xref: /openbmc/qemu/target/arm/cpu.c (revision f0984d40)
1 /*
2  * QEMU ARM CPU
3  *
4  * Copyright (c) 2012 SUSE LINUX Products GmbH
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see
18  * <http://www.gnu.org/licenses/gpl-2.0.html>
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qemu/qemu-print.h"
23 #include "qemu/timer.h"
24 #include "qemu/log.h"
25 #include "exec/page-vary.h"
26 #include "target/arm/idau.h"
27 #include "qemu/module.h"
28 #include "qapi/error.h"
29 #include "cpu.h"
30 #ifdef CONFIG_TCG
31 #include "hw/core/tcg-cpu-ops.h"
32 #endif /* CONFIG_TCG */
33 #include "internals.h"
34 #include "exec/exec-all.h"
35 #include "hw/qdev-properties.h"
36 #if !defined(CONFIG_USER_ONLY)
37 #include "hw/loader.h"
38 #include "hw/boards.h"
39 #ifdef CONFIG_TCG
40 #include "hw/intc/armv7m_nvic.h"
41 #endif /* CONFIG_TCG */
42 #endif /* !CONFIG_USER_ONLY */
43 #include "sysemu/tcg.h"
44 #include "sysemu/qtest.h"
45 #include "sysemu/hw_accel.h"
46 #include "kvm_arm.h"
47 #include "disas/capstone.h"
48 #include "fpu/softfloat.h"
49 #include "cpregs.h"
50 
51 static void arm_cpu_set_pc(CPUState *cs, vaddr value)
52 {
53     ARMCPU *cpu = ARM_CPU(cs);
54     CPUARMState *env = &cpu->env;
55 
56     if (is_a64(env)) {
57         env->pc = value;
58         env->thumb = false;
59     } else {
60         env->regs[15] = value & ~1;
61         env->thumb = value & 1;
62     }
63 }
64 
65 static vaddr arm_cpu_get_pc(CPUState *cs)
66 {
67     ARMCPU *cpu = ARM_CPU(cs);
68     CPUARMState *env = &cpu->env;
69 
70     if (is_a64(env)) {
71         return env->pc;
72     } else {
73         return env->regs[15];
74     }
75 }
76 
77 #ifdef CONFIG_TCG
78 void arm_cpu_synchronize_from_tb(CPUState *cs,
79                                  const TranslationBlock *tb)
80 {
81     /* The program counter is always up to date with TARGET_TB_PCREL. */
82     if (!TARGET_TB_PCREL) {
83         CPUARMState *env = cs->env_ptr;
84         /*
85          * It's OK to look at env for the current mode here, because it's
86          * never possible for an AArch64 TB to chain to an AArch32 TB.
87          */
88         if (is_a64(env)) {
89             env->pc = tb_pc(tb);
90         } else {
91             env->regs[15] = tb_pc(tb);
92         }
93     }
94 }
95 
96 void arm_restore_state_to_opc(CPUState *cs,
97                               const TranslationBlock *tb,
98                               const uint64_t *data)
99 {
100     CPUARMState *env = cs->env_ptr;
101 
102     if (is_a64(env)) {
103         if (TARGET_TB_PCREL) {
104             env->pc = (env->pc & TARGET_PAGE_MASK) | data[0];
105         } else {
106             env->pc = data[0];
107         }
108         env->condexec_bits = 0;
109         env->exception.syndrome = data[2] << ARM_INSN_START_WORD2_SHIFT;
110     } else {
111         if (TARGET_TB_PCREL) {
112             env->regs[15] = (env->regs[15] & TARGET_PAGE_MASK) | data[0];
113         } else {
114             env->regs[15] = data[0];
115         }
116         env->condexec_bits = data[1];
117         env->exception.syndrome = data[2] << ARM_INSN_START_WORD2_SHIFT;
118     }
119 }
120 #endif /* CONFIG_TCG */
121 
122 static bool arm_cpu_has_work(CPUState *cs)
123 {
124     ARMCPU *cpu = ARM_CPU(cs);
125 
126     return (cpu->power_state != PSCI_OFF)
127         && cs->interrupt_request &
128         (CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
129          | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
130          | CPU_INTERRUPT_EXITTB);
131 }
132 
133 void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
134                                  void *opaque)
135 {
136     ARMELChangeHook *entry = g_new0(ARMELChangeHook, 1);
137 
138     entry->hook = hook;
139     entry->opaque = opaque;
140 
141     QLIST_INSERT_HEAD(&cpu->pre_el_change_hooks, entry, node);
142 }
143 
144 void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
145                                  void *opaque)
146 {
147     ARMELChangeHook *entry = g_new0(ARMELChangeHook, 1);
148 
149     entry->hook = hook;
150     entry->opaque = opaque;
151 
152     QLIST_INSERT_HEAD(&cpu->el_change_hooks, entry, node);
153 }
154 
155 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
156 {
157     /* Reset a single ARMCPRegInfo register */
158     ARMCPRegInfo *ri = value;
159     ARMCPU *cpu = opaque;
160 
161     if (ri->type & (ARM_CP_SPECIAL_MASK | ARM_CP_ALIAS)) {
162         return;
163     }
164 
165     if (ri->resetfn) {
166         ri->resetfn(&cpu->env, ri);
167         return;
168     }
169 
170     /* A zero offset is never possible as it would be regs[0]
171      * so we use it to indicate that reset is being handled elsewhere.
172      * This is basically only used for fields in non-core coprocessors
173      * (like the pxa2xx ones).
174      */
175     if (!ri->fieldoffset) {
176         return;
177     }
178 
179     if (cpreg_field_is_64bit(ri)) {
180         CPREG_FIELD64(&cpu->env, ri) = ri->resetvalue;
181     } else {
182         CPREG_FIELD32(&cpu->env, ri) = ri->resetvalue;
183     }
184 }
185 
186 static void cp_reg_check_reset(gpointer key, gpointer value,  gpointer opaque)
187 {
188     /* Purely an assertion check: we've already done reset once,
189      * so now check that running the reset for the cpreg doesn't
190      * change its value. This traps bugs where two different cpregs
191      * both try to reset the same state field but to different values.
192      */
193     ARMCPRegInfo *ri = value;
194     ARMCPU *cpu = opaque;
195     uint64_t oldvalue, newvalue;
196 
197     if (ri->type & (ARM_CP_SPECIAL_MASK | ARM_CP_ALIAS | ARM_CP_NO_RAW)) {
198         return;
199     }
200 
201     oldvalue = read_raw_cp_reg(&cpu->env, ri);
202     cp_reg_reset(key, value, opaque);
203     newvalue = read_raw_cp_reg(&cpu->env, ri);
204     assert(oldvalue == newvalue);
205 }
206 
207 static void arm_cpu_reset_hold(Object *obj)
208 {
209     CPUState *s = CPU(obj);
210     ARMCPU *cpu = ARM_CPU(s);
211     ARMCPUClass *acc = ARM_CPU_GET_CLASS(cpu);
212     CPUARMState *env = &cpu->env;
213 
214     if (acc->parent_phases.hold) {
215         acc->parent_phases.hold(obj);
216     }
217 
218     memset(env, 0, offsetof(CPUARMState, end_reset_fields));
219 
220     g_hash_table_foreach(cpu->cp_regs, cp_reg_reset, cpu);
221     g_hash_table_foreach(cpu->cp_regs, cp_reg_check_reset, cpu);
222 
223     env->vfp.xregs[ARM_VFP_FPSID] = cpu->reset_fpsid;
224     env->vfp.xregs[ARM_VFP_MVFR0] = cpu->isar.mvfr0;
225     env->vfp.xregs[ARM_VFP_MVFR1] = cpu->isar.mvfr1;
226     env->vfp.xregs[ARM_VFP_MVFR2] = cpu->isar.mvfr2;
227 
228     cpu->power_state = s->start_powered_off ? PSCI_OFF : PSCI_ON;
229 
230     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
231         env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
232     }
233 
234     if (arm_feature(env, ARM_FEATURE_AARCH64)) {
235         /* 64 bit CPUs always start in 64 bit mode */
236         env->aarch64 = true;
237 #if defined(CONFIG_USER_ONLY)
238         env->pstate = PSTATE_MODE_EL0t;
239         /* Userspace expects access to DC ZVA, CTL_EL0 and the cache ops */
240         env->cp15.sctlr_el[1] |= SCTLR_UCT | SCTLR_UCI | SCTLR_DZE;
241         /* Enable all PAC keys.  */
242         env->cp15.sctlr_el[1] |= (SCTLR_EnIA | SCTLR_EnIB |
243                                   SCTLR_EnDA | SCTLR_EnDB);
244         /* Trap on btype=3 for PACIxSP. */
245         env->cp15.sctlr_el[1] |= SCTLR_BT0;
246         /* and to the FP/Neon instructions */
247         env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
248                                          CPACR_EL1, FPEN, 3);
249         /* and to the SVE instructions, with default vector length */
250         if (cpu_isar_feature(aa64_sve, cpu)) {
251             env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
252                                              CPACR_EL1, ZEN, 3);
253             env->vfp.zcr_el[1] = cpu->sve_default_vq - 1;
254         }
255         /* and for SME instructions, with default vector length, and TPIDR2 */
256         if (cpu_isar_feature(aa64_sme, cpu)) {
257             env->cp15.sctlr_el[1] |= SCTLR_EnTP2;
258             env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
259                                              CPACR_EL1, SMEN, 3);
260             env->vfp.smcr_el[1] = cpu->sme_default_vq - 1;
261             if (cpu_isar_feature(aa64_sme_fa64, cpu)) {
262                 env->vfp.smcr_el[1] = FIELD_DP64(env->vfp.smcr_el[1],
263                                                  SMCR, FA64, 1);
264             }
265         }
266         /*
267          * Enable 48-bit address space (TODO: take reserved_va into account).
268          * Enable TBI0 but not TBI1.
269          * Note that this must match useronly_clean_ptr.
270          */
271         env->cp15.tcr_el[1] = 5 | (1ULL << 37);
272 
273         /* Enable MTE */
274         if (cpu_isar_feature(aa64_mte, cpu)) {
275             /* Enable tag access, but leave TCF0 as No Effect (0). */
276             env->cp15.sctlr_el[1] |= SCTLR_ATA0;
277             /*
278              * Exclude all tags, so that tag 0 is always used.
279              * This corresponds to Linux current->thread.gcr_incl = 0.
280              *
281              * Set RRND, so that helper_irg() will generate a seed later.
282              * Here in cpu_reset(), the crypto subsystem has not yet been
283              * initialized.
284              */
285             env->cp15.gcr_el1 = 0x1ffff;
286         }
287         /*
288          * Disable access to SCXTNUM_EL0 from CSV2_1p2.
289          * This is not yet exposed from the Linux kernel in any way.
290          */
291         env->cp15.sctlr_el[1] |= SCTLR_TSCXT;
292 #else
293         /* Reset into the highest available EL */
294         if (arm_feature(env, ARM_FEATURE_EL3)) {
295             env->pstate = PSTATE_MODE_EL3h;
296         } else if (arm_feature(env, ARM_FEATURE_EL2)) {
297             env->pstate = PSTATE_MODE_EL2h;
298         } else {
299             env->pstate = PSTATE_MODE_EL1h;
300         }
301 
302         /* Sample rvbar at reset.  */
303         env->cp15.rvbar = cpu->rvbar_prop;
304         env->pc = env->cp15.rvbar;
305 #endif
306     } else {
307 #if defined(CONFIG_USER_ONLY)
308         /* Userspace expects access to cp10 and cp11 for FP/Neon */
309         env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
310                                          CPACR, CP10, 3);
311         env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
312                                          CPACR, CP11, 3);
313 #endif
314         if (arm_feature(env, ARM_FEATURE_V8)) {
315             env->cp15.rvbar = cpu->rvbar_prop;
316             env->regs[15] = cpu->rvbar_prop;
317         }
318     }
319 
320 #if defined(CONFIG_USER_ONLY)
321     env->uncached_cpsr = ARM_CPU_MODE_USR;
322     /* For user mode we must enable access to coprocessors */
323     env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
324     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
325         env->cp15.c15_cpar = 3;
326     } else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
327         env->cp15.c15_cpar = 1;
328     }
329 #else
330 
331     /*
332      * If the highest available EL is EL2, AArch32 will start in Hyp
333      * mode; otherwise it starts in SVC. Note that if we start in
334      * AArch64 then these values in the uncached_cpsr will be ignored.
335      */
336     if (arm_feature(env, ARM_FEATURE_EL2) &&
337         !arm_feature(env, ARM_FEATURE_EL3)) {
338         env->uncached_cpsr = ARM_CPU_MODE_HYP;
339     } else {
340         env->uncached_cpsr = ARM_CPU_MODE_SVC;
341     }
342     env->daif = PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F;
343 
344     /* AArch32 has a hard highvec setting of 0xFFFF0000.  If we are currently
345      * executing as AArch32 then check if highvecs are enabled and
346      * adjust the PC accordingly.
347      */
348     if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
349         env->regs[15] = 0xFFFF0000;
350     }
351 
352     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
353 #endif
354 
355     if (arm_feature(env, ARM_FEATURE_M)) {
356 #ifndef CONFIG_USER_ONLY
357         uint32_t initial_msp; /* Loaded from 0x0 */
358         uint32_t initial_pc; /* Loaded from 0x4 */
359         uint8_t *rom;
360         uint32_t vecbase;
361 #endif
362 
363         if (cpu_isar_feature(aa32_lob, cpu)) {
364             /*
365              * LTPSIZE is constant 4 if MVE not implemented, and resets
366              * to an UNKNOWN value if MVE is implemented. We choose to
367              * always reset to 4.
368              */
369             env->v7m.ltpsize = 4;
370             /* The LTPSIZE field in FPDSCR is constant and reads as 4. */
371             env->v7m.fpdscr[M_REG_NS] = 4 << FPCR_LTPSIZE_SHIFT;
372             env->v7m.fpdscr[M_REG_S] = 4 << FPCR_LTPSIZE_SHIFT;
373         }
374 
375         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
376             env->v7m.secure = true;
377         } else {
378             /* This bit resets to 0 if security is supported, but 1 if
379              * it is not. The bit is not present in v7M, but we set it
380              * here so we can avoid having to make checks on it conditional
381              * on ARM_FEATURE_V8 (we don't let the guest see the bit).
382              */
383             env->v7m.aircr = R_V7M_AIRCR_BFHFNMINS_MASK;
384             /*
385              * Set NSACR to indicate "NS access permitted to everything";
386              * this avoids having to have all the tests of it being
387              * conditional on ARM_FEATURE_M_SECURITY. Note also that from
388              * v8.1M the guest-visible value of NSACR in a CPU without the
389              * Security Extension is 0xcff.
390              */
391             env->v7m.nsacr = 0xcff;
392         }
393 
394         /* In v7M the reset value of this bit is IMPDEF, but ARM recommends
395          * that it resets to 1, so QEMU always does that rather than making
396          * it dependent on CPU model. In v8M it is RES1.
397          */
398         env->v7m.ccr[M_REG_NS] = R_V7M_CCR_STKALIGN_MASK;
399         env->v7m.ccr[M_REG_S] = R_V7M_CCR_STKALIGN_MASK;
400         if (arm_feature(env, ARM_FEATURE_V8)) {
401             /* in v8M the NONBASETHRDENA bit [0] is RES1 */
402             env->v7m.ccr[M_REG_NS] |= R_V7M_CCR_NONBASETHRDENA_MASK;
403             env->v7m.ccr[M_REG_S] |= R_V7M_CCR_NONBASETHRDENA_MASK;
404         }
405         if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
406             env->v7m.ccr[M_REG_NS] |= R_V7M_CCR_UNALIGN_TRP_MASK;
407             env->v7m.ccr[M_REG_S] |= R_V7M_CCR_UNALIGN_TRP_MASK;
408         }
409 
410         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
411             env->v7m.fpccr[M_REG_NS] = R_V7M_FPCCR_ASPEN_MASK;
412             env->v7m.fpccr[M_REG_S] = R_V7M_FPCCR_ASPEN_MASK |
413                 R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK;
414         }
415 
416 #ifndef CONFIG_USER_ONLY
417         /* Unlike A/R profile, M profile defines the reset LR value */
418         env->regs[14] = 0xffffffff;
419 
420         env->v7m.vecbase[M_REG_S] = cpu->init_svtor & 0xffffff80;
421         env->v7m.vecbase[M_REG_NS] = cpu->init_nsvtor & 0xffffff80;
422 
423         /* Load the initial SP and PC from offset 0 and 4 in the vector table */
424         vecbase = env->v7m.vecbase[env->v7m.secure];
425         rom = rom_ptr_for_as(s->as, vecbase, 8);
426         if (rom) {
427             /* Address zero is covered by ROM which hasn't yet been
428              * copied into physical memory.
429              */
430             initial_msp = ldl_p(rom);
431             initial_pc = ldl_p(rom + 4);
432         } else {
433             /* Address zero not covered by a ROM blob, or the ROM blob
434              * is in non-modifiable memory and this is a second reset after
435              * it got copied into memory. In the latter case, rom_ptr
436              * will return a NULL pointer and we should use ldl_phys instead.
437              */
438             initial_msp = ldl_phys(s->as, vecbase);
439             initial_pc = ldl_phys(s->as, vecbase + 4);
440         }
441 
442         qemu_log_mask(CPU_LOG_INT,
443                       "Loaded reset SP 0x%x PC 0x%x from vector table\n",
444                       initial_msp, initial_pc);
445 
446         env->regs[13] = initial_msp & 0xFFFFFFFC;
447         env->regs[15] = initial_pc & ~1;
448         env->thumb = initial_pc & 1;
449 #else
450         /*
451          * For user mode we run non-secure and with access to the FPU.
452          * The FPU context is active (ie does not need further setup)
453          * and is owned by non-secure.
454          */
455         env->v7m.secure = false;
456         env->v7m.nsacr = 0xcff;
457         env->v7m.cpacr[M_REG_NS] = 0xf0ffff;
458         env->v7m.fpccr[M_REG_S] &=
459             ~(R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK);
460         env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
461 #endif
462     }
463 
464     /* M profile requires that reset clears the exclusive monitor;
465      * A profile does not, but clearing it makes more sense than having it
466      * set with an exclusive access on address zero.
467      */
468     arm_clear_exclusive(env);
469 
470     if (arm_feature(env, ARM_FEATURE_PMSA)) {
471         if (cpu->pmsav7_dregion > 0) {
472             if (arm_feature(env, ARM_FEATURE_V8)) {
473                 memset(env->pmsav8.rbar[M_REG_NS], 0,
474                        sizeof(*env->pmsav8.rbar[M_REG_NS])
475                        * cpu->pmsav7_dregion);
476                 memset(env->pmsav8.rlar[M_REG_NS], 0,
477                        sizeof(*env->pmsav8.rlar[M_REG_NS])
478                        * cpu->pmsav7_dregion);
479                 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
480                     memset(env->pmsav8.rbar[M_REG_S], 0,
481                            sizeof(*env->pmsav8.rbar[M_REG_S])
482                            * cpu->pmsav7_dregion);
483                     memset(env->pmsav8.rlar[M_REG_S], 0,
484                            sizeof(*env->pmsav8.rlar[M_REG_S])
485                            * cpu->pmsav7_dregion);
486                 }
487             } else if (arm_feature(env, ARM_FEATURE_V7)) {
488                 memset(env->pmsav7.drbar, 0,
489                        sizeof(*env->pmsav7.drbar) * cpu->pmsav7_dregion);
490                 memset(env->pmsav7.drsr, 0,
491                        sizeof(*env->pmsav7.drsr) * cpu->pmsav7_dregion);
492                 memset(env->pmsav7.dracr, 0,
493                        sizeof(*env->pmsav7.dracr) * cpu->pmsav7_dregion);
494             }
495         }
496 
497         if (cpu->pmsav8r_hdregion > 0) {
498             memset(env->pmsav8.hprbar, 0,
499                    sizeof(*env->pmsav8.hprbar) * cpu->pmsav8r_hdregion);
500             memset(env->pmsav8.hprlar, 0,
501                    sizeof(*env->pmsav8.hprlar) * cpu->pmsav8r_hdregion);
502         }
503 
504         env->pmsav7.rnr[M_REG_NS] = 0;
505         env->pmsav7.rnr[M_REG_S] = 0;
506         env->pmsav8.mair0[M_REG_NS] = 0;
507         env->pmsav8.mair0[M_REG_S] = 0;
508         env->pmsav8.mair1[M_REG_NS] = 0;
509         env->pmsav8.mair1[M_REG_S] = 0;
510     }
511 
512     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
513         if (cpu->sau_sregion > 0) {
514             memset(env->sau.rbar, 0, sizeof(*env->sau.rbar) * cpu->sau_sregion);
515             memset(env->sau.rlar, 0, sizeof(*env->sau.rlar) * cpu->sau_sregion);
516         }
517         env->sau.rnr = 0;
518         /* SAU_CTRL reset value is IMPDEF; we choose 0, which is what
519          * the Cortex-M33 does.
520          */
521         env->sau.ctrl = 0;
522     }
523 
524     set_flush_to_zero(1, &env->vfp.standard_fp_status);
525     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
526     set_default_nan_mode(1, &env->vfp.standard_fp_status);
527     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
528     set_float_detect_tininess(float_tininess_before_rounding,
529                               &env->vfp.fp_status);
530     set_float_detect_tininess(float_tininess_before_rounding,
531                               &env->vfp.standard_fp_status);
532     set_float_detect_tininess(float_tininess_before_rounding,
533                               &env->vfp.fp_status_f16);
534     set_float_detect_tininess(float_tininess_before_rounding,
535                               &env->vfp.standard_fp_status_f16);
536 #ifndef CONFIG_USER_ONLY
537     if (kvm_enabled()) {
538         kvm_arm_reset_vcpu(cpu);
539     }
540 #endif
541 
542     if (tcg_enabled()) {
543         hw_breakpoint_update_all(cpu);
544         hw_watchpoint_update_all(cpu);
545     }
546     arm_rebuild_hflags(env);
547 }
548 
549 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
550 
551 static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
552                                      unsigned int target_el,
553                                      unsigned int cur_el, bool secure,
554                                      uint64_t hcr_el2)
555 {
556     CPUARMState *env = cs->env_ptr;
557     bool pstate_unmasked;
558     bool unmasked = false;
559 
560     /*
561      * Don't take exceptions if they target a lower EL.
562      * This check should catch any exceptions that would not be taken
563      * but left pending.
564      */
565     if (cur_el > target_el) {
566         return false;
567     }
568 
569     switch (excp_idx) {
570     case EXCP_FIQ:
571         pstate_unmasked = !(env->daif & PSTATE_F);
572         break;
573 
574     case EXCP_IRQ:
575         pstate_unmasked = !(env->daif & PSTATE_I);
576         break;
577 
578     case EXCP_VFIQ:
579         if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
580             /* VFIQs are only taken when hypervized.  */
581             return false;
582         }
583         return !(env->daif & PSTATE_F);
584     case EXCP_VIRQ:
585         if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
586             /* VIRQs are only taken when hypervized.  */
587             return false;
588         }
589         return !(env->daif & PSTATE_I);
590     case EXCP_VSERR:
591         if (!(hcr_el2 & HCR_AMO) || (hcr_el2 & HCR_TGE)) {
592             /* VIRQs are only taken when hypervized.  */
593             return false;
594         }
595         return !(env->daif & PSTATE_A);
596     default:
597         g_assert_not_reached();
598     }
599 
600     /*
601      * Use the target EL, current execution state and SCR/HCR settings to
602      * determine whether the corresponding CPSR bit is used to mask the
603      * interrupt.
604      */
605     if ((target_el > cur_el) && (target_el != 1)) {
606         /* Exceptions targeting a higher EL may not be maskable */
607         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
608             switch (target_el) {
609             case 2:
610                 /*
611                  * According to ARM DDI 0487H.a, an interrupt can be masked
612                  * when HCR_E2H and HCR_TGE are both set regardless of the
613                  * current Security state. Note that we need to revisit this
614                  * part again once we need to support NMI.
615                  */
616                 if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
617                         unmasked = true;
618                 }
619                 break;
620             case 3:
621                 /* Interrupt cannot be masked when the target EL is 3 */
622                 unmasked = true;
623                 break;
624             default:
625                 g_assert_not_reached();
626             }
627         } else {
628             /*
629              * The old 32-bit-only environment has a more complicated
630              * masking setup. HCR and SCR bits not only affect interrupt
631              * routing but also change the behaviour of masking.
632              */
633             bool hcr, scr;
634 
635             switch (excp_idx) {
636             case EXCP_FIQ:
637                 /*
638                  * If FIQs are routed to EL3 or EL2 then there are cases where
639                  * we override the CPSR.F in determining if the exception is
640                  * masked or not. If neither of these are set then we fall back
641                  * to the CPSR.F setting otherwise we further assess the state
642                  * below.
643                  */
644                 hcr = hcr_el2 & HCR_FMO;
645                 scr = (env->cp15.scr_el3 & SCR_FIQ);
646 
647                 /*
648                  * When EL3 is 32-bit, the SCR.FW bit controls whether the
649                  * CPSR.F bit masks FIQ interrupts when taken in non-secure
650                  * state. If SCR.FW is set then FIQs can be masked by CPSR.F
651                  * when non-secure but only when FIQs are only routed to EL3.
652                  */
653                 scr = scr && !((env->cp15.scr_el3 & SCR_FW) && !hcr);
654                 break;
655             case EXCP_IRQ:
656                 /*
657                  * When EL3 execution state is 32-bit, if HCR.IMO is set then
658                  * we may override the CPSR.I masking when in non-secure state.
659                  * The SCR.IRQ setting has already been taken into consideration
660                  * when setting the target EL, so it does not have a further
661                  * affect here.
662                  */
663                 hcr = hcr_el2 & HCR_IMO;
664                 scr = false;
665                 break;
666             default:
667                 g_assert_not_reached();
668             }
669 
670             if ((scr || hcr) && !secure) {
671                 unmasked = true;
672             }
673         }
674     }
675 
676     /*
677      * The PSTATE bits only mask the interrupt if we have not overriden the
678      * ability above.
679      */
680     return unmasked || pstate_unmasked;
681 }
682 
683 static bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
684 {
685     CPUClass *cc = CPU_GET_CLASS(cs);
686     CPUARMState *env = cs->env_ptr;
687     uint32_t cur_el = arm_current_el(env);
688     bool secure = arm_is_secure(env);
689     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
690     uint32_t target_el;
691     uint32_t excp_idx;
692 
693     /* The prioritization of interrupts is IMPLEMENTATION DEFINED. */
694 
695     if (interrupt_request & CPU_INTERRUPT_FIQ) {
696         excp_idx = EXCP_FIQ;
697         target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
698         if (arm_excp_unmasked(cs, excp_idx, target_el,
699                               cur_el, secure, hcr_el2)) {
700             goto found;
701         }
702     }
703     if (interrupt_request & CPU_INTERRUPT_HARD) {
704         excp_idx = EXCP_IRQ;
705         target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
706         if (arm_excp_unmasked(cs, excp_idx, target_el,
707                               cur_el, secure, hcr_el2)) {
708             goto found;
709         }
710     }
711     if (interrupt_request & CPU_INTERRUPT_VIRQ) {
712         excp_idx = EXCP_VIRQ;
713         target_el = 1;
714         if (arm_excp_unmasked(cs, excp_idx, target_el,
715                               cur_el, secure, hcr_el2)) {
716             goto found;
717         }
718     }
719     if (interrupt_request & CPU_INTERRUPT_VFIQ) {
720         excp_idx = EXCP_VFIQ;
721         target_el = 1;
722         if (arm_excp_unmasked(cs, excp_idx, target_el,
723                               cur_el, secure, hcr_el2)) {
724             goto found;
725         }
726     }
727     if (interrupt_request & CPU_INTERRUPT_VSERR) {
728         excp_idx = EXCP_VSERR;
729         target_el = 1;
730         if (arm_excp_unmasked(cs, excp_idx, target_el,
731                               cur_el, secure, hcr_el2)) {
732             /* Taking a virtual abort clears HCR_EL2.VSE */
733             env->cp15.hcr_el2 &= ~HCR_VSE;
734             cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
735             goto found;
736         }
737     }
738     return false;
739 
740  found:
741     cs->exception_index = excp_idx;
742     env->exception.target_el = target_el;
743     cc->tcg_ops->do_interrupt(cs);
744     return true;
745 }
746 
747 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
748 
749 void arm_cpu_update_virq(ARMCPU *cpu)
750 {
751     /*
752      * Update the interrupt level for VIRQ, which is the logical OR of
753      * the HCR_EL2.VI bit and the input line level from the GIC.
754      */
755     CPUARMState *env = &cpu->env;
756     CPUState *cs = CPU(cpu);
757 
758     bool new_state = (env->cp15.hcr_el2 & HCR_VI) ||
759         (env->irq_line_state & CPU_INTERRUPT_VIRQ);
760 
761     if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VIRQ) != 0)) {
762         if (new_state) {
763             cpu_interrupt(cs, CPU_INTERRUPT_VIRQ);
764         } else {
765             cpu_reset_interrupt(cs, CPU_INTERRUPT_VIRQ);
766         }
767     }
768 }
769 
770 void arm_cpu_update_vfiq(ARMCPU *cpu)
771 {
772     /*
773      * Update the interrupt level for VFIQ, which is the logical OR of
774      * the HCR_EL2.VF bit and the input line level from the GIC.
775      */
776     CPUARMState *env = &cpu->env;
777     CPUState *cs = CPU(cpu);
778 
779     bool new_state = (env->cp15.hcr_el2 & HCR_VF) ||
780         (env->irq_line_state & CPU_INTERRUPT_VFIQ);
781 
782     if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VFIQ) != 0)) {
783         if (new_state) {
784             cpu_interrupt(cs, CPU_INTERRUPT_VFIQ);
785         } else {
786             cpu_reset_interrupt(cs, CPU_INTERRUPT_VFIQ);
787         }
788     }
789 }
790 
791 void arm_cpu_update_vserr(ARMCPU *cpu)
792 {
793     /*
794      * Update the interrupt level for VSERR, which is the HCR_EL2.VSE bit.
795      */
796     CPUARMState *env = &cpu->env;
797     CPUState *cs = CPU(cpu);
798 
799     bool new_state = env->cp15.hcr_el2 & HCR_VSE;
800 
801     if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VSERR) != 0)) {
802         if (new_state) {
803             cpu_interrupt(cs, CPU_INTERRUPT_VSERR);
804         } else {
805             cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
806         }
807     }
808 }
809 
810 #ifndef CONFIG_USER_ONLY
811 static void arm_cpu_set_irq(void *opaque, int irq, int level)
812 {
813     ARMCPU *cpu = opaque;
814     CPUARMState *env = &cpu->env;
815     CPUState *cs = CPU(cpu);
816     static const int mask[] = {
817         [ARM_CPU_IRQ] = CPU_INTERRUPT_HARD,
818         [ARM_CPU_FIQ] = CPU_INTERRUPT_FIQ,
819         [ARM_CPU_VIRQ] = CPU_INTERRUPT_VIRQ,
820         [ARM_CPU_VFIQ] = CPU_INTERRUPT_VFIQ
821     };
822 
823     if (!arm_feature(env, ARM_FEATURE_EL2) &&
824         (irq == ARM_CPU_VIRQ || irq == ARM_CPU_VFIQ)) {
825         /*
826          * The GIC might tell us about VIRQ and VFIQ state, but if we don't
827          * have EL2 support we don't care. (Unless the guest is doing something
828          * silly this will only be calls saying "level is still 0".)
829          */
830         return;
831     }
832 
833     if (level) {
834         env->irq_line_state |= mask[irq];
835     } else {
836         env->irq_line_state &= ~mask[irq];
837     }
838 
839     switch (irq) {
840     case ARM_CPU_VIRQ:
841         arm_cpu_update_virq(cpu);
842         break;
843     case ARM_CPU_VFIQ:
844         arm_cpu_update_vfiq(cpu);
845         break;
846     case ARM_CPU_IRQ:
847     case ARM_CPU_FIQ:
848         if (level) {
849             cpu_interrupt(cs, mask[irq]);
850         } else {
851             cpu_reset_interrupt(cs, mask[irq]);
852         }
853         break;
854     default:
855         g_assert_not_reached();
856     }
857 }
858 
859 static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
860 {
861 #ifdef CONFIG_KVM
862     ARMCPU *cpu = opaque;
863     CPUARMState *env = &cpu->env;
864     CPUState *cs = CPU(cpu);
865     uint32_t linestate_bit;
866     int irq_id;
867 
868     switch (irq) {
869     case ARM_CPU_IRQ:
870         irq_id = KVM_ARM_IRQ_CPU_IRQ;
871         linestate_bit = CPU_INTERRUPT_HARD;
872         break;
873     case ARM_CPU_FIQ:
874         irq_id = KVM_ARM_IRQ_CPU_FIQ;
875         linestate_bit = CPU_INTERRUPT_FIQ;
876         break;
877     default:
878         g_assert_not_reached();
879     }
880 
881     if (level) {
882         env->irq_line_state |= linestate_bit;
883     } else {
884         env->irq_line_state &= ~linestate_bit;
885     }
886     kvm_arm_set_irq(cs->cpu_index, KVM_ARM_IRQ_TYPE_CPU, irq_id, !!level);
887 #endif
888 }
889 
890 static bool arm_cpu_virtio_is_big_endian(CPUState *cs)
891 {
892     ARMCPU *cpu = ARM_CPU(cs);
893     CPUARMState *env = &cpu->env;
894 
895     cpu_synchronize_state(cs);
896     return arm_cpu_data_is_big_endian(env);
897 }
898 
899 #endif
900 
901 static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)
902 {
903     ARMCPU *ac = ARM_CPU(cpu);
904     CPUARMState *env = &ac->env;
905     bool sctlr_b;
906 
907     if (is_a64(env)) {
908         info->cap_arch = CS_ARCH_ARM64;
909         info->cap_insn_unit = 4;
910         info->cap_insn_split = 4;
911     } else {
912         int cap_mode;
913         if (env->thumb) {
914             info->cap_insn_unit = 2;
915             info->cap_insn_split = 4;
916             cap_mode = CS_MODE_THUMB;
917         } else {
918             info->cap_insn_unit = 4;
919             info->cap_insn_split = 4;
920             cap_mode = CS_MODE_ARM;
921         }
922         if (arm_feature(env, ARM_FEATURE_V8)) {
923             cap_mode |= CS_MODE_V8;
924         }
925         if (arm_feature(env, ARM_FEATURE_M)) {
926             cap_mode |= CS_MODE_MCLASS;
927         }
928         info->cap_arch = CS_ARCH_ARM;
929         info->cap_mode = cap_mode;
930     }
931 
932     sctlr_b = arm_sctlr_b(env);
933     if (bswap_code(sctlr_b)) {
934 #if TARGET_BIG_ENDIAN
935         info->endian = BFD_ENDIAN_LITTLE;
936 #else
937         info->endian = BFD_ENDIAN_BIG;
938 #endif
939     }
940     info->flags &= ~INSN_ARM_BE32;
941 #ifndef CONFIG_USER_ONLY
942     if (sctlr_b) {
943         info->flags |= INSN_ARM_BE32;
944     }
945 #endif
946 }
947 
948 #ifdef TARGET_AARCH64
949 
950 static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
951 {
952     ARMCPU *cpu = ARM_CPU(cs);
953     CPUARMState *env = &cpu->env;
954     uint32_t psr = pstate_read(env);
955     int i;
956     int el = arm_current_el(env);
957     const char *ns_status;
958     bool sve;
959 
960     qemu_fprintf(f, " PC=%016" PRIx64 " ", env->pc);
961     for (i = 0; i < 32; i++) {
962         if (i == 31) {
963             qemu_fprintf(f, " SP=%016" PRIx64 "\n", env->xregs[i]);
964         } else {
965             qemu_fprintf(f, "X%02d=%016" PRIx64 "%s", i, env->xregs[i],
966                          (i + 2) % 3 ? " " : "\n");
967         }
968     }
969 
970     if (arm_feature(env, ARM_FEATURE_EL3) && el != 3) {
971         ns_status = env->cp15.scr_el3 & SCR_NS ? "NS " : "S ";
972     } else {
973         ns_status = "";
974     }
975     qemu_fprintf(f, "PSTATE=%08x %c%c%c%c %sEL%d%c",
976                  psr,
977                  psr & PSTATE_N ? 'N' : '-',
978                  psr & PSTATE_Z ? 'Z' : '-',
979                  psr & PSTATE_C ? 'C' : '-',
980                  psr & PSTATE_V ? 'V' : '-',
981                  ns_status,
982                  el,
983                  psr & PSTATE_SP ? 'h' : 't');
984 
985     if (cpu_isar_feature(aa64_sme, cpu)) {
986         qemu_fprintf(f, "  SVCR=%08" PRIx64 " %c%c",
987                      env->svcr,
988                      (FIELD_EX64(env->svcr, SVCR, ZA) ? 'Z' : '-'),
989                      (FIELD_EX64(env->svcr, SVCR, SM) ? 'S' : '-'));
990     }
991     if (cpu_isar_feature(aa64_bti, cpu)) {
992         qemu_fprintf(f, "  BTYPE=%d", (psr & PSTATE_BTYPE) >> 10);
993     }
994     if (!(flags & CPU_DUMP_FPU)) {
995         qemu_fprintf(f, "\n");
996         return;
997     }
998     if (fp_exception_el(env, el) != 0) {
999         qemu_fprintf(f, "    FPU disabled\n");
1000         return;
1001     }
1002     qemu_fprintf(f, "     FPCR=%08x FPSR=%08x\n",
1003                  vfp_get_fpcr(env), vfp_get_fpsr(env));
1004 
1005     if (cpu_isar_feature(aa64_sme, cpu) && FIELD_EX64(env->svcr, SVCR, SM)) {
1006         sve = sme_exception_el(env, el) == 0;
1007     } else if (cpu_isar_feature(aa64_sve, cpu)) {
1008         sve = sve_exception_el(env, el) == 0;
1009     } else {
1010         sve = false;
1011     }
1012 
1013     if (sve) {
1014         int j, zcr_len = sve_vqm1_for_el(env, el);
1015 
1016         for (i = 0; i <= FFR_PRED_NUM; i++) {
1017             bool eol;
1018             if (i == FFR_PRED_NUM) {
1019                 qemu_fprintf(f, "FFR=");
1020                 /* It's last, so end the line.  */
1021                 eol = true;
1022             } else {
1023                 qemu_fprintf(f, "P%02d=", i);
1024                 switch (zcr_len) {
1025                 case 0:
1026                     eol = i % 8 == 7;
1027                     break;
1028                 case 1:
1029                     eol = i % 6 == 5;
1030                     break;
1031                 case 2:
1032                 case 3:
1033                     eol = i % 3 == 2;
1034                     break;
1035                 default:
1036                     /* More than one quadword per predicate.  */
1037                     eol = true;
1038                     break;
1039                 }
1040             }
1041             for (j = zcr_len / 4; j >= 0; j--) {
1042                 int digits;
1043                 if (j * 4 + 4 <= zcr_len + 1) {
1044                     digits = 16;
1045                 } else {
1046                     digits = (zcr_len % 4 + 1) * 4;
1047                 }
1048                 qemu_fprintf(f, "%0*" PRIx64 "%s", digits,
1049                              env->vfp.pregs[i].p[j],
1050                              j ? ":" : eol ? "\n" : " ");
1051             }
1052         }
1053 
1054         for (i = 0; i < 32; i++) {
1055             if (zcr_len == 0) {
1056                 qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64 "%s",
1057                              i, env->vfp.zregs[i].d[1],
1058                              env->vfp.zregs[i].d[0], i & 1 ? "\n" : " ");
1059             } else if (zcr_len == 1) {
1060                 qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64
1061                              ":%016" PRIx64 ":%016" PRIx64 "\n",
1062                              i, env->vfp.zregs[i].d[3], env->vfp.zregs[i].d[2],
1063                              env->vfp.zregs[i].d[1], env->vfp.zregs[i].d[0]);
1064             } else {
1065                 for (j = zcr_len; j >= 0; j--) {
1066                     bool odd = (zcr_len - j) % 2 != 0;
1067                     if (j == zcr_len) {
1068                         qemu_fprintf(f, "Z%02d[%x-%x]=", i, j, j - 1);
1069                     } else if (!odd) {
1070                         if (j > 0) {
1071                             qemu_fprintf(f, "   [%x-%x]=", j, j - 1);
1072                         } else {
1073                             qemu_fprintf(f, "     [%x]=", j);
1074                         }
1075                     }
1076                     qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%s",
1077                                  env->vfp.zregs[i].d[j * 2 + 1],
1078                                  env->vfp.zregs[i].d[j * 2],
1079                                  odd || j == 0 ? "\n" : ":");
1080                 }
1081             }
1082         }
1083     } else {
1084         for (i = 0; i < 32; i++) {
1085             uint64_t *q = aa64_vfp_qreg(env, i);
1086             qemu_fprintf(f, "Q%02d=%016" PRIx64 ":%016" PRIx64 "%s",
1087                          i, q[1], q[0], (i & 1 ? "\n" : " "));
1088         }
1089     }
1090 }
1091 
1092 #else
1093 
1094 static inline void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
1095 {
1096     g_assert_not_reached();
1097 }
1098 
1099 #endif
1100 
1101 static void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
1102 {
1103     ARMCPU *cpu = ARM_CPU(cs);
1104     CPUARMState *env = &cpu->env;
1105     int i;
1106 
1107     if (is_a64(env)) {
1108         aarch64_cpu_dump_state(cs, f, flags);
1109         return;
1110     }
1111 
1112     for (i = 0; i < 16; i++) {
1113         qemu_fprintf(f, "R%02d=%08x", i, env->regs[i]);
1114         if ((i % 4) == 3) {
1115             qemu_fprintf(f, "\n");
1116         } else {
1117             qemu_fprintf(f, " ");
1118         }
1119     }
1120 
1121     if (arm_feature(env, ARM_FEATURE_M)) {
1122         uint32_t xpsr = xpsr_read(env);
1123         const char *mode;
1124         const char *ns_status = "";
1125 
1126         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1127             ns_status = env->v7m.secure ? "S " : "NS ";
1128         }
1129 
1130         if (xpsr & XPSR_EXCP) {
1131             mode = "handler";
1132         } else {
1133             if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_NPRIV_MASK) {
1134                 mode = "unpriv-thread";
1135             } else {
1136                 mode = "priv-thread";
1137             }
1138         }
1139 
1140         qemu_fprintf(f, "XPSR=%08x %c%c%c%c %c %s%s\n",
1141                      xpsr,
1142                      xpsr & XPSR_N ? 'N' : '-',
1143                      xpsr & XPSR_Z ? 'Z' : '-',
1144                      xpsr & XPSR_C ? 'C' : '-',
1145                      xpsr & XPSR_V ? 'V' : '-',
1146                      xpsr & XPSR_T ? 'T' : 'A',
1147                      ns_status,
1148                      mode);
1149     } else {
1150         uint32_t psr = cpsr_read(env);
1151         const char *ns_status = "";
1152 
1153         if (arm_feature(env, ARM_FEATURE_EL3) &&
1154             (psr & CPSR_M) != ARM_CPU_MODE_MON) {
1155             ns_status = env->cp15.scr_el3 & SCR_NS ? "NS " : "S ";
1156         }
1157 
1158         qemu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%s%d\n",
1159                      psr,
1160                      psr & CPSR_N ? 'N' : '-',
1161                      psr & CPSR_Z ? 'Z' : '-',
1162                      psr & CPSR_C ? 'C' : '-',
1163                      psr & CPSR_V ? 'V' : '-',
1164                      psr & CPSR_T ? 'T' : 'A',
1165                      ns_status,
1166                      aarch32_mode_name(psr), (psr & 0x10) ? 32 : 26);
1167     }
1168 
1169     if (flags & CPU_DUMP_FPU) {
1170         int numvfpregs = 0;
1171         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
1172             numvfpregs = 32;
1173         } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
1174             numvfpregs = 16;
1175         }
1176         for (i = 0; i < numvfpregs; i++) {
1177             uint64_t v = *aa32_vfp_dreg(env, i);
1178             qemu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
1179                          i * 2, (uint32_t)v,
1180                          i * 2 + 1, (uint32_t)(v >> 32),
1181                          i, v);
1182         }
1183         qemu_fprintf(f, "FPSCR: %08x\n", vfp_get_fpscr(env));
1184         if (cpu_isar_feature(aa32_mve, cpu)) {
1185             qemu_fprintf(f, "VPR: %08x\n", env->v7m.vpr);
1186         }
1187     }
1188 }
1189 
1190 uint64_t arm_cpu_mp_affinity(int idx, uint8_t clustersz)
1191 {
1192     uint32_t Aff1 = idx / clustersz;
1193     uint32_t Aff0 = idx % clustersz;
1194     return (Aff1 << ARM_AFF1_SHIFT) | Aff0;
1195 }
1196 
1197 static void arm_cpu_initfn(Object *obj)
1198 {
1199     ARMCPU *cpu = ARM_CPU(obj);
1200 
1201     cpu_set_cpustate_pointers(cpu);
1202     cpu->cp_regs = g_hash_table_new_full(g_direct_hash, g_direct_equal,
1203                                          NULL, g_free);
1204 
1205     QLIST_INIT(&cpu->pre_el_change_hooks);
1206     QLIST_INIT(&cpu->el_change_hooks);
1207 
1208 #ifdef CONFIG_USER_ONLY
1209 # ifdef TARGET_AARCH64
1210     /*
1211      * The linux kernel defaults to 512-bit for SVE, and 256-bit for SME.
1212      * These values were chosen to fit within the default signal frame.
1213      * See documentation for /proc/sys/abi/{sve,sme}_default_vector_length,
1214      * and our corresponding cpu property.
1215      */
1216     cpu->sve_default_vq = 4;
1217     cpu->sme_default_vq = 2;
1218 # endif
1219 #else
1220     /* Our inbound IRQ and FIQ lines */
1221     if (kvm_enabled()) {
1222         /* VIRQ and VFIQ are unused with KVM but we add them to maintain
1223          * the same interface as non-KVM CPUs.
1224          */
1225         qdev_init_gpio_in(DEVICE(cpu), arm_cpu_kvm_set_irq, 4);
1226     } else {
1227         qdev_init_gpio_in(DEVICE(cpu), arm_cpu_set_irq, 4);
1228     }
1229 
1230     qdev_init_gpio_out(DEVICE(cpu), cpu->gt_timer_outputs,
1231                        ARRAY_SIZE(cpu->gt_timer_outputs));
1232 
1233     qdev_init_gpio_out_named(DEVICE(cpu), &cpu->gicv3_maintenance_interrupt,
1234                              "gicv3-maintenance-interrupt", 1);
1235     qdev_init_gpio_out_named(DEVICE(cpu), &cpu->pmu_interrupt,
1236                              "pmu-interrupt", 1);
1237 #endif
1238 
1239     /* DTB consumers generally don't in fact care what the 'compatible'
1240      * string is, so always provide some string and trust that a hypothetical
1241      * picky DTB consumer will also provide a helpful error message.
1242      */
1243     cpu->dtb_compatible = "qemu,unknown";
1244     cpu->psci_version = QEMU_PSCI_VERSION_0_1; /* By default assume PSCI v0.1 */
1245     cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
1246 
1247     if (tcg_enabled() || hvf_enabled()) {
1248         /* TCG and HVF implement PSCI 1.1 */
1249         cpu->psci_version = QEMU_PSCI_VERSION_1_1;
1250     }
1251 }
1252 
1253 static Property arm_cpu_gt_cntfrq_property =
1254             DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz,
1255                                NANOSECONDS_PER_SECOND / GTIMER_SCALE);
1256 
1257 static Property arm_cpu_reset_cbar_property =
1258             DEFINE_PROP_UINT64("reset-cbar", ARMCPU, reset_cbar, 0);
1259 
1260 static Property arm_cpu_reset_hivecs_property =
1261             DEFINE_PROP_BOOL("reset-hivecs", ARMCPU, reset_hivecs, false);
1262 
1263 #ifndef CONFIG_USER_ONLY
1264 static Property arm_cpu_has_el2_property =
1265             DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);
1266 
1267 static Property arm_cpu_has_el3_property =
1268             DEFINE_PROP_BOOL("has_el3", ARMCPU, has_el3, true);
1269 #endif
1270 
1271 static Property arm_cpu_cfgend_property =
1272             DEFINE_PROP_BOOL("cfgend", ARMCPU, cfgend, false);
1273 
1274 static Property arm_cpu_has_vfp_property =
1275             DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
1276 
1277 static Property arm_cpu_has_neon_property =
1278             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
1279 
1280 static Property arm_cpu_has_dsp_property =
1281             DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
1282 
1283 static Property arm_cpu_has_mpu_property =
1284             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
1285 
1286 /* This is like DEFINE_PROP_UINT32 but it doesn't set the default value,
1287  * because the CPU initfn will have already set cpu->pmsav7_dregion to
1288  * the right value for that particular CPU type, and we don't want
1289  * to override that with an incorrect constant value.
1290  */
1291 static Property arm_cpu_pmsav7_dregion_property =
1292             DEFINE_PROP_UNSIGNED_NODEFAULT("pmsav7-dregion", ARMCPU,
1293                                            pmsav7_dregion,
1294                                            qdev_prop_uint32, uint32_t);
1295 
1296 static bool arm_get_pmu(Object *obj, Error **errp)
1297 {
1298     ARMCPU *cpu = ARM_CPU(obj);
1299 
1300     return cpu->has_pmu;
1301 }
1302 
1303 static void arm_set_pmu(Object *obj, bool value, Error **errp)
1304 {
1305     ARMCPU *cpu = ARM_CPU(obj);
1306 
1307     if (value) {
1308         if (kvm_enabled() && !kvm_arm_pmu_supported()) {
1309             error_setg(errp, "'pmu' feature not supported by KVM on this host");
1310             return;
1311         }
1312         set_feature(&cpu->env, ARM_FEATURE_PMU);
1313     } else {
1314         unset_feature(&cpu->env, ARM_FEATURE_PMU);
1315     }
1316     cpu->has_pmu = value;
1317 }
1318 
1319 unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
1320 {
1321     /*
1322      * The exact approach to calculating guest ticks is:
1323      *
1324      *     muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), cpu->gt_cntfrq_hz,
1325      *              NANOSECONDS_PER_SECOND);
1326      *
1327      * We don't do that. Rather we intentionally use integer division
1328      * truncation below and in the caller for the conversion of host monotonic
1329      * time to guest ticks to provide the exact inverse for the semantics of
1330      * the QEMUTimer scale factor. QEMUTimer's scale facter is an integer, so
1331      * it loses precision when representing frequencies where
1332      * `(NANOSECONDS_PER_SECOND % cpu->gt_cntfrq) > 0` holds. Failing to
1333      * provide an exact inverse leads to scheduling timers with negative
1334      * periods, which in turn leads to sticky behaviour in the guest.
1335      *
1336      * Finally, CNTFRQ is effectively capped at 1GHz to ensure our scale factor
1337      * cannot become zero.
1338      */
1339     return NANOSECONDS_PER_SECOND > cpu->gt_cntfrq_hz ?
1340       NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
1341 }
1342 
1343 void arm_cpu_post_init(Object *obj)
1344 {
1345     ARMCPU *cpu = ARM_CPU(obj);
1346 
1347     /* M profile implies PMSA. We have to do this here rather than
1348      * in realize with the other feature-implication checks because
1349      * we look at the PMSA bit to see if we should add some properties.
1350      */
1351     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
1352         set_feature(&cpu->env, ARM_FEATURE_PMSA);
1353     }
1354 
1355     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
1356         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
1357         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property);
1358     }
1359 
1360     if (!arm_feature(&cpu->env, ARM_FEATURE_M)) {
1361         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_hivecs_property);
1362     }
1363 
1364     if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1365         object_property_add_uint64_ptr(obj, "rvbar",
1366                                        &cpu->rvbar_prop,
1367                                        OBJ_PROP_FLAG_READWRITE);
1368     }
1369 
1370 #ifndef CONFIG_USER_ONLY
1371     if (arm_feature(&cpu->env, ARM_FEATURE_EL3)) {
1372         /* Add the has_el3 state CPU property only if EL3 is allowed.  This will
1373          * prevent "has_el3" from existing on CPUs which cannot support EL3.
1374          */
1375         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_el3_property);
1376 
1377         object_property_add_link(obj, "secure-memory",
1378                                  TYPE_MEMORY_REGION,
1379                                  (Object **)&cpu->secure_memory,
1380                                  qdev_prop_allow_set_link_before_realize,
1381                                  OBJ_PROP_LINK_STRONG);
1382     }
1383 
1384     if (arm_feature(&cpu->env, ARM_FEATURE_EL2)) {
1385         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_el2_property);
1386     }
1387 #endif
1388 
1389     if (arm_feature(&cpu->env, ARM_FEATURE_PMU)) {
1390         cpu->has_pmu = true;
1391         object_property_add_bool(obj, "pmu", arm_get_pmu, arm_set_pmu);
1392     }
1393 
1394     /*
1395      * Allow user to turn off VFP and Neon support, but only for TCG --
1396      * KVM does not currently allow us to lie to the guest about its
1397      * ID/feature registers, so the guest always sees what the host has.
1398      */
1399     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
1400         ? cpu_isar_feature(aa64_fp_simd, cpu)
1401         : cpu_isar_feature(aa32_vfp, cpu)) {
1402         cpu->has_vfp = true;
1403         if (!kvm_enabled()) {
1404             qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property);
1405         }
1406     }
1407 
1408     if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
1409         cpu->has_neon = true;
1410         if (!kvm_enabled()) {
1411             qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property);
1412         }
1413     }
1414 
1415     if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
1416         arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
1417         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property);
1418     }
1419 
1420     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
1421         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property);
1422         if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1423             qdev_property_add_static(DEVICE(obj),
1424                                      &arm_cpu_pmsav7_dregion_property);
1425         }
1426     }
1427 
1428     if (arm_feature(&cpu->env, ARM_FEATURE_M_SECURITY)) {
1429         object_property_add_link(obj, "idau", TYPE_IDAU_INTERFACE, &cpu->idau,
1430                                  qdev_prop_allow_set_link_before_realize,
1431                                  OBJ_PROP_LINK_STRONG);
1432         /*
1433          * M profile: initial value of the Secure VTOR. We can't just use
1434          * a simple DEFINE_PROP_UINT32 for this because we want to permit
1435          * the property to be set after realize.
1436          */
1437         object_property_add_uint32_ptr(obj, "init-svtor",
1438                                        &cpu->init_svtor,
1439                                        OBJ_PROP_FLAG_READWRITE);
1440     }
1441     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
1442         /*
1443          * Initial value of the NS VTOR (for cores without the Security
1444          * extension, this is the only VTOR)
1445          */
1446         object_property_add_uint32_ptr(obj, "init-nsvtor",
1447                                        &cpu->init_nsvtor,
1448                                        OBJ_PROP_FLAG_READWRITE);
1449     }
1450 
1451     /* Not DEFINE_PROP_UINT32: we want this to be settable after realize */
1452     object_property_add_uint32_ptr(obj, "psci-conduit",
1453                                    &cpu->psci_conduit,
1454                                    OBJ_PROP_FLAG_READWRITE);
1455 
1456     qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property);
1457 
1458     if (arm_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER)) {
1459         qdev_property_add_static(DEVICE(cpu), &arm_cpu_gt_cntfrq_property);
1460     }
1461 
1462     if (kvm_enabled()) {
1463         kvm_arm_add_vcpu_properties(obj);
1464     }
1465 
1466 #ifndef CONFIG_USER_ONLY
1467     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) &&
1468         cpu_isar_feature(aa64_mte, cpu)) {
1469         object_property_add_link(obj, "tag-memory",
1470                                  TYPE_MEMORY_REGION,
1471                                  (Object **)&cpu->tag_memory,
1472                                  qdev_prop_allow_set_link_before_realize,
1473                                  OBJ_PROP_LINK_STRONG);
1474 
1475         if (arm_feature(&cpu->env, ARM_FEATURE_EL3)) {
1476             object_property_add_link(obj, "secure-tag-memory",
1477                                      TYPE_MEMORY_REGION,
1478                                      (Object **)&cpu->secure_tag_memory,
1479                                      qdev_prop_allow_set_link_before_realize,
1480                                      OBJ_PROP_LINK_STRONG);
1481         }
1482     }
1483 #endif
1484 }
1485 
1486 static void arm_cpu_finalizefn(Object *obj)
1487 {
1488     ARMCPU *cpu = ARM_CPU(obj);
1489     ARMELChangeHook *hook, *next;
1490 
1491     g_hash_table_destroy(cpu->cp_regs);
1492 
1493     QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
1494         QLIST_REMOVE(hook, node);
1495         g_free(hook);
1496     }
1497     QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
1498         QLIST_REMOVE(hook, node);
1499         g_free(hook);
1500     }
1501 #ifndef CONFIG_USER_ONLY
1502     if (cpu->pmu_timer) {
1503         timer_free(cpu->pmu_timer);
1504     }
1505 #endif
1506 }
1507 
1508 void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
1509 {
1510     Error *local_err = NULL;
1511 
1512 #ifdef TARGET_AARCH64
1513     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1514         arm_cpu_sve_finalize(cpu, &local_err);
1515         if (local_err != NULL) {
1516             error_propagate(errp, local_err);
1517             return;
1518         }
1519 
1520         arm_cpu_sme_finalize(cpu, &local_err);
1521         if (local_err != NULL) {
1522             error_propagate(errp, local_err);
1523             return;
1524         }
1525 
1526         arm_cpu_pauth_finalize(cpu, &local_err);
1527         if (local_err != NULL) {
1528             error_propagate(errp, local_err);
1529             return;
1530         }
1531 
1532         arm_cpu_lpa2_finalize(cpu, &local_err);
1533         if (local_err != NULL) {
1534             error_propagate(errp, local_err);
1535             return;
1536         }
1537     }
1538 #endif
1539 
1540     if (kvm_enabled()) {
1541         kvm_arm_steal_time_finalize(cpu, &local_err);
1542         if (local_err != NULL) {
1543             error_propagate(errp, local_err);
1544             return;
1545         }
1546     }
1547 }
1548 
1549 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
1550 {
1551     CPUState *cs = CPU(dev);
1552     ARMCPU *cpu = ARM_CPU(dev);
1553     ARMCPUClass *acc = ARM_CPU_GET_CLASS(dev);
1554     CPUARMState *env = &cpu->env;
1555     int pagebits;
1556     Error *local_err = NULL;
1557     bool no_aa32 = false;
1558 
1559     /* If we needed to query the host kernel for the CPU features
1560      * then it's possible that might have failed in the initfn, but
1561      * this is the first point where we can report it.
1562      */
1563     if (cpu->host_cpu_probe_failed) {
1564         if (!kvm_enabled() && !hvf_enabled()) {
1565             error_setg(errp, "The 'host' CPU type can only be used with KVM or HVF");
1566         } else {
1567             error_setg(errp, "Failed to retrieve host CPU features");
1568         }
1569         return;
1570     }
1571 
1572 #ifndef CONFIG_USER_ONLY
1573     /* The NVIC and M-profile CPU are two halves of a single piece of
1574      * hardware; trying to use one without the other is a command line
1575      * error and will result in segfaults if not caught here.
1576      */
1577     if (arm_feature(env, ARM_FEATURE_M)) {
1578         if (!env->nvic) {
1579             error_setg(errp, "This board cannot be used with Cortex-M CPUs");
1580             return;
1581         }
1582     } else {
1583         if (env->nvic) {
1584             error_setg(errp, "This board can only be used with Cortex-M CPUs");
1585             return;
1586         }
1587     }
1588 
1589     if (!tcg_enabled() && !qtest_enabled()) {
1590         /*
1591          * We assume that no accelerator except TCG (and the "not really an
1592          * accelerator" qtest) can handle these features, because Arm hardware
1593          * virtualization can't virtualize them.
1594          *
1595          * Catch all the cases which might cause us to create more than one
1596          * address space for the CPU (otherwise we will assert() later in
1597          * cpu_address_space_init()).
1598          */
1599         if (arm_feature(env, ARM_FEATURE_M)) {
1600             error_setg(errp,
1601                        "Cannot enable %s when using an M-profile guest CPU",
1602                        current_accel_name());
1603             return;
1604         }
1605         if (cpu->has_el3) {
1606             error_setg(errp,
1607                        "Cannot enable %s when guest CPU has EL3 enabled",
1608                        current_accel_name());
1609             return;
1610         }
1611         if (cpu->tag_memory) {
1612             error_setg(errp,
1613                        "Cannot enable %s when guest CPUs has MTE enabled",
1614                        current_accel_name());
1615             return;
1616         }
1617     }
1618 
1619     {
1620         uint64_t scale;
1621 
1622         if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
1623             if (!cpu->gt_cntfrq_hz) {
1624                 error_setg(errp, "Invalid CNTFRQ: %"PRId64"Hz",
1625                            cpu->gt_cntfrq_hz);
1626                 return;
1627             }
1628             scale = gt_cntfrq_period_ns(cpu);
1629         } else {
1630             scale = GTIMER_SCALE;
1631         }
1632 
1633         cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
1634                                                arm_gt_ptimer_cb, cpu);
1635         cpu->gt_timer[GTIMER_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
1636                                                arm_gt_vtimer_cb, cpu);
1637         cpu->gt_timer[GTIMER_HYP] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
1638                                               arm_gt_htimer_cb, cpu);
1639         cpu->gt_timer[GTIMER_SEC] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
1640                                               arm_gt_stimer_cb, cpu);
1641         cpu->gt_timer[GTIMER_HYPVIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
1642                                                   arm_gt_hvtimer_cb, cpu);
1643     }
1644 #endif
1645 
1646     cpu_exec_realizefn(cs, &local_err);
1647     if (local_err != NULL) {
1648         error_propagate(errp, local_err);
1649         return;
1650     }
1651 
1652     arm_cpu_finalize_features(cpu, &local_err);
1653     if (local_err != NULL) {
1654         error_propagate(errp, local_err);
1655         return;
1656     }
1657 
1658     if (arm_feature(env, ARM_FEATURE_AARCH64) &&
1659         cpu->has_vfp != cpu->has_neon) {
1660         /*
1661          * This is an architectural requirement for AArch64; AArch32 is
1662          * more flexible and permits VFP-no-Neon and Neon-no-VFP.
1663          */
1664         error_setg(errp,
1665                    "AArch64 CPUs must have both VFP and Neon or neither");
1666         return;
1667     }
1668 
1669     if (!cpu->has_vfp) {
1670         uint64_t t;
1671         uint32_t u;
1672 
1673         t = cpu->isar.id_aa64isar1;
1674         t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
1675         cpu->isar.id_aa64isar1 = t;
1676 
1677         t = cpu->isar.id_aa64pfr0;
1678         t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
1679         cpu->isar.id_aa64pfr0 = t;
1680 
1681         u = cpu->isar.id_isar6;
1682         u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
1683         u = FIELD_DP32(u, ID_ISAR6, BF16, 0);
1684         cpu->isar.id_isar6 = u;
1685 
1686         u = cpu->isar.mvfr0;
1687         u = FIELD_DP32(u, MVFR0, FPSP, 0);
1688         u = FIELD_DP32(u, MVFR0, FPDP, 0);
1689         u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
1690         u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
1691         u = FIELD_DP32(u, MVFR0, FPROUND, 0);
1692         if (!arm_feature(env, ARM_FEATURE_M)) {
1693             u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
1694             u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
1695         }
1696         cpu->isar.mvfr0 = u;
1697 
1698         u = cpu->isar.mvfr1;
1699         u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
1700         u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
1701         u = FIELD_DP32(u, MVFR1, FPHP, 0);
1702         if (arm_feature(env, ARM_FEATURE_M)) {
1703             u = FIELD_DP32(u, MVFR1, FP16, 0);
1704         }
1705         cpu->isar.mvfr1 = u;
1706 
1707         u = cpu->isar.mvfr2;
1708         u = FIELD_DP32(u, MVFR2, FPMISC, 0);
1709         cpu->isar.mvfr2 = u;
1710     }
1711 
1712     if (!cpu->has_neon) {
1713         uint64_t t;
1714         uint32_t u;
1715 
1716         unset_feature(env, ARM_FEATURE_NEON);
1717 
1718         t = cpu->isar.id_aa64isar0;
1719         t = FIELD_DP64(t, ID_AA64ISAR0, AES, 0);
1720         t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 0);
1721         t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 0);
1722         t = FIELD_DP64(t, ID_AA64ISAR0, SHA3, 0);
1723         t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 0);
1724         t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 0);
1725         t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
1726         cpu->isar.id_aa64isar0 = t;
1727 
1728         t = cpu->isar.id_aa64isar1;
1729         t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
1730         t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 0);
1731         t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 0);
1732         cpu->isar.id_aa64isar1 = t;
1733 
1734         t = cpu->isar.id_aa64pfr0;
1735         t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
1736         cpu->isar.id_aa64pfr0 = t;
1737 
1738         u = cpu->isar.id_isar5;
1739         u = FIELD_DP32(u, ID_ISAR5, AES, 0);
1740         u = FIELD_DP32(u, ID_ISAR5, SHA1, 0);
1741         u = FIELD_DP32(u, ID_ISAR5, SHA2, 0);
1742         u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
1743         u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
1744         cpu->isar.id_isar5 = u;
1745 
1746         u = cpu->isar.id_isar6;
1747         u = FIELD_DP32(u, ID_ISAR6, DP, 0);
1748         u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
1749         u = FIELD_DP32(u, ID_ISAR6, BF16, 0);
1750         u = FIELD_DP32(u, ID_ISAR6, I8MM, 0);
1751         cpu->isar.id_isar6 = u;
1752 
1753         if (!arm_feature(env, ARM_FEATURE_M)) {
1754             u = cpu->isar.mvfr1;
1755             u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
1756             u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
1757             u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
1758             u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
1759             cpu->isar.mvfr1 = u;
1760 
1761             u = cpu->isar.mvfr2;
1762             u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
1763             cpu->isar.mvfr2 = u;
1764         }
1765     }
1766 
1767     if (!cpu->has_neon && !cpu->has_vfp) {
1768         uint64_t t;
1769         uint32_t u;
1770 
1771         t = cpu->isar.id_aa64isar0;
1772         t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
1773         cpu->isar.id_aa64isar0 = t;
1774 
1775         t = cpu->isar.id_aa64isar1;
1776         t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
1777         cpu->isar.id_aa64isar1 = t;
1778 
1779         u = cpu->isar.mvfr0;
1780         u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
1781         cpu->isar.mvfr0 = u;
1782 
1783         /* Despite the name, this field covers both VFP and Neon */
1784         u = cpu->isar.mvfr1;
1785         u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
1786         cpu->isar.mvfr1 = u;
1787     }
1788 
1789     if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
1790         uint32_t u;
1791 
1792         unset_feature(env, ARM_FEATURE_THUMB_DSP);
1793 
1794         u = cpu->isar.id_isar1;
1795         u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
1796         cpu->isar.id_isar1 = u;
1797 
1798         u = cpu->isar.id_isar2;
1799         u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
1800         u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
1801         cpu->isar.id_isar2 = u;
1802 
1803         u = cpu->isar.id_isar3;
1804         u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
1805         u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
1806         cpu->isar.id_isar3 = u;
1807     }
1808 
1809     /* Some features automatically imply others: */
1810     if (arm_feature(env, ARM_FEATURE_V8)) {
1811         if (arm_feature(env, ARM_FEATURE_M)) {
1812             set_feature(env, ARM_FEATURE_V7);
1813         } else {
1814             set_feature(env, ARM_FEATURE_V7VE);
1815         }
1816     }
1817 
1818     /*
1819      * There exist AArch64 cpus without AArch32 support.  When KVM
1820      * queries ID_ISAR0_EL1 on such a host, the value is UNKNOWN.
1821      * Similarly, we cannot check ID_AA64PFR0 without AArch64 support.
1822      * As a general principle, we also do not make ID register
1823      * consistency checks anywhere unless using TCG, because only
1824      * for TCG would a consistency-check failure be a QEMU bug.
1825      */
1826     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1827         no_aa32 = !cpu_isar_feature(aa64_aa32, cpu);
1828     }
1829 
1830     if (arm_feature(env, ARM_FEATURE_V7VE)) {
1831         /* v7 Virtualization Extensions. In real hardware this implies
1832          * EL2 and also the presence of the Security Extensions.
1833          * For QEMU, for backwards-compatibility we implement some
1834          * CPUs or CPU configs which have no actual EL2 or EL3 but do
1835          * include the various other features that V7VE implies.
1836          * Presence of EL2 itself is ARM_FEATURE_EL2, and of the
1837          * Security Extensions is ARM_FEATURE_EL3.
1838          */
1839         assert(!tcg_enabled() || no_aa32 ||
1840                cpu_isar_feature(aa32_arm_div, cpu));
1841         set_feature(env, ARM_FEATURE_LPAE);
1842         set_feature(env, ARM_FEATURE_V7);
1843     }
1844     if (arm_feature(env, ARM_FEATURE_V7)) {
1845         set_feature(env, ARM_FEATURE_VAPA);
1846         set_feature(env, ARM_FEATURE_THUMB2);
1847         set_feature(env, ARM_FEATURE_MPIDR);
1848         if (!arm_feature(env, ARM_FEATURE_M)) {
1849             set_feature(env, ARM_FEATURE_V6K);
1850         } else {
1851             set_feature(env, ARM_FEATURE_V6);
1852         }
1853 
1854         /* Always define VBAR for V7 CPUs even if it doesn't exist in
1855          * non-EL3 configs. This is needed by some legacy boards.
1856          */
1857         set_feature(env, ARM_FEATURE_VBAR);
1858     }
1859     if (arm_feature(env, ARM_FEATURE_V6K)) {
1860         set_feature(env, ARM_FEATURE_V6);
1861         set_feature(env, ARM_FEATURE_MVFR);
1862     }
1863     if (arm_feature(env, ARM_FEATURE_V6)) {
1864         set_feature(env, ARM_FEATURE_V5);
1865         if (!arm_feature(env, ARM_FEATURE_M)) {
1866             assert(!tcg_enabled() || no_aa32 ||
1867                    cpu_isar_feature(aa32_jazelle, cpu));
1868             set_feature(env, ARM_FEATURE_AUXCR);
1869         }
1870     }
1871     if (arm_feature(env, ARM_FEATURE_V5)) {
1872         set_feature(env, ARM_FEATURE_V4T);
1873     }
1874     if (arm_feature(env, ARM_FEATURE_LPAE)) {
1875         set_feature(env, ARM_FEATURE_V7MP);
1876     }
1877     if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
1878         set_feature(env, ARM_FEATURE_CBAR);
1879     }
1880     if (arm_feature(env, ARM_FEATURE_THUMB2) &&
1881         !arm_feature(env, ARM_FEATURE_M)) {
1882         set_feature(env, ARM_FEATURE_THUMB_DSP);
1883     }
1884 
1885     /*
1886      * We rely on no XScale CPU having VFP so we can use the same bits in the
1887      * TB flags field for VECSTRIDE and XSCALE_CPAR.
1888      */
1889     assert(arm_feature(&cpu->env, ARM_FEATURE_AARCH64) ||
1890            !cpu_isar_feature(aa32_vfp_simd, cpu) ||
1891            !arm_feature(env, ARM_FEATURE_XSCALE));
1892 
1893     if (arm_feature(env, ARM_FEATURE_V7) &&
1894         !arm_feature(env, ARM_FEATURE_M) &&
1895         !arm_feature(env, ARM_FEATURE_PMSA)) {
1896         /* v7VMSA drops support for the old ARMv5 tiny pages, so we
1897          * can use 4K pages.
1898          */
1899         pagebits = 12;
1900     } else {
1901         /* For CPUs which might have tiny 1K pages, or which have an
1902          * MPU and might have small region sizes, stick with 1K pages.
1903          */
1904         pagebits = 10;
1905     }
1906     if (!set_preferred_target_page_bits(pagebits)) {
1907         /* This can only ever happen for hotplugging a CPU, or if
1908          * the board code incorrectly creates a CPU which it has
1909          * promised via minimum_page_size that it will not.
1910          */
1911         error_setg(errp, "This CPU requires a smaller page size than the "
1912                    "system is using");
1913         return;
1914     }
1915 
1916     /* This cpu-id-to-MPIDR affinity is used only for TCG; KVM will override it.
1917      * We don't support setting cluster ID ([16..23]) (known as Aff2
1918      * in later ARM ARM versions), or any of the higher affinity level fields,
1919      * so these bits always RAZ.
1920      */
1921     if (cpu->mp_affinity == ARM64_AFFINITY_INVALID) {
1922         cpu->mp_affinity = arm_cpu_mp_affinity(cs->cpu_index,
1923                                                ARM_DEFAULT_CPUS_PER_CLUSTER);
1924     }
1925 
1926     if (cpu->reset_hivecs) {
1927             cpu->reset_sctlr |= (1 << 13);
1928     }
1929 
1930     if (cpu->cfgend) {
1931         if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1932             cpu->reset_sctlr |= SCTLR_EE;
1933         } else {
1934             cpu->reset_sctlr |= SCTLR_B;
1935         }
1936     }
1937 
1938     if (!arm_feature(env, ARM_FEATURE_M) && !cpu->has_el3) {
1939         /* If the has_el3 CPU property is disabled then we need to disable the
1940          * feature.
1941          */
1942         unset_feature(env, ARM_FEATURE_EL3);
1943 
1944         /*
1945          * Disable the security extension feature bits in the processor
1946          * feature registers as well.
1947          */
1948         cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1, ID_PFR1, SECURITY, 0);
1949         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
1950         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
1951                                            ID_AA64PFR0, EL3, 0);
1952     }
1953 
1954     if (!cpu->has_el2) {
1955         unset_feature(env, ARM_FEATURE_EL2);
1956     }
1957 
1958     if (!cpu->has_pmu) {
1959         unset_feature(env, ARM_FEATURE_PMU);
1960     }
1961     if (arm_feature(env, ARM_FEATURE_PMU)) {
1962         pmu_init(cpu);
1963 
1964         if (!kvm_enabled()) {
1965             arm_register_pre_el_change_hook(cpu, &pmu_pre_el_change, 0);
1966             arm_register_el_change_hook(cpu, &pmu_post_el_change, 0);
1967         }
1968 
1969 #ifndef CONFIG_USER_ONLY
1970         cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, arm_pmu_timer_cb,
1971                 cpu);
1972 #endif
1973     } else {
1974         cpu->isar.id_aa64dfr0 =
1975             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMUVER, 0);
1976         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, PERFMON, 0);
1977         cpu->pmceid0 = 0;
1978         cpu->pmceid1 = 0;
1979     }
1980 
1981     if (!arm_feature(env, ARM_FEATURE_EL2)) {
1982         /*
1983          * Disable the hypervisor feature bits in the processor feature
1984          * registers if we don't have EL2.
1985          */
1986         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
1987                                            ID_AA64PFR0, EL2, 0);
1988         cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1,
1989                                        ID_PFR1, VIRTUALIZATION, 0);
1990     }
1991 
1992 #ifndef CONFIG_USER_ONLY
1993     if (cpu->tag_memory == NULL && cpu_isar_feature(aa64_mte, cpu)) {
1994         /*
1995          * Disable the MTE feature bits if we do not have tag-memory
1996          * provided by the machine.
1997          */
1998         cpu->isar.id_aa64pfr1 =
1999             FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 0);
2000     }
2001 #endif
2002 
2003     if (tcg_enabled()) {
2004         /*
2005          * Don't report the Statistical Profiling Extension in the ID
2006          * registers, because TCG doesn't implement it yet (not even a
2007          * minimal stub version) and guests will fall over when they
2008          * try to access the non-existent system registers for it.
2009          */
2010         cpu->isar.id_aa64dfr0 =
2011             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMSVER, 0);
2012     }
2013 
2014     /* MPU can be configured out of a PMSA CPU either by setting has-mpu
2015      * to false or by setting pmsav7-dregion to 0.
2016      */
2017     if (!cpu->has_mpu || cpu->pmsav7_dregion == 0) {
2018         cpu->has_mpu = false;
2019         cpu->pmsav7_dregion = 0;
2020         cpu->pmsav8r_hdregion = 0;
2021     }
2022 
2023     if (arm_feature(env, ARM_FEATURE_PMSA) &&
2024         arm_feature(env, ARM_FEATURE_V7)) {
2025         uint32_t nr = cpu->pmsav7_dregion;
2026 
2027         if (nr > 0xff) {
2028             error_setg(errp, "PMSAv7 MPU #regions invalid %" PRIu32, nr);
2029             return;
2030         }
2031 
2032         if (nr) {
2033             if (arm_feature(env, ARM_FEATURE_V8)) {
2034                 /* PMSAv8 */
2035                 env->pmsav8.rbar[M_REG_NS] = g_new0(uint32_t, nr);
2036                 env->pmsav8.rlar[M_REG_NS] = g_new0(uint32_t, nr);
2037                 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2038                     env->pmsav8.rbar[M_REG_S] = g_new0(uint32_t, nr);
2039                     env->pmsav8.rlar[M_REG_S] = g_new0(uint32_t, nr);
2040                 }
2041             } else {
2042                 env->pmsav7.drbar = g_new0(uint32_t, nr);
2043                 env->pmsav7.drsr = g_new0(uint32_t, nr);
2044                 env->pmsav7.dracr = g_new0(uint32_t, nr);
2045             }
2046         }
2047 
2048         if (cpu->pmsav8r_hdregion > 0xff) {
2049             error_setg(errp, "PMSAv8 MPU EL2 #regions invalid %" PRIu32,
2050                               cpu->pmsav8r_hdregion);
2051             return;
2052         }
2053 
2054         if (cpu->pmsav8r_hdregion) {
2055             env->pmsav8.hprbar = g_new0(uint32_t,
2056                                         cpu->pmsav8r_hdregion);
2057             env->pmsav8.hprlar = g_new0(uint32_t,
2058                                         cpu->pmsav8r_hdregion);
2059         }
2060     }
2061 
2062     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2063         uint32_t nr = cpu->sau_sregion;
2064 
2065         if (nr > 0xff) {
2066             error_setg(errp, "v8M SAU #regions invalid %" PRIu32, nr);
2067             return;
2068         }
2069 
2070         if (nr) {
2071             env->sau.rbar = g_new0(uint32_t, nr);
2072             env->sau.rlar = g_new0(uint32_t, nr);
2073         }
2074     }
2075 
2076     if (arm_feature(env, ARM_FEATURE_EL3)) {
2077         set_feature(env, ARM_FEATURE_VBAR);
2078     }
2079 
2080     register_cp_regs_for_features(cpu);
2081     arm_cpu_register_gdb_regs_for_features(cpu);
2082 
2083     init_cpreg_list(cpu);
2084 
2085 #ifndef CONFIG_USER_ONLY
2086     MachineState *ms = MACHINE(qdev_get_machine());
2087     unsigned int smp_cpus = ms->smp.cpus;
2088     bool has_secure = cpu->has_el3 || arm_feature(env, ARM_FEATURE_M_SECURITY);
2089 
2090     /*
2091      * We must set cs->num_ases to the final value before
2092      * the first call to cpu_address_space_init.
2093      */
2094     if (cpu->tag_memory != NULL) {
2095         cs->num_ases = 3 + has_secure;
2096     } else {
2097         cs->num_ases = 1 + has_secure;
2098     }
2099 
2100     if (has_secure) {
2101         if (!cpu->secure_memory) {
2102             cpu->secure_memory = cs->memory;
2103         }
2104         cpu_address_space_init(cs, ARMASIdx_S, "cpu-secure-memory",
2105                                cpu->secure_memory);
2106     }
2107 
2108     if (cpu->tag_memory != NULL) {
2109         cpu_address_space_init(cs, ARMASIdx_TagNS, "cpu-tag-memory",
2110                                cpu->tag_memory);
2111         if (has_secure) {
2112             cpu_address_space_init(cs, ARMASIdx_TagS, "cpu-tag-memory",
2113                                    cpu->secure_tag_memory);
2114         }
2115     }
2116 
2117     cpu_address_space_init(cs, ARMASIdx_NS, "cpu-memory", cs->memory);
2118 
2119     /* No core_count specified, default to smp_cpus. */
2120     if (cpu->core_count == -1) {
2121         cpu->core_count = smp_cpus;
2122     }
2123 #endif
2124 
2125     if (tcg_enabled()) {
2126         int dcz_blocklen = 4 << cpu->dcz_blocksize;
2127 
2128         /*
2129          * We only support DCZ blocklen that fits on one page.
2130          *
2131          * Architectually this is always true.  However TARGET_PAGE_SIZE
2132          * is variable and, for compatibility with -machine virt-2.7,
2133          * is only 1KiB, as an artifact of legacy ARMv5 subpage support.
2134          * But even then, while the largest architectural DCZ blocklen
2135          * is 2KiB, no cpu actually uses such a large blocklen.
2136          */
2137         assert(dcz_blocklen <= TARGET_PAGE_SIZE);
2138 
2139         /*
2140          * We only support DCZ blocksize >= 2*TAG_GRANULE, which is to say
2141          * both nibbles of each byte storing tag data may be written at once.
2142          * Since TAG_GRANULE is 16, this means that blocklen must be >= 32.
2143          */
2144         if (cpu_isar_feature(aa64_mte, cpu)) {
2145             assert(dcz_blocklen >= 2 * TAG_GRANULE);
2146         }
2147     }
2148 
2149     qemu_init_vcpu(cs);
2150     cpu_reset(cs);
2151 
2152     acc->parent_realize(dev, errp);
2153 }
2154 
2155 static ObjectClass *arm_cpu_class_by_name(const char *cpu_model)
2156 {
2157     ObjectClass *oc;
2158     char *typename;
2159     char **cpuname;
2160     const char *cpunamestr;
2161 
2162     cpuname = g_strsplit(cpu_model, ",", 1);
2163     cpunamestr = cpuname[0];
2164 #ifdef CONFIG_USER_ONLY
2165     /* For backwards compatibility usermode emulation allows "-cpu any",
2166      * which has the same semantics as "-cpu max".
2167      */
2168     if (!strcmp(cpunamestr, "any")) {
2169         cpunamestr = "max";
2170     }
2171 #endif
2172     typename = g_strdup_printf(ARM_CPU_TYPE_NAME("%s"), cpunamestr);
2173     oc = object_class_by_name(typename);
2174     g_strfreev(cpuname);
2175     g_free(typename);
2176     if (!oc || !object_class_dynamic_cast(oc, TYPE_ARM_CPU) ||
2177         object_class_is_abstract(oc)) {
2178         return NULL;
2179     }
2180     return oc;
2181 }
2182 
2183 static Property arm_cpu_properties[] = {
2184     DEFINE_PROP_UINT64("midr", ARMCPU, midr, 0),
2185     DEFINE_PROP_UINT64("mp-affinity", ARMCPU,
2186                         mp_affinity, ARM64_AFFINITY_INVALID),
2187     DEFINE_PROP_INT32("node-id", ARMCPU, node_id, CPU_UNSET_NUMA_NODE_ID),
2188     DEFINE_PROP_INT32("core-count", ARMCPU, core_count, -1),
2189     DEFINE_PROP_END_OF_LIST()
2190 };
2191 
2192 static gchar *arm_gdb_arch_name(CPUState *cs)
2193 {
2194     ARMCPU *cpu = ARM_CPU(cs);
2195     CPUARMState *env = &cpu->env;
2196 
2197     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
2198         return g_strdup("iwmmxt");
2199     }
2200     return g_strdup("arm");
2201 }
2202 
2203 #ifndef CONFIG_USER_ONLY
2204 #include "hw/core/sysemu-cpu-ops.h"
2205 
2206 static const struct SysemuCPUOps arm_sysemu_ops = {
2207     .get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug,
2208     .asidx_from_attrs = arm_asidx_from_attrs,
2209     .write_elf32_note = arm_cpu_write_elf32_note,
2210     .write_elf64_note = arm_cpu_write_elf64_note,
2211     .virtio_is_big_endian = arm_cpu_virtio_is_big_endian,
2212     .legacy_vmsd = &vmstate_arm_cpu,
2213 };
2214 #endif
2215 
2216 #ifdef CONFIG_TCG
2217 static const struct TCGCPUOps arm_tcg_ops = {
2218     .initialize = arm_translate_init,
2219     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
2220     .debug_excp_handler = arm_debug_excp_handler,
2221     .restore_state_to_opc = arm_restore_state_to_opc,
2222 
2223 #ifdef CONFIG_USER_ONLY
2224     .record_sigsegv = arm_cpu_record_sigsegv,
2225     .record_sigbus = arm_cpu_record_sigbus,
2226 #else
2227     .tlb_fill = arm_cpu_tlb_fill,
2228     .cpu_exec_interrupt = arm_cpu_exec_interrupt,
2229     .do_interrupt = arm_cpu_do_interrupt,
2230     .do_transaction_failed = arm_cpu_do_transaction_failed,
2231     .do_unaligned_access = arm_cpu_do_unaligned_access,
2232     .adjust_watchpoint_address = arm_adjust_watchpoint_address,
2233     .debug_check_watchpoint = arm_debug_check_watchpoint,
2234     .debug_check_breakpoint = arm_debug_check_breakpoint,
2235 #endif /* !CONFIG_USER_ONLY */
2236 };
2237 #endif /* CONFIG_TCG */
2238 
2239 static void arm_cpu_class_init(ObjectClass *oc, void *data)
2240 {
2241     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
2242     CPUClass *cc = CPU_CLASS(acc);
2243     DeviceClass *dc = DEVICE_CLASS(oc);
2244     ResettableClass *rc = RESETTABLE_CLASS(oc);
2245 
2246     device_class_set_parent_realize(dc, arm_cpu_realizefn,
2247                                     &acc->parent_realize);
2248 
2249     device_class_set_props(dc, arm_cpu_properties);
2250 
2251     resettable_class_set_parent_phases(rc, NULL, arm_cpu_reset_hold, NULL,
2252                                        &acc->parent_phases);
2253 
2254     cc->class_by_name = arm_cpu_class_by_name;
2255     cc->has_work = arm_cpu_has_work;
2256     cc->dump_state = arm_cpu_dump_state;
2257     cc->set_pc = arm_cpu_set_pc;
2258     cc->get_pc = arm_cpu_get_pc;
2259     cc->gdb_read_register = arm_cpu_gdb_read_register;
2260     cc->gdb_write_register = arm_cpu_gdb_write_register;
2261 #ifndef CONFIG_USER_ONLY
2262     cc->sysemu_ops = &arm_sysemu_ops;
2263 #endif
2264     cc->gdb_num_core_regs = 26;
2265     cc->gdb_core_xml_file = "arm-core.xml";
2266     cc->gdb_arch_name = arm_gdb_arch_name;
2267     cc->gdb_get_dynamic_xml = arm_gdb_get_dynamic_xml;
2268     cc->gdb_stop_before_watchpoint = true;
2269     cc->disas_set_info = arm_disas_set_info;
2270 
2271 #ifdef CONFIG_TCG
2272     cc->tcg_ops = &arm_tcg_ops;
2273 #endif /* CONFIG_TCG */
2274 }
2275 
2276 static void arm_cpu_instance_init(Object *obj)
2277 {
2278     ARMCPUClass *acc = ARM_CPU_GET_CLASS(obj);
2279 
2280     acc->info->initfn(obj);
2281     arm_cpu_post_init(obj);
2282 }
2283 
2284 static void cpu_register_class_init(ObjectClass *oc, void *data)
2285 {
2286     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
2287 
2288     acc->info = data;
2289 }
2290 
2291 void arm_cpu_register(const ARMCPUInfo *info)
2292 {
2293     TypeInfo type_info = {
2294         .parent = TYPE_ARM_CPU,
2295         .instance_size = sizeof(ARMCPU),
2296         .instance_align = __alignof__(ARMCPU),
2297         .instance_init = arm_cpu_instance_init,
2298         .class_size = sizeof(ARMCPUClass),
2299         .class_init = info->class_init ?: cpu_register_class_init,
2300         .class_data = (void *)info,
2301     };
2302 
2303     type_info.name = g_strdup_printf("%s-" TYPE_ARM_CPU, info->name);
2304     type_register(&type_info);
2305     g_free((void *)type_info.name);
2306 }
2307 
2308 static const TypeInfo arm_cpu_type_info = {
2309     .name = TYPE_ARM_CPU,
2310     .parent = TYPE_CPU,
2311     .instance_size = sizeof(ARMCPU),
2312     .instance_align = __alignof__(ARMCPU),
2313     .instance_init = arm_cpu_initfn,
2314     .instance_finalize = arm_cpu_finalizefn,
2315     .abstract = true,
2316     .class_size = sizeof(ARMCPUClass),
2317     .class_init = arm_cpu_class_init,
2318 };
2319 
2320 static void arm_cpu_register_types(void)
2321 {
2322     type_register_static(&arm_cpu_type_info);
2323 }
2324 
2325 type_init(arm_cpu_register_types)
2326