node; |
698 | }; |
699 | |
700 | /* These values map onto the return values for |
701 | * QEMU_PSCI_0_2_FN_AFFINITY_INFO */ |
702 | typedef enum ARMPSCIState { |
703 | PSCI_ON = 0, |
704 | PSCI_OFF = 1, |
705 | PSCI_ON_PENDING = 2 |
706 | } ARMPSCIState; |
707 | |
708 | typedef struct ARMISARegisters ARMISARegisters; |
709 | |
710 | /** |
711 | * ARMCPU: |
712 | * @env: #CPUARMState |
713 | * |
714 | * An ARM CPU core. |
715 | */ |
716 | struct ARMCPU { |
717 | /*< private >*/ |
718 | CPUState parent_obj; |
719 | /*< public >*/ |
720 | |
721 | CPUNegativeOffsetState neg; |
722 | CPUARMState env; |
723 | |
724 | /* Coprocessor information */ |
725 | GHashTable *cp_regs; |
726 | /* For marshalling (mostly coprocessor) register state between the |
727 | * kernel and QEMU (for KVM) and between two QEMUs (for migration), |
728 | * we use these arrays. |
729 | */ |
730 | /* List of register indexes managed via these arrays; (full KVM style |
731 | * 64 bit indexes, not CPRegInfo 32 bit indexes) |
732 | */ |
733 | uint64_t *cpreg_indexes; |
734 | /* Values of the registers (cpreg_indexes[i]'s value is cpreg_values[i]) */ |
735 | uint64_t *cpreg_values; |
736 | /* Length of the indexes, values, reset_values arrays */ |
737 | int32_t cpreg_array_len; |
738 | /* These are used only for migration: incoming data arrives in |
739 | * these fields and is sanity checked in post_load before copying |
740 | * to the working data structures above. |
741 | */ |
742 | uint64_t *cpreg_vmstate_indexes; |
743 | uint64_t *cpreg_vmstate_values; |
744 | int32_t cpreg_vmstate_array_len; |
745 | |
746 | DynamicGDBXMLInfo dyn_xml; |
747 | |
748 | /* Timers used by the generic (architected) timer */ |
749 | QEMUTimer *gt_timer[NUM_GTIMERS]; |
750 | /* |
751 | * Timer used by the PMU. Its state is restored after migration by |
752 | * pmu_op_finish() - it does not need other handling during migration |
753 | */ |
754 | QEMUTimer *pmu_timer; |
755 | /* GPIO outputs for generic timer */ |
756 | qemu_irq gt_timer_outputs[NUM_GTIMERS]; |
757 | /* GPIO output for GICv3 maintenance interrupt signal */ |
758 | qemu_irq gicv3_maintenance_interrupt; |
759 | /* GPIO output for the PMU interrupt */ |
760 | qemu_irq pmu_interrupt; |
761 | |
762 | /* MemoryRegion to use for secure physical accesses */ |
763 | MemoryRegion *secure_memory; |
764 | |
765 | /* For v8M, pointer to the IDAU interface provided by board/SoC */ |
766 | Object *idau; |
767 | |
768 | /* 'compatible' string for this CPU for Linux device trees */ |
769 | const char *dtb_compatible; |
770 | |
771 | /* PSCI version for this CPU |
772 | * Bits[31:16] = Major Version |
773 | * Bits[15:0] = Minor Version |
774 | */ |
775 | uint32_t psci_version; |
776 | |
777 | /* Should CPU start in PSCI powered-off state? */ |
778 | bool start_powered_off; |
779 | |
780 | /* Current power state, access guarded by BQL */ |
781 | ARMPSCIState power_state; |
782 | |
783 | /* CPU has virtualization extension */ |
784 | bool has_el2; |
785 | /* CPU has security extension */ |
786 | bool has_el3; |
787 | /* CPU has PMU (Performance Monitor Unit) */ |
788 | bool has_pmu; |
789 | /* CPU has VFP */ |
790 | bool has_vfp; |
791 | /* CPU has Neon */ |
792 | bool has_neon; |
793 | /* CPU has M-profile DSP extension */ |
794 | bool has_dsp; |
795 | |
796 | /* CPU has memory protection unit */ |
797 | bool has_mpu; |
798 | /* PMSAv7 MPU number of supported regions */ |
799 | uint32_t pmsav7_dregion; |
800 | /* v8M SAU number of supported regions */ |
801 | uint32_t sau_sregion; |
802 | |
803 | /* PSCI conduit used to invoke PSCI methods |
804 | * 0 - disabled, 1 - smc, 2 - hvc |
805 | */ |
806 | uint32_t psci_conduit; |
807 | |
808 | /* For v8M, initial value of the Secure VTOR */ |
809 | uint32_t init_svtor; |
810 | |
811 | /* [QEMU_]KVM_ARM_TARGET_* constant for this CPU, or |
812 | * QEMU_KVM_ARM_TARGET_NONE if the kernel doesn't support this CPU type. |
813 | */ |
814 | uint32_t kvm_target; |
815 | |
816 | /* KVM init features for this CPU */ |
817 | uint32_t kvm_init_features[7]; |
818 | |
819 | /* Uniprocessor system with MP extensions */ |
820 | bool mp_is_up; |
821 | |
822 | /* True if we tried kvm_arm_host_cpu_features() during CPU instance_init |
823 | * and the probe failed (so we need to report the error in realize) |
824 | */ |
825 | bool host_cpu_probe_failed; |
826 | |
827 | /* Specify the number of cores in this CPU cluster. Used for the L2CTLR |
828 | * register. |
829 | */ |
830 | int32_t core_count; |
831 | |
832 | /* The instance init functions for implementation-specific subclasses |
833 | * set these fields to specify the implementation-dependent values of |
834 | * various constant registers and reset values of non-constant |
835 | * registers. |
836 | * Some of these might become QOM properties eventually. |
837 | * Field names match the official register names as defined in the |
838 | * ARMv7AR ARM Architecture Reference Manual. A reset_ prefix |
839 | * is used for reset values of non-constant registers; no reset_ |
840 | * prefix means a constant register. |
841 | * Some of these registers are split out into a substructure that |
842 | * is shared with the translators to control the ISA. |
843 | */ |
844 | struct ARMISARegisters { |
845 | uint32_t id_isar0; |
846 | uint32_t id_isar1; |
847 | uint32_t id_isar2; |
848 | uint32_t id_isar3; |
849 | uint32_t id_isar4; |
850 | uint32_t id_isar5; |
851 | uint32_t id_isar6; |
852 | uint32_t mvfr0; |
853 | uint32_t mvfr1; |
854 | uint32_t mvfr2; |
855 | uint64_t id_aa64isar0; |
856 | uint64_t id_aa64isar1; |
857 | uint64_t id_aa64pfr0; |
858 | uint64_t id_aa64pfr1; |
859 | uint64_t id_aa64mmfr0; |
860 | uint64_t id_aa64mmfr1; |
861 | } isar; |
862 | uint32_t midr; |
863 | uint32_t revidr; |
864 | uint32_t reset_fpsid; |
865 | uint32_t ctr; |
866 | uint32_t reset_sctlr; |
867 | uint32_t id_pfr0; |
868 | uint32_t id_pfr1; |
869 | uint32_t id_dfr0; |
870 | uint64_t pmceid0; |
871 | uint64_t pmceid1; |
872 | uint32_t id_afr0; |
873 | uint32_t id_mmfr0; |
874 | uint32_t id_mmfr1; |
875 | uint32_t id_mmfr2; |
876 | uint32_t id_mmfr3; |
877 | uint32_t id_mmfr4; |
878 | uint64_t id_aa64dfr0; |
879 | uint64_t id_aa64dfr1; |
880 | uint64_t id_aa64afr0; |
881 | uint64_t id_aa64afr1; |
882 | uint32_t dbgdidr; |
883 | uint32_t clidr; |
884 | uint64_t mp_affinity; /* MP ID without feature bits */ |
885 | /* The elements of this array are the CCSIDR values for each cache, |
886 | * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc. |
887 | */ |
888 | uint32_t ccsidr[16]; |
889 | uint64_t reset_cbar; |
890 | uint32_t reset_auxcr; |
891 | bool reset_hivecs; |
892 | /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */ |
893 | uint32_t dcz_blocksize; |
894 | uint64_t rvbar; |
895 | |
896 | /* Configurable aspects of GIC cpu interface (which is part of the CPU) */ |
897 | int gic_num_lrs; /* number of list registers */ |
898 | int gic_vpribits; /* number of virtual priority bits */ |
899 | int gic_vprebits; /* number of virtual preemption bits */ |
900 | |
901 | /* Whether the cfgend input is high (i.e. this CPU should reset into |
902 | * big-endian mode). This setting isn't used directly: instead it modifies |
903 | * the reset_sctlr value to have SCTLR_B or SCTLR_EE set, depending on the |
904 | * architecture version. |
905 | */ |
906 | bool cfgend; |
907 | |
908 | QLIST_HEAD(, ARMELChangeHook) pre_el_change_hooks; |
909 | QLIST_HEAD(, ARMELChangeHook) el_change_hooks; |
910 | |
911 | int32_t node_id; /* NUMA node this CPU belongs to */ |
912 | |
913 | /* Used to synchronize KVM and QEMU in-kernel device levels */ |
914 | uint8_t device_irq_level; |
915 | |
916 | /* Used to set the maximum vector length the cpu will support. */ |
917 | uint32_t sve_max_vq; |
918 | }; |
919 | |
920 | void arm_cpu_post_init(Object *obj); |
921 | |
922 | uint64_t arm_cpu_mp_affinity(int idx, uint8_t clustersz); |
923 | |
924 | #ifndef CONFIG_USER_ONLY |
925 | extern const VMStateDescription vmstate_arm_cpu; |
926 | #endif |
927 | |
928 | void arm_cpu_do_interrupt(CPUState *cpu); |
929 | void arm_v7m_cpu_do_interrupt(CPUState *cpu); |
930 | bool arm_cpu_exec_interrupt(CPUState *cpu, int int_req); |
931 | |
932 | hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr, |
933 | MemTxAttrs *attrs); |
934 | |
935 | int arm_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg); |
936 | int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg); |
937 | |
938 | /* Dynamically generates for gdb stub an XML description of the sysregs from |
939 | * the cp_regs hashtable. Returns the registered sysregs number. |
940 | */ |
941 | int arm_gen_dynamic_xml(CPUState *cpu); |
942 | |
943 | /* Returns the dynamically generated XML for the gdb stub. |
944 | * Returns a pointer to the XML contents for the specified XML file or NULL |
945 | * if the XML name doesn't match the predefined one. |
946 | */ |
947 | const char *arm_gdb_get_dynamic_xml(CPUState *cpu, const char *xmlname); |
948 | |
949 | int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs, |
950 | int cpuid, void *opaque); |
951 | int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs, |
952 | int cpuid, void *opaque); |
953 | |
954 | #ifdef TARGET_AARCH64 |
955 | int aarch64_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg); |
956 | int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg); |
957 | void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq); |
958 | void aarch64_sve_change_el(CPUARMState *env, int old_el, |
959 | int new_el, bool el0_a64); |
960 | #else |
961 | static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { } |
962 | static inline void aarch64_sve_change_el(CPUARMState *env, int o, |
963 | int n, bool a) |
964 | { } |
965 | #endif |
966 | |
967 | #if !defined(CONFIG_TCG) |
968 | static inline target_ulong do_arm_semihosting(CPUARMState *env) |
969 | { |
970 | g_assert_not_reached(); |
971 | } |
972 | #else |
973 | target_ulong do_arm_semihosting(CPUARMState *env); |
974 | #endif |
975 | void aarch64_sync_32_to_64(CPUARMState *env); |
976 | void aarch64_sync_64_to_32(CPUARMState *env); |
977 | |
978 | int fp_exception_el(CPUARMState *env, int cur_el); |
979 | int sve_exception_el(CPUARMState *env, int cur_el); |
980 | uint32_t sve_zcr_len_for_el(CPUARMState *env, int el); |
981 | |
982 | static inline bool is_a64(CPUARMState *env) |
983 | { |
984 | return env->aarch64; |
985 | } |
986 | |
987 | /* you can call this signal handler from your SIGBUS and SIGSEGV |
988 | signal handlers to inform the virtual CPU of exceptions. non zero |
989 | is returned if the signal was handled by the virtual CPU. */ |
990 | int cpu_arm_signal_handler(int host_signum, void *pinfo, |
991 | void *puc); |
992 | |
993 | /** |
994 | * pmu_op_start/finish |
995 | * @env: CPUARMState |
996 | * |
997 | * Convert all PMU counters between their delta form (the typical mode when |
998 | * they are enabled) and the guest-visible values. These two calls must |
999 | * surround any action which might affect the counters. |
1000 | */ |
1001 | void pmu_op_start(CPUARMState *env); |
1002 | void pmu_op_finish(CPUARMState *env); |
1003 | |
1004 | /* |
1005 | * Called when a PMU counter is due to overflow |
1006 | */ |
1007 | void arm_pmu_timer_cb(void *opaque); |
1008 | |
1009 | /** |
1010 | * Functions to register as EL change hooks for PMU mode filtering |
1011 | */ |
1012 | void pmu_pre_el_change(ARMCPU *cpu, void *ignored); |
1013 | void pmu_post_el_change(ARMCPU *cpu, void *ignored); |
1014 | |
1015 | /* |
1016 | * pmu_init |
1017 | * @cpu: ARMCPU |
1018 | * |
1019 | * Initialize the CPU's PMCEID[01]_EL0 registers and associated internal state |
1020 | * for the current configuration |
1021 | */ |
1022 | void pmu_init(ARMCPU *cpu); |
1023 | |
1024 | /* SCTLR bit meanings. Several bits have been reused in newer |
1025 | * versions of the architecture; in that case we define constants |
1026 | * for both old and new bit meanings. Code which tests against those |
1027 | * bits should probably check or otherwise arrange that the CPU |
1028 | * is the architectural version it expects. |
1029 | */ |
1030 | #define SCTLR_M (1U << 0) |
1031 | #define SCTLR_A (1U << 1) |
1032 | #define SCTLR_C (1U << 2) |
1033 | #define SCTLR_W (1U << 3) /* up to v6; RAO in v7 */ |
1034 | #define SCTLR_nTLSMD_32 (1U << 3) /* v8.2-LSMAOC, AArch32 only */ |
1035 | #define SCTLR_SA (1U << 3) /* AArch64 only */ |
1036 | #define SCTLR_P (1U << 4) /* up to v5; RAO in v6 and v7 */ |
1037 | #define SCTLR_LSMAOE_32 (1U << 4) /* v8.2-LSMAOC, AArch32 only */ |
1038 | #define SCTLR_SA0 (1U << 4) /* v8 onward, AArch64 only */ |
1039 | #define SCTLR_D (1U << 5) /* up to v5; RAO in v6 */ |
1040 | #define SCTLR_CP15BEN (1U << 5) /* v7 onward */ |
1041 | #define SCTLR_L (1U << 6) /* up to v5; RAO in v6 and v7; RAZ in v8 */ |
1042 | #define SCTLR_nAA (1U << 6) /* when v8.4-LSE is implemented */ |
1043 | #define SCTLR_B (1U << 7) /* up to v6; RAZ in v7 */ |
1044 | #define SCTLR_ITD (1U << 7) /* v8 onward */ |
1045 | #define SCTLR_S (1U << 8) /* up to v6; RAZ in v7 */ |
1046 | #define SCTLR_SED (1U << 8) /* v8 onward */ |
1047 | #define SCTLR_R (1U << 9) /* up to v6; RAZ in v7 */ |
1048 | #define SCTLR_UMA (1U << 9) /* v8 onward, AArch64 only */ |
1049 | #define SCTLR_F (1U << 10) /* up to v6 */ |
1050 | #define SCTLR_SW (1U << 10) /* v7 */ |
1051 | #define SCTLR_EnRCTX (1U << 10) /* in v8.0-PredInv */ |
1052 | #define SCTLR_Z (1U << 11) /* in v7, RES1 in v8 */ |
1053 | #define SCTLR_EOS (1U << 11) /* v8.5-ExS */ |
1054 | #define SCTLR_I (1U << 12) |
1055 | #define SCTLR_V (1U << 13) /* AArch32 only */ |
1056 | #define SCTLR_EnDB (1U << 13) /* v8.3, AArch64 only */ |
1057 | #define SCTLR_RR (1U << 14) /* up to v7 */ |
1058 | #define SCTLR_DZE (1U << 14) /* v8 onward, AArch64 only */ |
1059 | #define SCTLR_L4 (1U << 15) /* up to v6; RAZ in v7 */ |
1060 | #define SCTLR_UCT (1U << 15) /* v8 onward, AArch64 only */ |
1061 | #define SCTLR_DT (1U << 16) /* up to ??, RAO in v6 and v7 */ |
1062 | #define SCTLR_nTWI (1U << 16) /* v8 onward */ |
1063 | #define SCTLR_HA (1U << 17) /* up to v7, RES0 in v8 */ |
1064 | #define SCTLR_BR (1U << 17) /* PMSA only */ |
1065 | #define SCTLR_IT (1U << 18) /* up to ??, RAO in v6 and v7 */ |
1066 | #define SCTLR_nTWE (1U << 18) /* v8 onward */ |
1067 | #define SCTLR_WXN (1U << 19) |
1068 | #define SCTLR_ST (1U << 20) /* up to ??, RAZ in v6 */ |
1069 | #define SCTLR_UWXN (1U << 20) /* v7 onward, AArch32 only */ |
1070 | #define SCTLR_FI (1U << 21) /* up to v7, v8 RES0 */ |
1071 | #define SCTLR_IESB (1U << 21) /* v8.2-IESB, AArch64 only */ |
1072 | #define SCTLR_U (1U << 22) /* up to v6, RAO in v7 */ |
1073 | #define SCTLR_EIS (1U << 22) /* v8.5-ExS */ |
1074 | #define SCTLR_XP (1U << 23) /* up to v6; v7 onward RAO */ |
1075 | #define SCTLR_SPAN (1U << 23) /* v8.1-PAN */ |
1076 | #define SCTLR_VE (1U << 24) /* up to v7 */ |
1077 | #define SCTLR_E0E (1U << 24) /* v8 onward, AArch64 only */ |
1078 | #define SCTLR_EE (1U << 25) |
1079 | #define SCTLR_L2 (1U << 26) /* up to v6, RAZ in v7 */ |
1080 | #define SCTLR_UCI (1U << 26) /* v8 onward, AArch64 only */ |
1081 | #define SCTLR_NMFI (1U << 27) /* up to v7, RAZ in v7VE and v8 */ |
1082 | #define SCTLR_EnDA (1U << 27) /* v8.3, AArch64 only */ |
1083 | #define SCTLR_TRE (1U << 28) /* AArch32 only */ |
1084 | #define SCTLR_nTLSMD_64 (1U << 28) /* v8.2-LSMAOC, AArch64 only */ |
1085 | #define SCTLR_AFE (1U << 29) /* AArch32 only */ |
1086 | #define SCTLR_LSMAOE_64 (1U << 29) /* v8.2-LSMAOC, AArch64 only */ |
1087 | #define SCTLR_TE (1U << 30) /* AArch32 only */ |
1088 | #define SCTLR_EnIB (1U << 30) /* v8.3, AArch64 only */ |
1089 | #define SCTLR_EnIA (1U << 31) /* v8.3, AArch64 only */ |
1090 | #define SCTLR_BT0 (1ULL << 35) /* v8.5-BTI */ |
1091 | #define SCTLR_BT1 (1ULL << 36) /* v8.5-BTI */ |
1092 | #define SCTLR_ITFSB (1ULL << 37) /* v8.5-MemTag */ |
1093 | #define SCTLR_TCF0 (3ULL << 38) /* v8.5-MemTag */ |
1094 | #define SCTLR_TCF (3ULL << 40) /* v8.5-MemTag */ |
1095 | #define SCTLR_ATA0 (1ULL << 42) /* v8.5-MemTag */ |
1096 | #define SCTLR_ATA (1ULL << 43) /* v8.5-MemTag */ |
1097 | #define SCTLR_DSSBS (1ULL << 44) /* v8.5 */ |
1098 | |
1099 | #define CPTR_TCPAC (1U << 31) |
1100 | #define CPTR_TTA (1U << 20) |
1101 | #define CPTR_TFP (1U << 10) |
1102 | #define CPTR_TZ (1U << 8) /* CPTR_EL2 */ |
1103 | #define CPTR_EZ (1U << 8) /* CPTR_EL3 */ |
1104 | |
1105 | #define MDCR_EPMAD (1U << 21) |
1106 | #define MDCR_EDAD (1U << 20) |
1107 | #define MDCR_SPME (1U << 17) /* MDCR_EL3 */ |
1108 | #define MDCR_HPMD (1U << 17) /* MDCR_EL2 */ |
1109 | #define MDCR_SDD (1U << 16) |
1110 | #define MDCR_SPD (3U << 14) |
1111 | #define MDCR_TDRA (1U << 11) |
1112 | #define MDCR_TDOSA (1U << 10) |
1113 | #define MDCR_TDA (1U << 9) |
1114 | #define MDCR_TDE (1U << 8) |
1115 | #define MDCR_HPME (1U << 7) |
1116 | #define MDCR_TPM (1U << 6) |
1117 | #define MDCR_TPMCR (1U << 5) |
1118 | #define MDCR_HPMN (0x1fU) |
1119 | |
1120 | /* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */ |
1121 | #define SDCR_VALID_MASK (MDCR_EPMAD | MDCR_EDAD | MDCR_SPME | MDCR_SPD) |
1122 | |
1123 | #define CPSR_M (0x1fU) |
1124 | #define CPSR_T (1U << 5) |
1125 | #define CPSR_F (1U << 6) |
1126 | #define CPSR_I (1U << 7) |
1127 | #define CPSR_A (1U << 8) |
1128 | #define CPSR_E (1U << 9) |
1129 | #define CPSR_IT_2_7 (0xfc00U) |
1130 | #define CPSR_GE (0xfU << 16) |
1131 | #define CPSR_IL (1U << 20) |
1132 | /* Note that the RESERVED bits include bit 21, which is PSTATE_SS in |
1133 | * an AArch64 SPSR but RES0 in AArch32 SPSR and CPSR. In QEMU we use |
1134 | * env->uncached_cpsr bit 21 to store PSTATE.SS when executing in AArch32, |
1135 | * where it is live state but not accessible to the AArch32 code. |
1136 | */ |
1137 | #define CPSR_RESERVED (0x7U << 21) |
1138 | #define CPSR_J (1U << 24) |
1139 | #define CPSR_IT_0_1 (3U << 25) |
1140 | #define CPSR_Q (1U << 27) |
1141 | #define CPSR_V (1U << 28) |
1142 | #define CPSR_C (1U << 29) |
1143 | #define CPSR_Z (1U << 30) |
1144 | #define CPSR_N (1U << 31) |
1145 | #define CPSR_NZCV (CPSR_N | CPSR_Z | CPSR_C | CPSR_V) |
1146 | #define CPSR_AIF (CPSR_A | CPSR_I | CPSR_F) |
1147 | |
1148 | #define CPSR_IT (CPSR_IT_0_1 | CPSR_IT_2_7) |
1149 | #define CACHED_CPSR_BITS (CPSR_T | CPSR_AIF | CPSR_GE | CPSR_IT | CPSR_Q \ |
1150 | | CPSR_NZCV) |
1151 | /* Bits writable in user mode. */ |
1152 | #define CPSR_USER (CPSR_NZCV | CPSR_Q | CPSR_GE) |
1153 | /* Execution state bits. MRS read as zero, MSR writes ignored. */ |
1154 | #define CPSR_EXEC (CPSR_T | CPSR_IT | CPSR_J | CPSR_IL) |
1155 | /* Mask of bits which may be set by exception return copying them from SPSR */ |
1156 | #define CPSR_ERET_MASK (~CPSR_RESERVED) |
1157 | |
1158 | /* Bit definitions for M profile XPSR. Most are the same as CPSR. */ |
1159 | #define XPSR_EXCP 0x1ffU |
1160 | #define XPSR_SPREALIGN (1U << 9) /* Only set in exception stack frames */ |
1161 | #define XPSR_IT_2_7 CPSR_IT_2_7 |
1162 | #define XPSR_GE CPSR_GE |
1163 | #define XPSR_SFPA (1U << 20) /* Only set in exception stack frames */ |
1164 | #define XPSR_T (1U << 24) /* Not the same as CPSR_T ! */ |
1165 | #define XPSR_IT_0_1 CPSR_IT_0_1 |
1166 | #define XPSR_Q CPSR_Q |
1167 | #define XPSR_V CPSR_V |
1168 | #define XPSR_C CPSR_C |
1169 | #define XPSR_Z CPSR_Z |
1170 | #define XPSR_N CPSR_N |
1171 | #define XPSR_NZCV CPSR_NZCV |
1172 | #define XPSR_IT CPSR_IT |
1173 | |
1174 | #define TTBCR_N (7U << 0) /* TTBCR.EAE==0 */ |
1175 | #define TTBCR_T0SZ (7U << 0) /* TTBCR.EAE==1 */ |
1176 | #define TTBCR_PD0 (1U << 4) |
1177 | #define TTBCR_PD1 (1U << 5) |
1178 | #define TTBCR_EPD0 (1U << 7) |
1179 | #define TTBCR_IRGN0 (3U << 8) |
1180 | #define TTBCR_ORGN0 (3U << 10) |
1181 | #define TTBCR_SH0 (3U << 12) |
1182 | #define TTBCR_T1SZ (3U << 16) |
1183 | #define TTBCR_A1 (1U << 22) |
1184 | #define TTBCR_EPD1 (1U << 23) |
1185 | #define TTBCR_IRGN1 (3U << 24) |
1186 | #define TTBCR_ORGN1 (3U << 26) |
1187 | #define TTBCR_SH1 (1U << 28) |
1188 | #define TTBCR_EAE (1U << 31) |
1189 | |
1190 | /* Bit definitions for ARMv8 SPSR (PSTATE) format. |
1191 | * Only these are valid when in AArch64 mode; in |
1192 | * AArch32 mode SPSRs are basically CPSR-format. |
1193 | */ |
1194 | #define PSTATE_SP (1U) |
1195 | #define PSTATE_M (0xFU) |
1196 | #define PSTATE_nRW (1U << 4) |
1197 | #define PSTATE_F (1U << 6) |
1198 | #define PSTATE_I (1U << 7) |
1199 | #define PSTATE_A (1U << 8) |
1200 | #define PSTATE_D (1U << 9) |
1201 | #define PSTATE_BTYPE (3U << 10) |
1202 | #define PSTATE_IL (1U << 20) |
1203 | #define PSTATE_SS (1U << 21) |
1204 | #define PSTATE_V (1U << 28) |
1205 | #define PSTATE_C (1U << 29) |
1206 | #define PSTATE_Z (1U << 30) |
1207 | #define PSTATE_N (1U << 31) |
1208 | #define PSTATE_NZCV (PSTATE_N | PSTATE_Z | PSTATE_C | PSTATE_V) |
1209 | #define PSTATE_DAIF (PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F) |
1210 | #define CACHED_PSTATE_BITS (PSTATE_NZCV | PSTATE_DAIF | PSTATE_BTYPE) |
1211 | /* Mode values for AArch64 */ |
1212 | #define PSTATE_MODE_EL3h 13 |
1213 | #define PSTATE_MODE_EL3t 12 |
1214 | #define PSTATE_MODE_EL2h 9 |
1215 | #define PSTATE_MODE_EL2t 8 |
1216 | #define PSTATE_MODE_EL1h 5 |
1217 | #define PSTATE_MODE_EL1t 4 |
1218 | #define PSTATE_MODE_EL0t 0 |
1219 | |
1220 | /* Write a new value to v7m.exception, thus transitioning into or out |
1221 | * of Handler mode; this may result in a change of active stack pointer. |
1222 | */ |
1223 | void write_v7m_exception(CPUARMState *env, uint32_t new_exc); |
1224 | |
1225 | /* Map EL and handler into a PSTATE_MODE. */ |
1226 | static inline unsigned int aarch64_pstate_mode(unsigned int el, bool handler) |
1227 | { |
1228 | return (el << 2) | handler; |
1229 | } |
1230 | |
1231 | /* Return the current PSTATE value. For the moment we don't support 32<->64 bit |
1232 | * interprocessing, so we don't attempt to sync with the cpsr state used by |
1233 | * the 32 bit decoder. |
1234 | */ |
1235 | static inline uint32_t pstate_read(CPUARMState *env) |
1236 | { |
1237 | int ZF; |
1238 | |
1239 | ZF = (env->ZF == 0); |
1240 | return (env->NF & 0x80000000) | (ZF << 30) |
1241 | | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) |
1242 | | env->pstate | env->daif | (env->btype << 10); |
1243 | } |
1244 | |
1245 | static inline void pstate_write(CPUARMState *env, uint32_t val) |
1246 | { |
1247 | env->ZF = (~val) & PSTATE_Z; |
1248 | env->NF = val; |
1249 | env->CF = (val >> 29) & 1; |
1250 | env->VF = (val << 3) & 0x80000000; |
1251 | env->daif = val & PSTATE_DAIF; |
1252 | env->btype = (val >> 10) & 3; |
1253 | env->pstate = val & ~CACHED_PSTATE_BITS; |
1254 | } |
1255 | |
1256 | /* Return the current CPSR value. */ |
1257 | uint32_t cpsr_read(CPUARMState *env); |
1258 | |
1259 | typedef enum CPSRWriteType { |
1260 | CPSRWriteByInstr = 0, /* from guest MSR or CPS */ |
1261 | CPSRWriteExceptionReturn = 1, /* from guest exception return insn */ |
1262 | CPSRWriteRaw = 2, /* trust values, do not switch reg banks */ |
1263 | CPSRWriteByGDBStub = 3, /* from the GDB stub */ |
1264 | } CPSRWriteType; |
1265 | |
1266 | /* Set the CPSR. Note that some bits of mask must be all-set or all-clear.*/ |
1267 | void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, |
1268 | CPSRWriteType write_type); |
1269 | |
1270 | /* Return the current xPSR value. */ |
1271 | static inline uint32_t xpsr_read(CPUARMState *env) |
1272 | { |
1273 | int ZF; |
1274 | ZF = (env->ZF == 0); |
1275 | return (env->NF & 0x80000000) | (ZF << 30) |
1276 | | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) |
1277 | | (env->thumb << 24) | ((env->condexec_bits & 3) << 25) |
1278 | | ((env->condexec_bits & 0xfc) << 8) |
1279 | | (env->GE << 16) |
1280 | | env->v7m.exception; |
1281 | } |
1282 | |
1283 | /* Set the xPSR. Note that some bits of mask must be all-set or all-clear. */ |
1284 | static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask) |
1285 | { |
1286 | if (mask & XPSR_NZCV) { |
1287 | env->ZF = (~val) & XPSR_Z; |
1288 | env->NF = val; |
1289 | env->CF = (val >> 29) & 1; |
1290 | env->VF = (val << 3) & 0x80000000; |
1291 | } |
1292 | if (mask & XPSR_Q) { |
1293 | env->QF = ((val & XPSR_Q) != 0); |
1294 | } |
1295 | if (mask & XPSR_GE) { |
1296 | env->GE = (val & XPSR_GE) >> 16; |
1297 | } |
1298 | if (mask & XPSR_T) { |
1299 | env->thumb = ((val & XPSR_T) != 0); |
1300 | } |
1301 | if (mask & XPSR_IT_0_1) { |
1302 | env->condexec_bits &= ~3; |
1303 | env->condexec_bits |= (val >> 25) & 3; |
1304 | } |
1305 | if (mask & XPSR_IT_2_7) { |
1306 | env->condexec_bits &= 3; |
1307 | env->condexec_bits |= (val >> 8) & 0xfc; |
1308 | } |
1309 | if (mask & XPSR_EXCP) { |
1310 | /* Note that this only happens on exception exit */ |
1311 | write_v7m_exception(env, val & XPSR_EXCP); |
1312 | } |
1313 | } |
1314 | |
1315 | #define HCR_VM (1ULL << 0) |
1316 | #define HCR_SWIO (1ULL << 1) |
1317 | #define HCR_PTW (1ULL << 2) |
1318 | #define HCR_FMO (1ULL << 3) |
1319 | #define HCR_IMO (1ULL << 4) |
1320 | #define HCR_AMO (1ULL << 5) |
1321 | #define HCR_VF (1ULL << 6) |
1322 | #define HCR_VI (1ULL << 7) |
1323 | #define HCR_VSE (1ULL << 8) |
1324 | #define HCR_FB (1ULL << 9) |
1325 | #define HCR_BSU_MASK (3ULL << 10) |
1326 | #define HCR_DC (1ULL << 12) |
1327 | #define HCR_TWI (1ULL << 13) |
1328 | #define HCR_TWE (1ULL << 14) |
1329 | #define HCR_TID0 (1ULL << 15) |
1330 | #define HCR_TID1 (1ULL << 16) |
1331 | #define HCR_TID2 (1ULL << 17) |
1332 | #define HCR_TID3 (1ULL << 18) |
1333 | #define HCR_TSC (1ULL << 19) |
1334 | #define HCR_TIDCP (1ULL << 20) |
1335 | #define HCR_TACR (1ULL << 21) |
1336 | #define HCR_TSW (1ULL << 22) |
1337 | #define HCR_TPCP (1ULL << 23) |
1338 | #define HCR_TPU (1ULL << 24) |
1339 | #define HCR_TTLB (1ULL << 25) |
1340 | #define HCR_TVM (1ULL << 26) |
1341 | #define HCR_TGE (1ULL << 27) |
1342 | #define HCR_TDZ (1ULL << 28) |
1343 | #define HCR_HCD (1ULL << 29) |
1344 | #define HCR_TRVM (1ULL << 30) |
1345 | #define HCR_RW (1ULL << 31) |
1346 | #define HCR_CD (1ULL << 32) |
1347 | #define HCR_ID (1ULL << 33) |
1348 | #define HCR_E2H (1ULL << 34) |
1349 | #define HCR_TLOR (1ULL << 35) |
1350 | #define HCR_TERR (1ULL << 36) |
1351 | #define HCR_TEA (1ULL << 37) |
1352 | #define HCR_MIOCNCE (1ULL << 38) |
1353 | #define HCR_APK (1ULL << 40) |
1354 | #define HCR_API (1ULL << 41) |
1355 | #define HCR_NV (1ULL << 42) |
1356 | #define HCR_NV1 (1ULL << 43) |
1357 | #define HCR_AT (1ULL << 44) |
1358 | #define HCR_NV2 (1ULL << 45) |
1359 | #define HCR_FWB (1ULL << 46) |
1360 | #define HCR_FIEN (1ULL << 47) |
1361 | #define HCR_TID4 (1ULL << 49) |
1362 | #define HCR_TICAB (1ULL << 50) |
1363 | #define HCR_TOCU (1ULL << 52) |
1364 | #define HCR_TTLBIS (1ULL << 54) |
1365 | #define HCR_TTLBOS (1ULL << 55) |
1366 | #define HCR_ATA (1ULL << 56) |
1367 | #define HCR_DCT (1ULL << 57) |
1368 | |
1369 | /* |
1370 | * When we actually implement ARMv8.1-VHE we should add HCR_E2H to |
1371 | * HCR_MASK and then clear it again if the feature bit is not set in |
1372 | * hcr_write(). |
1373 | */ |
1374 | #define HCR_MASK ((1ULL << 34) - 1) |
1375 | |
1376 | #define SCR_NS (1U << 0) |
1377 | #define SCR_IRQ (1U << 1) |
1378 | #define SCR_FIQ (1U << 2) |
1379 | #define SCR_EA (1U << 3) |
1380 | #define SCR_FW (1U << 4) |
1381 | #define SCR_AW (1U << 5) |
1382 | #define SCR_NET (1U << 6) |
1383 | #define SCR_SMD (1U << 7) |
1384 | #define SCR_HCE (1U << 8) |
1385 | #define SCR_SIF (1U << 9) |
1386 | #define SCR_RW (1U << 10) |
1387 | #define SCR_ST (1U << 11) |
1388 | #define SCR_TWI (1U << 12) |
1389 | #define SCR_TWE (1U << 13) |
1390 | #define SCR_TLOR (1U << 14) |
1391 | #define SCR_TERR (1U << 15) |
1392 | #define SCR_APK (1U << 16) |
1393 | #define SCR_API (1U << 17) |
1394 | #define SCR_EEL2 (1U << 18) |
1395 | #define SCR_EASE (1U << 19) |
1396 | #define SCR_NMEA (1U << 20) |
1397 | #define SCR_FIEN (1U << 21) |
1398 | #define SCR_ENSCXT (1U << 25) |
1399 | #define SCR_ATA (1U << 26) |
1400 | |
1401 | /* Return the current FPSCR value. */ |
1402 | uint32_t vfp_get_fpscr(CPUARMState *env); |
1403 | void vfp_set_fpscr(CPUARMState *env, uint32_t val); |
1404 | |
1405 | /* FPCR, Floating Point Control Register |
1406 | * FPSR, Floating Poiht Status Register |
1407 | * |
1408 | * For A64 the FPSCR is split into two logically distinct registers, |
1409 | * FPCR and FPSR. However since they still use non-overlapping bits |
1410 | * we store the underlying state in fpscr and just mask on read/write. |
1411 | */ |
1412 | #define FPSR_MASK 0xf800009f |
1413 | #define FPCR_MASK 0x07ff9f00 |
1414 | |
1415 | #define FPCR_IOE (1 << 8) /* Invalid Operation exception trap enable */ |
1416 | #define FPCR_DZE (1 << 9) /* Divide by Zero exception trap enable */ |
1417 | #define FPCR_OFE (1 << 10) /* Overflow exception trap enable */ |
1418 | #define FPCR_UFE (1 << 11) /* Underflow exception trap enable */ |
1419 | #define FPCR_IXE (1 << 12) /* Inexact exception trap enable */ |
1420 | #define FPCR_IDE (1 << 15) /* Input Denormal exception trap enable */ |
1421 | #define FPCR_FZ16 (1 << 19) /* ARMv8.2+, FP16 flush-to-zero */ |
1422 | #define FPCR_FZ (1 << 24) /* Flush-to-zero enable bit */ |
1423 | #define FPCR_DN (1 << 25) /* Default NaN enable bit */ |
1424 | #define FPCR_QC (1 << 27) /* Cumulative saturation bit */ |
1425 | |
1426 | static inline uint32_t vfp_get_fpsr(CPUARMState *env) |
1427 | { |
1428 | return vfp_get_fpscr(env) & FPSR_MASK; |
1429 | } |
1430 | |
1431 | static inline void vfp_set_fpsr(CPUARMState *env, uint32_t val) |
1432 | { |
1433 | uint32_t new_fpscr = (vfp_get_fpscr(env) & ~FPSR_MASK) | (val & FPSR_MASK); |
1434 | vfp_set_fpscr(env, new_fpscr); |
1435 | } |
1436 | |
1437 | static inline uint32_t vfp_get_fpcr(CPUARMState *env) |
1438 | { |
1439 | return vfp_get_fpscr(env) & FPCR_MASK; |
1440 | } |
1441 | |
1442 | static inline void vfp_set_fpcr(CPUARMState *env, uint32_t val) |
1443 | { |
1444 | uint32_t new_fpscr = (vfp_get_fpscr(env) & ~FPCR_MASK) | (val & FPCR_MASK); |
1445 | vfp_set_fpscr(env, new_fpscr); |
1446 | } |
1447 | |
1448 | enum arm_cpu_mode { |
1449 | ARM_CPU_MODE_USR = 0x10, |
1450 | ARM_CPU_MODE_FIQ = 0x11, |
1451 | ARM_CPU_MODE_IRQ = 0x12, |
1452 | ARM_CPU_MODE_SVC = 0x13, |
1453 | ARM_CPU_MODE_MON = 0x16, |
1454 | ARM_CPU_MODE_ABT = 0x17, |
1455 | ARM_CPU_MODE_HYP = 0x1a, |
1456 | ARM_CPU_MODE_UND = 0x1b, |
1457 | ARM_CPU_MODE_SYS = 0x1f |
1458 | }; |
1459 | |
1460 | /* VFP system registers. */ |
1461 | #define ARM_VFP_FPSID 0 |
1462 | #define ARM_VFP_FPSCR 1 |
1463 | #define ARM_VFP_MVFR2 5 |
1464 | #define ARM_VFP_MVFR1 6 |
1465 | #define ARM_VFP_MVFR0 7 |
1466 | #define ARM_VFP_FPEXC 8 |
1467 | #define ARM_VFP_FPINST 9 |
1468 | #define ARM_VFP_FPINST2 10 |
1469 | |
1470 | /* iwMMXt coprocessor control registers. */ |
1471 | #define ARM_IWMMXT_wCID 0 |
1472 | #define ARM_IWMMXT_wCon 1 |
1473 | #define ARM_IWMMXT_wCSSF 2 |
1474 | #define ARM_IWMMXT_wCASF 3 |
1475 | #define ARM_IWMMXT_wCGR0 8 |
1476 | #define ARM_IWMMXT_wCGR1 9 |
1477 | #define ARM_IWMMXT_wCGR2 10 |
1478 | #define ARM_IWMMXT_wCGR3 11 |
1479 | |
1480 | /* V7M CCR bits */ |
1481 | FIELD(V7M_CCR, NONBASETHRDENA, 0, 1) |
1482 | FIELD(V7M_CCR, USERSETMPEND, 1, 1) |
1483 | FIELD(V7M_CCR, UNALIGN_TRP, 3, 1) |
1484 | FIELD(V7M_CCR, DIV_0_TRP, 4, 1) |
1485 | FIELD(V7M_CCR, BFHFNMIGN, 8, 1) |
1486 | FIELD(V7M_CCR, STKALIGN, 9, 1) |
1487 | FIELD(V7M_CCR, STKOFHFNMIGN, 10, 1) |
1488 | FIELD(V7M_CCR, DC, 16, 1) |
1489 | FIELD(V7M_CCR, IC, 17, 1) |
1490 | FIELD(V7M_CCR, BP, 18, 1) |
1491 | |
1492 | /* V7M SCR bits */ |
1493 | FIELD(V7M_SCR, SLEEPONEXIT, 1, 1) |
1494 | FIELD(V7M_SCR, SLEEPDEEP, 2, 1) |
1495 | FIELD(V7M_SCR, SLEEPDEEPS, 3, 1) |
1496 | FIELD(V7M_SCR, SEVONPEND, 4, 1) |
1497 | |
1498 | /* V7M AIRCR bits */ |
1499 | FIELD(V7M_AIRCR, VECTRESET, 0, 1) |
1500 | FIELD(V7M_AIRCR, VECTCLRACTIVE, 1, 1) |
1501 | FIELD(V7M_AIRCR, SYSRESETREQ, 2, 1) |
1502 | FIELD(V7M_AIRCR, SYSRESETREQS, 3, 1) |
1503 | FIELD(V7M_AIRCR, PRIGROUP, 8, 3) |
1504 | FIELD(V7M_AIRCR, BFHFNMINS, 13, 1) |
1505 | FIELD(V7M_AIRCR, PRIS, 14, 1) |
1506 | FIELD(V7M_AIRCR, ENDIANNESS, 15, 1) |
1507 | FIELD(V7M_AIRCR, VECTKEY, 16, 16) |
1508 | |
1509 | /* V7M CFSR bits for MMFSR */ |
1510 | FIELD(V7M_CFSR, IACCVIOL, 0, 1) |
1511 | FIELD(V7M_CFSR, DACCVIOL, 1, 1) |
1512 | FIELD(V7M_CFSR, MUNSTKERR, 3, 1) |
1513 | FIELD(V7M_CFSR, MSTKERR, 4, 1) |
1514 | FIELD(V7M_CFSR, MLSPERR, 5, 1) |
1515 | FIELD(V7M_CFSR, MMARVALID, 7, 1) |
1516 | |
1517 | /* V7M CFSR bits for BFSR */ |
1518 | FIELD(V7M_CFSR, IBUSERR, 8 + 0, 1) |
1519 | FIELD(V7M_CFSR, PRECISERR, 8 + 1, 1) |
1520 | FIELD(V7M_CFSR, IMPRECISERR, 8 + 2, 1) |
1521 | FIELD(V7M_CFSR, UNSTKERR, 8 + 3, 1) |
1522 | FIELD(V7M_CFSR, STKERR, 8 + 4, 1) |
1523 | FIELD(V7M_CFSR, LSPERR, 8 + 5, 1) |
1524 | FIELD(V7M_CFSR, BFARVALID, 8 + 7, 1) |
1525 | |
1526 | /* V7M CFSR bits for UFSR */ |
1527 | FIELD(V7M_CFSR, UNDEFINSTR, 16 + 0, 1) |
1528 | FIELD(V7M_CFSR, INVSTATE, 16 + 1, 1) |
1529 | FIELD(V7M_CFSR, INVPC, 16 + 2, 1) |
1530 | FIELD(V7M_CFSR, NOCP, 16 + 3, 1) |
1531 | FIELD(V7M_CFSR, STKOF, 16 + 4, 1) |
1532 | FIELD(V7M_CFSR, UNALIGNED, 16 + 8, 1) |
1533 | FIELD(V7M_CFSR, DIVBYZERO, 16 + 9, 1) |
1534 | |
1535 | /* V7M CFSR bit masks covering all of the subregister bits */ |
1536 | FIELD(V7M_CFSR, MMFSR, 0, 8) |
1537 | FIELD(V7M_CFSR, BFSR, 8, 8) |
1538 | FIELD(V7M_CFSR, UFSR, 16, 16) |
1539 | |
1540 | /* V7M HFSR bits */ |
1541 | FIELD(V7M_HFSR, VECTTBL, 1, 1) |
1542 | FIELD(V7M_HFSR, FORCED, 30, 1) |
1543 | FIELD(V7M_HFSR, DEBUGEVT, 31, 1) |
1544 | |
1545 | /* V7M DFSR bits */ |
1546 | FIELD(V7M_DFSR, HALTED, 0, 1) |
1547 | FIELD(V7M_DFSR, BKPT, 1, 1) |
1548 | FIELD(V7M_DFSR, DWTTRAP, 2, 1) |
1549 | FIELD(V7M_DFSR, VCATCH, 3, 1) |
1550 | FIELD(V7M_DFSR, EXTERNAL, 4, 1) |
1551 | |
1552 | /* V7M SFSR bits */ |
1553 | FIELD(V7M_SFSR, INVEP, 0, 1) |
1554 | FIELD(V7M_SFSR, INVIS, 1, 1) |
1555 | FIELD(V7M_SFSR, INVER, 2, 1) |
1556 | FIELD(V7M_SFSR, AUVIOL, 3, 1) |
1557 | FIELD(V7M_SFSR, INVTRAN, 4, 1) |
1558 | FIELD(V7M_SFSR, LSPERR, 5, 1) |
1559 | FIELD(V7M_SFSR, SFARVALID, 6, 1) |
1560 | FIELD(V7M_SFSR, LSERR, 7, 1) |
1561 | |
1562 | /* v7M MPU_CTRL bits */ |
1563 | FIELD(V7M_MPU_CTRL, ENABLE, 0, 1) |
1564 | FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1) |
1565 | FIELD(V7M_MPU_CTRL, PRIVDEFENA, 2, 1) |
1566 | |
1567 | /* v7M CLIDR bits */ |
1568 | FIELD(V7M_CLIDR, CTYPE_ALL, 0, 21) |
1569 | FIELD(V7M_CLIDR, LOUIS, 21, 3) |
1570 | FIELD(V7M_CLIDR, LOC, 24, 3) |
1571 | FIELD(V7M_CLIDR, LOUU, 27, 3) |
1572 | FIELD(V7M_CLIDR, ICB, 30, 2) |
1573 | |
1574 | FIELD(V7M_CSSELR, IND, 0, 1) |
1575 | FIELD(V7M_CSSELR, LEVEL, 1, 3) |
1576 | /* We use the combination of InD and Level to index into cpu->ccsidr[]; |
1577 | * define a mask for this and check that it doesn't permit running off |
1578 | * the end of the array. |
1579 | */ |
1580 | FIELD(V7M_CSSELR, INDEX, 0, 4) |
1581 | |
1582 | /* v7M FPCCR bits */ |
1583 | FIELD(V7M_FPCCR, LSPACT, 0, 1) |
1584 | FIELD(V7M_FPCCR, USER, 1, 1) |
1585 | FIELD(V7M_FPCCR, S, 2, 1) |
1586 | FIELD(V7M_FPCCR, THREAD, 3, 1) |
1587 | FIELD(V7M_FPCCR, HFRDY, 4, 1) |
1588 | FIELD(V7M_FPCCR, MMRDY, 5, 1) |
1589 | FIELD(V7M_FPCCR, BFRDY, 6, 1) |
1590 | FIELD(V7M_FPCCR, SFRDY, 7, 1) |
1591 | FIELD(V7M_FPCCR, MONRDY, 8, 1) |
1592 | FIELD(V7M_FPCCR, SPLIMVIOL, 9, 1) |
1593 | FIELD(V7M_FPCCR, UFRDY, 10, 1) |
1594 | FIELD(V7M_FPCCR, RES0, 11, 15) |
1595 | FIELD(V7M_FPCCR, TS, 26, 1) |
1596 | FIELD(V7M_FPCCR, CLRONRETS, 27, 1) |
1597 | FIELD(V7M_FPCCR, CLRONRET, 28, 1) |
1598 | FIELD(V7M_FPCCR, LSPENS, 29, 1) |
1599 | FIELD(V7M_FPCCR, LSPEN, 30, 1) |
1600 | FIELD(V7M_FPCCR, ASPEN, 31, 1) |
1601 | /* These bits are banked. Others are non-banked and live in the M_REG_S bank */ |
1602 | #define R_V7M_FPCCR_BANKED_MASK \ |
1603 | (R_V7M_FPCCR_LSPACT_MASK | \ |
1604 | R_V7M_FPCCR_USER_MASK | \ |
1605 | R_V7M_FPCCR_THREAD_MASK | \ |
1606 | R_V7M_FPCCR_MMRDY_MASK | \ |
1607 | R_V7M_FPCCR_SPLIMVIOL_MASK | \ |
1608 | R_V7M_FPCCR_UFRDY_MASK | \ |
1609 | R_V7M_FPCCR_ASPEN_MASK) |
1610 | |
1611 | /* |
1612 | * System register ID fields. |
1613 | */ |
1614 | FIELD(MIDR_EL1, REVISION, 0, 4) |
1615 | FIELD(MIDR_EL1, PARTNUM, 4, 12) |
1616 | FIELD(MIDR_EL1, ARCHITECTURE, 16, 4) |
1617 | FIELD(MIDR_EL1, VARIANT, 20, 4) |
1618 | FIELD(MIDR_EL1, IMPLEMENTER, 24, 8) |
1619 | |
1620 | FIELD(ID_ISAR0, SWAP, 0, 4) |
1621 | FIELD(ID_ISAR0, BITCOUNT, 4, 4) |
1622 | FIELD(ID_ISAR0, BITFIELD, 8, 4) |
1623 | FIELD(ID_ISAR0, CMPBRANCH, 12, 4) |
1624 | FIELD(ID_ISAR0, COPROC, 16, 4) |
1625 | FIELD(ID_ISAR0, DEBUG, 20, 4) |
1626 | FIELD(ID_ISAR0, DIVIDE, 24, 4) |
1627 | |
1628 | FIELD(ID_ISAR1, ENDIAN, 0, 4) |
1629 | FIELD(ID_ISAR1, EXCEPT, 4, 4) |
1630 | FIELD(ID_ISAR1, EXCEPT_AR, 8, 4) |
1631 | FIELD(ID_ISAR1, EXTEND, 12, 4) |
1632 | FIELD(ID_ISAR1, IFTHEN, 16, 4) |
1633 | FIELD(ID_ISAR1, IMMEDIATE, 20, 4) |
1634 | FIELD(ID_ISAR1, INTERWORK, 24, 4) |
1635 | FIELD(ID_ISAR1, JAZELLE, 28, 4) |
1636 | |
1637 | FIELD(ID_ISAR2, LOADSTORE, 0, 4) |
1638 | FIELD(ID_ISAR2, MEMHINT, 4, 4) |
1639 | FIELD(ID_ISAR2, MULTIACCESSINT, 8, 4) |
1640 | FIELD(ID_ISAR2, MULT, 12, 4) |
1641 | FIELD(ID_ISAR2, MULTS, 16, 4) |
1642 | FIELD(ID_ISAR2, MULTU, 20, 4) |
1643 | FIELD(ID_ISAR2, PSR_AR, 24, 4) |
1644 | FIELD(ID_ISAR2, REVERSAL, 28, 4) |
1645 | |
1646 | FIELD(ID_ISAR3, SATURATE, 0, 4) |
1647 | FIELD(ID_ISAR3, SIMD, 4, 4) |
1648 | FIELD(ID_ISAR3, SVC, 8, 4) |
1649 | FIELD(ID_ISAR3, SYNCHPRIM, 12, 4) |
1650 | FIELD(ID_ISAR3, TABBRANCH, 16, 4) |
1651 | FIELD(ID_ISAR3, T32COPY, 20, 4) |
1652 | FIELD(ID_ISAR3, TRUENOP, 24, 4) |
1653 | FIELD(ID_ISAR3, T32EE, 28, 4) |
1654 | |
1655 | FIELD(ID_ISAR4, UNPRIV, 0, 4) |
1656 | FIELD(ID_ISAR4, WITHSHIFTS, 4, 4) |
1657 | FIELD(ID_ISAR4, WRITEBACK, 8, 4) |
1658 | FIELD(ID_ISAR4, SMC, 12, 4) |
1659 | FIELD(ID_ISAR4, BARRIER, 16, 4) |
1660 | FIELD(ID_ISAR4, SYNCHPRIM_FRAC, 20, 4) |
1661 | FIELD(ID_ISAR4, PSR_M, 24, 4) |
1662 | FIELD(ID_ISAR4, SWP_FRAC, 28, 4) |
1663 | |
1664 | FIELD(ID_ISAR5, SEVL, 0, 4) |
1665 | FIELD(ID_ISAR5, AES, 4, 4) |
1666 | FIELD(ID_ISAR5, SHA1, 8, 4) |
1667 | FIELD(ID_ISAR5, SHA2, 12, 4) |
1668 | FIELD(ID_ISAR5, CRC32, 16, 4) |
1669 | FIELD(ID_ISAR5, RDM, 24, 4) |
1670 | FIELD(ID_ISAR5, VCMA, 28, 4) |
1671 | |
1672 | FIELD(ID_ISAR6, JSCVT, 0, 4) |
1673 | FIELD(ID_ISAR6, DP, 4, 4) |
1674 | FIELD(ID_ISAR6, FHM, 8, 4) |
1675 | FIELD(ID_ISAR6, SB, 12, 4) |
1676 | FIELD(ID_ISAR6, SPECRES, 16, 4) |
1677 | |
1678 | FIELD(ID_MMFR4, SPECSEI, 0, 4) |
1679 | FIELD(ID_MMFR4, AC2, 4, 4) |
1680 | FIELD(ID_MMFR4, XNX, 8, 4) |
1681 | FIELD(ID_MMFR4, CNP, 12, 4) |
1682 | FIELD(ID_MMFR4, HPDS, 16, 4) |
1683 | FIELD(ID_MMFR4, LSM, 20, 4) |
1684 | FIELD(ID_MMFR4, CCIDX, 24, 4) |
1685 | FIELD(ID_MMFR4, EVT, 28, 4) |
1686 | |
1687 | FIELD(ID_AA64ISAR0, AES, 4, 4) |
1688 | FIELD(ID_AA64ISAR0, SHA1, 8, 4) |
1689 | FIELD(ID_AA64ISAR0, SHA2, 12, 4) |
1690 | FIELD(ID_AA64ISAR0, CRC32, 16, 4) |
1691 | FIELD(ID_AA64ISAR0, ATOMIC, 20, 4) |
1692 | FIELD(ID_AA64ISAR0, RDM, 28, 4) |
1693 | FIELD(ID_AA64ISAR0, SHA3, 32, 4) |
1694 | FIELD(ID_AA64ISAR0, SM3, 36, 4) |
1695 | FIELD(ID_AA64ISAR0, SM4, 40, 4) |
1696 | FIELD(ID_AA64ISAR0, DP, 44, 4) |
1697 | FIELD(ID_AA64ISAR0, FHM, 48, 4) |
1698 | FIELD(ID_AA64ISAR0, TS, 52, 4) |
1699 | FIELD(ID_AA64ISAR0, TLB, 56, 4) |
1700 | FIELD(ID_AA64ISAR0, RNDR, 60, 4) |
1701 | |
1702 | FIELD(ID_AA64ISAR1, DPB, 0, 4) |
1703 | FIELD(ID_AA64ISAR1, APA, 4, 4) |
1704 | FIELD(ID_AA64ISAR1, API, 8, 4) |
1705 | FIELD(ID_AA64ISAR1, JSCVT, 12, 4) |
1706 | FIELD(ID_AA64ISAR1, FCMA, 16, 4) |
1707 | FIELD(ID_AA64ISAR1, LRCPC, 20, 4) |
1708 | FIELD(ID_AA64ISAR1, GPA, 24, 4) |
1709 | FIELD(ID_AA64ISAR1, GPI, 28, 4) |
1710 | FIELD(ID_AA64ISAR1, FRINTTS, 32, 4) |
1711 | FIELD(ID_AA64ISAR1, SB, 36, 4) |
1712 | FIELD(ID_AA64ISAR1, SPECRES, 40, 4) |
1713 | |
1714 | FIELD(ID_AA64PFR0, EL0, 0, 4) |
1715 | FIELD(ID_AA64PFR0, EL1, 4, 4) |
1716 | FIELD(ID_AA64PFR0, EL2, 8, 4) |
1717 | FIELD(ID_AA64PFR0, EL3, 12, 4) |
1718 | FIELD(ID_AA64PFR0, FP, 16, 4) |
1719 | FIELD(ID_AA64PFR0, ADVSIMD, 20, 4) |
1720 | FIELD(ID_AA64PFR0, GIC, 24, 4) |
1721 | FIELD(ID_AA64PFR0, RAS, 28, 4) |
1722 | FIELD(ID_AA64PFR0, SVE, 32, 4) |
1723 | |
1724 | FIELD(ID_AA64PFR1, BT, 0, 4) |
1725 | FIELD(ID_AA64PFR1, SBSS, 4, 4) |
1726 | FIELD(ID_AA64PFR1, MTE, 8, 4) |
1727 | FIELD(ID_AA64PFR1, RAS_FRAC, 12, 4) |
1728 | |
1729 | FIELD(ID_AA64MMFR0, PARANGE, 0, 4) |
1730 | FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4) |
1731 | FIELD(ID_AA64MMFR0, BIGEND, 8, 4) |
1732 | FIELD(ID_AA64MMFR0, SNSMEM, 12, 4) |
1733 | FIELD(ID_AA64MMFR0, BIGENDEL0, 16, 4) |
1734 | FIELD(ID_AA64MMFR0, TGRAN16, 20, 4) |
1735 | FIELD(ID_AA64MMFR0, TGRAN64, 24, 4) |
1736 | FIELD(ID_AA64MMFR0, TGRAN4, 28, 4) |
1737 | FIELD(ID_AA64MMFR0, TGRAN16_2, 32, 4) |
1738 | FIELD(ID_AA64MMFR0, TGRAN64_2, 36, 4) |
1739 | FIELD(ID_AA64MMFR0, TGRAN4_2, 40, 4) |
1740 | FIELD(ID_AA64MMFR0, EXS, 44, 4) |
1741 | |
1742 | FIELD(ID_AA64MMFR1, HAFDBS, 0, 4) |
1743 | FIELD(ID_AA64MMFR1, VMIDBITS, 4, 4) |
1744 | FIELD(ID_AA64MMFR1, VH, 8, 4) |
1745 | FIELD(ID_AA64MMFR1, HPDS, 12, 4) |
1746 | FIELD(ID_AA64MMFR1, LO, 16, 4) |
1747 | FIELD(ID_AA64MMFR1, PAN, 20, 4) |
1748 | FIELD(ID_AA64MMFR1, SPECSEI, 24, 4) |
1749 | FIELD(ID_AA64MMFR1, XNX, 28, 4) |
1750 | |
1751 | FIELD(ID_DFR0, COPDBG, 0, 4) |
1752 | FIELD(ID_DFR0, COPSDBG, 4, 4) |
1753 | FIELD(ID_DFR0, MMAPDBG, 8, 4) |
1754 | FIELD(ID_DFR0, COPTRC, 12, 4) |
1755 | FIELD(ID_DFR0, MMAPTRC, 16, 4) |
1756 | FIELD(ID_DFR0, MPROFDBG, 20, 4) |
1757 | FIELD(ID_DFR0, PERFMON, 24, 4) |
1758 | FIELD(ID_DFR0, TRACEFILT, 28, 4) |
1759 | |
1760 | FIELD(MVFR0, SIMDREG, 0, 4) |
1761 | FIELD(MVFR0, FPSP, 4, 4) |
1762 | FIELD(MVFR0, FPDP, 8, 4) |
1763 | FIELD(MVFR0, FPTRAP, 12, 4) |
1764 | FIELD(MVFR0, FPDIVIDE, 16, 4) |
1765 | FIELD(MVFR0, FPSQRT, 20, 4) |
1766 | FIELD(MVFR0, FPSHVEC, 24, 4) |
1767 | FIELD(MVFR0, FPROUND, 28, 4) |
1768 | |
1769 | FIELD(MVFR1, FPFTZ, 0, 4) |
1770 | FIELD(MVFR1, FPDNAN, 4, 4) |
1771 | FIELD(MVFR1, SIMDLS, 8, 4) |
1772 | FIELD(MVFR1, SIMDINT, 12, 4) |
1773 | FIELD(MVFR1, SIMDSP, 16, 4) |
1774 | FIELD(MVFR1, SIMDHP, 20, 4) |
1775 | FIELD(MVFR1, FPHP, 24, 4) |
1776 | FIELD(MVFR1, SIMDFMAC, 28, 4) |
1777 | |
1778 | FIELD(MVFR2, SIMDMISC, 0, 4) |
1779 | FIELD(MVFR2, FPMISC, 4, 4) |
1780 | |
1781 | QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK); |
1782 | |
1783 | /* If adding a feature bit which corresponds to a Linux ELF |
1784 | * HWCAP bit, remember to update the feature-bit-to-hwcap |
1785 | * mapping in linux-user/elfload.c:get_elf_hwcap(). |
1786 | */ |
1787 | enum arm_features { |
1788 | ARM_FEATURE_VFP, |
1789 | ARM_FEATURE_AUXCR, /* ARM1026 Auxiliary control register. */ |
1790 | ARM_FEATURE_XSCALE, /* Intel XScale extensions. */ |
1791 | ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension. */ |
1792 | ARM_FEATURE_V6, |
1793 | ARM_FEATURE_V6K, |
1794 | ARM_FEATURE_V7, |
1795 | ARM_FEATURE_THUMB2, |
1796 | ARM_FEATURE_PMSA, /* no MMU; may have Memory Protection Unit */ |
1797 | ARM_FEATURE_VFP3, |
1798 | ARM_FEATURE_NEON, |
1799 | ARM_FEATURE_M, /* Microcontroller profile. */ |
1800 | ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling. */ |
1801 | ARM_FEATURE_THUMB2EE, |
1802 | ARM_FEATURE_V7MP, /* v7 Multiprocessing Extensions */ |
1803 | ARM_FEATURE_V7VE, /* v7 Virtualization Extensions (non-EL2 parts) */ |
1804 | ARM_FEATURE_V4T, |
1805 | ARM_FEATURE_V5, |
1806 | ARM_FEATURE_STRONGARM, |
1807 | ARM_FEATURE_VAPA, /* cp15 VA to PA lookups */ |
1808 | ARM_FEATURE_VFP4, /* VFPv4 (implies that NEON is v2) */ |
1809 | ARM_FEATURE_GENERIC_TIMER, |
1810 | ARM_FEATURE_MVFR, /* Media and VFP Feature Registers 0 and 1 */ |
1811 | ARM_FEATURE_DUMMY_C15_REGS, /* RAZ/WI all of cp15 crn=15 */ |
1812 | ARM_FEATURE_CACHE_TEST_CLEAN, /* 926/1026 style test-and-clean ops */ |
1813 | ARM_FEATURE_CACHE_DIRTY_REG, /* 1136/1176 cache dirty status register */ |
1814 | ARM_FEATURE_CACHE_BLOCK_OPS, /* v6 optional cache block operations */ |
1815 | ARM_FEATURE_MPIDR, /* has cp15 MPIDR */ |
1816 | ARM_FEATURE_PXN, /* has Privileged Execute Never bit */ |
1817 | ARM_FEATURE_LPAE, /* has Large Physical Address Extension */ |
1818 | ARM_FEATURE_V8, |
1819 | ARM_FEATURE_AARCH64, /* supports 64 bit mode */ |
1820 | ARM_FEATURE_CBAR, /* has cp15 CBAR */ |
1821 | ARM_FEATURE_CRC, /* ARMv8 CRC instructions */ |
1822 | ARM_FEATURE_CBAR_RO, /* has cp15 CBAR and it is read-only */ |
1823 | ARM_FEATURE_EL2, /* has EL2 Virtualization support */ |
1824 | ARM_FEATURE_EL3, /* has EL3 Secure monitor support */ |
1825 | ARM_FEATURE_THUMB_DSP, /* DSP insns supported in the Thumb encodings */ |
1826 | ARM_FEATURE_PMU, /* has PMU support */ |
1827 | ARM_FEATURE_VBAR, /* has cp15 VBAR */ |
1828 | ARM_FEATURE_M_SECURITY, /* M profile Security Extension */ |
1829 | ARM_FEATURE_M_MAIN, /* M profile Main Extension */ |
1830 | }; |
1831 | |
1832 | static inline int arm_feature(CPUARMState *env, int feature) |
1833 | { |
1834 | return (env->features & (1ULL << feature)) != 0; |
1835 | } |
1836 | |
1837 | #if !defined(CONFIG_USER_ONLY) |
1838 | /* Return true if exception levels below EL3 are in secure state, |
1839 | * or would be following an exception return to that level. |
1840 | * Unlike arm_is_secure() (which is always a question about the |
1841 | * _current_ state of the CPU) this doesn't care about the current |
1842 | * EL or mode. |
1843 | */ |
1844 | static inline bool arm_is_secure_below_el3(CPUARMState *env) |
1845 | { |
1846 | if (arm_feature(env, ARM_FEATURE_EL3)) { |
1847 | return !(env->cp15.scr_el3 & SCR_NS); |
1848 | } else { |
1849 | /* If EL3 is not supported then the secure state is implementation |
1850 | * defined, in which case QEMU defaults to non-secure. |
1851 | */ |
1852 | return false; |
1853 | } |
1854 | } |
1855 | |
1856 | /* Return true if the CPU is AArch64 EL3 or AArch32 Mon */ |
1857 | static inline bool arm_is_el3_or_mon(CPUARMState *env) |
1858 | { |
1859 | if (arm_feature(env, ARM_FEATURE_EL3)) { |
1860 | if (is_a64(env) && extract32(env->pstate, 2, 2) == 3) { |
1861 | /* CPU currently in AArch64 state and EL3 */ |
1862 | return true; |
1863 | } else if (!is_a64(env) && |
1864 | (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { |
1865 | /* CPU currently in AArch32 state and monitor mode */ |
1866 | return true; |
1867 | } |
1868 | } |
1869 | return false; |
1870 | } |
1871 | |
1872 | /* Return true if the processor is in secure state */ |
1873 | static inline bool arm_is_secure(CPUARMState *env) |
1874 | { |
1875 | if (arm_is_el3_or_mon(env)) { |
1876 | return true; |
1877 | } |
1878 | return arm_is_secure_below_el3(env); |
1879 | } |
1880 | |
1881 | #else |
1882 | static inline bool arm_is_secure_below_el3(CPUARMState *env) |
1883 | { |
1884 | return false; |
1885 | } |
1886 | |
1887 | static inline bool arm_is_secure(CPUARMState *env) |
1888 | { |
1889 | return false; |
1890 | } |
1891 | #endif |
1892 | |
1893 | /** |
1894 | * arm_hcr_el2_eff(): Return the effective value of HCR_EL2. |
1895 | * E.g. when in secure state, fields in HCR_EL2 are suppressed, |
1896 | * "for all purposes other than a direct read or write access of HCR_EL2." |
1897 | * Not included here is HCR_RW. |
1898 | */ |
1899 | uint64_t arm_hcr_el2_eff(CPUARMState *env); |
1900 | |
1901 | /* Return true if the specified exception level is running in AArch64 state. */ |
1902 | static inline bool arm_el_is_aa64(CPUARMState *env, int el) |
1903 | { |
1904 | /* This isn't valid for EL0 (if we're in EL0, is_a64() is what you want, |
1905 | * and if we're not in EL0 then the state of EL0 isn't well defined.) |
1906 | */ |
1907 | assert(el >= 1 && el <= 3); |
1908 | bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64); |
1909 | |
1910 | /* The highest exception level is always at the maximum supported |
1911 | * register width, and then lower levels have a register width controlled |
1912 | * by bits in the SCR or HCR registers. |
1913 | */ |
1914 | if (el == 3) { |
1915 | return aa64; |
1916 | } |
1917 | |
1918 | if (arm_feature(env, ARM_FEATURE_EL3)) { |
1919 | aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW); |
1920 | } |
1921 | |
1922 | if (el == 2) { |
1923 | return aa64; |
1924 | } |
1925 | |
1926 | if (arm_feature(env, ARM_FEATURE_EL2) && !arm_is_secure_below_el3(env)) { |
1927 | aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW); |
1928 | } |
1929 | |
1930 | return aa64; |
1931 | } |
1932 | |
1933 | /* Function for determing whether guest cp register reads and writes should |
1934 | * access the secure or non-secure bank of a cp register. When EL3 is |
1935 | * operating in AArch32 state, the NS-bit determines whether the secure |
1936 | * instance of a cp register should be used. When EL3 is AArch64 (or if |
1937 | * it doesn't exist at all) then there is no register banking, and all |
1938 | * accesses are to the non-secure version. |
1939 | */ |
1940 | static inline bool access_secure_reg(CPUARMState *env) |
1941 | { |
1942 | bool ret = (arm_feature(env, ARM_FEATURE_EL3) && |
1943 | !arm_el_is_aa64(env, 3) && |
1944 | !(env->cp15.scr_el3 & SCR_NS)); |
1945 | |
1946 | return ret; |
1947 | } |
1948 | |
1949 | /* Macros for accessing a specified CP register bank */ |
1950 | #define A32_BANKED_REG_GET(_env, _regname, _secure) \ |
1951 | ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns) |
1952 | |
1953 | #define A32_BANKED_REG_SET(_env, _regname, _secure, _val) \ |
1954 | do { \ |
1955 | if (_secure) { \ |
1956 | (_env)->cp15._regname##_s = (_val); \ |
1957 | } else { \ |
1958 | (_env)->cp15._regname##_ns = (_val); \ |
1959 | } \ |
1960 | } while (0) |
1961 | |
1962 | /* Macros for automatically accessing a specific CP register bank depending on |
1963 | * the current secure state of the system. These macros are not intended for |
1964 | * supporting instruction translation reads/writes as these are dependent |
1965 | * solely on the SCR.NS bit and not the mode. |
1966 | */ |
1967 | #define A32_BANKED_CURRENT_REG_GET(_env, _regname) \ |
1968 | A32_BANKED_REG_GET((_env), _regname, \ |
1969 | (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3))) |
1970 | |
1971 | #define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val) \ |
1972 | A32_BANKED_REG_SET((_env), _regname, \ |
1973 | (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \ |
1974 | (_val)) |
1975 | |
1976 | void arm_cpu_list(void); |
1977 | uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, |
1978 | uint32_t cur_el, bool secure); |
1979 | |
1980 | /* Interface between CPU and Interrupt controller. */ |
1981 | #ifndef CONFIG_USER_ONLY |
1982 | bool armv7m_nvic_can_take_pending_exception(void *opaque); |
1983 | #else |
1984 | static inline bool armv7m_nvic_can_take_pending_exception(void *opaque) |
1985 | { |
1986 | return true; |
1987 | } |
1988 | #endif |
1989 | /** |
1990 | * armv7m_nvic_set_pending: mark the specified exception as pending |
1991 | * @opaque: the NVIC |
1992 | * @irq: the exception number to mark pending |
1993 | * @secure: false for non-banked exceptions or for the nonsecure |
1994 | * version of a banked exception, true for the secure version of a banked |
1995 | * exception. |
1996 | * |
1997 | * Marks the specified exception as pending. Note that we will assert() |
1998 | * if @secure is true and @irq does not specify one of the fixed set |
1999 | * of architecturally banked exceptions. |
2000 | */ |
2001 | void armv7m_nvic_set_pending(void *opaque, int irq, bool secure); |
2002 | /** |
2003 | * armv7m_nvic_set_pending_derived: mark this derived exception as pending |
2004 | * @opaque: the NVIC |
2005 | * @irq: the exception number to mark pending |
2006 | * @secure: false for non-banked exceptions or for the nonsecure |
2007 | * version of a banked exception, true for the secure version of a banked |
2008 | * exception. |
2009 | * |
2010 | * Similar to armv7m_nvic_set_pending(), but specifically for derived |
2011 | * exceptions (exceptions generated in the course of trying to take |
2012 | * a different exception). |
2013 | */ |
2014 | void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure); |
2015 | /** |
2016 | * armv7m_nvic_set_pending_lazyfp: mark this lazy FP exception as pending |
2017 | * @opaque: the NVIC |
2018 | * @irq: the exception number to mark pending |
2019 | * @secure: false for non-banked exceptions or for the nonsecure |
2020 | * version of a banked exception, true for the secure version of a banked |
2021 | * exception. |
2022 | * |
2023 | * Similar to armv7m_nvic_set_pending(), but specifically for exceptions |
2024 | * generated in the course of lazy stacking of FP registers. |
2025 | */ |
2026 | void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure); |
2027 | /** |
2028 | * armv7m_nvic_get_pending_irq_info: return highest priority pending |
2029 | * exception, and whether it targets Secure state |
2030 | * @opaque: the NVIC |
2031 | * @pirq: set to pending exception number |
2032 | * @ptargets_secure: set to whether pending exception targets Secure |
2033 | * |
2034 | * This function writes the number of the highest priority pending |
2035 | * exception (the one which would be made active by |
2036 | * armv7m_nvic_acknowledge_irq()) to @pirq, and sets @ptargets_secure |
2037 | * to true if the current highest priority pending exception should |
2038 | * be taken to Secure state, false for NS. |
2039 | */ |
2040 | void armv7m_nvic_get_pending_irq_info(void *opaque, int *pirq, |
2041 | bool *ptargets_secure); |
2042 | /** |
2043 | * armv7m_nvic_acknowledge_irq: make highest priority pending exception active |
2044 | * @opaque: the NVIC |
2045 | * |
2046 | * Move the current highest priority pending exception from the pending |
2047 | * state to the active state, and update v7m.exception to indicate that |
2048 | * it is the exception currently being handled. |
2049 | */ |
2050 | void armv7m_nvic_acknowledge_irq(void *opaque); |
2051 | /** |
2052 | * armv7m_nvic_complete_irq: complete specified interrupt or exception |
2053 | * @opaque: the NVIC |
2054 | * @irq: the exception number to complete |
2055 | * @secure: true if this exception was secure |
2056 | * |
2057 | * Returns: -1 if the irq was not active |
2058 | * 1 if completing this irq brought us back to base (no active irqs) |
2059 | * 0 if there is still an irq active after this one was completed |
2060 | * (Ignoring -1, this is the same as the RETTOBASE value before completion.) |
2061 | */ |
2062 | int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure); |
2063 | /** |
2064 | * armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure) |
2065 | * @opaque: the NVIC |
2066 | * @irq: the exception number to mark pending |
2067 | * @secure: false for non-banked exceptions or for the nonsecure |
2068 | * version of a banked exception, true for the secure version of a banked |
2069 | * exception. |
2070 | * |
2071 | * Return whether an exception is "ready", i.e. whether the exception is |
2072 | * enabled and is configured at a priority which would allow it to |
2073 | * interrupt the current execution priority. This controls whether the |
2074 | * RDY bit for it in the FPCCR is set. |
2075 | */ |
2076 | bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure); |
2077 | /** |
2078 | * armv7m_nvic_raw_execution_priority: return the raw execution priority |
2079 | * @opaque: the NVIC |
2080 | * |
2081 | * Returns: the raw execution priority as defined by the v8M architecture. |
2082 | * This is the execution priority minus the effects of AIRCR.PRIS, |
2083 | * and minus any PRIMASK/FAULTMASK/BASEPRI priority boosting. |
2084 | * (v8M ARM ARM I_PKLD.) |
2085 | */ |
2086 | int armv7m_nvic_raw_execution_priority(void *opaque); |
2087 | /** |
2088 | * armv7m_nvic_neg_prio_requested: return true if the requested execution |
2089 | * priority is negative for the specified security state. |
2090 | * @opaque: the NVIC |
2091 | * @secure: the security state to test |
2092 | * This corresponds to the pseudocode IsReqExecPriNeg(). |
2093 | */ |
2094 | #ifndef CONFIG_USER_ONLY |
2095 | bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure); |
2096 | #else |
2097 | static inline bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure) |
2098 | { |
2099 | return false; |
2100 | } |
2101 | #endif |
2102 | |
2103 | /* Interface for defining coprocessor registers. |
2104 | * Registers are defined in tables of arm_cp_reginfo structs |
2105 | * which are passed to define_arm_cp_regs(). |
2106 | */ |
2107 | |
2108 | /* When looking up a coprocessor register we look for it |
2109 | * via an integer which encodes all of: |
2110 | * coprocessor number |
2111 | * Crn, Crm, opc1, opc2 fields |
2112 | * 32 or 64 bit register (ie is it accessed via MRC/MCR |
2113 | * or via MRRC/MCRR?) |
2114 | * non-secure/secure bank (AArch32 only) |
2115 | * We allow 4 bits for opc1 because MRRC/MCRR have a 4 bit field. |
2116 | * (In this case crn and opc2 should be zero.) |
2117 | * For AArch64, there is no 32/64 bit size distinction; |
2118 | * instead all registers have a 2 bit op0, 3 bit op1 and op2, |
2119 | * and 4 bit CRn and CRm. The encoding patterns are chosen |
2120 | * to be easy to convert to and from the KVM encodings, and also |
2121 | * so that the hashtable can contain both AArch32 and AArch64 |
2122 | * registers (to allow for interprocessing where we might run |
2123 | * 32 bit code on a 64 bit core). |
2124 | */ |
2125 | /* This bit is private to our hashtable cpreg; in KVM register |
2126 | * IDs the AArch64/32 distinction is the KVM_REG_ARM/ARM64 |
2127 | * in the upper bits of the 64 bit ID. |
2128 | */ |
2129 | #define CP_REG_AA64_SHIFT 28 |
2130 | #define CP_REG_AA64_MASK (1 << CP_REG_AA64_SHIFT) |
2131 | |
2132 | /* To enable banking of coprocessor registers depending on ns-bit we |
2133 | * add a bit to distinguish between secure and non-secure cpregs in the |
2134 | * hashtable. |
2135 | */ |
2136 | #define CP_REG_NS_SHIFT 29 |
2137 | #define CP_REG_NS_MASK (1 << CP_REG_NS_SHIFT) |
2138 | |
2139 | #define ENCODE_CP_REG(cp, is64, ns, crn, crm, opc1, opc2) \ |
2140 | ((ns) << CP_REG_NS_SHIFT | ((cp) << 16) | ((is64) << 15) | \ |
2141 | ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2)) |
2142 | |
2143 | #define ENCODE_AA64_CP_REG(cp, crn, crm, op0, op1, op2) \ |
2144 | (CP_REG_AA64_MASK | \ |
2145 | ((cp) << CP_REG_ARM_COPROC_SHIFT) | \ |
2146 | ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) | \ |
2147 | ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) | \ |
2148 | ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) | \ |
2149 | ((crm) << CP_REG_ARM64_SYSREG_CRM_SHIFT) | \ |
2150 | ((op2) << CP_REG_ARM64_SYSREG_OP2_SHIFT)) |
2151 | |
2152 | /* Convert a full 64 bit KVM register ID to the truncated 32 bit |
2153 | * version used as a key for the coprocessor register hashtable |
2154 | */ |
2155 | static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid) |
2156 | { |
2157 | uint32_t cpregid = kvmid; |
2158 | if ((kvmid & CP_REG_ARCH_MASK) == CP_REG_ARM64) { |
2159 | cpregid |= CP_REG_AA64_MASK; |
2160 | } else { |
2161 | if ((kvmid & CP_REG_SIZE_MASK) == CP_REG_SIZE_U64) { |
2162 | cpregid |= (1 << 15); |
2163 | } |
2164 | |
2165 | /* KVM is always non-secure so add the NS flag on AArch32 register |
2166 | * entries. |
2167 | */ |
2168 | cpregid |= 1 << CP_REG_NS_SHIFT; |
2169 | } |
2170 | return cpregid; |
2171 | } |
2172 | |
2173 | /* Convert a truncated 32 bit hashtable key into the full |
2174 | * 64 bit KVM register ID. |
2175 | */ |
2176 | static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid) |
2177 | { |
2178 | uint64_t kvmid; |
2179 | |
2180 | if (cpregid & CP_REG_AA64_MASK) { |
2181 | kvmid = cpregid & ~CP_REG_AA64_MASK; |
2182 | kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM64; |
2183 | } else { |
2184 | kvmid = cpregid & ~(1 << 15); |
2185 | if (cpregid & (1 << 15)) { |
2186 | kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM; |
2187 | } else { |
2188 | kvmid |= CP_REG_SIZE_U32 | CP_REG_ARM; |
2189 | } |
2190 | } |
2191 | return kvmid; |
2192 | } |
2193 | |
2194 | /* ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a |
2195 | * special-behaviour cp reg and bits [11..8] indicate what behaviour |
2196 | * it has. Otherwise it is a simple cp reg, where CONST indicates that |
2197 | * TCG can assume the value to be constant (ie load at translate time) |
2198 | * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END |
2199 | * indicates that the TB should not be ended after a write to this register |
2200 | * (the default is that the TB ends after cp writes). OVERRIDE permits |
2201 | * a register definition to override a previous definition for the |
2202 | * same (cp, is64, crn, crm, opc1, opc2) tuple: either the new or the |
2203 | * old must have the OVERRIDE bit set. |
2204 | * ALIAS indicates that this register is an alias view of some underlying |
2205 | * state which is also visible via another register, and that the other |
2206 | * register is handling migration and reset; registers marked ALIAS will not be |
2207 | * migrated but may have their state set by syncing of register state from KVM. |
2208 | * NO_RAW indicates that this register has no underlying state and does not |
2209 | * support raw access for state saving/loading; it will not be used for either |
2210 | * migration or KVM state synchronization. (Typically this is for "registers" |
2211 | * which are actually used as instructions for cache maintenance and so on.) |
2212 | * IO indicates that this register does I/O and therefore its accesses |
2213 | * need to be surrounded by gen_io_start()/gen_io_end(). In particular, |
2214 | * registers which implement clocks or timers require this. |
2215 | * RAISES_EXC is for when the read or write hook might raise an exception; |
2216 | * the generated code will synchronize the CPU state before calling the hook |
2217 | * so that it is safe for the hook to call raise_exception(). |
2218 | */ |
2219 | #define ARM_CP_SPECIAL 0x0001 |
2220 | #define ARM_CP_CONST 0x0002 |
2221 | #define ARM_CP_64BIT 0x0004 |
2222 | #define ARM_CP_SUPPRESS_TB_END 0x0008 |
2223 | #define ARM_CP_OVERRIDE 0x0010 |
2224 | #define ARM_CP_ALIAS 0x0020 |
2225 | #define ARM_CP_IO 0x0040 |
2226 | #define ARM_CP_NO_RAW 0x0080 |
2227 | #define ARM_CP_NOP (ARM_CP_SPECIAL | 0x0100) |
2228 | #define ARM_CP_WFI (ARM_CP_SPECIAL | 0x0200) |
2229 | #define ARM_CP_NZCV (ARM_CP_SPECIAL | 0x0300) |
2230 | #define ARM_CP_CURRENTEL (ARM_CP_SPECIAL | 0x0400) |
2231 | #define ARM_CP_DC_ZVA (ARM_CP_SPECIAL | 0x0500) |
2232 | #define ARM_LAST_SPECIAL ARM_CP_DC_ZVA |
2233 | #define ARM_CP_FPU 0x1000 |
2234 | #define ARM_CP_SVE 0x2000 |
2235 | #define ARM_CP_NO_GDB 0x4000 |
2236 | #define ARM_CP_RAISES_EXC 0x8000 |
2237 | /* Used only as a terminator for ARMCPRegInfo lists */ |
2238 | #define ARM_CP_SENTINEL 0xffff |
2239 | /* Mask of only the flag bits in a type field */ |
2240 | #define ARM_CP_FLAG_MASK 0xf0ff |
2241 | |
2242 | /* Valid values for ARMCPRegInfo state field, indicating which of |
2243 | * the AArch32 and AArch64 execution states this register is visible in. |
2244 | * If the reginfo doesn't explicitly specify then it is AArch32 only. |
2245 | * If the reginfo is declared to be visible in both states then a second |
2246 | * reginfo is synthesised for the AArch32 view of the AArch64 register, |
2247 | * such that the AArch32 view is the lower 32 bits of the AArch64 one. |
2248 | * Note that we rely on the values of these enums as we iterate through |
2249 | * the various states in some places. |
2250 | */ |
2251 | enum { |
2252 | ARM_CP_STATE_AA32 = 0, |
2253 | ARM_CP_STATE_AA64 = 1, |
2254 | ARM_CP_STATE_BOTH = 2, |
2255 | }; |
2256 | |
2257 | /* ARM CP register secure state flags. These flags identify security state |
2258 | * attributes for a given CP register entry. |
2259 | * The existence of both or neither secure and non-secure flags indicates that |
2260 | * the register has both a secure and non-secure hash entry. A single one of |
2261 | * these flags causes the register to only be hashed for the specified |
2262 | * security state. |
2263 | * Although definitions may have any combination of the S/NS bits, each |
2264 | * registered entry will only have one to identify whether the entry is secure |
2265 | * or non-secure. |
2266 | */ |
2267 | enum { |
2268 | ARM_CP_SECSTATE_S = (1 << 0), /* bit[0]: Secure state register */ |
2269 | ARM_CP_SECSTATE_NS = (1 << 1), /* bit[1]: Non-secure state register */ |
2270 | }; |
2271 | |
2272 | /* Return true if cptype is a valid type field. This is used to try to |
2273 | * catch errors where the sentinel has been accidentally left off the end |
2274 | * of a list of registers. |
2275 | */ |
2276 | static inline bool cptype_valid(int cptype) |
2277 | { |
2278 | return ((cptype & ~ARM_CP_FLAG_MASK) == 0) |
2279 | || ((cptype & ARM_CP_SPECIAL) && |
2280 | ((cptype & ~ARM_CP_FLAG_MASK) <= ARM_LAST_SPECIAL)); |
2281 | } |
2282 | |
2283 | /* Access rights: |
2284 | * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM |
2285 | * defines as PL0 (user), PL1 (fiq/irq/svc/abt/und/sys, ie privileged), and |
2286 | * PL2 (hyp). The other level which has Read and Write bits is Secure PL1 |
2287 | * (ie any of the privileged modes in Secure state, or Monitor mode). |
2288 | * If a register is accessible in one privilege level it's always accessible |
2289 | * in higher privilege levels too. Since "Secure PL1" also follows this rule |
2290 | * (ie anything visible in PL2 is visible in S-PL1, some things are only |
2291 | * visible in S-PL1) but "Secure PL1" is a bit of a mouthful, we bend the |
2292 | * terminology a little and call this PL3. |
2293 | * In AArch64 things are somewhat simpler as the PLx bits line up exactly |
2294 | * with the ELx exception levels. |
2295 | * |
2296 | * If access permissions for a register are more complex than can be |
2297 | * described with these bits, then use a laxer set of restrictions, and |
2298 | * do the more restrictive/complex check inside a helper function. |
2299 | */ |
2300 | #define PL3_R 0x80 |
2301 | #define PL3_W 0x40 |
2302 | #define PL2_R (0x20 | PL3_R) |
2303 | #define PL2_W (0x10 | PL3_W) |
2304 | #define PL1_R (0x08 | PL2_R) |
2305 | #define PL1_W (0x04 | PL2_W) |
2306 | #define PL0_R (0x02 | PL1_R) |
2307 | #define PL0_W (0x01 | PL1_W) |
2308 | |
2309 | /* |
2310 | * For user-mode some registers are accessible to EL0 via a kernel |
2311 | * trap-and-emulate ABI. In this case we define the read permissions |
2312 | * as actually being PL0_R. However some bits of any given register |
2313 | * may still be masked. |
2314 | */ |
2315 | #ifdef CONFIG_USER_ONLY |
2316 | #define PL0U_R PL0_R |
2317 | #else |
2318 | #define PL0U_R PL1_R |
2319 | #endif |
2320 | |
2321 | #define PL3_RW (PL3_R | PL3_W) |
2322 | #define PL2_RW (PL2_R | PL2_W) |
2323 | #define PL1_RW (PL1_R | PL1_W) |
2324 | #define PL0_RW (PL0_R | PL0_W) |
2325 | |
2326 | /* Return the highest implemented Exception Level */ |
2327 | static inline int arm_highest_el(CPUARMState *env) |
2328 | { |
2329 | if (arm_feature(env, ARM_FEATURE_EL3)) { |
2330 | return 3; |
2331 | } |
2332 | if (arm_feature(env, ARM_FEATURE_EL2)) { |
2333 | return 2; |
2334 | } |
2335 | return 1; |
2336 | } |
2337 | |
2338 | /* Return true if a v7M CPU is in Handler mode */ |
2339 | static inline bool arm_v7m_is_handler_mode(CPUARMState *env) |
2340 | { |
2341 | return env->v7m.exception != 0; |
2342 | } |
2343 | |
2344 | /* Return the current Exception Level (as per ARMv8; note that this differs |
2345 | * from the ARMv7 Privilege Level). |
2346 | */ |
2347 | static inline int arm_current_el(CPUARMState *env) |
2348 | { |
2349 | if (arm_feature(env, ARM_FEATURE_M)) { |
2350 | return arm_v7m_is_handler_mode(env) || |
2351 | !(env->v7m.control[env->v7m.secure] & 1); |
2352 | } |
2353 | |
2354 | if (is_a64(env)) { |
2355 | return extract32(env->pstate, 2, 2); |
2356 | } |
2357 | |
2358 | switch (env->uncached_cpsr & 0x1f) { |
2359 | case ARM_CPU_MODE_USR: |
2360 | return 0; |
2361 | case ARM_CPU_MODE_HYP: |
2362 | return 2; |
2363 | case ARM_CPU_MODE_MON: |
2364 | return 3; |
2365 | default: |
2366 | if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) { |
2367 | /* If EL3 is 32-bit then all secure privileged modes run in |
2368 | * EL3 |
2369 | */ |
2370 | return 3; |
2371 | } |
2372 | |
2373 | return 1; |
2374 | } |
2375 | } |
2376 | |
2377 | typedef struct ARMCPRegInfo ARMCPRegInfo; |
2378 | |
2379 | typedef enum CPAccessResult { |
2380 | /* Access is permitted */ |
2381 | CP_ACCESS_OK = 0, |
2382 | /* Access fails due to a configurable trap or enable which would |
2383 | * result in a categorized exception syndrome giving information about |
2384 | * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6, |
2385 | * 0xc or 0x18). The exception is taken to the usual target EL (EL1 or |
2386 | * PL1 if in EL0, otherwise to the current EL). |
2387 | */ |
2388 | CP_ACCESS_TRAP = 1, |
2389 | /* Access fails and results in an exception syndrome 0x0 ("uncategorized"). |
2390 | * Note that this is not a catch-all case -- the set of cases which may |
2391 | * result in this failure is specifically defined by the architecture. |
2392 | */ |
2393 | CP_ACCESS_TRAP_UNCATEGORIZED = 2, |
2394 | /* As CP_ACCESS_TRAP, but for traps directly to EL2 or EL3 */ |
2395 | CP_ACCESS_TRAP_EL2 = 3, |
2396 | CP_ACCESS_TRAP_EL3 = 4, |
2397 | /* As CP_ACCESS_UNCATEGORIZED, but for traps directly to EL2 or EL3 */ |
2398 | CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = 5, |
2399 | CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = 6, |
2400 | /* Access fails and results in an exception syndrome for an FP access, |
2401 | * trapped directly to EL2 or EL3 |
2402 | */ |
2403 | CP_ACCESS_TRAP_FP_EL2 = 7, |
2404 | CP_ACCESS_TRAP_FP_EL3 = 8, |
2405 | } CPAccessResult; |
2406 | |
2407 | /* Access functions for coprocessor registers. These cannot fail and |
2408 | * may not raise exceptions. |
2409 | */ |
2410 | typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque); |
2411 | typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *opaque, |
2412 | uint64_t value); |
2413 | /* Access permission check functions for coprocessor registers. */ |
2414 | typedef CPAccessResult CPAccessFn(CPUARMState *env, |
2415 | const ARMCPRegInfo *opaque, |
2416 | bool isread); |
2417 | /* Hook function for register reset */ |
2418 | typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *opaque); |
2419 | |
2420 | #define CP_ANY 0xff |
2421 | |
2422 | /* Definition of an ARM coprocessor register */ |
2423 | struct ARMCPRegInfo { |
2424 | /* Name of register (useful mainly for debugging, need not be unique) */ |
2425 | const char *name; |
2426 | /* Location of register: coprocessor number and (crn,crm,opc1,opc2) |
2427 | * tuple. Any of crm, opc1 and opc2 may be CP_ANY to indicate a |
2428 | * 'wildcard' field -- any value of that field in the MRC/MCR insn |
2429 | * will be decoded to this register. The register read and write |
2430 | * callbacks will be passed an ARMCPRegInfo with the crn/crm/opc1/opc2 |
2431 | * used by the program, so it is possible to register a wildcard and |
2432 | * then behave differently on read/write if necessary. |
2433 | * For 64 bit registers, only crm and opc1 are relevant; crn and opc2 |
2434 | * must both be zero. |
2435 | * For AArch64-visible registers, opc0 is also used. |
2436 | * Since there are no "coprocessors" in AArch64, cp is purely used as a |
2437 | * way to distinguish (for KVM's benefit) guest-visible system registers |
2438 | * from demuxed ones provided to preserve the "no side effects on |
2439 | * KVM register read/write from QEMU" semantics. cp==0x13 is guest |
2440 | * visible (to match KVM's encoding); cp==0 will be converted to |
2441 | * cp==0x13 when the ARMCPRegInfo is registered, for convenience. |
2442 | */ |
2443 | uint8_t cp; |
2444 | uint8_t crn; |
2445 | uint8_t crm; |
2446 | uint8_t opc0; |
2447 | uint8_t opc1; |
2448 | uint8_t opc2; |
2449 | /* Execution state in which this register is visible: ARM_CP_STATE_* */ |
2450 | int state; |
2451 | /* Register type: ARM_CP_* bits/values */ |
2452 | int type; |
2453 | /* Access rights: PL*_[RW] */ |
2454 | int access; |
2455 | /* Security state: ARM_CP_SECSTATE_* bits/values */ |
2456 | int secure; |
2457 | /* The opaque pointer passed to define_arm_cp_regs_with_opaque() when |
2458 | * this register was defined: can be used to hand data through to the |
2459 | * register read/write functions, since they are passed the ARMCPRegInfo*. |
2460 | */ |
2461 | void *opaque; |
2462 | /* Value of this register, if it is ARM_CP_CONST. Otherwise, if |
2463 | * fieldoffset is non-zero, the reset value of the register. |
2464 | */ |
2465 | uint64_t resetvalue; |
2466 | /* Offset of the field in CPUARMState for this register. |
2467 | * |
2468 | * This is not needed if either: |
2469 | * 1. type is ARM_CP_CONST or one of the ARM_CP_SPECIALs |
2470 | * 2. both readfn and writefn are specified |
2471 | */ |
2472 | ptrdiff_t fieldoffset; /* offsetof(CPUARMState, field) */ |
2473 | |
2474 | /* Offsets of the secure and non-secure fields in CPUARMState for the |
2475 | * register if it is banked. These fields are only used during the static |
2476 | * registration of a register. During hashing the bank associated |
2477 | * with a given security state is copied to fieldoffset which is used from |
2478 | * there on out. |
2479 | * |
2480 | * It is expected that register definitions use either fieldoffset or |
2481 | * bank_fieldoffsets in the definition but not both. It is also expected |
2482 | * that both bank offsets are set when defining a banked register. This |
2483 | * use indicates that a register is banked. |
2484 | */ |
2485 | ptrdiff_t bank_fieldoffsets[2]; |
2486 | |
2487 | /* Function for making any access checks for this register in addition to |
2488 | * those specified by the 'access' permissions bits. If NULL, no extra |
2489 | * checks required. The access check is performed at runtime, not at |
2490 | * translate time. |
2491 | */ |
2492 | CPAccessFn *accessfn; |
2493 | /* Function for handling reads of this register. If NULL, then reads |
2494 | * will be done by loading from the offset into CPUARMState specified |
2495 | * by fieldoffset. |
2496 | */ |
2497 | CPReadFn *readfn; |
2498 | /* Function for handling writes of this register. If NULL, then writes |
2499 | * will be done by writing to the offset into CPUARMState specified |
2500 | * by fieldoffset. |
2501 | */ |
2502 | CPWriteFn *writefn; |
2503 | /* Function for doing a "raw" read; used when we need to copy |
2504 | * coprocessor state to the kernel for KVM or out for |
2505 | * migration. This only needs to be provided if there is also a |
2506 | * readfn and it has side effects (for instance clear-on-read bits). |
2507 | */ |
2508 | CPReadFn *raw_readfn; |
2509 | /* Function for doing a "raw" write; used when we need to copy KVM |
2510 | * kernel coprocessor state into userspace, or for inbound |
2511 | * migration. This only needs to be provided if there is also a |
2512 | * writefn and it masks out "unwritable" bits or has write-one-to-clear |
2513 | * or similar behaviour. |
2514 | */ |
2515 | CPWriteFn *raw_writefn; |
2516 | /* Function for resetting the register. If NULL, then reset will be done |
2517 | * by writing resetvalue to the field specified in fieldoffset. If |
2518 | * fieldoffset is 0 then no reset will be done. |
2519 | */ |
2520 | CPResetFn *resetfn; |
2521 | }; |
2522 | |
2523 | /* Macros which are lvalues for the field in CPUARMState for the |
2524 | * ARMCPRegInfo *ri. |
2525 | */ |
2526 | #define CPREG_FIELD32(env, ri) \ |
2527 | (*(uint32_t *)((char *)(env) + (ri)->fieldoffset)) |
2528 | #define CPREG_FIELD64(env, ri) \ |
2529 | (*(uint64_t *)((char *)(env) + (ri)->fieldoffset)) |
2530 | |
2531 | #define REGINFO_SENTINEL { .type = ARM_CP_SENTINEL } |
2532 | |
2533 | void define_arm_cp_regs_with_opaque(ARMCPU *cpu, |
2534 | const ARMCPRegInfo *regs, void *opaque); |
2535 | void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, |
2536 | const ARMCPRegInfo *regs, void *opaque); |
2537 | static inline void define_arm_cp_regs(ARMCPU *cpu, const ARMCPRegInfo *regs) |
2538 | { |
2539 | define_arm_cp_regs_with_opaque(cpu, regs, 0); |
2540 | } |
2541 | static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs) |
2542 | { |
2543 | define_one_arm_cp_reg_with_opaque(cpu, regs, 0); |
2544 | } |
2545 | const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp); |
2546 | |
2547 | /* |
2548 | * Definition of an ARM co-processor register as viewed from |
2549 | * userspace. This is used for presenting sanitised versions of |
2550 | * registers to userspace when emulating the Linux AArch64 CPU |
2551 | * ID/feature ABI (advertised as HWCAP_CPUID). |
2552 | */ |
2553 | typedef struct ARMCPRegUserSpaceInfo { |
2554 | /* Name of register */ |
2555 | const char *name; |
2556 | |
2557 | /* Is the name actually a glob pattern */ |
2558 | bool is_glob; |
2559 | |
2560 | /* Only some bits are exported to user space */ |
2561 | uint64_t exported_bits; |
2562 | |
2563 | /* Fixed bits are applied after the mask */ |
2564 | uint64_t fixed_bits; |
2565 | } ARMCPRegUserSpaceInfo; |
2566 | |
2567 | #define REGUSERINFO_SENTINEL { .name = NULL } |
2568 | |
2569 | void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods); |
2570 | |
2571 | /* CPWriteFn that can be used to implement writes-ignored behaviour */ |
2572 | void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, |
2573 | uint64_t value); |
2574 | /* CPReadFn that can be used for read-as-zero behaviour */ |
2575 | uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri); |
2576 | |
2577 | /* CPResetFn that does nothing, for use if no reset is required even |
2578 | * if fieldoffset is non zero. |
2579 | */ |
2580 | void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque); |
2581 | |
2582 | /* Return true if this reginfo struct's field in the cpu state struct |
2583 | * is 64 bits wide. |
2584 | */ |
2585 | static inline bool cpreg_field_is_64bit(const ARMCPRegInfo *ri) |
2586 | { |
2587 | return (ri->state == ARM_CP_STATE_AA64) || (ri->type & ARM_CP_64BIT); |
2588 | } |
2589 | |
2590 | static inline bool cp_access_ok(int current_el, |
2591 | const ARMCPRegInfo *ri, int isread) |
2592 | { |
2593 | return (ri->access >> ((current_el * 2) + isread)) & 1; |
2594 | } |
2595 | |
2596 | /* Raw read of a coprocessor register (as needed for migration, etc) */ |
2597 | uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri); |
2598 | |
2599 | /** |
2600 | * write_list_to_cpustate |
2601 | * @cpu: ARMCPU |
2602 | * |
2603 | * For each register listed in the ARMCPU cpreg_indexes list, write |
2604 | * its value from the cpreg_values list into the ARMCPUState structure. |
2605 | * This updates TCG's working data structures from KVM data or |
2606 | * from incoming migration state. |
2607 | * |
2608 | * Returns: true if all register values were updated correctly, |
2609 | * false if some register was unknown or could not be written. |
2610 | * Note that we do not stop early on failure -- we will attempt |
2611 | * writing all registers in the list. |
2612 | */ |
2613 | bool write_list_to_cpustate(ARMCPU *cpu); |
2614 | |
2615 | /** |
2616 | * write_cpustate_to_list: |
2617 | * @cpu: ARMCPU |
2618 | * @kvm_sync: true if this is for syncing back to KVM |
2619 | * |
2620 | * For each register listed in the ARMCPU cpreg_indexes list, write |
2621 | * its value from the ARMCPUState structure into the cpreg_values list. |
2622 | * This is used to copy info from TCG's working data structures into |
2623 | * KVM or for outbound migration. |
2624 | * |
2625 | * @kvm_sync is true if we are doing this in order to sync the |
2626 | * register state back to KVM. In this case we will only update |
2627 | * values in the list if the previous list->cpustate sync actually |
2628 | * successfully wrote the CPU state. Otherwise we will keep the value |
2629 | * that is in the list. |
2630 | * |
2631 | * Returns: true if all register values were read correctly, |
2632 | * false if some register was unknown or could not be read. |
2633 | * Note that we do not stop early on failure -- we will attempt |
2634 | * reading all registers in the list. |
2635 | */ |
2636 | bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync); |
2637 | |
2638 | #define ARM_CPUID_TI915T 0x54029152 |
2639 | #define ARM_CPUID_TI925T 0x54029252 |
2640 | |
2641 | static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx, |
2642 | unsigned int target_el) |
2643 | { |
2644 | CPUARMState *env = cs->env_ptr; |
2645 | unsigned int cur_el = arm_current_el(env); |
2646 | bool secure = arm_is_secure(env); |
2647 | bool pstate_unmasked; |
2648 | int8_t unmasked = 0; |
2649 | uint64_t hcr_el2; |
2650 | |
2651 | /* Don't take exceptions if they target a lower EL. |
2652 | * This check should catch any exceptions that would not be taken but left |
2653 | * pending. |
2654 | */ |
2655 | if (cur_el > target_el) { |
2656 | return false; |
2657 | } |
2658 | |
2659 | hcr_el2 = arm_hcr_el2_eff(env); |
2660 | |
2661 | switch (excp_idx) { |
2662 | case EXCP_FIQ: |
2663 | pstate_unmasked = !(env->daif & PSTATE_F); |
2664 | break; |
2665 | |
2666 | case EXCP_IRQ: |
2667 | pstate_unmasked = !(env->daif & PSTATE_I); |
2668 | break; |
2669 | |
2670 | case EXCP_VFIQ: |
2671 | if (secure || !(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) { |
2672 | /* VFIQs are only taken when hypervized and non-secure. */ |
2673 | return false; |
2674 | } |
2675 | return !(env->daif & PSTATE_F); |
2676 | case EXCP_VIRQ: |
2677 | if (secure || !(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) { |
2678 | /* VIRQs are only taken when hypervized and non-secure. */ |
2679 | return false; |
2680 | } |
2681 | return !(env->daif & PSTATE_I); |
2682 | default: |
2683 | g_assert_not_reached(); |
2684 | } |
2685 | |
2686 | /* Use the target EL, current execution state and SCR/HCR settings to |
2687 | * determine whether the corresponding CPSR bit is used to mask the |
2688 | * interrupt. |
2689 | */ |
2690 | if ((target_el > cur_el) && (target_el != 1)) { |
2691 | /* Exceptions targeting a higher EL may not be maskable */ |
2692 | if (arm_feature(env, ARM_FEATURE_AARCH64)) { |
2693 | /* 64-bit masking rules are simple: exceptions to EL3 |
2694 | * can't be masked, and exceptions to EL2 can only be |
2695 | * masked from Secure state. The HCR and SCR settings |
2696 | * don't affect the masking logic, only the interrupt routing. |
2697 | */ |
2698 | if (target_el == 3 || !secure) { |
2699 | unmasked = 1; |
2700 | } |
2701 | } else { |
2702 | /* The old 32-bit-only environment has a more complicated |
2703 | * masking setup. HCR and SCR bits not only affect interrupt |
2704 | * routing but also change the behaviour of masking. |
2705 | */ |
2706 | bool hcr, scr; |
2707 | |
2708 | switch (excp_idx) { |
2709 | case EXCP_FIQ: |
2710 | /* If FIQs are routed to EL3 or EL2 then there are cases where |
2711 | * we override the CPSR.F in determining if the exception is |
2712 | * masked or not. If neither of these are set then we fall back |
2713 | * to the CPSR.F setting otherwise we further assess the state |
2714 | * below. |
2715 | */ |
2716 | hcr = hcr_el2 & HCR_FMO; |
2717 | scr = (env->cp15.scr_el3 & SCR_FIQ); |
2718 | |
2719 | /* When EL3 is 32-bit, the SCR.FW bit controls whether the |
2720 | * CPSR.F bit masks FIQ interrupts when taken in non-secure |
2721 | * state. If SCR.FW is set then FIQs can be masked by CPSR.F |
2722 | * when non-secure but only when FIQs are only routed to EL3. |
2723 | */ |
2724 | scr = scr && !((env->cp15.scr_el3 & SCR_FW) && !hcr); |
2725 | break; |
2726 | case EXCP_IRQ: |
2727 | /* When EL3 execution state is 32-bit, if HCR.IMO is set then |
2728 | * we may override the CPSR.I masking when in non-secure state. |
2729 | * The SCR.IRQ setting has already been taken into consideration |
2730 | * when setting the target EL, so it does not have a further |
2731 | * affect here. |
2732 | */ |
2733 | hcr = hcr_el2 & HCR_IMO; |
2734 | scr = false; |
2735 | break; |
2736 | default: |
2737 | g_assert_not_reached(); |
2738 | } |
2739 | |
2740 | if ((scr || hcr) && !secure) { |
2741 | unmasked = 1; |
2742 | } |
2743 | } |
2744 | } |
2745 | |
2746 | /* The PSTATE bits only mask the interrupt if we have not overriden the |
2747 | * ability above. |
2748 | */ |
2749 | return unmasked || pstate_unmasked; |
2750 | } |
2751 | |
2752 | #define ARM_CPU_TYPE_SUFFIX "-" TYPE_ARM_CPU |
2753 | #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX) |
2754 | #define CPU_RESOLVING_TYPE TYPE_ARM_CPU |
2755 | |
2756 | #define cpu_signal_handler cpu_arm_signal_handler |
2757 | #define cpu_list arm_cpu_list |
2758 | |
2759 | /* ARM has the following "translation regimes" (as the ARM ARM calls them): |
2760 | * |
2761 | * If EL3 is 64-bit: |
2762 | * + NonSecure EL1 & 0 stage 1 |
2763 | * + NonSecure EL1 & 0 stage 2 |
2764 | * + NonSecure EL2 |
2765 | * + Secure EL1 & EL0 |
2766 | * + Secure EL3 |
2767 | * If EL3 is 32-bit: |
2768 | * + NonSecure PL1 & 0 stage 1 |
2769 | * + NonSecure PL1 & 0 stage 2 |
2770 | * + NonSecure PL2 |
2771 | * + Secure PL0 & PL1 |
2772 | * (reminder: for 32 bit EL3, Secure PL1 is *EL3*, not EL1.) |
2773 | * |
2774 | * For QEMU, an mmu_idx is not quite the same as a translation regime because: |
2775 | * 1. we need to split the "EL1 & 0" regimes into two mmu_idxes, because they |
2776 | * may differ in access permissions even if the VA->PA map is the same |
2777 | * 2. we want to cache in our TLB the full VA->IPA->PA lookup for a stage 1+2 |
2778 | * translation, which means that we have one mmu_idx that deals with two |
2779 | * concatenated translation regimes [this sort of combined s1+2 TLB is |
2780 | * architecturally permitted] |
2781 | * 3. we don't need to allocate an mmu_idx to translations that we won't be |
2782 | * handling via the TLB. The only way to do a stage 1 translation without |
2783 | * the immediate stage 2 translation is via the ATS or AT system insns, |
2784 | * which can be slow-pathed and always do a page table walk. |
2785 | * 4. we can also safely fold together the "32 bit EL3" and "64 bit EL3" |
2786 | * translation regimes, because they map reasonably well to each other |
2787 | * and they can't both be active at the same time. |
2788 | * This gives us the following list of mmu_idx values: |
2789 | * |
2790 | * NS EL0 (aka NS PL0) stage 1+2 |
2791 | * NS EL1 (aka NS PL1) stage 1+2 |
2792 | * NS EL2 (aka NS PL2) |
2793 | * S EL3 (aka S PL1) |
2794 | * S EL0 (aka S PL0) |
2795 | * S EL1 (not used if EL3 is 32 bit) |
2796 | * NS EL0+1 stage 2 |
2797 | * |
2798 | * (The last of these is an mmu_idx because we want to be able to use the TLB |
2799 | * for the accesses done as part of a stage 1 page table walk, rather than |
2800 | * having to walk the stage 2 page table over and over.) |
2801 | * |
2802 | * R profile CPUs have an MPU, but can use the same set of MMU indexes |
2803 | * as A profile. They only need to distinguish NS EL0 and NS EL1 (and |
2804 | * NS EL2 if we ever model a Cortex-R52). |
2805 | * |
2806 | * M profile CPUs are rather different as they do not have a true MMU. |
2807 | * They have the following different MMU indexes: |
2808 | * User |
2809 | * Privileged |
2810 | * User, execution priority negative (ie the MPU HFNMIENA bit may apply) |
2811 | * Privileged, execution priority negative (ditto) |
2812 | * If the CPU supports the v8M Security Extension then there are also: |
2813 | * Secure User |
2814 | * Secure Privileged |
2815 | * Secure User, execution priority negative |
2816 | * Secure Privileged, execution priority negative |
2817 | * |
2818 | * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code |
2819 | * are not quite the same -- different CPU types (most notably M profile |
2820 | * vs A/R profile) would like to use MMU indexes with different semantics, |
2821 | * but since we don't ever need to use all of those in a single CPU we |
2822 | * can avoid setting NB_MMU_MODES to more than 8. The lower bits of |
2823 | * ARMMMUIdx are the core TLB mmu index, and the higher bits are always |
2824 | * the same for any particular CPU. |
2825 | * Variables of type ARMMUIdx are always full values, and the core |
2826 | * index values are in variables of type 'int'. |
2827 | * |
2828 | * Our enumeration includes at the end some entries which are not "true" |
2829 | * mmu_idx values in that they don't have corresponding TLBs and are only |
2830 | * valid for doing slow path page table walks. |
2831 | * |
2832 | * The constant names here are patterned after the general style of the names |
2833 | * of the AT/ATS operations. |
2834 | * The values used are carefully arranged to make mmu_idx => EL lookup easy. |
2835 | * For M profile we arrange them to have a bit for priv, a bit for negpri |
2836 | * and a bit for secure. |
2837 | */ |
2838 | #define ARM_MMU_IDX_A 0x10 /* A profile */ |
2839 | #define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */ |
2840 | #define ARM_MMU_IDX_M 0x40 /* M profile */ |
2841 | |
2842 | /* meanings of the bits for M profile mmu idx values */ |
2843 | #define ARM_MMU_IDX_M_PRIV 0x1 |
2844 | #define ARM_MMU_IDX_M_NEGPRI 0x2 |
2845 | #define ARM_MMU_IDX_M_S 0x4 |
2846 | |
2847 | #define ARM_MMU_IDX_TYPE_MASK (~0x7) |
2848 | #define ARM_MMU_IDX_COREIDX_MASK 0x7 |
2849 | |
2850 | typedef enum ARMMMUIdx { |
2851 | ARMMMUIdx_S12NSE0 = 0 | ARM_MMU_IDX_A, |
2852 | ARMMMUIdx_S12NSE1 = 1 | ARM_MMU_IDX_A, |
2853 | ARMMMUIdx_S1E2 = 2 | ARM_MMU_IDX_A, |
2854 | ARMMMUIdx_S1E3 = 3 | ARM_MMU_IDX_A, |
2855 | ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A, |
2856 | ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A, |
2857 | ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A, |
2858 | ARMMMUIdx_MUser = 0 | ARM_MMU_IDX_M, |
2859 | ARMMMUIdx_MPriv = 1 | ARM_MMU_IDX_M, |
2860 | ARMMMUIdx_MUserNegPri = 2 | ARM_MMU_IDX_M, |
2861 | ARMMMUIdx_MPrivNegPri = 3 | ARM_MMU_IDX_M, |
2862 | ARMMMUIdx_MSUser = 4 | ARM_MMU_IDX_M, |
2863 | ARMMMUIdx_MSPriv = 5 | ARM_MMU_IDX_M, |
2864 | ARMMMUIdx_MSUserNegPri = 6 | ARM_MMU_IDX_M, |
2865 | ARMMMUIdx_MSPrivNegPri = 7 | ARM_MMU_IDX_M, |
2866 | /* Indexes below here don't have TLBs and are used only for AT system |
2867 | * instructions or for the first stage of an S12 page table walk. |
2868 | */ |
2869 | ARMMMUIdx_S1NSE0 = 0 | ARM_MMU_IDX_NOTLB, |
2870 | ARMMMUIdx_S1NSE1 = 1 | ARM_MMU_IDX_NOTLB, |
2871 | } ARMMMUIdx; |
2872 | |
2873 | /* Bit macros for the core-mmu-index values for each index, |
2874 | * for use when calling tlb_flush_by_mmuidx() and friends. |
2875 | */ |
2876 | typedef enum ARMMMUIdxBit { |
2877 | ARMMMUIdxBit_S12NSE0 = 1 << 0, |
2878 | ARMMMUIdxBit_S12NSE1 = 1 << 1, |
2879 | ARMMMUIdxBit_S1E2 = 1 << 2, |
2880 | ARMMMUIdxBit_S1E3 = 1 << 3, |
2881 | ARMMMUIdxBit_S1SE0 = 1 << 4, |
2882 | ARMMMUIdxBit_S1SE1 = 1 << 5, |
2883 | ARMMMUIdxBit_S2NS = 1 << 6, |
2884 | ARMMMUIdxBit_MUser = 1 << 0, |
2885 | ARMMMUIdxBit_MPriv = 1 << 1, |
2886 | ARMMMUIdxBit_MUserNegPri = 1 << 2, |
2887 | ARMMMUIdxBit_MPrivNegPri = 1 << 3, |
2888 | ARMMMUIdxBit_MSUser = 1 << 4, |
2889 | ARMMMUIdxBit_MSPriv = 1 << 5, |
2890 | ARMMMUIdxBit_MSUserNegPri = 1 << 6, |
2891 | ARMMMUIdxBit_MSPrivNegPri = 1 << 7, |
2892 | } ARMMMUIdxBit; |
2893 | |
2894 | #define MMU_USER_IDX 0 |
2895 | |
2896 | static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx) |
2897 | { |
2898 | return mmu_idx & ARM_MMU_IDX_COREIDX_MASK; |
2899 | } |
2900 | |
2901 | static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx) |
2902 | { |
2903 | if (arm_feature(env, ARM_FEATURE_M)) { |
2904 | return mmu_idx | ARM_MMU_IDX_M; |
2905 | } else { |
2906 | return mmu_idx | ARM_MMU_IDX_A; |
2907 | } |
2908 | } |
2909 | |
2910 | /* Return the exception level we're running at if this is our mmu_idx */ |
2911 | static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx) |
2912 | { |
2913 | switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) { |
2914 | case ARM_MMU_IDX_A: |
2915 | return mmu_idx & 3; |
2916 | case ARM_MMU_IDX_M: |
2917 | return mmu_idx & ARM_MMU_IDX_M_PRIV; |
2918 | default: |
2919 | g_assert_not_reached(); |
2920 | } |
2921 | } |
2922 | |
2923 | /* |
2924 | * Return the MMU index for a v7M CPU with all relevant information |
2925 | * manually specified. |
2926 | */ |
2927 | ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env, |
2928 | bool secstate, bool priv, bool negpri); |
2929 | |
2930 | /* Return the MMU index for a v7M CPU in the specified security and |
2931 | * privilege state. |
2932 | */ |
2933 | ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env, |
2934 | bool secstate, bool priv); |
2935 | |
2936 | /* Return the MMU index for a v7M CPU in the specified security state */ |
2937 | ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate); |
2938 | |
2939 | /** |
2940 | * cpu_mmu_index: |
2941 | * @env: The cpu environment |
2942 | * @ifetch: True for code access, false for data access. |
2943 | * |
2944 | * Return the core mmu index for the current translation regime. |
2945 | * This function is used by generic TCG code paths. |
2946 | */ |
2947 | int cpu_mmu_index(CPUARMState *env, bool ifetch); |
2948 | |
2949 | /* Indexes used when registering address spaces with cpu_address_space_init */ |
2950 | typedef enum ARMASIdx { |
2951 | ARMASIdx_NS = 0, |
2952 | ARMASIdx_S = 1, |
2953 | } ARMASIdx; |
2954 | |
2955 | /* Return the Exception Level targeted by debug exceptions. */ |
2956 | static inline int arm_debug_target_el(CPUARMState *env) |
2957 | { |
2958 | bool secure = arm_is_secure(env); |
2959 | bool route_to_el2 = false; |
2960 | |
2961 | if (arm_feature(env, ARM_FEATURE_EL2) && !secure) { |
2962 | route_to_el2 = env->cp15.hcr_el2 & HCR_TGE || |
2963 | env->cp15.mdcr_el2 & MDCR_TDE; |
2964 | } |
2965 | |
2966 | if (route_to_el2) { |
2967 | return 2; |
2968 | } else if (arm_feature(env, ARM_FEATURE_EL3) && |
2969 | !arm_el_is_aa64(env, 3) && secure) { |
2970 | return 3; |
2971 | } else { |
2972 | return 1; |
2973 | } |
2974 | } |
2975 | |
2976 | static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu) |
2977 | { |
2978 | /* If all the CLIDR.Ctypem bits are 0 there are no caches, and |
2979 | * CSSELR is RAZ/WI. |
2980 | */ |
2981 | return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0; |
2982 | } |
2983 | |
2984 | /* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */ |
2985 | static inline bool aa64_generate_debug_exceptions(CPUARMState *env) |
2986 | { |
2987 | int cur_el = arm_current_el(env); |
2988 | int debug_el; |
2989 | |
2990 | if (cur_el == 3) { |
2991 | return false; |
2992 | } |
2993 | |
2994 | /* MDCR_EL3.SDD disables debug events from Secure state */ |
2995 | if (arm_is_secure_below_el3(env) |
2996 | && extract32(env->cp15.mdcr_el3, 16, 1)) { |
2997 | return false; |
2998 | } |
2999 | |
3000 | /* |
3001 | * Same EL to same EL debug exceptions need MDSCR_KDE enabled |
3002 | * while not masking the (D)ebug bit in DAIF. |
3003 | */ |
3004 | debug_el = arm_debug_target_el(env); |
3005 | |
3006 | if (cur_el == debug_el) { |
3007 | return extract32(env->cp15.mdscr_el1, 13, 1) |
3008 | && !(env->daif & PSTATE_D); |
3009 | } |
3010 | |
3011 | /* Otherwise the debug target needs to be a higher EL */ |
3012 | return debug_el > cur_el; |
3013 | } |
3014 | |
3015 | static inline bool aa32_generate_debug_exceptions(CPUARMState *env) |
3016 | { |
3017 | int el = arm_current_el(env); |
3018 | |
3019 | if (el == 0 && arm_el_is_aa64(env, 1)) { |
3020 | return aa64_generate_debug_exceptions(env); |
3021 | } |
3022 | |
3023 | if (arm_is_secure(env)) { |
3024 | int spd; |
3025 | |
3026 | if (el == 0 && (env->cp15.sder & 1)) { |
3027 | /* SDER.SUIDEN means debug exceptions from Secure EL0 |
3028 | * are always enabled. Otherwise they are controlled by |
3029 | * SDCR.SPD like those from other Secure ELs. |
3030 | */ |
3031 | return true; |
3032 | } |
3033 | |
3034 | spd = extract32(env->cp15.mdcr_el3, 14, 2); |
3035 | switch (spd) { |
3036 | case 1: |
3037 | /* SPD == 0b01 is reserved, but behaves as 0b00. */ |
3038 | case 0: |
3039 | /* For 0b00 we return true if external secure invasive debug |
3040 | * is enabled. On real hardware this is controlled by external |
3041 | * signals to the core. QEMU always permits debug, and behaves |
3042 | * as if DBGEN, SPIDEN, NIDEN and SPNIDEN are all tied high. |
3043 | */ |
3044 | return true; |
3045 | case 2: |
3046 | return false; |
3047 | case 3: |
3048 | return true; |
3049 | } |
3050 | } |
3051 | |
3052 | return el != 2; |
3053 | } |
3054 | |
3055 | /* Return true if debugging exceptions are currently enabled. |
3056 | * This corresponds to what in ARM ARM pseudocode would be |
3057 | * if UsingAArch32() then |
3058 | * return AArch32.GenerateDebugExceptions() |
3059 | * else |
3060 | * return AArch64.GenerateDebugExceptions() |
3061 | * We choose to push the if() down into this function for clarity, |
3062 | * since the pseudocode has it at all callsites except for the one in |
3063 | * CheckSoftwareStep(), where it is elided because both branches would |
3064 | * always return the same value. |
3065 | */ |
3066 | static inline bool arm_generate_debug_exceptions(CPUARMState *env) |
3067 | { |
3068 | if (env->aarch64) { |
3069 | return aa64_generate_debug_exceptions(env); |
3070 | } else { |
3071 | return aa32_generate_debug_exceptions(env); |
3072 | } |
3073 | } |
3074 | |
3075 | /* Is single-stepping active? (Note that the "is EL_D AArch64?" check |
3076 | * implicitly means this always returns false in pre-v8 CPUs.) |
3077 | */ |
3078 | static inline bool arm_singlestep_active(CPUARMState *env) |
3079 | { |
3080 | return extract32(env->cp15.mdscr_el1, 0, 1) |
3081 | && arm_el_is_aa64(env, arm_debug_target_el(env)) |
3082 | && arm_generate_debug_exceptions(env); |
3083 | } |
3084 | |
3085 | static inline bool arm_sctlr_b(CPUARMState *env) |
3086 | { |
3087 | return |
3088 | /* We need not implement SCTLR.ITD in user-mode emulation, so |
3089 | * let linux-user ignore the fact that it conflicts with SCTLR_B. |
3090 | * This lets people run BE32 binaries with "-cpu any". |
3091 | */ |
3092 | #ifndef CONFIG_USER_ONLY |
3093 | !arm_feature(env, ARM_FEATURE_V7) && |
3094 | #endif |
3095 | (env->cp15.sctlr_el[1] & SCTLR_B) != 0; |
3096 | } |
3097 | |
3098 | static inline uint64_t arm_sctlr(CPUARMState *env, int el) |
3099 | { |
3100 | if (el == 0) { |
3101 | /* FIXME: ARMv8.1-VHE S2 translation regime. */ |
3102 | return env->cp15.sctlr_el[1]; |
3103 | } else { |
3104 | return env->cp15.sctlr_el[el]; |
3105 | } |
3106 | } |
3107 | |
3108 | |
3109 | /* Return true if the processor is in big-endian mode. */ |
3110 | static inline bool arm_cpu_data_is_big_endian(CPUARMState *env) |
3111 | { |
3112 | /* In 32bit endianness is determined by looking at CPSR's E bit */ |
3113 | if (!is_a64(env)) { |
3114 | return |
3115 | #ifdef CONFIG_USER_ONLY |
3116 | /* In system mode, BE32 is modelled in line with the |
3117 | * architecture (as word-invariant big-endianness), where loads |
3118 | * and stores are done little endian but from addresses which |
3119 | * are adjusted by XORing with the appropriate constant. So the |
3120 | * endianness to use for the raw data access is not affected by |
3121 | * SCTLR.B. |
3122 | * In user mode, however, we model BE32 as byte-invariant |
3123 | * big-endianness (because user-only code cannot tell the |
3124 | * difference), and so we need to use a data access endianness |
3125 | * that depends on SCTLR.B. |
3126 | */ |
3127 | arm_sctlr_b(env) || |
3128 | #endif |
3129 | ((env->uncached_cpsr & CPSR_E) ? 1 : 0); |
3130 | } else { |
3131 | int cur_el = arm_current_el(env); |
3132 | uint64_t sctlr = arm_sctlr(env, cur_el); |
3133 | |
3134 | return (sctlr & (cur_el ? SCTLR_EE : SCTLR_E0E)) != 0; |
3135 | } |
3136 | } |
3137 | |
3138 | typedef CPUARMState CPUArchState; |
3139 | typedef ARMCPU ArchCPU; |
3140 | |
3141 | #include "exec/cpu-all.h" |
3142 | |
3143 | /* Bit usage in the TB flags field: bit 31 indicates whether we are |
3144 | * in 32 or 64 bit mode. The meaning of the other bits depends on that. |
3145 | * We put flags which are shared between 32 and 64 bit mode at the top |
3146 | * of the word, and flags which apply to only one mode at the bottom. |
3147 | */ |
3148 | FIELD(TBFLAG_ANY, AARCH64_STATE, 31, 1) |
3149 | FIELD(TBFLAG_ANY, MMUIDX, 28, 3) |
3150 | FIELD(TBFLAG_ANY, SS_ACTIVE, 27, 1) |
3151 | FIELD(TBFLAG_ANY, PSTATE_SS, 26, 1) |
3152 | /* Target EL if we take a floating-point-disabled exception */ |
3153 | FIELD(TBFLAG_ANY, FPEXC_EL, 24, 2) |
3154 | FIELD(TBFLAG_ANY, BE_DATA, 23, 1) |
3155 | /* |
3156 | * For A-profile only, target EL for debug exceptions. |
3157 | * Note that this overlaps with the M-profile-only HANDLER and STACKCHECK bits. |
3158 | */ |
3159 | FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 21, 2) |
3160 | |
3161 | /* Bit usage when in AArch32 state: */ |
3162 | FIELD(TBFLAG_A32, THUMB, 0, 1) |
3163 | FIELD(TBFLAG_A32, VECLEN, 1, 3) |
3164 | FIELD(TBFLAG_A32, VECSTRIDE, 4, 2) |
3165 | /* |
3166 | * We store the bottom two bits of the CPAR as TB flags and handle |
3167 | * checks on the other bits at runtime. This shares the same bits as |
3168 | * VECSTRIDE, which is OK as no XScale CPU has VFP. |
3169 | */ |
3170 | FIELD(TBFLAG_A32, XSCALE_CPAR, 4, 2) |
3171 | /* |
3172 | * Indicates whether cp register reads and writes by guest code should access |
3173 | * the secure or nonsecure bank of banked registers; note that this is not |
3174 | * the same thing as the current security state of the processor! |
3175 | */ |
3176 | FIELD(TBFLAG_A32, NS, 6, 1) |
3177 | FIELD(TBFLAG_A32, VFPEN, 7, 1) |
3178 | FIELD(TBFLAG_A32, CONDEXEC, 8, 8) |
3179 | FIELD(TBFLAG_A32, SCTLR_B, 16, 1) |
3180 | /* For M profile only, set if FPCCR.LSPACT is set */ |
3181 | FIELD(TBFLAG_A32, LSPACT, 18, 1) |
3182 | /* For M profile only, set if we must create a new FP context */ |
3183 | FIELD(TBFLAG_A32, NEW_FP_CTXT_NEEDED, 19, 1) |
3184 | /* For M profile only, set if FPCCR.S does not match current security state */ |
3185 | FIELD(TBFLAG_A32, FPCCR_S_WRONG, 20, 1) |
3186 | /* For M profile only, Handler (ie not Thread) mode */ |
3187 | FIELD(TBFLAG_A32, HANDLER, 21, 1) |
3188 | /* For M profile only, whether we should generate stack-limit checks */ |
3189 | FIELD(TBFLAG_A32, STACKCHECK, 22, 1) |
3190 | |
3191 | /* Bit usage when in AArch64 state */ |
3192 | FIELD(TBFLAG_A64, TBII, 0, 2) |
3193 | FIELD(TBFLAG_A64, SVEEXC_EL, 2, 2) |
3194 | FIELD(TBFLAG_A64, ZCR_LEN, 4, 4) |
3195 | FIELD(TBFLAG_A64, PAUTH_ACTIVE, 8, 1) |
3196 | FIELD(TBFLAG_A64, BT, 9, 1) |
3197 | FIELD(TBFLAG_A64, BTYPE, 10, 2) |
3198 | FIELD(TBFLAG_A64, TBID, 12, 2) |
3199 | |
3200 | static inline bool bswap_code(bool sctlr_b) |
3201 | { |
3202 | #ifdef CONFIG_USER_ONLY |
3203 | /* BE8 (SCTLR.B = 0, TARGET_WORDS_BIGENDIAN = 1) is mixed endian. |
3204 | * The invalid combination SCTLR.B=1/CPSR.E=1/TARGET_WORDS_BIGENDIAN=0 |
3205 | * would also end up as a mixed-endian mode with BE code, LE data. |
3206 | */ |
3207 | return |
3208 | #ifdef TARGET_WORDS_BIGENDIAN |
3209 | 1 ^ |
3210 | #endif |
3211 | sctlr_b; |
3212 | #else |
3213 | /* All code access in ARM is little endian, and there are no loaders |
3214 | * doing swaps that need to be reversed |
3215 | */ |
3216 | return 0; |
3217 | #endif |
3218 | } |
3219 | |
3220 | #ifdef CONFIG_USER_ONLY |
3221 | static inline bool arm_cpu_bswap_data(CPUARMState *env) |
3222 | { |
3223 | return |
3224 | #ifdef TARGET_WORDS_BIGENDIAN |
3225 | 1 ^ |
3226 | #endif |
3227 | arm_cpu_data_is_big_endian(env); |
3228 | } |
3229 | #endif |
3230 | |
3231 | void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, |
3232 | target_ulong *cs_base, uint32_t *flags); |
3233 | |
3234 | enum { |
3235 | QEMU_PSCI_CONDUIT_DISABLED = 0, |
3236 | QEMU_PSCI_CONDUIT_SMC = 1, |
3237 | QEMU_PSCI_CONDUIT_HVC = 2, |
3238 | }; |
3239 | |
3240 | #ifndef CONFIG_USER_ONLY |
3241 | /* Return the address space index to use for a memory access */ |
3242 | static inline int arm_asidx_from_attrs(CPUState *cs, MemTxAttrs attrs) |
3243 | { |
3244 | return attrs.secure ? ARMASIdx_S : ARMASIdx_NS; |
3245 | } |
3246 | |
3247 | /* Return the AddressSpace to use for a memory access |
3248 | * (which depends on whether the access is S or NS, and whether |
3249 | * the board gave us a separate AddressSpace for S accesses). |
3250 | */ |
3251 | static inline AddressSpace *arm_addressspace(CPUState *cs, MemTxAttrs attrs) |
3252 | { |
3253 | return cpu_get_address_space(cs, arm_asidx_from_attrs(cs, attrs)); |
3254 | } |
3255 | #endif |
3256 | |
3257 | /** |
3258 | * arm_register_pre_el_change_hook: |
3259 | * Register a hook function which will be called immediately before this |
3260 | * CPU changes exception level or mode. The hook function will be |
3261 | * passed a pointer to the ARMCPU and the opaque data pointer passed |
3262 | * to this function when the hook was registered. |
3263 | * |
3264 | * Note that if a pre-change hook is called, any registered post-change hooks |
3265 | * are guaranteed to subsequently be called. |
3266 | */ |
3267 | void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook, |
3268 | void *opaque); |
3269 | /** |
3270 | * arm_register_el_change_hook: |
3271 | * Register a hook function which will be called immediately after this |
3272 | * CPU changes exception level or mode. The hook function will be |
3273 | * passed a pointer to the ARMCPU and the opaque data pointer passed |
3274 | * to this function when the hook was registered. |
3275 | * |
3276 | * Note that any registered hooks registered here are guaranteed to be called |
3277 | * if pre-change hooks have been. |
3278 | */ |
3279 | void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook, void |
3280 | *opaque); |
3281 | |
3282 | /** |
3283 | * aa32_vfp_dreg: |
3284 | * Return a pointer to the Dn register within env in 32-bit mode. |
3285 | */ |
3286 | static inline uint64_t *aa32_vfp_dreg(CPUARMState *env, unsigned regno) |
3287 | { |
3288 | return &env->vfp.zregs[regno >> 1].d[regno & 1]; |
3289 | } |
3290 | |
3291 | /** |
3292 | * aa32_vfp_qreg: |
3293 | * Return a pointer to the Qn register within env in 32-bit mode. |
3294 | */ |
3295 | static inline uint64_t *aa32_vfp_qreg(CPUARMState *env, unsigned regno) |
3296 | { |
3297 | return &env->vfp.zregs[regno].d[0]; |
3298 | } |
3299 | |
3300 | /** |
3301 | * aa64_vfp_qreg: |
3302 | * Return a pointer to the Qn register within env in 64-bit mode. |
3303 | */ |
3304 | static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, unsigned regno) |
3305 | { |
3306 | return &env->vfp.zregs[regno].d[0]; |
3307 | } |
3308 | |
3309 | /* Shared between translate-sve.c and sve_helper.c. */ |
3310 | extern const uint64_t pred_esz_masks[4]; |
3311 | |
3312 | /* |
3313 | * 32-bit feature tests via id registers. |
3314 | */ |
3315 | static inline bool isar_feature_thumb_div(const ARMISARegisters *id) |
3316 | { |
3317 | return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) != 0; |
3318 | } |
3319 | |
3320 | static inline bool isar_feature_arm_div(const ARMISARegisters *id) |
3321 | { |
3322 | return FIELD_EX32(id->id_isar0, ID_ISAR0, DIVIDE) > 1; |
3323 | } |
3324 | |
3325 | static inline bool isar_feature_jazelle(const ARMISARegisters *id) |
3326 | { |
3327 | return FIELD_EX32(id->id_isar1, ID_ISAR1, JAZELLE) != 0; |
3328 | } |
3329 | |
3330 | static inline bool isar_feature_aa32_aes(const ARMISARegisters *id) |
3331 | { |
3332 | return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) != 0; |
3333 | } |
3334 | |
3335 | static inline bool isar_feature_aa32_pmull(const ARMISARegisters *id) |
3336 | { |
3337 | return FIELD_EX32(id->id_isar5, ID_ISAR5, AES) > 1; |
3338 | } |
3339 | |
3340 | static inline bool isar_feature_aa32_sha1(const ARMISARegisters *id) |
3341 | { |
3342 | return FIELD_EX32(id->id_isar5, ID_ISAR5, SHA1) != 0; |
3343 | } |
3344 | |
3345 | static inline bool isar_feature_aa32_sha2(const ARMISARegisters *id) |
3346 | { |
3347 | return FIELD_EX32(id->id_isar5, ID_ISAR5, SHA2) != 0; |
3348 | } |
3349 | |
3350 | static inline bool isar_feature_aa32_crc32(const ARMISARegisters *id) |
3351 | { |
3352 | return FIELD_EX32(id->id_isar5, ID_ISAR5, CRC32) != 0; |
3353 | } |
3354 | |
3355 | static inline bool isar_feature_aa32_rdm(const ARMISARegisters *id) |
3356 | { |
3357 | return FIELD_EX32(id->id_isar5, ID_ISAR5, RDM) != 0; |
3358 | } |
3359 | |
3360 | static inline bool isar_feature_aa32_vcma(const ARMISARegisters *id) |
3361 | { |
3362 | return FIELD_EX32(id->id_isar5, ID_ISAR5, VCMA) != 0; |
3363 | } |
3364 | |
3365 | static inline bool isar_feature_aa32_jscvt(const ARMISARegisters *id) |
3366 | { |
3367 | return FIELD_EX32(id->id_isar6, ID_ISAR6, JSCVT) != 0; |
3368 | } |
3369 | |
3370 | static inline bool isar_feature_aa32_dp(const ARMISARegisters *id) |
3371 | { |
3372 | return FIELD_EX32(id->id_isar6, ID_ISAR6, DP) != 0; |
3373 | } |
3374 | |
3375 | static inline bool isar_feature_aa32_fhm(const ARMISARegisters *id) |
3376 | { |
3377 | return FIELD_EX32(id->id_isar6, ID_ISAR6, FHM) != 0; |
3378 | } |
3379 | |
3380 | static inline bool isar_feature_aa32_sb(const ARMISARegisters *id) |
3381 | { |
3382 | return FIELD_EX32(id->id_isar6, ID_ISAR6, SB) != 0; |
3383 | } |
3384 | |
3385 | static inline bool isar_feature_aa32_predinv(const ARMISARegisters *id) |
3386 | { |
3387 | return FIELD_EX32(id->id_isar6, ID_ISAR6, SPECRES) != 0; |
3388 | } |
3389 | |
3390 | static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id) |
3391 | { |
3392 | /* |
3393 | * This is a placeholder for use by VCMA until the rest of |
3394 | * the ARMv8.2-FP16 extension is implemented for aa32 mode. |
3395 | * At which point we can properly set and check MVFR1.FPHP. |
3396 | */ |
3397 | return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1; |
3398 | } |
3399 | |
3400 | static inline bool isar_feature_aa32_fp_d32(const ARMISARegisters *id) |
3401 | { |
3402 | /* Return true if D16-D31 are implemented */ |
3403 | return FIELD_EX64(id->mvfr0, MVFR0, SIMDREG) >= 2; |
3404 | } |
3405 | |
3406 | static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id) |
3407 | { |
3408 | return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0; |
3409 | } |
3410 | |
3411 | static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id) |
3412 | { |
3413 | /* Return true if CPU supports double precision floating point */ |
3414 | return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0; |
3415 | } |
3416 | |
3417 | /* |
3418 | * We always set the FP and SIMD FP16 fields to indicate identical |
3419 | * levels of support (assuming SIMD is implemented at all), so |
3420 | * we only need one set of accessors. |
3421 | */ |
3422 | static inline bool isar_feature_aa32_fp16_spconv(const ARMISARegisters *id) |
3423 | { |
3424 | return FIELD_EX64(id->mvfr1, MVFR1, FPHP) > 0; |
3425 | } |
3426 | |
3427 | static inline bool isar_feature_aa32_fp16_dpconv(const ARMISARegisters *id) |
3428 | { |
3429 | return FIELD_EX64(id->mvfr1, MVFR1, FPHP) > 1; |
3430 | } |
3431 | |
3432 | static inline bool isar_feature_aa32_vsel(const ARMISARegisters *id) |
3433 | { |
3434 | return FIELD_EX64(id->mvfr2, MVFR2, FPMISC) >= 1; |
3435 | } |
3436 | |
3437 | static inline bool isar_feature_aa32_vcvt_dr(const ARMISARegisters *id) |
3438 | { |
3439 | return FIELD_EX64(id->mvfr2, MVFR2, FPMISC) >= 2; |
3440 | } |
3441 | |
3442 | static inline bool isar_feature_aa32_vrint(const ARMISARegisters *id) |
3443 | { |
3444 | return FIELD_EX64(id->mvfr2, MVFR2, FPMISC) >= 3; |
3445 | } |
3446 | |
3447 | static inline bool isar_feature_aa32_vminmaxnm(const ARMISARegisters *id) |
3448 | { |
3449 | return FIELD_EX64(id->mvfr2, MVFR2, FPMISC) >= 4; |
3450 | } |
3451 | |
3452 | /* |
3453 | * 64-bit feature tests via id registers. |
3454 | */ |
3455 | static inline bool isar_feature_aa64_aes(const ARMISARegisters *id) |
3456 | { |
3457 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, AES) != 0; |
3458 | } |
3459 | |
3460 | static inline bool isar_feature_aa64_pmull(const ARMISARegisters *id) |
3461 | { |
3462 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, AES) > 1; |
3463 | } |
3464 | |
3465 | static inline bool isar_feature_aa64_sha1(const ARMISARegisters *id) |
3466 | { |
3467 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA1) != 0; |
3468 | } |
3469 | |
3470 | static inline bool isar_feature_aa64_sha256(const ARMISARegisters *id) |
3471 | { |
3472 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA2) != 0; |
3473 | } |
3474 | |
3475 | static inline bool isar_feature_aa64_sha512(const ARMISARegisters *id) |
3476 | { |
3477 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA2) > 1; |
3478 | } |
3479 | |
3480 | static inline bool isar_feature_aa64_crc32(const ARMISARegisters *id) |
3481 | { |
3482 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, CRC32) != 0; |
3483 | } |
3484 | |
3485 | static inline bool isar_feature_aa64_atomics(const ARMISARegisters *id) |
3486 | { |
3487 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, ATOMIC) != 0; |
3488 | } |
3489 | |
3490 | static inline bool isar_feature_aa64_rdm(const ARMISARegisters *id) |
3491 | { |
3492 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, RDM) != 0; |
3493 | } |
3494 | |
3495 | static inline bool isar_feature_aa64_sha3(const ARMISARegisters *id) |
3496 | { |
3497 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SHA3) != 0; |
3498 | } |
3499 | |
3500 | static inline bool isar_feature_aa64_sm3(const ARMISARegisters *id) |
3501 | { |
3502 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SM3) != 0; |
3503 | } |
3504 | |
3505 | static inline bool isar_feature_aa64_sm4(const ARMISARegisters *id) |
3506 | { |
3507 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, SM4) != 0; |
3508 | } |
3509 | |
3510 | static inline bool isar_feature_aa64_dp(const ARMISARegisters *id) |
3511 | { |
3512 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, DP) != 0; |
3513 | } |
3514 | |
3515 | static inline bool isar_feature_aa64_fhm(const ARMISARegisters *id) |
3516 | { |
3517 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, FHM) != 0; |
3518 | } |
3519 | |
3520 | static inline bool isar_feature_aa64_condm_4(const ARMISARegisters *id) |
3521 | { |
3522 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, TS) != 0; |
3523 | } |
3524 | |
3525 | static inline bool isar_feature_aa64_condm_5(const ARMISARegisters *id) |
3526 | { |
3527 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, TS) >= 2; |
3528 | } |
3529 | |
3530 | static inline bool isar_feature_aa64_rndr(const ARMISARegisters *id) |
3531 | { |
3532 | return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, RNDR) != 0; |
3533 | } |
3534 | |
3535 | static inline bool isar_feature_aa64_jscvt(const ARMISARegisters *id) |
3536 | { |
3537 | return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, JSCVT) != 0; |
3538 | } |
3539 | |
3540 | static inline bool isar_feature_aa64_fcma(const ARMISARegisters *id) |
3541 | { |
3542 | return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, FCMA) != 0; |
3543 | } |
3544 | |
3545 | static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id) |
3546 | { |
3547 | /* |
3548 | * Note that while QEMU will only implement the architected algorithm |
3549 | * QARMA, and thus APA+GPA, the host cpu for kvm may use implementation |
3550 | * defined algorithms, and thus API+GPI, and this predicate controls |
3551 | * migration of the 128-bit keys. |
3552 | */ |
3553 | return (id->id_aa64isar1 & |
3554 | (FIELD_DP64(0, ID_AA64ISAR1, APA, 0xf) | |
3555 | FIELD_DP64(0, ID_AA64ISAR1, API, 0xf) | |
3556 | FIELD_DP64(0, ID_AA64ISAR1, GPA, 0xf) | |
3557 | FIELD_DP64(0, ID_AA64ISAR1, GPI, 0xf))) != 0; |
3558 | } |
3559 | |
3560 | static inline bool isar_feature_aa64_sb(const ARMISARegisters *id) |
3561 | { |
3562 | return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, SB) != 0; |
3563 | } |
3564 | |
3565 | static inline bool isar_feature_aa64_predinv(const ARMISARegisters *id) |
3566 | { |
3567 | return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, SPECRES) != 0; |
3568 | } |
3569 | |
3570 | static inline bool isar_feature_aa64_frint(const ARMISARegisters *id) |
3571 | { |
3572 | return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, FRINTTS) != 0; |
3573 | } |
3574 | |
3575 | static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id) |
3576 | { |
3577 | /* We always set the AdvSIMD and FP fields identically wrt FP16. */ |
3578 | return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1; |
3579 | } |
3580 | |
3581 | static inline bool isar_feature_aa64_aa32(const ARMISARegisters *id) |
3582 | { |
3583 | return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL0) >= 2; |
3584 | } |
3585 | |
3586 | static inline bool isar_feature_aa64_sve(const ARMISARegisters *id) |
3587 | { |
3588 | return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0; |
3589 | } |
3590 | |
3591 | static inline bool isar_feature_aa64_lor(const ARMISARegisters *id) |
3592 | { |
3593 | return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, LO) != 0; |
3594 | } |
3595 | |
3596 | static inline bool isar_feature_aa64_bti(const ARMISARegisters *id) |
3597 | { |
3598 | return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, BT) != 0; |
3599 | } |
3600 | |
3601 | /* |
3602 | * Forward to the above feature tests given an ARMCPU pointer. |
3603 | */ |
3604 | #define cpu_isar_feature(name, cpu) \ |
3605 | ({ ARMCPU *cpu_ = (cpu); isar_feature_##name(&cpu_->isar); }) |
3606 | |
3607 | #endif |
3608 | |