1/*
2 * ARM generic helpers.
3 *
4 * This code is licensed under the GNU GPL v2 or later.
5 *
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
8
9#include "qemu/osdep.h"
10#include "qemu/units.h"
11#include "target/arm/idau.h"
12#include "trace.h"
13#include "cpu.h"
14#include "internals.h"
15#include "exec/gdbstub.h"
16#include "exec/helper-proto.h"
17#include "qemu/host-utils.h"
18#include "qemu/main-loop.h"
19#include "qemu/bitops.h"
20#include "qemu/crc32c.h"
21#include "qemu/qemu-print.h"
22#include "exec/exec-all.h"
23#include <zlib.h> /* For crc32 */
24#include "hw/irq.h"
25#include "hw/semihosting/semihost.h"
26#include "sysemu/cpus.h"
27#include "sysemu/kvm.h"
28#include "qemu/range.h"
29#include "qapi/qapi-commands-machine-target.h"
30#include "qapi/error.h"
31#include "qemu/guest-random.h"
32#ifdef CONFIG_TCG
33#include "arm_ldst.h"
34#include "exec/cpu_ldst.h"
35#endif
36
37#define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
38
39#ifndef CONFIG_USER_ONLY
40
41static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
42 MMUAccessType access_type, ARMMMUIdx mmu_idx,
43 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
44 target_ulong *page_size_ptr,
45 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
46#endif
47
48static void switch_mode(CPUARMState *env, int mode);
49
50static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
51{
52 int nregs;
53
54 /* VFP data registers are always little-endian. */
55 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
56 if (reg < nregs) {
57 stq_le_p(buf, *aa32_vfp_dreg(env, reg));
58 return 8;
59 }
60 if (arm_feature(env, ARM_FEATURE_NEON)) {
61 /* Aliases for Q regs. */
62 nregs += 16;
63 if (reg < nregs) {
64 uint64_t *q = aa32_vfp_qreg(env, reg - 32);
65 stq_le_p(buf, q[0]);
66 stq_le_p(buf + 8, q[1]);
67 return 16;
68 }
69 }
70 switch (reg - nregs) {
71 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
72 case 1: stl_p(buf, vfp_get_fpscr(env)); return 4;
73 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
74 }
75 return 0;
76}
77
78static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
79{
80 int nregs;
81
82 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
83 if (reg < nregs) {
84 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf);
85 return 8;
86 }
87 if (arm_feature(env, ARM_FEATURE_NEON)) {
88 nregs += 16;
89 if (reg < nregs) {
90 uint64_t *q = aa32_vfp_qreg(env, reg - 32);
91 q[0] = ldq_le_p(buf);
92 q[1] = ldq_le_p(buf + 8);
93 return 16;
94 }
95 }
96 switch (reg - nregs) {
97 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
98 case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4;
99 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
100 }
101 return 0;
102}
103
104static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
105{
106 switch (reg) {
107 case 0 ... 31:
108 /* 128 bit FP register */
109 {
110 uint64_t *q = aa64_vfp_qreg(env, reg);
111 stq_le_p(buf, q[0]);
112 stq_le_p(buf + 8, q[1]);
113 return 16;
114 }
115 case 32:
116 /* FPSR */
117 stl_p(buf, vfp_get_fpsr(env));
118 return 4;
119 case 33:
120 /* FPCR */
121 stl_p(buf, vfp_get_fpcr(env));
122 return 4;
123 default:
124 return 0;
125 }
126}
127
128static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
129{
130 switch (reg) {
131 case 0 ... 31:
132 /* 128 bit FP register */
133 {
134 uint64_t *q = aa64_vfp_qreg(env, reg);
135 q[0] = ldq_le_p(buf);
136 q[1] = ldq_le_p(buf + 8);
137 return 16;
138 }
139 case 32:
140 /* FPSR */
141 vfp_set_fpsr(env, ldl_p(buf));
142 return 4;
143 case 33:
144 /* FPCR */
145 vfp_set_fpcr(env, ldl_p(buf));
146 return 4;
147 default:
148 return 0;
149 }
150}
151
152static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
153{
154 assert(ri->fieldoffset);
155 if (cpreg_field_is_64bit(ri)) {
156 return CPREG_FIELD64(env, ri);
157 } else {
158 return CPREG_FIELD32(env, ri);
159 }
160}
161
162static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
163 uint64_t value)
164{
165 assert(ri->fieldoffset);
166 if (cpreg_field_is_64bit(ri)) {
167 CPREG_FIELD64(env, ri) = value;
168 } else {
169 CPREG_FIELD32(env, ri) = value;
170 }
171}
172
173static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
174{
175 return (char *)env + ri->fieldoffset;
176}
177
178uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
179{
180 /* Raw read of a coprocessor register (as needed for migration, etc). */
181 if (ri->type & ARM_CP_CONST) {
182 return ri->resetvalue;
183 } else if (ri->raw_readfn) {
184 return ri->raw_readfn(env, ri);
185 } else if (ri->readfn) {
186 return ri->readfn(env, ri);
187 } else {
188 return raw_read(env, ri);
189 }
190}
191
192static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
193 uint64_t v)
194{
195 /* Raw write of a coprocessor register (as needed for migration, etc).
196 * Note that constant registers are treated as write-ignored; the
197 * caller should check for success by whether a readback gives the
198 * value written.
199 */
200 if (ri->type & ARM_CP_CONST) {
201 return;
202 } else if (ri->raw_writefn) {
203 ri->raw_writefn(env, ri, v);
204 } else if (ri->writefn) {
205 ri->writefn(env, ri, v);
206 } else {
207 raw_write(env, ri, v);
208 }
209}
210
211static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg)
212{
213 ARMCPU *cpu = env_archcpu(env);
214 const ARMCPRegInfo *ri;
215 uint32_t key;
216
217 key = cpu->dyn_xml.cpregs_keys[reg];
218 ri = get_arm_cp_reginfo(cpu->cp_regs, key);
219 if (ri) {
220 if (cpreg_field_is_64bit(ri)) {
221 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri));
222 } else {
223 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri));
224 }
225 }
226 return 0;
227}
228
229static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg)
230{
231 return 0;
232}
233
234static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
235{
236 /* Return true if the regdef would cause an assertion if you called
237 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
238 * program bug for it not to have the NO_RAW flag).
239 * NB that returning false here doesn't necessarily mean that calling
240 * read/write_raw_cp_reg() is safe, because we can't distinguish "has
241 * read/write access functions which are safe for raw use" from "has
242 * read/write access functions which have side effects but has forgotten
243 * to provide raw access functions".
244 * The tests here line up with the conditions in read/write_raw_cp_reg()
245 * and assertions in raw_read()/raw_write().
246 */
247 if ((ri->type & ARM_CP_CONST) ||
248 ri->fieldoffset ||
249 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
250 return false;
251 }
252 return true;
253}
254
255bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
256{
257 /* Write the coprocessor state from cpu->env to the (index,value) list. */
258 int i;
259 bool ok = true;
260
261 for (i = 0; i < cpu->cpreg_array_len; i++) {
262 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
263 const ARMCPRegInfo *ri;
264 uint64_t newval;
265
266 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
267 if (!ri) {
268 ok = false;
269 continue;
270 }
271 if (ri->type & ARM_CP_NO_RAW) {
272 continue;
273 }
274
275 newval = read_raw_cp_reg(&cpu->env, ri);
276 if (kvm_sync) {
277 /*
278 * Only sync if the previous list->cpustate sync succeeded.
279 * Rather than tracking the success/failure state for every
280 * item in the list, we just recheck "does the raw write we must
281 * have made in write_list_to_cpustate() read back OK" here.
282 */
283 uint64_t oldval = cpu->cpreg_values[i];
284
285 if (oldval == newval) {
286 continue;
287 }
288
289 write_raw_cp_reg(&cpu->env, ri, oldval);
290 if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
291 continue;
292 }
293
294 write_raw_cp_reg(&cpu->env, ri, newval);
295 }
296 cpu->cpreg_values[i] = newval;
297 }
298 return ok;
299}
300
301bool write_list_to_cpustate(ARMCPU *cpu)
302{
303 int i;
304 bool ok = true;
305
306 for (i = 0; i < cpu->cpreg_array_len; i++) {
307 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
308 uint64_t v = cpu->cpreg_values[i];
309 const ARMCPRegInfo *ri;
310
311 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
312 if (!ri) {
313 ok = false;
314 continue;
315 }
316 if (ri->type & ARM_CP_NO_RAW) {
317 continue;
318 }
319 /* Write value and confirm it reads back as written
320 * (to catch read-only registers and partially read-only
321 * registers where the incoming migration value doesn't match)
322 */
323 write_raw_cp_reg(&cpu->env, ri, v);
324 if (read_raw_cp_reg(&cpu->env, ri) != v) {
325 ok = false;
326 }
327 }
328 return ok;
329}
330
331static void add_cpreg_to_list(gpointer key, gpointer opaque)
332{
333 ARMCPU *cpu = opaque;
334 uint64_t regidx;
335 const ARMCPRegInfo *ri;
336
337 regidx = *(uint32_t *)key;
338 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
339
340 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
341 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
342 /* The value array need not be initialized at this point */
343 cpu->cpreg_array_len++;
344 }
345}
346
347static void count_cpreg(gpointer key, gpointer opaque)
348{
349 ARMCPU *cpu = opaque;
350 uint64_t regidx;
351 const ARMCPRegInfo *ri;
352
353 regidx = *(uint32_t *)key;
354 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
355
356 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
357 cpu->cpreg_array_len++;
358 }
359}
360
361static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
362{
363 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
364 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
365
366 if (aidx > bidx) {
367 return 1;
368 }
369 if (aidx < bidx) {
370 return -1;
371 }
372 return 0;
373}
374
375void init_cpreg_list(ARMCPU *cpu)
376{
377 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
378 * Note that we require cpreg_tuples[] to be sorted by key ID.
379 */
380 GList *keys;
381 int arraylen;
382
383 keys = g_hash_table_get_keys(cpu->cp_regs);
384 keys = g_list_sort(keys, cpreg_key_compare);
385
386 cpu->cpreg_array_len = 0;
387
388 g_list_foreach(keys, count_cpreg, cpu);
389
390 arraylen = cpu->cpreg_array_len;
391 cpu->cpreg_indexes = g_new(uint64_t, arraylen);
392 cpu->cpreg_values = g_new(uint64_t, arraylen);
393 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
394 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
395 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
396 cpu->cpreg_array_len = 0;
397
398 g_list_foreach(keys, add_cpreg_to_list, cpu);
399
400 assert(cpu->cpreg_array_len == arraylen);
401
402 g_list_free(keys);
403}
404
405/*
406 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but
407 * they are accessible when EL3 is using AArch64 regardless of EL3.NS.
408 *
409 * access_el3_aa32ns: Used to check AArch32 register views.
410 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views.
411 */
412static CPAccessResult access_el3_aa32ns(CPUARMState *env,
413 const ARMCPRegInfo *ri,
414 bool isread)
415{
416 bool secure = arm_is_secure_below_el3(env);
417
418 assert(!arm_el_is_aa64(env, 3));
419 if (secure) {
420 return CP_ACCESS_TRAP_UNCATEGORIZED;
421 }
422 return CP_ACCESS_OK;
423}
424
425static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env,
426 const ARMCPRegInfo *ri,
427 bool isread)
428{
429 if (!arm_el_is_aa64(env, 3)) {
430 return access_el3_aa32ns(env, ri, isread);
431 }
432 return CP_ACCESS_OK;
433}
434
435/* Some secure-only AArch32 registers trap to EL3 if used from
436 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).
437 * Note that an access from Secure EL1 can only happen if EL3 is AArch64.
438 * We assume that the .access field is set to PL1_RW.
439 */
440static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
441 const ARMCPRegInfo *ri,
442 bool isread)
443{
444 if (arm_current_el(env) == 3) {
445 return CP_ACCESS_OK;
446 }
447 if (arm_is_secure_below_el3(env)) {
448 return CP_ACCESS_TRAP_EL3;
449 }
450 /* This will be EL1 NS and EL2 NS, which just UNDEF */
451 return CP_ACCESS_TRAP_UNCATEGORIZED;
452}
453
454/* Check for traps to "powerdown debug" registers, which are controlled
455 * by MDCR.TDOSA
456 */
457static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
458 bool isread)
459{
460 int el = arm_current_el(env);
461 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) ||
462 (env->cp15.mdcr_el2 & MDCR_TDE) ||
463 (arm_hcr_el2_eff(env) & HCR_TGE);
464
465 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) {
466 return CP_ACCESS_TRAP_EL2;
467 }
468 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
469 return CP_ACCESS_TRAP_EL3;
470 }
471 return CP_ACCESS_OK;
472}
473
474/* Check for traps to "debug ROM" registers, which are controlled
475 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
476 */
477static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
478 bool isread)
479{
480 int el = arm_current_el(env);
481 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) ||
482 (env->cp15.mdcr_el2 & MDCR_TDE) ||
483 (arm_hcr_el2_eff(env) & HCR_TGE);
484
485 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) {
486 return CP_ACCESS_TRAP_EL2;
487 }
488 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
489 return CP_ACCESS_TRAP_EL3;
490 }
491 return CP_ACCESS_OK;
492}
493
494/* Check for traps to general debug registers, which are controlled
495 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
496 */
497static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
498 bool isread)
499{
500 int el = arm_current_el(env);
501 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) ||
502 (env->cp15.mdcr_el2 & MDCR_TDE) ||
503 (arm_hcr_el2_eff(env) & HCR_TGE);
504
505 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) {
506 return CP_ACCESS_TRAP_EL2;
507 }
508 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
509 return CP_ACCESS_TRAP_EL3;
510 }
511 return CP_ACCESS_OK;
512}
513
514/* Check for traps to performance monitor registers, which are controlled
515 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
516 */
517static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
518 bool isread)
519{
520 int el = arm_current_el(env);
521
522 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
523 && !arm_is_secure_below_el3(env)) {
524 return CP_ACCESS_TRAP_EL2;
525 }
526 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
527 return CP_ACCESS_TRAP_EL3;
528 }
529 return CP_ACCESS_OK;
530}
531
532static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
533{
534 ARMCPU *cpu = env_archcpu(env);
535
536 raw_write(env, ri, value);
537 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */
538}
539
540static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
541{
542 ARMCPU *cpu = env_archcpu(env);
543
544 if (raw_read(env, ri) != value) {
545 /* Unlike real hardware the qemu TLB uses virtual addresses,
546 * not modified virtual addresses, so this causes a TLB flush.
547 */
548 tlb_flush(CPU(cpu));
549 raw_write(env, ri, value);
550 }
551}
552
553static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
554 uint64_t value)
555{
556 ARMCPU *cpu = env_archcpu(env);
557
558 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
559 && !extended_addresses_enabled(env)) {
560 /* For VMSA (when not using the LPAE long descriptor page table
561 * format) this register includes the ASID, so do a TLB flush.
562 * For PMSA it is purely a process ID and no action is needed.
563 */
564 tlb_flush(CPU(cpu));
565 }
566 raw_write(env, ri, value);
567}
568
569/* IS variants of TLB operations must affect all cores */
570static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
571 uint64_t value)
572{
573 CPUState *cs = env_cpu(env);
574
575 tlb_flush_all_cpus_synced(cs);
576}
577
578static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
579 uint64_t value)
580{
581 CPUState *cs = env_cpu(env);
582
583 tlb_flush_all_cpus_synced(cs);
584}
585
586static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
587 uint64_t value)
588{
589 CPUState *cs = env_cpu(env);
590
591 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
592}
593
594static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
595 uint64_t value)
596{
597 CPUState *cs = env_cpu(env);
598
599 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
600}
601
602/*
603 * Non-IS variants of TLB operations are upgraded to
604 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to
605 * force broadcast of these operations.
606 */
607static bool tlb_force_broadcast(CPUARMState *env)
608{
609 return (env->cp15.hcr_el2 & HCR_FB) &&
610 arm_current_el(env) == 1 && arm_is_secure_below_el3(env);
611}
612
613static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
614 uint64_t value)
615{
616 /* Invalidate all (TLBIALL) */
617 ARMCPU *cpu = env_archcpu(env);
618
619 if (tlb_force_broadcast(env)) {
620 tlbiall_is_write(env, NULL, value);
621 return;
622 }
623
624 tlb_flush(CPU(cpu));
625}
626
627static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
628 uint64_t value)
629{
630 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
631 ARMCPU *cpu = env_archcpu(env);
632
633 if (tlb_force_broadcast(env)) {
634 tlbimva_is_write(env, NULL, value);
635 return;
636 }
637
638 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
639}
640
641static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
642 uint64_t value)
643{
644 /* Invalidate by ASID (TLBIASID) */
645 ARMCPU *cpu = env_archcpu(env);
646
647 if (tlb_force_broadcast(env)) {
648 tlbiasid_is_write(env, NULL, value);
649 return;
650 }
651
652 tlb_flush(CPU(cpu));
653}
654
655static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
656 uint64_t value)
657{
658 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
659 ARMCPU *cpu = env_archcpu(env);
660
661 if (tlb_force_broadcast(env)) {
662 tlbimvaa_is_write(env, NULL, value);
663 return;
664 }
665
666 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
667}
668
669static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
670 uint64_t value)
671{
672 CPUState *cs = env_cpu(env);
673
674 tlb_flush_by_mmuidx(cs,
675 ARMMMUIdxBit_S12NSE1 |
676 ARMMMUIdxBit_S12NSE0 |
677 ARMMMUIdxBit_S2NS);
678}
679
680static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
681 uint64_t value)
682{
683 CPUState *cs = env_cpu(env);
684
685 tlb_flush_by_mmuidx_all_cpus_synced(cs,
686 ARMMMUIdxBit_S12NSE1 |
687 ARMMMUIdxBit_S12NSE0 |
688 ARMMMUIdxBit_S2NS);
689}
690
691static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
692 uint64_t value)
693{
694 /* Invalidate by IPA. This has to invalidate any structures that
695 * contain only stage 2 translation information, but does not need
696 * to apply to structures that contain combined stage 1 and stage 2
697 * translation information.
698 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
699 */
700 CPUState *cs = env_cpu(env);
701 uint64_t pageaddr;
702
703 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
704 return;
705 }
706
707 pageaddr = sextract64(value << 12, 0, 40);
708
709 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
710}
711
712static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
713 uint64_t value)
714{
715 CPUState *cs = env_cpu(env);
716 uint64_t pageaddr;
717
718 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
719 return;
720 }
721
722 pageaddr = sextract64(value << 12, 0, 40);
723
724 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
725 ARMMMUIdxBit_S2NS);
726}
727
728static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
729 uint64_t value)
730{
731 CPUState *cs = env_cpu(env);
732
733 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
734}
735
736static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
737 uint64_t value)
738{
739 CPUState *cs = env_cpu(env);
740
741 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
742}
743
744static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
745 uint64_t value)
746{
747 CPUState *cs = env_cpu(env);
748 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
749
750 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
751}
752
753static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
754 uint64_t value)
755{
756 CPUState *cs = env_cpu(env);
757 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
758
759 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
760 ARMMMUIdxBit_S1E2);
761}
762
763static const ARMCPRegInfo cp_reginfo[] = {
764 /* Define the secure and non-secure FCSE identifier CP registers
765 * separately because there is no secure bank in V8 (no _EL3). This allows
766 * the secure register to be properly reset and migrated. There is also no
767 * v8 EL1 version of the register so the non-secure instance stands alone.
768 */
769 { .name = "FCSEIDR",
770 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
771 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
772 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
773 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
774 { .name = "FCSEIDR_S",
775 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
776 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
777 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
778 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
779 /* Define the secure and non-secure context identifier CP registers
780 * separately because there is no secure bank in V8 (no _EL3). This allows
781 * the secure register to be properly reset and migrated. In the
782 * non-secure case, the 32-bit register will have reset and migration
783 * disabled during registration as it is handled by the 64-bit instance.
784 */
785 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
786 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
787 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
788 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
789 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
790 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32,
791 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
792 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
793 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
794 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
795 REGINFO_SENTINEL
796};
797
798static const ARMCPRegInfo not_v8_cp_reginfo[] = {
799 /* NB: Some of these registers exist in v8 but with more precise
800 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
801 */
802 /* MMU Domain access control / MPU write buffer control */
803 { .name = "DACR",
804 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
805 .access = PL1_RW, .resetvalue = 0,
806 .writefn = dacr_write, .raw_writefn = raw_write,
807 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
808 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
809 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
810 * For v6 and v5, these mappings are overly broad.
811 */
812 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
813 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
814 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
815 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
816 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
817 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
818 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
819 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
820 /* Cache maintenance ops; some of this space may be overridden later. */
821 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
822 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
823 .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
824 REGINFO_SENTINEL
825};
826
827static const ARMCPRegInfo not_v6_cp_reginfo[] = {
828 /* Not all pre-v6 cores implemented this WFI, so this is slightly
829 * over-broad.
830 */
831 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
832 .access = PL1_W, .type = ARM_CP_WFI },
833 REGINFO_SENTINEL
834};
835
836static const ARMCPRegInfo not_v7_cp_reginfo[] = {
837 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
838 * is UNPREDICTABLE; we choose to NOP as most implementations do).
839 */
840 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
841 .access = PL1_W, .type = ARM_CP_WFI },
842 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
843 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
844 * OMAPCP will override this space.
845 */
846 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
847 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
848 .resetvalue = 0 },
849 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
850 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
851 .resetvalue = 0 },
852 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
853 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
854 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
855 .resetvalue = 0 },
856 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
857 * implementing it as RAZ means the "debug architecture version" bits
858 * will read as a reserved value, which should cause Linux to not try
859 * to use the debug hardware.
860 */
861 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
862 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
863 /* MMU TLB control. Note that the wildcarding means we cover not just
864 * the unified TLB ops but also the dside/iside/inner-shareable variants.
865 */
866 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
867 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
868 .type = ARM_CP_NO_RAW },
869 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
870 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
871 .type = ARM_CP_NO_RAW },
872 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
873 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
874 .type = ARM_CP_NO_RAW },
875 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
876 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
877 .type = ARM_CP_NO_RAW },
878 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
879 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
880 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
881 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
882 REGINFO_SENTINEL
883};
884
885static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
886 uint64_t value)
887{
888 uint32_t mask = 0;
889
890 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
891 if (!arm_feature(env, ARM_FEATURE_V8)) {
892 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
893 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
894 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
895 */
896 if (arm_feature(env, ARM_FEATURE_VFP)) {
897 /* VFP coprocessor: cp10 & cp11 [23:20] */
898 mask |= (1 << 31) | (1 << 30) | (0xf << 20);
899
900 if (!arm_feature(env, ARM_FEATURE_NEON)) {
901 /* ASEDIS [31] bit is RAO/WI */
902 value |= (1 << 31);
903 }
904
905 /* VFPv3 and upwards with NEON implement 32 double precision
906 * registers (D0-D31).
907 */
908 if (!arm_feature(env, ARM_FEATURE_NEON) ||
909 !arm_feature(env, ARM_FEATURE_VFP3)) {
910 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
911 value |= (1 << 30);
912 }
913 }
914 value &= mask;
915 }
916
917 /*
918 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
919 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
920 */
921 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
922 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
923 value &= ~(0xf << 20);
924 value |= env->cp15.cpacr_el1 & (0xf << 20);
925 }
926
927 env->cp15.cpacr_el1 = value;
928}
929
930static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri)
931{
932 /*
933 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
934 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
935 */
936 uint64_t value = env->cp15.cpacr_el1;
937
938 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
939 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
940 value &= ~(0xf << 20);
941 }
942 return value;
943}
944
945
946static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
947{
948 /* Call cpacr_write() so that we reset with the correct RAO bits set
949 * for our CPU features.
950 */
951 cpacr_write(env, ri, 0);
952}
953
954static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
955 bool isread)
956{
957 if (arm_feature(env, ARM_FEATURE_V8)) {
958 /* Check if CPACR accesses are to be trapped to EL2 */
959 if (arm_current_el(env) == 1 &&
960 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
961 return CP_ACCESS_TRAP_EL2;
962 /* Check if CPACR accesses are to be trapped to EL3 */
963 } else if (arm_current_el(env) < 3 &&
964 (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
965 return CP_ACCESS_TRAP_EL3;
966 }
967 }
968
969 return CP_ACCESS_OK;
970}
971
972static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri,
973 bool isread)
974{
975 /* Check if CPTR accesses are set to trap to EL3 */
976 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
977 return CP_ACCESS_TRAP_EL3;
978 }
979
980 return CP_ACCESS_OK;
981}
982
983static const ARMCPRegInfo v6_cp_reginfo[] = {
984 /* prefetch by MVA in v6, NOP in v7 */
985 { .name = "MVA_prefetch",
986 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
987 .access = PL1_W, .type = ARM_CP_NOP },
988 /* We need to break the TB after ISB to execute self-modifying code
989 * correctly and also to take any pending interrupts immediately.
990 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag.
991 */
992 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
993 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore },
994 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
995 .access = PL0_W, .type = ARM_CP_NOP },
996 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
997 .access = PL0_W, .type = ARM_CP_NOP },
998 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
999 .access = PL1_RW,
1000 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
1001 offsetof(CPUARMState, cp15.ifar_ns) },
1002 .resetvalue = 0, },
1003 /* Watchpoint Fault Address Register : should actually only be present
1004 * for 1136, 1176, 11MPCore.
1005 */
1006 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
1007 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
1008 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
1009 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
1010 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
1011 .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
1012 REGINFO_SENTINEL
1013};
1014
1015/* Definitions for the PMU registers */
1016#define PMCRN_MASK 0xf800
1017#define PMCRN_SHIFT 11
1018#define PMCRLC 0x40
1019#define PMCRDP 0x10
1020#define PMCRD 0x8
1021#define PMCRC 0x4
1022#define PMCRP 0x2
1023#define PMCRE 0x1
1024
1025#define PMXEVTYPER_P 0x80000000
1026#define PMXEVTYPER_U 0x40000000
1027#define PMXEVTYPER_NSK 0x20000000
1028#define PMXEVTYPER_NSU 0x10000000
1029#define PMXEVTYPER_NSH 0x08000000
1030#define PMXEVTYPER_M 0x04000000
1031#define PMXEVTYPER_MT 0x02000000
1032#define PMXEVTYPER_EVTCOUNT 0x0000ffff
1033#define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \
1034 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \
1035 PMXEVTYPER_M | PMXEVTYPER_MT | \
1036 PMXEVTYPER_EVTCOUNT)
1037
1038#define PMCCFILTR 0xf8000000
1039#define PMCCFILTR_M PMXEVTYPER_M
1040#define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M)
1041
1042static inline uint32_t pmu_num_counters(CPUARMState *env)
1043{
1044 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
1045}
1046
1047/* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
1048static inline uint64_t pmu_counter_mask(CPUARMState *env)
1049{
1050 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
1051}
1052
1053typedef struct pm_event {
1054 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */
1055 /* If the event is supported on this CPU (used to generate PMCEID[01]) */
1056 bool (*supported)(CPUARMState *);
1057 /*
1058 * Retrieve the current count of the underlying event. The programmed
1059 * counters hold a difference from the return value from this function
1060 */
1061 uint64_t (*get_count)(CPUARMState *);
1062 /*
1063 * Return how many nanoseconds it will take (at a minimum) for count events
1064 * to occur. A negative value indicates the counter will never overflow, or
1065 * that the counter has otherwise arranged for the overflow bit to be set
1066 * and the PMU interrupt to be raised on overflow.
1067 */
1068 int64_t (*ns_per_count)(uint64_t);
1069} pm_event;
1070
1071static bool event_always_supported(CPUARMState *env)
1072{
1073 return true;
1074}
1075
1076static uint64_t swinc_get_count(CPUARMState *env)
1077{
1078 /*
1079 * SW_INCR events are written directly to the pmevcntr's by writes to
1080 * PMSWINC, so there is no underlying count maintained by the PMU itself
1081 */
1082 return 0;
1083}
1084
1085static int64_t swinc_ns_per(uint64_t ignored)
1086{
1087 return -1;
1088}
1089
1090/*
1091 * Return the underlying cycle count for the PMU cycle counters. If we're in
1092 * usermode, simply return 0.
1093 */
1094static uint64_t cycles_get_count(CPUARMState *env)
1095{
1096#ifndef CONFIG_USER_ONLY
1097 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
1098 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
1099#else
1100 return cpu_get_host_ticks();
1101#endif
1102}
1103
1104#ifndef CONFIG_USER_ONLY
1105static int64_t cycles_ns_per(uint64_t cycles)
1106{
1107 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles;
1108}
1109
1110static bool instructions_supported(CPUARMState *env)
1111{
1112 return use_icount == 1 /* Precise instruction counting */;
1113}
1114
1115static uint64_t instructions_get_count(CPUARMState *env)
1116{
1117 return (uint64_t)cpu_get_icount_raw();
1118}
1119
1120static int64_t instructions_ns_per(uint64_t icount)
1121{
1122 return cpu_icount_to_ns((int64_t)icount);
1123}
1124#endif
1125
1126static const pm_event pm_events[] = {
1127 { .number = 0x000, /* SW_INCR */
1128 .supported = event_always_supported,
1129 .get_count = swinc_get_count,
1130 .ns_per_count = swinc_ns_per,
1131 },
1132#ifndef CONFIG_USER_ONLY
1133 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */
1134 .supported = instructions_supported,
1135 .get_count = instructions_get_count,
1136 .ns_per_count = instructions_ns_per,
1137 },
1138 { .number = 0x011, /* CPU_CYCLES, Cycle */
1139 .supported = event_always_supported,
1140 .get_count = cycles_get_count,
1141 .ns_per_count = cycles_ns_per,
1142 }
1143#endif
1144};
1145
1146/*
1147 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of
1148 * events (i.e. the statistical profiling extension), this implementation
1149 * should first be updated to something sparse instead of the current
1150 * supported_event_map[] array.
1151 */
1152#define MAX_EVENT_ID 0x11
1153#define UNSUPPORTED_EVENT UINT16_MAX
1154static uint16_t supported_event_map[MAX_EVENT_ID + 1];
1155
1156/*
1157 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map
1158 * of ARM event numbers to indices in our pm_events array.
1159 *
1160 * Note: Events in the 0x40XX range are not currently supported.
1161 */
1162void pmu_init(ARMCPU *cpu)
1163{
1164 unsigned int i;
1165
1166 /*
1167 * Empty supported_event_map and cpu->pmceid[01] before adding supported
1168 * events to them
1169 */
1170 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) {
1171 supported_event_map[i] = UNSUPPORTED_EVENT;
1172 }
1173 cpu->pmceid0 = 0;
1174 cpu->pmceid1 = 0;
1175
1176 for (i = 0; i < ARRAY_SIZE(pm_events); i++) {
1177 const pm_event *cnt = &pm_events[i];
1178 assert(cnt->number <= MAX_EVENT_ID);
1179 /* We do not currently support events in the 0x40xx range */
1180 assert(cnt->number <= 0x3f);
1181
1182 if (cnt->supported(&cpu->env)) {
1183 supported_event_map[cnt->number] = i;
1184 uint64_t event_mask = 1ULL << (cnt->number & 0x1f);
1185 if (cnt->number & 0x20) {
1186 cpu->pmceid1 |= event_mask;
1187 } else {
1188 cpu->pmceid0 |= event_mask;
1189 }
1190 }
1191 }
1192}
1193
1194/*
1195 * Check at runtime whether a PMU event is supported for the current machine
1196 */
1197static bool event_supported(uint16_t number)
1198{
1199 if (number > MAX_EVENT_ID) {
1200 return false;
1201 }
1202 return supported_event_map[number] != UNSUPPORTED_EVENT;
1203}
1204
1205static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
1206 bool isread)
1207{
1208 /* Performance monitor registers user accessibility is controlled
1209 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
1210 * trapping to EL2 or EL3 for other accesses.
1211 */
1212 int el = arm_current_el(env);
1213
1214 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
1215 return CP_ACCESS_TRAP;
1216 }
1217 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
1218 && !arm_is_secure_below_el3(env)) {
1219 return CP_ACCESS_TRAP_EL2;
1220 }
1221 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
1222 return CP_ACCESS_TRAP_EL3;
1223 }
1224
1225 return CP_ACCESS_OK;
1226}
1227
1228static CPAccessResult pmreg_access_xevcntr(CPUARMState *env,
1229 const ARMCPRegInfo *ri,
1230 bool isread)
1231{
1232 /* ER: event counter read trap control */
1233 if (arm_feature(env, ARM_FEATURE_V8)
1234 && arm_current_el(env) == 0
1235 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0
1236 && isread) {
1237 return CP_ACCESS_OK;
1238 }
1239
1240 return pmreg_access(env, ri, isread);
1241}
1242
1243static CPAccessResult pmreg_access_swinc(CPUARMState *env,
1244 const ARMCPRegInfo *ri,
1245 bool isread)
1246{
1247 /* SW: software increment write trap control */
1248 if (arm_feature(env, ARM_FEATURE_V8)
1249 && arm_current_el(env) == 0
1250 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0
1251 && !isread) {
1252 return CP_ACCESS_OK;
1253 }
1254
1255 return pmreg_access(env, ri, isread);
1256}
1257
1258static CPAccessResult pmreg_access_selr(CPUARMState *env,
1259 const ARMCPRegInfo *ri,
1260 bool isread)
1261{
1262 /* ER: event counter read trap control */
1263 if (arm_feature(env, ARM_FEATURE_V8)
1264 && arm_current_el(env) == 0
1265 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) {
1266 return CP_ACCESS_OK;
1267 }
1268
1269 return pmreg_access(env, ri, isread);
1270}
1271
1272static CPAccessResult pmreg_access_ccntr(CPUARMState *env,
1273 const ARMCPRegInfo *ri,
1274 bool isread)
1275{
1276 /* CR: cycle counter read trap control */
1277 if (arm_feature(env, ARM_FEATURE_V8)
1278 && arm_current_el(env) == 0
1279 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0
1280 && isread) {
1281 return CP_ACCESS_OK;
1282 }
1283
1284 return pmreg_access(env, ri, isread);
1285}
1286
1287/* Returns true if the counter (pass 31 for PMCCNTR) should count events using
1288 * the current EL, security state, and register configuration.
1289 */
1290static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
1291{
1292 uint64_t filter;
1293 bool e, p, u, nsk, nsu, nsh, m;
1294 bool enabled, prohibited, filtered;
1295 bool secure = arm_is_secure(env);
1296 int el = arm_current_el(env);
1297 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
1298
1299 if (!arm_feature(env, ARM_FEATURE_PMU)) {
1300 return false;
1301 }
1302
1303 if (!arm_feature(env, ARM_FEATURE_EL2) ||
1304 (counter < hpmn || counter == 31)) {
1305 e = env->cp15.c9_pmcr & PMCRE;
1306 } else {
1307 e = env->cp15.mdcr_el2 & MDCR_HPME;
1308 }
1309 enabled = e && (env->cp15.c9_pmcnten & (1 << counter));
1310
1311 if (!secure) {
1312 if (el == 2 && (counter < hpmn || counter == 31)) {
1313 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD;
1314 } else {
1315 prohibited = false;
1316 }
1317 } else {
1318 prohibited = arm_feature(env, ARM_FEATURE_EL3) &&
1319 (env->cp15.mdcr_el3 & MDCR_SPME);
1320 }
1321
1322 if (prohibited && counter == 31) {
1323 prohibited = env->cp15.c9_pmcr & PMCRDP;
1324 }
1325
1326 if (counter == 31) {
1327 filter = env->cp15.pmccfiltr_el0;
1328 } else {
1329 filter = env->cp15.c14_pmevtyper[counter];
1330 }
1331
1332 p = filter & PMXEVTYPER_P;
1333 u = filter & PMXEVTYPER_U;
1334 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK);
1335 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU);
1336 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH);
1337 m = arm_el_is_aa64(env, 1) &&
1338 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M);
1339
1340 if (el == 0) {
1341 filtered = secure ? u : u != nsu;
1342 } else if (el == 1) {
1343 filtered = secure ? p : p != nsk;
1344 } else if (el == 2) {
1345 filtered = !nsh;
1346 } else { /* EL3 */
1347 filtered = m != p;
1348 }
1349
1350 if (counter != 31) {
1351 /*
1352 * If not checking PMCCNTR, ensure the counter is setup to an event we
1353 * support
1354 */
1355 uint16_t event = filter & PMXEVTYPER_EVTCOUNT;
1356 if (!event_supported(event)) {
1357 return false;
1358 }
1359 }
1360
1361 return enabled && !prohibited && !filtered;
1362}
1363
1364static void pmu_update_irq(CPUARMState *env)
1365{
1366 ARMCPU *cpu = env_archcpu(env);
1367 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) &&
1368 (env->cp15.c9_pminten & env->cp15.c9_pmovsr));
1369}
1370
1371/*
1372 * Ensure c15_ccnt is the guest-visible count so that operations such as
1373 * enabling/disabling the counter or filtering, modifying the count itself,
1374 * etc. can be done logically. This is essentially a no-op if the counter is
1375 * not enabled at the time of the call.
1376 */
1377static void pmccntr_op_start(CPUARMState *env)
1378{
1379 uint64_t cycles = cycles_get_count(env);
1380
1381 if (pmu_counter_enabled(env, 31)) {
1382 uint64_t eff_cycles = cycles;
1383 if (env->cp15.c9_pmcr & PMCRD) {
1384 /* Increment once every 64 processor clock cycles */
1385 eff_cycles /= 64;
1386 }
1387
1388 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta;
1389
1390 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \
1391 1ull << 63 : 1ull << 31;
1392 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) {
1393 env->cp15.c9_pmovsr |= (1 << 31);
1394 pmu_update_irq(env);
1395 }
1396
1397 env->cp15.c15_ccnt = new_pmccntr;
1398 }
1399 env->cp15.c15_ccnt_delta = cycles;
1400}
1401
1402/*
1403 * If PMCCNTR is enabled, recalculate the delta between the clock and the
1404 * guest-visible count. A call to pmccntr_op_finish should follow every call to
1405 * pmccntr_op_start.
1406 */
1407static void pmccntr_op_finish(CPUARMState *env)
1408{
1409 if (pmu_counter_enabled(env, 31)) {
1410#ifndef CONFIG_USER_ONLY
1411 /* Calculate when the counter will next overflow */
1412 uint64_t remaining_cycles = -env->cp15.c15_ccnt;
1413 if (!(env->cp15.c9_pmcr & PMCRLC)) {
1414 remaining_cycles = (uint32_t)remaining_cycles;
1415 }
1416 int64_t overflow_in = cycles_ns_per(remaining_cycles);
1417
1418 if (overflow_in > 0) {
1419 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
1420 overflow_in;
1421 ARMCPU *cpu = env_archcpu(env);
1422 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
1423 }
1424#endif
1425
1426 uint64_t prev_cycles = env->cp15.c15_ccnt_delta;
1427 if (env->cp15.c9_pmcr & PMCRD) {
1428 /* Increment once every 64 processor clock cycles */
1429 prev_cycles /= 64;
1430 }
1431 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt;
1432 }
1433}
1434
1435static void pmevcntr_op_start(CPUARMState *env, uint8_t counter)
1436{
1437
1438 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
1439 uint64_t count = 0;
1440 if (event_supported(event)) {
1441 uint16_t event_idx = supported_event_map[event];
1442 count = pm_events[event_idx].get_count(env);
1443 }
1444
1445 if (pmu_counter_enabled(env, counter)) {
1446 uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter];
1447
1448 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) {
1449 env->cp15.c9_pmovsr |= (1 << counter);
1450 pmu_update_irq(env);
1451 }
1452 env->cp15.c14_pmevcntr[counter] = new_pmevcntr;
1453 }
1454 env->cp15.c14_pmevcntr_delta[counter] = count;
1455}
1456
1457static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter)
1458{
1459 if (pmu_counter_enabled(env, counter)) {
1460#ifndef CONFIG_USER_ONLY
1461 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
1462 uint16_t event_idx = supported_event_map[event];
1463 uint64_t delta = UINT32_MAX -
1464 (uint32_t)env->cp15.c14_pmevcntr[counter] + 1;
1465 int64_t overflow_in = pm_events[event_idx].ns_per_count(delta);
1466
1467 if (overflow_in > 0) {
1468 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
1469 overflow_in;
1470 ARMCPU *cpu = env_archcpu(env);
1471 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
1472 }
1473#endif
1474
1475 env->cp15.c14_pmevcntr_delta[counter] -=
1476 env->cp15.c14_pmevcntr[counter];
1477 }
1478}
1479
1480void pmu_op_start(CPUARMState *env)
1481{
1482 unsigned int i;
1483 pmccntr_op_start(env);
1484 for (i = 0; i < pmu_num_counters(env); i++) {
1485 pmevcntr_op_start(env, i);
1486 }
1487}
1488
1489void pmu_op_finish(CPUARMState *env)
1490{
1491 unsigned int i;
1492 pmccntr_op_finish(env);
1493 for (i = 0; i < pmu_num_counters(env); i++) {
1494 pmevcntr_op_finish(env, i);
1495 }
1496}
1497
1498void pmu_pre_el_change(ARMCPU *cpu, void *ignored)
1499{
1500 pmu_op_start(&cpu->env);
1501}
1502
1503void pmu_post_el_change(ARMCPU *cpu, void *ignored)
1504{
1505 pmu_op_finish(&cpu->env);
1506}
1507
1508void arm_pmu_timer_cb(void *opaque)
1509{
1510 ARMCPU *cpu = opaque;
1511
1512 /*
1513 * Update all the counter values based on the current underlying counts,
1514 * triggering interrupts to be raised, if necessary. pmu_op_finish() also
1515 * has the effect of setting the cpu->pmu_timer to the next earliest time a
1516 * counter may expire.
1517 */
1518 pmu_op_start(&cpu->env);
1519 pmu_op_finish(&cpu->env);
1520}
1521
1522static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1523 uint64_t value)
1524{
1525 pmu_op_start(env);
1526
1527 if (value & PMCRC) {
1528 /* The counter has been reset */
1529 env->cp15.c15_ccnt = 0;
1530 }
1531
1532 if (value & PMCRP) {
1533 unsigned int i;
1534 for (i = 0; i < pmu_num_counters(env); i++) {
1535 env->cp15.c14_pmevcntr[i] = 0;
1536 }
1537 }
1538
1539 /* only the DP, X, D and E bits are writable */
1540 env->cp15.c9_pmcr &= ~0x39;
1541 env->cp15.c9_pmcr |= (value & 0x39);
1542
1543 pmu_op_finish(env);
1544}
1545
1546static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri,
1547 uint64_t value)
1548{
1549 unsigned int i;
1550 for (i = 0; i < pmu_num_counters(env); i++) {
1551 /* Increment a counter's count iff: */
1552 if ((value & (1 << i)) && /* counter's bit is set */
1553 /* counter is enabled and not filtered */
1554 pmu_counter_enabled(env, i) &&
1555 /* counter is SW_INCR */
1556 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) {
1557 pmevcntr_op_start(env, i);
1558
1559 /*
1560 * Detect if this write causes an overflow since we can't predict
1561 * PMSWINC overflows like we can for other events
1562 */
1563 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1;
1564
1565 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) {
1566 env->cp15.c9_pmovsr |= (1 << i);
1567 pmu_update_irq(env);
1568 }
1569
1570 env->cp15.c14_pmevcntr[i] = new_pmswinc;
1571
1572 pmevcntr_op_finish(env, i);
1573 }
1574 }
1575}
1576
1577static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1578{
1579 uint64_t ret;
1580 pmccntr_op_start(env);
1581 ret = env->cp15.c15_ccnt;
1582 pmccntr_op_finish(env);
1583 return ret;
1584}
1585
1586static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1587 uint64_t value)
1588{
1589 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
1590 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
1591 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
1592 * accessed.
1593 */
1594 env->cp15.c9_pmselr = value & 0x1f;
1595}
1596
1597static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1598 uint64_t value)
1599{
1600 pmccntr_op_start(env);
1601 env->cp15.c15_ccnt = value;
1602 pmccntr_op_finish(env);
1603}
1604
1605static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
1606 uint64_t value)
1607{
1608 uint64_t cur_val = pmccntr_read(env, NULL);
1609
1610 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
1611}
1612
1613static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1614 uint64_t value)
1615{
1616 pmccntr_op_start(env);
1617 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0;
1618 pmccntr_op_finish(env);
1619}
1620
1621static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri,
1622 uint64_t value)
1623{
1624 pmccntr_op_start(env);
1625 /* M is not accessible from AArch32 */
1626 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) |
1627 (value & PMCCFILTR);
1628 pmccntr_op_finish(env);
1629}
1630
1631static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri)
1632{
1633 /* M is not visible in AArch32 */
1634 return env->cp15.pmccfiltr_el0 & PMCCFILTR;
1635}
1636
1637static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1638 uint64_t value)
1639{
1640 value &= pmu_counter_mask(env);
1641 env->cp15.c9_pmcnten |= value;
1642}
1643
1644static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1645 uint64_t value)
1646{
1647 value &= pmu_counter_mask(env);
1648 env->cp15.c9_pmcnten &= ~value;
1649}
1650
1651static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1652 uint64_t value)
1653{
1654 value &= pmu_counter_mask(env);
1655 env->cp15.c9_pmovsr &= ~value;
1656 pmu_update_irq(env);
1657}
1658
1659static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1660 uint64_t value)
1661{
1662 value &= pmu_counter_mask(env);
1663 env->cp15.c9_pmovsr |= value;
1664 pmu_update_irq(env);
1665}
1666
1667static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1668 uint64_t value, const uint8_t counter)
1669{
1670 if (counter == 31) {
1671 pmccfiltr_write(env, ri, value);
1672 } else if (counter < pmu_num_counters(env)) {
1673 pmevcntr_op_start(env, counter);
1674
1675 /*
1676 * If this counter's event type is changing, store the current
1677 * underlying count for the new type in c14_pmevcntr_delta[counter] so
1678 * pmevcntr_op_finish has the correct baseline when it converts back to
1679 * a delta.
1680 */
1681 uint16_t old_event = env->cp15.c14_pmevtyper[counter] &
1682 PMXEVTYPER_EVTCOUNT;
1683 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT;
1684 if (old_event != new_event) {
1685 uint64_t count = 0;
1686 if (event_supported(new_event)) {
1687 uint16_t event_idx = supported_event_map[new_event];
1688 count = pm_events[event_idx].get_count(env);
1689 }
1690 env->cp15.c14_pmevcntr_delta[counter] = count;
1691 }
1692
1693 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK;
1694 pmevcntr_op_finish(env, counter);
1695 }
1696 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
1697 * PMSELR value is equal to or greater than the number of implemented
1698 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
1699 */
1700}
1701
1702static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri,
1703 const uint8_t counter)
1704{
1705 if (counter == 31) {
1706 return env->cp15.pmccfiltr_el0;
1707 } else if (counter < pmu_num_counters(env)) {
1708 return env->cp15.c14_pmevtyper[counter];
1709 } else {
1710 /*
1711 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
1712 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write().
1713 */
1714 return 0;
1715 }
1716}
1717
1718static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
1719 uint64_t value)
1720{
1721 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1722 pmevtyper_write(env, ri, value, counter);
1723}
1724
1725static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
1726 uint64_t value)
1727{
1728 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1729 env->cp15.c14_pmevtyper[counter] = value;
1730
1731 /*
1732 * pmevtyper_rawwrite is called between a pair of pmu_op_start and
1733 * pmu_op_finish calls when loading saved state for a migration. Because
1734 * we're potentially updating the type of event here, the value written to
1735 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a
1736 * different counter type. Therefore, we need to set this value to the
1737 * current count for the counter type we're writing so that pmu_op_finish
1738 * has the correct count for its calculation.
1739 */
1740 uint16_t event = value & PMXEVTYPER_EVTCOUNT;
1741 if (event_supported(event)) {
1742 uint16_t event_idx = supported_event_map[event];
1743 env->cp15.c14_pmevcntr_delta[counter] =
1744 pm_events[event_idx].get_count(env);
1745 }
1746}
1747
1748static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
1749{
1750 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1751 return pmevtyper_read(env, ri, counter);
1752}
1753
1754static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1755 uint64_t value)
1756{
1757 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31);
1758}
1759
1760static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
1761{
1762 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31);
1763}
1764
1765static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1766 uint64_t value, uint8_t counter)
1767{
1768 if (counter < pmu_num_counters(env)) {
1769 pmevcntr_op_start(env, counter);
1770 env->cp15.c14_pmevcntr[counter] = value;
1771 pmevcntr_op_finish(env, counter);
1772 }
1773 /*
1774 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
1775 * are CONSTRAINED UNPREDICTABLE.
1776 */
1777}
1778
1779static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri,
1780 uint8_t counter)
1781{
1782 if (counter < pmu_num_counters(env)) {
1783 uint64_t ret;
1784 pmevcntr_op_start(env, counter);
1785 ret = env->cp15.c14_pmevcntr[counter];
1786 pmevcntr_op_finish(env, counter);
1787 return ret;
1788 } else {
1789 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
1790 * are CONSTRAINED UNPREDICTABLE. */
1791 return 0;
1792 }
1793}
1794
1795static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
1796 uint64_t value)
1797{
1798 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1799 pmevcntr_write(env, ri, value, counter);
1800}
1801
1802static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
1803{
1804 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1805 return pmevcntr_read(env, ri, counter);
1806}
1807
1808static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
1809 uint64_t value)
1810{
1811 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1812 assert(counter < pmu_num_counters(env));
1813 env->cp15.c14_pmevcntr[counter] = value;
1814 pmevcntr_write(env, ri, value, counter);
1815}
1816
1817static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri)
1818{
1819 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1820 assert(counter < pmu_num_counters(env));
1821 return env->cp15.c14_pmevcntr[counter];
1822}
1823
1824static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1825 uint64_t value)
1826{
1827 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31);
1828}
1829
1830static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1831{
1832 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31);
1833}
1834
1835static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1836 uint64_t value)
1837{
1838 if (arm_feature(env, ARM_FEATURE_V8)) {
1839 env->cp15.c9_pmuserenr = value & 0xf;
1840 } else {
1841 env->cp15.c9_pmuserenr = value & 1;
1842 }
1843}
1844
1845static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1846 uint64_t value)
1847{
1848 /* We have no event counters so only the C bit can be changed */
1849 value &= pmu_counter_mask(env);
1850 env->cp15.c9_pminten |= value;
1851 pmu_update_irq(env);
1852}
1853
1854static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1855 uint64_t value)
1856{
1857 value &= pmu_counter_mask(env);
1858 env->cp15.c9_pminten &= ~value;
1859 pmu_update_irq(env);
1860}
1861
1862static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
1863 uint64_t value)
1864{
1865 /* Note that even though the AArch64 view of this register has bits
1866 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
1867 * architectural requirements for bits which are RES0 only in some
1868 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
1869 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
1870 */
1871 raw_write(env, ri, value & ~0x1FULL);
1872}
1873
1874static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1875{
1876 /* Begin with base v8.0 state. */
1877 uint32_t valid_mask = 0x3fff;
1878 ARMCPU *cpu = env_archcpu(env);
1879
1880 if (arm_el_is_aa64(env, 3)) {
1881 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */
1882 valid_mask &= ~SCR_NET;
1883 } else {
1884 valid_mask &= ~(SCR_RW | SCR_ST);
1885 }
1886
1887 if (!arm_feature(env, ARM_FEATURE_EL2)) {
1888 valid_mask &= ~SCR_HCE;
1889
1890 /* On ARMv7, SMD (or SCD as it is called in v7) is only
1891 * supported if EL2 exists. The bit is UNK/SBZP when
1892 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
1893 * when EL2 is unavailable.
1894 * On ARMv8, this bit is always available.
1895 */
1896 if (arm_feature(env, ARM_FEATURE_V7) &&
1897 !arm_feature(env, ARM_FEATURE_V8)) {
1898 valid_mask &= ~SCR_SMD;
1899 }
1900 }
1901 if (cpu_isar_feature(aa64_lor, cpu)) {
1902 valid_mask |= SCR_TLOR;
1903 }
1904 if (cpu_isar_feature(aa64_pauth, cpu)) {
1905 valid_mask |= SCR_API | SCR_APK;
1906 }
1907
1908 /* Clear all-context RES0 bits. */
1909 value &= valid_mask;
1910 raw_write(env, ri, value);
1911}
1912
1913static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1914{
1915 ARMCPU *cpu = env_archcpu(env);
1916
1917 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR
1918 * bank
1919 */
1920 uint32_t index = A32_BANKED_REG_GET(env, csselr,
1921 ri->secure & ARM_CP_SECSTATE_S);
1922
1923 return cpu->ccsidr[index];
1924}
1925
1926static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1927 uint64_t value)
1928{
1929 raw_write(env, ri, value & 0xf);
1930}
1931
1932static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1933{
1934 CPUState *cs = env_cpu(env);
1935 uint64_t hcr_el2 = arm_hcr_el2_eff(env);
1936 uint64_t ret = 0;
1937
1938 if (hcr_el2 & HCR_IMO) {
1939 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
1940 ret |= CPSR_I;
1941 }
1942 } else {
1943 if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
1944 ret |= CPSR_I;
1945 }
1946 }
1947
1948 if (hcr_el2 & HCR_FMO) {
1949 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
1950 ret |= CPSR_F;
1951 }
1952 } else {
1953 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
1954 ret |= CPSR_F;
1955 }
1956 }
1957
1958 /* External aborts are not possible in QEMU so A bit is always clear */
1959 return ret;
1960}
1961
1962static const ARMCPRegInfo v7_cp_reginfo[] = {
1963 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
1964 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
1965 .access = PL1_W, .type = ARM_CP_NOP },
1966 /* Performance monitors are implementation defined in v7,
1967 * but with an ARM recommended set of registers, which we
1968 * follow.
1969 *
1970 * Performance registers fall into three categories:
1971 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
1972 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
1973 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
1974 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
1975 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
1976 */
1977 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
1978 .access = PL0_RW, .type = ARM_CP_ALIAS,
1979 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
1980 .writefn = pmcntenset_write,
1981 .accessfn = pmreg_access,
1982 .raw_writefn = raw_write },
1983 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
1984 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
1985 .access = PL0_RW, .accessfn = pmreg_access,
1986 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
1987 .writefn = pmcntenset_write, .raw_writefn = raw_write },
1988 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
1989 .access = PL0_RW,
1990 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
1991 .accessfn = pmreg_access,
1992 .writefn = pmcntenclr_write,
1993 .type = ARM_CP_ALIAS },
1994 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
1995 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
1996 .access = PL0_RW, .accessfn = pmreg_access,
1997 .type = ARM_CP_ALIAS,
1998 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
1999 .writefn = pmcntenclr_write },
2000 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
2001 .access = PL0_RW, .type = ARM_CP_IO,
2002 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
2003 .accessfn = pmreg_access,
2004 .writefn = pmovsr_write,
2005 .raw_writefn = raw_write },
2006 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64,
2007 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3,
2008 .access = PL0_RW, .accessfn = pmreg_access,
2009 .type = ARM_CP_ALIAS | ARM_CP_IO,
2010 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
2011 .writefn = pmovsr_write,
2012 .raw_writefn = raw_write },
2013 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
2014 .access = PL0_W, .accessfn = pmreg_access_swinc,
2015 .type = ARM_CP_NO_RAW | ARM_CP_IO,
2016 .writefn = pmswinc_write },
2017 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64,
2018 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4,
2019 .access = PL0_W, .accessfn = pmreg_access_swinc,
2020 .type = ARM_CP_NO_RAW | ARM_CP_IO,
2021 .writefn = pmswinc_write },
2022 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
2023 .access = PL0_RW, .type = ARM_CP_ALIAS,
2024 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
2025 .accessfn = pmreg_access_selr, .writefn = pmselr_write,
2026 .raw_writefn = raw_write},
2027 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
2028 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
2029 .access = PL0_RW, .accessfn = pmreg_access_selr,
2030 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
2031 .writefn = pmselr_write, .raw_writefn = raw_write, },
2032 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
2033 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
2034 .readfn = pmccntr_read, .writefn = pmccntr_write32,
2035 .accessfn = pmreg_access_ccntr },
2036 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
2037 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
2038 .access = PL0_RW, .accessfn = pmreg_access_ccntr,
2039 .type = ARM_CP_IO,
2040 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt),
2041 .readfn = pmccntr_read, .writefn = pmccntr_write,
2042 .raw_readfn = raw_read, .raw_writefn = raw_write, },
2043 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7,
2044 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32,
2045 .access = PL0_RW, .accessfn = pmreg_access,
2046 .type = ARM_CP_ALIAS | ARM_CP_IO,
2047 .resetvalue = 0, },
2048 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
2049 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
2050 .writefn = pmccfiltr_write, .raw_writefn = raw_write,
2051 .access = PL0_RW, .accessfn = pmreg_access,
2052 .type = ARM_CP_IO,
2053 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
2054 .resetvalue = 0, },
2055 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
2056 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2057 .accessfn = pmreg_access,
2058 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
2059 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
2060 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
2061 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2062 .accessfn = pmreg_access,
2063 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
2064 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
2065 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2066 .accessfn = pmreg_access_xevcntr,
2067 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
2068 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64,
2069 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2,
2070 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2071 .accessfn = pmreg_access_xevcntr,
2072 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
2073 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
2074 .access = PL0_R | PL1_RW, .accessfn = access_tpm,
2075 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
2076 .resetvalue = 0,
2077 .writefn = pmuserenr_write, .raw_writefn = raw_write },
2078 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
2079 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0,
2080 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
2081 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
2082 .resetvalue = 0,
2083 .writefn = pmuserenr_write, .raw_writefn = raw_write },
2084 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
2085 .access = PL1_RW, .accessfn = access_tpm,
2086 .type = ARM_CP_ALIAS | ARM_CP_IO,
2087 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
2088 .resetvalue = 0,
2089 .writefn = pmintenset_write, .raw_writefn = raw_write },
2090 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
2091 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
2092 .access = PL1_RW, .accessfn = access_tpm,
2093 .type = ARM_CP_IO,
2094 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2095 .writefn = pmintenset_write, .raw_writefn = raw_write,
2096 .resetvalue = 0x0 },
2097 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
2098 .access = PL1_RW, .accessfn = access_tpm,
2099 .type = ARM_CP_ALIAS | ARM_CP_IO,
2100 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2101 .writefn = pmintenclr_write, },
2102 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
2103 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
2104 .access = PL1_RW, .accessfn = access_tpm,
2105 .type = ARM_CP_ALIAS | ARM_CP_IO,
2106 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2107 .writefn = pmintenclr_write },
2108 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
2109 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
2110 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
2111 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
2112 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
2113 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0,
2114 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
2115 offsetof(CPUARMState, cp15.csselr_ns) } },
2116 /* Auxiliary ID register: this actually has an IMPDEF value but for now
2117 * just RAZ for all cores:
2118 */
2119 { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
2120 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
2121 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2122 /* Auxiliary fault status registers: these also are IMPDEF, and we
2123 * choose to RAZ/WI for all cores.
2124 */
2125 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
2126 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
2127 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2128 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
2129 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
2130 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2131 /* MAIR can just read-as-written because we don't implement caches
2132 * and so don't need to care about memory attributes.
2133 */
2134 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
2135 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
2136 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
2137 .resetvalue = 0 },
2138 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
2139 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
2140 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
2141 .resetvalue = 0 },
2142 /* For non-long-descriptor page tables these are PRRR and NMRR;
2143 * regardless they still act as reads-as-written for QEMU.
2144 */
2145 /* MAIR0/1 are defined separately from their 64-bit counterpart which
2146 * allows them to assign the correct fieldoffset based on the endianness
2147 * handled in the field definitions.
2148 */
2149 { .name = "MAIR0", .state = ARM_CP_STATE_AA32,
2150 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
2151 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
2152 offsetof(CPUARMState, cp15.mair0_ns) },
2153 .resetfn = arm_cp_reset_ignore },
2154 { .name = "MAIR1", .state = ARM_CP_STATE_AA32,
2155 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
2156 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
2157 offsetof(CPUARMState, cp15.mair1_ns) },
2158 .resetfn = arm_cp_reset_ignore },
2159 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
2160 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
2161 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
2162 /* 32 bit ITLB invalidates */
2163 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
2164 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2165 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
2166 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2167 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
2168 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2169 /* 32 bit DTLB invalidates */
2170 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
2171 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2172 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
2173 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2174 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
2175 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2176 /* 32 bit TLB invalidates */
2177 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2178 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2179 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2180 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2181 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2182 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2183 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2184 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
2185 REGINFO_SENTINEL
2186};
2187
2188static const ARMCPRegInfo v7mp_cp_reginfo[] = {
2189 /* 32 bit TLB invalidates, Inner Shareable */
2190 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2191 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write },
2192 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2193 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
2194 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2195 .type = ARM_CP_NO_RAW, .access = PL1_W,
2196 .writefn = tlbiasid_is_write },
2197 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2198 .type = ARM_CP_NO_RAW, .access = PL1_W,
2199 .writefn = tlbimvaa_is_write },
2200 REGINFO_SENTINEL
2201};
2202
2203static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
2204 /* PMOVSSET is not implemented in v7 before v7ve */
2205 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3,
2206 .access = PL0_RW, .accessfn = pmreg_access,
2207 .type = ARM_CP_ALIAS | ARM_CP_IO,
2208 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
2209 .writefn = pmovsset_write,
2210 .raw_writefn = raw_write },
2211 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64,
2212 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3,
2213 .access = PL0_RW, .accessfn = pmreg_access,
2214 .type = ARM_CP_ALIAS | ARM_CP_IO,
2215 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
2216 .writefn = pmovsset_write,
2217 .raw_writefn = raw_write },
2218 REGINFO_SENTINEL
2219};
2220
2221static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2222 uint64_t value)
2223{
2224 value &= 1;
2225 env->teecr = value;
2226}
2227
2228static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri,
2229 bool isread)
2230{
2231 if (arm_current_el(env) == 0 && (env->teecr & 1)) {
2232 return CP_ACCESS_TRAP;
2233 }
2234 return CP_ACCESS_OK;
2235}
2236
2237static const ARMCPRegInfo t2ee_cp_reginfo[] = {
2238 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
2239 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
2240 .resetvalue = 0,
2241 .writefn = teecr_write },
2242 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
2243 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
2244 .accessfn = teehbr_access, .resetvalue = 0 },
2245 REGINFO_SENTINEL
2246};
2247
2248static const ARMCPRegInfo v6k_cp_reginfo[] = {
2249 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
2250 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
2251 .access = PL0_RW,
2252 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
2253 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
2254 .access = PL0_RW,
2255 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
2256 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
2257 .resetfn = arm_cp_reset_ignore },
2258 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
2259 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
2260 .access = PL0_R|PL1_W,
2261 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
2262 .resetvalue = 0},
2263 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
2264 .access = PL0_R|PL1_W,
2265 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
2266 offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
2267 .resetfn = arm_cp_reset_ignore },
2268 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
2269 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
2270 .access = PL1_RW,
2271 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
2272 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
2273 .access = PL1_RW,
2274 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
2275 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
2276 .resetvalue = 0 },
2277 REGINFO_SENTINEL
2278};
2279
2280#ifndef CONFIG_USER_ONLY
2281
2282static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri,
2283 bool isread)
2284{
2285 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
2286 * Writable only at the highest implemented exception level.
2287 */
2288 int el = arm_current_el(env);
2289
2290 switch (el) {
2291 case 0:
2292 if (!extract32(env->cp15.c14_cntkctl, 0, 2)) {
2293 return CP_ACCESS_TRAP;
2294 }
2295 break;
2296 case 1:
2297 if (!isread && ri->state == ARM_CP_STATE_AA32 &&
2298 arm_is_secure_below_el3(env)) {
2299 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
2300 return CP_ACCESS_TRAP_UNCATEGORIZED;
2301 }
2302 break;
2303 case 2:
2304 case 3:
2305 break;
2306 }
2307
2308 if (!isread && el < arm_highest_el(env)) {
2309 return CP_ACCESS_TRAP_UNCATEGORIZED;
2310 }
2311
2312 return CP_ACCESS_OK;
2313}
2314
2315static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
2316 bool isread)
2317{
2318 unsigned int cur_el = arm_current_el(env);
2319 bool secure = arm_is_secure(env);
2320
2321 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
2322 if (cur_el == 0 &&
2323 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
2324 return CP_ACCESS_TRAP;
2325 }
2326
2327 if (arm_feature(env, ARM_FEATURE_EL2) &&
2328 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
2329 !extract32(env->cp15.cnthctl_el2, 0, 1)) {
2330 return CP_ACCESS_TRAP_EL2;
2331 }
2332 return CP_ACCESS_OK;
2333}
2334
2335static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
2336 bool isread)
2337{
2338 unsigned int cur_el = arm_current_el(env);
2339 bool secure = arm_is_secure(env);
2340
2341 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
2342 * EL0[PV]TEN is zero.
2343 */
2344 if (cur_el == 0 &&
2345 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
2346 return CP_ACCESS_TRAP;
2347 }
2348
2349 if (arm_feature(env, ARM_FEATURE_EL2) &&
2350 timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
2351 !extract32(env->cp15.cnthctl_el2, 1, 1)) {
2352 return CP_ACCESS_TRAP_EL2;
2353 }
2354 return CP_ACCESS_OK;
2355}
2356
2357static CPAccessResult gt_pct_access(CPUARMState *env,
2358 const ARMCPRegInfo *ri,
2359 bool isread)
2360{
2361 return gt_counter_access(env, GTIMER_PHYS, isread);
2362}
2363
2364static CPAccessResult gt_vct_access(CPUARMState *env,
2365 const ARMCPRegInfo *ri,
2366 bool isread)
2367{
2368 return gt_counter_access(env, GTIMER_VIRT, isread);
2369}
2370
2371static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
2372 bool isread)
2373{
2374 return gt_timer_access(env, GTIMER_PHYS, isread);
2375}
2376
2377static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
2378 bool isread)
2379{
2380 return gt_timer_access(env, GTIMER_VIRT, isread);
2381}
2382
2383static CPAccessResult gt_stimer_access(CPUARMState *env,
2384 const ARMCPRegInfo *ri,
2385 bool isread)
2386{
2387 /* The AArch64 register view of the secure physical timer is
2388 * always accessible from EL3, and configurably accessible from
2389 * Secure EL1.
2390 */
2391 switch (arm_current_el(env)) {
2392 case 1:
2393 if (!arm_is_secure(env)) {
2394 return CP_ACCESS_TRAP;
2395 }
2396 if (!(env->cp15.scr_el3 & SCR_ST)) {
2397 return CP_ACCESS_TRAP_EL3;
2398 }
2399 return CP_ACCESS_OK;
2400 case 0:
2401 case 2:
2402 return CP_ACCESS_TRAP;
2403 case 3:
2404 return CP_ACCESS_OK;
2405 default:
2406 g_assert_not_reached();
2407 }
2408}
2409
2410static uint64_t gt_get_countervalue(CPUARMState *env)
2411{
2412 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
2413}
2414
2415static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
2416{
2417 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
2418
2419 if (gt->ctl & 1) {
2420 /* Timer enabled: calculate and set current ISTATUS, irq, and
2421 * reset timer to when ISTATUS next has to change
2422 */
2423 uint64_t offset = timeridx == GTIMER_VIRT ?
2424 cpu->env.cp15.cntvoff_el2 : 0;
2425 uint64_t count = gt_get_countervalue(&cpu->env);
2426 /* Note that this must be unsigned 64 bit arithmetic: */
2427 int istatus = count - offset >= gt->cval;
2428 uint64_t nexttick;
2429 int irqstate;
2430
2431 gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
2432
2433 irqstate = (istatus && !(gt->ctl & 2));
2434 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
2435
2436 if (istatus) {
2437 /* Next transition is when count rolls back over to zero */
2438 nexttick = UINT64_MAX;
2439 } else {
2440 /* Next transition is when we hit cval */
2441 nexttick = gt->cval + offset;
2442 }
2443 /* Note that the desired next expiry time might be beyond the
2444 * signed-64-bit range of a QEMUTimer -- in this case we just
2445 * set the timer for as far in the future as possible. When the
2446 * timer expires we will reset the timer for any remaining period.
2447 */
2448 if (nexttick > INT64_MAX / GTIMER_SCALE) {
2449 nexttick = INT64_MAX / GTIMER_SCALE;
2450 }
2451 timer_mod(cpu->gt_timer[timeridx], nexttick);
2452 trace_arm_gt_recalc(timeridx, irqstate, nexttick);
2453 } else {
2454 /* Timer disabled: ISTATUS and timer output always clear */
2455 gt->ctl &= ~4;
2456 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
2457 timer_del(cpu->gt_timer[timeridx]);
2458 trace_arm_gt_recalc_disabled(timeridx);
2459 }
2460}
2461
2462static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
2463 int timeridx)
2464{
2465 ARMCPU *cpu = env_archcpu(env);
2466
2467 timer_del(cpu->gt_timer[timeridx]);
2468}
2469
2470static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2471{
2472 return gt_get_countervalue(env);
2473}
2474
2475static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2476{
2477 return gt_get_countervalue(env) - env->cp15.cntvoff_el2;
2478}
2479
2480static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2481 int timeridx,
2482 uint64_t value)
2483{
2484 trace_arm_gt_cval_write(timeridx, value);
2485 env->cp15.c14_timer[timeridx].cval = value;
2486 gt_recalc_timer(env_archcpu(env), timeridx);
2487}
2488
2489static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
2490 int timeridx)
2491{
2492 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
2493
2494 return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
2495 (gt_get_countervalue(env) - offset));
2496}
2497
2498static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2499 int timeridx,
2500 uint64_t value)
2501{
2502 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
2503
2504 trace_arm_gt_tval_write(timeridx, value);
2505 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
2506 sextract64(value, 0, 32);
2507 gt_recalc_timer(env_archcpu(env), timeridx);
2508}
2509
2510static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2511 int timeridx,
2512 uint64_t value)
2513{
2514 ARMCPU *cpu = env_archcpu(env);
2515 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
2516
2517 trace_arm_gt_ctl_write(timeridx, value);
2518 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
2519 if ((oldval ^ value) & 1) {
2520 /* Enable toggled */
2521 gt_recalc_timer(cpu, timeridx);
2522 } else if ((oldval ^ value) & 2) {
2523 /* IMASK toggled: don't need to recalculate,
2524 * just set the interrupt line based on ISTATUS
2525 */
2526 int irqstate = (oldval & 4) && !(value & 2);
2527
2528 trace_arm_gt_imask_toggle(timeridx, irqstate);
2529 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
2530 }
2531}
2532
2533static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2534{
2535 gt_timer_reset(env, ri, GTIMER_PHYS);
2536}
2537
2538static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2539 uint64_t value)
2540{
2541 gt_cval_write(env, ri, GTIMER_PHYS, value);
2542}
2543
2544static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2545{
2546 return gt_tval_read(env, ri, GTIMER_PHYS);
2547}
2548
2549static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2550 uint64_t value)
2551{
2552 gt_tval_write(env, ri, GTIMER_PHYS, value);
2553}
2554
2555static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2556 uint64_t value)
2557{
2558 gt_ctl_write(env, ri, GTIMER_PHYS, value);
2559}
2560
2561static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2562{
2563 gt_timer_reset(env, ri, GTIMER_VIRT);
2564}
2565
2566static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2567 uint64_t value)
2568{
2569 gt_cval_write(env, ri, GTIMER_VIRT, value);
2570}
2571
2572static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2573{
2574 return gt_tval_read(env, ri, GTIMER_VIRT);
2575}
2576
2577static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2578 uint64_t value)
2579{
2580 gt_tval_write(env, ri, GTIMER_VIRT, value);
2581}
2582
2583static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2584 uint64_t value)
2585{
2586 gt_ctl_write(env, ri, GTIMER_VIRT, value);
2587}
2588
2589static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
2590 uint64_t value)
2591{
2592 ARMCPU *cpu = env_archcpu(env);
2593
2594 trace_arm_gt_cntvoff_write(value);
2595 raw_write(env, ri, value);
2596 gt_recalc_timer(cpu, GTIMER_VIRT);
2597}
2598
2599static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2600{
2601 gt_timer_reset(env, ri, GTIMER_HYP);
2602}
2603
2604static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2605 uint64_t value)
2606{
2607 gt_cval_write(env, ri, GTIMER_HYP, value);
2608}
2609
2610static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2611{
2612 return gt_tval_read(env, ri, GTIMER_HYP);
2613}
2614
2615static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2616 uint64_t value)
2617{
2618 gt_tval_write(env, ri, GTIMER_HYP, value);
2619}
2620
2621static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2622 uint64_t value)
2623{
2624 gt_ctl_write(env, ri, GTIMER_HYP, value);
2625}
2626
2627static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2628{
2629 gt_timer_reset(env, ri, GTIMER_SEC);
2630}
2631
2632static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2633 uint64_t value)
2634{
2635 gt_cval_write(env, ri, GTIMER_SEC, value);
2636}
2637
2638static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2639{
2640 return gt_tval_read(env, ri, GTIMER_SEC);
2641}
2642
2643static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2644 uint64_t value)
2645{
2646 gt_tval_write(env, ri, GTIMER_SEC, value);
2647}
2648
2649static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2650 uint64_t value)
2651{
2652 gt_ctl_write(env, ri, GTIMER_SEC, value);
2653}
2654
2655void arm_gt_ptimer_cb(void *opaque)
2656{
2657 ARMCPU *cpu = opaque;
2658
2659 gt_recalc_timer(cpu, GTIMER_PHYS);
2660}
2661
2662void arm_gt_vtimer_cb(void *opaque)
2663{
2664 ARMCPU *cpu = opaque;
2665
2666 gt_recalc_timer(cpu, GTIMER_VIRT);
2667}
2668
2669void arm_gt_htimer_cb(void *opaque)
2670{
2671 ARMCPU *cpu = opaque;
2672
2673 gt_recalc_timer(cpu, GTIMER_HYP);
2674}
2675
2676void arm_gt_stimer_cb(void *opaque)
2677{
2678 ARMCPU *cpu = opaque;
2679
2680 gt_recalc_timer(cpu, GTIMER_SEC);
2681}
2682
2683static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2684 /* Note that CNTFRQ is purely reads-as-written for the benefit
2685 * of software; writing it doesn't actually change the timer frequency.
2686 * Our reset value matches the fixed frequency we implement the timer at.
2687 */
2688 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
2689 .type = ARM_CP_ALIAS,
2690 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
2691 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
2692 },
2693 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2694 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2695 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
2696 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2697 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
2698 },
2699 /* overall control: mostly access permissions */
2700 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
2701 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
2702 .access = PL1_RW,
2703 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
2704 .resetvalue = 0,
2705 },
2706 /* per-timer control */
2707 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2708 .secure = ARM_CP_SECSTATE_NS,
2709 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2710 .accessfn = gt_ptimer_access,
2711 .fieldoffset = offsetoflow32(CPUARMState,
2712 cp15.c14_timer[GTIMER_PHYS].ctl),
2713 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
2714 },
2715 { .name = "CNTP_CTL_S",
2716 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2717 .secure = ARM_CP_SECSTATE_S,
2718 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2719 .accessfn = gt_ptimer_access,
2720 .fieldoffset = offsetoflow32(CPUARMState,
2721 cp15.c14_timer[GTIMER_SEC].ctl),
2722 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2723 },
2724 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
2725 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
2726 .type = ARM_CP_IO, .access = PL0_RW,
2727 .accessfn = gt_ptimer_access,
2728 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
2729 .resetvalue = 0,
2730 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
2731 },
2732 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
2733 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2734 .accessfn = gt_vtimer_access,
2735 .fieldoffset = offsetoflow32(CPUARMState,
2736 cp15.c14_timer[GTIMER_VIRT].ctl),
2737 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
2738 },
2739 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
2740 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
2741 .type = ARM_CP_IO, .access = PL0_RW,
2742 .accessfn = gt_vtimer_access,
2743 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
2744 .resetvalue = 0,
2745 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
2746 },
2747 /* TimerValue views: a 32 bit downcounting view of the underlying state */
2748 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2749 .secure = ARM_CP_SECSTATE_NS,
2750 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2751 .accessfn = gt_ptimer_access,
2752 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
2753 },
2754 { .name = "CNTP_TVAL_S",
2755 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2756 .secure = ARM_CP_SECSTATE_S,
2757 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2758 .accessfn = gt_ptimer_access,
2759 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
2760 },
2761 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2762 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
2763 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2764 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
2765 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
2766 },
2767 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
2768 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2769 .accessfn = gt_vtimer_access,
2770 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
2771 },
2772 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2773 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
2774 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2775 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
2776 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
2777 },
2778 /* The counter itself */
2779 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
2780 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
2781 .accessfn = gt_pct_access,
2782 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
2783 },
2784 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
2785 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
2786 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2787 .accessfn = gt_pct_access, .readfn = gt_cnt_read,
2788 },
2789 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
2790 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
2791 .accessfn = gt_vct_access,
2792 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
2793 },
2794 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2795 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2796 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2797 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
2798 },
2799 /* Comparison value, indicating when the timer goes off */
2800 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
2801 .secure = ARM_CP_SECSTATE_NS,
2802 .access = PL0_RW,
2803 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2804 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2805 .accessfn = gt_ptimer_access,
2806 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
2807 },
2808 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
2809 .secure = ARM_CP_SECSTATE_S,
2810 .access = PL0_RW,
2811 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2812 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2813 .accessfn = gt_ptimer_access,
2814 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2815 },
2816 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2817 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
2818 .access = PL0_RW,
2819 .type = ARM_CP_IO,
2820 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2821 .resetvalue = 0, .accessfn = gt_ptimer_access,
2822 .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
2823 },
2824 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
2825 .access = PL0_RW,
2826 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2827 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2828 .accessfn = gt_vtimer_access,
2829 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
2830 },
2831 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2832 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
2833 .access = PL0_RW,
2834 .type = ARM_CP_IO,
2835 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2836 .resetvalue = 0, .accessfn = gt_vtimer_access,
2837 .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
2838 },
2839 /* Secure timer -- this is actually restricted to only EL3
2840 * and configurably Secure-EL1 via the accessfn.
2841 */
2842 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
2843 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
2844 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW,
2845 .accessfn = gt_stimer_access,
2846 .readfn = gt_sec_tval_read,
2847 .writefn = gt_sec_tval_write,
2848 .resetfn = gt_sec_timer_reset,
2849 },
2850 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
2851 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
2852 .type = ARM_CP_IO, .access = PL1_RW,
2853 .accessfn = gt_stimer_access,
2854 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
2855 .resetvalue = 0,
2856 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2857 },
2858 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
2859 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
2860 .type = ARM_CP_IO, .access = PL1_RW,
2861 .accessfn = gt_stimer_access,
2862 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2863 .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2864 },
2865 REGINFO_SENTINEL
2866};
2867
2868#else
2869
2870/* In user-mode most of the generic timer registers are inaccessible
2871 * however modern kernels (4.12+) allow access to cntvct_el0
2872 */
2873
2874static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2875{
2876 /* Currently we have no support for QEMUTimer in linux-user so we
2877 * can't call gt_get_countervalue(env), instead we directly
2878 * call the lower level functions.
2879 */
2880 return cpu_get_clock() / GTIMER_SCALE;
2881}
2882
2883static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2884 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2885 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2886 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */,
2887 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2888 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE,
2889 },
2890 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2891 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2892 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2893 .readfn = gt_virt_cnt_read,
2894 },
2895 REGINFO_SENTINEL
2896};
2897
2898#endif
2899
2900static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
2901{
2902 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2903 raw_write(env, ri, value);
2904 } else if (arm_feature(env, ARM_FEATURE_V7)) {
2905 raw_write(env, ri, value & 0xfffff6ff);
2906 } else {
2907 raw_write(env, ri, value & 0xfffff1ff);
2908 }
2909}
2910
2911#ifndef CONFIG_USER_ONLY
2912/* get_phys_addr() isn't present for user-mode-only targets */
2913
2914static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
2915 bool isread)
2916{
2917 if (ri->opc2 & 4) {
2918 /* The ATS12NSO* operations must trap to EL3 if executed in
2919 * Secure EL1 (which can only happen if EL3 is AArch64).
2920 * They are simply UNDEF if executed from NS EL1.
2921 * They function normally from EL2 or EL3.
2922 */
2923 if (arm_current_el(env) == 1) {
2924 if (arm_is_secure_below_el3(env)) {
2925 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3;
2926 }
2927 return CP_ACCESS_TRAP_UNCATEGORIZED;
2928 }
2929 }
2930 return CP_ACCESS_OK;
2931}
2932
2933static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
2934 MMUAccessType access_type, ARMMMUIdx mmu_idx)
2935{
2936 hwaddr phys_addr;
2937 target_ulong page_size;
2938 int prot;
2939 bool ret;
2940 uint64_t par64;
2941 bool format64 = false;
2942 MemTxAttrs attrs = {};
2943 ARMMMUFaultInfo fi = {};
2944 ARMCacheAttrs cacheattrs = {};
2945
2946 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
2947 &prot, &page_size, &fi, &cacheattrs);
2948
2949 if (ret) {
2950 /*
2951 * Some kinds of translation fault must cause exceptions rather
2952 * than being reported in the PAR.
2953 */
2954 int current_el = arm_current_el(env);
2955 int target_el;
2956 uint32_t syn, fsr, fsc;
2957 bool take_exc = false;
2958
2959 if (fi.s1ptw && current_el == 1 && !arm_is_secure(env)
2960 && (mmu_idx == ARMMMUIdx_S1NSE1 || mmu_idx == ARMMMUIdx_S1NSE0)) {
2961 /*
2962 * Synchronous stage 2 fault on an access made as part of the
2963 * translation table walk for AT S1E0* or AT S1E1* insn
2964 * executed from NS EL1. If this is a synchronous external abort
2965 * and SCR_EL3.EA == 1, then we take a synchronous external abort
2966 * to EL3. Otherwise the fault is taken as an exception to EL2,
2967 * and HPFAR_EL2 holds the faulting IPA.
2968 */
2969 if (fi.type == ARMFault_SyncExternalOnWalk &&
2970 (env->cp15.scr_el3 & SCR_EA)) {
2971 target_el = 3;
2972 } else {
2973 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
2974 target_el = 2;
2975 }
2976 take_exc = true;
2977 } else if (fi.type == ARMFault_SyncExternalOnWalk) {
2978 /*
2979 * Synchronous external aborts during a translation table walk
2980 * are taken as Data Abort exceptions.
2981 */
2982 if (fi.stage2) {
2983 if (current_el == 3) {
2984 target_el = 3;
2985 } else {
2986 target_el = 2;
2987 }
2988 } else {
2989 target_el = exception_target_el(env);
2990 }
2991 take_exc = true;
2992 }
2993
2994 if (take_exc) {
2995 /* Construct FSR and FSC using same logic as arm_deliver_fault() */
2996 if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
2997 arm_s1_regime_using_lpae_format(env, mmu_idx)) {
2998 fsr = arm_fi_to_lfsc(&fi);
2999 fsc = extract32(fsr, 0, 6);
3000 } else {
3001 fsr = arm_fi_to_sfsc(&fi);
3002 fsc = 0x3f;
3003 }
3004 /*
3005 * Report exception with ESR indicating a fault due to a
3006 * translation table walk for a cache maintenance instruction.
3007 */
3008 syn = syn_data_abort_no_iss(current_el == target_el,
3009 fi.ea, 1, fi.s1ptw, 1, fsc);
3010 env->exception.vaddress = value;
3011 env->exception.fsr = fsr;
3012 raise_exception(env, EXCP_DATA_ABORT, syn, target_el);
3013 }
3014 }
3015
3016 if (is_a64(env)) {
3017 format64 = true;
3018 } else if (arm_feature(env, ARM_FEATURE_LPAE)) {
3019 /*
3020 * ATS1Cxx:
3021 * * TTBCR.EAE determines whether the result is returned using the
3022 * 32-bit or the 64-bit PAR format
3023 * * Instructions executed in Hyp mode always use the 64bit format
3024 *
3025 * ATS1S2NSOxx uses the 64bit format if any of the following is true:
3026 * * The Non-secure TTBCR.EAE bit is set to 1
3027 * * The implementation includes EL2, and the value of HCR.VM is 1
3028 *
3029 * (Note that HCR.DC makes HCR.VM behave as if it is 1.)
3030 *
3031 * ATS1Hx always uses the 64bit format.
3032 */
3033 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx);
3034
3035 if (arm_feature(env, ARM_FEATURE_EL2)) {
3036 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
3037 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC);
3038 } else {
3039 format64 |= arm_current_el(env) == 2;
3040 }
3041 }
3042 }
3043
3044 if (format64) {
3045 /* Create a 64-bit PAR */
3046 par64 = (1 << 11); /* LPAE bit always set */
3047 if (!ret) {
3048 par64 |= phys_addr & ~0xfffULL;
3049 if (!attrs.secure) {
3050 par64 |= (1 << 9); /* NS */
3051 }
3052 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
3053 par64 |= cacheattrs.shareability << 7; /* SH */
3054 } else {
3055 uint32_t fsr = arm_fi_to_lfsc(&fi);
3056
3057 par64 |= 1; /* F */
3058 par64 |= (fsr & 0x3f) << 1; /* FS */
3059 if (fi.stage2) {
3060 par64 |= (1 << 9); /* S */
3061 }
3062 if (fi.s1ptw) {
3063 par64 |= (1 << 8); /* PTW */
3064 }
3065 }
3066 } else {
3067 /* fsr is a DFSR/IFSR value for the short descriptor
3068 * translation table format (with WnR always clear).
3069 * Convert it to a 32-bit PAR.
3070 */
3071 if (!ret) {
3072 /* We do not set any attribute bits in the PAR */
3073 if (page_size == (1 << 24)
3074 && arm_feature(env, ARM_FEATURE_V7)) {
3075 par64 = (phys_addr & 0xff000000) | (1 << 1);
3076 } else {
3077 par64 = phys_addr & 0xfffff000;
3078 }
3079 if (!attrs.secure) {
3080 par64 |= (1 << 9); /* NS */
3081 }
3082 } else {
3083 uint32_t fsr = arm_fi_to_sfsc(&fi);
3084
3085 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
3086 ((fsr & 0xf) << 1) | 1;
3087 }
3088 }
3089 return par64;
3090}
3091
3092static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
3093{
3094 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3095 uint64_t par64;
3096 ARMMMUIdx mmu_idx;
3097 int el = arm_current_el(env);
3098 bool secure = arm_is_secure_below_el3(env);
3099
3100 switch (ri->opc2 & 6) {
3101 case 0:
3102 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */
3103 switch (el) {
3104 case 3:
3105 mmu_idx = ARMMMUIdx_S1E3;
3106 break;
3107 case 2:
3108 mmu_idx = ARMMMUIdx_S1NSE1;
3109 break;
3110 case 1:
3111 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
3112 break;
3113 default:
3114 g_assert_not_reached();
3115 }
3116 break;
3117 case 2:
3118 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
3119 switch (el) {
3120 case 3:
3121 mmu_idx = ARMMMUIdx_S1SE0;
3122 break;
3123 case 2:
3124 mmu_idx = ARMMMUIdx_S1NSE0;
3125 break;
3126 case 1:
3127 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
3128 break;
3129 default:
3130 g_assert_not_reached();
3131 }
3132 break;
3133 case 4:
3134 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
3135 mmu_idx = ARMMMUIdx_S12NSE1;
3136 break;
3137 case 6:
3138 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
3139 mmu_idx = ARMMMUIdx_S12NSE0;
3140 break;
3141 default:
3142 g_assert_not_reached();
3143 }
3144
3145 par64 = do_ats_write(env, value, access_type, mmu_idx);
3146
3147 A32_BANKED_CURRENT_REG_SET(env, par, par64);
3148}
3149
3150static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
3151 uint64_t value)
3152{
3153 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3154 uint64_t par64;
3155
3156 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2);
3157
3158 A32_BANKED_CURRENT_REG_SET(env, par, par64);
3159}
3160
3161static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
3162 bool isread)
3163{
3164 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) {
3165 return CP_ACCESS_TRAP;
3166 }
3167 return CP_ACCESS_OK;
3168}
3169
3170static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
3171 uint64_t value)
3172{
3173 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3174 ARMMMUIdx mmu_idx;
3175 int secure = arm_is_secure_below_el3(env);
3176
3177 switch (ri->opc2 & 6) {
3178 case 0:
3179 switch (ri->opc1) {
3180 case 0: /* AT S1E1R, AT S1E1W */
3181 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
3182 break;
3183 case 4: /* AT S1E2R, AT S1E2W */
3184 mmu_idx = ARMMMUIdx_S1E2;
3185 break;
3186 case 6: /* AT S1E3R, AT S1E3W */
3187 mmu_idx = ARMMMUIdx_S1E3;
3188 break;
3189 default:
3190 g_assert_not_reached();
3191 }
3192 break;
3193 case 2: /* AT S1E0R, AT S1E0W */
3194 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
3195 break;
3196 case 4: /* AT S12E1R, AT S12E1W */
3197 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1;
3198 break;
3199 case 6: /* AT S12E0R, AT S12E0W */
3200 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0;
3201 break;
3202 default:
3203 g_assert_not_reached();
3204 }
3205
3206 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
3207}
3208#endif
3209
3210static const ARMCPRegInfo vapa_cp_reginfo[] = {
3211 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
3212 .access = PL1_RW, .resetvalue = 0,
3213 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
3214 offsetoflow32(CPUARMState, cp15.par_ns) },
3215 .writefn = par_write },
3216#ifndef CONFIG_USER_ONLY
3217 /* This underdecoding is safe because the reginfo is NO_RAW. */
3218 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
3219 .access = PL1_W, .accessfn = ats_access,
3220 .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
3221#endif
3222 REGINFO_SENTINEL
3223};
3224
3225/* Return basic MPU access permission bits. */
3226static uint32_t simple_mpu_ap_bits(uint32_t val)
3227{
3228 uint32_t ret;
3229 uint32_t mask;
3230 int i;
3231 ret = 0;
3232 mask = 3;
3233 for (i = 0; i < 16; i += 2) {
3234 ret |= (val >> i) & mask;
3235 mask <<= 2;
3236 }
3237 return ret;
3238}
3239
3240/* Pad basic MPU access permission bits to extended format. */
3241static uint32_t extended_mpu_ap_bits(uint32_t val)
3242{
3243 uint32_t ret;
3244 uint32_t mask;
3245 int i;
3246 ret = 0;
3247 mask = 3;
3248 for (i = 0; i < 16; i += 2) {
3249 ret |= (val & mask) << i;
3250 mask <<= 2;
3251 }
3252 return ret;
3253}
3254
3255static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
3256 uint64_t value)
3257{
3258 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
3259}
3260
3261static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
3262{
3263 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
3264}
3265
3266static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
3267 uint64_t value)
3268{
3269 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
3270}
3271
3272static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
3273{
3274 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
3275}
3276
3277static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
3278{
3279 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
3280
3281 if (!u32p) {
3282 return 0;
3283 }
3284
3285 u32p += env->pmsav7.rnr[M_REG_NS];
3286 return *u32p;
3287}
3288
3289static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
3290 uint64_t value)
3291{
3292 ARMCPU *cpu = env_archcpu(env);
3293 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
3294
3295 if (!u32p) {
3296 return;
3297 }
3298
3299 u32p += env->pmsav7.rnr[M_REG_NS];
3300 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
3301 *u32p = value;
3302}
3303
3304static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3305 uint64_t value)
3306{
3307 ARMCPU *cpu = env_archcpu(env);
3308 uint32_t nrgs = cpu->pmsav7_dregion;
3309
3310 if (value >= nrgs) {
3311 qemu_log_mask(LOG_GUEST_ERROR,
3312 "PMSAv7 RGNR write >= # supported regions, %" PRIu32
3313 " > %" PRIu32 "\n", (uint32_t)value, nrgs);
3314 return;
3315 }
3316
3317 raw_write(env, ri, value);
3318}
3319
3320static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
3321 /* Reset for all these registers is handled in arm_cpu_reset(),
3322 * because the PMSAv7 is also used by M-profile CPUs, which do
3323 * not register cpregs but still need the state to be reset.
3324 */
3325 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
3326 .access = PL1_RW, .type = ARM_CP_NO_RAW,
3327 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
3328 .readfn = pmsav7_read, .writefn = pmsav7_write,
3329 .resetfn = arm_cp_reset_ignore },
3330 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
3331 .access = PL1_RW, .type = ARM_CP_NO_RAW,
3332 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
3333 .readfn = pmsav7_read, .writefn = pmsav7_write,
3334 .resetfn = arm_cp_reset_ignore },
3335 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
3336 .access = PL1_RW, .type = ARM_CP_NO_RAW,
3337 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
3338 .readfn = pmsav7_read, .writefn = pmsav7_write,
3339 .resetfn = arm_cp_reset_ignore },
3340 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
3341 .access = PL1_RW,
3342 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]),
3343 .writefn = pmsav7_rgnr_write,
3344 .resetfn = arm_cp_reset_ignore },
3345 REGINFO_SENTINEL
3346};
3347
3348static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
3349 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
3350 .access = PL1_RW, .type = ARM_CP_ALIAS,
3351 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
3352 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
3353 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
3354 .access = PL1_RW, .type = ARM_CP_ALIAS,
3355 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
3356 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
3357 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
3358 .access = PL1_RW,
3359 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
3360 .resetvalue = 0, },
3361 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
3362 .access = PL1_RW,
3363 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
3364 .resetvalue = 0, },
3365 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
3366 .access = PL1_RW,
3367 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
3368 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
3369 .access = PL1_RW,
3370 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
3371 /* Protection region base and size registers */
3372 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
3373 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3374 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
3375 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
3376 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3377 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
3378 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
3379 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3380 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
3381 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
3382 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3383 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
3384 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
3385 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3386 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
3387 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
3388 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3389 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
3390 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
3391 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3392 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
3393 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
3394 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3395 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
3396 REGINFO_SENTINEL
3397};
3398
3399static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
3400 uint64_t value)
3401{
3402 TCR *tcr = raw_ptr(env, ri);
3403 int maskshift = extract32(value, 0, 3);
3404
3405 if (!arm_feature(env, ARM_FEATURE_V8)) {
3406 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
3407 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
3408 * using Long-desciptor translation table format */
3409 value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
3410 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
3411 /* In an implementation that includes the Security Extensions
3412 * TTBCR has additional fields PD0 [4] and PD1 [5] for
3413 * Short-descriptor translation table format.
3414 */
3415 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
3416 } else {
3417 value &= TTBCR_N;
3418 }
3419 }
3420
3421 /* Update the masks corresponding to the TCR bank being written
3422 * Note that we always calculate mask and base_mask, but
3423 * they are only used for short-descriptor tables (ie if EAE is 0);
3424 * for long-descriptor tables the TCR fields are used differently
3425 * and the mask and base_mask values are meaningless.
3426 */
3427 tcr->raw_tcr = value;
3428 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
3429 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
3430}
3431
3432static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3433 uint64_t value)
3434{
3435 ARMCPU *cpu = env_archcpu(env);
3436 TCR *tcr = raw_ptr(env, ri);
3437
3438 if (arm_feature(env, ARM_FEATURE_LPAE)) {
3439 /* With LPAE the TTBCR could result in a change of ASID
3440 * via the TTBCR.A1 bit, so do a TLB flush.
3441 */
3442 tlb_flush(CPU(cpu));
3443 }
3444 /* Preserve the high half of TCR_EL1, set via TTBCR2. */
3445 value = deposit64(tcr->raw_tcr, 0, 32, value);
3446 vmsa_ttbcr_raw_write(env, ri, value);
3447}
3448
3449static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
3450{
3451 TCR *tcr = raw_ptr(env, ri);
3452
3453 /* Reset both the TCR as well as the masks corresponding to the bank of
3454 * the TCR being reset.
3455 */
3456 tcr->raw_tcr = 0;
3457 tcr->mask = 0;
3458 tcr->base_mask = 0xffffc000u;
3459}
3460
3461static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3462 uint64_t value)
3463{
3464 ARMCPU *cpu = env_archcpu(env);
3465 TCR *tcr = raw_ptr(env, ri);
3466
3467 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
3468 tlb_flush(CPU(cpu));
3469 tcr->raw_tcr = value;
3470}
3471
3472static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3473 uint64_t value)
3474{
3475 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */
3476 if (cpreg_field_is_64bit(ri) &&
3477 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
3478 ARMCPU *cpu = env_archcpu(env);
3479 tlb_flush(CPU(cpu));
3480 }
3481 raw_write(env, ri, value);
3482}
3483
3484static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3485 uint64_t value)
3486{
3487 ARMCPU *cpu = env_archcpu(env);
3488 CPUState *cs = CPU(cpu);
3489
3490 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */
3491 if (raw_read(env, ri) != value) {
3492 tlb_flush_by_mmuidx(cs,
3493 ARMMMUIdxBit_S12NSE1 |
3494 ARMMMUIdxBit_S12NSE0 |
3495 ARMMMUIdxBit_S2NS);
3496 raw_write(env, ri, value);
3497 }
3498}
3499
3500static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
3501 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
3502 .access = PL1_RW, .type = ARM_CP_ALIAS,
3503 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
3504 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
3505 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
3506 .access = PL1_RW, .resetvalue = 0,
3507 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
3508 offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
3509 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
3510 .access = PL1_RW, .resetvalue = 0,
3511 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
3512 offsetof(CPUARMState, cp15.dfar_ns) } },
3513 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
3514 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
3515 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
3516 .resetvalue = 0, },
3517 REGINFO_SENTINEL
3518};
3519
3520static const ARMCPRegInfo vmsa_cp_reginfo[] = {
3521 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
3522 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
3523 .access = PL1_RW,
3524 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
3525 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
3526 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
3527 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3528 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
3529 offsetof(CPUARMState, cp15.ttbr0_ns) } },
3530 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
3531 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
3532 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3533 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
3534 offsetof(CPUARMState, cp15.ttbr1_ns) } },
3535 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
3536 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
3537 .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
3538 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
3539 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
3540 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
3541 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
3542 .raw_writefn = vmsa_ttbcr_raw_write,
3543 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
3544 offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
3545 REGINFO_SENTINEL
3546};
3547
3548/* Note that unlike TTBCR, writing to TTBCR2 does not require flushing
3549 * qemu tlbs nor adjusting cached masks.
3550 */
3551static const ARMCPRegInfo ttbcr2_reginfo = {
3552 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3,
3553 .access = PL1_RW, .type = ARM_CP_ALIAS,
3554 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]),
3555 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) },
3556};
3557
3558static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
3559 uint64_t value)
3560{
3561 env->cp15.c15_ticonfig = value & 0xe7;
3562 /* The OS_TYPE bit in this register changes the reported CPUID! */
3563 env->cp15.c0_cpuid = (value & (1 << 5)) ?
3564 ARM_CPUID_TI915T : ARM_CPUID_TI925T;
3565}
3566
3567static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
3568 uint64_t value)
3569{
3570 env->cp15.c15_threadid = value & 0xffff;
3571}
3572
3573static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
3574 uint64_t value)
3575{
3576 /* Wait-for-interrupt (deprecated) */
3577 cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT);
3578}
3579
3580static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
3581 uint64_t value)
3582{
3583 /* On OMAP there are registers indicating the max/min index of dcache lines
3584 * containing a dirty line; cache flush operations have to reset these.
3585 */
3586 env->cp15.c15_i_max = 0x000;
3587 env->cp15.c15_i_min = 0xff0;
3588}
3589
3590static const ARMCPRegInfo omap_cp_reginfo[] = {
3591 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
3592 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
3593 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
3594 .resetvalue = 0, },
3595 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
3596 .access = PL1_RW, .type = ARM_CP_NOP },
3597 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
3598 .access = PL1_RW,
3599 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
3600 .writefn = omap_ticonfig_write },
3601 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
3602 .access = PL1_RW,
3603 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
3604 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
3605 .access = PL1_RW, .resetvalue = 0xff0,
3606 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
3607 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
3608 .access = PL1_RW,
3609 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
3610 .writefn = omap_threadid_write },
3611 { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
3612 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
3613 .type = ARM_CP_NO_RAW,
3614 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
3615 /* TODO: Peripheral port remap register:
3616 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
3617 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
3618 * when MMU is off.
3619 */
3620 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
3621 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
3622 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW,
3623 .writefn = omap_cachemaint_write },
3624 { .name = "C9", .cp = 15, .crn = 9,
3625 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
3626 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
3627 REGINFO_SENTINEL
3628};
3629
3630static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
3631 uint64_t value)
3632{
3633 env->cp15.c15_cpar = value & 0x3fff;
3634}
3635
3636static const ARMCPRegInfo xscale_cp_reginfo[] = {
3637 { .name = "XSCALE_CPAR",
3638 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
3639 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
3640 .writefn = xscale_cpar_write, },
3641 { .name = "XSCALE_AUXCR",
3642 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
3643 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
3644 .resetvalue = 0, },
3645 /* XScale specific cache-lockdown: since we have no cache we NOP these
3646 * and hope the guest does not really rely on cache behaviour.
3647 */
3648 { .name = "XSCALE_LOCK_ICACHE_LINE",
3649 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
3650 .access = PL1_W, .type = ARM_CP_NOP },
3651 { .name = "XSCALE_UNLOCK_ICACHE",
3652 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
3653 .access = PL1_W, .type = ARM_CP_NOP },
3654 { .name = "XSCALE_DCACHE_LOCK",
3655 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
3656 .access = PL1_RW, .type = ARM_CP_NOP },
3657 { .name = "XSCALE_UNLOCK_DCACHE",
3658 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
3659 .access = PL1_W, .type = ARM_CP_NOP },
3660 REGINFO_SENTINEL
3661};
3662
3663static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
3664 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
3665 * implementation of this implementation-defined space.
3666 * Ideally this should eventually disappear in favour of actually
3667 * implementing the correct behaviour for all cores.
3668 */
3669 { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
3670 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
3671 .access = PL1_RW,
3672 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
3673 .resetvalue = 0 },
3674 REGINFO_SENTINEL
3675};
3676
3677static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
3678 /* Cache status: RAZ because we have no cache so it's always clean */
3679 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
3680 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3681 .resetvalue = 0 },
3682 REGINFO_SENTINEL
3683};
3684
3685static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
3686 /* We never have a a block transfer operation in progress */
3687 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
3688 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3689 .resetvalue = 0 },
3690 /* The cache ops themselves: these all NOP for QEMU */
3691 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
3692 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3693 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
3694 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3695 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
3696 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3697 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
3698 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3699 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
3700 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3701 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
3702 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3703 REGINFO_SENTINEL
3704};
3705
3706static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
3707 /* The cache test-and-clean instructions always return (1 << 30)
3708 * to indicate that there are no dirty cache lines.
3709 */
3710 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
3711 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3712 .resetvalue = (1 << 30) },
3713 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
3714 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3715 .resetvalue = (1 << 30) },
3716 REGINFO_SENTINEL
3717};
3718
3719static const ARMCPRegInfo strongarm_cp_reginfo[] = {
3720 /* Ignore ReadBuffer accesses */
3721 { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
3722 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
3723 .access = PL1_RW, .resetvalue = 0,
3724 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
3725 REGINFO_SENTINEL
3726};
3727
3728static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3729{
3730 ARMCPU *cpu = env_archcpu(env);
3731 unsigned int cur_el = arm_current_el(env);
3732 bool secure = arm_is_secure(env);
3733
3734 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
3735 return env->cp15.vpidr_el2;
3736 }
3737 return raw_read(env, ri);
3738}
3739
3740static uint64_t mpidr_read_val(CPUARMState *env)
3741{
3742 ARMCPU *cpu = env_archcpu(env);
3743 uint64_t mpidr = cpu->mp_affinity;
3744
3745 if (arm_feature(env, ARM_FEATURE_V7MP)) {
3746 mpidr |= (1U << 31);
3747 /* Cores which are uniprocessor (non-coherent)
3748 * but still implement the MP extensions set
3749 * bit 30. (For instance, Cortex-R5).
3750 */
3751 if (cpu->mp_is_up) {
3752 mpidr |= (1u << 30);
3753 }
3754 }
3755 return mpidr;
3756}
3757
3758static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3759{
3760 unsigned int cur_el = arm_current_el(env);
3761 bool secure = arm_is_secure(env);
3762
3763 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
3764 return env->cp15.vmpidr_el2;
3765 }
3766 return mpidr_read_val(env);
3767}
3768
3769static const ARMCPRegInfo lpae_cp_reginfo[] = {
3770 /* NOP AMAIR0/1 */
3771 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
3772 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
3773 .access = PL1_RW, .type = ARM_CP_CONST,
3774 .resetvalue = 0 },
3775 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
3776 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
3777 .access = PL1_RW, .type = ARM_CP_CONST,
3778 .resetvalue = 0 },
3779 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
3780 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
3781 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
3782 offsetof(CPUARMState, cp15.par_ns)} },
3783 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
3784 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3785 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
3786 offsetof(CPUARMState, cp15.ttbr0_ns) },
3787 .writefn = vmsa_ttbr_write, },
3788 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
3789 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3790 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
3791 offsetof(CPUARMState, cp15.ttbr1_ns) },
3792 .writefn = vmsa_ttbr_write, },
3793 REGINFO_SENTINEL
3794};
3795
3796static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3797{
3798 return vfp_get_fpcr(env);
3799}
3800
3801static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3802 uint64_t value)
3803{
3804 vfp_set_fpcr(env, value);
3805}
3806
3807static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3808{
3809 return vfp_get_fpsr(env);
3810}
3811
3812static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3813 uint64_t value)
3814{
3815 vfp_set_fpsr(env, value);
3816}
3817
3818static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri,
3819 bool isread)
3820{
3821 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
3822 return CP_ACCESS_TRAP;
3823 }
3824 return CP_ACCESS_OK;
3825}
3826
3827static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
3828 uint64_t value)
3829{
3830 env->daif = value & PSTATE_DAIF;
3831}
3832
3833static CPAccessResult aa64_cacheop_access(CPUARMState *env,
3834 const ARMCPRegInfo *ri,
3835 bool isread)
3836{
3837 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
3838 * SCTLR_EL1.UCI is set.
3839 */
3840 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) {
3841 return CP_ACCESS_TRAP;
3842 }
3843 return CP_ACCESS_OK;
3844}
3845
3846/* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
3847 * Page D4-1736 (DDI0487A.b)
3848 */
3849
3850static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3851 uint64_t value)
3852{
3853 CPUState *cs = env_cpu(env);
3854 bool sec = arm_is_secure_below_el3(env);
3855
3856 if (sec) {
3857 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3858 ARMMMUIdxBit_S1SE1 |
3859 ARMMMUIdxBit_S1SE0);
3860 } else {
3861 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3862 ARMMMUIdxBit_S12NSE1 |
3863 ARMMMUIdxBit_S12NSE0);
3864 }
3865}
3866
3867static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3868 uint64_t value)
3869{
3870 CPUState *cs = env_cpu(env);
3871
3872 if (tlb_force_broadcast(env)) {
3873 tlbi_aa64_vmalle1is_write(env, NULL, value);
3874 return;
3875 }
3876
3877 if (arm_is_secure_below_el3(env)) {
3878 tlb_flush_by_mmuidx(cs,
3879 ARMMMUIdxBit_S1SE1 |
3880 ARMMMUIdxBit_S1SE0);
3881 } else {
3882 tlb_flush_by_mmuidx(cs,
3883 ARMMMUIdxBit_S12NSE1 |
3884 ARMMMUIdxBit_S12NSE0);
3885 }
3886}
3887
3888static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3889 uint64_t value)
3890{
3891 /* Note that the 'ALL' scope must invalidate both stage 1 and
3892 * stage 2 translations, whereas most other scopes only invalidate
3893 * stage 1 translations.
3894 */
3895 ARMCPU *cpu = env_archcpu(env);
3896 CPUState *cs = CPU(cpu);
3897
3898 if (arm_is_secure_below_el3(env)) {
3899 tlb_flush_by_mmuidx(cs,
3900 ARMMMUIdxBit_S1SE1 |
3901 ARMMMUIdxBit_S1SE0);
3902 } else {
3903 if (arm_feature(env, ARM_FEATURE_EL2)) {
3904 tlb_flush_by_mmuidx(cs,
3905 ARMMMUIdxBit_S12NSE1 |
3906 ARMMMUIdxBit_S12NSE0 |
3907 ARMMMUIdxBit_S2NS);
3908 } else {
3909 tlb_flush_by_mmuidx(cs,
3910 ARMMMUIdxBit_S12NSE1 |
3911 ARMMMUIdxBit_S12NSE0);
3912 }
3913 }
3914}
3915
3916static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
3917 uint64_t value)
3918{
3919 ARMCPU *cpu = env_archcpu(env);
3920 CPUState *cs = CPU(cpu);
3921
3922 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
3923}
3924
3925static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
3926 uint64_t value)
3927{
3928 ARMCPU *cpu = env_archcpu(env);
3929 CPUState *cs = CPU(cpu);
3930
3931 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3);
3932}
3933
3934static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3935 uint64_t value)
3936{
3937 /* Note that the 'ALL' scope must invalidate both stage 1 and
3938 * stage 2 translations, whereas most other scopes only invalidate
3939 * stage 1 translations.
3940 */
3941 CPUState *cs = env_cpu(env);
3942 bool sec = arm_is_secure_below_el3(env);
3943 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2);
3944
3945 if (sec) {
3946 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3947 ARMMMUIdxBit_S1SE1 |
3948 ARMMMUIdxBit_S1SE0);
3949 } else if (has_el2) {
3950 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3951 ARMMMUIdxBit_S12NSE1 |
3952 ARMMMUIdxBit_S12NSE0 |
3953 ARMMMUIdxBit_S2NS);
3954 } else {
3955 tlb_flush_by_mmuidx_all_cpus_synced(cs,
3956 ARMMMUIdxBit_S12NSE1 |
3957 ARMMMUIdxBit_S12NSE0);
3958 }
3959}
3960
3961static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3962 uint64_t value)
3963{
3964 CPUState *cs = env_cpu(env);
3965
3966 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
3967}
3968
3969static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3970 uint64_t value)
3971{
3972 CPUState *cs = env_cpu(env);
3973
3974 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3);
3975}
3976
3977static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
3978 uint64_t value)
3979{
3980 /* Invalidate by VA, EL2
3981 * Currently handles both VAE2 and VALE2, since we don't support
3982 * flush-last-level-only.
3983 */
3984 ARMCPU *cpu = env_archcpu(env);
3985 CPUState *cs = CPU(cpu);
3986 uint64_t pageaddr = sextract64(value << 12, 0, 56);
3987
3988 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
3989}
3990
3991static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
3992 uint64_t value)
3993{
3994 /* Invalidate by VA, EL3
3995 * Currently handles both VAE3 and VALE3, since we don't support
3996 * flush-last-level-only.
3997 */
3998 ARMCPU *cpu = env_archcpu(env);
3999 CPUState *cs = CPU(cpu);
4000 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4001
4002 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3);
4003}
4004
4005static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4006 uint64_t value)
4007{
4008 ARMCPU *cpu = env_archcpu(env);
4009 CPUState *cs = CPU(cpu);
4010 bool sec = arm_is_secure_below_el3(env);
4011 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4012
4013 if (sec) {
4014 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4015 ARMMMUIdxBit_S1SE1 |
4016 ARMMMUIdxBit_S1SE0);
4017 } else {
4018 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4019 ARMMMUIdxBit_S12NSE1 |
4020 ARMMMUIdxBit_S12NSE0);
4021 }
4022}
4023
4024static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
4025 uint64_t value)
4026{
4027 /* Invalidate by VA, EL1&0 (AArch64 version).
4028 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1,
4029 * since we don't support flush-for-specific-ASID-only or
4030 * flush-last-level-only.
4031 */
4032 ARMCPU *cpu = env_archcpu(env);
4033 CPUState *cs = CPU(cpu);
4034 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4035
4036 if (tlb_force_broadcast(env)) {
4037 tlbi_aa64_vae1is_write(env, NULL, value);
4038 return;
4039 }
4040
4041 if (arm_is_secure_below_el3(env)) {
4042 tlb_flush_page_by_mmuidx(cs, pageaddr,
4043 ARMMMUIdxBit_S1SE1 |
4044 ARMMMUIdxBit_S1SE0);
4045 } else {
4046 tlb_flush_page_by_mmuidx(cs, pageaddr,
4047 ARMMMUIdxBit_S12NSE1 |
4048 ARMMMUIdxBit_S12NSE0);
4049 }
4050}
4051
4052static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4053 uint64_t value)
4054{
4055 CPUState *cs = env_cpu(env);
4056 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4057
4058 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4059 ARMMMUIdxBit_S1E2);
4060}
4061
4062static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4063 uint64_t value)
4064{
4065 CPUState *cs = env_cpu(env);
4066 uint64_t pageaddr = sextract64(value << 12, 0, 56);
4067
4068 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4069 ARMMMUIdxBit_S1E3);
4070}
4071
4072static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
4073 uint64_t value)
4074{
4075 /* Invalidate by IPA. This has to invalidate any structures that
4076 * contain only stage 2 translation information, but does not need
4077 * to apply to structures that contain combined stage 1 and stage 2
4078 * translation information.
4079 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
4080 */
4081 ARMCPU *cpu = env_archcpu(env);
4082 CPUState *cs = CPU(cpu);
4083 uint64_t pageaddr;
4084
4085 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
4086 return;
4087 }
4088
4089 pageaddr = sextract64(value << 12, 0, 48);
4090
4091 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
4092}
4093
4094static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4095 uint64_t value)
4096{
4097 CPUState *cs = env_cpu(env);
4098 uint64_t pageaddr;
4099
4100 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
4101 return;
4102 }
4103
4104 pageaddr = sextract64(value << 12, 0, 48);
4105
4106 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4107 ARMMMUIdxBit_S2NS);
4108}
4109
4110static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
4111 bool isread)
4112{
4113 /* We don't implement EL2, so the only control on DC ZVA is the
4114 * bit in the SCTLR which can prohibit access for EL0.
4115 */
4116 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
4117 return CP_ACCESS_TRAP;
4118 }
4119 return CP_ACCESS_OK;
4120}
4121
4122static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
4123{
4124 ARMCPU *cpu = env_archcpu(env);
4125 int dzp_bit = 1 << 4;
4126
4127 /* DZP indicates whether DC ZVA access is allowed */
4128 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) {
4129 dzp_bit = 0;
4130 }
4131 return cpu->dcz_blocksize | dzp_bit;
4132}
4133
4134static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
4135 bool isread)
4136{
4137 if (!(env->pstate & PSTATE_SP)) {
4138 /* Access to SP_EL0 is undefined if it's being used as
4139 * the stack pointer.
4140 */
4141 return CP_ACCESS_TRAP_UNCATEGORIZED;
4142 }
4143 return CP_ACCESS_OK;
4144}
4145
4146static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
4147{
4148 return env->pstate & PSTATE_SP;
4149}
4150
4151static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
4152{
4153 update_spsel(env, val);
4154}
4155
4156static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4157 uint64_t value)
4158{
4159 ARMCPU *cpu = env_archcpu(env);
4160
4161 if (raw_read(env, ri) == value) {
4162 /* Skip the TLB flush if nothing actually changed; Linux likes
4163 * to do a lot of pointless SCTLR writes.
4164 */
4165 return;
4166 }
4167
4168 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
4169 /* M bit is RAZ/WI for PMSA with no MPU implemented */
4170 value &= ~SCTLR_M;
4171 }
4172
4173 raw_write(env, ri, value);
4174 /* ??? Lots of these bits are not implemented. */
4175 /* This may enable/disable the MMU, so do a TLB flush. */
4176 tlb_flush(CPU(cpu));
4177}
4178
4179static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri,
4180 bool isread)
4181{
4182 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) {
4183 return CP_ACCESS_TRAP_FP_EL2;
4184 }
4185 if (env->cp15.cptr_el[3] & CPTR_TFP) {
4186 return CP_ACCESS_TRAP_FP_EL3;
4187 }
4188 return CP_ACCESS_OK;
4189}
4190
4191static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4192 uint64_t value)
4193{
4194 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK;
4195}
4196
4197static const ARMCPRegInfo v8_cp_reginfo[] = {
4198 /* Minimal set of EL0-visible registers. This will need to be expanded
4199 * significantly for system emulation of AArch64 CPUs.
4200 */
4201 { .name = "NZCV", .state = ARM_CP_STATE_AA64,
4202 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
4203 .access = PL0_RW, .type = ARM_CP_NZCV },
4204 { .name = "DAIF", .state = ARM_CP_STATE_AA64,
4205 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
4206 .type = ARM_CP_NO_RAW,
4207 .access = PL0_RW, .accessfn = aa64_daif_access,
4208 .fieldoffset = offsetof(CPUARMState, daif),
4209 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
4210 { .name = "FPCR", .state = ARM_CP_STATE_AA64,
4211 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
4212 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
4213 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
4214 { .name = "FPSR", .state = ARM_CP_STATE_AA64,
4215 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
4216 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
4217 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
4218 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
4219 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
4220 .access = PL0_R, .type = ARM_CP_NO_RAW,
4221 .readfn = aa64_dczid_read },
4222 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
4223 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
4224 .access = PL0_W, .type = ARM_CP_DC_ZVA,
4225#ifndef CONFIG_USER_ONLY
4226 /* Avoid overhead of an access check that always passes in user-mode */
4227 .accessfn = aa64_zva_access,
4228#endif
4229 },
4230 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
4231 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
4232 .access = PL1_R, .type = ARM_CP_CURRENTEL },
4233 /* Cache ops: all NOPs since we don't emulate caches */
4234 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
4235 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
4236 .access = PL1_W, .type = ARM_CP_NOP },
4237 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
4238 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
4239 .access = PL1_W, .type = ARM_CP_NOP },
4240 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
4241 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
4242 .access = PL0_W, .type = ARM_CP_NOP,
4243 .accessfn = aa64_cacheop_access },
4244 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
4245 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
4246 .access = PL1_W, .type = ARM_CP_NOP },
4247 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
4248 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
4249 .access = PL1_W, .type = ARM_CP_NOP },
4250 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
4251 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
4252 .access = PL0_W, .type = ARM_CP_NOP,
4253 .accessfn = aa64_cacheop_access },
4254 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
4255 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
4256 .access = PL1_W, .type = ARM_CP_NOP },
4257 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
4258 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
4259 .access = PL0_W, .type = ARM_CP_NOP,
4260 .accessfn = aa64_cacheop_access },
4261 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
4262 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
4263 .access = PL0_W, .type = ARM_CP_NOP,
4264 .accessfn = aa64_cacheop_access },
4265 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
4266 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
4267 .access = PL1_W, .type = ARM_CP_NOP },
4268 /* TLBI operations */
4269 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
4270 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
4271 .access = PL1_W, .type = ARM_CP_NO_RAW,
4272 .writefn = tlbi_aa64_vmalle1is_write },
4273 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
4274 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
4275 .access = PL1_W, .type = ARM_CP_NO_RAW,
4276 .writefn = tlbi_aa64_vae1is_write },
4277 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
4278 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
4279 .access = PL1_W, .type = ARM_CP_NO_RAW,
4280 .writefn = tlbi_aa64_vmalle1is_write },
4281 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
4282 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
4283 .access = PL1_W, .type = ARM_CP_NO_RAW,
4284 .writefn = tlbi_aa64_vae1is_write },
4285 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
4286 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
4287 .access = PL1_W, .type = ARM_CP_NO_RAW,
4288 .writefn = tlbi_aa64_vae1is_write },
4289 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
4290 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
4291 .access = PL1_W, .type = ARM_CP_NO_RAW,
4292 .writefn = tlbi_aa64_vae1is_write },
4293 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
4294 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
4295 .access = PL1_W, .type = ARM_CP_NO_RAW,
4296 .writefn = tlbi_aa64_vmalle1_write },
4297 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
4298 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
4299 .access = PL1_W, .type = ARM_CP_NO_RAW,
4300 .writefn = tlbi_aa64_vae1_write },
4301 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
4302 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
4303 .access = PL1_W, .type = ARM_CP_NO_RAW,
4304 .writefn = tlbi_aa64_vmalle1_write },
4305 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
4306 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
4307 .access = PL1_W, .type = ARM_CP_NO_RAW,
4308 .writefn = tlbi_aa64_vae1_write },
4309 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
4310 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
4311 .access = PL1_W, .type = ARM_CP_NO_RAW,
4312 .writefn = tlbi_aa64_vae1_write },
4313 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
4314 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
4315 .access = PL1_W, .type = ARM_CP_NO_RAW,
4316 .writefn = tlbi_aa64_vae1_write },
4317 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
4318 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
4319 .access = PL2_W, .type = ARM_CP_NO_RAW,
4320 .writefn = tlbi_aa64_ipas2e1is_write },
4321 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
4322 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
4323 .access = PL2_W, .type = ARM_CP_NO_RAW,
4324 .writefn = tlbi_aa64_ipas2e1is_write },
4325 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
4326 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
4327 .access = PL2_W, .type = ARM_CP_NO_RAW,
4328 .writefn = tlbi_aa64_alle1is_write },
4329 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64,
4330 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6,
4331 .access = PL2_W, .type = ARM_CP_NO_RAW,
4332 .writefn = tlbi_aa64_alle1is_write },
4333 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
4334 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
4335 .access = PL2_W, .type = ARM_CP_NO_RAW,
4336 .writefn = tlbi_aa64_ipas2e1_write },
4337 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
4338 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
4339 .access = PL2_W, .type = ARM_CP_NO_RAW,
4340 .writefn = tlbi_aa64_ipas2e1_write },
4341 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
4342 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
4343 .access = PL2_W, .type = ARM_CP_NO_RAW,
4344 .writefn = tlbi_aa64_alle1_write },
4345 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64,
4346 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6,
4347 .access = PL2_W, .type = ARM_CP_NO_RAW,
4348 .writefn = tlbi_aa64_alle1is_write },
4349#ifndef CONFIG_USER_ONLY
4350 /* 64 bit address translation operations */
4351 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
4352 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
4353 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4354 .writefn = ats_write64 },
4355 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
4356 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
4357 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4358 .writefn = ats_write64 },
4359 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
4360 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
4361 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4362 .writefn = ats_write64 },
4363 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
4364 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
4365 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4366 .writefn = ats_write64 },
4367 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
4368 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
4369 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4370 .writefn = ats_write64 },
4371 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
4372 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
4373 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4374 .writefn = ats_write64 },
4375 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
4376 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
4377 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4378 .writefn = ats_write64 },
4379 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
4380 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
4381 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4382 .writefn = ats_write64 },
4383 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
4384 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
4385 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
4386 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4387 .writefn = ats_write64 },
4388 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
4389 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
4390 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
4391 .writefn = ats_write64 },
4392 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
4393 .type = ARM_CP_ALIAS,
4394 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
4395 .access = PL1_RW, .resetvalue = 0,
4396 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
4397 .writefn = par_write },
4398#endif
4399 /* TLB invalidate last level of translation table walk */
4400 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
4401 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
4402 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
4403 .type = ARM_CP_NO_RAW, .access = PL1_W,
4404 .writefn = tlbimvaa_is_write },
4405 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
4406 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
4407 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
4408 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
4409 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
4410 .type = ARM_CP_NO_RAW, .access = PL2_W,
4411 .writefn = tlbimva_hyp_write },
4412 { .name = "TLBIMVALHIS",
4413 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
4414 .type = ARM_CP_NO_RAW, .access = PL2_W,
4415 .writefn = tlbimva_hyp_is_write },
4416 { .name = "TLBIIPAS2",
4417 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
4418 .type = ARM_CP_NO_RAW, .access = PL2_W,
4419 .writefn = tlbiipas2_write },
4420 { .name = "TLBIIPAS2IS",
4421 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
4422 .type = ARM_CP_NO_RAW, .access = PL2_W,
4423 .writefn = tlbiipas2_is_write },
4424 { .name = "TLBIIPAS2L",
4425 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
4426 .type = ARM_CP_NO_RAW, .access = PL2_W,
4427 .writefn = tlbiipas2_write },
4428 { .name = "TLBIIPAS2LIS",
4429 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
4430 .type = ARM_CP_NO_RAW, .access = PL2_W,
4431 .writefn = tlbiipas2_is_write },
4432 /* 32 bit cache operations */
4433 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
4434 .type = ARM_CP_NOP, .access = PL1_W },
4435 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
4436 .type = ARM_CP_NOP, .access = PL1_W },
4437 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
4438 .type = ARM_CP_NOP, .access = PL1_W },
4439 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
4440 .type = ARM_CP_NOP, .access = PL1_W },
4441 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
4442 .type = ARM_CP_NOP, .access = PL1_W },
4443 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
4444 .type = ARM_CP_NOP, .access = PL1_W },
4445 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
4446 .type = ARM_CP_NOP, .access = PL1_W },
4447 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
4448 .type = ARM_CP_NOP, .access = PL1_W },
4449 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
4450 .type = ARM_CP_NOP, .access = PL1_W },
4451 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
4452 .type = ARM_CP_NOP, .access = PL1_W },
4453 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
4454 .type = ARM_CP_NOP, .access = PL1_W },
4455 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
4456 .type = ARM_CP_NOP, .access = PL1_W },
4457 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
4458 .type = ARM_CP_NOP, .access = PL1_W },
4459 /* MMU Domain access control / MPU write buffer control */
4460 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
4461 .access = PL1_RW, .resetvalue = 0,
4462 .writefn = dacr_write, .raw_writefn = raw_write,
4463 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
4464 offsetoflow32(CPUARMState, cp15.dacr_ns) } },
4465 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
4466 .type = ARM_CP_ALIAS,
4467 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
4468 .access = PL1_RW,
4469 .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
4470 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
4471 .type = ARM_CP_ALIAS,
4472 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
4473 .access = PL1_RW,
4474 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) },
4475 /* We rely on the access checks not allowing the guest to write to the
4476 * state field when SPSel indicates that it's being used as the stack
4477 * pointer.
4478 */
4479 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
4480 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
4481 .access = PL1_RW, .accessfn = sp_el0_access,
4482 .type = ARM_CP_ALIAS,
4483 .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
4484 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
4485 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
4486 .access = PL2_RW, .type = ARM_CP_ALIAS,
4487 .fieldoffset = offsetof(CPUARMState, sp_el[1]) },
4488 { .name = "SPSel", .state = ARM_CP_STATE_AA64,
4489 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
4490 .type = ARM_CP_NO_RAW,
4491 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
4492 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64,
4493 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0,
4494 .type = ARM_CP_ALIAS,
4495 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]),
4496 .access = PL2_RW, .accessfn = fpexc32_access },
4497 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
4498 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
4499 .access = PL2_RW, .resetvalue = 0,
4500 .writefn = dacr_write, .raw_writefn = raw_write,
4501 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
4502 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
4503 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
4504 .access = PL2_RW, .resetvalue = 0,
4505 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
4506 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64,
4507 .type = ARM_CP_ALIAS,
4508 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0,
4509 .access = PL2_RW,
4510 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) },
4511 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64,
4512 .type = ARM_CP_ALIAS,
4513 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1,
4514 .access = PL2_RW,
4515 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) },
4516 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64,
4517 .type = ARM_CP_ALIAS,
4518 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2,
4519 .access = PL2_RW,
4520 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) },
4521 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64,
4522 .type = ARM_CP_ALIAS,
4523 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3,
4524 .access = PL2_RW,
4525 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) },
4526 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64,
4527 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1,
4528 .resetvalue = 0,
4529 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) },
4530 { .name = "SDCR", .type = ARM_CP_ALIAS,
4531 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1,
4532 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
4533 .writefn = sdcr_write,
4534 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
4535 REGINFO_SENTINEL
4536};
4537
4538/* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
4539static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
4540 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
4541 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
4542 .access = PL2_RW,
4543 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
4544 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH,
4545 .type = ARM_CP_NO_RAW,
4546 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4547 .access = PL2_RW,
4548 .type = ARM_CP_CONST, .resetvalue = 0 },
4549 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
4550 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
4551 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4552 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
4553 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
4554 .access = PL2_RW,
4555 .type = ARM_CP_CONST, .resetvalue = 0 },
4556 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
4557 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
4558 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4559 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
4560 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
4561 .access = PL2_RW, .type = ARM_CP_CONST,
4562 .resetvalue = 0 },
4563 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
4564 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
4565 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4566 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
4567 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
4568 .access = PL2_RW, .type = ARM_CP_CONST,
4569 .resetvalue = 0 },
4570 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
4571 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
4572 .access = PL2_RW, .type = ARM_CP_CONST,
4573 .resetvalue = 0 },
4574 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
4575 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
4576 .access = PL2_RW, .type = ARM_CP_CONST,
4577 .resetvalue = 0 },
4578 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
4579 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
4580 .access = PL2_RW, .type = ARM_CP_CONST,
4581 .resetvalue = 0 },
4582 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
4583 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
4584 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4585 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,
4586 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4587 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4588 .type = ARM_CP_CONST, .resetvalue = 0 },
4589 { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
4590 .cp = 15, .opc1 = 6, .crm = 2,
4591 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4592 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
4593 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
4594 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
4595 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4596 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
4597 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
4598 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4599 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4600 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
4601 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4602 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
4603 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
4604 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4605 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
4606 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4607 .resetvalue = 0 },
4608 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
4609 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
4610 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4611 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
4612 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
4613 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4614 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
4615 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4616 .resetvalue = 0 },
4617 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
4618 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
4619 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4620 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
4621 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4622 .resetvalue = 0 },
4623 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
4624 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
4625 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4626 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
4627 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
4628 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4629 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
4630 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
4631 .access = PL2_RW, .accessfn = access_tda,
4632 .type = ARM_CP_CONST, .resetvalue = 0 },
4633 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH,
4634 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4635 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4636 .type = ARM_CP_CONST, .resetvalue = 0 },
4637 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
4638 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
4639 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4640 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
4641 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
4642 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4643 { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
4644 .type = ARM_CP_CONST,
4645 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
4646 .access = PL2_RW, .resetvalue = 0 },
4647 REGINFO_SENTINEL
4648};
4649
4650/* Ditto, but for registers which exist in ARMv8 but not v7 */
4651static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
4652 { .name = "HCR2", .state = ARM_CP_STATE_AA32,
4653 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
4654 .access = PL2_RW,
4655 .type = ARM_CP_CONST, .resetvalue = 0 },
4656 REGINFO_SENTINEL
4657};
4658
4659static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
4660{
4661 ARMCPU *cpu = env_archcpu(env);
4662 uint64_t valid_mask = HCR_MASK;
4663
4664 if (arm_feature(env, ARM_FEATURE_EL3)) {
4665 valid_mask &= ~HCR_HCD;
4666 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
4667 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
4668 * However, if we're using the SMC PSCI conduit then QEMU is
4669 * effectively acting like EL3 firmware and so the guest at
4670 * EL2 should retain the ability to prevent EL1 from being
4671 * able to make SMC calls into the ersatz firmware, so in
4672 * that case HCR.TSC should be read/write.
4673 */
4674 valid_mask &= ~HCR_TSC;
4675 }
4676 if (cpu_isar_feature(aa64_lor, cpu)) {
4677 valid_mask |= HCR_TLOR;
4678 }
4679 if (cpu_isar_feature(aa64_pauth, cpu)) {
4680 valid_mask |= HCR_API | HCR_APK;
4681 }
4682
4683 /* Clear RES0 bits. */
4684 value &= valid_mask;
4685
4686 /* These bits change the MMU setup:
4687 * HCR_VM enables stage 2 translation
4688 * HCR_PTW forbids certain page-table setups
4689 * HCR_DC Disables stage1 and enables stage2 translation
4690 */
4691 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) {
4692 tlb_flush(CPU(cpu));
4693 }
4694 env->cp15.hcr_el2 = value;
4695
4696 /*
4697 * Updates to VI and VF require us to update the status of
4698 * virtual interrupts, which are the logical OR of these bits
4699 * and the state of the input lines from the GIC. (This requires
4700 * that we have the iothread lock, which is done by marking the
4701 * reginfo structs as ARM_CP_IO.)
4702 * Note that if a write to HCR pends a VIRQ or VFIQ it is never
4703 * possible for it to be taken immediately, because VIRQ and
4704 * VFIQ are masked unless running at EL0 or EL1, and HCR
4705 * can only be written at EL2.
4706 */
4707 g_assert(qemu_mutex_iothread_locked());
4708 arm_cpu_update_virq(cpu);
4709 arm_cpu_update_vfiq(cpu);
4710}
4711
4712static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri,
4713 uint64_t value)
4714{
4715 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */
4716 value = deposit64(env->cp15.hcr_el2, 32, 32, value);
4717 hcr_write(env, NULL, value);
4718}
4719
4720static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
4721 uint64_t value)
4722{
4723 /* Handle HCR write, i.e. write to low half of HCR_EL2 */
4724 value = deposit64(env->cp15.hcr_el2, 0, 32, value);
4725 hcr_write(env, NULL, value);
4726}
4727
4728/*
4729 * Return the effective value of HCR_EL2.
4730 * Bits that are not included here:
4731 * RW (read from SCR_EL3.RW as needed)
4732 */
4733uint64_t arm_hcr_el2_eff(CPUARMState *env)
4734{
4735 uint64_t ret = env->cp15.hcr_el2;
4736
4737 if (arm_is_secure_below_el3(env)) {
4738 /*
4739 * "This register has no effect if EL2 is not enabled in the
4740 * current Security state". This is ARMv8.4-SecEL2 speak for
4741 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1).
4742 *
4743 * Prior to that, the language was "In an implementation that
4744 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves
4745 * as if this field is 0 for all purposes other than a direct
4746 * read or write access of HCR_EL2". With lots of enumeration
4747 * on a per-field basis. In current QEMU, this is condition
4748 * is arm_is_secure_below_el3.
4749 *
4750 * Since the v8.4 language applies to the entire register, and
4751 * appears to be backward compatible, use that.
4752 */
4753 ret = 0;
4754 } else if (ret & HCR_TGE) {
4755 /* These bits are up-to-date as of ARMv8.4. */
4756 if (ret & HCR_E2H) {
4757 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO |
4758 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE |
4759 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU |
4760 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE);
4761 } else {
4762 ret |= HCR_FMO | HCR_IMO | HCR_AMO;
4763 }
4764 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE |
4765 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR |
4766 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM |
4767 HCR_TLOR);
4768 }
4769
4770 return ret;
4771}
4772
4773static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
4774 uint64_t value)
4775{
4776 /*
4777 * For A-profile AArch32 EL3, if NSACR.CP10
4778 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
4779 */
4780 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
4781 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
4782 value &= ~(0x3 << 10);
4783 value |= env->cp15.cptr_el[2] & (0x3 << 10);
4784 }
4785 env->cp15.cptr_el[2] = value;
4786}
4787
4788static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri)
4789{
4790 /*
4791 * For A-profile AArch32 EL3, if NSACR.CP10
4792 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
4793 */
4794 uint64_t value = env->cp15.cptr_el[2];
4795
4796 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
4797 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
4798 value |= 0x3 << 10;
4799 }
4800 return value;
4801}
4802
4803static const ARMCPRegInfo el2_cp_reginfo[] = {
4804 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
4805 .type = ARM_CP_IO,
4806 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4807 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4808 .writefn = hcr_write },
4809 { .name = "HCR", .state = ARM_CP_STATE_AA32,
4810 .type = ARM_CP_ALIAS | ARM_CP_IO,
4811 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4812 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4813 .writefn = hcr_writelow },
4814 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
4815 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
4816 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4817 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
4818 .type = ARM_CP_ALIAS,
4819 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
4820 .access = PL2_RW,
4821 .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
4822 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
4823 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
4824 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
4825 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
4826 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
4827 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
4828 { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
4829 .type = ARM_CP_ALIAS,
4830 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
4831 .access = PL2_RW,
4832 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) },
4833 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
4834 .type = ARM_CP_ALIAS,
4835 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
4836 .access = PL2_RW,
4837 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
4838 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
4839 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
4840 .access = PL2_RW, .writefn = vbar_write,
4841 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
4842 .resetvalue = 0 },
4843 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
4844 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
4845 .access = PL3_RW, .type = ARM_CP_ALIAS,
4846 .fieldoffset = offsetof(CPUARMState, sp_el[2]) },
4847 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
4848 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
4849 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
4850 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]),
4851 .readfn = cptr_el2_read, .writefn = cptr_el2_write },
4852 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
4853 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
4854 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
4855 .resetvalue = 0 },
4856 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
4857 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
4858 .access = PL2_RW, .type = ARM_CP_ALIAS,
4859 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
4860 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
4861 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
4862 .access = PL2_RW, .type = ARM_CP_CONST,
4863 .resetvalue = 0 },
4864 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
4865 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
4866 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
4867 .access = PL2_RW, .type = ARM_CP_CONST,
4868 .resetvalue = 0 },
4869 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
4870 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
4871 .access = PL2_RW, .type = ARM_CP_CONST,
4872 .resetvalue = 0 },
4873 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
4874 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
4875 .access = PL2_RW, .type = ARM_CP_CONST,
4876 .resetvalue = 0 },
4877 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
4878 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
4879 .access = PL2_RW,
4880 /* no .writefn needed as this can't cause an ASID change;
4881 * no .raw_writefn or .resetfn needed as we never use mask/base_mask
4882 */
4883 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
4884 { .name = "VTCR", .state = ARM_CP_STATE_AA32,
4885 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4886 .type = ARM_CP_ALIAS,
4887 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4888 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4889 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
4890 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4891 .access = PL2_RW,
4892 /* no .writefn needed as this can't cause an ASID change;
4893 * no .raw_writefn or .resetfn needed as we never use mask/base_mask
4894 */
4895 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4896 { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
4897 .cp = 15, .opc1 = 6, .crm = 2,
4898 .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4899 .access = PL2_RW, .accessfn = access_el3_aa32ns,
4900 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
4901 .writefn = vttbr_write },
4902 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
4903 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
4904 .access = PL2_RW, .writefn = vttbr_write,
4905 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
4906 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
4907 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
4908 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
4909 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
4910 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4911 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
4912 .access = PL2_RW, .resetvalue = 0,
4913 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
4914 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
4915 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
4916 .access = PL2_RW, .resetvalue = 0,
4917 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4918 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
4919 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4920 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4921 { .name = "TLBIALLNSNH",
4922 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
4923 .type = ARM_CP_NO_RAW, .access = PL2_W,
4924 .writefn = tlbiall_nsnh_write },
4925 { .name = "TLBIALLNSNHIS",
4926 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
4927 .type = ARM_CP_NO_RAW, .access = PL2_W,
4928 .writefn = tlbiall_nsnh_is_write },
4929 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
4930 .type = ARM_CP_NO_RAW, .access = PL2_W,
4931 .writefn = tlbiall_hyp_write },
4932 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
4933 .type = ARM_CP_NO_RAW, .access = PL2_W,
4934 .writefn = tlbiall_hyp_is_write },
4935 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
4936 .type = ARM_CP_NO_RAW, .access = PL2_W,
4937 .writefn = tlbimva_hyp_write },
4938 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
4939 .type = ARM_CP_NO_RAW, .access = PL2_W,
4940 .writefn = tlbimva_hyp_is_write },
4941 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
4942 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
4943 .type = ARM_CP_NO_RAW, .access = PL2_W,
4944 .writefn = tlbi_aa64_alle2_write },
4945 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
4946 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
4947 .type = ARM_CP_NO_RAW, .access = PL2_W,
4948 .writefn = tlbi_aa64_vae2_write },
4949 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
4950 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
4951 .access = PL2_W, .type = ARM_CP_NO_RAW,
4952 .writefn = tlbi_aa64_vae2_write },
4953 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
4954 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
4955 .access = PL2_W, .type = ARM_CP_NO_RAW,
4956 .writefn = tlbi_aa64_alle2is_write },
4957 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
4958 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
4959 .type = ARM_CP_NO_RAW, .access = PL2_W,
4960 .writefn = tlbi_aa64_vae2is_write },
4961 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
4962 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
4963 .access = PL2_W, .type = ARM_CP_NO_RAW,
4964 .writefn = tlbi_aa64_vae2is_write },
4965#ifndef CONFIG_USER_ONLY
4966 /* Unlike the other EL2-related AT operations, these must
4967 * UNDEF from EL3 if EL2 is not implemented, which is why we
4968 * define them here rather than with the rest of the AT ops.
4969 */
4970 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
4971 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
4972 .access = PL2_W, .accessfn = at_s1e2_access,
4973 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 },
4974 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
4975 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
4976 .access = PL2_W, .accessfn = at_s1e2_access,
4977 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 },
4978 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
4979 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
4980 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
4981 * to behave as if SCR.NS was 1.
4982 */
4983 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
4984 .access = PL2_W,
4985 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
4986 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
4987 .access = PL2_W,
4988 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
4989 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
4990 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
4991 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
4992 * reset values as IMPDEF. We choose to reset to 3 to comply with
4993 * both ARMv7 and ARMv8.
4994 */
4995 .access = PL2_RW, .resetvalue = 3,
4996 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
4997 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
4998 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
4999 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
5000 .writefn = gt_cntvoff_write,
5001 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
5002 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
5003 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO,
5004 .writefn = gt_cntvoff_write,
5005 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
5006 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
5007 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
5008 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
5009 .type = ARM_CP_IO, .access = PL2_RW,
5010 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
5011 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
5012 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
5013 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO,
5014 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
5015 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
5016 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
5017 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW,
5018 .resetfn = gt_hyp_timer_reset,
5019 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
5020 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
5021 .type = ARM_CP_IO,
5022 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
5023 .access = PL2_RW,
5024 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
5025 .resetvalue = 0,
5026 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
5027#endif
5028 /* The only field of MDCR_EL2 that has a defined architectural reset value
5029 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we
5030 * don't implement any PMU event counters, so using zero as a reset
5031 * value for MDCR_EL2 is okay
5032 */
5033 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
5034 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
5035 .access = PL2_RW, .resetvalue = 0,
5036 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
5037 { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
5038 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
5039 .access = PL2_RW, .accessfn = access_el3_aa32ns,
5040 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
5041 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64,
5042 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
5043 .access = PL2_RW,
5044 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
5045 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
5046 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
5047 .access = PL2_RW,
5048 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) },
5049 REGINFO_SENTINEL
5050};
5051
5052static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
5053 { .name = "HCR2", .state = ARM_CP_STATE_AA32,
5054 .type = ARM_CP_ALIAS | ARM_CP_IO,
5055 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
5056 .access = PL2_RW,
5057 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
5058 .writefn = hcr_writehigh },
5059 REGINFO_SENTINEL
5060};
5061
5062static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
5063 bool isread)
5064{
5065 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
5066 * At Secure EL1 it traps to EL3.
5067 */
5068 if (arm_current_el(env) == 3) {
5069 return CP_ACCESS_OK;
5070 }
5071 if (arm_is_secure_below_el3(env)) {
5072 return CP_ACCESS_TRAP_EL3;
5073 }
5074 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
5075 if (isread) {
5076 return CP_ACCESS_OK;
5077 }
5078 return CP_ACCESS_TRAP_UNCATEGORIZED;
5079}
5080
5081static const ARMCPRegInfo el3_cp_reginfo[] = {
5082 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
5083 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
5084 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
5085 .resetvalue = 0, .writefn = scr_write },
5086 { .name = "SCR", .type = ARM_CP_ALIAS,
5087 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
5088 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
5089 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
5090 .writefn = scr_write },
5091 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
5092 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
5093 .access = PL3_RW, .resetvalue = 0,
5094 .fieldoffset = offsetof(CPUARMState, cp15.sder) },
5095 { .name = "SDER",
5096 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
5097 .access = PL3_RW, .resetvalue = 0,
5098 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
5099 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
5100 .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
5101 .writefn = vbar_write, .resetvalue = 0,
5102 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
5103 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
5104 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
5105 .access = PL3_RW, .resetvalue = 0,
5106 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
5107 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
5108 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
5109 .access = PL3_RW,
5110 /* no .writefn needed as this can't cause an ASID change;
5111 * we must provide a .raw_writefn and .resetfn because we handle
5112 * reset and migration for the AArch32 TTBCR(S), which might be
5113 * using mask and base_mask.
5114 */
5115 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write,
5116 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
5117 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
5118 .type = ARM_CP_ALIAS,
5119 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
5120 .access = PL3_RW,
5121 .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
5122 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
5123 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
5124 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
5125 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
5126 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
5127 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
5128 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
5129 .type = ARM_CP_ALIAS,
5130 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
5131 .access = PL3_RW,
5132 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) },
5133 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
5134 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
5135 .access = PL3_RW, .writefn = vbar_write,
5136 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
5137 .resetvalue = 0 },
5138 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
5139 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
5140 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
5141 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
5142 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
5143 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
5144 .access = PL3_RW, .resetvalue = 0,
5145 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
5146 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
5147 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
5148 .access = PL3_RW, .type = ARM_CP_CONST,
5149 .resetvalue = 0 },
5150 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH,
5151 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0,
5152 .access = PL3_RW, .type = ARM_CP_CONST,
5153 .resetvalue = 0 },
5154 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH,
5155 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1,
5156 .access = PL3_RW, .type = ARM_CP_CONST,
5157 .resetvalue = 0 },
5158 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64,
5159 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0,
5160 .access = PL3_W, .type = ARM_CP_NO_RAW,
5161 .writefn = tlbi_aa64_alle3is_write },
5162 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64,
5163 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1,
5164 .access = PL3_W, .type = ARM_CP_NO_RAW,
5165 .writefn = tlbi_aa64_vae3is_write },
5166 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64,
5167 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5,
5168 .access = PL3_W, .type = ARM_CP_NO_RAW,
5169 .writefn = tlbi_aa64_vae3is_write },
5170 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64,
5171 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0,
5172 .access = PL3_W, .type = ARM_CP_NO_RAW,
5173 .writefn = tlbi_aa64_alle3_write },
5174 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64,
5175 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1,
5176 .access = PL3_W, .type = ARM_CP_NO_RAW,
5177 .writefn = tlbi_aa64_vae3_write },
5178 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64,
5179 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
5180 .access = PL3_W, .type = ARM_CP_NO_RAW,
5181 .writefn = tlbi_aa64_vae3_write },
5182 REGINFO_SENTINEL
5183};
5184
5185static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
5186 bool isread)
5187{
5188 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
5189 * but the AArch32 CTR has its own reginfo struct)
5190 */
5191 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
5192 return CP_ACCESS_TRAP;
5193 }
5194 return CP_ACCESS_OK;
5195}
5196
5197static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
5198 uint64_t value)
5199{
5200 /* Writes to OSLAR_EL1 may update the OS lock status, which can be
5201 * read via a bit in OSLSR_EL1.
5202 */
5203 int oslock;
5204
5205 if (ri->state == ARM_CP_STATE_AA32) {
5206 oslock = (value == 0xC5ACCE55);
5207 } else {
5208 oslock = value & 1;
5209 }
5210
5211 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
5212}
5213
5214static const ARMCPRegInfo debug_cp_reginfo[] = {
5215 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
5216 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
5217 * unlike DBGDRAR it is never accessible from EL0.
5218 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
5219 * accessor.
5220 */
5221 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
5222 .access = PL0_R, .accessfn = access_tdra,
5223 .type = ARM_CP_CONST, .resetvalue = 0 },
5224 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
5225 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
5226 .access = PL1_R, .accessfn = access_tdra,
5227 .type = ARM_CP_CONST, .resetvalue = 0 },
5228 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
5229 .access = PL0_R, .accessfn = access_tdra,
5230 .type = ARM_CP_CONST, .resetvalue = 0 },
5231 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
5232 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
5233 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
5234 .access = PL1_RW, .accessfn = access_tda,
5235 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
5236 .resetvalue = 0 },
5237 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
5238 * We don't implement the configurable EL0 access.
5239 */
5240 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
5241 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
5242 .type = ARM_CP_ALIAS,
5243 .access = PL1_R, .accessfn = access_tda,
5244 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
5245 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
5246 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
5247 .access = PL1_W, .type = ARM_CP_NO_RAW,
5248 .accessfn = access_tdosa,
5249 .writefn = oslar_write },
5250 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
5251 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
5252 .access = PL1_R, .resetvalue = 10,
5253 .accessfn = access_tdosa,
5254 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
5255 /* Dummy OSDLR_EL1: 32-bit Linux will read this */
5256 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
5257 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
5258 .access = PL1_RW, .accessfn = access_tdosa,
5259 .type = ARM_CP_NOP },
5260 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
5261 * implement vector catch debug events yet.
5262 */
5263 { .name = "DBGVCR",
5264 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
5265 .access = PL1_RW, .accessfn = access_tda,
5266 .type = ARM_CP_NOP },
5267 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
5268 * to save and restore a 32-bit guest's DBGVCR)
5269 */
5270 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
5271 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
5272 .access = PL2_RW, .accessfn = access_tda,
5273 .type = ARM_CP_NOP },
5274 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
5275 * Channel but Linux may try to access this register. The 32-bit
5276 * alias is DBGDCCINT.
5277 */
5278 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
5279 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
5280 .access = PL1_RW, .accessfn = access_tda,
5281 .type = ARM_CP_NOP },
5282 REGINFO_SENTINEL
5283};
5284
5285static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
5286 /* 64 bit access versions of the (dummy) debug registers */
5287 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
5288 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
5289 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
5290 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
5291 REGINFO_SENTINEL
5292};
5293
5294/* Return the exception level to which exceptions should be taken
5295 * via SVEAccessTrap. If an exception should be routed through
5296 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should
5297 * take care of raising that exception.
5298 * C.f. the ARM pseudocode function CheckSVEEnabled.
5299 */
5300int sve_exception_el(CPUARMState *env, int el)
5301{
5302#ifndef CONFIG_USER_ONLY
5303 if (el <= 1) {
5304 bool disabled = false;
5305
5306 /* The CPACR.ZEN controls traps to EL1:
5307 * 0, 2 : trap EL0 and EL1 accesses
5308 * 1 : trap only EL0 accesses
5309 * 3 : trap no accesses
5310 */
5311 if (!extract32(env->cp15.cpacr_el1, 16, 1)) {
5312 disabled = true;
5313 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) {
5314 disabled = el == 0;
5315 }
5316 if (disabled) {
5317 /* route_to_el2 */
5318 return (arm_feature(env, ARM_FEATURE_EL2)
5319 && (arm_hcr_el2_eff(env) & HCR_TGE) ? 2 : 1);
5320 }
5321
5322 /* Check CPACR.FPEN. */
5323 if (!extract32(env->cp15.cpacr_el1, 20, 1)) {
5324 disabled = true;
5325 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) {
5326 disabled = el == 0;
5327 }
5328 if (disabled) {
5329 return 0;
5330 }
5331 }
5332
5333 /* CPTR_EL2. Since TZ and TFP are positive,
5334 * they will be zero when EL2 is not present.
5335 */
5336 if (el <= 2 && !arm_is_secure_below_el3(env)) {
5337 if (env->cp15.cptr_el[2] & CPTR_TZ) {
5338 return 2;
5339 }
5340 if (env->cp15.cptr_el[2] & CPTR_TFP) {
5341 return 0;
5342 }
5343 }
5344
5345 /* CPTR_EL3. Since EZ is negative we must check for EL3. */
5346 if (arm_feature(env, ARM_FEATURE_EL3)
5347 && !(env->cp15.cptr_el[3] & CPTR_EZ)) {
5348 return 3;
5349 }
5350#endif
5351 return 0;
5352}
5353
5354/*
5355 * Given that SVE is enabled, return the vector length for EL.
5356 */
5357uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
5358{
5359 ARMCPU *cpu = env_archcpu(env);
5360 uint32_t zcr_len = cpu->sve_max_vq - 1;
5361
5362 if (el <= 1) {
5363 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
5364 }
5365 if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) {
5366 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
5367 }
5368 if (arm_feature(env, ARM_FEATURE_EL3)) {
5369 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
5370 }
5371 return zcr_len;
5372}
5373
5374static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5375 uint64_t value)
5376{
5377 int cur_el = arm_current_el(env);
5378 int old_len = sve_zcr_len_for_el(env, cur_el);
5379 int new_len;
5380
5381 /* Bits other than [3:0] are RAZ/WI. */
5382 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
5383 raw_write(env, ri, value & 0xf);
5384
5385 /*
5386 * Because we arrived here, we know both FP and SVE are enabled;
5387 * otherwise we would have trapped access to the ZCR_ELn register.
5388 */
5389 new_len = sve_zcr_len_for_el(env, cur_el);
5390 if (new_len < old_len) {
5391 aarch64_sve_narrow_vq(env, new_len + 1);
5392 }
5393}
5394
5395static const ARMCPRegInfo zcr_el1_reginfo = {
5396 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
5397 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
5398 .access = PL1_RW, .type = ARM_CP_SVE,
5399 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
5400 .writefn = zcr_write, .raw_writefn = raw_write
5401};
5402
5403static const ARMCPRegInfo zcr_el2_reginfo = {
5404 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
5405 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
5406 .access = PL2_RW, .type = ARM_CP_SVE,
5407 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
5408 .writefn = zcr_write, .raw_writefn = raw_write
5409};
5410
5411static const ARMCPRegInfo zcr_no_el2_reginfo = {
5412 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
5413 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
5414 .access = PL2_RW, .type = ARM_CP_SVE,
5415 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
5416};
5417
5418static const ARMCPRegInfo zcr_el3_reginfo = {
5419 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
5420 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
5421 .access = PL3_RW, .type = ARM_CP_SVE,
5422 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
5423 .writefn = zcr_write, .raw_writefn = raw_write
5424};
5425
5426void hw_watchpoint_update(ARMCPU *cpu, int n)
5427{
5428 CPUARMState *env = &cpu->env;
5429 vaddr len = 0;
5430 vaddr wvr = env->cp15.dbgwvr[n];
5431 uint64_t wcr = env->cp15.dbgwcr[n];
5432 int mask;
5433 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
5434
5435 if (env->cpu_watchpoint[n]) {
5436 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
5437 env->cpu_watchpoint[n] = NULL;
5438 }
5439
5440 if (!extract64(wcr, 0, 1)) {
5441 /* E bit clear : watchpoint disabled */
5442 return;
5443 }
5444
5445 switch (extract64(wcr, 3, 2)) {
5446 case 0:
5447 /* LSC 00 is reserved and must behave as if the wp is disabled */
5448 return;
5449 case 1:
5450 flags |= BP_MEM_READ;
5451 break;
5452 case 2:
5453 flags |= BP_MEM_WRITE;
5454 break;
5455 case 3:
5456 flags |= BP_MEM_ACCESS;
5457 break;
5458 }
5459
5460 /* Attempts to use both MASK and BAS fields simultaneously are
5461 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
5462 * thus generating a watchpoint for every byte in the masked region.
5463 */
5464 mask = extract64(wcr, 24, 4);
5465 if (mask == 1 || mask == 2) {
5466 /* Reserved values of MASK; we must act as if the mask value was
5467 * some non-reserved value, or as if the watchpoint were disabled.
5468 * We choose the latter.
5469 */
5470 return;
5471 } else if (mask) {
5472 /* Watchpoint covers an aligned area up to 2GB in size */
5473 len = 1ULL << mask;
5474 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
5475 * whether the watchpoint fires when the unmasked bits match; we opt
5476 * to generate the exceptions.
5477 */
5478 wvr &= ~(len - 1);
5479 } else {
5480 /* Watchpoint covers bytes defined by the byte address select bits */
5481 int bas = extract64(wcr, 5, 8);
5482 int basstart;
5483
5484 if (bas == 0) {
5485 /* This must act as if the watchpoint is disabled */
5486 return;
5487 }
5488
5489 if (extract64(wvr, 2, 1)) {
5490 /* Deprecated case of an only 4-aligned address. BAS[7:4] are
5491 * ignored, and BAS[3:0] define which bytes to watch.
5492 */
5493 bas &= 0xf;
5494 }
5495 /* The BAS bits are supposed to be programmed to indicate a contiguous
5496 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
5497 * we fire for each byte in the word/doubleword addressed by the WVR.
5498 * We choose to ignore any non-zero bits after the first range of 1s.
5499 */
5500 basstart = ctz32(bas);
5501 len = cto32(bas >> basstart);
5502 wvr += basstart;
5503 }
5504
5505 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
5506 &env->cpu_watchpoint[n]);
5507}
5508
5509void hw_watchpoint_update_all(ARMCPU *cpu)
5510{
5511 int i;
5512 CPUARMState *env = &cpu->env;
5513
5514 /* Completely clear out existing QEMU watchpoints and our array, to
5515 * avoid possible stale entries following migration load.
5516 */
5517 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
5518 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
5519
5520 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
5521 hw_watchpoint_update(cpu, i);
5522 }
5523}
5524
5525static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5526 uint64_t value)
5527{
5528 ARMCPU *cpu = env_archcpu(env);
5529 int i = ri->crm;
5530
5531 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
5532 * register reads and behaves as if values written are sign extended.
5533 * Bits [1:0] are RES0.
5534 */
5535 value = sextract64(value, 0, 49) & ~3ULL;
5536
5537 raw_write(env, ri, value);
5538 hw_watchpoint_update(cpu, i);
5539}
5540
5541static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5542 uint64_t value)
5543{
5544 ARMCPU *cpu = env_archcpu(env);
5545 int i = ri->crm;
5546
5547 raw_write(env, ri, value);
5548 hw_watchpoint_update(cpu, i);
5549}
5550
5551void hw_breakpoint_update(ARMCPU *cpu, int n)
5552{
5553 CPUARMState *env = &cpu->env;
5554 uint64_t bvr = env->cp15.dbgbvr[n];
5555 uint64_t bcr = env->cp15.dbgbcr[n];
5556 vaddr addr;
5557 int bt;
5558 int flags = BP_CPU;
5559
5560 if (env->cpu_breakpoint[n]) {
5561 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
5562 env->cpu_breakpoint[n] = NULL;
5563 }
5564
5565 if (!extract64(bcr, 0, 1)) {
5566 /* E bit clear : watchpoint disabled */
5567 return;
5568 }
5569
5570 bt = extract64(bcr, 20, 4);
5571
5572 switch (bt) {
5573 case 4: /* unlinked address mismatch (reserved if AArch64) */
5574 case 5: /* linked address mismatch (reserved if AArch64) */
5575 qemu_log_mask(LOG_UNIMP,
5576 "arm: address mismatch breakpoint types not implemented\n");
5577 return;
5578 case 0: /* unlinked address match */
5579 case 1: /* linked address match */
5580 {
5581 /* Bits [63:49] are hardwired to the value of bit [48]; that is,
5582 * we behave as if the register was sign extended. Bits [1:0] are
5583 * RES0. The BAS field is used to allow setting breakpoints on 16
5584 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
5585 * a bp will fire if the addresses covered by the bp and the addresses
5586 * covered by the insn overlap but the insn doesn't start at the
5587 * start of the bp address range. We choose to require the insn and
5588 * the bp to have the same address. The constraints on writing to
5589 * BAS enforced in dbgbcr_write mean we have only four cases:
5590 * 0b0000 => no breakpoint
5591 * 0b0011 => breakpoint on addr
5592 * 0b1100 => breakpoint on addr + 2
5593 * 0b1111 => breakpoint on addr
5594 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
5595 */
5596 int bas = extract64(bcr, 5, 4);
5597 addr = sextract64(bvr, 0, 49) & ~3ULL;
5598 if (bas == 0) {
5599 return;
5600 }
5601 if (bas == 0xc) {
5602 addr += 2;
5603 }
5604 break;
5605 }
5606 case 2: /* unlinked context ID match */
5607 case 8: /* unlinked VMID match (reserved if no EL2) */
5608 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
5609 qemu_log_mask(LOG_UNIMP,
5610 "arm: unlinked context breakpoint types not implemented\n");
5611 return;
5612 case 9: /* linked VMID match (reserved if no EL2) */
5613 case 11: /* linked context ID and VMID match (reserved if no EL2) */
5614 case 3: /* linked context ID match */
5615 default:
5616 /* We must generate no events for Linked context matches (unless
5617 * they are linked to by some other bp/wp, which is handled in
5618 * updates for the linking bp/wp). We choose to also generate no events
5619 * for reserved values.
5620 */
5621 return;
5622 }
5623
5624 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
5625}
5626
5627void hw_breakpoint_update_all(ARMCPU *cpu)
5628{
5629 int i;
5630 CPUARMState *env = &cpu->env;
5631
5632 /* Completely clear out existing QEMU breakpoints and our array, to
5633 * avoid possible stale entries following migration load.
5634 */
5635 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
5636 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
5637
5638 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
5639 hw_breakpoint_update(cpu, i);
5640 }
5641}
5642
5643static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5644 uint64_t value)
5645{
5646 ARMCPU *cpu = env_archcpu(env);
5647 int i = ri->crm;
5648
5649 raw_write(env, ri, value);
5650 hw_breakpoint_update(cpu, i);
5651}
5652
5653static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5654 uint64_t value)
5655{
5656 ARMCPU *cpu = env_archcpu(env);
5657 int i = ri->crm;
5658
5659 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
5660 * copy of BAS[0].
5661 */
5662 value = deposit64(value, 6, 1, extract64(value, 5, 1));
5663 value = deposit64(value, 8, 1, extract64(value, 7, 1));
5664
5665 raw_write(env, ri, value);
5666 hw_breakpoint_update(cpu, i);
5667}
5668
5669static void define_debug_regs(ARMCPU *cpu)
5670{
5671 /* Define v7 and v8 architectural debug registers.
5672 * These are just dummy implementations for now.
5673 */
5674 int i;
5675 int wrps, brps, ctx_cmps;
5676 ARMCPRegInfo dbgdidr = {
5677 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
5678 .access = PL0_R, .accessfn = access_tda,
5679 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
5680 };
5681
5682 /* Note that all these register fields hold "number of Xs minus 1". */
5683 brps = extract32(cpu->dbgdidr, 24, 4);
5684 wrps = extract32(cpu->dbgdidr, 28, 4);
5685 ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
5686
5687 assert(ctx_cmps <= brps);
5688
5689 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
5690 * of the debug registers such as number of breakpoints;
5691 * check that if they both exist then they agree.
5692 */
5693 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
5694 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
5695 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
5696 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
5697 }
5698
5699 define_one_arm_cp_reg(cpu, &dbgdidr);
5700 define_arm_cp_regs(cpu, debug_cp_reginfo);
5701
5702 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
5703 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
5704 }
5705
5706 for (i = 0; i < brps + 1; i++) {
5707 ARMCPRegInfo dbgregs[] = {
5708 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
5709 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
5710 .access = PL1_RW, .accessfn = access_tda,
5711 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
5712 .writefn = dbgbvr_write, .raw_writefn = raw_write
5713 },
5714 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
5715 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
5716 .access = PL1_RW, .accessfn = access_tda,
5717 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
5718 .writefn = dbgbcr_write, .raw_writefn = raw_write
5719 },
5720 REGINFO_SENTINEL
5721 };
5722 define_arm_cp_regs(cpu, dbgregs);
5723 }
5724
5725 for (i = 0; i < wrps + 1; i++) {
5726 ARMCPRegInfo dbgregs[] = {
5727 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
5728 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
5729 .access = PL1_RW, .accessfn = access_tda,
5730 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
5731 .writefn = dbgwvr_write, .raw_writefn = raw_write
5732 },
5733 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
5734 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
5735 .access = PL1_RW, .accessfn = access_tda,
5736 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
5737 .writefn = dbgwcr_write, .raw_writefn = raw_write
5738 },
5739 REGINFO_SENTINEL
5740 };
5741 define_arm_cp_regs(cpu, dbgregs);
5742 }
5743}
5744
5745/* We don't know until after realize whether there's a GICv3
5746 * attached, and that is what registers the gicv3 sysregs.
5747 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1
5748 * at runtime.
5749 */
5750static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
5751{
5752 ARMCPU *cpu = env_archcpu(env);
5753 uint64_t pfr1 = cpu->id_pfr1;
5754
5755 if (env->gicv3state) {
5756 pfr1 |= 1 << 28;
5757 }
5758 return pfr1;
5759}
5760
5761static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
5762{
5763 ARMCPU *cpu = env_archcpu(env);
5764 uint64_t pfr0 = cpu->isar.id_aa64pfr0;
5765
5766 if (env->gicv3state) {
5767 pfr0 |= 1 << 24;
5768 }
5769 return pfr0;
5770}
5771
5772/* Shared logic between LORID and the rest of the LOR* registers.
5773 * Secure state has already been delt with.
5774 */
5775static CPAccessResult access_lor_ns(CPUARMState *env)
5776{
5777 int el = arm_current_el(env);
5778
5779 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) {
5780 return CP_ACCESS_TRAP_EL2;
5781 }
5782 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) {
5783 return CP_ACCESS_TRAP_EL3;
5784 }
5785 return CP_ACCESS_OK;
5786}
5787
5788static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri,
5789 bool isread)
5790{
5791 if (arm_is_secure_below_el3(env)) {
5792 /* Access ok in secure mode. */
5793 return CP_ACCESS_OK;
5794 }
5795 return access_lor_ns(env);
5796}
5797
5798static CPAccessResult access_lor_other(CPUARMState *env,
5799 const ARMCPRegInfo *ri, bool isread)
5800{
5801 if (arm_is_secure_below_el3(env)) {
5802 /* Access denied in secure mode. */
5803 return CP_ACCESS_TRAP;
5804 }
5805 return access_lor_ns(env);
5806}
5807
5808#ifdef TARGET_AARCH64
5809static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri,
5810 bool isread)
5811{
5812 int el = arm_current_el(env);
5813
5814 if (el < 2 &&
5815 arm_feature(env, ARM_FEATURE_EL2) &&
5816 !(arm_hcr_el2_eff(env) & HCR_APK)) {
5817 return CP_ACCESS_TRAP_EL2;
5818 }
5819 if (el < 3 &&
5820 arm_feature(env, ARM_FEATURE_EL3) &&
5821 !(env->cp15.scr_el3 & SCR_APK)) {
5822 return CP_ACCESS_TRAP_EL3;
5823 }
5824 return CP_ACCESS_OK;
5825}
5826
5827static const ARMCPRegInfo pauth_reginfo[] = {
5828 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5829 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0,
5830 .access = PL1_RW, .accessfn = access_pauth,
5831 .fieldoffset = offsetof(CPUARMState, keys.apda.lo) },
5832 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5833 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1,
5834 .access = PL1_RW, .accessfn = access_pauth,
5835 .fieldoffset = offsetof(CPUARMState, keys.apda.hi) },
5836 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5837 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2,
5838 .access = PL1_RW, .accessfn = access_pauth,
5839 .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) },
5840 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5841 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3,
5842 .access = PL1_RW, .accessfn = access_pauth,
5843 .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) },
5844 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5845 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0,
5846 .access = PL1_RW, .accessfn = access_pauth,
5847 .fieldoffset = offsetof(CPUARMState, keys.apga.lo) },
5848 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5849 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1,
5850 .access = PL1_RW, .accessfn = access_pauth,
5851 .fieldoffset = offsetof(CPUARMState, keys.apga.hi) },
5852 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5853 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0,
5854 .access = PL1_RW, .accessfn = access_pauth,
5855 .fieldoffset = offsetof(CPUARMState, keys.apia.lo) },
5856 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5857 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1,
5858 .access = PL1_RW, .accessfn = access_pauth,
5859 .fieldoffset = offsetof(CPUARMState, keys.apia.hi) },
5860 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5861 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2,
5862 .access = PL1_RW, .accessfn = access_pauth,
5863 .fieldoffset = offsetof(CPUARMState, keys.apib.lo) },
5864 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5865 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3,
5866 .access = PL1_RW, .accessfn = access_pauth,
5867 .fieldoffset = offsetof(CPUARMState, keys.apib.hi) },
5868 REGINFO_SENTINEL
5869};
5870
5871static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
5872{
5873 Error *err = NULL;
5874 uint64_t ret;
5875
5876 /* Success sets NZCV = 0000. */
5877 env->NF = env->CF = env->VF = 0, env->ZF = 1;
5878
5879 if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) {
5880 /*
5881 * ??? Failed, for unknown reasons in the crypto subsystem.
5882 * The best we can do is log the reason and return the
5883 * timed-out indication to the guest. There is no reason
5884 * we know to expect this failure to be transitory, so the
5885 * guest may well hang retrying the operation.
5886 */
5887 qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
5888 ri->name, error_get_pretty(err));
5889 error_free(err);
5890
5891 env->ZF = 0; /* NZCF = 0100 */
5892 return 0;
5893 }
5894 return ret;
5895}
5896
5897/* We do not support re-seeding, so the two registers operate the same. */
5898static const ARMCPRegInfo rndr_reginfo[] = {
5899 { .name = "RNDR", .state = ARM_CP_STATE_AA64,
5900 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
5901 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0,
5902 .access = PL0_R, .readfn = rndr_readfn },
5903 { .name = "RNDRRS", .state = ARM_CP_STATE_AA64,
5904 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
5905 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1,
5906 .access = PL0_R, .readfn = rndr_readfn },
5907 REGINFO_SENTINEL
5908};
5909#endif
5910
5911static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri,
5912 bool isread)
5913{
5914 int el = arm_current_el(env);
5915
5916 if (el == 0) {
5917 uint64_t sctlr = arm_sctlr(env, el);
5918 if (!(sctlr & SCTLR_EnRCTX)) {
5919 return CP_ACCESS_TRAP;
5920 }
5921 } else if (el == 1) {
5922 uint64_t hcr = arm_hcr_el2_eff(env);
5923 if (hcr & HCR_NV) {
5924 return CP_ACCESS_TRAP_EL2;
5925 }
5926 }
5927 return CP_ACCESS_OK;
5928}
5929
5930static const ARMCPRegInfo predinv_reginfo[] = {
5931 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64,
5932 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4,
5933 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5934 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64,
5935 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5,
5936 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5937 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64,
5938 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7,
5939 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5940 /*
5941 * Note the AArch32 opcodes have a different OPC1.
5942 */
5943 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32,
5944 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4,
5945 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5946 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32,
5947 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5,
5948 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5949 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32,
5950 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7,
5951 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5952 REGINFO_SENTINEL
5953};
5954
5955void register_cp_regs_for_features(ARMCPU *cpu)
5956{
5957 /* Register all the coprocessor registers based on feature bits */
5958 CPUARMState *env = &cpu->env;
5959 if (arm_feature(env, ARM_FEATURE_M)) {
5960 /* M profile has no coprocessor registers */
5961 return;
5962 }
5963
5964 define_arm_cp_regs(cpu, cp_reginfo);
5965 if (!arm_feature(env, ARM_FEATURE_V8)) {
5966 /* Must go early as it is full of wildcards that may be
5967 * overridden by later definitions.
5968 */
5969 define_arm_cp_regs(cpu, not_v8_cp_reginfo);
5970 }
5971
5972 if (arm_feature(env, ARM_FEATURE_V6)) {
5973 /* The ID registers all have impdef reset values */
5974 ARMCPRegInfo v6_idregs[] = {
5975 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
5976 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
5977 .access = PL1_R, .type = ARM_CP_CONST,
5978 .resetvalue = cpu->id_pfr0 },
5979 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
5980 * the value of the GIC field until after we define these regs.
5981 */
5982 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
5983 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
5984 .access = PL1_R, .type = ARM_CP_NO_RAW,
5985 .readfn = id_pfr1_read,
5986 .writefn = arm_cp_write_ignore },
5987 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
5988 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
5989 .access = PL1_R, .type = ARM_CP_CONST,
5990 .resetvalue = cpu->id_dfr0 },
5991 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
5992 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
5993 .access = PL1_R, .type = ARM_CP_CONST,
5994 .resetvalue = cpu->id_afr0 },
5995 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
5996 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
5997 .access = PL1_R, .type = ARM_CP_CONST,
5998 .resetvalue = cpu->id_mmfr0 },
5999 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
6000 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
6001 .access = PL1_R, .type = ARM_CP_CONST,
6002 .resetvalue = cpu->id_mmfr1 },
6003 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
6004 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
6005 .access = PL1_R, .type = ARM_CP_CONST,
6006 .resetvalue = cpu->id_mmfr2 },
6007 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
6008 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
6009 .access = PL1_R, .type = ARM_CP_CONST,
6010 .resetvalue = cpu->id_mmfr3 },
6011 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
6012 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
6013 .access = PL1_R, .type = ARM_CP_CONST,
6014 .resetvalue = cpu->isar.id_isar0 },
6015 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
6016 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
6017 .access = PL1_R, .type = ARM_CP_CONST,
6018 .resetvalue = cpu->isar.id_isar1 },
6019 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
6020 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
6021 .access = PL1_R, .type = ARM_CP_CONST,
6022 .resetvalue = cpu->isar.id_isar2 },
6023 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
6024 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
6025 .access = PL1_R, .type = ARM_CP_CONST,
6026 .resetvalue = cpu->isar.id_isar3 },
6027 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
6028 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
6029 .access = PL1_R, .type = ARM_CP_CONST,
6030 .resetvalue = cpu->isar.id_isar4 },
6031 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
6032 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
6033 .access = PL1_R, .type = ARM_CP_CONST,
6034 .resetvalue = cpu->isar.id_isar5 },
6035 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
6036 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
6037 .access = PL1_R, .type = ARM_CP_CONST,
6038 .resetvalue = cpu->id_mmfr4 },
6039 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
6040 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
6041 .access = PL1_R, .type = ARM_CP_CONST,
6042 .resetvalue = cpu->isar.id_isar6 },
6043 REGINFO_SENTINEL
6044 };
6045 define_arm_cp_regs(cpu, v6_idregs);
6046 define_arm_cp_regs(cpu, v6_cp_reginfo);
6047 } else {
6048 define_arm_cp_regs(cpu, not_v6_cp_reginfo);
6049 }
6050 if (arm_feature(env, ARM_FEATURE_V6K)) {
6051 define_arm_cp_regs(cpu, v6k_cp_reginfo);
6052 }
6053 if (arm_feature(env, ARM_FEATURE_V7MP) &&
6054 !arm_feature(env, ARM_FEATURE_PMSA)) {
6055 define_arm_cp_regs(cpu, v7mp_cp_reginfo);
6056 }
6057 if (arm_feature(env, ARM_FEATURE_V7VE)) {
6058 define_arm_cp_regs(cpu, pmovsset_cp_reginfo);
6059 }
6060 if (arm_feature(env, ARM_FEATURE_V7)) {
6061 /* v7 performance monitor control register: same implementor
6062 * field as main ID register, and we implement four counters in
6063 * addition to the cycle count register.
6064 */
6065 unsigned int i, pmcrn = 4;
6066 ARMCPRegInfo pmcr = {
6067 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
6068 .access = PL0_RW,
6069 .type = ARM_CP_IO | ARM_CP_ALIAS,
6070 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
6071 .accessfn = pmreg_access, .writefn = pmcr_write,
6072 .raw_writefn = raw_write,
6073 };
6074 ARMCPRegInfo pmcr64 = {
6075 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
6076 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
6077 .access = PL0_RW, .accessfn = pmreg_access,
6078 .type = ARM_CP_IO,
6079 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
6080 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT),
6081 .writefn = pmcr_write, .raw_writefn = raw_write,
6082 };
6083 define_one_arm_cp_reg(cpu, &pmcr);
6084 define_one_arm_cp_reg(cpu, &pmcr64);
6085 for (i = 0; i < pmcrn; i++) {
6086 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i);
6087 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i);
6088 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i);
6089 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i);
6090 ARMCPRegInfo pmev_regs[] = {
6091 { .name = pmevcntr_name, .cp = 15, .crn = 14,
6092 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
6093 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
6094 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
6095 .accessfn = pmreg_access },
6096 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
6097 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
6098 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
6099 .type = ARM_CP_IO,
6100 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
6101 .raw_readfn = pmevcntr_rawread,
6102 .raw_writefn = pmevcntr_rawwrite },
6103 { .name = pmevtyper_name, .cp = 15, .crn = 14,
6104 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
6105 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
6106 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
6107 .accessfn = pmreg_access },
6108 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64,
6109 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)),
6110 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
6111 .type = ARM_CP_IO,
6112 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
6113 .raw_writefn = pmevtyper_rawwrite },
6114 REGINFO_SENTINEL
6115 };
6116 define_arm_cp_regs(cpu, pmev_regs);
6117 g_free(pmevcntr_name);
6118 g_free(pmevcntr_el0_name);
6119 g_free(pmevtyper_name);
6120 g_free(pmevtyper_el0_name);
6121 }
6122 ARMCPRegInfo clidr = {
6123 .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
6124 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
6125 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
6126 };
6127 define_one_arm_cp_reg(cpu, &clidr);
6128 define_arm_cp_regs(cpu, v7_cp_reginfo);
6129 define_debug_regs(cpu);
6130 } else {
6131 define_arm_cp_regs(cpu, not_v7_cp_reginfo);
6132 }
6133 if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 &&
6134 FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) {
6135 ARMCPRegInfo v81_pmu_regs[] = {
6136 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32,
6137 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4,
6138 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6139 .resetvalue = extract64(cpu->pmceid0, 32, 32) },
6140 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32,
6141 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5,
6142 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6143 .resetvalue = extract64(cpu->pmceid1, 32, 32) },
6144 REGINFO_SENTINEL
6145 };
6146 define_arm_cp_regs(cpu, v81_pmu_regs);
6147 }
6148 if (arm_feature(env, ARM_FEATURE_V8)) {
6149 /* AArch64 ID registers, which all have impdef reset values.
6150 * Note that within the ID register ranges the unused slots
6151 * must all RAZ, not UNDEF; future architecture versions may
6152 * define new registers here.
6153 */
6154 ARMCPRegInfo v8_idregs[] = {
6155 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't
6156 * know the right value for the GIC field until after we
6157 * define these regs.
6158 */
6159 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
6160 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
6161 .access = PL1_R, .type = ARM_CP_NO_RAW,
6162 .readfn = id_aa64pfr0_read,
6163 .writefn = arm_cp_write_ignore },
6164 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
6165 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
6166 .access = PL1_R, .type = ARM_CP_CONST,
6167 .resetvalue = cpu->isar.id_aa64pfr1},
6168 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6169 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
6170 .access = PL1_R, .type = ARM_CP_CONST,
6171 .resetvalue = 0 },
6172 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6173 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
6174 .access = PL1_R, .type = ARM_CP_CONST,
6175 .resetvalue = 0 },
6176 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
6177 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
6178 .access = PL1_R, .type = ARM_CP_CONST,
6179 /* At present, only SVEver == 0 is defined anyway. */
6180 .resetvalue = 0 },
6181 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6182 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
6183 .access = PL1_R, .type = ARM_CP_CONST,
6184 .resetvalue = 0 },
6185 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6186 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
6187 .access = PL1_R, .type = ARM_CP_CONST,
6188 .resetvalue = 0 },
6189 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6190 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
6191 .access = PL1_R, .type = ARM_CP_CONST,
6192 .resetvalue = 0 },
6193 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
6194 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
6195 .access = PL1_R, .type = ARM_CP_CONST,
6196 .resetvalue = cpu->id_aa64dfr0 },
6197 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
6198 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
6199 .access = PL1_R, .type = ARM_CP_CONST,
6200 .resetvalue = cpu->id_aa64dfr1 },
6201 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6202 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
6203 .access = PL1_R, .type = ARM_CP_CONST,
6204 .resetvalue = 0 },
6205 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6206 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
6207 .access = PL1_R, .type = ARM_CP_CONST,
6208 .resetvalue = 0 },
6209 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
6210 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
6211 .access = PL1_R, .type = ARM_CP_CONST,
6212 .resetvalue = cpu->id_aa64afr0 },
6213 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
6214 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
6215 .access = PL1_R, .type = ARM_CP_CONST,
6216 .resetvalue = cpu->id_aa64afr1 },
6217 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6218 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
6219 .access = PL1_R, .type = ARM_CP_CONST,
6220 .resetvalue = 0 },
6221 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6222 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
6223 .access = PL1_R, .type = ARM_CP_CONST,
6224 .resetvalue = 0 },
6225 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
6226 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
6227 .access = PL1_R, .type = ARM_CP_CONST,
6228 .resetvalue = cpu->isar.id_aa64isar0 },
6229 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
6230 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
6231 .access = PL1_R, .type = ARM_CP_CONST,
6232 .resetvalue = cpu->isar.id_aa64isar1 },
6233 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6234 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
6235 .access = PL1_R, .type = ARM_CP_CONST,
6236 .resetvalue = 0 },
6237 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6238 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
6239 .access = PL1_R, .type = ARM_CP_CONST,
6240 .resetvalue = 0 },
6241 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6242 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
6243 .access = PL1_R, .type = ARM_CP_CONST,
6244 .resetvalue = 0 },
6245 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6246 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
6247 .access = PL1_R, .type = ARM_CP_CONST,
6248 .resetvalue = 0 },
6249 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6250 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
6251 .access = PL1_R, .type = ARM_CP_CONST,
6252 .resetvalue = 0 },
6253 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6254 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
6255 .access = PL1_R, .type = ARM_CP_CONST,
6256 .resetvalue = 0 },
6257 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
6258 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
6259 .access = PL1_R, .type = ARM_CP_CONST,
6260 .resetvalue = cpu->isar.id_aa64mmfr0 },
6261 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
6262 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
6263 .access = PL1_R, .type = ARM_CP_CONST,
6264 .resetvalue = cpu->isar.id_aa64mmfr1 },
6265 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6266 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
6267 .access = PL1_R, .type = ARM_CP_CONST,
6268 .resetvalue = 0 },
6269 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6270 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
6271 .access = PL1_R, .type = ARM_CP_CONST,
6272 .resetvalue = 0 },
6273 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6274 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
6275 .access = PL1_R, .type = ARM_CP_CONST,
6276 .resetvalue = 0 },
6277 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6278 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
6279 .access = PL1_R, .type = ARM_CP_CONST,
6280 .resetvalue = 0 },
6281 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6282 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
6283 .access = PL1_R, .type = ARM_CP_CONST,
6284 .resetvalue = 0 },
6285 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6286 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
6287 .access = PL1_R, .type = ARM_CP_CONST,
6288 .resetvalue = 0 },
6289 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
6290 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
6291 .access = PL1_R, .type = ARM_CP_CONST,
6292 .resetvalue = cpu->isar.mvfr0 },
6293 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
6294 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
6295 .access = PL1_R, .type = ARM_CP_CONST,
6296 .resetvalue = cpu->isar.mvfr1 },
6297 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
6298 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
6299 .access = PL1_R, .type = ARM_CP_CONST,
6300 .resetvalue = cpu->isar.mvfr2 },
6301 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6302 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
6303 .access = PL1_R, .type = ARM_CP_CONST,
6304 .resetvalue = 0 },
6305 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6306 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
6307 .access = PL1_R, .type = ARM_CP_CONST,
6308 .resetvalue = 0 },
6309 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6310 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
6311 .access = PL1_R, .type = ARM_CP_CONST,
6312 .resetvalue = 0 },
6313 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6314 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
6315 .access = PL1_R, .type = ARM_CP_CONST,
6316 .resetvalue = 0 },
6317 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6318 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
6319 .access = PL1_R, .type = ARM_CP_CONST,
6320 .resetvalue = 0 },
6321 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
6322 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
6323 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6324 .resetvalue = extract64(cpu->pmceid0, 0, 32) },
6325 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64,
6326 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6,
6327 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6328 .resetvalue = cpu->pmceid0 },
6329 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32,
6330 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7,
6331 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6332 .resetvalue = extract64(cpu->pmceid1, 0, 32) },
6333 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64,
6334 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
6335 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6336 .resetvalue = cpu->pmceid1 },
6337 REGINFO_SENTINEL
6338 };
6339#ifdef CONFIG_USER_ONLY
6340 ARMCPRegUserSpaceInfo v8_user_idregs[] = {
6341 { .name = "ID_AA64PFR0_EL1",
6342 .exported_bits = 0x000f000f00ff0000,
6343 .fixed_bits = 0x0000000000000011 },
6344 { .name = "ID_AA64PFR1_EL1",
6345 .exported_bits = 0x00000000000000f0 },
6346 { .name = "ID_AA64PFR*_EL1_RESERVED",
6347 .is_glob = true },
6348 { .name = "ID_AA64ZFR0_EL1" },
6349 { .name = "ID_AA64MMFR0_EL1",
6350 .fixed_bits = 0x00000000ff000000 },
6351 { .name = "ID_AA64MMFR1_EL1" },
6352 { .name = "ID_AA64MMFR*_EL1_RESERVED",
6353 .is_glob = true },
6354 { .name = "ID_AA64DFR0_EL1",
6355 .fixed_bits = 0x0000000000000006 },
6356 { .name = "ID_AA64DFR1_EL1" },
6357 { .name = "ID_AA64DFR*_EL1_RESERVED",
6358 .is_glob = true },
6359 { .name = "ID_AA64AFR*",
6360 .is_glob = true },
6361 { .name = "ID_AA64ISAR0_EL1",
6362 .exported_bits = 0x00fffffff0fffff0 },
6363 { .name = "ID_AA64ISAR1_EL1",
6364 .exported_bits = 0x000000f0ffffffff },
6365 { .name = "ID_AA64ISAR*_EL1_RESERVED",
6366 .is_glob = true },
6367 REGUSERINFO_SENTINEL
6368 };
6369 modify_arm_cp_regs(v8_idregs, v8_user_idregs);
6370#endif
6371 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
6372 if (!arm_feature(env, ARM_FEATURE_EL3) &&
6373 !arm_feature(env, ARM_FEATURE_EL2)) {
6374 ARMCPRegInfo rvbar = {
6375 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
6376 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
6377 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
6378 };
6379 define_one_arm_cp_reg(cpu, &rvbar);
6380 }
6381 define_arm_cp_regs(cpu, v8_idregs);
6382 define_arm_cp_regs(cpu, v8_cp_reginfo);
6383 }
6384 if (arm_feature(env, ARM_FEATURE_EL2)) {
6385 uint64_t vmpidr_def = mpidr_read_val(env);
6386 ARMCPRegInfo vpidr_regs[] = {
6387 { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
6388 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6389 .access = PL2_RW, .accessfn = access_el3_aa32ns,
6390 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS,
6391 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
6392 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
6393 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6394 .access = PL2_RW, .resetvalue = cpu->midr,
6395 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
6396 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
6397 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6398 .access = PL2_RW, .accessfn = access_el3_aa32ns,
6399 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS,
6400 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
6401 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
6402 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6403 .access = PL2_RW,
6404 .resetvalue = vmpidr_def,
6405 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
6406 REGINFO_SENTINEL
6407 };
6408 define_arm_cp_regs(cpu, vpidr_regs);
6409 define_arm_cp_regs(cpu, el2_cp_reginfo);
6410 if (arm_feature(env, ARM_FEATURE_V8)) {
6411 define_arm_cp_regs(cpu, el2_v8_cp_reginfo);
6412 }
6413 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
6414 if (!arm_feature(env, ARM_FEATURE_EL3)) {
6415 ARMCPRegInfo rvbar = {
6416 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
6417 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
6418 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
6419 };
6420 define_one_arm_cp_reg(cpu, &rvbar);
6421 }
6422 } else {
6423 /* If EL2 is missing but higher ELs are enabled, we need to
6424 * register the no_el2 reginfos.
6425 */
6426 if (arm_feature(env, ARM_FEATURE_EL3)) {
6427 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
6428 * of MIDR_EL1 and MPIDR_EL1.
6429 */
6430 ARMCPRegInfo vpidr_regs[] = {
6431 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,
6432 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6433 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
6434 .type = ARM_CP_CONST, .resetvalue = cpu->midr,
6435 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
6436 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,
6437 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6438 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
6439 .type = ARM_CP_NO_RAW,
6440 .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
6441 REGINFO_SENTINEL
6442 };
6443 define_arm_cp_regs(cpu, vpidr_regs);
6444 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
6445 if (arm_feature(env, ARM_FEATURE_V8)) {
6446 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo);
6447 }
6448 }
6449 }
6450 if (arm_feature(env, ARM_FEATURE_EL3)) {
6451 define_arm_cp_regs(cpu, el3_cp_reginfo);
6452 ARMCPRegInfo el3_regs[] = {
6453 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
6454 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
6455 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },
6456 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
6457 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
6458 .access = PL3_RW,
6459 .raw_writefn = raw_write, .writefn = sctlr_write,
6460 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]),
6461 .resetvalue = cpu->reset_sctlr },
6462 REGINFO_SENTINEL
6463 };
6464
6465 define_arm_cp_regs(cpu, el3_regs);
6466 }
6467 /* The behaviour of NSACR is sufficiently various that we don't
6468 * try to describe it in a single reginfo:
6469 * if EL3 is 64 bit, then trap to EL3 from S EL1,
6470 * reads as constant 0xc00 from NS EL1 and NS EL2
6471 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2
6472 * if v7 without EL3, register doesn't exist
6473 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2
6474 */
6475 if (arm_feature(env, ARM_FEATURE_EL3)) {
6476 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6477 ARMCPRegInfo nsacr = {
6478 .name = "NSACR", .type = ARM_CP_CONST,
6479 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6480 .access = PL1_RW, .accessfn = nsacr_access,
6481 .resetvalue = 0xc00
6482 };
6483 define_one_arm_cp_reg(cpu, &nsacr);
6484 } else {
6485 ARMCPRegInfo nsacr = {
6486 .name = "NSACR",
6487 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6488 .access = PL3_RW | PL1_R,
6489 .resetvalue = 0,
6490 .fieldoffset = offsetof(CPUARMState, cp15.nsacr)
6491 };
6492 define_one_arm_cp_reg(cpu, &nsacr);
6493 }
6494 } else {
6495 if (arm_feature(env, ARM_FEATURE_V8)) {
6496 ARMCPRegInfo nsacr = {
6497 .name = "NSACR", .type = ARM_CP_CONST,
6498 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6499 .access = PL1_R,
6500 .resetvalue = 0xc00
6501 };
6502 define_one_arm_cp_reg(cpu, &nsacr);
6503 }
6504 }
6505
6506 if (arm_feature(env, ARM_FEATURE_PMSA)) {
6507 if (arm_feature(env, ARM_FEATURE_V6)) {
6508 /* PMSAv6 not implemented */
6509 assert(arm_feature(env, ARM_FEATURE_V7));
6510 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
6511 define_arm_cp_regs(cpu, pmsav7_cp_reginfo);
6512 } else {
6513 define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
6514 }
6515 } else {
6516 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
6517 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
6518 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */
6519 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) {
6520 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo);
6521 }
6522 }
6523 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
6524 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
6525 }
6526 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
6527 define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
6528 }
6529 if (arm_feature(env, ARM_FEATURE_VAPA)) {
6530 define_arm_cp_regs(cpu, vapa_cp_reginfo);
6531 }
6532 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
6533 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
6534 }
6535 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
6536 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
6537 }
6538 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
6539 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
6540 }
6541 if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
6542 define_arm_cp_regs(cpu, omap_cp_reginfo);
6543 }
6544 if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
6545 define_arm_cp_regs(cpu, strongarm_cp_reginfo);
6546 }
6547 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
6548 define_arm_cp_regs(cpu, xscale_cp_reginfo);
6549 }
6550 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
6551 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
6552 }
6553 if (arm_feature(env, ARM_FEATURE_LPAE)) {
6554 define_arm_cp_regs(cpu, lpae_cp_reginfo);
6555 }
6556 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
6557 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
6558 * be read-only (ie write causes UNDEF exception).
6559 */
6560 {
6561 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
6562 /* Pre-v8 MIDR space.
6563 * Note that the MIDR isn't a simple constant register because
6564 * of the TI925 behaviour where writes to another register can
6565 * cause the MIDR value to change.
6566 *
6567 * Unimplemented registers in the c15 0 0 0 space default to
6568 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
6569 * and friends override accordingly.
6570 */
6571 { .name = "MIDR",
6572 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
6573 .access = PL1_R, .resetvalue = cpu->midr,
6574 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
6575 .readfn = midr_read,
6576 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
6577 .type = ARM_CP_OVERRIDE },
6578 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
6579 { .name = "DUMMY",
6580 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
6581 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6582 { .name = "DUMMY",
6583 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
6584 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6585 { .name = "DUMMY",
6586 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
6587 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6588 { .name = "DUMMY",
6589 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
6590 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6591 { .name = "DUMMY",
6592 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
6593 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6594 REGINFO_SENTINEL
6595 };
6596 ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
6597 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
6598 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
6599 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr,
6600 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
6601 .readfn = midr_read },
6602 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */
6603 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
6604 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
6605 .access = PL1_R, .resetvalue = cpu->midr },
6606 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
6607 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7,
6608 .access = PL1_R, .resetvalue = cpu->midr },
6609 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
6610 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
6611 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
6612 REGINFO_SENTINEL
6613 };
6614 ARMCPRegInfo id_cp_reginfo[] = {
6615 /* These are common to v8 and pre-v8 */
6616 { .name = "CTR",
6617 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
6618 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
6619 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
6620 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
6621 .access = PL0_R, .accessfn = ctr_el0_access,
6622 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
6623 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
6624 { .name = "TCMTR",
6625 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
6626 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6627 REGINFO_SENTINEL
6628 };
6629 /* TLBTR is specific to VMSA */
6630 ARMCPRegInfo id_tlbtr_reginfo = {
6631 .name = "TLBTR",
6632 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
6633 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0,
6634 };
6635 /* MPUIR is specific to PMSA V6+ */
6636 ARMCPRegInfo id_mpuir_reginfo = {
6637 .name = "MPUIR",
6638 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
6639 .access = PL1_R, .type = ARM_CP_CONST,
6640 .resetvalue = cpu->pmsav7_dregion << 8
6641 };
6642 ARMCPRegInfo crn0_wi_reginfo = {
6643 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
6644 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
6645 .type = ARM_CP_NOP | ARM_CP_OVERRIDE
6646 };
6647#ifdef CONFIG_USER_ONLY
6648 ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
6649 { .name = "MIDR_EL1",
6650 .exported_bits = 0x00000000ffffffff },
6651 { .name = "REVIDR_EL1" },
6652 REGUSERINFO_SENTINEL
6653 };
6654 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo);
6655#endif
6656 if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
6657 arm_feature(env, ARM_FEATURE_STRONGARM)) {
6658 ARMCPRegInfo *r;
6659 /* Register the blanket "writes ignored" value first to cover the
6660 * whole space. Then update the specific ID registers to allow write
6661 * access, so that they ignore writes rather than causing them to
6662 * UNDEF.
6663 */
6664 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
6665 for (r = id_pre_v8_midr_cp_reginfo;
6666 r->type != ARM_CP_SENTINEL; r++) {
6667 r->access = PL1_RW;
6668 }
6669 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
6670 r->access = PL1_RW;
6671 }
6672 id_mpuir_reginfo.access = PL1_RW;
6673 id_tlbtr_reginfo.access = PL1_RW;
6674 }
6675 if (arm_feature(env, ARM_FEATURE_V8)) {
6676 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
6677 } else {
6678 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
6679 }
6680 define_arm_cp_regs(cpu, id_cp_reginfo);
6681 if (!arm_feature(env, ARM_FEATURE_PMSA)) {
6682 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
6683 } else if (arm_feature(env, ARM_FEATURE_V7)) {
6684 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
6685 }
6686 }
6687
6688 if (arm_feature(env, ARM_FEATURE_MPIDR)) {
6689 ARMCPRegInfo mpidr_cp_reginfo[] = {
6690 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH,
6691 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
6692 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
6693 REGINFO_SENTINEL
6694 };
6695#ifdef CONFIG_USER_ONLY
6696 ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
6697 { .name = "MPIDR_EL1",
6698 .fixed_bits = 0x0000000080000000 },
6699 REGUSERINFO_SENTINEL
6700 };
6701 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo);
6702#endif
6703 define_arm_cp_regs(cpu, mpidr_cp_reginfo);
6704 }
6705
6706 if (arm_feature(env, ARM_FEATURE_AUXCR)) {
6707 ARMCPRegInfo auxcr_reginfo[] = {
6708 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
6709 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
6710 .access = PL1_RW, .type = ARM_CP_CONST,
6711 .resetvalue = cpu->reset_auxcr },
6712 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH,
6713 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1,
6714 .access = PL2_RW, .type = ARM_CP_CONST,
6715 .resetvalue = 0 },
6716 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64,
6717 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
6718 .access = PL3_RW, .type = ARM_CP_CONST,
6719 .resetvalue = 0 },
6720 REGINFO_SENTINEL
6721 };
6722 define_arm_cp_regs(cpu, auxcr_reginfo);
6723 if (arm_feature(env, ARM_FEATURE_V8)) {
6724 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */
6725 ARMCPRegInfo hactlr2_reginfo = {
6726 .name = "HACTLR2", .state = ARM_CP_STATE_AA32,
6727 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3,
6728 .access = PL2_RW, .type = ARM_CP_CONST,
6729 .resetvalue = 0
6730 };
6731 define_one_arm_cp_reg(cpu, &hactlr2_reginfo);
6732 }
6733 }
6734
6735 if (arm_feature(env, ARM_FEATURE_CBAR)) {
6736 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6737 /* 32 bit view is [31:18] 0...0 [43:32]. */
6738 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
6739 | extract64(cpu->reset_cbar, 32, 12);
6740 ARMCPRegInfo cbar_reginfo[] = {
6741 { .name = "CBAR",
6742 .type = ARM_CP_CONST,
6743 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
6744 .access = PL1_R, .resetvalue = cpu->reset_cbar },
6745 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
6746 .type = ARM_CP_CONST,
6747 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
6748 .access = PL1_R, .resetvalue = cbar32 },
6749 REGINFO_SENTINEL
6750 };
6751 /* We don't implement a r/w 64 bit CBAR currently */
6752 assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
6753 define_arm_cp_regs(cpu, cbar_reginfo);
6754 } else {
6755 ARMCPRegInfo cbar = {
6756 .name = "CBAR",
6757 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
6758 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
6759 .fieldoffset = offsetof(CPUARMState,
6760 cp15.c15_config_base_address)
6761 };
6762 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
6763 cbar.access = PL1_R;
6764 cbar.fieldoffset = 0;
6765 cbar.type = ARM_CP_CONST;
6766 }
6767 define_one_arm_cp_reg(cpu, &cbar);
6768 }
6769 }
6770
6771 if (arm_feature(env, ARM_FEATURE_VBAR)) {
6772 ARMCPRegInfo vbar_cp_reginfo[] = {
6773 { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
6774 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
6775 .access = PL1_RW, .writefn = vbar_write,
6776 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
6777 offsetof(CPUARMState, cp15.vbar_ns) },
6778 .resetvalue = 0 },
6779 REGINFO_SENTINEL
6780 };
6781 define_arm_cp_regs(cpu, vbar_cp_reginfo);
6782 }
6783
6784 /* Generic registers whose values depend on the implementation */
6785 {
6786 ARMCPRegInfo sctlr = {
6787 .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
6788 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
6789 .access = PL1_RW,
6790 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
6791 offsetof(CPUARMState, cp15.sctlr_ns) },
6792 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
6793 .raw_writefn = raw_write,
6794 };
6795 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
6796 /* Normally we would always end the TB on an SCTLR write, but Linux
6797 * arch/arm/mach-pxa/sleep.S expects two instructions following
6798 * an MMU enable to execute from cache. Imitate this behaviour.
6799 */
6800 sctlr.type |= ARM_CP_SUPPRESS_TB_END;
6801 }
6802 define_one_arm_cp_reg(cpu, &sctlr);
6803 }
6804
6805 if (cpu_isar_feature(aa64_lor, cpu)) {
6806 /*
6807 * A trivial implementation of ARMv8.1-LOR leaves all of these
6808 * registers fixed at 0, which indicates that there are zero
6809 * supported Limited Ordering regions.
6810 */
6811 static const ARMCPRegInfo lor_reginfo[] = {
6812 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64,
6813 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0,
6814 .access = PL1_RW, .accessfn = access_lor_other,
6815 .type = ARM_CP_CONST, .resetvalue = 0 },
6816 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64,
6817 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1,
6818 .access = PL1_RW, .accessfn = access_lor_other,
6819 .type = ARM_CP_CONST, .resetvalue = 0 },
6820 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64,
6821 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2,
6822 .access = PL1_RW, .accessfn = access_lor_other,
6823 .type = ARM_CP_CONST, .resetvalue = 0 },
6824 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64,
6825 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3,
6826 .access = PL1_RW, .accessfn = access_lor_other,
6827 .type = ARM_CP_CONST, .resetvalue = 0 },
6828 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64,
6829 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7,
6830 .access = PL1_R, .accessfn = access_lorid,
6831 .type = ARM_CP_CONST, .resetvalue = 0 },
6832 REGINFO_SENTINEL
6833 };
6834 define_arm_cp_regs(cpu, lor_reginfo);
6835 }
6836
6837 if (cpu_isar_feature(aa64_sve, cpu)) {
6838 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo);
6839 if (arm_feature(env, ARM_FEATURE_EL2)) {
6840 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo);
6841 } else {
6842 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo);
6843 }
6844 if (arm_feature(env, ARM_FEATURE_EL3)) {
6845 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo);
6846 }
6847 }
6848
6849#ifdef TARGET_AARCH64
6850 if (cpu_isar_feature(aa64_pauth, cpu)) {
6851 define_arm_cp_regs(cpu, pauth_reginfo);
6852 }
6853 if (cpu_isar_feature(aa64_rndr, cpu)) {
6854 define_arm_cp_regs(cpu, rndr_reginfo);
6855 }
6856#endif
6857
6858 /*
6859 * While all v8.0 cpus support aarch64, QEMU does have configurations
6860 * that do not set ID_AA64ISAR1, e.g. user-only qemu-arm -cpu max,
6861 * which will set ID_ISAR6.
6862 */
6863 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
6864 ? cpu_isar_feature(aa64_predinv, cpu)
6865 : cpu_isar_feature(aa32_predinv, cpu)) {
6866 define_arm_cp_regs(cpu, predinv_reginfo);
6867 }
6868}
6869
6870void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
6871{
6872 CPUState *cs = CPU(cpu);
6873 CPUARMState *env = &cpu->env;
6874
6875 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6876 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
6877 aarch64_fpu_gdb_set_reg,
6878 34, "aarch64-fpu.xml", 0);
6879 } else if (arm_feature(env, ARM_FEATURE_NEON)) {
6880 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
6881 51, "arm-neon.xml", 0);
6882 } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
6883 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
6884 35, "arm-vfp3.xml", 0);
6885 } else if (arm_feature(env, ARM_FEATURE_VFP)) {
6886 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
6887 19, "arm-vfp.xml", 0);
6888 }
6889 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg,
6890 arm_gen_dynamic_xml(cs),
6891 "system-registers.xml", 0);
6892}
6893
6894/* Sort alphabetically by type name, except for "any". */
6895static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
6896{
6897 ObjectClass *class_a = (ObjectClass *)a;
6898 ObjectClass *class_b = (ObjectClass *)b;
6899 const char *name_a, *name_b;
6900
6901 name_a = object_class_get_name(class_a);
6902 name_b = object_class_get_name(class_b);
6903 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
6904 return 1;
6905 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
6906 return -1;
6907 } else {
6908 return strcmp(name_a, name_b);
6909 }
6910}
6911
6912static void arm_cpu_list_entry(gpointer data, gpointer user_data)
6913{
6914 ObjectClass *oc = data;
6915 const char *typename;
6916 char *name;
6917
6918 typename = object_class_get_name(oc);
6919 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
6920 qemu_printf(" %s\n", name);
6921 g_free(name);
6922}
6923
6924void arm_cpu_list(void)
6925{
6926 GSList *list;
6927
6928 list = object_class_get_list(TYPE_ARM_CPU, false);
6929 list = g_slist_sort(list, arm_cpu_list_compare);
6930 qemu_printf("Available CPUs:\n");
6931 g_slist_foreach(list, arm_cpu_list_entry, NULL);
6932 g_slist_free(list);
6933}
6934
6935static void arm_cpu_add_definition(gpointer data, gpointer user_data)
6936{
6937 ObjectClass *oc = data;
6938 CpuDefinitionInfoList **cpu_list = user_data;
6939 CpuDefinitionInfoList *entry;
6940 CpuDefinitionInfo *info;
6941 const char *typename;
6942
6943 typename = object_class_get_name(oc);
6944 info = g_malloc0(sizeof(*info));
6945 info->name = g_strndup(typename,
6946 strlen(typename) - strlen("-" TYPE_ARM_CPU));
6947 info->q_typename = g_strdup(typename);
6948
6949 entry = g_malloc0(sizeof(*entry));
6950 entry->value = info;
6951 entry->next = *cpu_list;
6952 *cpu_list = entry;
6953}
6954
6955CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
6956{
6957 CpuDefinitionInfoList *cpu_list = NULL;
6958 GSList *list;
6959
6960 list = object_class_get_list(TYPE_ARM_CPU, false);
6961 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
6962 g_slist_free(list);
6963
6964 return cpu_list;
6965}
6966
6967static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
6968 void *opaque, int state, int secstate,
6969 int crm, int opc1, int opc2,
6970 const char *name)
6971{
6972 /* Private utility function for define_one_arm_cp_reg_with_opaque():
6973 * add a single reginfo struct to the hash table.
6974 */
6975 uint32_t *key = g_new(uint32_t, 1);
6976 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
6977 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
6978 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
6979
6980 r2->name = g_strdup(name);
6981 /* Reset the secure state to the specific incoming state. This is
6982 * necessary as the register may have been defined with both states.
6983 */
6984 r2->secure = secstate;
6985
6986 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
6987 /* Register is banked (using both entries in array).
6988 * Overwriting fieldoffset as the array is only used to define
6989 * banked registers but later only fieldoffset is used.
6990 */
6991 r2->fieldoffset = r->bank_fieldoffsets[ns];
6992 }
6993
6994 if (state == ARM_CP_STATE_AA32) {
6995 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
6996 /* If the register is banked then we don't need to migrate or
6997 * reset the 32-bit instance in certain cases:
6998 *
6999 * 1) If the register has both 32-bit and 64-bit instances then we
7000 * can count on the 64-bit instance taking care of the
7001 * non-secure bank.
7002 * 2) If ARMv8 is enabled then we can count on a 64-bit version
7003 * taking care of the secure bank. This requires that separate
7004 * 32 and 64-bit definitions are provided.
7005 */
7006 if ((r->state == ARM_CP_STATE_BOTH && ns) ||
7007 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
7008 r2->type |= ARM_CP_ALIAS;
7009 }
7010 } else if ((secstate != r->secure) && !ns) {
7011 /* The register is not banked so we only want to allow migration of
7012 * the non-secure instance.
7013 */
7014 r2->type |= ARM_CP_ALIAS;
7015 }
7016
7017 if (r->state == ARM_CP_STATE_BOTH) {
7018 /* We assume it is a cp15 register if the .cp field is left unset.
7019 */
7020 if (r2->cp == 0) {
7021 r2->cp = 15;
7022 }
7023
7024#ifdef HOST_WORDS_BIGENDIAN
7025 if (r2->fieldoffset) {
7026 r2->fieldoffset += sizeof(uint32_t);
7027 }
7028#endif
7029 }
7030 }
7031 if (state == ARM_CP_STATE_AA64) {
7032 /* To allow abbreviation of ARMCPRegInfo
7033 * definitions, we treat cp == 0 as equivalent to
7034 * the value for "standard guest-visible sysreg".
7035 * STATE_BOTH definitions are also always "standard
7036 * sysreg" in their AArch64 view (the .cp value may
7037 * be non-zero for the benefit of the AArch32 view).
7038 */
7039 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
7040 r2->cp = CP_REG_ARM64_SYSREG_CP;
7041 }
7042 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
7043 r2->opc0, opc1, opc2);
7044 } else {
7045 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
7046 }
7047 if (opaque) {
7048 r2->opaque = opaque;
7049 }
7050 /* reginfo passed to helpers is correct for the actual access,
7051 * and is never ARM_CP_STATE_BOTH:
7052 */
7053 r2->state = state;
7054 /* Make sure reginfo passed to helpers for wildcarded regs
7055 * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
7056 */
7057 r2->crm = crm;
7058 r2->opc1 = opc1;
7059 r2->opc2 = opc2;
7060 /* By convention, for wildcarded registers only the first
7061 * entry is used for migration; the others are marked as
7062 * ALIAS so we don't try to transfer the register
7063 * multiple times. Special registers (ie NOP/WFI) are
7064 * never migratable and not even raw-accessible.
7065 */
7066 if ((r->type & ARM_CP_SPECIAL)) {
7067 r2->type |= ARM_CP_NO_RAW;
7068 }
7069 if (((r->crm == CP_ANY) && crm != 0) ||
7070 ((r->opc1 == CP_ANY) && opc1 != 0) ||
7071 ((r->opc2 == CP_ANY) && opc2 != 0)) {
7072 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
7073 }
7074
7075 /* Check that raw accesses are either forbidden or handled. Note that
7076 * we can't assert this earlier because the setup of fieldoffset for
7077 * banked registers has to be done first.
7078 */
7079 if (!(r2->type & ARM_CP_NO_RAW)) {
7080 assert(!raw_accessors_invalid(r2));
7081 }
7082
7083 /* Overriding of an existing definition must be explicitly
7084 * requested.
7085 */
7086 if (!(r->type & ARM_CP_OVERRIDE)) {
7087 ARMCPRegInfo *oldreg;
7088 oldreg = g_hash_table_lookup(cpu->cp_regs, key);
7089 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
7090 fprintf(stderr, "Register redefined: cp=%d %d bit "
7091 "crn=%d crm=%d opc1=%d opc2=%d, "
7092 "was %s, now %s\n", r2->cp, 32 + 32 * is64,
7093 r2->crn, r2->crm, r2->opc1, r2->opc2,
7094 oldreg->name, r2->name);
7095 g_assert_not_reached();
7096 }
7097 }
7098 g_hash_table_insert(cpu->cp_regs, key, r2);
7099}
7100
7101
7102void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
7103 const ARMCPRegInfo *r, void *opaque)
7104{
7105 /* Define implementations of coprocessor registers.
7106 * We store these in a hashtable because typically
7107 * there are less than 150 registers in a space which
7108 * is 16*16*16*8*8 = 262144 in size.
7109 * Wildcarding is supported for the crm, opc1 and opc2 fields.
7110 * If a register is defined twice then the second definition is
7111 * used, so this can be used to define some generic registers and
7112 * then override them with implementation specific variations.
7113 * At least one of the original and the second definition should
7114 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
7115 * against accidental use.
7116 *
7117 * The state field defines whether the register is to be
7118 * visible in the AArch32 or AArch64 execution state. If the
7119 * state is set to ARM_CP_STATE_BOTH then we synthesise a
7120 * reginfo structure for the AArch32 view, which sees the lower
7121 * 32 bits of the 64 bit register.
7122 *
7123 * Only registers visible in AArch64 may set r->opc0; opc0 cannot
7124 * be wildcarded. AArch64 registers are always considered to be 64
7125 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
7126 * the register, if any.
7127 */
7128 int crm, opc1, opc2, state;
7129 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
7130 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
7131 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
7132 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
7133 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
7134 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
7135 /* 64 bit registers have only CRm and Opc1 fields */
7136 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
7137 /* op0 only exists in the AArch64 encodings */
7138 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
7139 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
7140 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
7141 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
7142 * encodes a minimum access level for the register. We roll this
7143 * runtime check into our general permission check code, so check
7144 * here that the reginfo's specified permissions are strict enough
7145 * to encompass the generic architectural permission check.
7146 */
7147 if (r->state != ARM_CP_STATE_AA32) {
7148 int mask = 0;
7149 switch (r->opc1) {
7150 case 0:
7151 /* min_EL EL1, but some accessible to EL0 via kernel ABI */
7152 mask = PL0U_R | PL1_RW;
7153 break;
7154 case 1: case 2:
7155 /* min_EL EL1 */
7156 mask = PL1_RW;
7157 break;
7158 case 3:
7159 /* min_EL EL0 */
7160 mask = PL0_RW;
7161 break;
7162 case 4:
7163 /* min_EL EL2 */
7164 mask = PL2_RW;
7165 break;
7166 case 5:
7167 /* unallocated encoding, so not possible */
7168 assert(false);
7169 break;
7170 case 6:
7171 /* min_EL EL3 */
7172 mask = PL3_RW;
7173 break;
7174 case 7:
7175 /* min_EL EL1, secure mode only (we don't check the latter) */
7176 mask = PL1_RW;
7177 break;
7178 default:
7179 /* broken reginfo with out-of-range opc1 */
7180 assert(false);
7181 break;
7182 }
7183 /* assert our permissions are not too lax (stricter is fine) */
7184 assert((r->access & ~mask) == 0);
7185 }
7186
7187 /* Check that the register definition has enough info to handle
7188 * reads and writes if they are permitted.
7189 */
7190 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
7191 if (r->access & PL3_R) {
7192 assert((r->fieldoffset ||
7193 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
7194 r->readfn);
7195 }
7196 if (r->access & PL3_W) {
7197 assert((r->fieldoffset ||
7198 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
7199 r->writefn);
7200 }
7201 }
7202 /* Bad type field probably means missing sentinel at end of reg list */
7203 assert(cptype_valid(r->type));
7204 for (crm = crmmin; crm <= crmmax; crm++) {
7205 for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
7206 for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
7207 for (state = ARM_CP_STATE_AA32;
7208 state <= ARM_CP_STATE_AA64; state++) {
7209 if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
7210 continue;
7211 }
7212 if (state == ARM_CP_STATE_AA32) {
7213 /* Under AArch32 CP registers can be common
7214 * (same for secure and non-secure world) or banked.
7215 */
7216 char *name;
7217
7218 switch (r->secure) {
7219 case ARM_CP_SECSTATE_S:
7220 case ARM_CP_SECSTATE_NS:
7221 add_cpreg_to_hashtable(cpu, r, opaque, state,
7222 r->secure, crm, opc1, opc2,
7223 r->name);
7224 break;
7225 default:
7226 name = g_strdup_printf("%s_S", r->name);
7227 add_cpreg_to_hashtable(cpu, r, opaque, state,
7228 ARM_CP_SECSTATE_S,
7229 crm, opc1, opc2, name);
7230 g_free(name);
7231 add_cpreg_to_hashtable(cpu, r, opaque, state,
7232 ARM_CP_SECSTATE_NS,
7233 crm, opc1, opc2, r->name);
7234 break;
7235 }
7236 } else {
7237 /* AArch64 registers get mapped to non-secure instance
7238 * of AArch32 */
7239 add_cpreg_to_hashtable(cpu, r, opaque, state,
7240 ARM_CP_SECSTATE_NS,
7241 crm, opc1, opc2, r->name);
7242 }
7243 }
7244 }
7245 }
7246 }
7247}
7248
7249void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
7250 const ARMCPRegInfo *regs, void *opaque)
7251{
7252 /* Define a whole list of registers */
7253 const ARMCPRegInfo *r;
7254 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
7255 define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
7256 }
7257}
7258
7259/*
7260 * Modify ARMCPRegInfo for access from userspace.
7261 *
7262 * This is a data driven modification directed by
7263 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as
7264 * user-space cannot alter any values and dynamic values pertaining to
7265 * execution state are hidden from user space view anyway.
7266 */
7267void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
7268{
7269 const ARMCPRegUserSpaceInfo *m;
7270 ARMCPRegInfo *r;
7271
7272 for (m = mods; m->name; m++) {
7273 GPatternSpec *pat = NULL;
7274 if (m->is_glob) {
7275 pat = g_pattern_spec_new(m->name);
7276 }
7277 for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
7278 if (pat && g_pattern_match_string(pat, r->name)) {
7279 r->type = ARM_CP_CONST;
7280 r->access = PL0U_R;
7281 r->resetvalue = 0;
7282 /* continue */
7283 } else if (strcmp(r->name, m->name) == 0) {
7284 r->type = ARM_CP_CONST;
7285 r->access = PL0U_R;
7286 r->resetvalue &= m->exported_bits;
7287 r->resetvalue |= m->fixed_bits;
7288 break;
7289 }
7290 }
7291 if (pat) {
7292 g_pattern_spec_free(pat);
7293 }
7294 }
7295}
7296
7297const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
7298{
7299 return g_hash_table_lookup(cpregs, &encoded_cp);
7300}
7301
7302void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
7303 uint64_t value)
7304{
7305 /* Helper coprocessor write function for write-ignore registers */
7306}
7307
7308uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
7309{
7310 /* Helper coprocessor write function for read-as-zero registers */
7311 return 0;
7312}
7313
7314void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
7315{
7316 /* Helper coprocessor reset function for do-nothing-on-reset registers */
7317}
7318
7319static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type)
7320{
7321 /* Return true if it is not valid for us to switch to
7322 * this CPU mode (ie all the UNPREDICTABLE cases in
7323 * the ARM ARM CPSRWriteByInstr pseudocode).
7324 */
7325
7326 /* Changes to or from Hyp via MSR and CPS are illegal. */
7327 if (write_type == CPSRWriteByInstr &&
7328 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP ||
7329 mode == ARM_CPU_MODE_HYP)) {
7330 return 1;
7331 }
7332
7333 switch (mode) {
7334 case ARM_CPU_MODE_USR:
7335 return 0;
7336 case ARM_CPU_MODE_SYS:
7337 case ARM_CPU_MODE_SVC:
7338 case ARM_CPU_MODE_ABT:
7339 case ARM_CPU_MODE_UND:
7340 case ARM_CPU_MODE_IRQ:
7341 case ARM_CPU_MODE_FIQ:
7342 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7
7343 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.)
7344 */
7345 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR
7346 * and CPS are treated as illegal mode changes.
7347 */
7348 if (write_type == CPSRWriteByInstr &&
7349 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON &&
7350 (arm_hcr_el2_eff(env) & HCR_TGE)) {
7351 return 1;
7352 }
7353 return 0;
7354 case ARM_CPU_MODE_HYP:
7355 return !arm_feature(env, ARM_FEATURE_EL2)
7356 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env);
7357 case ARM_CPU_MODE_MON:
7358 return arm_current_el(env) < 3;
7359 default:
7360 return 1;
7361 }
7362}
7363
7364uint32_t cpsr_read(CPUARMState *env)
7365{
7366 int ZF;
7367 ZF = (env->ZF == 0);
7368 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
7369 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
7370 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
7371 | ((env->condexec_bits & 0xfc) << 8)
7372 | (env->GE << 16) | (env->daif & CPSR_AIF);
7373}
7374
7375void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask,
7376 CPSRWriteType write_type)
7377{
7378 uint32_t changed_daif;
7379
7380 if (mask & CPSR_NZCV) {
7381 env->ZF = (~val) & CPSR_Z;
7382 env->NF = val;
7383 env->CF = (val >> 29) & 1;
7384 env->VF = (val << 3) & 0x80000000;
7385 }
7386 if (mask & CPSR_Q)
7387 env->QF = ((val & CPSR_Q) != 0);
7388 if (mask & CPSR_T)
7389 env->thumb = ((val & CPSR_T) != 0);
7390 if (mask & CPSR_IT_0_1) {
7391 env->condexec_bits &= ~3;
7392 env->condexec_bits |= (val >> 25) & 3;
7393 }
7394 if (mask & CPSR_IT_2_7) {
7395 env->condexec_bits &= 3;
7396 env->condexec_bits |= (val >> 8) & 0xfc;
7397 }
7398 if (mask & CPSR_GE) {
7399 env->GE = (val >> 16) & 0xf;
7400 }
7401
7402 /* In a V7 implementation that includes the security extensions but does
7403 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
7404 * whether non-secure software is allowed to change the CPSR_F and CPSR_A
7405 * bits respectively.
7406 *
7407 * In a V8 implementation, it is permitted for privileged software to
7408 * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
7409 */
7410 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) &&
7411 arm_feature(env, ARM_FEATURE_EL3) &&
7412 !arm_feature(env, ARM_FEATURE_EL2) &&
7413 !arm_is_secure(env)) {
7414
7415 changed_daif = (env->daif ^ val) & mask;
7416
7417 if (changed_daif & CPSR_A) {
7418 /* Check to see if we are allowed to change the masking of async
7419 * abort exceptions from a non-secure state.
7420 */
7421 if (!(env->cp15.scr_el3 & SCR_AW)) {
7422 qemu_log_mask(LOG_GUEST_ERROR,
7423 "Ignoring attempt to switch CPSR_A flag from "
7424 "non-secure world with SCR.AW bit clear\n");
7425 mask &= ~CPSR_A;
7426 }
7427 }
7428
7429 if (changed_daif & CPSR_F) {
7430 /* Check to see if we are allowed to change the masking of FIQ
7431 * exceptions from a non-secure state.
7432 */
7433 if (!(env->cp15.scr_el3 & SCR_FW)) {
7434 qemu_log_mask(LOG_GUEST_ERROR,
7435 "Ignoring attempt to switch CPSR_F flag from "
7436 "non-secure world with SCR.FW bit clear\n");
7437 mask &= ~CPSR_F;
7438 }
7439
7440 /* Check whether non-maskable FIQ (NMFI) support is enabled.
7441 * If this bit is set software is not allowed to mask
7442 * FIQs, but is allowed to set CPSR_F to 0.
7443 */
7444 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) &&
7445 (val & CPSR_F)) {
7446 qemu_log_mask(LOG_GUEST_ERROR,
7447 "Ignoring attempt to enable CPSR_F flag "
7448 "(non-maskable FIQ [NMFI] support enabled)\n");
7449 mask &= ~CPSR_F;
7450 }
7451 }
7452 }
7453
7454 env->daif &= ~(CPSR_AIF & mask);
7455 env->daif |= val & CPSR_AIF & mask;
7456
7457 if (write_type != CPSRWriteRaw &&
7458 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) {
7459 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) {
7460 /* Note that we can only get here in USR mode if this is a
7461 * gdb stub write; for this case we follow the architectural
7462 * behaviour for guest writes in USR mode of ignoring an attempt
7463 * to switch mode. (Those are caught by translate.c for writes
7464 * triggered by guest instructions.)
7465 */
7466 mask &= ~CPSR_M;
7467 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) {
7468 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in
7469 * v7, and has defined behaviour in v8:
7470 * + leave CPSR.M untouched
7471 * + allow changes to the other CPSR fields
7472 * + set PSTATE.IL
7473 * For user changes via the GDB stub, we don't set PSTATE.IL,
7474 * as this would be unnecessarily harsh for a user error.
7475 */
7476 mask &= ~CPSR_M;
7477 if (write_type != CPSRWriteByGDBStub &&
7478 arm_feature(env, ARM_FEATURE_V8)) {
7479 mask |= CPSR_IL;
7480 val |= CPSR_IL;
7481 }
7482 qemu_log_mask(LOG_GUEST_ERROR,
7483 "Illegal AArch32 mode switch attempt from %s to %s\n",
7484 aarch32_mode_name(env->uncached_cpsr),
7485 aarch32_mode_name(val));
7486 } else {
7487 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n",
7488 write_type == CPSRWriteExceptionReturn ?
7489 "Exception return from AArch32" :
7490 "AArch32 mode switch from",
7491 aarch32_mode_name(env->uncached_cpsr),
7492 aarch32_mode_name(val), env->regs[15]);
7493 switch_mode(env, val & CPSR_M);
7494 }
7495 }
7496 mask &= ~CACHED_CPSR_BITS;
7497 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
7498}
7499
7500/* Sign/zero extend */
7501uint32_t HELPER(sxtb16)(uint32_t x)
7502{
7503 uint32_t res;
7504 res = (uint16_t)(int8_t)x;
7505 res |= (uint32_t)(int8_t)(x >> 16) << 16;
7506 return res;
7507}
7508
7509uint32_t HELPER(uxtb16)(uint32_t x)
7510{
7511 uint32_t res;
7512 res = (uint16_t)(uint8_t)x;
7513 res |= (uint32_t)(uint8_t)(x >> 16) << 16;
7514 return res;
7515}
7516
7517int32_t HELPER(sdiv)(int32_t num, int32_t den)
7518{
7519 if (den == 0)
7520 return 0;
7521 if (num == INT_MIN && den == -1)
7522 return INT_MIN;
7523 return num / den;
7524}
7525
7526uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
7527{
7528 if (den == 0)
7529 return 0;
7530 return num / den;
7531}
7532
7533uint32_t HELPER(rbit)(uint32_t x)
7534{
7535 return revbit32(x);
7536}
7537
7538#ifdef CONFIG_USER_ONLY
7539
7540static void switch_mode(CPUARMState *env, int mode)
7541{
7542 ARMCPU *cpu = env_archcpu(env);
7543
7544 if (mode != ARM_CPU_MODE_USR) {
7545 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
7546 }
7547}
7548
7549uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
7550 uint32_t cur_el, bool secure)
7551{
7552 return 1;
7553}
7554
7555void aarch64_sync_64_to_32(CPUARMState *env)
7556{
7557 g_assert_not_reached();
7558}
7559
7560#else
7561
7562static void switch_mode(CPUARMState *env, int mode)
7563{
7564 int old_mode;
7565 int i;
7566
7567 old_mode = env->uncached_cpsr & CPSR_M;
7568 if (mode == old_mode)
7569 return;
7570
7571 if (old_mode == ARM_CPU_MODE_FIQ) {
7572 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
7573 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
7574 } else if (mode == ARM_CPU_MODE_FIQ) {
7575 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
7576 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
7577 }
7578
7579 i = bank_number(old_mode);
7580 env->banked_r13[i] = env->regs[13];
7581 env->banked_spsr[i] = env->spsr;
7582
7583 i = bank_number(mode);
7584 env->regs[13] = env->banked_r13[i];
7585 env->spsr = env->banked_spsr[i];
7586
7587 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14];
7588 env->regs[14] = env->banked_r14[r14_bank_number(mode)];
7589}
7590
7591/* Physical Interrupt Target EL Lookup Table
7592 *
7593 * [ From ARM ARM section G1.13.4 (Table G1-15) ]
7594 *
7595 * The below multi-dimensional table is used for looking up the target
7596 * exception level given numerous condition criteria. Specifically, the
7597 * target EL is based on SCR and HCR routing controls as well as the
7598 * currently executing EL and secure state.
7599 *
7600 * Dimensions:
7601 * target_el_table[2][2][2][2][2][4]
7602 * | | | | | +--- Current EL
7603 * | | | | +------ Non-secure(0)/Secure(1)
7604 * | | | +--------- HCR mask override
7605 * | | +------------ SCR exec state control
7606 * | +--------------- SCR mask override
7607 * +------------------ 32-bit(0)/64-bit(1) EL3
7608 *
7609 * The table values are as such:
7610 * 0-3 = EL0-EL3
7611 * -1 = Cannot occur
7612 *
7613 * The ARM ARM target EL table includes entries indicating that an "exception
7614 * is not taken". The two cases where this is applicable are:
7615 * 1) An exception is taken from EL3 but the SCR does not have the exception
7616 * routed to EL3.
7617 * 2) An exception is taken from EL2 but the HCR does not have the exception
7618 * routed to EL2.
7619 * In these two cases, the below table contain a target of EL1. This value is
7620 * returned as it is expected that the consumer of the table data will check
7621 * for "target EL >= current EL" to ensure the exception is not taken.
7622 *
7623 * SCR HCR
7624 * 64 EA AMO From
7625 * BIT IRQ IMO Non-secure Secure
7626 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3
7627 */
7628static const int8_t target_el_table[2][2][2][2][2][4] = {
7629 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
7630 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},
7631 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },},
7632 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},},
7633 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
7634 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},
7635 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},
7636 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},},
7637 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },},
7638 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},
7639 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },},
7640 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},},
7641 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
7642 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},
7643 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},
7644 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},},
7645};
7646
7647/*
7648 * Determine the target EL for physical exceptions
7649 */
7650uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
7651 uint32_t cur_el, bool secure)
7652{
7653 CPUARMState *env = cs->env_ptr;
7654 bool rw;
7655 bool scr;
7656 bool hcr;
7657 int target_el;
7658 /* Is the highest EL AArch64? */
7659 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64);
7660 uint64_t hcr_el2;
7661
7662 if (arm_feature(env, ARM_FEATURE_EL3)) {
7663 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
7664 } else {
7665 /* Either EL2 is the highest EL (and so the EL2 register width
7666 * is given by is64); or there is no EL2 or EL3, in which case
7667 * the value of 'rw' does not affect the table lookup anyway.
7668 */
7669 rw = is64;
7670 }
7671
7672 hcr_el2 = arm_hcr_el2_eff(env);
7673 switch (excp_idx) {
7674 case EXCP_IRQ:
7675 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ);
7676 hcr = hcr_el2 & HCR_IMO;
7677 break;
7678 case EXCP_FIQ:
7679 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ);
7680 hcr = hcr_el2 & HCR_FMO;
7681 break;
7682 default:
7683 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA);
7684 hcr = hcr_el2 & HCR_AMO;
7685 break;
7686 };
7687
7688 /* Perform a table-lookup for the target EL given the current state */
7689 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
7690
7691 assert(target_el > 0);
7692
7693 return target_el;
7694}
7695
7696void arm_log_exception(int idx)
7697{
7698 if (qemu_loglevel_mask(CPU_LOG_INT)) {
7699 const char *exc = NULL;
7700 static const char * const excnames[] = {
7701 [EXCP_UDEF] = "Undefined Instruction",
7702 [EXCP_SWI] = "SVC",
7703 [EXCP_PREFETCH_ABORT] = "Prefetch Abort",
7704 [EXCP_DATA_ABORT] = "Data Abort",
7705 [EXCP_IRQ] = "IRQ",
7706 [EXCP_FIQ] = "FIQ",
7707 [EXCP_BKPT] = "Breakpoint",
7708 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit",
7709 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage",
7710 [EXCP_HVC] = "Hypervisor Call",
7711 [EXCP_HYP_TRAP] = "Hypervisor Trap",
7712 [EXCP_SMC] = "Secure Monitor Call",
7713 [EXCP_VIRQ] = "Virtual IRQ",
7714 [EXCP_VFIQ] = "Virtual FIQ",
7715 [EXCP_SEMIHOST] = "Semihosting call",
7716 [EXCP_NOCP] = "v7M NOCP UsageFault",
7717 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault",
7718 [EXCP_STKOF] = "v8M STKOF UsageFault",
7719 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking",
7720 [EXCP_LSERR] = "v8M LSERR UsageFault",
7721 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
7722 };
7723
7724 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
7725 exc = excnames[idx];
7726 }
7727 if (!exc) {
7728 exc = "unknown";
7729 }
7730 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc);
7731 }
7732}
7733
7734/*
7735 * Function used to synchronize QEMU's AArch64 register set with AArch32
7736 * register set. This is necessary when switching between AArch32 and AArch64
7737 * execution state.
7738 */
7739void aarch64_sync_32_to_64(CPUARMState *env)
7740{
7741 int i;
7742 uint32_t mode = env->uncached_cpsr & CPSR_M;
7743
7744 /* We can blanket copy R[0:7] to X[0:7] */
7745 for (i = 0; i < 8; i++) {
7746 env->xregs[i] = env->regs[i];
7747 }
7748
7749 /*
7750 * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
7751 * Otherwise, they come from the banked user regs.
7752 */
7753 if (mode == ARM_CPU_MODE_FIQ) {
7754 for (i = 8; i < 13; i++) {
7755 env->xregs[i] = env->usr_regs[i - 8];
7756 }
7757 } else {
7758 for (i = 8; i < 13; i++) {
7759 env->xregs[i] = env->regs[i];
7760 }
7761 }
7762
7763 /*
7764 * Registers x13-x23 are the various mode SP and FP registers. Registers
7765 * r13 and r14 are only copied if we are in that mode, otherwise we copy
7766 * from the mode banked register.
7767 */
7768 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
7769 env->xregs[13] = env->regs[13];
7770 env->xregs[14] = env->regs[14];
7771 } else {
7772 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)];
7773 /* HYP is an exception in that it is copied from r14 */
7774 if (mode == ARM_CPU_MODE_HYP) {
7775 env->xregs[14] = env->regs[14];
7776 } else {
7777 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)];
7778 }
7779 }
7780
7781 if (mode == ARM_CPU_MODE_HYP) {
7782 env->xregs[15] = env->regs[13];
7783 } else {
7784 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)];
7785 }
7786
7787 if (mode == ARM_CPU_MODE_IRQ) {
7788 env->xregs[16] = env->regs[14];
7789 env->xregs[17] = env->regs[13];
7790 } else {
7791 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)];
7792 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
7793 }
7794
7795 if (mode == ARM_CPU_MODE_SVC) {
7796 env->xregs[18] = env->regs[14];
7797 env->xregs[19] = env->regs[13];
7798 } else {
7799 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)];
7800 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
7801 }
7802
7803 if (mode == ARM_CPU_MODE_ABT) {
7804 env->xregs[20] = env->regs[14];
7805 env->xregs[21] = env->regs[13];
7806 } else {
7807 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)];
7808 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
7809 }
7810
7811 if (mode == ARM_CPU_MODE_UND) {
7812 env->xregs[22] = env->regs[14];
7813 env->xregs[23] = env->regs[13];
7814 } else {
7815 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)];
7816 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
7817 }
7818
7819 /*
7820 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
7821 * mode, then we can copy from r8-r14. Otherwise, we copy from the
7822 * FIQ bank for r8-r14.
7823 */
7824 if (mode == ARM_CPU_MODE_FIQ) {
7825 for (i = 24; i < 31; i++) {
7826 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */
7827 }
7828 } else {
7829 for (i = 24; i < 29; i++) {
7830 env->xregs[i] = env->fiq_regs[i - 24];
7831 }
7832 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
7833 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)];
7834 }
7835
7836 env->pc = env->regs[15];
7837}
7838
7839/*
7840 * Function used to synchronize QEMU's AArch32 register set with AArch64
7841 * register set. This is necessary when switching between AArch32 and AArch64
7842 * execution state.
7843 */
7844void aarch64_sync_64_to_32(CPUARMState *env)
7845{
7846 int i;
7847 uint32_t mode = env->uncached_cpsr & CPSR_M;
7848
7849 /* We can blanket copy X[0:7] to R[0:7] */
7850 for (i = 0; i < 8; i++) {
7851 env->regs[i] = env->xregs[i];
7852 }
7853
7854 /*
7855 * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
7856 * Otherwise, we copy x8-x12 into the banked user regs.
7857 */
7858 if (mode == ARM_CPU_MODE_FIQ) {
7859 for (i = 8; i < 13; i++) {
7860 env->usr_regs[i - 8] = env->xregs[i];
7861 }
7862 } else {
7863 for (i = 8; i < 13; i++) {
7864 env->regs[i] = env->xregs[i];
7865 }
7866 }
7867
7868 /*
7869 * Registers r13 & r14 depend on the current mode.
7870 * If we are in a given mode, we copy the corresponding x registers to r13
7871 * and r14. Otherwise, we copy the x register to the banked r13 and r14
7872 * for the mode.
7873 */
7874 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
7875 env->regs[13] = env->xregs[13];
7876 env->regs[14] = env->xregs[14];
7877 } else {
7878 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13];
7879
7880 /*
7881 * HYP is an exception in that it does not have its own banked r14 but
7882 * shares the USR r14
7883 */
7884 if (mode == ARM_CPU_MODE_HYP) {
7885 env->regs[14] = env->xregs[14];
7886 } else {
7887 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
7888 }
7889 }
7890
7891 if (mode == ARM_CPU_MODE_HYP) {
7892 env->regs[13] = env->xregs[15];
7893 } else {
7894 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15];
7895 }
7896
7897 if (mode == ARM_CPU_MODE_IRQ) {
7898 env->regs[14] = env->xregs[16];
7899 env->regs[13] = env->xregs[17];
7900 } else {
7901 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
7902 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
7903 }
7904
7905 if (mode == ARM_CPU_MODE_SVC) {
7906 env->regs[14] = env->xregs[18];
7907 env->regs[13] = env->xregs[19];
7908 } else {
7909 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
7910 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
7911 }
7912
7913 if (mode == ARM_CPU_MODE_ABT) {
7914 env->regs[14] = env->xregs[20];
7915 env->regs[13] = env->xregs[21];
7916 } else {
7917 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
7918 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
7919 }
7920
7921 if (mode == ARM_CPU_MODE_UND) {
7922 env->regs[14] = env->xregs[22];
7923 env->regs[13] = env->xregs[23];
7924 } else {
7925 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
7926 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
7927 }
7928
7929 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ
7930 * mode, then we can copy to r8-r14. Otherwise, we copy to the
7931 * FIQ bank for r8-r14.
7932 */
7933 if (mode == ARM_CPU_MODE_FIQ) {
7934 for (i = 24; i < 31; i++) {
7935 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */
7936 }
7937 } else {
7938 for (i = 24; i < 29; i++) {
7939 env->fiq_regs[i - 24] = env->xregs[i];
7940 }
7941 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
7942 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
7943 }
7944
7945 env->regs[15] = env->pc;
7946}
7947
7948static void take_aarch32_exception(CPUARMState *env, int new_mode,
7949 uint32_t mask, uint32_t offset,
7950 uint32_t newpc)
7951{
7952 /* Change the CPU state so as to actually take the exception. */
7953 switch_mode(env, new_mode);
7954 /*
7955 * For exceptions taken to AArch32 we must clear the SS bit in both
7956 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
7957 */
7958 env->uncached_cpsr &= ~PSTATE_SS;
7959 env->spsr = cpsr_read(env);
7960 /* Clear IT bits. */
7961 env->condexec_bits = 0;
7962 /* Switch to the new mode, and to the correct instruction set. */
7963 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
7964 /* Set new mode endianness */
7965 env->uncached_cpsr &= ~CPSR_E;
7966 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) {
7967 env->uncached_cpsr |= CPSR_E;
7968 }
7969 /* J and IL must always be cleared for exception entry */
7970 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J);
7971 env->daif |= mask;
7972
7973 if (new_mode == ARM_CPU_MODE_HYP) {
7974 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0;
7975 env->elr_el[2] = env->regs[15];
7976 } else {
7977 /*
7978 * this is a lie, as there was no c1_sys on V4T/V5, but who cares
7979 * and we should just guard the thumb mode on V4
7980 */
7981 if (arm_feature(env, ARM_FEATURE_V4T)) {
7982 env->thumb =
7983 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0;
7984 }
7985 env->regs[14] = env->regs[15] + offset;
7986 }
7987 env->regs[15] = newpc;
7988}
7989
7990static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
7991{
7992 /*
7993 * Handle exception entry to Hyp mode; this is sufficiently
7994 * different to entry to other AArch32 modes that we handle it
7995 * separately here.
7996 *
7997 * The vector table entry used is always the 0x14 Hyp mode entry point,
7998 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp.
7999 * The offset applied to the preferred return address is always zero
8000 * (see DDI0487C.a section G1.12.3).
8001 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values.
8002 */
8003 uint32_t addr, mask;
8004 ARMCPU *cpu = ARM_CPU(cs);
8005 CPUARMState *env = &cpu->env;
8006
8007 switch (cs->exception_index) {
8008 case EXCP_UDEF:
8009 addr = 0x04;
8010 break;
8011 case EXCP_SWI:
8012 addr = 0x14;
8013 break;
8014 case EXCP_BKPT:
8015 /* Fall through to prefetch abort. */
8016 case EXCP_PREFETCH_ABORT:
8017 env->cp15.ifar_s = env->exception.vaddress;
8018 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n",
8019 (uint32_t)env->exception.vaddress);
8020 addr = 0x0c;
8021 break;
8022 case EXCP_DATA_ABORT:
8023 env->cp15.dfar_s = env->exception.vaddress;
8024 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n",
8025 (uint32_t)env->exception.vaddress);
8026 addr = 0x10;
8027 break;
8028 case EXCP_IRQ:
8029 addr = 0x18;
8030 break;
8031 case EXCP_FIQ:
8032 addr = 0x1c;
8033 break;
8034 case EXCP_HVC:
8035 addr = 0x08;
8036 break;
8037 case EXCP_HYP_TRAP:
8038 addr = 0x14;
8039 break;
8040 default:
8041 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8042 }
8043
8044 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) {
8045 if (!arm_feature(env, ARM_FEATURE_V8)) {
8046 /*
8047 * QEMU syndrome values are v8-style. v7 has the IL bit
8048 * UNK/SBZP for "field not valid" cases, where v8 uses RES1.
8049 * If this is a v7 CPU, squash the IL bit in those cases.
8050 */
8051 if (cs->exception_index == EXCP_PREFETCH_ABORT ||
8052 (cs->exception_index == EXCP_DATA_ABORT &&
8053 !(env->exception.syndrome & ARM_EL_ISV)) ||
8054 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) {
8055 env->exception.syndrome &= ~ARM_EL_IL;
8056 }
8057 }
8058 env->cp15.esr_el[2] = env->exception.syndrome;
8059 }
8060
8061 if (arm_current_el(env) != 2 && addr < 0x14) {
8062 addr = 0x14;
8063 }
8064
8065 mask = 0;
8066 if (!(env->cp15.scr_el3 & SCR_EA)) {
8067 mask |= CPSR_A;
8068 }
8069 if (!(env->cp15.scr_el3 & SCR_IRQ)) {
8070 mask |= CPSR_I;
8071 }
8072 if (!(env->cp15.scr_el3 & SCR_FIQ)) {
8073 mask |= CPSR_F;
8074 }
8075
8076 addr += env->cp15.hvbar;
8077
8078 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr);
8079}
8080
8081static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
8082{
8083 ARMCPU *cpu = ARM_CPU(cs);
8084 CPUARMState *env = &cpu->env;
8085 uint32_t addr;
8086 uint32_t mask;
8087 int new_mode;
8088 uint32_t offset;
8089 uint32_t moe;
8090
8091 /* If this is a debug exception we must update the DBGDSCR.MOE bits */
8092 switch (syn_get_ec(env->exception.syndrome)) {
8093 case EC_BREAKPOINT:
8094 case EC_BREAKPOINT_SAME_EL:
8095 moe = 1;
8096 break;
8097 case EC_WATCHPOINT:
8098 case EC_WATCHPOINT_SAME_EL:
8099 moe = 10;
8100 break;
8101 case EC_AA32_BKPT:
8102 moe = 3;
8103 break;
8104 case EC_VECTORCATCH:
8105 moe = 5;
8106 break;
8107 default:
8108 moe = 0;
8109 break;
8110 }
8111
8112 if (moe) {
8113 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
8114 }
8115
8116 if (env->exception.target_el == 2) {
8117 arm_cpu_do_interrupt_aarch32_hyp(cs);
8118 return;
8119 }
8120
8121 switch (cs->exception_index) {
8122 case EXCP_UDEF:
8123 new_mode = ARM_CPU_MODE_UND;
8124 addr = 0x04;
8125 mask = CPSR_I;
8126 if (env->thumb)
8127 offset = 2;
8128 else
8129 offset = 4;
8130 break;
8131 case EXCP_SWI:
8132 new_mode = ARM_CPU_MODE_SVC;
8133 addr = 0x08;
8134 mask = CPSR_I;
8135 /* The PC already points to the next instruction. */
8136 offset = 0;
8137 break;
8138 case EXCP_BKPT:
8139 /* Fall through to prefetch abort. */
8140 case EXCP_PREFETCH_ABORT:
8141 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr);
8142 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress);
8143 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
8144 env->exception.fsr, (uint32_t)env->exception.vaddress);
8145 new_mode = ARM_CPU_MODE_ABT;
8146 addr = 0x0c;
8147 mask = CPSR_A | CPSR_I;
8148 offset = 4;
8149 break;
8150 case EXCP_DATA_ABORT:
8151 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
8152 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress);
8153 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
8154 env->exception.fsr,
8155 (uint32_t)env->exception.vaddress);
8156 new_mode = ARM_CPU_MODE_ABT;
8157 addr = 0x10;
8158 mask = CPSR_A | CPSR_I;
8159 offset = 8;
8160 break;
8161 case EXCP_IRQ:
8162 new_mode = ARM_CPU_MODE_IRQ;
8163 addr = 0x18;
8164 /* Disable IRQ and imprecise data aborts. */
8165 mask = CPSR_A | CPSR_I;
8166 offset = 4;
8167 if (env->cp15.scr_el3 & SCR_IRQ) {
8168 /* IRQ routed to monitor mode */
8169 new_mode = ARM_CPU_MODE_MON;
8170 mask |= CPSR_F;
8171 }
8172 break;
8173 case EXCP_FIQ:
8174 new_mode = ARM_CPU_MODE_FIQ;
8175 addr = 0x1c;
8176 /* Disable FIQ, IRQ and imprecise data aborts. */
8177 mask = CPSR_A | CPSR_I | CPSR_F;
8178 if (env->cp15.scr_el3 & SCR_FIQ) {
8179 /* FIQ routed to monitor mode */
8180 new_mode = ARM_CPU_MODE_MON;
8181 }
8182 offset = 4;
8183 break;
8184 case EXCP_VIRQ:
8185 new_mode = ARM_CPU_MODE_IRQ;
8186 addr = 0x18;
8187 /* Disable IRQ and imprecise data aborts. */
8188 mask = CPSR_A | CPSR_I;
8189 offset = 4;
8190 break;
8191 case EXCP_VFIQ:
8192 new_mode = ARM_CPU_MODE_FIQ;
8193 addr = 0x1c;
8194 /* Disable FIQ, IRQ and imprecise data aborts. */
8195 mask = CPSR_A | CPSR_I | CPSR_F;
8196 offset = 4;
8197 break;
8198 case EXCP_SMC:
8199 new_mode = ARM_CPU_MODE_MON;
8200 addr = 0x08;
8201 mask = CPSR_A | CPSR_I | CPSR_F;
8202 offset = 0;
8203 break;
8204 default:
8205 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8206 return; /* Never happens. Keep compiler happy. */
8207 }
8208
8209 if (new_mode == ARM_CPU_MODE_MON) {
8210 addr += env->cp15.mvbar;
8211 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
8212 /* High vectors. When enabled, base address cannot be remapped. */
8213 addr += 0xffff0000;
8214 } else {
8215 /* ARM v7 architectures provide a vector base address register to remap
8216 * the interrupt vector table.
8217 * This register is only followed in non-monitor mode, and is banked.
8218 * Note: only bits 31:5 are valid.
8219 */
8220 addr += A32_BANKED_CURRENT_REG_GET(env, vbar);
8221 }
8222
8223 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
8224 env->cp15.scr_el3 &= ~SCR_NS;
8225 }
8226
8227 take_aarch32_exception(env, new_mode, mask, offset, addr);
8228}
8229
8230/* Handle exception entry to a target EL which is using AArch64 */
8231static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
8232{
8233 ARMCPU *cpu = ARM_CPU(cs);
8234 CPUARMState *env = &cpu->env;
8235 unsigned int new_el = env->exception.target_el;
8236 target_ulong addr = env->cp15.vbar_el[new_el];
8237 unsigned int new_mode = aarch64_pstate_mode(new_el, true);
8238 unsigned int cur_el = arm_current_el(env);
8239
8240 /*
8241 * Note that new_el can never be 0. If cur_el is 0, then
8242 * el0_a64 is is_a64(), else el0_a64 is ignored.
8243 */
8244 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
8245
8246 if (cur_el < new_el) {
8247 /* Entry vector offset depends on whether the implemented EL
8248 * immediately lower than the target level is using AArch32 or AArch64
8249 */
8250 bool is_aa64;
8251
8252 switch (new_el) {
8253 case 3:
8254 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
8255 break;
8256 case 2:
8257 is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0;
8258 break;
8259 case 1:
8260 is_aa64 = is_a64(env);
8261 break;
8262 default:
8263 g_assert_not_reached();
8264 }
8265
8266 if (is_aa64) {
8267 addr += 0x400;
8268 } else {
8269 addr += 0x600;
8270 }
8271 } else if (pstate_read(env) & PSTATE_SP) {
8272 addr += 0x200;
8273 }
8274
8275 switch (cs->exception_index) {
8276 case EXCP_PREFETCH_ABORT:
8277 case EXCP_DATA_ABORT:
8278 env->cp15.far_el[new_el] = env->exception.vaddress;
8279 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n",
8280 env->cp15.far_el[new_el]);
8281 /* fall through */
8282 case EXCP_BKPT:
8283 case EXCP_UDEF:
8284 case EXCP_SWI:
8285 case EXCP_HVC:
8286 case EXCP_HYP_TRAP:
8287 case EXCP_SMC:
8288 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) {
8289 /*
8290 * QEMU internal FP/SIMD syndromes from AArch32 include the
8291 * TA and coproc fields which are only exposed if the exception
8292 * is taken to AArch32 Hyp mode. Mask them out to get a valid
8293 * AArch64 format syndrome.
8294 */
8295 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20);
8296 }
8297 env->cp15.esr_el[new_el] = env->exception.syndrome;
8298 break;
8299 case EXCP_IRQ:
8300 case EXCP_VIRQ:
8301 addr += 0x80;
8302 break;
8303 case EXCP_FIQ:
8304 case EXCP_VFIQ:
8305 addr += 0x100;
8306 break;
8307 case EXCP_SEMIHOST:
8308 qemu_log_mask(CPU_LOG_INT,
8309 "...handling as semihosting call 0x%" PRIx64 "\n",
8310 env->xregs[0]);
8311 env->xregs[0] = do_arm_semihosting(env);
8312 return;
8313 default:
8314 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8315 }
8316
8317 if (is_a64(env)) {
8318 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env);
8319 aarch64_save_sp(env, arm_current_el(env));
8320 env->elr_el[new_el] = env->pc;
8321 } else {
8322 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env);
8323 env->elr_el[new_el] = env->regs[15];
8324
8325 aarch64_sync_32_to_64(env);
8326
8327 env->condexec_bits = 0;
8328 }
8329 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n",
8330 env->elr_el[new_el]);
8331
8332 pstate_write(env, PSTATE_DAIF | new_mode);
8333 env->aarch64 = 1;
8334 aarch64_restore_sp(env, new_el);
8335
8336 env->pc = addr;
8337
8338 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n",
8339 new_el, env->pc, pstate_read(env));
8340}
8341
8342static inline bool check_for_semihosting(CPUState *cs)
8343{
8344#ifdef CONFIG_TCG
8345 /* Check whether this exception is a semihosting call; if so
8346 * then handle it and return true; otherwise return false.
8347 */
8348 ARMCPU *cpu = ARM_CPU(cs);
8349 CPUARMState *env = &cpu->env;
8350
8351 if (is_a64(env)) {
8352 if (cs->exception_index == EXCP_SEMIHOST) {
8353 /* This is always the 64-bit semihosting exception.
8354 * The "is this usermode" and "is semihosting enabled"
8355 * checks have been done at translate time.
8356 */
8357 qemu_log_mask(CPU_LOG_INT,
8358 "...handling as semihosting call 0x%" PRIx64 "\n",
8359 env->xregs[0]);
8360 env->xregs[0] = do_arm_semihosting(env);
8361 return true;
8362 }
8363 return false;
8364 } else {
8365 uint32_t imm;
8366
8367 /* Only intercept calls from privileged modes, to provide some
8368 * semblance of security.
8369 */
8370 if (cs->exception_index != EXCP_SEMIHOST &&
8371 (!semihosting_enabled() ||
8372 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) {
8373 return false;
8374 }
8375
8376 switch (cs->exception_index) {
8377 case EXCP_SEMIHOST:
8378 /* This is always a semihosting call; the "is this usermode"
8379 * and "is semihosting enabled" checks have been done at
8380 * translate time.
8381 */
8382 break;
8383 case EXCP_SWI:
8384 /* Check for semihosting interrupt. */
8385 if (env->thumb) {
8386 imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env))
8387 & 0xff;
8388 if (imm == 0xab) {
8389 break;
8390 }
8391 } else {
8392 imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env))
8393 & 0xffffff;
8394 if (imm == 0x123456) {
8395 break;
8396 }
8397 }
8398 return false;
8399 case EXCP_BKPT:
8400 /* See if this is a semihosting syscall. */
8401 if (env->thumb) {
8402 imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env))
8403 & 0xff;
8404 if (imm == 0xab) {
8405 env->regs[15] += 2;
8406 break;
8407 }
8408 }
8409 return false;
8410 default:
8411 return false;
8412 }
8413
8414 qemu_log_mask(CPU_LOG_INT,
8415 "...handling as semihosting call 0x%x\n",
8416 env->regs[0]);
8417 env->regs[0] = do_arm_semihosting(env);
8418 return true;
8419 }
8420#else
8421 return false;
8422#endif
8423}
8424
8425/* Handle a CPU exception for A and R profile CPUs.
8426 * Do any appropriate logging, handle PSCI calls, and then hand off
8427 * to the AArch64-entry or AArch32-entry function depending on the
8428 * target exception level's register width.
8429 */
8430void arm_cpu_do_interrupt(CPUState *cs)
8431{
8432 ARMCPU *cpu = ARM_CPU(cs);
8433 CPUARMState *env = &cpu->env;
8434 unsigned int new_el = env->exception.target_el;
8435
8436 assert(!arm_feature(env, ARM_FEATURE_M));
8437
8438 arm_log_exception(cs->exception_index);
8439 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env),
8440 new_el);
8441 if (qemu_loglevel_mask(CPU_LOG_INT)
8442 && !excp_is_internal(cs->exception_index)) {
8443 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n",
8444 syn_get_ec(env->exception.syndrome),
8445 env->exception.syndrome);
8446 }
8447
8448 if (arm_is_psci_call(cpu, cs->exception_index)) {
8449 arm_handle_psci_call(cpu);
8450 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
8451 return;
8452 }
8453
8454 /* Semihosting semantics depend on the register width of the
8455 * code that caused the exception, not the target exception level,
8456 * so must be handled here.
8457 */
8458 if (check_for_semihosting(cs)) {
8459 return;
8460 }
8461
8462 /* Hooks may change global state so BQL should be held, also the
8463 * BQL needs to be held for any modification of
8464 * cs->interrupt_request.
8465 */
8466 g_assert(qemu_mutex_iothread_locked());
8467
8468 arm_call_pre_el_change_hook(cpu);
8469
8470 assert(!excp_is_internal(cs->exception_index));
8471 if (arm_el_is_aa64(env, new_el)) {
8472 arm_cpu_do_interrupt_aarch64(cs);
8473 } else {
8474 arm_cpu_do_interrupt_aarch32(cs);
8475 }
8476
8477 arm_call_el_change_hook(cpu);
8478
8479 if (!kvm_enabled()) {
8480 cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
8481 }
8482}
8483#endif /* !CONFIG_USER_ONLY */
8484
8485/* Return the exception level which controls this address translation regime */
8486static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
8487{
8488 switch (mmu_idx) {
8489 case ARMMMUIdx_S2NS:
8490 case ARMMMUIdx_S1E2:
8491 return 2;
8492 case ARMMMUIdx_S1E3:
8493 return 3;
8494 case ARMMMUIdx_S1SE0:
8495 return arm_el_is_aa64(env, 3) ? 1 : 3;
8496 case ARMMMUIdx_S1SE1:
8497 case ARMMMUIdx_S1NSE0:
8498 case ARMMMUIdx_S1NSE1:
8499 case ARMMMUIdx_MPrivNegPri:
8500 case ARMMMUIdx_MUserNegPri:
8501 case ARMMMUIdx_MPriv:
8502 case ARMMMUIdx_MUser:
8503 case ARMMMUIdx_MSPrivNegPri:
8504 case ARMMMUIdx_MSUserNegPri:
8505 case ARMMMUIdx_MSPriv:
8506 case ARMMMUIdx_MSUser:
8507 return 1;
8508 default:
8509 g_assert_not_reached();
8510 }
8511}
8512
8513#ifndef CONFIG_USER_ONLY
8514
8515/* Return the SCTLR value which controls this address translation regime */
8516static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
8517{
8518 return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
8519}
8520
8521/* Return true if the specified stage of address translation is disabled */
8522static inline bool regime_translation_disabled(CPUARMState *env,
8523 ARMMMUIdx mmu_idx)
8524{
8525 if (arm_feature(env, ARM_FEATURE_M)) {
8526 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &
8527 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
8528 case R_V7M_MPU_CTRL_ENABLE_MASK:
8529 /* Enabled, but not for HardFault and NMI */
8530 return mmu_idx & ARM_MMU_IDX_M_NEGPRI;
8531 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
8532 /* Enabled for all cases */
8533 return false;
8534 case 0:
8535 default:
8536 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
8537 * we warned about that in armv7m_nvic.c when the guest set it.
8538 */
8539 return true;
8540 }
8541 }
8542
8543 if (mmu_idx == ARMMMUIdx_S2NS) {
8544 /* HCR.DC means HCR.VM behaves as 1 */
8545 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0;
8546 }
8547
8548 if (env->cp15.hcr_el2 & HCR_TGE) {
8549 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
8550 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
8551 return true;
8552 }
8553 }
8554
8555 if ((env->cp15.hcr_el2 & HCR_DC) &&
8556 (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) {
8557 /* HCR.DC means SCTLR_EL1.M behaves as 0 */
8558 return true;
8559 }
8560
8561 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
8562}
8563
8564static inline bool regime_translation_big_endian(CPUARMState *env,
8565 ARMMMUIdx mmu_idx)
8566{
8567 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
8568}
8569
8570/* Return the TTBR associated with this translation regime */
8571static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
8572 int ttbrn)
8573{
8574 if (mmu_idx == ARMMMUIdx_S2NS) {
8575 return env->cp15.vttbr_el2;
8576 }
8577 if (ttbrn == 0) {
8578 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
8579 } else {
8580 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
8581 }
8582}
8583
8584#endif /* !CONFIG_USER_ONLY */
8585
8586/* Return the TCR controlling this translation regime */
8587static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
8588{
8589 if (mmu_idx == ARMMMUIdx_S2NS) {
8590 return &env->cp15.vtcr_el2;
8591 }
8592 return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
8593}
8594
8595/* Convert a possible stage1+2 MMU index into the appropriate
8596 * stage 1 MMU index
8597 */
8598static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
8599{
8600 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
8601 mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0);
8602 }
8603 return mmu_idx;
8604}
8605
8606/* Return true if the translation regime is using LPAE format page tables */
8607static inline bool regime_using_lpae_format(CPUARMState *env,
8608 ARMMMUIdx mmu_idx)
8609{
8610 int el = regime_el(env, mmu_idx);
8611 if (el == 2 || arm_el_is_aa64(env, el)) {
8612 return true;
8613 }
8614 if (arm_feature(env, ARM_FEATURE_LPAE)
8615 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
8616 return true;
8617 }
8618 return false;
8619}
8620
8621/* Returns true if the stage 1 translation regime is using LPAE format page
8622 * tables. Used when raising alignment exceptions, whose FSR changes depending
8623 * on whether the long or short descriptor format is in use. */
8624bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
8625{
8626 mmu_idx = stage_1_mmu_idx(mmu_idx);
8627
8628 return regime_using_lpae_format(env, mmu_idx);
8629}
8630
8631#ifndef CONFIG_USER_ONLY
8632static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
8633{
8634 switch (mmu_idx) {
8635 case ARMMMUIdx_S1SE0:
8636 case ARMMMUIdx_S1NSE0:
8637 case ARMMMUIdx_MUser:
8638 case ARMMMUIdx_MSUser:
8639 case ARMMMUIdx_MUserNegPri:
8640 case ARMMMUIdx_MSUserNegPri:
8641 return true;
8642 default:
8643 return false;
8644 case ARMMMUIdx_S12NSE0:
8645 case ARMMMUIdx_S12NSE1:
8646 g_assert_not_reached();
8647 }
8648}
8649
8650/* Translate section/page access permissions to page
8651 * R/W protection flags
8652 *
8653 * @env: CPUARMState
8654 * @mmu_idx: MMU index indicating required translation regime
8655 * @ap: The 3-bit access permissions (AP[2:0])
8656 * @domain_prot: The 2-bit domain access permissions
8657 */
8658static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
8659 int ap, int domain_prot)
8660{
8661 bool is_user = regime_is_user(env, mmu_idx);
8662
8663 if (domain_prot == 3) {
8664 return PAGE_READ | PAGE_WRITE;
8665 }
8666
8667 switch (ap) {
8668 case 0:
8669 if (arm_feature(env, ARM_FEATURE_V7)) {
8670 return 0;
8671 }
8672 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
8673 case SCTLR_S:
8674 return is_user ? 0 : PAGE_READ;
8675 case SCTLR_R:
8676 return PAGE_READ;
8677 default:
8678 return 0;
8679 }
8680 case 1:
8681 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
8682 case 2:
8683 if (is_user) {
8684 return PAGE_READ;
8685 } else {
8686 return PAGE_READ | PAGE_WRITE;
8687 }
8688 case 3:
8689 return PAGE_READ | PAGE_WRITE;
8690 case 4: /* Reserved. */
8691 return 0;
8692 case 5:
8693 return is_user ? 0 : PAGE_READ;
8694 case 6:
8695 return PAGE_READ;
8696 case 7:
8697 if (!arm_feature(env, ARM_FEATURE_V6K)) {
8698 return 0;
8699 }
8700 return PAGE_READ;
8701 default:
8702 g_assert_not_reached();
8703 }
8704}
8705
8706/* Translate section/page access permissions to page
8707 * R/W protection flags.
8708 *
8709 * @ap: The 2-bit simple AP (AP[2:1])
8710 * @is_user: TRUE if accessing from PL0
8711 */
8712static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
8713{
8714 switch (ap) {
8715 case 0:
8716 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
8717 case 1:
8718 return PAGE_READ | PAGE_WRITE;
8719 case 2:
8720 return is_user ? 0 : PAGE_READ;
8721 case 3:
8722 return PAGE_READ;
8723 default:
8724 g_assert_not_reached();
8725 }
8726}
8727
8728static inline int
8729simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
8730{
8731 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
8732}
8733
8734/* Translate S2 section/page access permissions to protection flags
8735 *
8736 * @env: CPUARMState
8737 * @s2ap: The 2-bit stage2 access permissions (S2AP)
8738 * @xn: XN (execute-never) bit
8739 */
8740static int get_S2prot(CPUARMState *env, int s2ap, int xn)
8741{
8742 int prot = 0;
8743
8744 if (s2ap & 1) {
8745 prot |= PAGE_READ;
8746 }
8747 if (s2ap & 2) {
8748 prot |= PAGE_WRITE;
8749 }
8750 if (!xn) {
8751 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
8752 prot |= PAGE_EXEC;
8753 }
8754 }
8755 return prot;
8756}
8757
8758/* Translate section/page access permissions to protection flags
8759 *
8760 * @env: CPUARMState
8761 * @mmu_idx: MMU index indicating required translation regime
8762 * @is_aa64: TRUE if AArch64
8763 * @ap: The 2-bit simple AP (AP[2:1])
8764 * @ns: NS (non-secure) bit
8765 * @xn: XN (execute-never) bit
8766 * @pxn: PXN (privileged execute-never) bit
8767 */
8768static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
8769 int ap, int ns, int xn, int pxn)
8770{
8771 bool is_user = regime_is_user(env, mmu_idx);
8772 int prot_rw, user_rw;
8773 bool have_wxn;
8774 int wxn = 0;
8775
8776 assert(mmu_idx != ARMMMUIdx_S2NS);
8777
8778 user_rw = simple_ap_to_rw_prot_is_user(ap, true);
8779 if (is_user) {
8780 prot_rw = user_rw;
8781 } else {
8782 prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
8783 }
8784
8785 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
8786 return prot_rw;
8787 }
8788
8789 /* TODO have_wxn should be replaced with
8790 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
8791 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
8792 * compatible processors have EL2, which is required for [U]WXN.
8793 */
8794 have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
8795
8796 if (have_wxn) {
8797 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
8798 }
8799
8800 if (is_aa64) {
8801 switch (regime_el(env, mmu_idx)) {
8802 case 1:
8803 if (!is_user) {
8804 xn = pxn || (user_rw & PAGE_WRITE);
8805 }
8806 break;
8807 case 2:
8808 case 3:
8809 break;
8810 }
8811 } else if (arm_feature(env, ARM_FEATURE_V7)) {
8812 switch (regime_el(env, mmu_idx)) {
8813 case 1:
8814 case 3:
8815 if (is_user) {
8816 xn = xn || !(user_rw & PAGE_READ);
8817 } else {
8818 int uwxn = 0;
8819 if (have_wxn) {
8820 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
8821 }
8822 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
8823 (uwxn && (user_rw & PAGE_WRITE));
8824 }
8825 break;
8826 case 2:
8827 break;
8828 }
8829 } else {
8830 xn = wxn = 0;
8831 }
8832
8833 if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
8834 return prot_rw;
8835 }
8836 return prot_rw | PAGE_EXEC;
8837}
8838
8839static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
8840 uint32_t *table, uint32_t address)
8841{
8842 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
8843 TCR *tcr = regime_tcr(env, mmu_idx);
8844
8845 if (address & tcr->mask) {
8846 if (tcr->raw_tcr & TTBCR_PD1) {
8847 /* Translation table walk disabled for TTBR1 */
8848 return false;
8849 }
8850 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
8851 } else {
8852 if (tcr->raw_tcr & TTBCR_PD0) {
8853 /* Translation table walk disabled for TTBR0 */
8854 return false;
8855 }
8856 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
8857 }
8858 *table |= (address >> 18) & 0x3ffc;
8859 return true;
8860}
8861
8862/* Translate a S1 pagetable walk through S2 if needed. */
8863static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
8864 hwaddr addr, MemTxAttrs txattrs,
8865 ARMMMUFaultInfo *fi)
8866{
8867 if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) &&
8868 !regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
8869 target_ulong s2size;
8870 hwaddr s2pa;
8871 int s2prot;
8872 int ret;
8873 ARMCacheAttrs cacheattrs = {};
8874 ARMCacheAttrs *pcacheattrs = NULL;
8875
8876 if (env->cp15.hcr_el2 & HCR_PTW) {
8877 /*
8878 * PTW means we must fault if this S1 walk touches S2 Device
8879 * memory; otherwise we don't care about the attributes and can
8880 * save the S2 translation the effort of computing them.
8881 */
8882 pcacheattrs = &cacheattrs;
8883 }
8884
8885 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
8886 &txattrs, &s2prot, &s2size, fi, pcacheattrs);
8887 if (ret) {
8888 assert(fi->type != ARMFault_None);
8889 fi->s2addr = addr;
8890 fi->stage2 = true;
8891 fi->s1ptw = true;
8892 return ~0;
8893 }
8894 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) {
8895 /* Access was to Device memory: generate Permission fault */
8896 fi->type = ARMFault_Permission;
8897 fi->s2addr = addr;
8898 fi->stage2 = true;
8899 fi->s1ptw = true;
8900 return ~0;
8901 }
8902 addr = s2pa;
8903 }
8904 return addr;
8905}
8906
8907/* All loads done in the course of a page table walk go through here. */
8908static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
8909 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
8910{
8911 ARMCPU *cpu = ARM_CPU(cs);
8912 CPUARMState *env = &cpu->env;
8913 MemTxAttrs attrs = {};
8914 MemTxResult result = MEMTX_OK;
8915 AddressSpace *as;
8916 uint32_t data;
8917
8918 attrs.secure = is_secure;
8919 as = arm_addressspace(cs, attrs);
8920 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
8921 if (fi->s1ptw) {
8922 return 0;
8923 }
8924 if (regime_translation_big_endian(env, mmu_idx)) {
8925 data = address_space_ldl_be(as, addr, attrs, &result);
8926 } else {
8927 data = address_space_ldl_le(as, addr, attrs, &result);
8928 }
8929 if (result == MEMTX_OK) {
8930 return data;
8931 }
8932 fi->type = ARMFault_SyncExternalOnWalk;
8933 fi->ea = arm_extabort_type(result);
8934 return 0;
8935}
8936
8937static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
8938 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
8939{
8940 ARMCPU *cpu = ARM_CPU(cs);
8941 CPUARMState *env = &cpu->env;
8942 MemTxAttrs attrs = {};
8943 MemTxResult result = MEMTX_OK;
8944 AddressSpace *as;
8945 uint64_t data;
8946
8947 attrs.secure = is_secure;
8948 as = arm_addressspace(cs, attrs);
8949 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
8950 if (fi->s1ptw) {
8951 return 0;
8952 }
8953 if (regime_translation_big_endian(env, mmu_idx)) {
8954 data = address_space_ldq_be(as, addr, attrs, &result);
8955 } else {
8956 data = address_space_ldq_le(as, addr, attrs, &result);
8957 }
8958 if (result == MEMTX_OK) {
8959 return data;
8960 }
8961 fi->type = ARMFault_SyncExternalOnWalk;
8962 fi->ea = arm_extabort_type(result);
8963 return 0;
8964}
8965
8966static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
8967 MMUAccessType access_type, ARMMMUIdx mmu_idx,
8968 hwaddr *phys_ptr, int *prot,
8969 target_ulong *page_size,
8970 ARMMMUFaultInfo *fi)
8971{
8972 CPUState *cs = env_cpu(env);
8973 int level = 1;
8974 uint32_t table;
8975 uint32_t desc;
8976 int type;
8977 int ap;
8978 int domain = 0;
8979 int domain_prot;
8980 hwaddr phys_addr;
8981 uint32_t dacr;
8982
8983 /* Pagetable walk. */
8984 /* Lookup l1 descriptor. */
8985 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
8986 /* Section translation fault if page walk is disabled by PD0 or PD1 */
8987 fi->type = ARMFault_Translation;
8988 goto do_fault;
8989 }
8990 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
8991 mmu_idx, fi);
8992 if (fi->type != ARMFault_None) {
8993 goto do_fault;
8994 }
8995 type = (desc & 3);
8996 domain = (desc >> 5) & 0x0f;
8997 if (regime_el(env, mmu_idx) == 1) {
8998 dacr = env->cp15.dacr_ns;
8999 } else {
9000 dacr = env->cp15.dacr_s;
9001 }
9002 domain_prot = (dacr >> (domain * 2)) & 3;
9003 if (type == 0) {
9004 /* Section translation fault. */
9005 fi->type = ARMFault_Translation;
9006 goto do_fault;
9007 }
9008 if (type != 2) {
9009 level = 2;
9010 }
9011 if (domain_prot == 0 || domain_prot == 2) {
9012 fi->type = ARMFault_Domain;
9013 goto do_fault;
9014 }
9015 if (type == 2) {
9016 /* 1Mb section. */
9017 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
9018 ap = (desc >> 10) & 3;
9019 *page_size = 1024 * 1024;
9020 } else {
9021 /* Lookup l2 entry. */
9022 if (type == 1) {
9023 /* Coarse pagetable. */
9024 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
9025 } else {
9026 /* Fine pagetable. */
9027 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
9028 }
9029 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9030 mmu_idx, fi);
9031 if (fi->type != ARMFault_None) {
9032 goto do_fault;
9033 }
9034 switch (desc & 3) {
9035 case 0: /* Page translation fault. */
9036 fi->type = ARMFault_Translation;
9037 goto do_fault;
9038 case 1: /* 64k page. */
9039 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
9040 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
9041 *page_size = 0x10000;
9042 break;
9043 case 2: /* 4k page. */
9044 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9045 ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
9046 *page_size = 0x1000;
9047 break;
9048 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
9049 if (type == 1) {
9050 /* ARMv6/XScale extended small page format */
9051 if (arm_feature(env, ARM_FEATURE_XSCALE)
9052 || arm_feature(env, ARM_FEATURE_V6)) {
9053 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9054 *page_size = 0x1000;
9055 } else {
9056 /* UNPREDICTABLE in ARMv5; we choose to take a
9057 * page translation fault.
9058 */
9059 fi->type = ARMFault_Translation;
9060 goto do_fault;
9061 }
9062 } else {
9063 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
9064 *page_size = 0x400;
9065 }
9066 ap = (desc >> 4) & 3;
9067 break;
9068 default:
9069 /* Never happens, but compiler isn't smart enough to tell. */
9070 abort();
9071 }
9072 }
9073 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
9074 *prot |= *prot ? PAGE_EXEC : 0;
9075 if (!(*prot & (1 << access_type))) {
9076 /* Access permission fault. */
9077 fi->type = ARMFault_Permission;
9078 goto do_fault;
9079 }
9080 *phys_ptr = phys_addr;
9081 return false;
9082do_fault:
9083 fi->domain = domain;
9084 fi->level = level;
9085 return true;
9086}
9087
9088static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
9089 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9090 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
9091 target_ulong *page_size, ARMMMUFaultInfo *fi)
9092{
9093 CPUState *cs = env_cpu(env);
9094 int level = 1;
9095 uint32_t table;
9096 uint32_t desc;
9097 uint32_t xn;
9098 uint32_t pxn = 0;
9099 int type;
9100 int ap;
9101 int domain = 0;
9102 int domain_prot;
9103 hwaddr phys_addr;
9104 uint32_t dacr;
9105 bool ns;
9106
9107 /* Pagetable walk. */
9108 /* Lookup l1 descriptor. */
9109 if (!get_level1_table_address(env, mmu_idx, &table, address)) {
9110 /* Section translation fault if page walk is disabled by PD0 or PD1 */
9111 fi->type = ARMFault_Translation;
9112 goto do_fault;
9113 }
9114 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9115 mmu_idx, fi);
9116 if (fi->type != ARMFault_None) {
9117 goto do_fault;
9118 }
9119 type = (desc & 3);
9120 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
9121 /* Section translation fault, or attempt to use the encoding
9122 * which is Reserved on implementations without PXN.
9123 */
9124 fi->type = ARMFault_Translation;
9125 goto do_fault;
9126 }
9127 if ((type == 1) || !(desc & (1 << 18))) {
9128 /* Page or Section. */
9129 domain = (desc >> 5) & 0x0f;
9130 }
9131 if (regime_el(env, mmu_idx) == 1) {
9132 dacr = env->cp15.dacr_ns;
9133 } else {
9134 dacr = env->cp15.dacr_s;
9135 }
9136 if (type == 1) {
9137 level = 2;
9138 }
9139 domain_prot = (dacr >> (domain * 2)) & 3;
9140 if (domain_prot == 0 || domain_prot == 2) {
9141 /* Section or Page domain fault */
9142 fi->type = ARMFault_Domain;
9143 goto do_fault;
9144 }
9145 if (type != 1) {
9146 if (desc & (1 << 18)) {
9147 /* Supersection. */
9148 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
9149 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
9150 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
9151 *page_size = 0x1000000;
9152 } else {
9153 /* Section. */
9154 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
9155 *page_size = 0x100000;
9156 }
9157 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
9158 xn = desc & (1 << 4);
9159 pxn = desc & 1;
9160 ns = extract32(desc, 19, 1);
9161 } else {
9162 if (arm_feature(env, ARM_FEATURE_PXN)) {
9163 pxn = (desc >> 2) & 1;
9164 }
9165 ns = extract32(desc, 3, 1);
9166 /* Lookup l2 entry. */
9167 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
9168 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9169 mmu_idx, fi);
9170 if (fi->type != ARMFault_None) {
9171 goto do_fault;
9172 }
9173 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
9174 switch (desc & 3) {
9175 case 0: /* Page translation fault. */
9176 fi->type = ARMFault_Translation;
9177 goto do_fault;
9178 case 1: /* 64k page. */
9179 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
9180 xn = desc & (1 << 15);
9181 *page_size = 0x10000;
9182 break;
9183 case 2: case 3: /* 4k page. */
9184 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9185 xn = desc & 1;
9186 *page_size = 0x1000;
9187 break;
9188 default:
9189 /* Never happens, but compiler isn't smart enough to tell. */
9190 abort();
9191 }
9192 }
9193 if (domain_prot == 3) {
9194 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
9195 } else {
9196 if (pxn && !regime_is_user(env, mmu_idx)) {
9197 xn = 1;
9198 }
9199 if (xn && access_type == MMU_INST_FETCH) {
9200 fi->type = ARMFault_Permission;
9201 goto do_fault;
9202 }
9203
9204 if (arm_feature(env, ARM_FEATURE_V6K) &&
9205 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
9206 /* The simplified model uses AP[0] as an access control bit. */
9207 if ((ap & 1) == 0) {
9208 /* Access flag fault. */
9209 fi->type = ARMFault_AccessFlag;
9210 goto do_fault;
9211 }
9212 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
9213 } else {
9214 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
9215 }
9216 if (*prot && !xn) {
9217 *prot |= PAGE_EXEC;
9218 }
9219 if (!(*prot & (1 << access_type))) {
9220 /* Access permission fault. */
9221 fi->type = ARMFault_Permission;
9222 goto do_fault;
9223 }
9224 }
9225 if (ns) {
9226 /* The NS bit will (as required by the architecture) have no effect if
9227 * the CPU doesn't support TZ or this is a non-secure translation
9228 * regime, because the attribute will already be non-secure.
9229 */
9230 attrs->secure = false;
9231 }
9232 *phys_ptr = phys_addr;
9233 return false;
9234do_fault:
9235 fi->domain = domain;
9236 fi->level = level;
9237 return true;
9238}
9239
9240/*
9241 * check_s2_mmu_setup
9242 * @cpu: ARMCPU
9243 * @is_aa64: True if the translation regime is in AArch64 state
9244 * @startlevel: Suggested starting level
9245 * @inputsize: Bitsize of IPAs
9246 * @stride: Page-table stride (See the ARM ARM)
9247 *
9248 * Returns true if the suggested S2 translation parameters are OK and
9249 * false otherwise.
9250 */
9251static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
9252 int inputsize, int stride)
9253{
9254 const int grainsize = stride + 3;
9255 int startsizecheck;
9256
9257 /* Negative levels are never allowed. */
9258 if (level < 0) {
9259 return false;
9260 }
9261
9262 startsizecheck = inputsize - ((3 - level) * stride + grainsize);
9263 if (startsizecheck < 1 || startsizecheck > stride + 4) {
9264 return false;
9265 }
9266
9267 if (is_aa64) {
9268 CPUARMState *env = &cpu->env;
9269 unsigned int pamax = arm_pamax(cpu);
9270
9271 switch (stride) {
9272 case 13: /* 64KB Pages. */
9273 if (level == 0 || (level == 1 && pamax <= 42)) {
9274 return false;
9275 }
9276 break;
9277 case 11: /* 16KB Pages. */
9278 if (level == 0 || (level == 1 && pamax <= 40)) {
9279 return false;
9280 }
9281 break;
9282 case 9: /* 4KB Pages. */
9283 if (level == 0 && pamax <= 42) {
9284 return false;
9285 }
9286 break;
9287 default:
9288 g_assert_not_reached();
9289 }
9290
9291 /* Inputsize checks. */
9292 if (inputsize > pamax &&
9293 (arm_el_is_aa64(env, 1) || inputsize > 40)) {
9294 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */
9295 return false;
9296 }
9297 } else {
9298 /* AArch32 only supports 4KB pages. Assert on that. */
9299 assert(stride == 9);
9300
9301 if (level == 0) {
9302 return false;
9303 }
9304 }
9305 return true;
9306}
9307
9308/* Translate from the 4-bit stage 2 representation of
9309 * memory attributes (without cache-allocation hints) to
9310 * the 8-bit representation of the stage 1 MAIR registers
9311 * (which includes allocation hints).
9312 *
9313 * ref: shared/translation/attrs/S2AttrDecode()
9314 * .../S2ConvertAttrsHints()
9315 */
9316static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
9317{
9318 uint8_t hiattr = extract32(s2attrs, 2, 2);
9319 uint8_t loattr = extract32(s2attrs, 0, 2);
9320 uint8_t hihint = 0, lohint = 0;
9321
9322 if (hiattr != 0) { /* normal memory */
9323 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
9324 hiattr = loattr = 1; /* non-cacheable */
9325 } else {
9326 if (hiattr != 1) { /* Write-through or write-back */
9327 hihint = 3; /* RW allocate */
9328 }
9329 if (loattr != 1) { /* Write-through or write-back */
9330 lohint = 3; /* RW allocate */
9331 }
9332 }
9333 }
9334
9335 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
9336}
9337#endif /* !CONFIG_USER_ONLY */
9338
9339ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va,
9340 ARMMMUIdx mmu_idx)
9341{
9342 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
9343 uint32_t el = regime_el(env, mmu_idx);
9344 bool tbi, tbid, epd, hpd, using16k, using64k;
9345 int select, tsz;
9346
9347 /*
9348 * Bit 55 is always between the two regions, and is canonical for
9349 * determining if address tagging is enabled.
9350 */
9351 select = extract64(va, 55, 1);
9352
9353 if (el > 1) {
9354 tsz = extract32(tcr, 0, 6);
9355 using64k = extract32(tcr, 14, 1);
9356 using16k = extract32(tcr, 15, 1);
9357 if (mmu_idx == ARMMMUIdx_S2NS) {
9358 /* VTCR_EL2 */
9359 tbi = tbid = hpd = false;
9360 } else {
9361 tbi = extract32(tcr, 20, 1);
9362 hpd = extract32(tcr, 24, 1);
9363 tbid = extract32(tcr, 29, 1);
9364 }
9365 epd = false;
9366 } else if (!select) {
9367 tsz = extract32(tcr, 0, 6);
9368 epd = extract32(tcr, 7, 1);
9369 using64k = extract32(tcr, 14, 1);
9370 using16k = extract32(tcr, 15, 1);
9371 tbi = extract64(tcr, 37, 1);
9372 hpd = extract64(tcr, 41, 1);
9373 tbid = extract64(tcr, 51, 1);
9374 } else {
9375 int tg = extract32(tcr, 30, 2);
9376 using16k = tg == 1;
9377 using64k = tg == 3;
9378 tsz = extract32(tcr, 16, 6);
9379 epd = extract32(tcr, 23, 1);
9380 tbi = extract64(tcr, 38, 1);
9381 hpd = extract64(tcr, 42, 1);
9382 tbid = extract64(tcr, 52, 1);
9383 }
9384 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */
9385 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */
9386
9387 return (ARMVAParameters) {
9388 .tsz = tsz,
9389 .select = select,
9390 .tbi = tbi,
9391 .tbid = tbid,
9392 .epd = epd,
9393 .hpd = hpd,
9394 .using16k = using16k,
9395 .using64k = using64k,
9396 };
9397}
9398
9399ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
9400 ARMMMUIdx mmu_idx, bool data)
9401{
9402 ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx);
9403
9404 /* Present TBI as a composite with TBID. */
9405 ret.tbi &= (data || !ret.tbid);
9406 return ret;
9407}
9408
9409#ifndef CONFIG_USER_ONLY
9410static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
9411 ARMMMUIdx mmu_idx)
9412{
9413 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
9414 uint32_t el = regime_el(env, mmu_idx);
9415 int select, tsz;
9416 bool epd, hpd;
9417
9418 if (mmu_idx == ARMMMUIdx_S2NS) {
9419 /* VTCR */
9420 bool sext = extract32(tcr, 4, 1);
9421 bool sign = extract32(tcr, 3, 1);
9422
9423 /*
9424 * If the sign-extend bit is not the same as t0sz[3], the result
9425 * is unpredictable. Flag this as a guest error.
9426 */
9427 if (sign != sext) {
9428 qemu_log_mask(LOG_GUEST_ERROR,
9429 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
9430 }
9431 tsz = sextract32(tcr, 0, 4) + 8;
9432 select = 0;
9433 hpd = false;
9434 epd = false;
9435 } else if (el == 2) {
9436 /* HTCR */
9437 tsz = extract32(tcr, 0, 3);
9438 select = 0;
9439 hpd = extract64(tcr, 24, 1);
9440 epd = false;
9441 } else {
9442 int t0sz = extract32(tcr, 0, 3);
9443 int t1sz = extract32(tcr, 16, 3);
9444
9445 if (t1sz == 0) {
9446 select = va > (0xffffffffu >> t0sz);
9447 } else {
9448 /* Note that we will detect errors later. */
9449 select = va >= ~(0xffffffffu >> t1sz);
9450 }
9451 if (!select) {
9452 tsz = t0sz;
9453 epd = extract32(tcr, 7, 1);
9454 hpd = extract64(tcr, 41, 1);
9455 } else {
9456 tsz = t1sz;
9457 epd = extract32(tcr, 23, 1);
9458 hpd = extract64(tcr, 42, 1);
9459 }
9460 /* For aarch32, hpd0 is not enabled without t2e as well. */
9461 hpd &= extract32(tcr, 6, 1);
9462 }
9463
9464 return (ARMVAParameters) {
9465 .tsz = tsz,
9466 .select = select,
9467 .epd = epd,
9468 .hpd = hpd,
9469 };
9470}
9471
9472static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
9473 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9474 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
9475 target_ulong *page_size_ptr,
9476 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
9477{
9478 ARMCPU *cpu = env_archcpu(env);
9479 CPUState *cs = CPU(cpu);
9480 /* Read an LPAE long-descriptor translation table. */
9481 ARMFaultType fault_type = ARMFault_Translation;
9482 uint32_t level;
9483 ARMVAParameters param;
9484 uint64_t ttbr;
9485 hwaddr descaddr, indexmask, indexmask_grainsize;
9486 uint32_t tableattrs;
9487 target_ulong page_size;
9488 uint32_t attrs;
9489 int32_t stride;
9490 int addrsize, inputsize;
9491 TCR *tcr = regime_tcr(env, mmu_idx);
9492 int ap, ns, xn, pxn;
9493 uint32_t el = regime_el(env, mmu_idx);
9494 bool ttbr1_valid;
9495 uint64_t descaddrmask;
9496 bool aarch64 = arm_el_is_aa64(env, el);
9497 bool guarded = false;
9498
9499 /* TODO:
9500 * This code does not handle the different format TCR for VTCR_EL2.
9501 * This code also does not support shareability levels.
9502 * Attribute and permission bit handling should also be checked when adding
9503 * support for those page table walks.
9504 */
9505 if (aarch64) {
9506 param = aa64_va_parameters(env, address, mmu_idx,
9507 access_type != MMU_INST_FETCH);
9508 level = 0;
9509 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
9510 * invalid.
9511 */
9512 ttbr1_valid = (el < 2);
9513 addrsize = 64 - 8 * param.tbi;
9514 inputsize = 64 - param.tsz;
9515 } else {
9516 param = aa32_va_parameters(env, address, mmu_idx);
9517 level = 1;
9518 /* There is no TTBR1 for EL2 */
9519 ttbr1_valid = (el != 2);
9520 addrsize = (mmu_idx == ARMMMUIdx_S2NS ? 40 : 32);
9521 inputsize = addrsize - param.tsz;
9522 }
9523
9524 /*
9525 * We determined the region when collecting the parameters, but we
9526 * have not yet validated that the address is valid for the region.
9527 * Extract the top bits and verify that they all match select.
9528 *
9529 * For aa32, if inputsize == addrsize, then we have selected the
9530 * region by exclusion in aa32_va_parameters and there is no more
9531 * validation to do here.
9532 */
9533 if (inputsize < addrsize) {
9534 target_ulong top_bits = sextract64(address, inputsize,
9535 addrsize - inputsize);
9536 if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
9537 /* The gap between the two regions is a Translation fault */
9538 fault_type = ARMFault_Translation;
9539 goto do_fault;
9540 }
9541 }
9542
9543 if (param.using64k) {
9544 stride = 13;
9545 } else if (param.using16k) {
9546 stride = 11;
9547 } else {
9548 stride = 9;
9549 }
9550
9551 /* Note that QEMU ignores shareability and cacheability attributes,
9552 * so we don't need to do anything with the SH, ORGN, IRGN fields
9553 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
9554 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
9555 * implement any ASID-like capability so we can ignore it (instead
9556 * we will always flush the TLB any time the ASID is changed).
9557 */
9558 ttbr = regime_ttbr(env, mmu_idx, param.select);
9559
9560 /* Here we should have set up all the parameters for the translation:
9561 * inputsize, ttbr, epd, stride, tbi
9562 */
9563
9564 if (param.epd) {
9565 /* Translation table walk disabled => Translation fault on TLB miss
9566 * Note: This is always 0 on 64-bit EL2 and EL3.
9567 */
9568 goto do_fault;
9569 }
9570
9571 if (mmu_idx != ARMMMUIdx_S2NS) {
9572 /* The starting level depends on the virtual address size (which can
9573 * be up to 48 bits) and the translation granule size. It indicates
9574 * the number of strides (stride bits at a time) needed to
9575 * consume the bits of the input address. In the pseudocode this is:
9576 * level = 4 - RoundUp((inputsize - grainsize) / stride)
9577 * where their 'inputsize' is our 'inputsize', 'grainsize' is
9578 * our 'stride + 3' and 'stride' is our 'stride'.
9579 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
9580 * = 4 - (inputsize - stride - 3 + stride - 1) / stride
9581 * = 4 - (inputsize - 4) / stride;
9582 */
9583 level = 4 - (inputsize - 4) / stride;
9584 } else {
9585 /* For stage 2 translations the starting level is specified by the
9586 * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
9587 */
9588 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2);
9589 uint32_t startlevel;
9590 bool ok;
9591
9592 if (!aarch64 || stride == 9) {
9593 /* AArch32 or 4KB pages */
9594 startlevel = 2 - sl0;
9595 } else {
9596 /* 16KB or 64KB pages */
9597 startlevel = 3 - sl0;
9598 }
9599
9600 /* Check that the starting level is valid. */
9601 ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
9602 inputsize, stride);
9603 if (!ok) {
9604 fault_type = ARMFault_Translation;
9605 goto do_fault;
9606 }
9607 level = startlevel;
9608 }
9609
9610 indexmask_grainsize = (1ULL << (stride + 3)) - 1;
9611 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
9612
9613 /* Now we can extract the actual base address from the TTBR */
9614 descaddr = extract64(ttbr, 0, 48);
9615 descaddr &= ~indexmask;
9616
9617 /* The address field in the descriptor goes up to bit 39 for ARMv7
9618 * but up to bit 47 for ARMv8, but we use the descaddrmask
9619 * up to bit 39 for AArch32, because we don't need other bits in that case
9620 * to construct next descriptor address (anyway they should be all zeroes).
9621 */
9622 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) &
9623 ~indexmask_grainsize;
9624
9625 /* Secure accesses start with the page table in secure memory and
9626 * can be downgraded to non-secure at any step. Non-secure accesses
9627 * remain non-secure. We implement this by just ORing in the NSTable/NS
9628 * bits at each step.
9629 */
9630 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
9631 for (;;) {
9632 uint64_t descriptor;
9633 bool nstable;
9634
9635 descaddr |= (address >> (stride * (4 - level))) & indexmask;
9636 descaddr &= ~7ULL;
9637 nstable = extract32(tableattrs, 4, 1);
9638 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi);
9639 if (fi->type != ARMFault_None) {
9640 goto do_fault;
9641 }
9642
9643 if (!(descriptor & 1) ||
9644 (!(descriptor & 2) && (level == 3))) {
9645 /* Invalid, or the Reserved level 3 encoding */
9646 goto do_fault;
9647 }
9648 descaddr = descriptor & descaddrmask;
9649
9650 if ((descriptor & 2) && (level < 3)) {
9651 /* Table entry. The top five bits are attributes which may
9652 * propagate down through lower levels of the table (and
9653 * which are all arranged so that 0 means "no effect", so
9654 * we can gather them up by ORing in the bits at each level).
9655 */
9656 tableattrs |= extract64(descriptor, 59, 5);
9657 level++;
9658 indexmask = indexmask_grainsize;
9659 continue;
9660 }
9661 /* Block entry at level 1 or 2, or page entry at level 3.
9662 * These are basically the same thing, although the number
9663 * of bits we pull in from the vaddr varies.
9664 */
9665 page_size = (1ULL << ((stride * (4 - level)) + 3));
9666 descaddr |= (address & (page_size - 1));
9667 /* Extract attributes from the descriptor */
9668 attrs = extract64(descriptor, 2, 10)
9669 | (extract64(descriptor, 52, 12) << 10);
9670
9671 if (mmu_idx == ARMMMUIdx_S2NS) {
9672 /* Stage 2 table descriptors do not include any attribute fields */
9673 break;
9674 }
9675 /* Merge in attributes from table descriptors */
9676 attrs |= nstable << 3; /* NS */
9677 guarded = extract64(descriptor, 50, 1); /* GP */
9678 if (param.hpd) {
9679 /* HPD disables all the table attributes except NSTable. */
9680 break;
9681 }
9682 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */
9683 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
9684 * means "force PL1 access only", which means forcing AP[1] to 0.
9685 */
9686 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */
9687 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */
9688 break;
9689 }
9690 /* Here descaddr is the final physical address, and attributes
9691 * are all in attrs.
9692 */
9693 fault_type = ARMFault_AccessFlag;
9694 if ((attrs & (1 << 8)) == 0) {
9695 /* Access flag */
9696 goto do_fault;
9697 }
9698
9699 ap = extract32(attrs, 4, 2);
9700 xn = extract32(attrs, 12, 1);
9701
9702 if (mmu_idx == ARMMMUIdx_S2NS) {
9703 ns = true;
9704 *prot = get_S2prot(env, ap, xn);
9705 } else {
9706 ns = extract32(attrs, 3, 1);
9707 pxn = extract32(attrs, 11, 1);
9708 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
9709 }
9710
9711 fault_type = ARMFault_Permission;
9712 if (!(*prot & (1 << access_type))) {
9713 goto do_fault;
9714 }
9715
9716 if (ns) {
9717 /* The NS bit will (as required by the architecture) have no effect if
9718 * the CPU doesn't support TZ or this is a non-secure translation
9719 * regime, because the attribute will already be non-secure.
9720 */
9721 txattrs->secure = false;
9722 }
9723 /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB. */
9724 if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) {
9725 txattrs->target_tlb_bit0 = true;
9726 }
9727
9728 if (cacheattrs != NULL) {
9729 if (mmu_idx == ARMMMUIdx_S2NS) {
9730 cacheattrs->attrs = convert_stage2_attrs(env,
9731 extract32(attrs, 0, 4));
9732 } else {
9733 /* Index into MAIR registers for cache attributes */
9734 uint8_t attrindx = extract32(attrs, 0, 3);
9735 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
9736 assert(attrindx <= 7);
9737 cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
9738 }
9739 cacheattrs->shareability = extract32(attrs, 6, 2);
9740 }
9741
9742 *phys_ptr = descaddr;
9743 *page_size_ptr = page_size;
9744 return false;
9745
9746do_fault:
9747 fi->type = fault_type;
9748 fi->level = level;
9749 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */
9750 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS);
9751 return true;
9752}
9753
9754static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
9755 ARMMMUIdx mmu_idx,
9756 int32_t address, int *prot)
9757{
9758 if (!arm_feature(env, ARM_FEATURE_M)) {
9759 *prot = PAGE_READ | PAGE_WRITE;
9760 switch (address) {
9761 case 0xF0000000 ... 0xFFFFFFFF:
9762 if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
9763 /* hivecs execing is ok */
9764 *prot |= PAGE_EXEC;
9765 }
9766 break;
9767 case 0x00000000 ... 0x7FFFFFFF:
9768 *prot |= PAGE_EXEC;
9769 break;
9770 }
9771 } else {
9772 /* Default system address map for M profile cores.
9773 * The architecture specifies which regions are execute-never;
9774 * at the MPU level no other checks are defined.
9775 */
9776 switch (address) {
9777 case 0x00000000 ... 0x1fffffff: /* ROM */
9778 case 0x20000000 ... 0x3fffffff: /* SRAM */
9779 case 0x60000000 ... 0x7fffffff: /* RAM */
9780 case 0x80000000 ... 0x9fffffff: /* RAM */
9781 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
9782 break;
9783 case 0x40000000 ... 0x5fffffff: /* Peripheral */
9784 case 0xa0000000 ... 0xbfffffff: /* Device */
9785 case 0xc0000000 ... 0xdfffffff: /* Device */
9786 case 0xe0000000 ... 0xffffffff: /* System */
9787 *prot = PAGE_READ | PAGE_WRITE;
9788 break;
9789 default:
9790 g_assert_not_reached();
9791 }
9792 }
9793}
9794
9795static bool pmsav7_use_background_region(ARMCPU *cpu,
9796 ARMMMUIdx mmu_idx, bool is_user)
9797{
9798 /* Return true if we should use the default memory map as a
9799 * "background" region if there are no hits against any MPU regions.
9800 */
9801 CPUARMState *env = &cpu->env;
9802
9803 if (is_user) {
9804 return false;
9805 }
9806
9807 if (arm_feature(env, ARM_FEATURE_M)) {
9808 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)]
9809 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
9810 } else {
9811 return regime_sctlr(env, mmu_idx) & SCTLR_BR;
9812 }
9813}
9814
9815static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
9816{
9817 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
9818 return arm_feature(env, ARM_FEATURE_M) &&
9819 extract32(address, 20, 12) == 0xe00;
9820}
9821
9822static inline bool m_is_system_region(CPUARMState *env, uint32_t address)
9823{
9824 /* True if address is in the M profile system region
9825 * 0xe0000000 - 0xffffffff
9826 */
9827 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
9828}
9829
9830static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
9831 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9832 hwaddr *phys_ptr, int *prot,
9833 target_ulong *page_size,
9834 ARMMMUFaultInfo *fi)
9835{
9836 ARMCPU *cpu = env_archcpu(env);
9837 int n;
9838 bool is_user = regime_is_user(env, mmu_idx);
9839
9840 *phys_ptr = address;
9841 *page_size = TARGET_PAGE_SIZE;
9842 *prot = 0;
9843
9844 if (regime_translation_disabled(env, mmu_idx) ||
9845 m_is_ppb_region(env, address)) {
9846 /* MPU disabled or M profile PPB access: use default memory map.
9847 * The other case which uses the default memory map in the
9848 * v7M ARM ARM pseudocode is exception vector reads from the vector
9849 * table. In QEMU those accesses are done in arm_v7m_load_vector(),
9850 * which always does a direct read using address_space_ldl(), rather
9851 * than going via this function, so we don't need to check that here.
9852 */
9853 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
9854 } else { /* MPU enabled */
9855 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
9856 /* region search */
9857 uint32_t base = env->pmsav7.drbar[n];
9858 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
9859 uint32_t rmask;
9860 bool srdis = false;
9861
9862 if (!(env->pmsav7.drsr[n] & 0x1)) {
9863 continue;
9864 }
9865
9866 if (!rsize) {
9867 qemu_log_mask(LOG_GUEST_ERROR,
9868 "DRSR[%d]: Rsize field cannot be 0\n", n);
9869 continue;
9870 }
9871 rsize++;
9872 rmask = (1ull << rsize) - 1;
9873
9874 if (base & rmask) {
9875 qemu_log_mask(LOG_GUEST_ERROR,
9876 "DRBAR[%d]: 0x%" PRIx32 " misaligned "
9877 "to DRSR region size, mask = 0x%" PRIx32 "\n",
9878 n, base, rmask);
9879 continue;
9880 }
9881
9882 if (address < base || address > base + rmask) {
9883 /*
9884 * Address not in this region. We must check whether the
9885 * region covers addresses in the same page as our address.
9886 * In that case we must not report a size that covers the
9887 * whole page for a subsequent hit against a different MPU
9888 * region or the background region, because it would result in
9889 * incorrect TLB hits for subsequent accesses to addresses that
9890 * are in this MPU region.
9891 */
9892 if (ranges_overlap(base, rmask,
9893 address & TARGET_PAGE_MASK,
9894 TARGET_PAGE_SIZE)) {
9895 *page_size = 1;
9896 }
9897 continue;
9898 }
9899
9900 /* Region matched */
9901
9902 if (rsize >= 8) { /* no subregions for regions < 256 bytes */
9903 int i, snd;
9904 uint32_t srdis_mask;
9905
9906 rsize -= 3; /* sub region size (power of 2) */
9907 snd = ((address - base) >> rsize) & 0x7;
9908 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
9909
9910 srdis_mask = srdis ? 0x3 : 0x0;
9911 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
9912 /* This will check in groups of 2, 4 and then 8, whether
9913 * the subregion bits are consistent. rsize is incremented
9914 * back up to give the region size, considering consistent
9915 * adjacent subregions as one region. Stop testing if rsize
9916 * is already big enough for an entire QEMU page.
9917 */
9918 int snd_rounded = snd & ~(i - 1);
9919 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
9920 snd_rounded + 8, i);
9921 if (srdis_mask ^ srdis_multi) {
9922 break;
9923 }
9924 srdis_mask = (srdis_mask << i) | srdis_mask;
9925 rsize++;
9926 }
9927 }
9928 if (srdis) {
9929 continue;
9930 }
9931 if (rsize < TARGET_PAGE_BITS) {
9932 *page_size = 1 << rsize;
9933 }
9934 break;
9935 }
9936
9937 if (n == -1) { /* no hits */
9938 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
9939 /* background fault */
9940 fi->type = ARMFault_Background;
9941 return true;
9942 }
9943 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
9944 } else { /* a MPU hit! */
9945 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
9946 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
9947
9948 if (m_is_system_region(env, address)) {
9949 /* System space is always execute never */
9950 xn = 1;
9951 }
9952
9953 if (is_user) { /* User mode AP bit decoding */
9954 switch (ap) {
9955 case 0:
9956 case 1:
9957 case 5:
9958 break; /* no access */
9959 case 3:
9960 *prot |= PAGE_WRITE;
9961 /* fall through */
9962 case 2:
9963 case 6:
9964 *prot |= PAGE_READ | PAGE_EXEC;
9965 break;
9966 case 7:
9967 /* for v7M, same as 6; for R profile a reserved value */
9968 if (arm_feature(env, ARM_FEATURE_M)) {
9969 *prot |= PAGE_READ | PAGE_EXEC;
9970 break;
9971 }
9972 /* fall through */
9973 default:
9974 qemu_log_mask(LOG_GUEST_ERROR,
9975 "DRACR[%d]: Bad value for AP bits: 0x%"
9976 PRIx32 "\n", n, ap);
9977 }
9978 } else { /* Priv. mode AP bits decoding */
9979 switch (ap) {
9980 case 0:
9981 break; /* no access */
9982 case 1:
9983 case 2:
9984 case 3:
9985 *prot |= PAGE_WRITE;
9986 /* fall through */
9987 case 5:
9988 case 6:
9989 *prot |= PAGE_READ | PAGE_EXEC;
9990 break;
9991 case 7:
9992 /* for v7M, same as 6; for R profile a reserved value */
9993 if (arm_feature(env, ARM_FEATURE_M)) {
9994 *prot |= PAGE_READ | PAGE_EXEC;
9995 break;
9996 }
9997 /* fall through */
9998 default:
9999 qemu_log_mask(LOG_GUEST_ERROR,
10000 "DRACR[%d]: Bad value for AP bits: 0x%"
10001 PRIx32 "\n", n, ap);
10002 }
10003 }
10004
10005 /* execute never */
10006 if (xn) {
10007 *prot &= ~PAGE_EXEC;
10008 }
10009 }
10010 }
10011
10012 fi->type = ARMFault_Permission;
10013 fi->level = 1;
10014 return !(*prot & (1 << access_type));
10015}
10016
10017static bool v8m_is_sau_exempt(CPUARMState *env,
10018 uint32_t address, MMUAccessType access_type)
10019{
10020 /* The architecture specifies that certain address ranges are
10021 * exempt from v8M SAU/IDAU checks.
10022 */
10023 return
10024 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
10025 (address >= 0xe0000000 && address <= 0xe0002fff) ||
10026 (address >= 0xe000e000 && address <= 0xe000efff) ||
10027 (address >= 0xe002e000 && address <= 0xe002efff) ||
10028 (address >= 0xe0040000 && address <= 0xe0041fff) ||
10029 (address >= 0xe00ff000 && address <= 0xe00fffff);
10030}
10031
10032void v8m_security_lookup(CPUARMState *env, uint32_t address,
10033 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10034 V8M_SAttributes *sattrs)
10035{
10036 /* Look up the security attributes for this address. Compare the
10037 * pseudocode SecurityCheck() function.
10038 * We assume the caller has zero-initialized *sattrs.
10039 */
10040 ARMCPU *cpu = env_archcpu(env);
10041 int r;
10042 bool idau_exempt = false, idau_ns = true, idau_nsc = true;
10043 int idau_region = IREGION_NOTVALID;
10044 uint32_t addr_page_base = address & TARGET_PAGE_MASK;
10045 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
10046
10047 if (cpu->idau) {
10048 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
10049 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
10050
10051 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
10052 &idau_nsc);
10053 }
10054
10055 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
10056 /* 0xf0000000..0xffffffff is always S for insn fetches */
10057 return;
10058 }
10059
10060 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
10061 sattrs->ns = !regime_is_secure(env, mmu_idx);
10062 return;
10063 }
10064
10065 if (idau_region != IREGION_NOTVALID) {
10066 sattrs->irvalid = true;
10067 sattrs->iregion = idau_region;
10068 }
10069
10070 switch (env->sau.ctrl & 3) {
10071 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
10072 break;
10073 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
10074 sattrs->ns = true;
10075 break;
10076 default: /* SAU.ENABLE == 1 */
10077 for (r = 0; r < cpu->sau_sregion; r++) {
10078 if (env->sau.rlar[r] & 1) {
10079 uint32_t base = env->sau.rbar[r] & ~0x1f;
10080 uint32_t limit = env->sau.rlar[r] | 0x1f;
10081
10082 if (base <= address && limit >= address) {
10083 if (base > addr_page_base || limit < addr_page_limit) {
10084 sattrs->subpage = true;
10085 }
10086 if (sattrs->srvalid) {
10087 /* If we hit in more than one region then we must report
10088 * as Secure, not NS-Callable, with no valid region
10089 * number info.
10090 */
10091 sattrs->ns = false;
10092 sattrs->nsc = false;
10093 sattrs->sregion = 0;
10094 sattrs->srvalid = false;
10095 break;
10096 } else {
10097 if (env->sau.rlar[r] & 2) {
10098 sattrs->nsc = true;
10099 } else {
10100 sattrs->ns = true;
10101 }
10102 sattrs->srvalid = true;
10103 sattrs->sregion = r;
10104 }
10105 } else {
10106 /*
10107 * Address not in this region. We must check whether the
10108 * region covers addresses in the same page as our address.
10109 * In that case we must not report a size that covers the
10110 * whole page for a subsequent hit against a different MPU
10111 * region or the background region, because it would result
10112 * in incorrect TLB hits for subsequent accesses to
10113 * addresses that are in this MPU region.
10114 */
10115 if (limit >= base &&
10116 ranges_overlap(base, limit - base + 1,
10117 addr_page_base,
10118 TARGET_PAGE_SIZE)) {
10119 sattrs->subpage = true;
10120 }
10121 }
10122 }
10123 }
10124 break;
10125 }
10126
10127 /*
10128 * The IDAU will override the SAU lookup results if it specifies
10129 * higher security than the SAU does.
10130 */
10131 if (!idau_ns) {
10132 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
10133 sattrs->ns = false;
10134 sattrs->nsc = idau_nsc;
10135 }
10136 }
10137}
10138
10139bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
10140 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10141 hwaddr *phys_ptr, MemTxAttrs *txattrs,
10142 int *prot, bool *is_subpage,
10143 ARMMMUFaultInfo *fi, uint32_t *mregion)
10144{
10145 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check
10146 * that a full phys-to-virt translation does).
10147 * mregion is (if not NULL) set to the region number which matched,
10148 * or -1 if no region number is returned (MPU off, address did not
10149 * hit a region, address hit in multiple regions).
10150 * We set is_subpage to true if the region hit doesn't cover the
10151 * entire TARGET_PAGE the address is within.
10152 */
10153 ARMCPU *cpu = env_archcpu(env);
10154 bool is_user = regime_is_user(env, mmu_idx);
10155 uint32_t secure = regime_is_secure(env, mmu_idx);
10156 int n;
10157 int matchregion = -1;
10158 bool hit = false;
10159 uint32_t addr_page_base = address & TARGET_PAGE_MASK;
10160 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
10161
10162 *is_subpage = false;
10163 *phys_ptr = address;
10164 *prot = 0;
10165 if (mregion) {
10166 *mregion = -1;
10167 }
10168
10169 /* Unlike the ARM ARM pseudocode, we don't need to check whether this
10170 * was an exception vector read from the vector table (which is always
10171 * done using the default system address map), because those accesses
10172 * are done in arm_v7m_load_vector(), which always does a direct
10173 * read using address_space_ldl(), rather than going via this function.
10174 */
10175 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
10176 hit = true;
10177 } else if (m_is_ppb_region(env, address)) {
10178 hit = true;
10179 } else {
10180 if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
10181 hit = true;
10182 }
10183
10184 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
10185 /* region search */
10186 /* Note that the base address is bits [31:5] from the register
10187 * with bits [4:0] all zeroes, but the limit address is bits
10188 * [31:5] from the register with bits [4:0] all ones.
10189 */
10190 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f;
10191 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f;
10192
10193 if (!(env->pmsav8.rlar[secure][n] & 0x1)) {
10194 /* Region disabled */
10195 continue;
10196 }
10197
10198 if (address < base || address > limit) {
10199 /*
10200 * Address not in this region. We must check whether the
10201 * region covers addresses in the same page as our address.
10202 * In that case we must not report a size that covers the
10203 * whole page for a subsequent hit against a different MPU
10204 * region or the background region, because it would result in
10205 * incorrect TLB hits for subsequent accesses to addresses that
10206 * are in this MPU region.
10207 */
10208 if (limit >= base &&
10209 ranges_overlap(base, limit - base + 1,
10210 addr_page_base,
10211 TARGET_PAGE_SIZE)) {
10212 *is_subpage = true;
10213 }
10214 continue;
10215 }
10216
10217 if (base > addr_page_base || limit < addr_page_limit) {
10218 *is_subpage = true;
10219 }
10220
10221 if (matchregion != -1) {
10222 /* Multiple regions match -- always a failure (unlike
10223 * PMSAv7 where highest-numbered-region wins)
10224 */
10225 fi->type = ARMFault_Permission;
10226 fi->level = 1;
10227 return true;
10228 }
10229
10230 matchregion = n;
10231 hit = true;
10232 }
10233 }
10234
10235 if (!hit) {
10236 /* background fault */
10237 fi->type = ARMFault_Background;
10238 return true;
10239 }
10240
10241 if (matchregion == -1) {
10242 /* hit using the background region */
10243 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
10244 } else {
10245 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
10246 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
10247
10248 if (m_is_system_region(env, address)) {
10249 /* System space is always execute never */
10250 xn = 1;
10251 }
10252
10253 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
10254 if (*prot && !xn) {
10255 *prot |= PAGE_EXEC;
10256 }
10257 /* We don't need to look the attribute up in the MAIR0/MAIR1
10258 * registers because that only tells us about cacheability.
10259 */
10260 if (mregion) {
10261 *mregion = matchregion;
10262 }
10263 }
10264
10265 fi->type = ARMFault_Permission;
10266 fi->level = 1;
10267 return !(*prot & (1 << access_type));
10268}
10269
10270
10271static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
10272 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10273 hwaddr *phys_ptr, MemTxAttrs *txattrs,
10274 int *prot, target_ulong *page_size,
10275 ARMMMUFaultInfo *fi)
10276{
10277 uint32_t secure = regime_is_secure(env, mmu_idx);
10278 V8M_SAttributes sattrs = {};
10279 bool ret;
10280 bool mpu_is_subpage;
10281
10282 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
10283 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs);
10284 if (access_type == MMU_INST_FETCH) {
10285 /* Instruction fetches always use the MMU bank and the
10286 * transaction attribute determined by the fetch address,
10287 * regardless of CPU state. This is painful for QEMU
10288 * to handle, because it would mean we need to encode
10289 * into the mmu_idx not just the (user, negpri) information
10290 * for the current security state but also that for the
10291 * other security state, which would balloon the number
10292 * of mmu_idx values needed alarmingly.
10293 * Fortunately we can avoid this because it's not actually
10294 * possible to arbitrarily execute code from memory with
10295 * the wrong security attribute: it will always generate
10296 * an exception of some kind or another, apart from the
10297 * special case of an NS CPU executing an SG instruction
10298 * in S&NSC memory. So we always just fail the translation
10299 * here and sort things out in the exception handler
10300 * (including possibly emulating an SG instruction).
10301 */
10302 if (sattrs.ns != !secure) {
10303 if (sattrs.nsc) {
10304 fi->type = ARMFault_QEMU_NSCExec;
10305 } else {
10306 fi->type = ARMFault_QEMU_SFault;
10307 }
10308 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
10309 *phys_ptr = address;
10310 *prot = 0;
10311 return true;
10312 }
10313 } else {
10314 /* For data accesses we always use the MMU bank indicated
10315 * by the current CPU state, but the security attributes
10316 * might downgrade a secure access to nonsecure.
10317 */
10318 if (sattrs.ns) {
10319 txattrs->secure = false;
10320 } else if (!secure) {
10321 /* NS access to S memory must fault.
10322 * Architecturally we should first check whether the
10323 * MPU information for this address indicates that we
10324 * are doing an unaligned access to Device memory, which
10325 * should generate a UsageFault instead. QEMU does not
10326 * currently check for that kind of unaligned access though.
10327 * If we added it we would need to do so as a special case
10328 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
10329 */
10330 fi->type = ARMFault_QEMU_SFault;
10331 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
10332 *phys_ptr = address;
10333 *prot = 0;
10334 return true;
10335 }
10336 }
10337 }
10338
10339 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr,
10340 txattrs, prot, &mpu_is_subpage, fi, NULL);
10341 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE;
10342 return ret;
10343}
10344
10345static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
10346 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10347 hwaddr *phys_ptr, int *prot,
10348 ARMMMUFaultInfo *fi)
10349{
10350 int n;
10351 uint32_t mask;
10352 uint32_t base;
10353 bool is_user = regime_is_user(env, mmu_idx);
10354
10355 if (regime_translation_disabled(env, mmu_idx)) {
10356 /* MPU disabled. */
10357 *phys_ptr = address;
10358 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10359 return false;
10360 }
10361
10362 *phys_ptr = address;
10363 for (n = 7; n >= 0; n--) {
10364 base = env->cp15.c6_region[n];
10365 if ((base & 1) == 0) {
10366 continue;
10367 }
10368 mask = 1 << ((base >> 1) & 0x1f);
10369 /* Keep this shift separate from the above to avoid an
10370 (undefined) << 32. */
10371 mask = (mask << 1) - 1;
10372 if (((base ^ address) & ~mask) == 0) {
10373 break;
10374 }
10375 }
10376 if (n < 0) {
10377 fi->type = ARMFault_Background;
10378 return true;
10379 }
10380
10381 if (access_type == MMU_INST_FETCH) {
10382 mask = env->cp15.pmsav5_insn_ap;
10383 } else {
10384 mask = env->cp15.pmsav5_data_ap;
10385 }
10386 mask = (mask >> (n * 4)) & 0xf;
10387 switch (mask) {
10388 case 0:
10389 fi->type = ARMFault_Permission;
10390 fi->level = 1;
10391 return true;
10392 case 1:
10393 if (is_user) {
10394 fi->type = ARMFault_Permission;
10395 fi->level = 1;
10396 return true;
10397 }
10398 *prot = PAGE_READ | PAGE_WRITE;
10399 break;
10400 case 2:
10401 *prot = PAGE_READ;
10402 if (!is_user) {
10403 *prot |= PAGE_WRITE;
10404 }
10405 break;
10406 case 3:
10407 *prot = PAGE_READ | PAGE_WRITE;
10408 break;
10409 case 5:
10410 if (is_user) {
10411 fi->type = ARMFault_Permission;
10412 fi->level = 1;
10413 return true;
10414 }
10415 *prot = PAGE_READ;
10416 break;
10417 case 6:
10418 *prot = PAGE_READ;
10419 break;
10420 default:
10421 /* Bad permission. */
10422 fi->type = ARMFault_Permission;
10423 fi->level = 1;
10424 return true;
10425 }
10426 *prot |= PAGE_EXEC;
10427 return false;
10428}
10429
10430/* Combine either inner or outer cacheability attributes for normal
10431 * memory, according to table D4-42 and pseudocode procedure
10432 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
10433 *
10434 * NB: only stage 1 includes allocation hints (RW bits), leading to
10435 * some asymmetry.
10436 */
10437static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
10438{
10439 if (s1 == 4 || s2 == 4) {
10440 /* non-cacheable has precedence */
10441 return 4;
10442 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
10443 /* stage 1 write-through takes precedence */
10444 return s1;
10445 } else if (extract32(s2, 2, 2) == 2) {
10446 /* stage 2 write-through takes precedence, but the allocation hint
10447 * is still taken from stage 1
10448 */
10449 return (2 << 2) | extract32(s1, 0, 2);
10450 } else { /* write-back */
10451 return s1;
10452 }
10453}
10454
10455/* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
10456 * and CombineS1S2Desc()
10457 *
10458 * @s1: Attributes from stage 1 walk
10459 * @s2: Attributes from stage 2 walk
10460 */
10461static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
10462{
10463 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
10464 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
10465 ARMCacheAttrs ret;
10466
10467 /* Combine shareability attributes (table D4-43) */
10468 if (s1.shareability == 2 || s2.shareability == 2) {
10469 /* if either are outer-shareable, the result is outer-shareable */
10470 ret.shareability = 2;
10471 } else if (s1.shareability == 3 || s2.shareability == 3) {
10472 /* if either are inner-shareable, the result is inner-shareable */
10473 ret.shareability = 3;
10474 } else {
10475 /* both non-shareable */
10476 ret.shareability = 0;
10477 }
10478
10479 /* Combine memory type and cacheability attributes */
10480 if (s1hi == 0 || s2hi == 0) {
10481 /* Device has precedence over normal */
10482 if (s1lo == 0 || s2lo == 0) {
10483 /* nGnRnE has precedence over anything */
10484 ret.attrs = 0;
10485 } else if (s1lo == 4 || s2lo == 4) {
10486 /* non-Reordering has precedence over Reordering */
10487 ret.attrs = 4; /* nGnRE */
10488 } else if (s1lo == 8 || s2lo == 8) {
10489 /* non-Gathering has precedence over Gathering */
10490 ret.attrs = 8; /* nGRE */
10491 } else {
10492 ret.attrs = 0xc; /* GRE */
10493 }
10494
10495 /* Any location for which the resultant memory type is any
10496 * type of Device memory is always treated as Outer Shareable.
10497 */
10498 ret.shareability = 2;
10499 } else { /* Normal memory */
10500 /* Outer/inner cacheability combine independently */
10501 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
10502 | combine_cacheattr_nibble(s1lo, s2lo);
10503
10504 if (ret.attrs == 0x44) {
10505 /* Any location for which the resultant memory type is Normal
10506 * Inner Non-cacheable, Outer Non-cacheable is always treated
10507 * as Outer Shareable.
10508 */
10509 ret.shareability = 2;
10510 }
10511 }
10512
10513 return ret;
10514}
10515
10516
10517/* get_phys_addr - get the physical address for this virtual address
10518 *
10519 * Find the physical address corresponding to the given virtual address,
10520 * by doing a translation table walk on MMU based systems or using the
10521 * MPU state on MPU based systems.
10522 *
10523 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
10524 * prot and page_size may not be filled in, and the populated fsr value provides
10525 * information on why the translation aborted, in the format of a
10526 * DFSR/IFSR fault register, with the following caveats:
10527 * * we honour the short vs long DFSR format differences.
10528 * * the WnR bit is never set (the caller must do this).
10529 * * for PSMAv5 based systems we don't bother to return a full FSR format
10530 * value.
10531 *
10532 * @env: CPUARMState
10533 * @address: virtual address to get physical address for
10534 * @access_type: 0 for read, 1 for write, 2 for execute
10535 * @mmu_idx: MMU index indicating required translation regime
10536 * @phys_ptr: set to the physical address corresponding to the virtual address
10537 * @attrs: set to the memory transaction attributes to use
10538 * @prot: set to the permissions for the page containing phys_ptr
10539 * @page_size: set to the size of the page containing phys_ptr
10540 * @fi: set to fault info if the translation fails
10541 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
10542 */
10543bool get_phys_addr(CPUARMState *env, target_ulong address,
10544 MMUAccessType access_type, ARMMMUIdx mmu_idx,
10545 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
10546 target_ulong *page_size,
10547 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
10548{
10549 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
10550 /* Call ourselves recursively to do the stage 1 and then stage 2
10551 * translations.
10552 */
10553 if (arm_feature(env, ARM_FEATURE_EL2)) {
10554 hwaddr ipa;
10555 int s2_prot;
10556 int ret;
10557 ARMCacheAttrs cacheattrs2 = {};
10558
10559 ret = get_phys_addr(env, address, access_type,
10560 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
10561 prot, page_size, fi, cacheattrs);
10562
10563 /* If S1 fails or S2 is disabled, return early. */
10564 if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
10565 *phys_ptr = ipa;
10566 return ret;
10567 }
10568
10569 /* S1 is done. Now do S2 translation. */
10570 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
10571 phys_ptr, attrs, &s2_prot,
10572 page_size, fi,
10573 cacheattrs != NULL ? &cacheattrs2 : NULL);
10574 fi->s2addr = ipa;
10575 /* Combine the S1 and S2 perms. */
10576 *prot &= s2_prot;
10577
10578 /* Combine the S1 and S2 cache attributes, if needed */
10579 if (!ret && cacheattrs != NULL) {
10580 if (env->cp15.hcr_el2 & HCR_DC) {
10581 /*
10582 * HCR.DC forces the first stage attributes to
10583 * Normal Non-Shareable,
10584 * Inner Write-Back Read-Allocate Write-Allocate,
10585 * Outer Write-Back Read-Allocate Write-Allocate.
10586 */
10587 cacheattrs->attrs = 0xff;
10588 cacheattrs->shareability = 0;
10589 }
10590 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
10591 }
10592
10593 return ret;
10594 } else {
10595 /*
10596 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
10597 */
10598 mmu_idx = stage_1_mmu_idx(mmu_idx);
10599 }
10600 }
10601
10602 /* The page table entries may downgrade secure to non-secure, but
10603 * cannot upgrade an non-secure translation regime's attributes
10604 * to secure.
10605 */
10606 attrs->secure = regime_is_secure(env, mmu_idx);
10607 attrs->user = regime_is_user(env, mmu_idx);
10608
10609 /* Fast Context Switch Extension. This doesn't exist at all in v8.
10610 * In v7 and earlier it affects all stage 1 translations.
10611 */
10612 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS
10613 && !arm_feature(env, ARM_FEATURE_V8)) {
10614 if (regime_el(env, mmu_idx) == 3) {
10615 address += env->cp15.fcseidr_s;
10616 } else {
10617 address += env->cp15.fcseidr_ns;
10618 }
10619 }
10620
10621 if (arm_feature(env, ARM_FEATURE_PMSA)) {
10622 bool ret;
10623 *page_size = TARGET_PAGE_SIZE;
10624
10625 if (arm_feature(env, ARM_FEATURE_V8)) {
10626 /* PMSAv8 */
10627 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
10628 phys_ptr, attrs, prot, page_size, fi);
10629 } else if (arm_feature(env, ARM_FEATURE_V7)) {
10630 /* PMSAv7 */
10631 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
10632 phys_ptr, prot, page_size, fi);
10633 } else {
10634 /* Pre-v7 MPU */
10635 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
10636 phys_ptr, prot, fi);
10637 }
10638 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
10639 " mmu_idx %u -> %s (prot %c%c%c)\n",
10640 access_type == MMU_DATA_LOAD ? "reading" :
10641 (access_type == MMU_DATA_STORE ? "writing" : "execute"),
10642 (uint32_t)address, mmu_idx,
10643 ret ? "Miss" : "Hit",
10644 *prot & PAGE_READ ? 'r' : '-',
10645 *prot & PAGE_WRITE ? 'w' : '-',
10646 *prot & PAGE_EXEC ? 'x' : '-');
10647
10648 return ret;
10649 }
10650
10651 /* Definitely a real MMU, not an MPU */
10652
10653 if (regime_translation_disabled(env, mmu_idx)) {
10654 /* MMU disabled. */
10655 *phys_ptr = address;
10656 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10657 *page_size = TARGET_PAGE_SIZE;
10658 return 0;
10659 }
10660
10661 if (regime_using_lpae_format(env, mmu_idx)) {
10662 return get_phys_addr_lpae(env, address, access_type, mmu_idx,
10663 phys_ptr, attrs, prot, page_size,
10664 fi, cacheattrs);
10665 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
10666 return get_phys_addr_v6(env, address, access_type, mmu_idx,
10667 phys_ptr, attrs, prot, page_size, fi);
10668 } else {
10669 return get_phys_addr_v5(env, address, access_type, mmu_idx,
10670 phys_ptr, prot, page_size, fi);
10671 }
10672}
10673
10674hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
10675 MemTxAttrs *attrs)
10676{
10677 ARMCPU *cpu = ARM_CPU(cs);
10678 CPUARMState *env = &cpu->env;
10679 hwaddr phys_addr;
10680 target_ulong page_size;
10681 int prot;
10682 bool ret;
10683 ARMMMUFaultInfo fi = {};
10684 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
10685
10686 *attrs = (MemTxAttrs) {};
10687
10688 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
10689 attrs, &prot, &page_size, &fi, NULL);
10690
10691 if (ret) {
10692 return -1;
10693 }
10694 return phys_addr;
10695}
10696
10697#endif
10698
10699/* Note that signed overflow is undefined in C. The following routines are
10700 careful to use unsigned types where modulo arithmetic is required.
10701 Failure to do so _will_ break on newer gcc. */
10702
10703/* Signed saturating arithmetic. */
10704
10705/* Perform 16-bit signed saturating addition. */
10706static inline uint16_t add16_sat(uint16_t a, uint16_t b)
10707{
10708 uint16_t res;
10709
10710 res = a + b;
10711 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
10712 if (a & 0x8000)
10713 res = 0x8000;
10714 else
10715 res = 0x7fff;
10716 }
10717 return res;
10718}
10719
10720/* Perform 8-bit signed saturating addition. */
10721static inline uint8_t add8_sat(uint8_t a, uint8_t b)
10722{
10723 uint8_t res;
10724
10725 res = a + b;
10726 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
10727 if (a & 0x80)
10728 res = 0x80;
10729 else
10730 res = 0x7f;
10731 }
10732 return res;
10733}
10734
10735/* Perform 16-bit signed saturating subtraction. */
10736static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
10737{
10738 uint16_t res;
10739
10740 res = a - b;
10741 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
10742 if (a & 0x8000)
10743 res = 0x8000;
10744 else
10745 res = 0x7fff;
10746 }
10747 return res;
10748}
10749
10750/* Perform 8-bit signed saturating subtraction. */
10751static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
10752{
10753 uint8_t res;
10754
10755 res = a - b;
10756 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
10757 if (a & 0x80)
10758 res = 0x80;
10759 else
10760 res = 0x7f;
10761 }
10762 return res;
10763}
10764
10765#define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
10766#define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
10767#define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8);
10768#define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8);
10769#define PFX q
10770
10771#include "op_addsub.h"
10772
10773/* Unsigned saturating arithmetic. */
10774static inline uint16_t add16_usat(uint16_t a, uint16_t b)
10775{
10776 uint16_t res;
10777 res = a + b;
10778 if (res < a)
10779 res = 0xffff;
10780 return res;
10781}
10782
10783static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
10784{
10785 if (a > b)
10786 return a - b;
10787 else
10788 return 0;
10789}
10790
10791static inline uint8_t add8_usat(uint8_t a, uint8_t b)
10792{
10793 uint8_t res;
10794 res = a + b;
10795 if (res < a)
10796 res = 0xff;
10797 return res;
10798}
10799
10800static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
10801{
10802 if (a > b)
10803 return a - b;
10804 else
10805 return 0;
10806}
10807
10808#define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
10809#define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
10810#define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8);
10811#define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8);
10812#define PFX uq
10813
10814#include "op_addsub.h"
10815
10816/* Signed modulo arithmetic. */
10817#define SARITH16(a, b, n, op) do { \
10818 int32_t sum; \
10819 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
10820 RESULT(sum, n, 16); \
10821 if (sum >= 0) \
10822 ge |= 3 << (n * 2); \
10823 } while(0)
10824
10825#define SARITH8(a, b, n, op) do { \
10826 int32_t sum; \
10827 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
10828 RESULT(sum, n, 8); \
10829 if (sum >= 0) \
10830 ge |= 1 << n; \
10831 } while(0)
10832
10833
10834#define ADD16(a, b, n) SARITH16(a, b, n, +)
10835#define SUB16(a, b, n) SARITH16(a, b, n, -)
10836#define ADD8(a, b, n) SARITH8(a, b, n, +)
10837#define SUB8(a, b, n) SARITH8(a, b, n, -)
10838#define PFX s
10839#define ARITH_GE
10840
10841#include "op_addsub.h"
10842
10843/* Unsigned modulo arithmetic. */
10844#define ADD16(a, b, n) do { \
10845 uint32_t sum; \
10846 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
10847 RESULT(sum, n, 16); \
10848 if ((sum >> 16) == 1) \
10849 ge |= 3 << (n * 2); \
10850 } while(0)
10851
10852#define ADD8(a, b, n) do { \
10853 uint32_t sum; \
10854 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
10855 RESULT(sum, n, 8); \
10856 if ((sum >> 8) == 1) \
10857 ge |= 1 << n; \
10858 } while(0)
10859
10860#define SUB16(a, b, n) do { \
10861 uint32_t sum; \
10862 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
10863 RESULT(sum, n, 16); \
10864 if ((sum >> 16) == 0) \
10865 ge |= 3 << (n * 2); \
10866 } while(0)
10867
10868#define SUB8(a, b, n) do { \
10869 uint32_t sum; \
10870 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
10871 RESULT(sum, n, 8); \
10872 if ((sum >> 8) == 0) \
10873 ge |= 1 << n; \
10874 } while(0)
10875
10876#define PFX u
10877#define ARITH_GE
10878
10879#include "op_addsub.h"
10880
10881/* Halved signed arithmetic. */
10882#define ADD16(a, b, n) \
10883 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
10884#define SUB16(a, b, n) \
10885 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
10886#define ADD8(a, b, n) \
10887 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
10888#define SUB8(a, b, n) \
10889 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
10890#define PFX sh
10891
10892#include "op_addsub.h"
10893
10894/* Halved unsigned arithmetic. */
10895#define ADD16(a, b, n) \
10896 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
10897#define SUB16(a, b, n) \
10898 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
10899#define ADD8(a, b, n) \
10900 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
10901#define SUB8(a, b, n) \
10902 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
10903#define PFX uh
10904
10905#include "op_addsub.h"
10906
10907static inline uint8_t do_usad(uint8_t a, uint8_t b)
10908{
10909 if (a > b)
10910 return a - b;
10911 else
10912 return b - a;
10913}
10914
10915/* Unsigned sum of absolute byte differences. */
10916uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
10917{
10918 uint32_t sum;
10919 sum = do_usad(a, b);
10920 sum += do_usad(a >> 8, b >> 8);
10921 sum += do_usad(a >> 16, b >>16);
10922 sum += do_usad(a >> 24, b >> 24);
10923 return sum;
10924}
10925
10926/* For ARMv6 SEL instruction. */
10927uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
10928{
10929 uint32_t mask;
10930
10931 mask = 0;
10932 if (flags & 1)
10933 mask |= 0xff;
10934 if (flags & 2)
10935 mask |= 0xff00;
10936 if (flags & 4)
10937 mask |= 0xff0000;
10938 if (flags & 8)
10939 mask |= 0xff000000;
10940 return (a & mask) | (b & ~mask);
10941}
10942
10943/* CRC helpers.
10944 * The upper bytes of val (above the number specified by 'bytes') must have
10945 * been zeroed out by the caller.
10946 */
10947uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
10948{
10949 uint8_t buf[4];
10950
10951 stl_le_p(buf, val);
10952
10953 /* zlib crc32 converts the accumulator and output to one's complement. */
10954 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
10955}
10956
10957uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
10958{
10959 uint8_t buf[4];
10960
10961 stl_le_p(buf, val);
10962
10963 /* Linux crc32c converts the output to one's complement. */
10964 return crc32c(acc, buf, bytes) ^ 0xffffffff;
10965}
10966
10967/* Return the exception level to which FP-disabled exceptions should
10968 * be taken, or 0 if FP is enabled.
10969 */
10970int fp_exception_el(CPUARMState *env, int cur_el)
10971{
10972#ifndef CONFIG_USER_ONLY
10973 int fpen;
10974
10975 /* CPACR and the CPTR registers don't exist before v6, so FP is
10976 * always accessible
10977 */
10978 if (!arm_feature(env, ARM_FEATURE_V6)) {
10979 return 0;
10980 }
10981
10982 if (arm_feature(env, ARM_FEATURE_M)) {
10983 /* CPACR can cause a NOCP UsageFault taken to current security state */
10984 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) {
10985 return 1;
10986 }
10987
10988 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) {
10989 if (!extract32(env->v7m.nsacr, 10, 1)) {
10990 /* FP insns cause a NOCP UsageFault taken to Secure */
10991 return 3;
10992 }
10993 }
10994
10995 return 0;
10996 }
10997
10998 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
10999 * 0, 2 : trap EL0 and EL1/PL1 accesses
11000 * 1 : trap only EL0 accesses
11001 * 3 : trap no accesses
11002 */
11003 fpen = extract32(env->cp15.cpacr_el1, 20, 2);
11004 switch (fpen) {
11005 case 0:
11006 case 2:
11007 if (cur_el == 0 || cur_el == 1) {
11008 /* Trap to PL1, which might be EL1 or EL3 */
11009 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
11010 return 3;
11011 }
11012 return 1;
11013 }
11014 if (cur_el == 3 && !is_a64(env)) {
11015 /* Secure PL1 running at EL3 */
11016 return 3;
11017 }
11018 break;
11019 case 1:
11020 if (cur_el == 0) {
11021 return 1;
11022 }
11023 break;
11024 case 3:
11025 break;
11026 }
11027
11028 /*
11029 * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode
11030 * to control non-secure access to the FPU. It doesn't have any
11031 * effect if EL3 is AArch64 or if EL3 doesn't exist at all.
11032 */
11033 if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
11034 cur_el <= 2 && !arm_is_secure_below_el3(env))) {
11035 if (!extract32(env->cp15.nsacr, 10, 1)) {
11036 /* FP insns act as UNDEF */
11037 return cur_el == 2 ? 2 : 1;
11038 }
11039 }
11040
11041 /* For the CPTR registers we don't need to guard with an ARM_FEATURE
11042 * check because zero bits in the registers mean "don't trap".
11043 */
11044
11045 /* CPTR_EL2 : present in v7VE or v8 */
11046 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
11047 && !arm_is_secure_below_el3(env)) {
11048 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
11049 return 2;
11050 }
11051
11052 /* CPTR_EL3 : present in v8 */
11053 if (extract32(env->cp15.cptr_el[3], 10, 1)) {
11054 /* Trap all FP ops to EL3 */
11055 return 3;
11056 }
11057#endif
11058 return 0;
11059}
11060
11061#ifndef CONFIG_TCG
11062ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
11063{
11064 g_assert_not_reached();
11065}
11066#endif
11067
11068ARMMMUIdx arm_mmu_idx(CPUARMState *env)
11069{
11070 int el;
11071
11072 if (arm_feature(env, ARM_FEATURE_M)) {
11073 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
11074 }
11075
11076 el = arm_current_el(env);
11077 if (el < 2 && arm_is_secure_below_el3(env)) {
11078 return ARMMMUIdx_S1SE0 + el;
11079 } else {
11080 return ARMMMUIdx_S12NSE0 + el;
11081 }
11082}
11083
11084int cpu_mmu_index(CPUARMState *env, bool ifetch)
11085{
11086 return arm_to_core_mmu_idx(arm_mmu_idx(env));
11087}
11088
11089#ifndef CONFIG_USER_ONLY
11090ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
11091{
11092 return stage_1_mmu_idx(arm_mmu_idx(env));
11093}
11094#endif
11095
11096void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
11097 target_ulong *cs_base, uint32_t *pflags)
11098{
11099 ARMMMUIdx mmu_idx = arm_mmu_idx(env);
11100 int current_el = arm_current_el(env);
11101 int fp_el = fp_exception_el(env, current_el);
11102 uint32_t flags = 0;
11103
11104 if (is_a64(env)) {
11105 ARMCPU *cpu = env_archcpu(env);
11106 uint64_t sctlr;
11107
11108 *pc = env->pc;
11109 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1);
11110
11111 /* Get control bits for tagged addresses. */
11112 {
11113 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
11114 ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1);
11115 int tbii, tbid;
11116
11117 /* FIXME: ARMv8.1-VHE S2 translation regime. */
11118 if (regime_el(env, stage1) < 2) {
11119 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1);
11120 tbid = (p1.tbi << 1) | p0.tbi;
11121 tbii = tbid & ~((p1.tbid << 1) | p0.tbid);
11122 } else {
11123 tbid = p0.tbi;
11124 tbii = tbid & !p0.tbid;
11125 }
11126
11127 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
11128 flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
11129 }
11130
11131 if (cpu_isar_feature(aa64_sve, cpu)) {
11132 int sve_el = sve_exception_el(env, current_el);
11133 uint32_t zcr_len;
11134
11135 /* If SVE is disabled, but FP is enabled,
11136 * then the effective len is 0.
11137 */
11138 if (sve_el != 0 && fp_el == 0) {
11139 zcr_len = 0;
11140 } else {
11141 zcr_len = sve_zcr_len_for_el(env, current_el);
11142 }
11143 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el);
11144 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len);
11145 }
11146
11147 sctlr = arm_sctlr(env, current_el);
11148
11149 if (cpu_isar_feature(aa64_pauth, cpu)) {
11150 /*
11151 * In order to save space in flags, we record only whether
11152 * pauth is "inactive", meaning all insns are implemented as
11153 * a nop, or "active" when some action must be performed.
11154 * The decision of which action to take is left to a helper.
11155 */
11156 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
11157 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1);
11158 }
11159 }
11160
11161 if (cpu_isar_feature(aa64_bti, cpu)) {
11162 /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */
11163 if (sctlr & (current_el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
11164 flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1);
11165 }
11166 flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype);
11167 }
11168 } else {
11169 *pc = env->regs[15];
11170 flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb);
11171 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, env->vfp.vec_len);
11172 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, env->vfp.vec_stride);
11173 flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits);
11174 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, arm_sctlr_b(env));
11175 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env));
11176 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
11177 || arm_el_is_aa64(env, 1) || arm_feature(env, ARM_FEATURE_M)) {
11178 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
11179 }
11180 /* Note that XSCALE_CPAR shares bits with VECSTRIDE */
11181 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
11182 flags = FIELD_DP32(flags, TBFLAG_A32,
11183 XSCALE_CPAR, env->cp15.c15_cpar);
11184 }
11185 }
11186
11187 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
11188
11189 /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
11190 * states defined in the ARM ARM for software singlestep:
11191 * SS_ACTIVE PSTATE.SS State
11192 * 0 x Inactive (the TB flag for SS is always 0)
11193 * 1 0 Active-pending
11194 * 1 1 Active-not-pending
11195 */
11196 if (arm_singlestep_active(env)) {
11197 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1);
11198 if (is_a64(env)) {
11199 if (env->pstate & PSTATE_SS) {
11200 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
11201 }
11202 } else {
11203 if (env->uncached_cpsr & PSTATE_SS) {
11204 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
11205 }
11206 }
11207 }
11208 if (arm_cpu_data_is_big_endian(env)) {
11209 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1);
11210 }
11211 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el);
11212
11213 if (arm_v7m_is_handler_mode(env)) {
11214 flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1);
11215 }
11216
11217 /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is
11218 * suppressing them because the requested execution priority is less than 0.
11219 */
11220 if (arm_feature(env, ARM_FEATURE_V8) &&
11221 arm_feature(env, ARM_FEATURE_M) &&
11222 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) &&
11223 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
11224 flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1);
11225 }
11226
11227 if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
11228 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) != env->v7m.secure) {
11229 flags = FIELD_DP32(flags, TBFLAG_A32, FPCCR_S_WRONG, 1);
11230 }
11231
11232 if (arm_feature(env, ARM_FEATURE_M) &&
11233 (env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) &&
11234 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) ||
11235 (env->v7m.secure &&
11236 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) {
11237 /*
11238 * ASPEN is set, but FPCA/SFPA indicate that there is no active
11239 * FP context; we must create a new FP context before executing
11240 * any FP insn.
11241 */
11242 flags = FIELD_DP32(flags, TBFLAG_A32, NEW_FP_CTXT_NEEDED, 1);
11243 }
11244
11245 if (arm_feature(env, ARM_FEATURE_M)) {
11246 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
11247
11248 if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
11249 flags = FIELD_DP32(flags, TBFLAG_A32, LSPACT, 1);
11250 }
11251 }
11252
11253 if (!arm_feature(env, ARM_FEATURE_M)) {
11254 int target_el = arm_debug_target_el(env);
11255
11256 flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL, target_el);
11257 }
11258
11259 *pflags = flags;
11260 *cs_base = 0;
11261}
11262
11263#ifdef TARGET_AARCH64
11264/*
11265 * The manual says that when SVE is enabled and VQ is widened the
11266 * implementation is allowed to zero the previously inaccessible
11267 * portion of the registers. The corollary to that is that when
11268 * SVE is enabled and VQ is narrowed we are also allowed to zero
11269 * the now inaccessible portion of the registers.
11270 *
11271 * The intent of this is that no predicate bit beyond VQ is ever set.
11272 * Which means that some operations on predicate registers themselves
11273 * may operate on full uint64_t or even unrolled across the maximum
11274 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally
11275 * may well be cheaper than conditionals to restrict the operation
11276 * to the relevant portion of a uint16_t[16].
11277 */
11278void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
11279{
11280 int i, j;
11281 uint64_t pmask;
11282
11283 assert(vq >= 1 && vq <= ARM_MAX_VQ);
11284 assert(vq <= env_archcpu(env)->sve_max_vq);
11285
11286 /* Zap the high bits of the zregs. */
11287 for (i = 0; i < 32; i++) {
11288 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq));
11289 }
11290
11291 /* Zap the high bits of the pregs and ffr. */
11292 pmask = 0;
11293 if (vq & 3) {
11294 pmask = ~(-1ULL << (16 * (vq & 3)));
11295 }
11296 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) {
11297 for (i = 0; i < 17; ++i) {
11298 env->vfp.pregs[i].p[j] &= pmask;
11299 }
11300 pmask = 0;
11301 }
11302}
11303
11304/*
11305 * Notice a change in SVE vector size when changing EL.
11306 */
11307void aarch64_sve_change_el(CPUARMState *env, int old_el,
11308 int new_el, bool el0_a64)
11309{
11310 ARMCPU *cpu = env_archcpu(env);
11311 int old_len, new_len;
11312 bool old_a64, new_a64;
11313
11314 /* Nothing to do if no SVE. */
11315 if (!cpu_isar_feature(aa64_sve, cpu)) {
11316 return;
11317 }
11318
11319 /* Nothing to do if FP is disabled in either EL. */
11320 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) {
11321 return;
11322 }
11323
11324 /*
11325 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped
11326 * at ELx, or not available because the EL is in AArch32 state, then
11327 * for all purposes other than a direct read, the ZCR_ELx.LEN field
11328 * has an effective value of 0".
11329 *
11330 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0).
11331 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition
11332 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that
11333 * we already have the correct register contents when encountering the
11334 * vq0->vq0 transition between EL0->EL1.
11335 */
11336 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64;
11337 old_len = (old_a64 && !sve_exception_el(env, old_el)
11338 ? sve_zcr_len_for_el(env, old_el) : 0);
11339 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64;
11340 new_len = (new_a64 && !sve_exception_el(env, new_el)
11341 ? sve_zcr_len_for_el(env, new_el) : 0);
11342
11343 /* When changing vector length, clear inaccessible state. */
11344 if (new_len < old_len) {
11345 aarch64_sve_narrow_vq(env, new_len + 1);
11346 }
11347}
11348#endif
11349