1 /* 2 * ARM generic helpers. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 #include "qemu/osdep.h" 9 #include "qemu/units.h" 10 #include "target/arm/idau.h" 11 #include "trace.h" 12 #include "cpu.h" 13 #include "internals.h" 14 #include "exec/gdbstub.h" 15 #include "exec/helper-proto.h" 16 #include "qemu/host-utils.h" 17 #include "sysemu/sysemu.h" 18 #include "qemu/bitops.h" 19 #include "qemu/crc32c.h" 20 #include "qemu/qemu-print.h" 21 #include "exec/exec-all.h" 22 #include <zlib.h> /* For crc32 */ 23 #include "hw/semihosting/semihost.h" 24 #include "sysemu/cpus.h" 25 #include "sysemu/kvm.h" 26 #include "qemu/range.h" 27 #include "qapi/qapi-commands-machine-target.h" 28 #include "qapi/error.h" 29 #include "qemu/guest-random.h" 30 #ifdef CONFIG_TCG 31 #include "arm_ldst.h" 32 #include "exec/cpu_ldst.h" 33 #endif 34 35 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 36 37 #ifndef CONFIG_USER_ONLY 38 39 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 40 MMUAccessType access_type, ARMMMUIdx mmu_idx, 41 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 42 target_ulong *page_size_ptr, 43 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 44 #endif 45 46 static void switch_mode(CPUARMState *env, int mode); 47 48 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 49 { 50 int nregs; 51 52 /* VFP data registers are always little-endian. */ 53 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 54 if (reg < nregs) { 55 stq_le_p(buf, *aa32_vfp_dreg(env, reg)); 56 return 8; 57 } 58 if (arm_feature(env, ARM_FEATURE_NEON)) { 59 /* Aliases for Q regs. */ 60 nregs += 16; 61 if (reg < nregs) { 62 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 63 stq_le_p(buf, q[0]); 64 stq_le_p(buf + 8, q[1]); 65 return 16; 66 } 67 } 68 switch (reg - nregs) { 69 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4; 70 case 1: stl_p(buf, vfp_get_fpscr(env)); return 4; 71 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4; 72 } 73 return 0; 74 } 75 76 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 77 { 78 int nregs; 79 80 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 81 if (reg < nregs) { 82 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf); 83 return 8; 84 } 85 if (arm_feature(env, ARM_FEATURE_NEON)) { 86 nregs += 16; 87 if (reg < nregs) { 88 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 89 q[0] = ldq_le_p(buf); 90 q[1] = ldq_le_p(buf + 8); 91 return 16; 92 } 93 } 94 switch (reg - nregs) { 95 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4; 96 case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4; 97 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4; 98 } 99 return 0; 100 } 101 102 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 103 { 104 switch (reg) { 105 case 0 ... 31: 106 /* 128 bit FP register */ 107 { 108 uint64_t *q = aa64_vfp_qreg(env, reg); 109 stq_le_p(buf, q[0]); 110 stq_le_p(buf + 8, q[1]); 111 return 16; 112 } 113 case 32: 114 /* FPSR */ 115 stl_p(buf, vfp_get_fpsr(env)); 116 return 4; 117 case 33: 118 /* FPCR */ 119 stl_p(buf, vfp_get_fpcr(env)); 120 return 4; 121 default: 122 return 0; 123 } 124 } 125 126 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 127 { 128 switch (reg) { 129 case 0 ... 31: 130 /* 128 bit FP register */ 131 { 132 uint64_t *q = aa64_vfp_qreg(env, reg); 133 q[0] = ldq_le_p(buf); 134 q[1] = ldq_le_p(buf + 8); 135 return 16; 136 } 137 case 32: 138 /* FPSR */ 139 vfp_set_fpsr(env, ldl_p(buf)); 140 return 4; 141 case 33: 142 /* FPCR */ 143 vfp_set_fpcr(env, ldl_p(buf)); 144 return 4; 145 default: 146 return 0; 147 } 148 } 149 150 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 151 { 152 assert(ri->fieldoffset); 153 if (cpreg_field_is_64bit(ri)) { 154 return CPREG_FIELD64(env, ri); 155 } else { 156 return CPREG_FIELD32(env, ri); 157 } 158 } 159 160 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 161 uint64_t value) 162 { 163 assert(ri->fieldoffset); 164 if (cpreg_field_is_64bit(ri)) { 165 CPREG_FIELD64(env, ri) = value; 166 } else { 167 CPREG_FIELD32(env, ri) = value; 168 } 169 } 170 171 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 172 { 173 return (char *)env + ri->fieldoffset; 174 } 175 176 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 177 { 178 /* Raw read of a coprocessor register (as needed for migration, etc). */ 179 if (ri->type & ARM_CP_CONST) { 180 return ri->resetvalue; 181 } else if (ri->raw_readfn) { 182 return ri->raw_readfn(env, ri); 183 } else if (ri->readfn) { 184 return ri->readfn(env, ri); 185 } else { 186 return raw_read(env, ri); 187 } 188 } 189 190 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 191 uint64_t v) 192 { 193 /* Raw write of a coprocessor register (as needed for migration, etc). 194 * Note that constant registers are treated as write-ignored; the 195 * caller should check for success by whether a readback gives the 196 * value written. 197 */ 198 if (ri->type & ARM_CP_CONST) { 199 return; 200 } else if (ri->raw_writefn) { 201 ri->raw_writefn(env, ri, v); 202 } else if (ri->writefn) { 203 ri->writefn(env, ri, v); 204 } else { 205 raw_write(env, ri, v); 206 } 207 } 208 209 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg) 210 { 211 ARMCPU *cpu = env_archcpu(env); 212 const ARMCPRegInfo *ri; 213 uint32_t key; 214 215 key = cpu->dyn_xml.cpregs_keys[reg]; 216 ri = get_arm_cp_reginfo(cpu->cp_regs, key); 217 if (ri) { 218 if (cpreg_field_is_64bit(ri)) { 219 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri)); 220 } else { 221 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri)); 222 } 223 } 224 return 0; 225 } 226 227 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg) 228 { 229 return 0; 230 } 231 232 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 233 { 234 /* Return true if the regdef would cause an assertion if you called 235 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 236 * program bug for it not to have the NO_RAW flag). 237 * NB that returning false here doesn't necessarily mean that calling 238 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 239 * read/write access functions which are safe for raw use" from "has 240 * read/write access functions which have side effects but has forgotten 241 * to provide raw access functions". 242 * The tests here line up with the conditions in read/write_raw_cp_reg() 243 * and assertions in raw_read()/raw_write(). 244 */ 245 if ((ri->type & ARM_CP_CONST) || 246 ri->fieldoffset || 247 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 248 return false; 249 } 250 return true; 251 } 252 253 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync) 254 { 255 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 256 int i; 257 bool ok = true; 258 259 for (i = 0; i < cpu->cpreg_array_len; i++) { 260 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 261 const ARMCPRegInfo *ri; 262 uint64_t newval; 263 264 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 265 if (!ri) { 266 ok = false; 267 continue; 268 } 269 if (ri->type & ARM_CP_NO_RAW) { 270 continue; 271 } 272 273 newval = read_raw_cp_reg(&cpu->env, ri); 274 if (kvm_sync) { 275 /* 276 * Only sync if the previous list->cpustate sync succeeded. 277 * Rather than tracking the success/failure state for every 278 * item in the list, we just recheck "does the raw write we must 279 * have made in write_list_to_cpustate() read back OK" here. 280 */ 281 uint64_t oldval = cpu->cpreg_values[i]; 282 283 if (oldval == newval) { 284 continue; 285 } 286 287 write_raw_cp_reg(&cpu->env, ri, oldval); 288 if (read_raw_cp_reg(&cpu->env, ri) != oldval) { 289 continue; 290 } 291 292 write_raw_cp_reg(&cpu->env, ri, newval); 293 } 294 cpu->cpreg_values[i] = newval; 295 } 296 return ok; 297 } 298 299 bool write_list_to_cpustate(ARMCPU *cpu) 300 { 301 int i; 302 bool ok = true; 303 304 for (i = 0; i < cpu->cpreg_array_len; i++) { 305 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 306 uint64_t v = cpu->cpreg_values[i]; 307 const ARMCPRegInfo *ri; 308 309 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 310 if (!ri) { 311 ok = false; 312 continue; 313 } 314 if (ri->type & ARM_CP_NO_RAW) { 315 continue; 316 } 317 /* Write value and confirm it reads back as written 318 * (to catch read-only registers and partially read-only 319 * registers where the incoming migration value doesn't match) 320 */ 321 write_raw_cp_reg(&cpu->env, ri, v); 322 if (read_raw_cp_reg(&cpu->env, ri) != v) { 323 ok = false; 324 } 325 } 326 return ok; 327 } 328 329 static void add_cpreg_to_list(gpointer key, gpointer opaque) 330 { 331 ARMCPU *cpu = opaque; 332 uint64_t regidx; 333 const ARMCPRegInfo *ri; 334 335 regidx = *(uint32_t *)key; 336 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 337 338 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 339 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 340 /* The value array need not be initialized at this point */ 341 cpu->cpreg_array_len++; 342 } 343 } 344 345 static void count_cpreg(gpointer key, gpointer opaque) 346 { 347 ARMCPU *cpu = opaque; 348 uint64_t regidx; 349 const ARMCPRegInfo *ri; 350 351 regidx = *(uint32_t *)key; 352 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 353 354 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 355 cpu->cpreg_array_len++; 356 } 357 } 358 359 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 360 { 361 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a); 362 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b); 363 364 if (aidx > bidx) { 365 return 1; 366 } 367 if (aidx < bidx) { 368 return -1; 369 } 370 return 0; 371 } 372 373 void init_cpreg_list(ARMCPU *cpu) 374 { 375 /* Initialise the cpreg_tuples[] array based on the cp_regs hash. 376 * Note that we require cpreg_tuples[] to be sorted by key ID. 377 */ 378 GList *keys; 379 int arraylen; 380 381 keys = g_hash_table_get_keys(cpu->cp_regs); 382 keys = g_list_sort(keys, cpreg_key_compare); 383 384 cpu->cpreg_array_len = 0; 385 386 g_list_foreach(keys, count_cpreg, cpu); 387 388 arraylen = cpu->cpreg_array_len; 389 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 390 cpu->cpreg_values = g_new(uint64_t, arraylen); 391 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 392 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 393 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 394 cpu->cpreg_array_len = 0; 395 396 g_list_foreach(keys, add_cpreg_to_list, cpu); 397 398 assert(cpu->cpreg_array_len == arraylen); 399 400 g_list_free(keys); 401 } 402 403 /* 404 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but 405 * they are accessible when EL3 is using AArch64 regardless of EL3.NS. 406 * 407 * access_el3_aa32ns: Used to check AArch32 register views. 408 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views. 409 */ 410 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 411 const ARMCPRegInfo *ri, 412 bool isread) 413 { 414 bool secure = arm_is_secure_below_el3(env); 415 416 assert(!arm_el_is_aa64(env, 3)); 417 if (secure) { 418 return CP_ACCESS_TRAP_UNCATEGORIZED; 419 } 420 return CP_ACCESS_OK; 421 } 422 423 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env, 424 const ARMCPRegInfo *ri, 425 bool isread) 426 { 427 if (!arm_el_is_aa64(env, 3)) { 428 return access_el3_aa32ns(env, ri, isread); 429 } 430 return CP_ACCESS_OK; 431 } 432 433 /* Some secure-only AArch32 registers trap to EL3 if used from 434 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 435 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 436 * We assume that the .access field is set to PL1_RW. 437 */ 438 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 439 const ARMCPRegInfo *ri, 440 bool isread) 441 { 442 if (arm_current_el(env) == 3) { 443 return CP_ACCESS_OK; 444 } 445 if (arm_is_secure_below_el3(env)) { 446 return CP_ACCESS_TRAP_EL3; 447 } 448 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 449 return CP_ACCESS_TRAP_UNCATEGORIZED; 450 } 451 452 /* Check for traps to "powerdown debug" registers, which are controlled 453 * by MDCR.TDOSA 454 */ 455 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, 456 bool isread) 457 { 458 int el = arm_current_el(env); 459 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) || 460 (env->cp15.mdcr_el2 & MDCR_TDE) || 461 (arm_hcr_el2_eff(env) & HCR_TGE); 462 463 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) { 464 return CP_ACCESS_TRAP_EL2; 465 } 466 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { 467 return CP_ACCESS_TRAP_EL3; 468 } 469 return CP_ACCESS_OK; 470 } 471 472 /* Check for traps to "debug ROM" registers, which are controlled 473 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. 474 */ 475 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, 476 bool isread) 477 { 478 int el = arm_current_el(env); 479 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) || 480 (env->cp15.mdcr_el2 & MDCR_TDE) || 481 (arm_hcr_el2_eff(env) & HCR_TGE); 482 483 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) { 484 return CP_ACCESS_TRAP_EL2; 485 } 486 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 487 return CP_ACCESS_TRAP_EL3; 488 } 489 return CP_ACCESS_OK; 490 } 491 492 /* Check for traps to general debug registers, which are controlled 493 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. 494 */ 495 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, 496 bool isread) 497 { 498 int el = arm_current_el(env); 499 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) || 500 (env->cp15.mdcr_el2 & MDCR_TDE) || 501 (arm_hcr_el2_eff(env) & HCR_TGE); 502 503 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) { 504 return CP_ACCESS_TRAP_EL2; 505 } 506 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 507 return CP_ACCESS_TRAP_EL3; 508 } 509 return CP_ACCESS_OK; 510 } 511 512 /* Check for traps to performance monitor registers, which are controlled 513 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 514 */ 515 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 516 bool isread) 517 { 518 int el = arm_current_el(env); 519 520 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 521 && !arm_is_secure_below_el3(env)) { 522 return CP_ACCESS_TRAP_EL2; 523 } 524 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 525 return CP_ACCESS_TRAP_EL3; 526 } 527 return CP_ACCESS_OK; 528 } 529 530 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 531 { 532 ARMCPU *cpu = env_archcpu(env); 533 534 raw_write(env, ri, value); 535 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 536 } 537 538 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 539 { 540 ARMCPU *cpu = env_archcpu(env); 541 542 if (raw_read(env, ri) != value) { 543 /* Unlike real hardware the qemu TLB uses virtual addresses, 544 * not modified virtual addresses, so this causes a TLB flush. 545 */ 546 tlb_flush(CPU(cpu)); 547 raw_write(env, ri, value); 548 } 549 } 550 551 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 552 uint64_t value) 553 { 554 ARMCPU *cpu = env_archcpu(env); 555 556 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 557 && !extended_addresses_enabled(env)) { 558 /* For VMSA (when not using the LPAE long descriptor page table 559 * format) this register includes the ASID, so do a TLB flush. 560 * For PMSA it is purely a process ID and no action is needed. 561 */ 562 tlb_flush(CPU(cpu)); 563 } 564 raw_write(env, ri, value); 565 } 566 567 /* IS variants of TLB operations must affect all cores */ 568 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 569 uint64_t value) 570 { 571 CPUState *cs = env_cpu(env); 572 573 tlb_flush_all_cpus_synced(cs); 574 } 575 576 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 577 uint64_t value) 578 { 579 CPUState *cs = env_cpu(env); 580 581 tlb_flush_all_cpus_synced(cs); 582 } 583 584 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 585 uint64_t value) 586 { 587 CPUState *cs = env_cpu(env); 588 589 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 590 } 591 592 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 593 uint64_t value) 594 { 595 CPUState *cs = env_cpu(env); 596 597 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 598 } 599 600 /* 601 * Non-IS variants of TLB operations are upgraded to 602 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to 603 * force broadcast of these operations. 604 */ 605 static bool tlb_force_broadcast(CPUARMState *env) 606 { 607 return (env->cp15.hcr_el2 & HCR_FB) && 608 arm_current_el(env) == 1 && arm_is_secure_below_el3(env); 609 } 610 611 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 612 uint64_t value) 613 { 614 /* Invalidate all (TLBIALL) */ 615 ARMCPU *cpu = env_archcpu(env); 616 617 if (tlb_force_broadcast(env)) { 618 tlbiall_is_write(env, NULL, value); 619 return; 620 } 621 622 tlb_flush(CPU(cpu)); 623 } 624 625 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 626 uint64_t value) 627 { 628 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 629 ARMCPU *cpu = env_archcpu(env); 630 631 if (tlb_force_broadcast(env)) { 632 tlbimva_is_write(env, NULL, value); 633 return; 634 } 635 636 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 637 } 638 639 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 640 uint64_t value) 641 { 642 /* Invalidate by ASID (TLBIASID) */ 643 ARMCPU *cpu = env_archcpu(env); 644 645 if (tlb_force_broadcast(env)) { 646 tlbiasid_is_write(env, NULL, value); 647 return; 648 } 649 650 tlb_flush(CPU(cpu)); 651 } 652 653 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 654 uint64_t value) 655 { 656 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 657 ARMCPU *cpu = env_archcpu(env); 658 659 if (tlb_force_broadcast(env)) { 660 tlbimvaa_is_write(env, NULL, value); 661 return; 662 } 663 664 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 665 } 666 667 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 668 uint64_t value) 669 { 670 CPUState *cs = env_cpu(env); 671 672 tlb_flush_by_mmuidx(cs, 673 ARMMMUIdxBit_S12NSE1 | 674 ARMMMUIdxBit_S12NSE0 | 675 ARMMMUIdxBit_S2NS); 676 } 677 678 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 679 uint64_t value) 680 { 681 CPUState *cs = env_cpu(env); 682 683 tlb_flush_by_mmuidx_all_cpus_synced(cs, 684 ARMMMUIdxBit_S12NSE1 | 685 ARMMMUIdxBit_S12NSE0 | 686 ARMMMUIdxBit_S2NS); 687 } 688 689 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri, 690 uint64_t value) 691 { 692 /* Invalidate by IPA. This has to invalidate any structures that 693 * contain only stage 2 translation information, but does not need 694 * to apply to structures that contain combined stage 1 and stage 2 695 * translation information. 696 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 697 */ 698 CPUState *cs = env_cpu(env); 699 uint64_t pageaddr; 700 701 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 702 return; 703 } 704 705 pageaddr = sextract64(value << 12, 0, 40); 706 707 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 708 } 709 710 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 711 uint64_t value) 712 { 713 CPUState *cs = env_cpu(env); 714 uint64_t pageaddr; 715 716 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 717 return; 718 } 719 720 pageaddr = sextract64(value << 12, 0, 40); 721 722 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 723 ARMMMUIdxBit_S2NS); 724 } 725 726 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 727 uint64_t value) 728 { 729 CPUState *cs = env_cpu(env); 730 731 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 732 } 733 734 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 735 uint64_t value) 736 { 737 CPUState *cs = env_cpu(env); 738 739 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 740 } 741 742 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 743 uint64_t value) 744 { 745 CPUState *cs = env_cpu(env); 746 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 747 748 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 749 } 750 751 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 752 uint64_t value) 753 { 754 CPUState *cs = env_cpu(env); 755 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 756 757 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 758 ARMMMUIdxBit_S1E2); 759 } 760 761 static const ARMCPRegInfo cp_reginfo[] = { 762 /* Define the secure and non-secure FCSE identifier CP registers 763 * separately because there is no secure bank in V8 (no _EL3). This allows 764 * the secure register to be properly reset and migrated. There is also no 765 * v8 EL1 version of the register so the non-secure instance stands alone. 766 */ 767 { .name = "FCSEIDR", 768 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 769 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 770 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 771 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 772 { .name = "FCSEIDR_S", 773 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 774 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 775 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 776 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 777 /* Define the secure and non-secure context identifier CP registers 778 * separately because there is no secure bank in V8 (no _EL3). This allows 779 * the secure register to be properly reset and migrated. In the 780 * non-secure case, the 32-bit register will have reset and migration 781 * disabled during registration as it is handled by the 64-bit instance. 782 */ 783 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 784 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 785 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 786 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 787 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 788 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 789 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 790 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 791 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 792 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 793 REGINFO_SENTINEL 794 }; 795 796 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 797 /* NB: Some of these registers exist in v8 but with more precise 798 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 799 */ 800 /* MMU Domain access control / MPU write buffer control */ 801 { .name = "DACR", 802 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 803 .access = PL1_RW, .resetvalue = 0, 804 .writefn = dacr_write, .raw_writefn = raw_write, 805 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 806 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 807 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 808 * For v6 and v5, these mappings are overly broad. 809 */ 810 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 811 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 812 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 813 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 814 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 815 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 816 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 817 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 818 /* Cache maintenance ops; some of this space may be overridden later. */ 819 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 820 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 821 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 822 REGINFO_SENTINEL 823 }; 824 825 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 826 /* Not all pre-v6 cores implemented this WFI, so this is slightly 827 * over-broad. 828 */ 829 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 830 .access = PL1_W, .type = ARM_CP_WFI }, 831 REGINFO_SENTINEL 832 }; 833 834 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 835 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 836 * is UNPREDICTABLE; we choose to NOP as most implementations do). 837 */ 838 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 839 .access = PL1_W, .type = ARM_CP_WFI }, 840 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice 841 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 842 * OMAPCP will override this space. 843 */ 844 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 845 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 846 .resetvalue = 0 }, 847 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 848 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 849 .resetvalue = 0 }, 850 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 851 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 852 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 853 .resetvalue = 0 }, 854 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 855 * implementing it as RAZ means the "debug architecture version" bits 856 * will read as a reserved value, which should cause Linux to not try 857 * to use the debug hardware. 858 */ 859 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 860 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 861 /* MMU TLB control. Note that the wildcarding means we cover not just 862 * the unified TLB ops but also the dside/iside/inner-shareable variants. 863 */ 864 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 865 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 866 .type = ARM_CP_NO_RAW }, 867 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 868 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 869 .type = ARM_CP_NO_RAW }, 870 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 871 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 872 .type = ARM_CP_NO_RAW }, 873 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 874 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 875 .type = ARM_CP_NO_RAW }, 876 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 877 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 878 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 879 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 880 REGINFO_SENTINEL 881 }; 882 883 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 884 uint64_t value) 885 { 886 uint32_t mask = 0; 887 888 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 889 if (!arm_feature(env, ARM_FEATURE_V8)) { 890 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 891 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 892 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 893 */ 894 if (arm_feature(env, ARM_FEATURE_VFP)) { 895 /* VFP coprocessor: cp10 & cp11 [23:20] */ 896 mask |= (1 << 31) | (1 << 30) | (0xf << 20); 897 898 if (!arm_feature(env, ARM_FEATURE_NEON)) { 899 /* ASEDIS [31] bit is RAO/WI */ 900 value |= (1 << 31); 901 } 902 903 /* VFPv3 and upwards with NEON implement 32 double precision 904 * registers (D0-D31). 905 */ 906 if (!arm_feature(env, ARM_FEATURE_NEON) || 907 !arm_feature(env, ARM_FEATURE_VFP3)) { 908 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 909 value |= (1 << 30); 910 } 911 } 912 value &= mask; 913 } 914 915 /* 916 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 917 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 918 */ 919 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 920 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 921 value &= ~(0xf << 20); 922 value |= env->cp15.cpacr_el1 & (0xf << 20); 923 } 924 925 env->cp15.cpacr_el1 = value; 926 } 927 928 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri) 929 { 930 /* 931 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 932 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 933 */ 934 uint64_t value = env->cp15.cpacr_el1; 935 936 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 937 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 938 value &= ~(0xf << 20); 939 } 940 return value; 941 } 942 943 944 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 945 { 946 /* Call cpacr_write() so that we reset with the correct RAO bits set 947 * for our CPU features. 948 */ 949 cpacr_write(env, ri, 0); 950 } 951 952 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 953 bool isread) 954 { 955 if (arm_feature(env, ARM_FEATURE_V8)) { 956 /* Check if CPACR accesses are to be trapped to EL2 */ 957 if (arm_current_el(env) == 1 && 958 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) { 959 return CP_ACCESS_TRAP_EL2; 960 /* Check if CPACR accesses are to be trapped to EL3 */ 961 } else if (arm_current_el(env) < 3 && 962 (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 963 return CP_ACCESS_TRAP_EL3; 964 } 965 } 966 967 return CP_ACCESS_OK; 968 } 969 970 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 971 bool isread) 972 { 973 /* Check if CPTR accesses are set to trap to EL3 */ 974 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 975 return CP_ACCESS_TRAP_EL3; 976 } 977 978 return CP_ACCESS_OK; 979 } 980 981 static const ARMCPRegInfo v6_cp_reginfo[] = { 982 /* prefetch by MVA in v6, NOP in v7 */ 983 { .name = "MVA_prefetch", 984 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 985 .access = PL1_W, .type = ARM_CP_NOP }, 986 /* We need to break the TB after ISB to execute self-modifying code 987 * correctly and also to take any pending interrupts immediately. 988 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 989 */ 990 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 991 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 992 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 993 .access = PL0_W, .type = ARM_CP_NOP }, 994 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 995 .access = PL0_W, .type = ARM_CP_NOP }, 996 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 997 .access = PL1_RW, 998 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 999 offsetof(CPUARMState, cp15.ifar_ns) }, 1000 .resetvalue = 0, }, 1001 /* Watchpoint Fault Address Register : should actually only be present 1002 * for 1136, 1176, 11MPCore. 1003 */ 1004 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 1005 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 1006 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 1007 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 1008 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 1009 .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read }, 1010 REGINFO_SENTINEL 1011 }; 1012 1013 /* Definitions for the PMU registers */ 1014 #define PMCRN_MASK 0xf800 1015 #define PMCRN_SHIFT 11 1016 #define PMCRLC 0x40 1017 #define PMCRDP 0x10 1018 #define PMCRD 0x8 1019 #define PMCRC 0x4 1020 #define PMCRP 0x2 1021 #define PMCRE 0x1 1022 1023 #define PMXEVTYPER_P 0x80000000 1024 #define PMXEVTYPER_U 0x40000000 1025 #define PMXEVTYPER_NSK 0x20000000 1026 #define PMXEVTYPER_NSU 0x10000000 1027 #define PMXEVTYPER_NSH 0x08000000 1028 #define PMXEVTYPER_M 0x04000000 1029 #define PMXEVTYPER_MT 0x02000000 1030 #define PMXEVTYPER_EVTCOUNT 0x0000ffff 1031 #define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \ 1032 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \ 1033 PMXEVTYPER_M | PMXEVTYPER_MT | \ 1034 PMXEVTYPER_EVTCOUNT) 1035 1036 #define PMCCFILTR 0xf8000000 1037 #define PMCCFILTR_M PMXEVTYPER_M 1038 #define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M) 1039 1040 static inline uint32_t pmu_num_counters(CPUARMState *env) 1041 { 1042 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT; 1043 } 1044 1045 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */ 1046 static inline uint64_t pmu_counter_mask(CPUARMState *env) 1047 { 1048 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1); 1049 } 1050 1051 typedef struct pm_event { 1052 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 1053 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 1054 bool (*supported)(CPUARMState *); 1055 /* 1056 * Retrieve the current count of the underlying event. The programmed 1057 * counters hold a difference from the return value from this function 1058 */ 1059 uint64_t (*get_count)(CPUARMState *); 1060 /* 1061 * Return how many nanoseconds it will take (at a minimum) for count events 1062 * to occur. A negative value indicates the counter will never overflow, or 1063 * that the counter has otherwise arranged for the overflow bit to be set 1064 * and the PMU interrupt to be raised on overflow. 1065 */ 1066 int64_t (*ns_per_count)(uint64_t); 1067 } pm_event; 1068 1069 static bool event_always_supported(CPUARMState *env) 1070 { 1071 return true; 1072 } 1073 1074 static uint64_t swinc_get_count(CPUARMState *env) 1075 { 1076 /* 1077 * SW_INCR events are written directly to the pmevcntr's by writes to 1078 * PMSWINC, so there is no underlying count maintained by the PMU itself 1079 */ 1080 return 0; 1081 } 1082 1083 static int64_t swinc_ns_per(uint64_t ignored) 1084 { 1085 return -1; 1086 } 1087 1088 /* 1089 * Return the underlying cycle count for the PMU cycle counters. If we're in 1090 * usermode, simply return 0. 1091 */ 1092 static uint64_t cycles_get_count(CPUARMState *env) 1093 { 1094 #ifndef CONFIG_USER_ONLY 1095 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1096 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 1097 #else 1098 return cpu_get_host_ticks(); 1099 #endif 1100 } 1101 1102 #ifndef CONFIG_USER_ONLY 1103 static int64_t cycles_ns_per(uint64_t cycles) 1104 { 1105 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 1106 } 1107 1108 static bool instructions_supported(CPUARMState *env) 1109 { 1110 return use_icount == 1 /* Precise instruction counting */; 1111 } 1112 1113 static uint64_t instructions_get_count(CPUARMState *env) 1114 { 1115 return (uint64_t)cpu_get_icount_raw(); 1116 } 1117 1118 static int64_t instructions_ns_per(uint64_t icount) 1119 { 1120 return cpu_icount_to_ns((int64_t)icount); 1121 } 1122 #endif 1123 1124 static const pm_event pm_events[] = { 1125 { .number = 0x000, /* SW_INCR */ 1126 .supported = event_always_supported, 1127 .get_count = swinc_get_count, 1128 .ns_per_count = swinc_ns_per, 1129 }, 1130 #ifndef CONFIG_USER_ONLY 1131 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 1132 .supported = instructions_supported, 1133 .get_count = instructions_get_count, 1134 .ns_per_count = instructions_ns_per, 1135 }, 1136 { .number = 0x011, /* CPU_CYCLES, Cycle */ 1137 .supported = event_always_supported, 1138 .get_count = cycles_get_count, 1139 .ns_per_count = cycles_ns_per, 1140 } 1141 #endif 1142 }; 1143 1144 /* 1145 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1146 * events (i.e. the statistical profiling extension), this implementation 1147 * should first be updated to something sparse instead of the current 1148 * supported_event_map[] array. 1149 */ 1150 #define MAX_EVENT_ID 0x11 1151 #define UNSUPPORTED_EVENT UINT16_MAX 1152 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1153 1154 /* 1155 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 1156 * of ARM event numbers to indices in our pm_events array. 1157 * 1158 * Note: Events in the 0x40XX range are not currently supported. 1159 */ 1160 void pmu_init(ARMCPU *cpu) 1161 { 1162 unsigned int i; 1163 1164 /* 1165 * Empty supported_event_map and cpu->pmceid[01] before adding supported 1166 * events to them 1167 */ 1168 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1169 supported_event_map[i] = UNSUPPORTED_EVENT; 1170 } 1171 cpu->pmceid0 = 0; 1172 cpu->pmceid1 = 0; 1173 1174 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1175 const pm_event *cnt = &pm_events[i]; 1176 assert(cnt->number <= MAX_EVENT_ID); 1177 /* We do not currently support events in the 0x40xx range */ 1178 assert(cnt->number <= 0x3f); 1179 1180 if (cnt->supported(&cpu->env)) { 1181 supported_event_map[cnt->number] = i; 1182 uint64_t event_mask = 1ULL << (cnt->number & 0x1f); 1183 if (cnt->number & 0x20) { 1184 cpu->pmceid1 |= event_mask; 1185 } else { 1186 cpu->pmceid0 |= event_mask; 1187 } 1188 } 1189 } 1190 } 1191 1192 /* 1193 * Check at runtime whether a PMU event is supported for the current machine 1194 */ 1195 static bool event_supported(uint16_t number) 1196 { 1197 if (number > MAX_EVENT_ID) { 1198 return false; 1199 } 1200 return supported_event_map[number] != UNSUPPORTED_EVENT; 1201 } 1202 1203 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1204 bool isread) 1205 { 1206 /* Performance monitor registers user accessibility is controlled 1207 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1208 * trapping to EL2 or EL3 for other accesses. 1209 */ 1210 int el = arm_current_el(env); 1211 1212 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1213 return CP_ACCESS_TRAP; 1214 } 1215 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 1216 && !arm_is_secure_below_el3(env)) { 1217 return CP_ACCESS_TRAP_EL2; 1218 } 1219 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1220 return CP_ACCESS_TRAP_EL3; 1221 } 1222 1223 return CP_ACCESS_OK; 1224 } 1225 1226 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1227 const ARMCPRegInfo *ri, 1228 bool isread) 1229 { 1230 /* ER: event counter read trap control */ 1231 if (arm_feature(env, ARM_FEATURE_V8) 1232 && arm_current_el(env) == 0 1233 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1234 && isread) { 1235 return CP_ACCESS_OK; 1236 } 1237 1238 return pmreg_access(env, ri, isread); 1239 } 1240 1241 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1242 const ARMCPRegInfo *ri, 1243 bool isread) 1244 { 1245 /* SW: software increment write trap control */ 1246 if (arm_feature(env, ARM_FEATURE_V8) 1247 && arm_current_el(env) == 0 1248 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1249 && !isread) { 1250 return CP_ACCESS_OK; 1251 } 1252 1253 return pmreg_access(env, ri, isread); 1254 } 1255 1256 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1257 const ARMCPRegInfo *ri, 1258 bool isread) 1259 { 1260 /* ER: event counter read trap control */ 1261 if (arm_feature(env, ARM_FEATURE_V8) 1262 && arm_current_el(env) == 0 1263 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1264 return CP_ACCESS_OK; 1265 } 1266 1267 return pmreg_access(env, ri, isread); 1268 } 1269 1270 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1271 const ARMCPRegInfo *ri, 1272 bool isread) 1273 { 1274 /* CR: cycle counter read trap control */ 1275 if (arm_feature(env, ARM_FEATURE_V8) 1276 && arm_current_el(env) == 0 1277 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1278 && isread) { 1279 return CP_ACCESS_OK; 1280 } 1281 1282 return pmreg_access(env, ri, isread); 1283 } 1284 1285 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using 1286 * the current EL, security state, and register configuration. 1287 */ 1288 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1289 { 1290 uint64_t filter; 1291 bool e, p, u, nsk, nsu, nsh, m; 1292 bool enabled, prohibited, filtered; 1293 bool secure = arm_is_secure(env); 1294 int el = arm_current_el(env); 1295 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1296 1297 if (!arm_feature(env, ARM_FEATURE_PMU)) { 1298 return false; 1299 } 1300 1301 if (!arm_feature(env, ARM_FEATURE_EL2) || 1302 (counter < hpmn || counter == 31)) { 1303 e = env->cp15.c9_pmcr & PMCRE; 1304 } else { 1305 e = env->cp15.mdcr_el2 & MDCR_HPME; 1306 } 1307 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1308 1309 if (!secure) { 1310 if (el == 2 && (counter < hpmn || counter == 31)) { 1311 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD; 1312 } else { 1313 prohibited = false; 1314 } 1315 } else { 1316 prohibited = arm_feature(env, ARM_FEATURE_EL3) && 1317 (env->cp15.mdcr_el3 & MDCR_SPME); 1318 } 1319 1320 if (prohibited && counter == 31) { 1321 prohibited = env->cp15.c9_pmcr & PMCRDP; 1322 } 1323 1324 if (counter == 31) { 1325 filter = env->cp15.pmccfiltr_el0; 1326 } else { 1327 filter = env->cp15.c14_pmevtyper[counter]; 1328 } 1329 1330 p = filter & PMXEVTYPER_P; 1331 u = filter & PMXEVTYPER_U; 1332 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1333 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1334 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1335 m = arm_el_is_aa64(env, 1) && 1336 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1337 1338 if (el == 0) { 1339 filtered = secure ? u : u != nsu; 1340 } else if (el == 1) { 1341 filtered = secure ? p : p != nsk; 1342 } else if (el == 2) { 1343 filtered = !nsh; 1344 } else { /* EL3 */ 1345 filtered = m != p; 1346 } 1347 1348 if (counter != 31) { 1349 /* 1350 * If not checking PMCCNTR, ensure the counter is setup to an event we 1351 * support 1352 */ 1353 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1354 if (!event_supported(event)) { 1355 return false; 1356 } 1357 } 1358 1359 return enabled && !prohibited && !filtered; 1360 } 1361 1362 static void pmu_update_irq(CPUARMState *env) 1363 { 1364 ARMCPU *cpu = env_archcpu(env); 1365 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1366 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1367 } 1368 1369 /* 1370 * Ensure c15_ccnt is the guest-visible count so that operations such as 1371 * enabling/disabling the counter or filtering, modifying the count itself, 1372 * etc. can be done logically. This is essentially a no-op if the counter is 1373 * not enabled at the time of the call. 1374 */ 1375 static void pmccntr_op_start(CPUARMState *env) 1376 { 1377 uint64_t cycles = cycles_get_count(env); 1378 1379 if (pmu_counter_enabled(env, 31)) { 1380 uint64_t eff_cycles = cycles; 1381 if (env->cp15.c9_pmcr & PMCRD) { 1382 /* Increment once every 64 processor clock cycles */ 1383 eff_cycles /= 64; 1384 } 1385 1386 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1387 1388 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1389 1ull << 63 : 1ull << 31; 1390 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1391 env->cp15.c9_pmovsr |= (1 << 31); 1392 pmu_update_irq(env); 1393 } 1394 1395 env->cp15.c15_ccnt = new_pmccntr; 1396 } 1397 env->cp15.c15_ccnt_delta = cycles; 1398 } 1399 1400 /* 1401 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1402 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1403 * pmccntr_op_start. 1404 */ 1405 static void pmccntr_op_finish(CPUARMState *env) 1406 { 1407 if (pmu_counter_enabled(env, 31)) { 1408 #ifndef CONFIG_USER_ONLY 1409 /* Calculate when the counter will next overflow */ 1410 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1411 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1412 remaining_cycles = (uint32_t)remaining_cycles; 1413 } 1414 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1415 1416 if (overflow_in > 0) { 1417 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1418 overflow_in; 1419 ARMCPU *cpu = env_archcpu(env); 1420 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1421 } 1422 #endif 1423 1424 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1425 if (env->cp15.c9_pmcr & PMCRD) { 1426 /* Increment once every 64 processor clock cycles */ 1427 prev_cycles /= 64; 1428 } 1429 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1430 } 1431 } 1432 1433 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1434 { 1435 1436 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1437 uint64_t count = 0; 1438 if (event_supported(event)) { 1439 uint16_t event_idx = supported_event_map[event]; 1440 count = pm_events[event_idx].get_count(env); 1441 } 1442 1443 if (pmu_counter_enabled(env, counter)) { 1444 uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1445 1446 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) { 1447 env->cp15.c9_pmovsr |= (1 << counter); 1448 pmu_update_irq(env); 1449 } 1450 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1451 } 1452 env->cp15.c14_pmevcntr_delta[counter] = count; 1453 } 1454 1455 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1456 { 1457 if (pmu_counter_enabled(env, counter)) { 1458 #ifndef CONFIG_USER_ONLY 1459 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1460 uint16_t event_idx = supported_event_map[event]; 1461 uint64_t delta = UINT32_MAX - 1462 (uint32_t)env->cp15.c14_pmevcntr[counter] + 1; 1463 int64_t overflow_in = pm_events[event_idx].ns_per_count(delta); 1464 1465 if (overflow_in > 0) { 1466 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1467 overflow_in; 1468 ARMCPU *cpu = env_archcpu(env); 1469 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1470 } 1471 #endif 1472 1473 env->cp15.c14_pmevcntr_delta[counter] -= 1474 env->cp15.c14_pmevcntr[counter]; 1475 } 1476 } 1477 1478 void pmu_op_start(CPUARMState *env) 1479 { 1480 unsigned int i; 1481 pmccntr_op_start(env); 1482 for (i = 0; i < pmu_num_counters(env); i++) { 1483 pmevcntr_op_start(env, i); 1484 } 1485 } 1486 1487 void pmu_op_finish(CPUARMState *env) 1488 { 1489 unsigned int i; 1490 pmccntr_op_finish(env); 1491 for (i = 0; i < pmu_num_counters(env); i++) { 1492 pmevcntr_op_finish(env, i); 1493 } 1494 } 1495 1496 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1497 { 1498 pmu_op_start(&cpu->env); 1499 } 1500 1501 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1502 { 1503 pmu_op_finish(&cpu->env); 1504 } 1505 1506 void arm_pmu_timer_cb(void *opaque) 1507 { 1508 ARMCPU *cpu = opaque; 1509 1510 /* 1511 * Update all the counter values based on the current underlying counts, 1512 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1513 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1514 * counter may expire. 1515 */ 1516 pmu_op_start(&cpu->env); 1517 pmu_op_finish(&cpu->env); 1518 } 1519 1520 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1521 uint64_t value) 1522 { 1523 pmu_op_start(env); 1524 1525 if (value & PMCRC) { 1526 /* The counter has been reset */ 1527 env->cp15.c15_ccnt = 0; 1528 } 1529 1530 if (value & PMCRP) { 1531 unsigned int i; 1532 for (i = 0; i < pmu_num_counters(env); i++) { 1533 env->cp15.c14_pmevcntr[i] = 0; 1534 } 1535 } 1536 1537 /* only the DP, X, D and E bits are writable */ 1538 env->cp15.c9_pmcr &= ~0x39; 1539 env->cp15.c9_pmcr |= (value & 0x39); 1540 1541 pmu_op_finish(env); 1542 } 1543 1544 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1545 uint64_t value) 1546 { 1547 unsigned int i; 1548 for (i = 0; i < pmu_num_counters(env); i++) { 1549 /* Increment a counter's count iff: */ 1550 if ((value & (1 << i)) && /* counter's bit is set */ 1551 /* counter is enabled and not filtered */ 1552 pmu_counter_enabled(env, i) && 1553 /* counter is SW_INCR */ 1554 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1555 pmevcntr_op_start(env, i); 1556 1557 /* 1558 * Detect if this write causes an overflow since we can't predict 1559 * PMSWINC overflows like we can for other events 1560 */ 1561 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1562 1563 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) { 1564 env->cp15.c9_pmovsr |= (1 << i); 1565 pmu_update_irq(env); 1566 } 1567 1568 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1569 1570 pmevcntr_op_finish(env, i); 1571 } 1572 } 1573 } 1574 1575 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1576 { 1577 uint64_t ret; 1578 pmccntr_op_start(env); 1579 ret = env->cp15.c15_ccnt; 1580 pmccntr_op_finish(env); 1581 return ret; 1582 } 1583 1584 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1585 uint64_t value) 1586 { 1587 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1588 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1589 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1590 * accessed. 1591 */ 1592 env->cp15.c9_pmselr = value & 0x1f; 1593 } 1594 1595 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1596 uint64_t value) 1597 { 1598 pmccntr_op_start(env); 1599 env->cp15.c15_ccnt = value; 1600 pmccntr_op_finish(env); 1601 } 1602 1603 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1604 uint64_t value) 1605 { 1606 uint64_t cur_val = pmccntr_read(env, NULL); 1607 1608 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1609 } 1610 1611 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1612 uint64_t value) 1613 { 1614 pmccntr_op_start(env); 1615 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1616 pmccntr_op_finish(env); 1617 } 1618 1619 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1620 uint64_t value) 1621 { 1622 pmccntr_op_start(env); 1623 /* M is not accessible from AArch32 */ 1624 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1625 (value & PMCCFILTR); 1626 pmccntr_op_finish(env); 1627 } 1628 1629 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1630 { 1631 /* M is not visible in AArch32 */ 1632 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1633 } 1634 1635 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1636 uint64_t value) 1637 { 1638 value &= pmu_counter_mask(env); 1639 env->cp15.c9_pmcnten |= value; 1640 } 1641 1642 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1643 uint64_t value) 1644 { 1645 value &= pmu_counter_mask(env); 1646 env->cp15.c9_pmcnten &= ~value; 1647 } 1648 1649 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1650 uint64_t value) 1651 { 1652 value &= pmu_counter_mask(env); 1653 env->cp15.c9_pmovsr &= ~value; 1654 pmu_update_irq(env); 1655 } 1656 1657 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1658 uint64_t value) 1659 { 1660 value &= pmu_counter_mask(env); 1661 env->cp15.c9_pmovsr |= value; 1662 pmu_update_irq(env); 1663 } 1664 1665 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1666 uint64_t value, const uint8_t counter) 1667 { 1668 if (counter == 31) { 1669 pmccfiltr_write(env, ri, value); 1670 } else if (counter < pmu_num_counters(env)) { 1671 pmevcntr_op_start(env, counter); 1672 1673 /* 1674 * If this counter's event type is changing, store the current 1675 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1676 * pmevcntr_op_finish has the correct baseline when it converts back to 1677 * a delta. 1678 */ 1679 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1680 PMXEVTYPER_EVTCOUNT; 1681 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1682 if (old_event != new_event) { 1683 uint64_t count = 0; 1684 if (event_supported(new_event)) { 1685 uint16_t event_idx = supported_event_map[new_event]; 1686 count = pm_events[event_idx].get_count(env); 1687 } 1688 env->cp15.c14_pmevcntr_delta[counter] = count; 1689 } 1690 1691 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1692 pmevcntr_op_finish(env, counter); 1693 } 1694 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1695 * PMSELR value is equal to or greater than the number of implemented 1696 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1697 */ 1698 } 1699 1700 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1701 const uint8_t counter) 1702 { 1703 if (counter == 31) { 1704 return env->cp15.pmccfiltr_el0; 1705 } else if (counter < pmu_num_counters(env)) { 1706 return env->cp15.c14_pmevtyper[counter]; 1707 } else { 1708 /* 1709 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1710 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1711 */ 1712 return 0; 1713 } 1714 } 1715 1716 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1717 uint64_t value) 1718 { 1719 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1720 pmevtyper_write(env, ri, value, counter); 1721 } 1722 1723 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1724 uint64_t value) 1725 { 1726 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1727 env->cp15.c14_pmevtyper[counter] = value; 1728 1729 /* 1730 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1731 * pmu_op_finish calls when loading saved state for a migration. Because 1732 * we're potentially updating the type of event here, the value written to 1733 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a 1734 * different counter type. Therefore, we need to set this value to the 1735 * current count for the counter type we're writing so that pmu_op_finish 1736 * has the correct count for its calculation. 1737 */ 1738 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1739 if (event_supported(event)) { 1740 uint16_t event_idx = supported_event_map[event]; 1741 env->cp15.c14_pmevcntr_delta[counter] = 1742 pm_events[event_idx].get_count(env); 1743 } 1744 } 1745 1746 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1747 { 1748 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1749 return pmevtyper_read(env, ri, counter); 1750 } 1751 1752 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1753 uint64_t value) 1754 { 1755 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1756 } 1757 1758 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1759 { 1760 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1761 } 1762 1763 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1764 uint64_t value, uint8_t counter) 1765 { 1766 if (counter < pmu_num_counters(env)) { 1767 pmevcntr_op_start(env, counter); 1768 env->cp15.c14_pmevcntr[counter] = value; 1769 pmevcntr_op_finish(env, counter); 1770 } 1771 /* 1772 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1773 * are CONSTRAINED UNPREDICTABLE. 1774 */ 1775 } 1776 1777 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1778 uint8_t counter) 1779 { 1780 if (counter < pmu_num_counters(env)) { 1781 uint64_t ret; 1782 pmevcntr_op_start(env, counter); 1783 ret = env->cp15.c14_pmevcntr[counter]; 1784 pmevcntr_op_finish(env, counter); 1785 return ret; 1786 } else { 1787 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1788 * are CONSTRAINED UNPREDICTABLE. */ 1789 return 0; 1790 } 1791 } 1792 1793 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1794 uint64_t value) 1795 { 1796 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1797 pmevcntr_write(env, ri, value, counter); 1798 } 1799 1800 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1801 { 1802 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1803 return pmevcntr_read(env, ri, counter); 1804 } 1805 1806 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1807 uint64_t value) 1808 { 1809 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1810 assert(counter < pmu_num_counters(env)); 1811 env->cp15.c14_pmevcntr[counter] = value; 1812 pmevcntr_write(env, ri, value, counter); 1813 } 1814 1815 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1816 { 1817 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1818 assert(counter < pmu_num_counters(env)); 1819 return env->cp15.c14_pmevcntr[counter]; 1820 } 1821 1822 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1823 uint64_t value) 1824 { 1825 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1826 } 1827 1828 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1829 { 1830 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1831 } 1832 1833 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1834 uint64_t value) 1835 { 1836 if (arm_feature(env, ARM_FEATURE_V8)) { 1837 env->cp15.c9_pmuserenr = value & 0xf; 1838 } else { 1839 env->cp15.c9_pmuserenr = value & 1; 1840 } 1841 } 1842 1843 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1844 uint64_t value) 1845 { 1846 /* We have no event counters so only the C bit can be changed */ 1847 value &= pmu_counter_mask(env); 1848 env->cp15.c9_pminten |= value; 1849 pmu_update_irq(env); 1850 } 1851 1852 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1853 uint64_t value) 1854 { 1855 value &= pmu_counter_mask(env); 1856 env->cp15.c9_pminten &= ~value; 1857 pmu_update_irq(env); 1858 } 1859 1860 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1861 uint64_t value) 1862 { 1863 /* Note that even though the AArch64 view of this register has bits 1864 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1865 * architectural requirements for bits which are RES0 only in some 1866 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1867 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1868 */ 1869 raw_write(env, ri, value & ~0x1FULL); 1870 } 1871 1872 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1873 { 1874 /* Begin with base v8.0 state. */ 1875 uint32_t valid_mask = 0x3fff; 1876 ARMCPU *cpu = env_archcpu(env); 1877 1878 if (arm_el_is_aa64(env, 3)) { 1879 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */ 1880 valid_mask &= ~SCR_NET; 1881 } else { 1882 valid_mask &= ~(SCR_RW | SCR_ST); 1883 } 1884 1885 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1886 valid_mask &= ~SCR_HCE; 1887 1888 /* On ARMv7, SMD (or SCD as it is called in v7) is only 1889 * supported if EL2 exists. The bit is UNK/SBZP when 1890 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1891 * when EL2 is unavailable. 1892 * On ARMv8, this bit is always available. 1893 */ 1894 if (arm_feature(env, ARM_FEATURE_V7) && 1895 !arm_feature(env, ARM_FEATURE_V8)) { 1896 valid_mask &= ~SCR_SMD; 1897 } 1898 } 1899 if (cpu_isar_feature(aa64_lor, cpu)) { 1900 valid_mask |= SCR_TLOR; 1901 } 1902 if (cpu_isar_feature(aa64_pauth, cpu)) { 1903 valid_mask |= SCR_API | SCR_APK; 1904 } 1905 1906 /* Clear all-context RES0 bits. */ 1907 value &= valid_mask; 1908 raw_write(env, ri, value); 1909 } 1910 1911 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1912 { 1913 ARMCPU *cpu = env_archcpu(env); 1914 1915 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR 1916 * bank 1917 */ 1918 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1919 ri->secure & ARM_CP_SECSTATE_S); 1920 1921 return cpu->ccsidr[index]; 1922 } 1923 1924 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1925 uint64_t value) 1926 { 1927 raw_write(env, ri, value & 0xf); 1928 } 1929 1930 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1931 { 1932 CPUState *cs = env_cpu(env); 1933 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 1934 uint64_t ret = 0; 1935 1936 if (hcr_el2 & HCR_IMO) { 1937 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1938 ret |= CPSR_I; 1939 } 1940 } else { 1941 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1942 ret |= CPSR_I; 1943 } 1944 } 1945 1946 if (hcr_el2 & HCR_FMO) { 1947 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1948 ret |= CPSR_F; 1949 } 1950 } else { 1951 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1952 ret |= CPSR_F; 1953 } 1954 } 1955 1956 /* External aborts are not possible in QEMU so A bit is always clear */ 1957 return ret; 1958 } 1959 1960 static const ARMCPRegInfo v7_cp_reginfo[] = { 1961 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 1962 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 1963 .access = PL1_W, .type = ARM_CP_NOP }, 1964 /* Performance monitors are implementation defined in v7, 1965 * but with an ARM recommended set of registers, which we 1966 * follow. 1967 * 1968 * Performance registers fall into three categories: 1969 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 1970 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 1971 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 1972 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 1973 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 1974 */ 1975 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 1976 .access = PL0_RW, .type = ARM_CP_ALIAS, 1977 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1978 .writefn = pmcntenset_write, 1979 .accessfn = pmreg_access, 1980 .raw_writefn = raw_write }, 1981 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, 1982 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 1983 .access = PL0_RW, .accessfn = pmreg_access, 1984 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 1985 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 1986 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 1987 .access = PL0_RW, 1988 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1989 .accessfn = pmreg_access, 1990 .writefn = pmcntenclr_write, 1991 .type = ARM_CP_ALIAS }, 1992 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 1993 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 1994 .access = PL0_RW, .accessfn = pmreg_access, 1995 .type = ARM_CP_ALIAS, 1996 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 1997 .writefn = pmcntenclr_write }, 1998 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 1999 .access = PL0_RW, .type = ARM_CP_IO, 2000 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2001 .accessfn = pmreg_access, 2002 .writefn = pmovsr_write, 2003 .raw_writefn = raw_write }, 2004 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 2005 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 2006 .access = PL0_RW, .accessfn = pmreg_access, 2007 .type = ARM_CP_ALIAS | ARM_CP_IO, 2008 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2009 .writefn = pmovsr_write, 2010 .raw_writefn = raw_write }, 2011 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 2012 .access = PL0_W, .accessfn = pmreg_access_swinc, 2013 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2014 .writefn = pmswinc_write }, 2015 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 2016 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 2017 .access = PL0_W, .accessfn = pmreg_access_swinc, 2018 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2019 .writefn = pmswinc_write }, 2020 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 2021 .access = PL0_RW, .type = ARM_CP_ALIAS, 2022 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 2023 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 2024 .raw_writefn = raw_write}, 2025 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 2026 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 2027 .access = PL0_RW, .accessfn = pmreg_access_selr, 2028 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 2029 .writefn = pmselr_write, .raw_writefn = raw_write, }, 2030 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 2031 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 2032 .readfn = pmccntr_read, .writefn = pmccntr_write32, 2033 .accessfn = pmreg_access_ccntr }, 2034 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 2035 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 2036 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 2037 .type = ARM_CP_IO, 2038 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 2039 .readfn = pmccntr_read, .writefn = pmccntr_write, 2040 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 2041 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 2042 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 2043 .access = PL0_RW, .accessfn = pmreg_access, 2044 .type = ARM_CP_ALIAS | ARM_CP_IO, 2045 .resetvalue = 0, }, 2046 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 2047 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 2048 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 2049 .access = PL0_RW, .accessfn = pmreg_access, 2050 .type = ARM_CP_IO, 2051 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 2052 .resetvalue = 0, }, 2053 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 2054 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2055 .accessfn = pmreg_access, 2056 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2057 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 2058 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 2059 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2060 .accessfn = pmreg_access, 2061 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2062 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 2063 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2064 .accessfn = pmreg_access_xevcntr, 2065 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2066 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 2067 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 2068 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2069 .accessfn = pmreg_access_xevcntr, 2070 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2071 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2072 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2073 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2074 .resetvalue = 0, 2075 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2076 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2077 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2078 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2079 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2080 .resetvalue = 0, 2081 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2082 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2083 .access = PL1_RW, .accessfn = access_tpm, 2084 .type = ARM_CP_ALIAS | ARM_CP_IO, 2085 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2086 .resetvalue = 0, 2087 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2088 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2089 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2090 .access = PL1_RW, .accessfn = access_tpm, 2091 .type = ARM_CP_IO, 2092 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2093 .writefn = pmintenset_write, .raw_writefn = raw_write, 2094 .resetvalue = 0x0 }, 2095 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2096 .access = PL1_RW, .accessfn = access_tpm, 2097 .type = ARM_CP_ALIAS | ARM_CP_IO, 2098 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2099 .writefn = pmintenclr_write, }, 2100 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2101 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2102 .access = PL1_RW, .accessfn = access_tpm, 2103 .type = ARM_CP_ALIAS | ARM_CP_IO, 2104 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2105 .writefn = pmintenclr_write }, 2106 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2107 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2108 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2109 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2110 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2111 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0, 2112 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2113 offsetof(CPUARMState, cp15.csselr_ns) } }, 2114 /* Auxiliary ID register: this actually has an IMPDEF value but for now 2115 * just RAZ for all cores: 2116 */ 2117 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2118 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2119 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 2120 /* Auxiliary fault status registers: these also are IMPDEF, and we 2121 * choose to RAZ/WI for all cores. 2122 */ 2123 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2124 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2125 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2126 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2127 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2128 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2129 /* MAIR can just read-as-written because we don't implement caches 2130 * and so don't need to care about memory attributes. 2131 */ 2132 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2133 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2134 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2135 .resetvalue = 0 }, 2136 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2137 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2138 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2139 .resetvalue = 0 }, 2140 /* For non-long-descriptor page tables these are PRRR and NMRR; 2141 * regardless they still act as reads-as-written for QEMU. 2142 */ 2143 /* MAIR0/1 are defined separately from their 64-bit counterpart which 2144 * allows them to assign the correct fieldoffset based on the endianness 2145 * handled in the field definitions. 2146 */ 2147 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2148 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW, 2149 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2150 offsetof(CPUARMState, cp15.mair0_ns) }, 2151 .resetfn = arm_cp_reset_ignore }, 2152 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2153 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW, 2154 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2155 offsetof(CPUARMState, cp15.mair1_ns) }, 2156 .resetfn = arm_cp_reset_ignore }, 2157 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2158 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2159 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2160 /* 32 bit ITLB invalidates */ 2161 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2162 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2163 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2164 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2165 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2166 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2167 /* 32 bit DTLB invalidates */ 2168 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2169 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2170 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2171 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2172 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2173 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2174 /* 32 bit TLB invalidates */ 2175 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2176 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2177 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2178 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2179 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2180 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2181 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2182 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 2183 REGINFO_SENTINEL 2184 }; 2185 2186 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2187 /* 32 bit TLB invalidates, Inner Shareable */ 2188 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2189 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write }, 2190 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2191 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 2192 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2193 .type = ARM_CP_NO_RAW, .access = PL1_W, 2194 .writefn = tlbiasid_is_write }, 2195 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2196 .type = ARM_CP_NO_RAW, .access = PL1_W, 2197 .writefn = tlbimvaa_is_write }, 2198 REGINFO_SENTINEL 2199 }; 2200 2201 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2202 /* PMOVSSET is not implemented in v7 before v7ve */ 2203 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2204 .access = PL0_RW, .accessfn = pmreg_access, 2205 .type = ARM_CP_ALIAS | ARM_CP_IO, 2206 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2207 .writefn = pmovsset_write, 2208 .raw_writefn = raw_write }, 2209 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2210 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2211 .access = PL0_RW, .accessfn = pmreg_access, 2212 .type = ARM_CP_ALIAS | ARM_CP_IO, 2213 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2214 .writefn = pmovsset_write, 2215 .raw_writefn = raw_write }, 2216 REGINFO_SENTINEL 2217 }; 2218 2219 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2220 uint64_t value) 2221 { 2222 value &= 1; 2223 env->teecr = value; 2224 } 2225 2226 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2227 bool isread) 2228 { 2229 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2230 return CP_ACCESS_TRAP; 2231 } 2232 return CP_ACCESS_OK; 2233 } 2234 2235 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2236 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2237 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2238 .resetvalue = 0, 2239 .writefn = teecr_write }, 2240 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2241 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2242 .accessfn = teehbr_access, .resetvalue = 0 }, 2243 REGINFO_SENTINEL 2244 }; 2245 2246 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2247 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2248 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2249 .access = PL0_RW, 2250 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2251 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2252 .access = PL0_RW, 2253 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2254 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2255 .resetfn = arm_cp_reset_ignore }, 2256 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2257 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2258 .access = PL0_R|PL1_W, 2259 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2260 .resetvalue = 0}, 2261 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2262 .access = PL0_R|PL1_W, 2263 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2264 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2265 .resetfn = arm_cp_reset_ignore }, 2266 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2267 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2268 .access = PL1_RW, 2269 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2270 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2271 .access = PL1_RW, 2272 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2273 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2274 .resetvalue = 0 }, 2275 REGINFO_SENTINEL 2276 }; 2277 2278 #ifndef CONFIG_USER_ONLY 2279 2280 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2281 bool isread) 2282 { 2283 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2284 * Writable only at the highest implemented exception level. 2285 */ 2286 int el = arm_current_el(env); 2287 2288 switch (el) { 2289 case 0: 2290 if (!extract32(env->cp15.c14_cntkctl, 0, 2)) { 2291 return CP_ACCESS_TRAP; 2292 } 2293 break; 2294 case 1: 2295 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2296 arm_is_secure_below_el3(env)) { 2297 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2298 return CP_ACCESS_TRAP_UNCATEGORIZED; 2299 } 2300 break; 2301 case 2: 2302 case 3: 2303 break; 2304 } 2305 2306 if (!isread && el < arm_highest_el(env)) { 2307 return CP_ACCESS_TRAP_UNCATEGORIZED; 2308 } 2309 2310 return CP_ACCESS_OK; 2311 } 2312 2313 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2314 bool isread) 2315 { 2316 unsigned int cur_el = arm_current_el(env); 2317 bool secure = arm_is_secure(env); 2318 2319 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */ 2320 if (cur_el == 0 && 2321 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2322 return CP_ACCESS_TRAP; 2323 } 2324 2325 if (arm_feature(env, ARM_FEATURE_EL2) && 2326 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2327 !extract32(env->cp15.cnthctl_el2, 0, 1)) { 2328 return CP_ACCESS_TRAP_EL2; 2329 } 2330 return CP_ACCESS_OK; 2331 } 2332 2333 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2334 bool isread) 2335 { 2336 unsigned int cur_el = arm_current_el(env); 2337 bool secure = arm_is_secure(env); 2338 2339 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if 2340 * EL0[PV]TEN is zero. 2341 */ 2342 if (cur_el == 0 && 2343 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2344 return CP_ACCESS_TRAP; 2345 } 2346 2347 if (arm_feature(env, ARM_FEATURE_EL2) && 2348 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2349 !extract32(env->cp15.cnthctl_el2, 1, 1)) { 2350 return CP_ACCESS_TRAP_EL2; 2351 } 2352 return CP_ACCESS_OK; 2353 } 2354 2355 static CPAccessResult gt_pct_access(CPUARMState *env, 2356 const ARMCPRegInfo *ri, 2357 bool isread) 2358 { 2359 return gt_counter_access(env, GTIMER_PHYS, isread); 2360 } 2361 2362 static CPAccessResult gt_vct_access(CPUARMState *env, 2363 const ARMCPRegInfo *ri, 2364 bool isread) 2365 { 2366 return gt_counter_access(env, GTIMER_VIRT, isread); 2367 } 2368 2369 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2370 bool isread) 2371 { 2372 return gt_timer_access(env, GTIMER_PHYS, isread); 2373 } 2374 2375 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2376 bool isread) 2377 { 2378 return gt_timer_access(env, GTIMER_VIRT, isread); 2379 } 2380 2381 static CPAccessResult gt_stimer_access(CPUARMState *env, 2382 const ARMCPRegInfo *ri, 2383 bool isread) 2384 { 2385 /* The AArch64 register view of the secure physical timer is 2386 * always accessible from EL3, and configurably accessible from 2387 * Secure EL1. 2388 */ 2389 switch (arm_current_el(env)) { 2390 case 1: 2391 if (!arm_is_secure(env)) { 2392 return CP_ACCESS_TRAP; 2393 } 2394 if (!(env->cp15.scr_el3 & SCR_ST)) { 2395 return CP_ACCESS_TRAP_EL3; 2396 } 2397 return CP_ACCESS_OK; 2398 case 0: 2399 case 2: 2400 return CP_ACCESS_TRAP; 2401 case 3: 2402 return CP_ACCESS_OK; 2403 default: 2404 g_assert_not_reached(); 2405 } 2406 } 2407 2408 static uint64_t gt_get_countervalue(CPUARMState *env) 2409 { 2410 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE; 2411 } 2412 2413 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2414 { 2415 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2416 2417 if (gt->ctl & 1) { 2418 /* Timer enabled: calculate and set current ISTATUS, irq, and 2419 * reset timer to when ISTATUS next has to change 2420 */ 2421 uint64_t offset = timeridx == GTIMER_VIRT ? 2422 cpu->env.cp15.cntvoff_el2 : 0; 2423 uint64_t count = gt_get_countervalue(&cpu->env); 2424 /* Note that this must be unsigned 64 bit arithmetic: */ 2425 int istatus = count - offset >= gt->cval; 2426 uint64_t nexttick; 2427 int irqstate; 2428 2429 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2430 2431 irqstate = (istatus && !(gt->ctl & 2)); 2432 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2433 2434 if (istatus) { 2435 /* Next transition is when count rolls back over to zero */ 2436 nexttick = UINT64_MAX; 2437 } else { 2438 /* Next transition is when we hit cval */ 2439 nexttick = gt->cval + offset; 2440 } 2441 /* Note that the desired next expiry time might be beyond the 2442 * signed-64-bit range of a QEMUTimer -- in this case we just 2443 * set the timer for as far in the future as possible. When the 2444 * timer expires we will reset the timer for any remaining period. 2445 */ 2446 if (nexttick > INT64_MAX / GTIMER_SCALE) { 2447 nexttick = INT64_MAX / GTIMER_SCALE; 2448 } 2449 timer_mod(cpu->gt_timer[timeridx], nexttick); 2450 trace_arm_gt_recalc(timeridx, irqstate, nexttick); 2451 } else { 2452 /* Timer disabled: ISTATUS and timer output always clear */ 2453 gt->ctl &= ~4; 2454 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0); 2455 timer_del(cpu->gt_timer[timeridx]); 2456 trace_arm_gt_recalc_disabled(timeridx); 2457 } 2458 } 2459 2460 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2461 int timeridx) 2462 { 2463 ARMCPU *cpu = env_archcpu(env); 2464 2465 timer_del(cpu->gt_timer[timeridx]); 2466 } 2467 2468 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2469 { 2470 return gt_get_countervalue(env); 2471 } 2472 2473 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2474 { 2475 return gt_get_countervalue(env) - env->cp15.cntvoff_el2; 2476 } 2477 2478 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2479 int timeridx, 2480 uint64_t value) 2481 { 2482 trace_arm_gt_cval_write(timeridx, value); 2483 env->cp15.c14_timer[timeridx].cval = value; 2484 gt_recalc_timer(env_archcpu(env), timeridx); 2485 } 2486 2487 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2488 int timeridx) 2489 { 2490 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2491 2492 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2493 (gt_get_countervalue(env) - offset)); 2494 } 2495 2496 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2497 int timeridx, 2498 uint64_t value) 2499 { 2500 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2501 2502 trace_arm_gt_tval_write(timeridx, value); 2503 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2504 sextract64(value, 0, 32); 2505 gt_recalc_timer(env_archcpu(env), timeridx); 2506 } 2507 2508 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2509 int timeridx, 2510 uint64_t value) 2511 { 2512 ARMCPU *cpu = env_archcpu(env); 2513 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2514 2515 trace_arm_gt_ctl_write(timeridx, value); 2516 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2517 if ((oldval ^ value) & 1) { 2518 /* Enable toggled */ 2519 gt_recalc_timer(cpu, timeridx); 2520 } else if ((oldval ^ value) & 2) { 2521 /* IMASK toggled: don't need to recalculate, 2522 * just set the interrupt line based on ISTATUS 2523 */ 2524 int irqstate = (oldval & 4) && !(value & 2); 2525 2526 trace_arm_gt_imask_toggle(timeridx, irqstate); 2527 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2528 } 2529 } 2530 2531 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2532 { 2533 gt_timer_reset(env, ri, GTIMER_PHYS); 2534 } 2535 2536 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2537 uint64_t value) 2538 { 2539 gt_cval_write(env, ri, GTIMER_PHYS, value); 2540 } 2541 2542 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2543 { 2544 return gt_tval_read(env, ri, GTIMER_PHYS); 2545 } 2546 2547 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2548 uint64_t value) 2549 { 2550 gt_tval_write(env, ri, GTIMER_PHYS, value); 2551 } 2552 2553 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2554 uint64_t value) 2555 { 2556 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2557 } 2558 2559 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2560 { 2561 gt_timer_reset(env, ri, GTIMER_VIRT); 2562 } 2563 2564 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2565 uint64_t value) 2566 { 2567 gt_cval_write(env, ri, GTIMER_VIRT, value); 2568 } 2569 2570 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2571 { 2572 return gt_tval_read(env, ri, GTIMER_VIRT); 2573 } 2574 2575 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2576 uint64_t value) 2577 { 2578 gt_tval_write(env, ri, GTIMER_VIRT, value); 2579 } 2580 2581 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2582 uint64_t value) 2583 { 2584 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2585 } 2586 2587 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2588 uint64_t value) 2589 { 2590 ARMCPU *cpu = env_archcpu(env); 2591 2592 trace_arm_gt_cntvoff_write(value); 2593 raw_write(env, ri, value); 2594 gt_recalc_timer(cpu, GTIMER_VIRT); 2595 } 2596 2597 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2598 { 2599 gt_timer_reset(env, ri, GTIMER_HYP); 2600 } 2601 2602 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2603 uint64_t value) 2604 { 2605 gt_cval_write(env, ri, GTIMER_HYP, value); 2606 } 2607 2608 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2609 { 2610 return gt_tval_read(env, ri, GTIMER_HYP); 2611 } 2612 2613 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2614 uint64_t value) 2615 { 2616 gt_tval_write(env, ri, GTIMER_HYP, value); 2617 } 2618 2619 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2620 uint64_t value) 2621 { 2622 gt_ctl_write(env, ri, GTIMER_HYP, value); 2623 } 2624 2625 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2626 { 2627 gt_timer_reset(env, ri, GTIMER_SEC); 2628 } 2629 2630 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2631 uint64_t value) 2632 { 2633 gt_cval_write(env, ri, GTIMER_SEC, value); 2634 } 2635 2636 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2637 { 2638 return gt_tval_read(env, ri, GTIMER_SEC); 2639 } 2640 2641 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2642 uint64_t value) 2643 { 2644 gt_tval_write(env, ri, GTIMER_SEC, value); 2645 } 2646 2647 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2648 uint64_t value) 2649 { 2650 gt_ctl_write(env, ri, GTIMER_SEC, value); 2651 } 2652 2653 void arm_gt_ptimer_cb(void *opaque) 2654 { 2655 ARMCPU *cpu = opaque; 2656 2657 gt_recalc_timer(cpu, GTIMER_PHYS); 2658 } 2659 2660 void arm_gt_vtimer_cb(void *opaque) 2661 { 2662 ARMCPU *cpu = opaque; 2663 2664 gt_recalc_timer(cpu, GTIMER_VIRT); 2665 } 2666 2667 void arm_gt_htimer_cb(void *opaque) 2668 { 2669 ARMCPU *cpu = opaque; 2670 2671 gt_recalc_timer(cpu, GTIMER_HYP); 2672 } 2673 2674 void arm_gt_stimer_cb(void *opaque) 2675 { 2676 ARMCPU *cpu = opaque; 2677 2678 gt_recalc_timer(cpu, GTIMER_SEC); 2679 } 2680 2681 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2682 /* Note that CNTFRQ is purely reads-as-written for the benefit 2683 * of software; writing it doesn't actually change the timer frequency. 2684 * Our reset value matches the fixed frequency we implement the timer at. 2685 */ 2686 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 2687 .type = ARM_CP_ALIAS, 2688 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2689 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 2690 }, 2691 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2692 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2693 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2694 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2695 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE, 2696 }, 2697 /* overall control: mostly access permissions */ 2698 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 2699 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 2700 .access = PL1_RW, 2701 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 2702 .resetvalue = 0, 2703 }, 2704 /* per-timer control */ 2705 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2706 .secure = ARM_CP_SECSTATE_NS, 2707 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2708 .accessfn = gt_ptimer_access, 2709 .fieldoffset = offsetoflow32(CPUARMState, 2710 cp15.c14_timer[GTIMER_PHYS].ctl), 2711 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2712 }, 2713 { .name = "CNTP_CTL_S", 2714 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2715 .secure = ARM_CP_SECSTATE_S, 2716 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2717 .accessfn = gt_ptimer_access, 2718 .fieldoffset = offsetoflow32(CPUARMState, 2719 cp15.c14_timer[GTIMER_SEC].ctl), 2720 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2721 }, 2722 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 2723 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 2724 .type = ARM_CP_IO, .access = PL0_RW, 2725 .accessfn = gt_ptimer_access, 2726 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 2727 .resetvalue = 0, 2728 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2729 }, 2730 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 2731 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2732 .accessfn = gt_vtimer_access, 2733 .fieldoffset = offsetoflow32(CPUARMState, 2734 cp15.c14_timer[GTIMER_VIRT].ctl), 2735 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2736 }, 2737 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 2738 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 2739 .type = ARM_CP_IO, .access = PL0_RW, 2740 .accessfn = gt_vtimer_access, 2741 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 2742 .resetvalue = 0, 2743 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2744 }, 2745 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 2746 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2747 .secure = ARM_CP_SECSTATE_NS, 2748 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2749 .accessfn = gt_ptimer_access, 2750 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2751 }, 2752 { .name = "CNTP_TVAL_S", 2753 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2754 .secure = ARM_CP_SECSTATE_S, 2755 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2756 .accessfn = gt_ptimer_access, 2757 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 2758 }, 2759 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2760 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 2761 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2762 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 2763 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2764 }, 2765 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 2766 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2767 .accessfn = gt_vtimer_access, 2768 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2769 }, 2770 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2771 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 2772 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2773 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 2774 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2775 }, 2776 /* The counter itself */ 2777 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 2778 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2779 .accessfn = gt_pct_access, 2780 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 2781 }, 2782 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 2783 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 2784 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2785 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 2786 }, 2787 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 2788 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2789 .accessfn = gt_vct_access, 2790 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 2791 }, 2792 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2793 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2794 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2795 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 2796 }, 2797 /* Comparison value, indicating when the timer goes off */ 2798 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 2799 .secure = ARM_CP_SECSTATE_NS, 2800 .access = PL0_RW, 2801 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2802 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2803 .accessfn = gt_ptimer_access, 2804 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2805 }, 2806 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 2807 .secure = ARM_CP_SECSTATE_S, 2808 .access = PL0_RW, 2809 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2810 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2811 .accessfn = gt_ptimer_access, 2812 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2813 }, 2814 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2815 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 2816 .access = PL0_RW, 2817 .type = ARM_CP_IO, 2818 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2819 .resetvalue = 0, .accessfn = gt_ptimer_access, 2820 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2821 }, 2822 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 2823 .access = PL0_RW, 2824 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2825 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2826 .accessfn = gt_vtimer_access, 2827 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2828 }, 2829 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2830 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 2831 .access = PL0_RW, 2832 .type = ARM_CP_IO, 2833 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2834 .resetvalue = 0, .accessfn = gt_vtimer_access, 2835 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2836 }, 2837 /* Secure timer -- this is actually restricted to only EL3 2838 * and configurably Secure-EL1 via the accessfn. 2839 */ 2840 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 2841 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 2842 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 2843 .accessfn = gt_stimer_access, 2844 .readfn = gt_sec_tval_read, 2845 .writefn = gt_sec_tval_write, 2846 .resetfn = gt_sec_timer_reset, 2847 }, 2848 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 2849 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 2850 .type = ARM_CP_IO, .access = PL1_RW, 2851 .accessfn = gt_stimer_access, 2852 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 2853 .resetvalue = 0, 2854 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2855 }, 2856 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 2857 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 2858 .type = ARM_CP_IO, .access = PL1_RW, 2859 .accessfn = gt_stimer_access, 2860 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2861 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2862 }, 2863 REGINFO_SENTINEL 2864 }; 2865 2866 #else 2867 2868 /* In user-mode most of the generic timer registers are inaccessible 2869 * however modern kernels (4.12+) allow access to cntvct_el0 2870 */ 2871 2872 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2873 { 2874 /* Currently we have no support for QEMUTimer in linux-user so we 2875 * can't call gt_get_countervalue(env), instead we directly 2876 * call the lower level functions. 2877 */ 2878 return cpu_get_clock() / GTIMER_SCALE; 2879 } 2880 2881 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2882 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2883 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2884 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 2885 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2886 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE, 2887 }, 2888 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2889 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2890 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2891 .readfn = gt_virt_cnt_read, 2892 }, 2893 REGINFO_SENTINEL 2894 }; 2895 2896 #endif 2897 2898 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2899 { 2900 if (arm_feature(env, ARM_FEATURE_LPAE)) { 2901 raw_write(env, ri, value); 2902 } else if (arm_feature(env, ARM_FEATURE_V7)) { 2903 raw_write(env, ri, value & 0xfffff6ff); 2904 } else { 2905 raw_write(env, ri, value & 0xfffff1ff); 2906 } 2907 } 2908 2909 #ifndef CONFIG_USER_ONLY 2910 /* get_phys_addr() isn't present for user-mode-only targets */ 2911 2912 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 2913 bool isread) 2914 { 2915 if (ri->opc2 & 4) { 2916 /* The ATS12NSO* operations must trap to EL3 if executed in 2917 * Secure EL1 (which can only happen if EL3 is AArch64). 2918 * They are simply UNDEF if executed from NS EL1. 2919 * They function normally from EL2 or EL3. 2920 */ 2921 if (arm_current_el(env) == 1) { 2922 if (arm_is_secure_below_el3(env)) { 2923 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3; 2924 } 2925 return CP_ACCESS_TRAP_UNCATEGORIZED; 2926 } 2927 } 2928 return CP_ACCESS_OK; 2929 } 2930 2931 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 2932 MMUAccessType access_type, ARMMMUIdx mmu_idx) 2933 { 2934 hwaddr phys_addr; 2935 target_ulong page_size; 2936 int prot; 2937 bool ret; 2938 uint64_t par64; 2939 bool format64 = false; 2940 MemTxAttrs attrs = {}; 2941 ARMMMUFaultInfo fi = {}; 2942 ARMCacheAttrs cacheattrs = {}; 2943 2944 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs, 2945 &prot, &page_size, &fi, &cacheattrs); 2946 2947 if (is_a64(env)) { 2948 format64 = true; 2949 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 2950 /* 2951 * ATS1Cxx: 2952 * * TTBCR.EAE determines whether the result is returned using the 2953 * 32-bit or the 64-bit PAR format 2954 * * Instructions executed in Hyp mode always use the 64bit format 2955 * 2956 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 2957 * * The Non-secure TTBCR.EAE bit is set to 1 2958 * * The implementation includes EL2, and the value of HCR.VM is 1 2959 * 2960 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 2961 * 2962 * ATS1Hx always uses the 64bit format. 2963 */ 2964 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 2965 2966 if (arm_feature(env, ARM_FEATURE_EL2)) { 2967 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 2968 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 2969 } else { 2970 format64 |= arm_current_el(env) == 2; 2971 } 2972 } 2973 } 2974 2975 if (format64) { 2976 /* Create a 64-bit PAR */ 2977 par64 = (1 << 11); /* LPAE bit always set */ 2978 if (!ret) { 2979 par64 |= phys_addr & ~0xfffULL; 2980 if (!attrs.secure) { 2981 par64 |= (1 << 9); /* NS */ 2982 } 2983 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */ 2984 par64 |= cacheattrs.shareability << 7; /* SH */ 2985 } else { 2986 uint32_t fsr = arm_fi_to_lfsc(&fi); 2987 2988 par64 |= 1; /* F */ 2989 par64 |= (fsr & 0x3f) << 1; /* FS */ 2990 if (fi.stage2) { 2991 par64 |= (1 << 9); /* S */ 2992 } 2993 if (fi.s1ptw) { 2994 par64 |= (1 << 8); /* PTW */ 2995 } 2996 } 2997 } else { 2998 /* fsr is a DFSR/IFSR value for the short descriptor 2999 * translation table format (with WnR always clear). 3000 * Convert it to a 32-bit PAR. 3001 */ 3002 if (!ret) { 3003 /* We do not set any attribute bits in the PAR */ 3004 if (page_size == (1 << 24) 3005 && arm_feature(env, ARM_FEATURE_V7)) { 3006 par64 = (phys_addr & 0xff000000) | (1 << 1); 3007 } else { 3008 par64 = phys_addr & 0xfffff000; 3009 } 3010 if (!attrs.secure) { 3011 par64 |= (1 << 9); /* NS */ 3012 } 3013 } else { 3014 uint32_t fsr = arm_fi_to_sfsc(&fi); 3015 3016 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 3017 ((fsr & 0xf) << 1) | 1; 3018 } 3019 } 3020 return par64; 3021 } 3022 3023 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3024 { 3025 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3026 uint64_t par64; 3027 ARMMMUIdx mmu_idx; 3028 int el = arm_current_el(env); 3029 bool secure = arm_is_secure_below_el3(env); 3030 3031 switch (ri->opc2 & 6) { 3032 case 0: 3033 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */ 3034 switch (el) { 3035 case 3: 3036 mmu_idx = ARMMMUIdx_S1E3; 3037 break; 3038 case 2: 3039 mmu_idx = ARMMMUIdx_S1NSE1; 3040 break; 3041 case 1: 3042 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 3043 break; 3044 default: 3045 g_assert_not_reached(); 3046 } 3047 break; 3048 case 2: 3049 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3050 switch (el) { 3051 case 3: 3052 mmu_idx = ARMMMUIdx_S1SE0; 3053 break; 3054 case 2: 3055 mmu_idx = ARMMMUIdx_S1NSE0; 3056 break; 3057 case 1: 3058 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 3059 break; 3060 default: 3061 g_assert_not_reached(); 3062 } 3063 break; 3064 case 4: 3065 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3066 mmu_idx = ARMMMUIdx_S12NSE1; 3067 break; 3068 case 6: 3069 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3070 mmu_idx = ARMMMUIdx_S12NSE0; 3071 break; 3072 default: 3073 g_assert_not_reached(); 3074 } 3075 3076 par64 = do_ats_write(env, value, access_type, mmu_idx); 3077 3078 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3079 } 3080 3081 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3082 uint64_t value) 3083 { 3084 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3085 uint64_t par64; 3086 3087 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2); 3088 3089 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3090 } 3091 3092 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3093 bool isread) 3094 { 3095 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) { 3096 return CP_ACCESS_TRAP; 3097 } 3098 return CP_ACCESS_OK; 3099 } 3100 3101 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3102 uint64_t value) 3103 { 3104 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3105 ARMMMUIdx mmu_idx; 3106 int secure = arm_is_secure_below_el3(env); 3107 3108 switch (ri->opc2 & 6) { 3109 case 0: 3110 switch (ri->opc1) { 3111 case 0: /* AT S1E1R, AT S1E1W */ 3112 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 3113 break; 3114 case 4: /* AT S1E2R, AT S1E2W */ 3115 mmu_idx = ARMMMUIdx_S1E2; 3116 break; 3117 case 6: /* AT S1E3R, AT S1E3W */ 3118 mmu_idx = ARMMMUIdx_S1E3; 3119 break; 3120 default: 3121 g_assert_not_reached(); 3122 } 3123 break; 3124 case 2: /* AT S1E0R, AT S1E0W */ 3125 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 3126 break; 3127 case 4: /* AT S12E1R, AT S12E1W */ 3128 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1; 3129 break; 3130 case 6: /* AT S12E0R, AT S12E0W */ 3131 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0; 3132 break; 3133 default: 3134 g_assert_not_reached(); 3135 } 3136 3137 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx); 3138 } 3139 #endif 3140 3141 static const ARMCPRegInfo vapa_cp_reginfo[] = { 3142 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 3143 .access = PL1_RW, .resetvalue = 0, 3144 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 3145 offsetoflow32(CPUARMState, cp15.par_ns) }, 3146 .writefn = par_write }, 3147 #ifndef CONFIG_USER_ONLY 3148 /* This underdecoding is safe because the reginfo is NO_RAW. */ 3149 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 3150 .access = PL1_W, .accessfn = ats_access, 3151 .writefn = ats_write, .type = ARM_CP_NO_RAW }, 3152 #endif 3153 REGINFO_SENTINEL 3154 }; 3155 3156 /* Return basic MPU access permission bits. */ 3157 static uint32_t simple_mpu_ap_bits(uint32_t val) 3158 { 3159 uint32_t ret; 3160 uint32_t mask; 3161 int i; 3162 ret = 0; 3163 mask = 3; 3164 for (i = 0; i < 16; i += 2) { 3165 ret |= (val >> i) & mask; 3166 mask <<= 2; 3167 } 3168 return ret; 3169 } 3170 3171 /* Pad basic MPU access permission bits to extended format. */ 3172 static uint32_t extended_mpu_ap_bits(uint32_t val) 3173 { 3174 uint32_t ret; 3175 uint32_t mask; 3176 int i; 3177 ret = 0; 3178 mask = 3; 3179 for (i = 0; i < 16; i += 2) { 3180 ret |= (val & mask) << i; 3181 mask <<= 2; 3182 } 3183 return ret; 3184 } 3185 3186 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3187 uint64_t value) 3188 { 3189 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3190 } 3191 3192 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3193 { 3194 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3195 } 3196 3197 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3198 uint64_t value) 3199 { 3200 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3201 } 3202 3203 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3204 { 3205 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3206 } 3207 3208 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3209 { 3210 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3211 3212 if (!u32p) { 3213 return 0; 3214 } 3215 3216 u32p += env->pmsav7.rnr[M_REG_NS]; 3217 return *u32p; 3218 } 3219 3220 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3221 uint64_t value) 3222 { 3223 ARMCPU *cpu = env_archcpu(env); 3224 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3225 3226 if (!u32p) { 3227 return; 3228 } 3229 3230 u32p += env->pmsav7.rnr[M_REG_NS]; 3231 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3232 *u32p = value; 3233 } 3234 3235 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3236 uint64_t value) 3237 { 3238 ARMCPU *cpu = env_archcpu(env); 3239 uint32_t nrgs = cpu->pmsav7_dregion; 3240 3241 if (value >= nrgs) { 3242 qemu_log_mask(LOG_GUEST_ERROR, 3243 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3244 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3245 return; 3246 } 3247 3248 raw_write(env, ri, value); 3249 } 3250 3251 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 3252 /* Reset for all these registers is handled in arm_cpu_reset(), 3253 * because the PMSAv7 is also used by M-profile CPUs, which do 3254 * not register cpregs but still need the state to be reset. 3255 */ 3256 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 3257 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3258 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 3259 .readfn = pmsav7_read, .writefn = pmsav7_write, 3260 .resetfn = arm_cp_reset_ignore }, 3261 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 3262 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3263 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 3264 .readfn = pmsav7_read, .writefn = pmsav7_write, 3265 .resetfn = arm_cp_reset_ignore }, 3266 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 3267 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3268 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 3269 .readfn = pmsav7_read, .writefn = pmsav7_write, 3270 .resetfn = arm_cp_reset_ignore }, 3271 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 3272 .access = PL1_RW, 3273 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 3274 .writefn = pmsav7_rgnr_write, 3275 .resetfn = arm_cp_reset_ignore }, 3276 REGINFO_SENTINEL 3277 }; 3278 3279 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 3280 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3281 .access = PL1_RW, .type = ARM_CP_ALIAS, 3282 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3283 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 3284 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3285 .access = PL1_RW, .type = ARM_CP_ALIAS, 3286 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3287 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 3288 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 3289 .access = PL1_RW, 3290 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3291 .resetvalue = 0, }, 3292 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 3293 .access = PL1_RW, 3294 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3295 .resetvalue = 0, }, 3296 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 3297 .access = PL1_RW, 3298 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 3299 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 3300 .access = PL1_RW, 3301 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 3302 /* Protection region base and size registers */ 3303 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 3304 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3305 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 3306 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 3307 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3308 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 3309 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 3310 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3311 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 3312 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 3313 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3314 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 3315 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 3316 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3317 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 3318 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 3319 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3320 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 3321 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 3322 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3323 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 3324 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 3325 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3326 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 3327 REGINFO_SENTINEL 3328 }; 3329 3330 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 3331 uint64_t value) 3332 { 3333 TCR *tcr = raw_ptr(env, ri); 3334 int maskshift = extract32(value, 0, 3); 3335 3336 if (!arm_feature(env, ARM_FEATURE_V8)) { 3337 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 3338 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 3339 * using Long-desciptor translation table format */ 3340 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 3341 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 3342 /* In an implementation that includes the Security Extensions 3343 * TTBCR has additional fields PD0 [4] and PD1 [5] for 3344 * Short-descriptor translation table format. 3345 */ 3346 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 3347 } else { 3348 value &= TTBCR_N; 3349 } 3350 } 3351 3352 /* Update the masks corresponding to the TCR bank being written 3353 * Note that we always calculate mask and base_mask, but 3354 * they are only used for short-descriptor tables (ie if EAE is 0); 3355 * for long-descriptor tables the TCR fields are used differently 3356 * and the mask and base_mask values are meaningless. 3357 */ 3358 tcr->raw_tcr = value; 3359 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift); 3360 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift); 3361 } 3362 3363 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3364 uint64_t value) 3365 { 3366 ARMCPU *cpu = env_archcpu(env); 3367 TCR *tcr = raw_ptr(env, ri); 3368 3369 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3370 /* With LPAE the TTBCR could result in a change of ASID 3371 * via the TTBCR.A1 bit, so do a TLB flush. 3372 */ 3373 tlb_flush(CPU(cpu)); 3374 } 3375 /* Preserve the high half of TCR_EL1, set via TTBCR2. */ 3376 value = deposit64(tcr->raw_tcr, 0, 32, value); 3377 vmsa_ttbcr_raw_write(env, ri, value); 3378 } 3379 3380 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3381 { 3382 TCR *tcr = raw_ptr(env, ri); 3383 3384 /* Reset both the TCR as well as the masks corresponding to the bank of 3385 * the TCR being reset. 3386 */ 3387 tcr->raw_tcr = 0; 3388 tcr->mask = 0; 3389 tcr->base_mask = 0xffffc000u; 3390 } 3391 3392 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3393 uint64_t value) 3394 { 3395 ARMCPU *cpu = env_archcpu(env); 3396 TCR *tcr = raw_ptr(env, ri); 3397 3398 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 3399 tlb_flush(CPU(cpu)); 3400 tcr->raw_tcr = value; 3401 } 3402 3403 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3404 uint64_t value) 3405 { 3406 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 3407 if (cpreg_field_is_64bit(ri) && 3408 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 3409 ARMCPU *cpu = env_archcpu(env); 3410 tlb_flush(CPU(cpu)); 3411 } 3412 raw_write(env, ri, value); 3413 } 3414 3415 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3416 uint64_t value) 3417 { 3418 ARMCPU *cpu = env_archcpu(env); 3419 CPUState *cs = CPU(cpu); 3420 3421 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */ 3422 if (raw_read(env, ri) != value) { 3423 tlb_flush_by_mmuidx(cs, 3424 ARMMMUIdxBit_S12NSE1 | 3425 ARMMMUIdxBit_S12NSE0 | 3426 ARMMMUIdxBit_S2NS); 3427 raw_write(env, ri, value); 3428 } 3429 } 3430 3431 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 3432 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3433 .access = PL1_RW, .type = ARM_CP_ALIAS, 3434 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 3435 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 3436 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3437 .access = PL1_RW, .resetvalue = 0, 3438 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 3439 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 3440 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 3441 .access = PL1_RW, .resetvalue = 0, 3442 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 3443 offsetof(CPUARMState, cp15.dfar_ns) } }, 3444 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 3445 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 3446 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 3447 .resetvalue = 0, }, 3448 REGINFO_SENTINEL 3449 }; 3450 3451 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 3452 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 3453 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 3454 .access = PL1_RW, 3455 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 3456 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 3457 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 3458 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3459 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3460 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 3461 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 3462 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 3463 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3464 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3465 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 3466 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 3467 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3468 .access = PL1_RW, .writefn = vmsa_tcr_el1_write, 3469 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write, 3470 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 3471 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3472 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 3473 .raw_writefn = vmsa_ttbcr_raw_write, 3474 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 3475 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 3476 REGINFO_SENTINEL 3477 }; 3478 3479 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing 3480 * qemu tlbs nor adjusting cached masks. 3481 */ 3482 static const ARMCPRegInfo ttbcr2_reginfo = { 3483 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 3484 .access = PL1_RW, .type = ARM_CP_ALIAS, 3485 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 3486 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) }, 3487 }; 3488 3489 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 3490 uint64_t value) 3491 { 3492 env->cp15.c15_ticonfig = value & 0xe7; 3493 /* The OS_TYPE bit in this register changes the reported CPUID! */ 3494 env->cp15.c0_cpuid = (value & (1 << 5)) ? 3495 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 3496 } 3497 3498 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 3499 uint64_t value) 3500 { 3501 env->cp15.c15_threadid = value & 0xffff; 3502 } 3503 3504 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 3505 uint64_t value) 3506 { 3507 /* Wait-for-interrupt (deprecated) */ 3508 cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT); 3509 } 3510 3511 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 3512 uint64_t value) 3513 { 3514 /* On OMAP there are registers indicating the max/min index of dcache lines 3515 * containing a dirty line; cache flush operations have to reset these. 3516 */ 3517 env->cp15.c15_i_max = 0x000; 3518 env->cp15.c15_i_min = 0xff0; 3519 } 3520 3521 static const ARMCPRegInfo omap_cp_reginfo[] = { 3522 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 3523 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 3524 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 3525 .resetvalue = 0, }, 3526 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 3527 .access = PL1_RW, .type = ARM_CP_NOP }, 3528 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 3529 .access = PL1_RW, 3530 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 3531 .writefn = omap_ticonfig_write }, 3532 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 3533 .access = PL1_RW, 3534 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 3535 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 3536 .access = PL1_RW, .resetvalue = 0xff0, 3537 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 3538 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 3539 .access = PL1_RW, 3540 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 3541 .writefn = omap_threadid_write }, 3542 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 3543 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3544 .type = ARM_CP_NO_RAW, 3545 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 3546 /* TODO: Peripheral port remap register: 3547 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 3548 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 3549 * when MMU is off. 3550 */ 3551 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 3552 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 3553 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 3554 .writefn = omap_cachemaint_write }, 3555 { .name = "C9", .cp = 15, .crn = 9, 3556 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 3557 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 3558 REGINFO_SENTINEL 3559 }; 3560 3561 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3562 uint64_t value) 3563 { 3564 env->cp15.c15_cpar = value & 0x3fff; 3565 } 3566 3567 static const ARMCPRegInfo xscale_cp_reginfo[] = { 3568 { .name = "XSCALE_CPAR", 3569 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3570 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 3571 .writefn = xscale_cpar_write, }, 3572 { .name = "XSCALE_AUXCR", 3573 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 3574 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 3575 .resetvalue = 0, }, 3576 /* XScale specific cache-lockdown: since we have no cache we NOP these 3577 * and hope the guest does not really rely on cache behaviour. 3578 */ 3579 { .name = "XSCALE_LOCK_ICACHE_LINE", 3580 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 3581 .access = PL1_W, .type = ARM_CP_NOP }, 3582 { .name = "XSCALE_UNLOCK_ICACHE", 3583 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 3584 .access = PL1_W, .type = ARM_CP_NOP }, 3585 { .name = "XSCALE_DCACHE_LOCK", 3586 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 3587 .access = PL1_RW, .type = ARM_CP_NOP }, 3588 { .name = "XSCALE_UNLOCK_DCACHE", 3589 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 3590 .access = PL1_W, .type = ARM_CP_NOP }, 3591 REGINFO_SENTINEL 3592 }; 3593 3594 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 3595 /* RAZ/WI the whole crn=15 space, when we don't have a more specific 3596 * implementation of this implementation-defined space. 3597 * Ideally this should eventually disappear in favour of actually 3598 * implementing the correct behaviour for all cores. 3599 */ 3600 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 3601 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3602 .access = PL1_RW, 3603 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 3604 .resetvalue = 0 }, 3605 REGINFO_SENTINEL 3606 }; 3607 3608 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 3609 /* Cache status: RAZ because we have no cache so it's always clean */ 3610 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 3611 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3612 .resetvalue = 0 }, 3613 REGINFO_SENTINEL 3614 }; 3615 3616 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 3617 /* We never have a a block transfer operation in progress */ 3618 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 3619 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3620 .resetvalue = 0 }, 3621 /* The cache ops themselves: these all NOP for QEMU */ 3622 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 3623 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3624 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 3625 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3626 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 3627 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3628 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 3629 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3630 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 3631 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3632 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 3633 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3634 REGINFO_SENTINEL 3635 }; 3636 3637 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 3638 /* The cache test-and-clean instructions always return (1 << 30) 3639 * to indicate that there are no dirty cache lines. 3640 */ 3641 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 3642 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3643 .resetvalue = (1 << 30) }, 3644 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 3645 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3646 .resetvalue = (1 << 30) }, 3647 REGINFO_SENTINEL 3648 }; 3649 3650 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 3651 /* Ignore ReadBuffer accesses */ 3652 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 3653 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3654 .access = PL1_RW, .resetvalue = 0, 3655 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 3656 REGINFO_SENTINEL 3657 }; 3658 3659 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3660 { 3661 ARMCPU *cpu = env_archcpu(env); 3662 unsigned int cur_el = arm_current_el(env); 3663 bool secure = arm_is_secure(env); 3664 3665 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3666 return env->cp15.vpidr_el2; 3667 } 3668 return raw_read(env, ri); 3669 } 3670 3671 static uint64_t mpidr_read_val(CPUARMState *env) 3672 { 3673 ARMCPU *cpu = env_archcpu(env); 3674 uint64_t mpidr = cpu->mp_affinity; 3675 3676 if (arm_feature(env, ARM_FEATURE_V7MP)) { 3677 mpidr |= (1U << 31); 3678 /* Cores which are uniprocessor (non-coherent) 3679 * but still implement the MP extensions set 3680 * bit 30. (For instance, Cortex-R5). 3681 */ 3682 if (cpu->mp_is_up) { 3683 mpidr |= (1u << 30); 3684 } 3685 } 3686 return mpidr; 3687 } 3688 3689 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3690 { 3691 unsigned int cur_el = arm_current_el(env); 3692 bool secure = arm_is_secure(env); 3693 3694 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3695 return env->cp15.vmpidr_el2; 3696 } 3697 return mpidr_read_val(env); 3698 } 3699 3700 static const ARMCPRegInfo lpae_cp_reginfo[] = { 3701 /* NOP AMAIR0/1 */ 3702 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 3703 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 3704 .access = PL1_RW, .type = ARM_CP_CONST, 3705 .resetvalue = 0 }, 3706 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 3707 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 3708 .access = PL1_RW, .type = ARM_CP_CONST, 3709 .resetvalue = 0 }, 3710 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 3711 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 3712 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 3713 offsetof(CPUARMState, cp15.par_ns)} }, 3714 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 3715 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3716 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3717 offsetof(CPUARMState, cp15.ttbr0_ns) }, 3718 .writefn = vmsa_ttbr_write, }, 3719 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 3720 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3721 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3722 offsetof(CPUARMState, cp15.ttbr1_ns) }, 3723 .writefn = vmsa_ttbr_write, }, 3724 REGINFO_SENTINEL 3725 }; 3726 3727 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3728 { 3729 return vfp_get_fpcr(env); 3730 } 3731 3732 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3733 uint64_t value) 3734 { 3735 vfp_set_fpcr(env, value); 3736 } 3737 3738 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3739 { 3740 return vfp_get_fpsr(env); 3741 } 3742 3743 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3744 uint64_t value) 3745 { 3746 vfp_set_fpsr(env, value); 3747 } 3748 3749 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 3750 bool isread) 3751 { 3752 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) { 3753 return CP_ACCESS_TRAP; 3754 } 3755 return CP_ACCESS_OK; 3756 } 3757 3758 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 3759 uint64_t value) 3760 { 3761 env->daif = value & PSTATE_DAIF; 3762 } 3763 3764 static CPAccessResult aa64_cacheop_access(CPUARMState *env, 3765 const ARMCPRegInfo *ri, 3766 bool isread) 3767 { 3768 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless 3769 * SCTLR_EL1.UCI is set. 3770 */ 3771 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) { 3772 return CP_ACCESS_TRAP; 3773 } 3774 return CP_ACCESS_OK; 3775 } 3776 3777 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 3778 * Page D4-1736 (DDI0487A.b) 3779 */ 3780 3781 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3782 uint64_t value) 3783 { 3784 CPUState *cs = env_cpu(env); 3785 bool sec = arm_is_secure_below_el3(env); 3786 3787 if (sec) { 3788 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3789 ARMMMUIdxBit_S1SE1 | 3790 ARMMMUIdxBit_S1SE0); 3791 } else { 3792 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3793 ARMMMUIdxBit_S12NSE1 | 3794 ARMMMUIdxBit_S12NSE0); 3795 } 3796 } 3797 3798 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3799 uint64_t value) 3800 { 3801 CPUState *cs = env_cpu(env); 3802 3803 if (tlb_force_broadcast(env)) { 3804 tlbi_aa64_vmalle1is_write(env, NULL, value); 3805 return; 3806 } 3807 3808 if (arm_is_secure_below_el3(env)) { 3809 tlb_flush_by_mmuidx(cs, 3810 ARMMMUIdxBit_S1SE1 | 3811 ARMMMUIdxBit_S1SE0); 3812 } else { 3813 tlb_flush_by_mmuidx(cs, 3814 ARMMMUIdxBit_S12NSE1 | 3815 ARMMMUIdxBit_S12NSE0); 3816 } 3817 } 3818 3819 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3820 uint64_t value) 3821 { 3822 /* Note that the 'ALL' scope must invalidate both stage 1 and 3823 * stage 2 translations, whereas most other scopes only invalidate 3824 * stage 1 translations. 3825 */ 3826 ARMCPU *cpu = env_archcpu(env); 3827 CPUState *cs = CPU(cpu); 3828 3829 if (arm_is_secure_below_el3(env)) { 3830 tlb_flush_by_mmuidx(cs, 3831 ARMMMUIdxBit_S1SE1 | 3832 ARMMMUIdxBit_S1SE0); 3833 } else { 3834 if (arm_feature(env, ARM_FEATURE_EL2)) { 3835 tlb_flush_by_mmuidx(cs, 3836 ARMMMUIdxBit_S12NSE1 | 3837 ARMMMUIdxBit_S12NSE0 | 3838 ARMMMUIdxBit_S2NS); 3839 } else { 3840 tlb_flush_by_mmuidx(cs, 3841 ARMMMUIdxBit_S12NSE1 | 3842 ARMMMUIdxBit_S12NSE0); 3843 } 3844 } 3845 } 3846 3847 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3848 uint64_t value) 3849 { 3850 ARMCPU *cpu = env_archcpu(env); 3851 CPUState *cs = CPU(cpu); 3852 3853 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 3854 } 3855 3856 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3857 uint64_t value) 3858 { 3859 ARMCPU *cpu = env_archcpu(env); 3860 CPUState *cs = CPU(cpu); 3861 3862 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3); 3863 } 3864 3865 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3866 uint64_t value) 3867 { 3868 /* Note that the 'ALL' scope must invalidate both stage 1 and 3869 * stage 2 translations, whereas most other scopes only invalidate 3870 * stage 1 translations. 3871 */ 3872 CPUState *cs = env_cpu(env); 3873 bool sec = arm_is_secure_below_el3(env); 3874 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2); 3875 3876 if (sec) { 3877 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3878 ARMMMUIdxBit_S1SE1 | 3879 ARMMMUIdxBit_S1SE0); 3880 } else if (has_el2) { 3881 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3882 ARMMMUIdxBit_S12NSE1 | 3883 ARMMMUIdxBit_S12NSE0 | 3884 ARMMMUIdxBit_S2NS); 3885 } else { 3886 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3887 ARMMMUIdxBit_S12NSE1 | 3888 ARMMMUIdxBit_S12NSE0); 3889 } 3890 } 3891 3892 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3893 uint64_t value) 3894 { 3895 CPUState *cs = env_cpu(env); 3896 3897 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 3898 } 3899 3900 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3901 uint64_t value) 3902 { 3903 CPUState *cs = env_cpu(env); 3904 3905 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3); 3906 } 3907 3908 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3909 uint64_t value) 3910 { 3911 /* Invalidate by VA, EL2 3912 * Currently handles both VAE2 and VALE2, since we don't support 3913 * flush-last-level-only. 3914 */ 3915 ARMCPU *cpu = env_archcpu(env); 3916 CPUState *cs = CPU(cpu); 3917 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3918 3919 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 3920 } 3921 3922 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3923 uint64_t value) 3924 { 3925 /* Invalidate by VA, EL3 3926 * Currently handles both VAE3 and VALE3, since we don't support 3927 * flush-last-level-only. 3928 */ 3929 ARMCPU *cpu = env_archcpu(env); 3930 CPUState *cs = CPU(cpu); 3931 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3932 3933 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3); 3934 } 3935 3936 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3937 uint64_t value) 3938 { 3939 ARMCPU *cpu = env_archcpu(env); 3940 CPUState *cs = CPU(cpu); 3941 bool sec = arm_is_secure_below_el3(env); 3942 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3943 3944 if (sec) { 3945 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3946 ARMMMUIdxBit_S1SE1 | 3947 ARMMMUIdxBit_S1SE0); 3948 } else { 3949 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3950 ARMMMUIdxBit_S12NSE1 | 3951 ARMMMUIdxBit_S12NSE0); 3952 } 3953 } 3954 3955 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3956 uint64_t value) 3957 { 3958 /* Invalidate by VA, EL1&0 (AArch64 version). 3959 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 3960 * since we don't support flush-for-specific-ASID-only or 3961 * flush-last-level-only. 3962 */ 3963 ARMCPU *cpu = env_archcpu(env); 3964 CPUState *cs = CPU(cpu); 3965 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3966 3967 if (tlb_force_broadcast(env)) { 3968 tlbi_aa64_vae1is_write(env, NULL, value); 3969 return; 3970 } 3971 3972 if (arm_is_secure_below_el3(env)) { 3973 tlb_flush_page_by_mmuidx(cs, pageaddr, 3974 ARMMMUIdxBit_S1SE1 | 3975 ARMMMUIdxBit_S1SE0); 3976 } else { 3977 tlb_flush_page_by_mmuidx(cs, pageaddr, 3978 ARMMMUIdxBit_S12NSE1 | 3979 ARMMMUIdxBit_S12NSE0); 3980 } 3981 } 3982 3983 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3984 uint64_t value) 3985 { 3986 CPUState *cs = env_cpu(env); 3987 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3988 3989 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3990 ARMMMUIdxBit_S1E2); 3991 } 3992 3993 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3994 uint64_t value) 3995 { 3996 CPUState *cs = env_cpu(env); 3997 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3998 3999 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4000 ARMMMUIdxBit_S1E3); 4001 } 4002 4003 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4004 uint64_t value) 4005 { 4006 /* Invalidate by IPA. This has to invalidate any structures that 4007 * contain only stage 2 translation information, but does not need 4008 * to apply to structures that contain combined stage 1 and stage 2 4009 * translation information. 4010 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 4011 */ 4012 ARMCPU *cpu = env_archcpu(env); 4013 CPUState *cs = CPU(cpu); 4014 uint64_t pageaddr; 4015 4016 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 4017 return; 4018 } 4019 4020 pageaddr = sextract64(value << 12, 0, 48); 4021 4022 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 4023 } 4024 4025 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4026 uint64_t value) 4027 { 4028 CPUState *cs = env_cpu(env); 4029 uint64_t pageaddr; 4030 4031 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 4032 return; 4033 } 4034 4035 pageaddr = sextract64(value << 12, 0, 48); 4036 4037 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4038 ARMMMUIdxBit_S2NS); 4039 } 4040 4041 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 4042 bool isread) 4043 { 4044 /* We don't implement EL2, so the only control on DC ZVA is the 4045 * bit in the SCTLR which can prohibit access for EL0. 4046 */ 4047 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 4048 return CP_ACCESS_TRAP; 4049 } 4050 return CP_ACCESS_OK; 4051 } 4052 4053 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 4054 { 4055 ARMCPU *cpu = env_archcpu(env); 4056 int dzp_bit = 1 << 4; 4057 4058 /* DZP indicates whether DC ZVA access is allowed */ 4059 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 4060 dzp_bit = 0; 4061 } 4062 return cpu->dcz_blocksize | dzp_bit; 4063 } 4064 4065 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 4066 bool isread) 4067 { 4068 if (!(env->pstate & PSTATE_SP)) { 4069 /* Access to SP_EL0 is undefined if it's being used as 4070 * the stack pointer. 4071 */ 4072 return CP_ACCESS_TRAP_UNCATEGORIZED; 4073 } 4074 return CP_ACCESS_OK; 4075 } 4076 4077 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 4078 { 4079 return env->pstate & PSTATE_SP; 4080 } 4081 4082 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 4083 { 4084 update_spsel(env, val); 4085 } 4086 4087 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4088 uint64_t value) 4089 { 4090 ARMCPU *cpu = env_archcpu(env); 4091 4092 if (raw_read(env, ri) == value) { 4093 /* Skip the TLB flush if nothing actually changed; Linux likes 4094 * to do a lot of pointless SCTLR writes. 4095 */ 4096 return; 4097 } 4098 4099 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 4100 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 4101 value &= ~SCTLR_M; 4102 } 4103 4104 raw_write(env, ri, value); 4105 /* ??? Lots of these bits are not implemented. */ 4106 /* This may enable/disable the MMU, so do a TLB flush. */ 4107 tlb_flush(CPU(cpu)); 4108 } 4109 4110 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri, 4111 bool isread) 4112 { 4113 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) { 4114 return CP_ACCESS_TRAP_FP_EL2; 4115 } 4116 if (env->cp15.cptr_el[3] & CPTR_TFP) { 4117 return CP_ACCESS_TRAP_FP_EL3; 4118 } 4119 return CP_ACCESS_OK; 4120 } 4121 4122 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4123 uint64_t value) 4124 { 4125 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK; 4126 } 4127 4128 static const ARMCPRegInfo v8_cp_reginfo[] = { 4129 /* Minimal set of EL0-visible registers. This will need to be expanded 4130 * significantly for system emulation of AArch64 CPUs. 4131 */ 4132 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 4133 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 4134 .access = PL0_RW, .type = ARM_CP_NZCV }, 4135 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 4136 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 4137 .type = ARM_CP_NO_RAW, 4138 .access = PL0_RW, .accessfn = aa64_daif_access, 4139 .fieldoffset = offsetof(CPUARMState, daif), 4140 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 4141 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 4142 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 4143 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4144 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 4145 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 4146 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 4147 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4148 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 4149 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 4150 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 4151 .access = PL0_R, .type = ARM_CP_NO_RAW, 4152 .readfn = aa64_dczid_read }, 4153 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 4154 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 4155 .access = PL0_W, .type = ARM_CP_DC_ZVA, 4156 #ifndef CONFIG_USER_ONLY 4157 /* Avoid overhead of an access check that always passes in user-mode */ 4158 .accessfn = aa64_zva_access, 4159 #endif 4160 }, 4161 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 4162 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 4163 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 4164 /* Cache ops: all NOPs since we don't emulate caches */ 4165 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 4166 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4167 .access = PL1_W, .type = ARM_CP_NOP }, 4168 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 4169 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4170 .access = PL1_W, .type = ARM_CP_NOP }, 4171 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 4172 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 4173 .access = PL0_W, .type = ARM_CP_NOP, 4174 .accessfn = aa64_cacheop_access }, 4175 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 4176 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4177 .access = PL1_W, .type = ARM_CP_NOP }, 4178 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 4179 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4180 .access = PL1_W, .type = ARM_CP_NOP }, 4181 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 4182 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 4183 .access = PL0_W, .type = ARM_CP_NOP, 4184 .accessfn = aa64_cacheop_access }, 4185 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 4186 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4187 .access = PL1_W, .type = ARM_CP_NOP }, 4188 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 4189 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 4190 .access = PL0_W, .type = ARM_CP_NOP, 4191 .accessfn = aa64_cacheop_access }, 4192 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 4193 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 4194 .access = PL0_W, .type = ARM_CP_NOP, 4195 .accessfn = aa64_cacheop_access }, 4196 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 4197 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4198 .access = PL1_W, .type = ARM_CP_NOP }, 4199 /* TLBI operations */ 4200 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 4201 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 4202 .access = PL1_W, .type = ARM_CP_NO_RAW, 4203 .writefn = tlbi_aa64_vmalle1is_write }, 4204 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 4205 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 4206 .access = PL1_W, .type = ARM_CP_NO_RAW, 4207 .writefn = tlbi_aa64_vae1is_write }, 4208 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 4209 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 4210 .access = PL1_W, .type = ARM_CP_NO_RAW, 4211 .writefn = tlbi_aa64_vmalle1is_write }, 4212 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 4213 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 4214 .access = PL1_W, .type = ARM_CP_NO_RAW, 4215 .writefn = tlbi_aa64_vae1is_write }, 4216 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 4217 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4218 .access = PL1_W, .type = ARM_CP_NO_RAW, 4219 .writefn = tlbi_aa64_vae1is_write }, 4220 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 4221 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4222 .access = PL1_W, .type = ARM_CP_NO_RAW, 4223 .writefn = tlbi_aa64_vae1is_write }, 4224 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 4225 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 4226 .access = PL1_W, .type = ARM_CP_NO_RAW, 4227 .writefn = tlbi_aa64_vmalle1_write }, 4228 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 4229 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 4230 .access = PL1_W, .type = ARM_CP_NO_RAW, 4231 .writefn = tlbi_aa64_vae1_write }, 4232 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 4233 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 4234 .access = PL1_W, .type = ARM_CP_NO_RAW, 4235 .writefn = tlbi_aa64_vmalle1_write }, 4236 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 4237 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 4238 .access = PL1_W, .type = ARM_CP_NO_RAW, 4239 .writefn = tlbi_aa64_vae1_write }, 4240 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 4241 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4242 .access = PL1_W, .type = ARM_CP_NO_RAW, 4243 .writefn = tlbi_aa64_vae1_write }, 4244 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 4245 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4246 .access = PL1_W, .type = ARM_CP_NO_RAW, 4247 .writefn = tlbi_aa64_vae1_write }, 4248 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 4249 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4250 .access = PL2_W, .type = ARM_CP_NO_RAW, 4251 .writefn = tlbi_aa64_ipas2e1is_write }, 4252 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 4253 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4254 .access = PL2_W, .type = ARM_CP_NO_RAW, 4255 .writefn = tlbi_aa64_ipas2e1is_write }, 4256 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 4257 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4258 .access = PL2_W, .type = ARM_CP_NO_RAW, 4259 .writefn = tlbi_aa64_alle1is_write }, 4260 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 4261 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 4262 .access = PL2_W, .type = ARM_CP_NO_RAW, 4263 .writefn = tlbi_aa64_alle1is_write }, 4264 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 4265 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4266 .access = PL2_W, .type = ARM_CP_NO_RAW, 4267 .writefn = tlbi_aa64_ipas2e1_write }, 4268 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 4269 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4270 .access = PL2_W, .type = ARM_CP_NO_RAW, 4271 .writefn = tlbi_aa64_ipas2e1_write }, 4272 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 4273 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4274 .access = PL2_W, .type = ARM_CP_NO_RAW, 4275 .writefn = tlbi_aa64_alle1_write }, 4276 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 4277 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 4278 .access = PL2_W, .type = ARM_CP_NO_RAW, 4279 .writefn = tlbi_aa64_alle1is_write }, 4280 #ifndef CONFIG_USER_ONLY 4281 /* 64 bit address translation operations */ 4282 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 4283 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 4284 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4285 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 4286 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 4287 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4288 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 4289 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 4290 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4291 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 4292 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 4293 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4294 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 4295 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 4296 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4297 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 4298 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 4299 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4300 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 4301 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 4302 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4303 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 4304 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 4305 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4306 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 4307 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 4308 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 4309 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4310 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 4311 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 4312 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4313 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 4314 .type = ARM_CP_ALIAS, 4315 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 4316 .access = PL1_RW, .resetvalue = 0, 4317 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 4318 .writefn = par_write }, 4319 #endif 4320 /* TLB invalidate last level of translation table walk */ 4321 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4322 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 4323 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4324 .type = ARM_CP_NO_RAW, .access = PL1_W, 4325 .writefn = tlbimvaa_is_write }, 4326 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4327 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 4328 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4329 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 4330 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4331 .type = ARM_CP_NO_RAW, .access = PL2_W, 4332 .writefn = tlbimva_hyp_write }, 4333 { .name = "TLBIMVALHIS", 4334 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4335 .type = ARM_CP_NO_RAW, .access = PL2_W, 4336 .writefn = tlbimva_hyp_is_write }, 4337 { .name = "TLBIIPAS2", 4338 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4339 .type = ARM_CP_NO_RAW, .access = PL2_W, 4340 .writefn = tlbiipas2_write }, 4341 { .name = "TLBIIPAS2IS", 4342 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4343 .type = ARM_CP_NO_RAW, .access = PL2_W, 4344 .writefn = tlbiipas2_is_write }, 4345 { .name = "TLBIIPAS2L", 4346 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4347 .type = ARM_CP_NO_RAW, .access = PL2_W, 4348 .writefn = tlbiipas2_write }, 4349 { .name = "TLBIIPAS2LIS", 4350 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4351 .type = ARM_CP_NO_RAW, .access = PL2_W, 4352 .writefn = tlbiipas2_is_write }, 4353 /* 32 bit cache operations */ 4354 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4355 .type = ARM_CP_NOP, .access = PL1_W }, 4356 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 4357 .type = ARM_CP_NOP, .access = PL1_W }, 4358 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4359 .type = ARM_CP_NOP, .access = PL1_W }, 4360 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 4361 .type = ARM_CP_NOP, .access = PL1_W }, 4362 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 4363 .type = ARM_CP_NOP, .access = PL1_W }, 4364 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 4365 .type = ARM_CP_NOP, .access = PL1_W }, 4366 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4367 .type = ARM_CP_NOP, .access = PL1_W }, 4368 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4369 .type = ARM_CP_NOP, .access = PL1_W }, 4370 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 4371 .type = ARM_CP_NOP, .access = PL1_W }, 4372 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4373 .type = ARM_CP_NOP, .access = PL1_W }, 4374 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 4375 .type = ARM_CP_NOP, .access = PL1_W }, 4376 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 4377 .type = ARM_CP_NOP, .access = PL1_W }, 4378 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4379 .type = ARM_CP_NOP, .access = PL1_W }, 4380 /* MMU Domain access control / MPU write buffer control */ 4381 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 4382 .access = PL1_RW, .resetvalue = 0, 4383 .writefn = dacr_write, .raw_writefn = raw_write, 4384 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 4385 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 4386 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 4387 .type = ARM_CP_ALIAS, 4388 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 4389 .access = PL1_RW, 4390 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 4391 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 4392 .type = ARM_CP_ALIAS, 4393 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 4394 .access = PL1_RW, 4395 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 4396 /* We rely on the access checks not allowing the guest to write to the 4397 * state field when SPSel indicates that it's being used as the stack 4398 * pointer. 4399 */ 4400 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 4401 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 4402 .access = PL1_RW, .accessfn = sp_el0_access, 4403 .type = ARM_CP_ALIAS, 4404 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 4405 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 4406 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 4407 .access = PL2_RW, .type = ARM_CP_ALIAS, 4408 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 4409 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 4410 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 4411 .type = ARM_CP_NO_RAW, 4412 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 4413 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 4414 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 4415 .type = ARM_CP_ALIAS, 4416 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]), 4417 .access = PL2_RW, .accessfn = fpexc32_access }, 4418 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 4419 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 4420 .access = PL2_RW, .resetvalue = 0, 4421 .writefn = dacr_write, .raw_writefn = raw_write, 4422 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 4423 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 4424 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 4425 .access = PL2_RW, .resetvalue = 0, 4426 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 4427 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 4428 .type = ARM_CP_ALIAS, 4429 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 4430 .access = PL2_RW, 4431 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 4432 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 4433 .type = ARM_CP_ALIAS, 4434 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 4435 .access = PL2_RW, 4436 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 4437 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 4438 .type = ARM_CP_ALIAS, 4439 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 4440 .access = PL2_RW, 4441 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 4442 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 4443 .type = ARM_CP_ALIAS, 4444 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 4445 .access = PL2_RW, 4446 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 4447 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 4448 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 4449 .resetvalue = 0, 4450 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 4451 { .name = "SDCR", .type = ARM_CP_ALIAS, 4452 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 4453 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4454 .writefn = sdcr_write, 4455 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 4456 REGINFO_SENTINEL 4457 }; 4458 4459 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */ 4460 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = { 4461 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4462 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4463 .access = PL2_RW, 4464 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore }, 4465 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH, 4466 .type = ARM_CP_NO_RAW, 4467 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4468 .access = PL2_RW, 4469 .type = ARM_CP_CONST, .resetvalue = 0 }, 4470 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 4471 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 4472 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4473 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4474 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4475 .access = PL2_RW, 4476 .type = ARM_CP_CONST, .resetvalue = 0 }, 4477 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4478 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4479 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4480 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4481 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4482 .access = PL2_RW, .type = ARM_CP_CONST, 4483 .resetvalue = 0 }, 4484 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4485 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4486 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4487 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4488 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4489 .access = PL2_RW, .type = ARM_CP_CONST, 4490 .resetvalue = 0 }, 4491 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4492 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4493 .access = PL2_RW, .type = ARM_CP_CONST, 4494 .resetvalue = 0 }, 4495 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4496 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4497 .access = PL2_RW, .type = ARM_CP_CONST, 4498 .resetvalue = 0 }, 4499 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4500 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4501 .access = PL2_RW, .type = ARM_CP_CONST, 4502 .resetvalue = 0 }, 4503 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4504 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4505 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4506 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH, 4507 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4508 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4509 .type = ARM_CP_CONST, .resetvalue = 0 }, 4510 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4511 .cp = 15, .opc1 = 6, .crm = 2, 4512 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4513 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 }, 4514 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4515 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4516 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4517 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4518 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4519 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4520 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4521 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4522 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4523 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4524 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4525 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4526 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4527 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4528 .resetvalue = 0 }, 4529 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4530 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4531 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4532 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4533 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4534 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4535 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4536 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4537 .resetvalue = 0 }, 4538 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4539 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4540 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4541 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4542 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4543 .resetvalue = 0 }, 4544 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4545 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4546 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4547 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4548 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4549 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4550 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4551 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4552 .access = PL2_RW, .accessfn = access_tda, 4553 .type = ARM_CP_CONST, .resetvalue = 0 }, 4554 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH, 4555 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4556 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4557 .type = ARM_CP_CONST, .resetvalue = 0 }, 4558 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4559 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4560 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4561 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4562 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4563 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4564 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4565 .type = ARM_CP_CONST, 4566 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4567 .access = PL2_RW, .resetvalue = 0 }, 4568 REGINFO_SENTINEL 4569 }; 4570 4571 /* Ditto, but for registers which exist in ARMv8 but not v7 */ 4572 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = { 4573 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4574 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4575 .access = PL2_RW, 4576 .type = ARM_CP_CONST, .resetvalue = 0 }, 4577 REGINFO_SENTINEL 4578 }; 4579 4580 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 4581 { 4582 ARMCPU *cpu = env_archcpu(env); 4583 uint64_t valid_mask = HCR_MASK; 4584 4585 if (arm_feature(env, ARM_FEATURE_EL3)) { 4586 valid_mask &= ~HCR_HCD; 4587 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 4588 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented. 4589 * However, if we're using the SMC PSCI conduit then QEMU is 4590 * effectively acting like EL3 firmware and so the guest at 4591 * EL2 should retain the ability to prevent EL1 from being 4592 * able to make SMC calls into the ersatz firmware, so in 4593 * that case HCR.TSC should be read/write. 4594 */ 4595 valid_mask &= ~HCR_TSC; 4596 } 4597 if (cpu_isar_feature(aa64_lor, cpu)) { 4598 valid_mask |= HCR_TLOR; 4599 } 4600 if (cpu_isar_feature(aa64_pauth, cpu)) { 4601 valid_mask |= HCR_API | HCR_APK; 4602 } 4603 4604 /* Clear RES0 bits. */ 4605 value &= valid_mask; 4606 4607 /* These bits change the MMU setup: 4608 * HCR_VM enables stage 2 translation 4609 * HCR_PTW forbids certain page-table setups 4610 * HCR_DC Disables stage1 and enables stage2 translation 4611 */ 4612 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) { 4613 tlb_flush(CPU(cpu)); 4614 } 4615 env->cp15.hcr_el2 = value; 4616 4617 /* 4618 * Updates to VI and VF require us to update the status of 4619 * virtual interrupts, which are the logical OR of these bits 4620 * and the state of the input lines from the GIC. (This requires 4621 * that we have the iothread lock, which is done by marking the 4622 * reginfo structs as ARM_CP_IO.) 4623 * Note that if a write to HCR pends a VIRQ or VFIQ it is never 4624 * possible for it to be taken immediately, because VIRQ and 4625 * VFIQ are masked unless running at EL0 or EL1, and HCR 4626 * can only be written at EL2. 4627 */ 4628 g_assert(qemu_mutex_iothread_locked()); 4629 arm_cpu_update_virq(cpu); 4630 arm_cpu_update_vfiq(cpu); 4631 } 4632 4633 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 4634 uint64_t value) 4635 { 4636 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 4637 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 4638 hcr_write(env, NULL, value); 4639 } 4640 4641 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 4642 uint64_t value) 4643 { 4644 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 4645 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 4646 hcr_write(env, NULL, value); 4647 } 4648 4649 /* 4650 * Return the effective value of HCR_EL2. 4651 * Bits that are not included here: 4652 * RW (read from SCR_EL3.RW as needed) 4653 */ 4654 uint64_t arm_hcr_el2_eff(CPUARMState *env) 4655 { 4656 uint64_t ret = env->cp15.hcr_el2; 4657 4658 if (arm_is_secure_below_el3(env)) { 4659 /* 4660 * "This register has no effect if EL2 is not enabled in the 4661 * current Security state". This is ARMv8.4-SecEL2 speak for 4662 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 4663 * 4664 * Prior to that, the language was "In an implementation that 4665 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 4666 * as if this field is 0 for all purposes other than a direct 4667 * read or write access of HCR_EL2". With lots of enumeration 4668 * on a per-field basis. In current QEMU, this is condition 4669 * is arm_is_secure_below_el3. 4670 * 4671 * Since the v8.4 language applies to the entire register, and 4672 * appears to be backward compatible, use that. 4673 */ 4674 ret = 0; 4675 } else if (ret & HCR_TGE) { 4676 /* These bits are up-to-date as of ARMv8.4. */ 4677 if (ret & HCR_E2H) { 4678 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 4679 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 4680 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 4681 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE); 4682 } else { 4683 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 4684 } 4685 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 4686 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 4687 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 4688 HCR_TLOR); 4689 } 4690 4691 return ret; 4692 } 4693 4694 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4695 uint64_t value) 4696 { 4697 /* 4698 * For A-profile AArch32 EL3, if NSACR.CP10 4699 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 4700 */ 4701 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 4702 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 4703 value &= ~(0x3 << 10); 4704 value |= env->cp15.cptr_el[2] & (0x3 << 10); 4705 } 4706 env->cp15.cptr_el[2] = value; 4707 } 4708 4709 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri) 4710 { 4711 /* 4712 * For A-profile AArch32 EL3, if NSACR.CP10 4713 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 4714 */ 4715 uint64_t value = env->cp15.cptr_el[2]; 4716 4717 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 4718 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 4719 value |= 0x3 << 10; 4720 } 4721 return value; 4722 } 4723 4724 static const ARMCPRegInfo el2_cp_reginfo[] = { 4725 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 4726 .type = ARM_CP_IO, 4727 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4728 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4729 .writefn = hcr_write }, 4730 { .name = "HCR", .state = ARM_CP_STATE_AA32, 4731 .type = ARM_CP_ALIAS | ARM_CP_IO, 4732 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4733 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4734 .writefn = hcr_writelow }, 4735 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 4736 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 4737 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4738 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 4739 .type = ARM_CP_ALIAS, 4740 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 4741 .access = PL2_RW, 4742 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 4743 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4744 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4745 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 4746 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4747 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4748 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 4749 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4750 .type = ARM_CP_ALIAS, 4751 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4752 .access = PL2_RW, 4753 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 4754 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 4755 .type = ARM_CP_ALIAS, 4756 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 4757 .access = PL2_RW, 4758 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 4759 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4760 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4761 .access = PL2_RW, .writefn = vbar_write, 4762 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 4763 .resetvalue = 0 }, 4764 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 4765 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 4766 .access = PL3_RW, .type = ARM_CP_ALIAS, 4767 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 4768 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4769 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4770 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 4771 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]), 4772 .readfn = cptr_el2_read, .writefn = cptr_el2_write }, 4773 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4774 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4775 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 4776 .resetvalue = 0 }, 4777 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4778 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4779 .access = PL2_RW, .type = ARM_CP_ALIAS, 4780 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 4781 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4782 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4783 .access = PL2_RW, .type = ARM_CP_CONST, 4784 .resetvalue = 0 }, 4785 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 4786 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4787 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4788 .access = PL2_RW, .type = ARM_CP_CONST, 4789 .resetvalue = 0 }, 4790 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4791 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4792 .access = PL2_RW, .type = ARM_CP_CONST, 4793 .resetvalue = 0 }, 4794 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4795 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4796 .access = PL2_RW, .type = ARM_CP_CONST, 4797 .resetvalue = 0 }, 4798 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4799 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4800 .access = PL2_RW, 4801 /* no .writefn needed as this can't cause an ASID change; 4802 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4803 */ 4804 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 4805 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 4806 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4807 .type = ARM_CP_ALIAS, 4808 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4809 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4810 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 4811 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4812 .access = PL2_RW, 4813 /* no .writefn needed as this can't cause an ASID change; 4814 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4815 */ 4816 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4817 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4818 .cp = 15, .opc1 = 6, .crm = 2, 4819 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4820 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4821 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 4822 .writefn = vttbr_write }, 4823 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4824 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4825 .access = PL2_RW, .writefn = vttbr_write, 4826 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 4827 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4828 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4829 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 4830 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 4831 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4832 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4833 .access = PL2_RW, .resetvalue = 0, 4834 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 4835 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4836 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4837 .access = PL2_RW, .resetvalue = 0, 4838 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4839 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4840 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4841 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4842 { .name = "TLBIALLNSNH", 4843 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4844 .type = ARM_CP_NO_RAW, .access = PL2_W, 4845 .writefn = tlbiall_nsnh_write }, 4846 { .name = "TLBIALLNSNHIS", 4847 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4848 .type = ARM_CP_NO_RAW, .access = PL2_W, 4849 .writefn = tlbiall_nsnh_is_write }, 4850 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4851 .type = ARM_CP_NO_RAW, .access = PL2_W, 4852 .writefn = tlbiall_hyp_write }, 4853 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4854 .type = ARM_CP_NO_RAW, .access = PL2_W, 4855 .writefn = tlbiall_hyp_is_write }, 4856 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4857 .type = ARM_CP_NO_RAW, .access = PL2_W, 4858 .writefn = tlbimva_hyp_write }, 4859 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4860 .type = ARM_CP_NO_RAW, .access = PL2_W, 4861 .writefn = tlbimva_hyp_is_write }, 4862 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 4863 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4864 .type = ARM_CP_NO_RAW, .access = PL2_W, 4865 .writefn = tlbi_aa64_alle2_write }, 4866 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 4867 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4868 .type = ARM_CP_NO_RAW, .access = PL2_W, 4869 .writefn = tlbi_aa64_vae2_write }, 4870 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 4871 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4872 .access = PL2_W, .type = ARM_CP_NO_RAW, 4873 .writefn = tlbi_aa64_vae2_write }, 4874 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 4875 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4876 .access = PL2_W, .type = ARM_CP_NO_RAW, 4877 .writefn = tlbi_aa64_alle2is_write }, 4878 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 4879 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4880 .type = ARM_CP_NO_RAW, .access = PL2_W, 4881 .writefn = tlbi_aa64_vae2is_write }, 4882 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 4883 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4884 .access = PL2_W, .type = ARM_CP_NO_RAW, 4885 .writefn = tlbi_aa64_vae2is_write }, 4886 #ifndef CONFIG_USER_ONLY 4887 /* Unlike the other EL2-related AT operations, these must 4888 * UNDEF from EL3 if EL2 is not implemented, which is why we 4889 * define them here rather than with the rest of the AT ops. 4890 */ 4891 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 4892 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4893 .access = PL2_W, .accessfn = at_s1e2_access, 4894 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4895 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 4896 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4897 .access = PL2_W, .accessfn = at_s1e2_access, 4898 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4899 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 4900 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 4901 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 4902 * to behave as if SCR.NS was 1. 4903 */ 4904 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4905 .access = PL2_W, 4906 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4907 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4908 .access = PL2_W, 4909 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4910 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4911 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4912 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 4913 * reset values as IMPDEF. We choose to reset to 3 to comply with 4914 * both ARMv7 and ARMv8. 4915 */ 4916 .access = PL2_RW, .resetvalue = 3, 4917 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 4918 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4919 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4920 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 4921 .writefn = gt_cntvoff_write, 4922 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4923 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4924 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 4925 .writefn = gt_cntvoff_write, 4926 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4927 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4928 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4929 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4930 .type = ARM_CP_IO, .access = PL2_RW, 4931 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4932 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4933 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4934 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 4935 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4936 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4937 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4938 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 4939 .resetfn = gt_hyp_timer_reset, 4940 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 4941 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4942 .type = ARM_CP_IO, 4943 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4944 .access = PL2_RW, 4945 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 4946 .resetvalue = 0, 4947 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 4948 #endif 4949 /* The only field of MDCR_EL2 that has a defined architectural reset value 4950 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we 4951 * don't implement any PMU event counters, so using zero as a reset 4952 * value for MDCR_EL2 is okay 4953 */ 4954 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4955 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4956 .access = PL2_RW, .resetvalue = 0, 4957 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), }, 4958 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 4959 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4960 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4961 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4962 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 4963 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4964 .access = PL2_RW, 4965 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4966 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4967 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4968 .access = PL2_RW, 4969 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 4970 REGINFO_SENTINEL 4971 }; 4972 4973 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 4974 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4975 .type = ARM_CP_ALIAS | ARM_CP_IO, 4976 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4977 .access = PL2_RW, 4978 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 4979 .writefn = hcr_writehigh }, 4980 REGINFO_SENTINEL 4981 }; 4982 4983 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 4984 bool isread) 4985 { 4986 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 4987 * At Secure EL1 it traps to EL3. 4988 */ 4989 if (arm_current_el(env) == 3) { 4990 return CP_ACCESS_OK; 4991 } 4992 if (arm_is_secure_below_el3(env)) { 4993 return CP_ACCESS_TRAP_EL3; 4994 } 4995 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 4996 if (isread) { 4997 return CP_ACCESS_OK; 4998 } 4999 return CP_ACCESS_TRAP_UNCATEGORIZED; 5000 } 5001 5002 static const ARMCPRegInfo el3_cp_reginfo[] = { 5003 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 5004 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 5005 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 5006 .resetvalue = 0, .writefn = scr_write }, 5007 { .name = "SCR", .type = ARM_CP_ALIAS, 5008 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 5009 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5010 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 5011 .writefn = scr_write }, 5012 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 5013 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 5014 .access = PL3_RW, .resetvalue = 0, 5015 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 5016 { .name = "SDER", 5017 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 5018 .access = PL3_RW, .resetvalue = 0, 5019 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 5020 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 5021 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5022 .writefn = vbar_write, .resetvalue = 0, 5023 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 5024 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 5025 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 5026 .access = PL3_RW, .resetvalue = 0, 5027 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 5028 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 5029 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 5030 .access = PL3_RW, 5031 /* no .writefn needed as this can't cause an ASID change; 5032 * we must provide a .raw_writefn and .resetfn because we handle 5033 * reset and migration for the AArch32 TTBCR(S), which might be 5034 * using mask and base_mask. 5035 */ 5036 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write, 5037 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 5038 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 5039 .type = ARM_CP_ALIAS, 5040 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 5041 .access = PL3_RW, 5042 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 5043 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 5044 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 5045 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 5046 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 5047 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 5048 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 5049 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 5050 .type = ARM_CP_ALIAS, 5051 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 5052 .access = PL3_RW, 5053 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 5054 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 5055 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 5056 .access = PL3_RW, .writefn = vbar_write, 5057 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 5058 .resetvalue = 0 }, 5059 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 5060 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 5061 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 5062 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 5063 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 5064 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 5065 .access = PL3_RW, .resetvalue = 0, 5066 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 5067 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 5068 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 5069 .access = PL3_RW, .type = ARM_CP_CONST, 5070 .resetvalue = 0 }, 5071 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 5072 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 5073 .access = PL3_RW, .type = ARM_CP_CONST, 5074 .resetvalue = 0 }, 5075 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 5076 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 5077 .access = PL3_RW, .type = ARM_CP_CONST, 5078 .resetvalue = 0 }, 5079 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 5080 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 5081 .access = PL3_W, .type = ARM_CP_NO_RAW, 5082 .writefn = tlbi_aa64_alle3is_write }, 5083 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 5084 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 5085 .access = PL3_W, .type = ARM_CP_NO_RAW, 5086 .writefn = tlbi_aa64_vae3is_write }, 5087 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 5088 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 5089 .access = PL3_W, .type = ARM_CP_NO_RAW, 5090 .writefn = tlbi_aa64_vae3is_write }, 5091 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 5092 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 5093 .access = PL3_W, .type = ARM_CP_NO_RAW, 5094 .writefn = tlbi_aa64_alle3_write }, 5095 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 5096 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 5097 .access = PL3_W, .type = ARM_CP_NO_RAW, 5098 .writefn = tlbi_aa64_vae3_write }, 5099 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 5100 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 5101 .access = PL3_W, .type = ARM_CP_NO_RAW, 5102 .writefn = tlbi_aa64_vae3_write }, 5103 REGINFO_SENTINEL 5104 }; 5105 5106 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 5107 bool isread) 5108 { 5109 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64, 5110 * but the AArch32 CTR has its own reginfo struct) 5111 */ 5112 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 5113 return CP_ACCESS_TRAP; 5114 } 5115 return CP_ACCESS_OK; 5116 } 5117 5118 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, 5119 uint64_t value) 5120 { 5121 /* Writes to OSLAR_EL1 may update the OS lock status, which can be 5122 * read via a bit in OSLSR_EL1. 5123 */ 5124 int oslock; 5125 5126 if (ri->state == ARM_CP_STATE_AA32) { 5127 oslock = (value == 0xC5ACCE55); 5128 } else { 5129 oslock = value & 1; 5130 } 5131 5132 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock); 5133 } 5134 5135 static const ARMCPRegInfo debug_cp_reginfo[] = { 5136 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped 5137 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; 5138 * unlike DBGDRAR it is never accessible from EL0. 5139 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64 5140 * accessor. 5141 */ 5142 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, 5143 .access = PL0_R, .accessfn = access_tdra, 5144 .type = ARM_CP_CONST, .resetvalue = 0 }, 5145 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, 5146 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 5147 .access = PL1_R, .accessfn = access_tdra, 5148 .type = ARM_CP_CONST, .resetvalue = 0 }, 5149 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 5150 .access = PL0_R, .accessfn = access_tdra, 5151 .type = ARM_CP_CONST, .resetvalue = 0 }, 5152 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ 5153 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, 5154 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5155 .access = PL1_RW, .accessfn = access_tda, 5156 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), 5157 .resetvalue = 0 }, 5158 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1. 5159 * We don't implement the configurable EL0 access. 5160 */ 5161 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH, 5162 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5163 .type = ARM_CP_ALIAS, 5164 .access = PL1_R, .accessfn = access_tda, 5165 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, 5166 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, 5167 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, 5168 .access = PL1_W, .type = ARM_CP_NO_RAW, 5169 .accessfn = access_tdosa, 5170 .writefn = oslar_write }, 5171 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, 5172 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, 5173 .access = PL1_R, .resetvalue = 10, 5174 .accessfn = access_tdosa, 5175 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, 5176 /* Dummy OSDLR_EL1: 32-bit Linux will read this */ 5177 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, 5178 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, 5179 .access = PL1_RW, .accessfn = access_tdosa, 5180 .type = ARM_CP_NOP }, 5181 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't 5182 * implement vector catch debug events yet. 5183 */ 5184 { .name = "DBGVCR", 5185 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 5186 .access = PL1_RW, .accessfn = access_tda, 5187 .type = ARM_CP_NOP }, 5188 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor 5189 * to save and restore a 32-bit guest's DBGVCR) 5190 */ 5191 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64, 5192 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0, 5193 .access = PL2_RW, .accessfn = access_tda, 5194 .type = ARM_CP_NOP }, 5195 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications 5196 * Channel but Linux may try to access this register. The 32-bit 5197 * alias is DBGDCCINT. 5198 */ 5199 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH, 5200 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5201 .access = PL1_RW, .accessfn = access_tda, 5202 .type = ARM_CP_NOP }, 5203 REGINFO_SENTINEL 5204 }; 5205 5206 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = { 5207 /* 64 bit access versions of the (dummy) debug registers */ 5208 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0, 5209 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5210 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0, 5211 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5212 REGINFO_SENTINEL 5213 }; 5214 5215 /* Return the exception level to which exceptions should be taken 5216 * via SVEAccessTrap. If an exception should be routed through 5217 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should 5218 * take care of raising that exception. 5219 * C.f. the ARM pseudocode function CheckSVEEnabled. 5220 */ 5221 int sve_exception_el(CPUARMState *env, int el) 5222 { 5223 #ifndef CONFIG_USER_ONLY 5224 if (el <= 1) { 5225 bool disabled = false; 5226 5227 /* The CPACR.ZEN controls traps to EL1: 5228 * 0, 2 : trap EL0 and EL1 accesses 5229 * 1 : trap only EL0 accesses 5230 * 3 : trap no accesses 5231 */ 5232 if (!extract32(env->cp15.cpacr_el1, 16, 1)) { 5233 disabled = true; 5234 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) { 5235 disabled = el == 0; 5236 } 5237 if (disabled) { 5238 /* route_to_el2 */ 5239 return (arm_feature(env, ARM_FEATURE_EL2) 5240 && (arm_hcr_el2_eff(env) & HCR_TGE) ? 2 : 1); 5241 } 5242 5243 /* Check CPACR.FPEN. */ 5244 if (!extract32(env->cp15.cpacr_el1, 20, 1)) { 5245 disabled = true; 5246 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) { 5247 disabled = el == 0; 5248 } 5249 if (disabled) { 5250 return 0; 5251 } 5252 } 5253 5254 /* CPTR_EL2. Since TZ and TFP are positive, 5255 * they will be zero when EL2 is not present. 5256 */ 5257 if (el <= 2 && !arm_is_secure_below_el3(env)) { 5258 if (env->cp15.cptr_el[2] & CPTR_TZ) { 5259 return 2; 5260 } 5261 if (env->cp15.cptr_el[2] & CPTR_TFP) { 5262 return 0; 5263 } 5264 } 5265 5266 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 5267 if (arm_feature(env, ARM_FEATURE_EL3) 5268 && !(env->cp15.cptr_el[3] & CPTR_EZ)) { 5269 return 3; 5270 } 5271 #endif 5272 return 0; 5273 } 5274 5275 /* 5276 * Given that SVE is enabled, return the vector length for EL. 5277 */ 5278 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) 5279 { 5280 ARMCPU *cpu = env_archcpu(env); 5281 uint32_t zcr_len = cpu->sve_max_vq - 1; 5282 5283 if (el <= 1) { 5284 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]); 5285 } 5286 if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) { 5287 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]); 5288 } 5289 if (arm_feature(env, ARM_FEATURE_EL3)) { 5290 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); 5291 } 5292 return zcr_len; 5293 } 5294 5295 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5296 uint64_t value) 5297 { 5298 int cur_el = arm_current_el(env); 5299 int old_len = sve_zcr_len_for_el(env, cur_el); 5300 int new_len; 5301 5302 /* Bits other than [3:0] are RAZ/WI. */ 5303 raw_write(env, ri, value & 0xf); 5304 5305 /* 5306 * Because we arrived here, we know both FP and SVE are enabled; 5307 * otherwise we would have trapped access to the ZCR_ELn register. 5308 */ 5309 new_len = sve_zcr_len_for_el(env, cur_el); 5310 if (new_len < old_len) { 5311 aarch64_sve_narrow_vq(env, new_len + 1); 5312 } 5313 } 5314 5315 static const ARMCPRegInfo zcr_el1_reginfo = { 5316 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 5317 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 5318 .access = PL1_RW, .type = ARM_CP_SVE, 5319 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 5320 .writefn = zcr_write, .raw_writefn = raw_write 5321 }; 5322 5323 static const ARMCPRegInfo zcr_el2_reginfo = { 5324 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5325 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5326 .access = PL2_RW, .type = ARM_CP_SVE, 5327 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 5328 .writefn = zcr_write, .raw_writefn = raw_write 5329 }; 5330 5331 static const ARMCPRegInfo zcr_no_el2_reginfo = { 5332 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5333 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5334 .access = PL2_RW, .type = ARM_CP_SVE, 5335 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore 5336 }; 5337 5338 static const ARMCPRegInfo zcr_el3_reginfo = { 5339 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 5340 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 5341 .access = PL3_RW, .type = ARM_CP_SVE, 5342 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 5343 .writefn = zcr_write, .raw_writefn = raw_write 5344 }; 5345 5346 void hw_watchpoint_update(ARMCPU *cpu, int n) 5347 { 5348 CPUARMState *env = &cpu->env; 5349 vaddr len = 0; 5350 vaddr wvr = env->cp15.dbgwvr[n]; 5351 uint64_t wcr = env->cp15.dbgwcr[n]; 5352 int mask; 5353 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 5354 5355 if (env->cpu_watchpoint[n]) { 5356 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); 5357 env->cpu_watchpoint[n] = NULL; 5358 } 5359 5360 if (!extract64(wcr, 0, 1)) { 5361 /* E bit clear : watchpoint disabled */ 5362 return; 5363 } 5364 5365 switch (extract64(wcr, 3, 2)) { 5366 case 0: 5367 /* LSC 00 is reserved and must behave as if the wp is disabled */ 5368 return; 5369 case 1: 5370 flags |= BP_MEM_READ; 5371 break; 5372 case 2: 5373 flags |= BP_MEM_WRITE; 5374 break; 5375 case 3: 5376 flags |= BP_MEM_ACCESS; 5377 break; 5378 } 5379 5380 /* Attempts to use both MASK and BAS fields simultaneously are 5381 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, 5382 * thus generating a watchpoint for every byte in the masked region. 5383 */ 5384 mask = extract64(wcr, 24, 4); 5385 if (mask == 1 || mask == 2) { 5386 /* Reserved values of MASK; we must act as if the mask value was 5387 * some non-reserved value, or as if the watchpoint were disabled. 5388 * We choose the latter. 5389 */ 5390 return; 5391 } else if (mask) { 5392 /* Watchpoint covers an aligned area up to 2GB in size */ 5393 len = 1ULL << mask; 5394 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE 5395 * whether the watchpoint fires when the unmasked bits match; we opt 5396 * to generate the exceptions. 5397 */ 5398 wvr &= ~(len - 1); 5399 } else { 5400 /* Watchpoint covers bytes defined by the byte address select bits */ 5401 int bas = extract64(wcr, 5, 8); 5402 int basstart; 5403 5404 if (bas == 0) { 5405 /* This must act as if the watchpoint is disabled */ 5406 return; 5407 } 5408 5409 if (extract64(wvr, 2, 1)) { 5410 /* Deprecated case of an only 4-aligned address. BAS[7:4] are 5411 * ignored, and BAS[3:0] define which bytes to watch. 5412 */ 5413 bas &= 0xf; 5414 } 5415 /* The BAS bits are supposed to be programmed to indicate a contiguous 5416 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether 5417 * we fire for each byte in the word/doubleword addressed by the WVR. 5418 * We choose to ignore any non-zero bits after the first range of 1s. 5419 */ 5420 basstart = ctz32(bas); 5421 len = cto32(bas >> basstart); 5422 wvr += basstart; 5423 } 5424 5425 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, 5426 &env->cpu_watchpoint[n]); 5427 } 5428 5429 void hw_watchpoint_update_all(ARMCPU *cpu) 5430 { 5431 int i; 5432 CPUARMState *env = &cpu->env; 5433 5434 /* Completely clear out existing QEMU watchpoints and our array, to 5435 * avoid possible stale entries following migration load. 5436 */ 5437 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); 5438 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); 5439 5440 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { 5441 hw_watchpoint_update(cpu, i); 5442 } 5443 } 5444 5445 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5446 uint64_t value) 5447 { 5448 ARMCPU *cpu = env_archcpu(env); 5449 int i = ri->crm; 5450 5451 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the 5452 * register reads and behaves as if values written are sign extended. 5453 * Bits [1:0] are RES0. 5454 */ 5455 value = sextract64(value, 0, 49) & ~3ULL; 5456 5457 raw_write(env, ri, value); 5458 hw_watchpoint_update(cpu, i); 5459 } 5460 5461 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5462 uint64_t value) 5463 { 5464 ARMCPU *cpu = env_archcpu(env); 5465 int i = ri->crm; 5466 5467 raw_write(env, ri, value); 5468 hw_watchpoint_update(cpu, i); 5469 } 5470 5471 void hw_breakpoint_update(ARMCPU *cpu, int n) 5472 { 5473 CPUARMState *env = &cpu->env; 5474 uint64_t bvr = env->cp15.dbgbvr[n]; 5475 uint64_t bcr = env->cp15.dbgbcr[n]; 5476 vaddr addr; 5477 int bt; 5478 int flags = BP_CPU; 5479 5480 if (env->cpu_breakpoint[n]) { 5481 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); 5482 env->cpu_breakpoint[n] = NULL; 5483 } 5484 5485 if (!extract64(bcr, 0, 1)) { 5486 /* E bit clear : watchpoint disabled */ 5487 return; 5488 } 5489 5490 bt = extract64(bcr, 20, 4); 5491 5492 switch (bt) { 5493 case 4: /* unlinked address mismatch (reserved if AArch64) */ 5494 case 5: /* linked address mismatch (reserved if AArch64) */ 5495 qemu_log_mask(LOG_UNIMP, 5496 "arm: address mismatch breakpoint types not implemented\n"); 5497 return; 5498 case 0: /* unlinked address match */ 5499 case 1: /* linked address match */ 5500 { 5501 /* Bits [63:49] are hardwired to the value of bit [48]; that is, 5502 * we behave as if the register was sign extended. Bits [1:0] are 5503 * RES0. The BAS field is used to allow setting breakpoints on 16 5504 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether 5505 * a bp will fire if the addresses covered by the bp and the addresses 5506 * covered by the insn overlap but the insn doesn't start at the 5507 * start of the bp address range. We choose to require the insn and 5508 * the bp to have the same address. The constraints on writing to 5509 * BAS enforced in dbgbcr_write mean we have only four cases: 5510 * 0b0000 => no breakpoint 5511 * 0b0011 => breakpoint on addr 5512 * 0b1100 => breakpoint on addr + 2 5513 * 0b1111 => breakpoint on addr 5514 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). 5515 */ 5516 int bas = extract64(bcr, 5, 4); 5517 addr = sextract64(bvr, 0, 49) & ~3ULL; 5518 if (bas == 0) { 5519 return; 5520 } 5521 if (bas == 0xc) { 5522 addr += 2; 5523 } 5524 break; 5525 } 5526 case 2: /* unlinked context ID match */ 5527 case 8: /* unlinked VMID match (reserved if no EL2) */ 5528 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ 5529 qemu_log_mask(LOG_UNIMP, 5530 "arm: unlinked context breakpoint types not implemented\n"); 5531 return; 5532 case 9: /* linked VMID match (reserved if no EL2) */ 5533 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 5534 case 3: /* linked context ID match */ 5535 default: 5536 /* We must generate no events for Linked context matches (unless 5537 * they are linked to by some other bp/wp, which is handled in 5538 * updates for the linking bp/wp). We choose to also generate no events 5539 * for reserved values. 5540 */ 5541 return; 5542 } 5543 5544 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); 5545 } 5546 5547 void hw_breakpoint_update_all(ARMCPU *cpu) 5548 { 5549 int i; 5550 CPUARMState *env = &cpu->env; 5551 5552 /* Completely clear out existing QEMU breakpoints and our array, to 5553 * avoid possible stale entries following migration load. 5554 */ 5555 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); 5556 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); 5557 5558 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { 5559 hw_breakpoint_update(cpu, i); 5560 } 5561 } 5562 5563 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5564 uint64_t value) 5565 { 5566 ARMCPU *cpu = env_archcpu(env); 5567 int i = ri->crm; 5568 5569 raw_write(env, ri, value); 5570 hw_breakpoint_update(cpu, i); 5571 } 5572 5573 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5574 uint64_t value) 5575 { 5576 ARMCPU *cpu = env_archcpu(env); 5577 int i = ri->crm; 5578 5579 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only 5580 * copy of BAS[0]. 5581 */ 5582 value = deposit64(value, 6, 1, extract64(value, 5, 1)); 5583 value = deposit64(value, 8, 1, extract64(value, 7, 1)); 5584 5585 raw_write(env, ri, value); 5586 hw_breakpoint_update(cpu, i); 5587 } 5588 5589 static void define_debug_regs(ARMCPU *cpu) 5590 { 5591 /* Define v7 and v8 architectural debug registers. 5592 * These are just dummy implementations for now. 5593 */ 5594 int i; 5595 int wrps, brps, ctx_cmps; 5596 ARMCPRegInfo dbgdidr = { 5597 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 5598 .access = PL0_R, .accessfn = access_tda, 5599 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, 5600 }; 5601 5602 /* Note that all these register fields hold "number of Xs minus 1". */ 5603 brps = extract32(cpu->dbgdidr, 24, 4); 5604 wrps = extract32(cpu->dbgdidr, 28, 4); 5605 ctx_cmps = extract32(cpu->dbgdidr, 20, 4); 5606 5607 assert(ctx_cmps <= brps); 5608 5609 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties 5610 * of the debug registers such as number of breakpoints; 5611 * check that if they both exist then they agree. 5612 */ 5613 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 5614 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps); 5615 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps); 5616 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps); 5617 } 5618 5619 define_one_arm_cp_reg(cpu, &dbgdidr); 5620 define_arm_cp_regs(cpu, debug_cp_reginfo); 5621 5622 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { 5623 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); 5624 } 5625 5626 for (i = 0; i < brps + 1; i++) { 5627 ARMCPRegInfo dbgregs[] = { 5628 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH, 5629 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, 5630 .access = PL1_RW, .accessfn = access_tda, 5631 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), 5632 .writefn = dbgbvr_write, .raw_writefn = raw_write 5633 }, 5634 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH, 5635 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, 5636 .access = PL1_RW, .accessfn = access_tda, 5637 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), 5638 .writefn = dbgbcr_write, .raw_writefn = raw_write 5639 }, 5640 REGINFO_SENTINEL 5641 }; 5642 define_arm_cp_regs(cpu, dbgregs); 5643 } 5644 5645 for (i = 0; i < wrps + 1; i++) { 5646 ARMCPRegInfo dbgregs[] = { 5647 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH, 5648 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, 5649 .access = PL1_RW, .accessfn = access_tda, 5650 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), 5651 .writefn = dbgwvr_write, .raw_writefn = raw_write 5652 }, 5653 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH, 5654 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, 5655 .access = PL1_RW, .accessfn = access_tda, 5656 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), 5657 .writefn = dbgwcr_write, .raw_writefn = raw_write 5658 }, 5659 REGINFO_SENTINEL 5660 }; 5661 define_arm_cp_regs(cpu, dbgregs); 5662 } 5663 } 5664 5665 /* We don't know until after realize whether there's a GICv3 5666 * attached, and that is what registers the gicv3 sysregs. 5667 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 5668 * at runtime. 5669 */ 5670 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 5671 { 5672 ARMCPU *cpu = env_archcpu(env); 5673 uint64_t pfr1 = cpu->id_pfr1; 5674 5675 if (env->gicv3state) { 5676 pfr1 |= 1 << 28; 5677 } 5678 return pfr1; 5679 } 5680 5681 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 5682 { 5683 ARMCPU *cpu = env_archcpu(env); 5684 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 5685 5686 if (env->gicv3state) { 5687 pfr0 |= 1 << 24; 5688 } 5689 return pfr0; 5690 } 5691 5692 /* Shared logic between LORID and the rest of the LOR* registers. 5693 * Secure state has already been delt with. 5694 */ 5695 static CPAccessResult access_lor_ns(CPUARMState *env) 5696 { 5697 int el = arm_current_el(env); 5698 5699 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 5700 return CP_ACCESS_TRAP_EL2; 5701 } 5702 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 5703 return CP_ACCESS_TRAP_EL3; 5704 } 5705 return CP_ACCESS_OK; 5706 } 5707 5708 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri, 5709 bool isread) 5710 { 5711 if (arm_is_secure_below_el3(env)) { 5712 /* Access ok in secure mode. */ 5713 return CP_ACCESS_OK; 5714 } 5715 return access_lor_ns(env); 5716 } 5717 5718 static CPAccessResult access_lor_other(CPUARMState *env, 5719 const ARMCPRegInfo *ri, bool isread) 5720 { 5721 if (arm_is_secure_below_el3(env)) { 5722 /* Access denied in secure mode. */ 5723 return CP_ACCESS_TRAP; 5724 } 5725 return access_lor_ns(env); 5726 } 5727 5728 #ifdef TARGET_AARCH64 5729 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 5730 bool isread) 5731 { 5732 int el = arm_current_el(env); 5733 5734 if (el < 2 && 5735 arm_feature(env, ARM_FEATURE_EL2) && 5736 !(arm_hcr_el2_eff(env) & HCR_APK)) { 5737 return CP_ACCESS_TRAP_EL2; 5738 } 5739 if (el < 3 && 5740 arm_feature(env, ARM_FEATURE_EL3) && 5741 !(env->cp15.scr_el3 & SCR_APK)) { 5742 return CP_ACCESS_TRAP_EL3; 5743 } 5744 return CP_ACCESS_OK; 5745 } 5746 5747 static const ARMCPRegInfo pauth_reginfo[] = { 5748 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5749 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 5750 .access = PL1_RW, .accessfn = access_pauth, 5751 .fieldoffset = offsetof(CPUARMState, keys.apda.lo) }, 5752 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5753 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 5754 .access = PL1_RW, .accessfn = access_pauth, 5755 .fieldoffset = offsetof(CPUARMState, keys.apda.hi) }, 5756 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5757 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 5758 .access = PL1_RW, .accessfn = access_pauth, 5759 .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) }, 5760 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5761 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 5762 .access = PL1_RW, .accessfn = access_pauth, 5763 .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) }, 5764 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5765 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 5766 .access = PL1_RW, .accessfn = access_pauth, 5767 .fieldoffset = offsetof(CPUARMState, keys.apga.lo) }, 5768 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5769 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 5770 .access = PL1_RW, .accessfn = access_pauth, 5771 .fieldoffset = offsetof(CPUARMState, keys.apga.hi) }, 5772 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5773 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 5774 .access = PL1_RW, .accessfn = access_pauth, 5775 .fieldoffset = offsetof(CPUARMState, keys.apia.lo) }, 5776 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5777 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 5778 .access = PL1_RW, .accessfn = access_pauth, 5779 .fieldoffset = offsetof(CPUARMState, keys.apia.hi) }, 5780 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5781 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 5782 .access = PL1_RW, .accessfn = access_pauth, 5783 .fieldoffset = offsetof(CPUARMState, keys.apib.lo) }, 5784 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5785 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 5786 .access = PL1_RW, .accessfn = access_pauth, 5787 .fieldoffset = offsetof(CPUARMState, keys.apib.hi) }, 5788 REGINFO_SENTINEL 5789 }; 5790 5791 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 5792 { 5793 Error *err = NULL; 5794 uint64_t ret; 5795 5796 /* Success sets NZCV = 0000. */ 5797 env->NF = env->CF = env->VF = 0, env->ZF = 1; 5798 5799 if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) { 5800 /* 5801 * ??? Failed, for unknown reasons in the crypto subsystem. 5802 * The best we can do is log the reason and return the 5803 * timed-out indication to the guest. There is no reason 5804 * we know to expect this failure to be transitory, so the 5805 * guest may well hang retrying the operation. 5806 */ 5807 qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s", 5808 ri->name, error_get_pretty(err)); 5809 error_free(err); 5810 5811 env->ZF = 0; /* NZCF = 0100 */ 5812 return 0; 5813 } 5814 return ret; 5815 } 5816 5817 /* We do not support re-seeding, so the two registers operate the same. */ 5818 static const ARMCPRegInfo rndr_reginfo[] = { 5819 { .name = "RNDR", .state = ARM_CP_STATE_AA64, 5820 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 5821 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0, 5822 .access = PL0_R, .readfn = rndr_readfn }, 5823 { .name = "RNDRRS", .state = ARM_CP_STATE_AA64, 5824 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 5825 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1, 5826 .access = PL0_R, .readfn = rndr_readfn }, 5827 REGINFO_SENTINEL 5828 }; 5829 #endif 5830 5831 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri, 5832 bool isread) 5833 { 5834 int el = arm_current_el(env); 5835 5836 if (el == 0) { 5837 uint64_t sctlr = arm_sctlr(env, el); 5838 if (!(sctlr & SCTLR_EnRCTX)) { 5839 return CP_ACCESS_TRAP; 5840 } 5841 } else if (el == 1) { 5842 uint64_t hcr = arm_hcr_el2_eff(env); 5843 if (hcr & HCR_NV) { 5844 return CP_ACCESS_TRAP_EL2; 5845 } 5846 } 5847 return CP_ACCESS_OK; 5848 } 5849 5850 static const ARMCPRegInfo predinv_reginfo[] = { 5851 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64, 5852 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4, 5853 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5854 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64, 5855 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5, 5856 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5857 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64, 5858 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7, 5859 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5860 /* 5861 * Note the AArch32 opcodes have a different OPC1. 5862 */ 5863 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32, 5864 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4, 5865 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5866 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32, 5867 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5, 5868 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5869 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32, 5870 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7, 5871 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5872 REGINFO_SENTINEL 5873 }; 5874 5875 void register_cp_regs_for_features(ARMCPU *cpu) 5876 { 5877 /* Register all the coprocessor registers based on feature bits */ 5878 CPUARMState *env = &cpu->env; 5879 if (arm_feature(env, ARM_FEATURE_M)) { 5880 /* M profile has no coprocessor registers */ 5881 return; 5882 } 5883 5884 define_arm_cp_regs(cpu, cp_reginfo); 5885 if (!arm_feature(env, ARM_FEATURE_V8)) { 5886 /* Must go early as it is full of wildcards that may be 5887 * overridden by later definitions. 5888 */ 5889 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 5890 } 5891 5892 if (arm_feature(env, ARM_FEATURE_V6)) { 5893 /* The ID registers all have impdef reset values */ 5894 ARMCPRegInfo v6_idregs[] = { 5895 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 5896 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5897 .access = PL1_R, .type = ARM_CP_CONST, 5898 .resetvalue = cpu->id_pfr0 }, 5899 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know 5900 * the value of the GIC field until after we define these regs. 5901 */ 5902 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 5903 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 5904 .access = PL1_R, .type = ARM_CP_NO_RAW, 5905 .readfn = id_pfr1_read, 5906 .writefn = arm_cp_write_ignore }, 5907 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 5908 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 5909 .access = PL1_R, .type = ARM_CP_CONST, 5910 .resetvalue = cpu->id_dfr0 }, 5911 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 5912 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 5913 .access = PL1_R, .type = ARM_CP_CONST, 5914 .resetvalue = cpu->id_afr0 }, 5915 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 5916 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 5917 .access = PL1_R, .type = ARM_CP_CONST, 5918 .resetvalue = cpu->id_mmfr0 }, 5919 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 5920 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 5921 .access = PL1_R, .type = ARM_CP_CONST, 5922 .resetvalue = cpu->id_mmfr1 }, 5923 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 5924 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 5925 .access = PL1_R, .type = ARM_CP_CONST, 5926 .resetvalue = cpu->id_mmfr2 }, 5927 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 5928 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 5929 .access = PL1_R, .type = ARM_CP_CONST, 5930 .resetvalue = cpu->id_mmfr3 }, 5931 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 5932 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5933 .access = PL1_R, .type = ARM_CP_CONST, 5934 .resetvalue = cpu->isar.id_isar0 }, 5935 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 5936 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 5937 .access = PL1_R, .type = ARM_CP_CONST, 5938 .resetvalue = cpu->isar.id_isar1 }, 5939 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 5940 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5941 .access = PL1_R, .type = ARM_CP_CONST, 5942 .resetvalue = cpu->isar.id_isar2 }, 5943 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 5944 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 5945 .access = PL1_R, .type = ARM_CP_CONST, 5946 .resetvalue = cpu->isar.id_isar3 }, 5947 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 5948 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 5949 .access = PL1_R, .type = ARM_CP_CONST, 5950 .resetvalue = cpu->isar.id_isar4 }, 5951 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 5952 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 5953 .access = PL1_R, .type = ARM_CP_CONST, 5954 .resetvalue = cpu->isar.id_isar5 }, 5955 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 5956 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 5957 .access = PL1_R, .type = ARM_CP_CONST, 5958 .resetvalue = cpu->id_mmfr4 }, 5959 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 5960 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 5961 .access = PL1_R, .type = ARM_CP_CONST, 5962 .resetvalue = cpu->isar.id_isar6 }, 5963 REGINFO_SENTINEL 5964 }; 5965 define_arm_cp_regs(cpu, v6_idregs); 5966 define_arm_cp_regs(cpu, v6_cp_reginfo); 5967 } else { 5968 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 5969 } 5970 if (arm_feature(env, ARM_FEATURE_V6K)) { 5971 define_arm_cp_regs(cpu, v6k_cp_reginfo); 5972 } 5973 if (arm_feature(env, ARM_FEATURE_V7MP) && 5974 !arm_feature(env, ARM_FEATURE_PMSA)) { 5975 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 5976 } 5977 if (arm_feature(env, ARM_FEATURE_V7VE)) { 5978 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 5979 } 5980 if (arm_feature(env, ARM_FEATURE_V7)) { 5981 /* v7 performance monitor control register: same implementor 5982 * field as main ID register, and we implement four counters in 5983 * addition to the cycle count register. 5984 */ 5985 unsigned int i, pmcrn = 4; 5986 ARMCPRegInfo pmcr = { 5987 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 5988 .access = PL0_RW, 5989 .type = ARM_CP_IO | ARM_CP_ALIAS, 5990 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 5991 .accessfn = pmreg_access, .writefn = pmcr_write, 5992 .raw_writefn = raw_write, 5993 }; 5994 ARMCPRegInfo pmcr64 = { 5995 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 5996 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 5997 .access = PL0_RW, .accessfn = pmreg_access, 5998 .type = ARM_CP_IO, 5999 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 6000 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT), 6001 .writefn = pmcr_write, .raw_writefn = raw_write, 6002 }; 6003 define_one_arm_cp_reg(cpu, &pmcr); 6004 define_one_arm_cp_reg(cpu, &pmcr64); 6005 for (i = 0; i < pmcrn; i++) { 6006 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 6007 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 6008 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 6009 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 6010 ARMCPRegInfo pmev_regs[] = { 6011 { .name = pmevcntr_name, .cp = 15, .crn = 14, 6012 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6013 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6014 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6015 .accessfn = pmreg_access }, 6016 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 6017 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)), 6018 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 6019 .type = ARM_CP_IO, 6020 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6021 .raw_readfn = pmevcntr_rawread, 6022 .raw_writefn = pmevcntr_rawwrite }, 6023 { .name = pmevtyper_name, .cp = 15, .crn = 14, 6024 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6025 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6026 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6027 .accessfn = pmreg_access }, 6028 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 6029 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)), 6030 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 6031 .type = ARM_CP_IO, 6032 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6033 .raw_writefn = pmevtyper_rawwrite }, 6034 REGINFO_SENTINEL 6035 }; 6036 define_arm_cp_regs(cpu, pmev_regs); 6037 g_free(pmevcntr_name); 6038 g_free(pmevcntr_el0_name); 6039 g_free(pmevtyper_name); 6040 g_free(pmevtyper_el0_name); 6041 } 6042 ARMCPRegInfo clidr = { 6043 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 6044 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 6045 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr 6046 }; 6047 define_one_arm_cp_reg(cpu, &clidr); 6048 define_arm_cp_regs(cpu, v7_cp_reginfo); 6049 define_debug_regs(cpu); 6050 } else { 6051 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 6052 } 6053 if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 && 6054 FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) { 6055 ARMCPRegInfo v81_pmu_regs[] = { 6056 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 6057 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 6058 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6059 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 6060 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 6061 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 6062 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6063 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 6064 REGINFO_SENTINEL 6065 }; 6066 define_arm_cp_regs(cpu, v81_pmu_regs); 6067 } 6068 if (arm_feature(env, ARM_FEATURE_V8)) { 6069 /* AArch64 ID registers, which all have impdef reset values. 6070 * Note that within the ID register ranges the unused slots 6071 * must all RAZ, not UNDEF; future architecture versions may 6072 * define new registers here. 6073 */ 6074 ARMCPRegInfo v8_idregs[] = { 6075 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't 6076 * know the right value for the GIC field until after we 6077 * define these regs. 6078 */ 6079 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 6080 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 6081 .access = PL1_R, .type = ARM_CP_NO_RAW, 6082 .readfn = id_aa64pfr0_read, 6083 .writefn = arm_cp_write_ignore }, 6084 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 6085 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 6086 .access = PL1_R, .type = ARM_CP_CONST, 6087 .resetvalue = cpu->isar.id_aa64pfr1}, 6088 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6089 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 6090 .access = PL1_R, .type = ARM_CP_CONST, 6091 .resetvalue = 0 }, 6092 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6093 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 6094 .access = PL1_R, .type = ARM_CP_CONST, 6095 .resetvalue = 0 }, 6096 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 6097 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 6098 .access = PL1_R, .type = ARM_CP_CONST, 6099 /* At present, only SVEver == 0 is defined anyway. */ 6100 .resetvalue = 0 }, 6101 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6102 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 6103 .access = PL1_R, .type = ARM_CP_CONST, 6104 .resetvalue = 0 }, 6105 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6106 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 6107 .access = PL1_R, .type = ARM_CP_CONST, 6108 .resetvalue = 0 }, 6109 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6110 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 6111 .access = PL1_R, .type = ARM_CP_CONST, 6112 .resetvalue = 0 }, 6113 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 6114 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 6115 .access = PL1_R, .type = ARM_CP_CONST, 6116 .resetvalue = cpu->id_aa64dfr0 }, 6117 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 6118 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 6119 .access = PL1_R, .type = ARM_CP_CONST, 6120 .resetvalue = cpu->id_aa64dfr1 }, 6121 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6122 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 6123 .access = PL1_R, .type = ARM_CP_CONST, 6124 .resetvalue = 0 }, 6125 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6126 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 6127 .access = PL1_R, .type = ARM_CP_CONST, 6128 .resetvalue = 0 }, 6129 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 6130 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 6131 .access = PL1_R, .type = ARM_CP_CONST, 6132 .resetvalue = cpu->id_aa64afr0 }, 6133 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 6134 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 6135 .access = PL1_R, .type = ARM_CP_CONST, 6136 .resetvalue = cpu->id_aa64afr1 }, 6137 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6138 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 6139 .access = PL1_R, .type = ARM_CP_CONST, 6140 .resetvalue = 0 }, 6141 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6142 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 6143 .access = PL1_R, .type = ARM_CP_CONST, 6144 .resetvalue = 0 }, 6145 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 6146 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 6147 .access = PL1_R, .type = ARM_CP_CONST, 6148 .resetvalue = cpu->isar.id_aa64isar0 }, 6149 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 6150 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 6151 .access = PL1_R, .type = ARM_CP_CONST, 6152 .resetvalue = cpu->isar.id_aa64isar1 }, 6153 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6154 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 6155 .access = PL1_R, .type = ARM_CP_CONST, 6156 .resetvalue = 0 }, 6157 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6158 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 6159 .access = PL1_R, .type = ARM_CP_CONST, 6160 .resetvalue = 0 }, 6161 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6162 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 6163 .access = PL1_R, .type = ARM_CP_CONST, 6164 .resetvalue = 0 }, 6165 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6166 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 6167 .access = PL1_R, .type = ARM_CP_CONST, 6168 .resetvalue = 0 }, 6169 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6170 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 6171 .access = PL1_R, .type = ARM_CP_CONST, 6172 .resetvalue = 0 }, 6173 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6174 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 6175 .access = PL1_R, .type = ARM_CP_CONST, 6176 .resetvalue = 0 }, 6177 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 6178 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 6179 .access = PL1_R, .type = ARM_CP_CONST, 6180 .resetvalue = cpu->isar.id_aa64mmfr0 }, 6181 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 6182 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 6183 .access = PL1_R, .type = ARM_CP_CONST, 6184 .resetvalue = cpu->isar.id_aa64mmfr1 }, 6185 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6186 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 6187 .access = PL1_R, .type = ARM_CP_CONST, 6188 .resetvalue = 0 }, 6189 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6190 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 6191 .access = PL1_R, .type = ARM_CP_CONST, 6192 .resetvalue = 0 }, 6193 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6194 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 6195 .access = PL1_R, .type = ARM_CP_CONST, 6196 .resetvalue = 0 }, 6197 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6198 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 6199 .access = PL1_R, .type = ARM_CP_CONST, 6200 .resetvalue = 0 }, 6201 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6202 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 6203 .access = PL1_R, .type = ARM_CP_CONST, 6204 .resetvalue = 0 }, 6205 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6206 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 6207 .access = PL1_R, .type = ARM_CP_CONST, 6208 .resetvalue = 0 }, 6209 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 6210 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 6211 .access = PL1_R, .type = ARM_CP_CONST, 6212 .resetvalue = cpu->isar.mvfr0 }, 6213 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 6214 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 6215 .access = PL1_R, .type = ARM_CP_CONST, 6216 .resetvalue = cpu->isar.mvfr1 }, 6217 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 6218 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 6219 .access = PL1_R, .type = ARM_CP_CONST, 6220 .resetvalue = cpu->isar.mvfr2 }, 6221 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6222 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 6223 .access = PL1_R, .type = ARM_CP_CONST, 6224 .resetvalue = 0 }, 6225 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6226 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 6227 .access = PL1_R, .type = ARM_CP_CONST, 6228 .resetvalue = 0 }, 6229 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6230 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 6231 .access = PL1_R, .type = ARM_CP_CONST, 6232 .resetvalue = 0 }, 6233 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6234 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 6235 .access = PL1_R, .type = ARM_CP_CONST, 6236 .resetvalue = 0 }, 6237 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6238 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 6239 .access = PL1_R, .type = ARM_CP_CONST, 6240 .resetvalue = 0 }, 6241 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 6242 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 6243 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6244 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 6245 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 6246 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 6247 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6248 .resetvalue = cpu->pmceid0 }, 6249 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 6250 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 6251 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6252 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 6253 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 6254 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 6255 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6256 .resetvalue = cpu->pmceid1 }, 6257 REGINFO_SENTINEL 6258 }; 6259 #ifdef CONFIG_USER_ONLY 6260 ARMCPRegUserSpaceInfo v8_user_idregs[] = { 6261 { .name = "ID_AA64PFR0_EL1", 6262 .exported_bits = 0x000f000f00ff0000, 6263 .fixed_bits = 0x0000000000000011 }, 6264 { .name = "ID_AA64PFR1_EL1", 6265 .exported_bits = 0x00000000000000f0 }, 6266 { .name = "ID_AA64PFR*_EL1_RESERVED", 6267 .is_glob = true }, 6268 { .name = "ID_AA64ZFR0_EL1" }, 6269 { .name = "ID_AA64MMFR0_EL1", 6270 .fixed_bits = 0x00000000ff000000 }, 6271 { .name = "ID_AA64MMFR1_EL1" }, 6272 { .name = "ID_AA64MMFR*_EL1_RESERVED", 6273 .is_glob = true }, 6274 { .name = "ID_AA64DFR0_EL1", 6275 .fixed_bits = 0x0000000000000006 }, 6276 { .name = "ID_AA64DFR1_EL1" }, 6277 { .name = "ID_AA64DFR*_EL1_RESERVED", 6278 .is_glob = true }, 6279 { .name = "ID_AA64AFR*", 6280 .is_glob = true }, 6281 { .name = "ID_AA64ISAR0_EL1", 6282 .exported_bits = 0x00fffffff0fffff0 }, 6283 { .name = "ID_AA64ISAR1_EL1", 6284 .exported_bits = 0x000000f0ffffffff }, 6285 { .name = "ID_AA64ISAR*_EL1_RESERVED", 6286 .is_glob = true }, 6287 REGUSERINFO_SENTINEL 6288 }; 6289 modify_arm_cp_regs(v8_idregs, v8_user_idregs); 6290 #endif 6291 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ 6292 if (!arm_feature(env, ARM_FEATURE_EL3) && 6293 !arm_feature(env, ARM_FEATURE_EL2)) { 6294 ARMCPRegInfo rvbar = { 6295 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64, 6296 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 6297 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar 6298 }; 6299 define_one_arm_cp_reg(cpu, &rvbar); 6300 } 6301 define_arm_cp_regs(cpu, v8_idregs); 6302 define_arm_cp_regs(cpu, v8_cp_reginfo); 6303 } 6304 if (arm_feature(env, ARM_FEATURE_EL2)) { 6305 uint64_t vmpidr_def = mpidr_read_val(env); 6306 ARMCPRegInfo vpidr_regs[] = { 6307 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 6308 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6309 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6310 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS, 6311 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 6312 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 6313 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6314 .access = PL2_RW, .resetvalue = cpu->midr, 6315 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6316 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 6317 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6318 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6319 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS, 6320 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 6321 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 6322 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6323 .access = PL2_RW, 6324 .resetvalue = vmpidr_def, 6325 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 6326 REGINFO_SENTINEL 6327 }; 6328 define_arm_cp_regs(cpu, vpidr_regs); 6329 define_arm_cp_regs(cpu, el2_cp_reginfo); 6330 if (arm_feature(env, ARM_FEATURE_V8)) { 6331 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 6332 } 6333 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */ 6334 if (!arm_feature(env, ARM_FEATURE_EL3)) { 6335 ARMCPRegInfo rvbar = { 6336 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 6337 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 6338 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar 6339 }; 6340 define_one_arm_cp_reg(cpu, &rvbar); 6341 } 6342 } else { 6343 /* If EL2 is missing but higher ELs are enabled, we need to 6344 * register the no_el2 reginfos. 6345 */ 6346 if (arm_feature(env, ARM_FEATURE_EL3)) { 6347 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value 6348 * of MIDR_EL1 and MPIDR_EL1. 6349 */ 6350 ARMCPRegInfo vpidr_regs[] = { 6351 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6352 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6353 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6354 .type = ARM_CP_CONST, .resetvalue = cpu->midr, 6355 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6356 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6357 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6358 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6359 .type = ARM_CP_NO_RAW, 6360 .writefn = arm_cp_write_ignore, .readfn = mpidr_read }, 6361 REGINFO_SENTINEL 6362 }; 6363 define_arm_cp_regs(cpu, vpidr_regs); 6364 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo); 6365 if (arm_feature(env, ARM_FEATURE_V8)) { 6366 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo); 6367 } 6368 } 6369 } 6370 if (arm_feature(env, ARM_FEATURE_EL3)) { 6371 define_arm_cp_regs(cpu, el3_cp_reginfo); 6372 ARMCPRegInfo el3_regs[] = { 6373 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 6374 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 6375 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar }, 6376 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 6377 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 6378 .access = PL3_RW, 6379 .raw_writefn = raw_write, .writefn = sctlr_write, 6380 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 6381 .resetvalue = cpu->reset_sctlr }, 6382 REGINFO_SENTINEL 6383 }; 6384 6385 define_arm_cp_regs(cpu, el3_regs); 6386 } 6387 /* The behaviour of NSACR is sufficiently various that we don't 6388 * try to describe it in a single reginfo: 6389 * if EL3 is 64 bit, then trap to EL3 from S EL1, 6390 * reads as constant 0xc00 from NS EL1 and NS EL2 6391 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 6392 * if v7 without EL3, register doesn't exist 6393 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 6394 */ 6395 if (arm_feature(env, ARM_FEATURE_EL3)) { 6396 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6397 ARMCPRegInfo nsacr = { 6398 .name = "NSACR", .type = ARM_CP_CONST, 6399 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6400 .access = PL1_RW, .accessfn = nsacr_access, 6401 .resetvalue = 0xc00 6402 }; 6403 define_one_arm_cp_reg(cpu, &nsacr); 6404 } else { 6405 ARMCPRegInfo nsacr = { 6406 .name = "NSACR", 6407 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6408 .access = PL3_RW | PL1_R, 6409 .resetvalue = 0, 6410 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 6411 }; 6412 define_one_arm_cp_reg(cpu, &nsacr); 6413 } 6414 } else { 6415 if (arm_feature(env, ARM_FEATURE_V8)) { 6416 ARMCPRegInfo nsacr = { 6417 .name = "NSACR", .type = ARM_CP_CONST, 6418 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6419 .access = PL1_R, 6420 .resetvalue = 0xc00 6421 }; 6422 define_one_arm_cp_reg(cpu, &nsacr); 6423 } 6424 } 6425 6426 if (arm_feature(env, ARM_FEATURE_PMSA)) { 6427 if (arm_feature(env, ARM_FEATURE_V6)) { 6428 /* PMSAv6 not implemented */ 6429 assert(arm_feature(env, ARM_FEATURE_V7)); 6430 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6431 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 6432 } else { 6433 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 6434 } 6435 } else { 6436 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6437 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 6438 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */ 6439 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) { 6440 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 6441 } 6442 } 6443 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 6444 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 6445 } 6446 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 6447 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 6448 } 6449 if (arm_feature(env, ARM_FEATURE_VAPA)) { 6450 define_arm_cp_regs(cpu, vapa_cp_reginfo); 6451 } 6452 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 6453 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 6454 } 6455 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 6456 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 6457 } 6458 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 6459 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 6460 } 6461 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 6462 define_arm_cp_regs(cpu, omap_cp_reginfo); 6463 } 6464 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 6465 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 6466 } 6467 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6468 define_arm_cp_regs(cpu, xscale_cp_reginfo); 6469 } 6470 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 6471 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 6472 } 6473 if (arm_feature(env, ARM_FEATURE_LPAE)) { 6474 define_arm_cp_regs(cpu, lpae_cp_reginfo); 6475 } 6476 /* Slightly awkwardly, the OMAP and StrongARM cores need all of 6477 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 6478 * be read-only (ie write causes UNDEF exception). 6479 */ 6480 { 6481 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 6482 /* Pre-v8 MIDR space. 6483 * Note that the MIDR isn't a simple constant register because 6484 * of the TI925 behaviour where writes to another register can 6485 * cause the MIDR value to change. 6486 * 6487 * Unimplemented registers in the c15 0 0 0 space default to 6488 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 6489 * and friends override accordingly. 6490 */ 6491 { .name = "MIDR", 6492 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 6493 .access = PL1_R, .resetvalue = cpu->midr, 6494 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 6495 .readfn = midr_read, 6496 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6497 .type = ARM_CP_OVERRIDE }, 6498 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 6499 { .name = "DUMMY", 6500 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 6501 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6502 { .name = "DUMMY", 6503 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 6504 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6505 { .name = "DUMMY", 6506 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 6507 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6508 { .name = "DUMMY", 6509 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 6510 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6511 { .name = "DUMMY", 6512 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 6513 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6514 REGINFO_SENTINEL 6515 }; 6516 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 6517 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 6518 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 6519 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 6520 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6521 .readfn = midr_read }, 6522 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */ 6523 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6524 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6525 .access = PL1_R, .resetvalue = cpu->midr }, 6526 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6527 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 6528 .access = PL1_R, .resetvalue = cpu->midr }, 6529 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 6530 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 6531 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 6532 REGINFO_SENTINEL 6533 }; 6534 ARMCPRegInfo id_cp_reginfo[] = { 6535 /* These are common to v8 and pre-v8 */ 6536 { .name = "CTR", 6537 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 6538 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6539 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 6540 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 6541 .access = PL0_R, .accessfn = ctr_el0_access, 6542 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6543 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 6544 { .name = "TCMTR", 6545 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 6546 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6547 REGINFO_SENTINEL 6548 }; 6549 /* TLBTR is specific to VMSA */ 6550 ARMCPRegInfo id_tlbtr_reginfo = { 6551 .name = "TLBTR", 6552 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 6553 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0, 6554 }; 6555 /* MPUIR is specific to PMSA V6+ */ 6556 ARMCPRegInfo id_mpuir_reginfo = { 6557 .name = "MPUIR", 6558 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6559 .access = PL1_R, .type = ARM_CP_CONST, 6560 .resetvalue = cpu->pmsav7_dregion << 8 6561 }; 6562 ARMCPRegInfo crn0_wi_reginfo = { 6563 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 6564 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 6565 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 6566 }; 6567 #ifdef CONFIG_USER_ONLY 6568 ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = { 6569 { .name = "MIDR_EL1", 6570 .exported_bits = 0x00000000ffffffff }, 6571 { .name = "REVIDR_EL1" }, 6572 REGUSERINFO_SENTINEL 6573 }; 6574 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo); 6575 #endif 6576 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 6577 arm_feature(env, ARM_FEATURE_STRONGARM)) { 6578 ARMCPRegInfo *r; 6579 /* Register the blanket "writes ignored" value first to cover the 6580 * whole space. Then update the specific ID registers to allow write 6581 * access, so that they ignore writes rather than causing them to 6582 * UNDEF. 6583 */ 6584 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 6585 for (r = id_pre_v8_midr_cp_reginfo; 6586 r->type != ARM_CP_SENTINEL; r++) { 6587 r->access = PL1_RW; 6588 } 6589 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) { 6590 r->access = PL1_RW; 6591 } 6592 id_mpuir_reginfo.access = PL1_RW; 6593 id_tlbtr_reginfo.access = PL1_RW; 6594 } 6595 if (arm_feature(env, ARM_FEATURE_V8)) { 6596 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 6597 } else { 6598 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 6599 } 6600 define_arm_cp_regs(cpu, id_cp_reginfo); 6601 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 6602 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 6603 } else if (arm_feature(env, ARM_FEATURE_V7)) { 6604 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 6605 } 6606 } 6607 6608 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 6609 ARMCPRegInfo mpidr_cp_reginfo[] = { 6610 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH, 6611 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 6612 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 6613 REGINFO_SENTINEL 6614 }; 6615 #ifdef CONFIG_USER_ONLY 6616 ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = { 6617 { .name = "MPIDR_EL1", 6618 .fixed_bits = 0x0000000080000000 }, 6619 REGUSERINFO_SENTINEL 6620 }; 6621 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo); 6622 #endif 6623 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 6624 } 6625 6626 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 6627 ARMCPRegInfo auxcr_reginfo[] = { 6628 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 6629 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 6630 .access = PL1_RW, .type = ARM_CP_CONST, 6631 .resetvalue = cpu->reset_auxcr }, 6632 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 6633 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 6634 .access = PL2_RW, .type = ARM_CP_CONST, 6635 .resetvalue = 0 }, 6636 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 6637 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 6638 .access = PL3_RW, .type = ARM_CP_CONST, 6639 .resetvalue = 0 }, 6640 REGINFO_SENTINEL 6641 }; 6642 define_arm_cp_regs(cpu, auxcr_reginfo); 6643 if (arm_feature(env, ARM_FEATURE_V8)) { 6644 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */ 6645 ARMCPRegInfo hactlr2_reginfo = { 6646 .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 6647 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 6648 .access = PL2_RW, .type = ARM_CP_CONST, 6649 .resetvalue = 0 6650 }; 6651 define_one_arm_cp_reg(cpu, &hactlr2_reginfo); 6652 } 6653 } 6654 6655 if (arm_feature(env, ARM_FEATURE_CBAR)) { 6656 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6657 /* 32 bit view is [31:18] 0...0 [43:32]. */ 6658 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 6659 | extract64(cpu->reset_cbar, 32, 12); 6660 ARMCPRegInfo cbar_reginfo[] = { 6661 { .name = "CBAR", 6662 .type = ARM_CP_CONST, 6663 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6664 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 6665 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 6666 .type = ARM_CP_CONST, 6667 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 6668 .access = PL1_R, .resetvalue = cbar32 }, 6669 REGINFO_SENTINEL 6670 }; 6671 /* We don't implement a r/w 64 bit CBAR currently */ 6672 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 6673 define_arm_cp_regs(cpu, cbar_reginfo); 6674 } else { 6675 ARMCPRegInfo cbar = { 6676 .name = "CBAR", 6677 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6678 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar, 6679 .fieldoffset = offsetof(CPUARMState, 6680 cp15.c15_config_base_address) 6681 }; 6682 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 6683 cbar.access = PL1_R; 6684 cbar.fieldoffset = 0; 6685 cbar.type = ARM_CP_CONST; 6686 } 6687 define_one_arm_cp_reg(cpu, &cbar); 6688 } 6689 } 6690 6691 if (arm_feature(env, ARM_FEATURE_VBAR)) { 6692 ARMCPRegInfo vbar_cp_reginfo[] = { 6693 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 6694 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 6695 .access = PL1_RW, .writefn = vbar_write, 6696 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 6697 offsetof(CPUARMState, cp15.vbar_ns) }, 6698 .resetvalue = 0 }, 6699 REGINFO_SENTINEL 6700 }; 6701 define_arm_cp_regs(cpu, vbar_cp_reginfo); 6702 } 6703 6704 /* Generic registers whose values depend on the implementation */ 6705 { 6706 ARMCPRegInfo sctlr = { 6707 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 6708 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 6709 .access = PL1_RW, 6710 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 6711 offsetof(CPUARMState, cp15.sctlr_ns) }, 6712 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 6713 .raw_writefn = raw_write, 6714 }; 6715 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6716 /* Normally we would always end the TB on an SCTLR write, but Linux 6717 * arch/arm/mach-pxa/sleep.S expects two instructions following 6718 * an MMU enable to execute from cache. Imitate this behaviour. 6719 */ 6720 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 6721 } 6722 define_one_arm_cp_reg(cpu, &sctlr); 6723 } 6724 6725 if (cpu_isar_feature(aa64_lor, cpu)) { 6726 /* 6727 * A trivial implementation of ARMv8.1-LOR leaves all of these 6728 * registers fixed at 0, which indicates that there are zero 6729 * supported Limited Ordering regions. 6730 */ 6731 static const ARMCPRegInfo lor_reginfo[] = { 6732 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 6733 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 6734 .access = PL1_RW, .accessfn = access_lor_other, 6735 .type = ARM_CP_CONST, .resetvalue = 0 }, 6736 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 6737 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 6738 .access = PL1_RW, .accessfn = access_lor_other, 6739 .type = ARM_CP_CONST, .resetvalue = 0 }, 6740 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 6741 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 6742 .access = PL1_RW, .accessfn = access_lor_other, 6743 .type = ARM_CP_CONST, .resetvalue = 0 }, 6744 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 6745 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 6746 .access = PL1_RW, .accessfn = access_lor_other, 6747 .type = ARM_CP_CONST, .resetvalue = 0 }, 6748 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 6749 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 6750 .access = PL1_R, .accessfn = access_lorid, 6751 .type = ARM_CP_CONST, .resetvalue = 0 }, 6752 REGINFO_SENTINEL 6753 }; 6754 define_arm_cp_regs(cpu, lor_reginfo); 6755 } 6756 6757 if (cpu_isar_feature(aa64_sve, cpu)) { 6758 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo); 6759 if (arm_feature(env, ARM_FEATURE_EL2)) { 6760 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo); 6761 } else { 6762 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo); 6763 } 6764 if (arm_feature(env, ARM_FEATURE_EL3)) { 6765 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo); 6766 } 6767 } 6768 6769 #ifdef TARGET_AARCH64 6770 if (cpu_isar_feature(aa64_pauth, cpu)) { 6771 define_arm_cp_regs(cpu, pauth_reginfo); 6772 } 6773 if (cpu_isar_feature(aa64_rndr, cpu)) { 6774 define_arm_cp_regs(cpu, rndr_reginfo); 6775 } 6776 #endif 6777 6778 /* 6779 * While all v8.0 cpus support aarch64, QEMU does have configurations 6780 * that do not set ID_AA64ISAR1, e.g. user-only qemu-arm -cpu max, 6781 * which will set ID_ISAR6. 6782 */ 6783 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) 6784 ? cpu_isar_feature(aa64_predinv, cpu) 6785 : cpu_isar_feature(aa32_predinv, cpu)) { 6786 define_arm_cp_regs(cpu, predinv_reginfo); 6787 } 6788 } 6789 6790 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) 6791 { 6792 CPUState *cs = CPU(cpu); 6793 CPUARMState *env = &cpu->env; 6794 6795 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6796 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg, 6797 aarch64_fpu_gdb_set_reg, 6798 34, "aarch64-fpu.xml", 0); 6799 } else if (arm_feature(env, ARM_FEATURE_NEON)) { 6800 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6801 51, "arm-neon.xml", 0); 6802 } else if (arm_feature(env, ARM_FEATURE_VFP3)) { 6803 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6804 35, "arm-vfp3.xml", 0); 6805 } else if (arm_feature(env, ARM_FEATURE_VFP)) { 6806 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6807 19, "arm-vfp.xml", 0); 6808 } 6809 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg, 6810 arm_gen_dynamic_xml(cs), 6811 "system-registers.xml", 0); 6812 } 6813 6814 /* Sort alphabetically by type name, except for "any". */ 6815 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b) 6816 { 6817 ObjectClass *class_a = (ObjectClass *)a; 6818 ObjectClass *class_b = (ObjectClass *)b; 6819 const char *name_a, *name_b; 6820 6821 name_a = object_class_get_name(class_a); 6822 name_b = object_class_get_name(class_b); 6823 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) { 6824 return 1; 6825 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) { 6826 return -1; 6827 } else { 6828 return strcmp(name_a, name_b); 6829 } 6830 } 6831 6832 static void arm_cpu_list_entry(gpointer data, gpointer user_data) 6833 { 6834 ObjectClass *oc = data; 6835 const char *typename; 6836 char *name; 6837 6838 typename = object_class_get_name(oc); 6839 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6840 qemu_printf(" %s\n", name); 6841 g_free(name); 6842 } 6843 6844 void arm_cpu_list(void) 6845 { 6846 GSList *list; 6847 6848 list = object_class_get_list(TYPE_ARM_CPU, false); 6849 list = g_slist_sort(list, arm_cpu_list_compare); 6850 qemu_printf("Available CPUs:\n"); 6851 g_slist_foreach(list, arm_cpu_list_entry, NULL); 6852 g_slist_free(list); 6853 } 6854 6855 static void arm_cpu_add_definition(gpointer data, gpointer user_data) 6856 { 6857 ObjectClass *oc = data; 6858 CpuDefinitionInfoList **cpu_list = user_data; 6859 CpuDefinitionInfoList *entry; 6860 CpuDefinitionInfo *info; 6861 const char *typename; 6862 6863 typename = object_class_get_name(oc); 6864 info = g_malloc0(sizeof(*info)); 6865 info->name = g_strndup(typename, 6866 strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6867 info->q_typename = g_strdup(typename); 6868 6869 entry = g_malloc0(sizeof(*entry)); 6870 entry->value = info; 6871 entry->next = *cpu_list; 6872 *cpu_list = entry; 6873 } 6874 6875 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp) 6876 { 6877 CpuDefinitionInfoList *cpu_list = NULL; 6878 GSList *list; 6879 6880 list = object_class_get_list(TYPE_ARM_CPU, false); 6881 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list); 6882 g_slist_free(list); 6883 6884 return cpu_list; 6885 } 6886 6887 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 6888 void *opaque, int state, int secstate, 6889 int crm, int opc1, int opc2, 6890 const char *name) 6891 { 6892 /* Private utility function for define_one_arm_cp_reg_with_opaque(): 6893 * add a single reginfo struct to the hash table. 6894 */ 6895 uint32_t *key = g_new(uint32_t, 1); 6896 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo)); 6897 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0; 6898 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0; 6899 6900 r2->name = g_strdup(name); 6901 /* Reset the secure state to the specific incoming state. This is 6902 * necessary as the register may have been defined with both states. 6903 */ 6904 r2->secure = secstate; 6905 6906 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6907 /* Register is banked (using both entries in array). 6908 * Overwriting fieldoffset as the array is only used to define 6909 * banked registers but later only fieldoffset is used. 6910 */ 6911 r2->fieldoffset = r->bank_fieldoffsets[ns]; 6912 } 6913 6914 if (state == ARM_CP_STATE_AA32) { 6915 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6916 /* If the register is banked then we don't need to migrate or 6917 * reset the 32-bit instance in certain cases: 6918 * 6919 * 1) If the register has both 32-bit and 64-bit instances then we 6920 * can count on the 64-bit instance taking care of the 6921 * non-secure bank. 6922 * 2) If ARMv8 is enabled then we can count on a 64-bit version 6923 * taking care of the secure bank. This requires that separate 6924 * 32 and 64-bit definitions are provided. 6925 */ 6926 if ((r->state == ARM_CP_STATE_BOTH && ns) || 6927 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) { 6928 r2->type |= ARM_CP_ALIAS; 6929 } 6930 } else if ((secstate != r->secure) && !ns) { 6931 /* The register is not banked so we only want to allow migration of 6932 * the non-secure instance. 6933 */ 6934 r2->type |= ARM_CP_ALIAS; 6935 } 6936 6937 if (r->state == ARM_CP_STATE_BOTH) { 6938 /* We assume it is a cp15 register if the .cp field is left unset. 6939 */ 6940 if (r2->cp == 0) { 6941 r2->cp = 15; 6942 } 6943 6944 #ifdef HOST_WORDS_BIGENDIAN 6945 if (r2->fieldoffset) { 6946 r2->fieldoffset += sizeof(uint32_t); 6947 } 6948 #endif 6949 } 6950 } 6951 if (state == ARM_CP_STATE_AA64) { 6952 /* To allow abbreviation of ARMCPRegInfo 6953 * definitions, we treat cp == 0 as equivalent to 6954 * the value for "standard guest-visible sysreg". 6955 * STATE_BOTH definitions are also always "standard 6956 * sysreg" in their AArch64 view (the .cp value may 6957 * be non-zero for the benefit of the AArch32 view). 6958 */ 6959 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) { 6960 r2->cp = CP_REG_ARM64_SYSREG_CP; 6961 } 6962 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm, 6963 r2->opc0, opc1, opc2); 6964 } else { 6965 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2); 6966 } 6967 if (opaque) { 6968 r2->opaque = opaque; 6969 } 6970 /* reginfo passed to helpers is correct for the actual access, 6971 * and is never ARM_CP_STATE_BOTH: 6972 */ 6973 r2->state = state; 6974 /* Make sure reginfo passed to helpers for wildcarded regs 6975 * has the correct crm/opc1/opc2 for this reg, not CP_ANY: 6976 */ 6977 r2->crm = crm; 6978 r2->opc1 = opc1; 6979 r2->opc2 = opc2; 6980 /* By convention, for wildcarded registers only the first 6981 * entry is used for migration; the others are marked as 6982 * ALIAS so we don't try to transfer the register 6983 * multiple times. Special registers (ie NOP/WFI) are 6984 * never migratable and not even raw-accessible. 6985 */ 6986 if ((r->type & ARM_CP_SPECIAL)) { 6987 r2->type |= ARM_CP_NO_RAW; 6988 } 6989 if (((r->crm == CP_ANY) && crm != 0) || 6990 ((r->opc1 == CP_ANY) && opc1 != 0) || 6991 ((r->opc2 == CP_ANY) && opc2 != 0)) { 6992 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 6993 } 6994 6995 /* Check that raw accesses are either forbidden or handled. Note that 6996 * we can't assert this earlier because the setup of fieldoffset for 6997 * banked registers has to be done first. 6998 */ 6999 if (!(r2->type & ARM_CP_NO_RAW)) { 7000 assert(!raw_accessors_invalid(r2)); 7001 } 7002 7003 /* Overriding of an existing definition must be explicitly 7004 * requested. 7005 */ 7006 if (!(r->type & ARM_CP_OVERRIDE)) { 7007 ARMCPRegInfo *oldreg; 7008 oldreg = g_hash_table_lookup(cpu->cp_regs, key); 7009 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) { 7010 fprintf(stderr, "Register redefined: cp=%d %d bit " 7011 "crn=%d crm=%d opc1=%d opc2=%d, " 7012 "was %s, now %s\n", r2->cp, 32 + 32 * is64, 7013 r2->crn, r2->crm, r2->opc1, r2->opc2, 7014 oldreg->name, r2->name); 7015 g_assert_not_reached(); 7016 } 7017 } 7018 g_hash_table_insert(cpu->cp_regs, key, r2); 7019 } 7020 7021 7022 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 7023 const ARMCPRegInfo *r, void *opaque) 7024 { 7025 /* Define implementations of coprocessor registers. 7026 * We store these in a hashtable because typically 7027 * there are less than 150 registers in a space which 7028 * is 16*16*16*8*8 = 262144 in size. 7029 * Wildcarding is supported for the crm, opc1 and opc2 fields. 7030 * If a register is defined twice then the second definition is 7031 * used, so this can be used to define some generic registers and 7032 * then override them with implementation specific variations. 7033 * At least one of the original and the second definition should 7034 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 7035 * against accidental use. 7036 * 7037 * The state field defines whether the register is to be 7038 * visible in the AArch32 or AArch64 execution state. If the 7039 * state is set to ARM_CP_STATE_BOTH then we synthesise a 7040 * reginfo structure for the AArch32 view, which sees the lower 7041 * 32 bits of the 64 bit register. 7042 * 7043 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 7044 * be wildcarded. AArch64 registers are always considered to be 64 7045 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 7046 * the register, if any. 7047 */ 7048 int crm, opc1, opc2, state; 7049 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 7050 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 7051 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 7052 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 7053 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 7054 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 7055 /* 64 bit registers have only CRm and Opc1 fields */ 7056 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 7057 /* op0 only exists in the AArch64 encodings */ 7058 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 7059 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 7060 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 7061 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1 7062 * encodes a minimum access level for the register. We roll this 7063 * runtime check into our general permission check code, so check 7064 * here that the reginfo's specified permissions are strict enough 7065 * to encompass the generic architectural permission check. 7066 */ 7067 if (r->state != ARM_CP_STATE_AA32) { 7068 int mask = 0; 7069 switch (r->opc1) { 7070 case 0: 7071 /* min_EL EL1, but some accessible to EL0 via kernel ABI */ 7072 mask = PL0U_R | PL1_RW; 7073 break; 7074 case 1: case 2: 7075 /* min_EL EL1 */ 7076 mask = PL1_RW; 7077 break; 7078 case 3: 7079 /* min_EL EL0 */ 7080 mask = PL0_RW; 7081 break; 7082 case 4: 7083 /* min_EL EL2 */ 7084 mask = PL2_RW; 7085 break; 7086 case 5: 7087 /* unallocated encoding, so not possible */ 7088 assert(false); 7089 break; 7090 case 6: 7091 /* min_EL EL3 */ 7092 mask = PL3_RW; 7093 break; 7094 case 7: 7095 /* min_EL EL1, secure mode only (we don't check the latter) */ 7096 mask = PL1_RW; 7097 break; 7098 default: 7099 /* broken reginfo with out-of-range opc1 */ 7100 assert(false); 7101 break; 7102 } 7103 /* assert our permissions are not too lax (stricter is fine) */ 7104 assert((r->access & ~mask) == 0); 7105 } 7106 7107 /* Check that the register definition has enough info to handle 7108 * reads and writes if they are permitted. 7109 */ 7110 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) { 7111 if (r->access & PL3_R) { 7112 assert((r->fieldoffset || 7113 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 7114 r->readfn); 7115 } 7116 if (r->access & PL3_W) { 7117 assert((r->fieldoffset || 7118 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 7119 r->writefn); 7120 } 7121 } 7122 /* Bad type field probably means missing sentinel at end of reg list */ 7123 assert(cptype_valid(r->type)); 7124 for (crm = crmmin; crm <= crmmax; crm++) { 7125 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 7126 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 7127 for (state = ARM_CP_STATE_AA32; 7128 state <= ARM_CP_STATE_AA64; state++) { 7129 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 7130 continue; 7131 } 7132 if (state == ARM_CP_STATE_AA32) { 7133 /* Under AArch32 CP registers can be common 7134 * (same for secure and non-secure world) or banked. 7135 */ 7136 char *name; 7137 7138 switch (r->secure) { 7139 case ARM_CP_SECSTATE_S: 7140 case ARM_CP_SECSTATE_NS: 7141 add_cpreg_to_hashtable(cpu, r, opaque, state, 7142 r->secure, crm, opc1, opc2, 7143 r->name); 7144 break; 7145 default: 7146 name = g_strdup_printf("%s_S", r->name); 7147 add_cpreg_to_hashtable(cpu, r, opaque, state, 7148 ARM_CP_SECSTATE_S, 7149 crm, opc1, opc2, name); 7150 g_free(name); 7151 add_cpreg_to_hashtable(cpu, r, opaque, state, 7152 ARM_CP_SECSTATE_NS, 7153 crm, opc1, opc2, r->name); 7154 break; 7155 } 7156 } else { 7157 /* AArch64 registers get mapped to non-secure instance 7158 * of AArch32 */ 7159 add_cpreg_to_hashtable(cpu, r, opaque, state, 7160 ARM_CP_SECSTATE_NS, 7161 crm, opc1, opc2, r->name); 7162 } 7163 } 7164 } 7165 } 7166 } 7167 } 7168 7169 void define_arm_cp_regs_with_opaque(ARMCPU *cpu, 7170 const ARMCPRegInfo *regs, void *opaque) 7171 { 7172 /* Define a whole list of registers */ 7173 const ARMCPRegInfo *r; 7174 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 7175 define_one_arm_cp_reg_with_opaque(cpu, r, opaque); 7176 } 7177 } 7178 7179 /* 7180 * Modify ARMCPRegInfo for access from userspace. 7181 * 7182 * This is a data driven modification directed by 7183 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as 7184 * user-space cannot alter any values and dynamic values pertaining to 7185 * execution state are hidden from user space view anyway. 7186 */ 7187 void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods) 7188 { 7189 const ARMCPRegUserSpaceInfo *m; 7190 ARMCPRegInfo *r; 7191 7192 for (m = mods; m->name; m++) { 7193 GPatternSpec *pat = NULL; 7194 if (m->is_glob) { 7195 pat = g_pattern_spec_new(m->name); 7196 } 7197 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 7198 if (pat && g_pattern_match_string(pat, r->name)) { 7199 r->type = ARM_CP_CONST; 7200 r->access = PL0U_R; 7201 r->resetvalue = 0; 7202 /* continue */ 7203 } else if (strcmp(r->name, m->name) == 0) { 7204 r->type = ARM_CP_CONST; 7205 r->access = PL0U_R; 7206 r->resetvalue &= m->exported_bits; 7207 r->resetvalue |= m->fixed_bits; 7208 break; 7209 } 7210 } 7211 if (pat) { 7212 g_pattern_spec_free(pat); 7213 } 7214 } 7215 } 7216 7217 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 7218 { 7219 return g_hash_table_lookup(cpregs, &encoded_cp); 7220 } 7221 7222 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 7223 uint64_t value) 7224 { 7225 /* Helper coprocessor write function for write-ignore registers */ 7226 } 7227 7228 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 7229 { 7230 /* Helper coprocessor write function for read-as-zero registers */ 7231 return 0; 7232 } 7233 7234 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 7235 { 7236 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 7237 } 7238 7239 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 7240 { 7241 /* Return true if it is not valid for us to switch to 7242 * this CPU mode (ie all the UNPREDICTABLE cases in 7243 * the ARM ARM CPSRWriteByInstr pseudocode). 7244 */ 7245 7246 /* Changes to or from Hyp via MSR and CPS are illegal. */ 7247 if (write_type == CPSRWriteByInstr && 7248 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 7249 mode == ARM_CPU_MODE_HYP)) { 7250 return 1; 7251 } 7252 7253 switch (mode) { 7254 case ARM_CPU_MODE_USR: 7255 return 0; 7256 case ARM_CPU_MODE_SYS: 7257 case ARM_CPU_MODE_SVC: 7258 case ARM_CPU_MODE_ABT: 7259 case ARM_CPU_MODE_UND: 7260 case ARM_CPU_MODE_IRQ: 7261 case ARM_CPU_MODE_FIQ: 7262 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7 7263 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 7264 */ 7265 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 7266 * and CPS are treated as illegal mode changes. 7267 */ 7268 if (write_type == CPSRWriteByInstr && 7269 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 7270 (arm_hcr_el2_eff(env) & HCR_TGE)) { 7271 return 1; 7272 } 7273 return 0; 7274 case ARM_CPU_MODE_HYP: 7275 return !arm_feature(env, ARM_FEATURE_EL2) 7276 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env); 7277 case ARM_CPU_MODE_MON: 7278 return arm_current_el(env) < 3; 7279 default: 7280 return 1; 7281 } 7282 } 7283 7284 uint32_t cpsr_read(CPUARMState *env) 7285 { 7286 int ZF; 7287 ZF = (env->ZF == 0); 7288 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 7289 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 7290 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 7291 | ((env->condexec_bits & 0xfc) << 8) 7292 | (env->GE << 16) | (env->daif & CPSR_AIF); 7293 } 7294 7295 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 7296 CPSRWriteType write_type) 7297 { 7298 uint32_t changed_daif; 7299 7300 if (mask & CPSR_NZCV) { 7301 env->ZF = (~val) & CPSR_Z; 7302 env->NF = val; 7303 env->CF = (val >> 29) & 1; 7304 env->VF = (val << 3) & 0x80000000; 7305 } 7306 if (mask & CPSR_Q) 7307 env->QF = ((val & CPSR_Q) != 0); 7308 if (mask & CPSR_T) 7309 env->thumb = ((val & CPSR_T) != 0); 7310 if (mask & CPSR_IT_0_1) { 7311 env->condexec_bits &= ~3; 7312 env->condexec_bits |= (val >> 25) & 3; 7313 } 7314 if (mask & CPSR_IT_2_7) { 7315 env->condexec_bits &= 3; 7316 env->condexec_bits |= (val >> 8) & 0xfc; 7317 } 7318 if (mask & CPSR_GE) { 7319 env->GE = (val >> 16) & 0xf; 7320 } 7321 7322 /* In a V7 implementation that includes the security extensions but does 7323 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 7324 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 7325 * bits respectively. 7326 * 7327 * In a V8 implementation, it is permitted for privileged software to 7328 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 7329 */ 7330 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 7331 arm_feature(env, ARM_FEATURE_EL3) && 7332 !arm_feature(env, ARM_FEATURE_EL2) && 7333 !arm_is_secure(env)) { 7334 7335 changed_daif = (env->daif ^ val) & mask; 7336 7337 if (changed_daif & CPSR_A) { 7338 /* Check to see if we are allowed to change the masking of async 7339 * abort exceptions from a non-secure state. 7340 */ 7341 if (!(env->cp15.scr_el3 & SCR_AW)) { 7342 qemu_log_mask(LOG_GUEST_ERROR, 7343 "Ignoring attempt to switch CPSR_A flag from " 7344 "non-secure world with SCR.AW bit clear\n"); 7345 mask &= ~CPSR_A; 7346 } 7347 } 7348 7349 if (changed_daif & CPSR_F) { 7350 /* Check to see if we are allowed to change the masking of FIQ 7351 * exceptions from a non-secure state. 7352 */ 7353 if (!(env->cp15.scr_el3 & SCR_FW)) { 7354 qemu_log_mask(LOG_GUEST_ERROR, 7355 "Ignoring attempt to switch CPSR_F flag from " 7356 "non-secure world with SCR.FW bit clear\n"); 7357 mask &= ~CPSR_F; 7358 } 7359 7360 /* Check whether non-maskable FIQ (NMFI) support is enabled. 7361 * If this bit is set software is not allowed to mask 7362 * FIQs, but is allowed to set CPSR_F to 0. 7363 */ 7364 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 7365 (val & CPSR_F)) { 7366 qemu_log_mask(LOG_GUEST_ERROR, 7367 "Ignoring attempt to enable CPSR_F flag " 7368 "(non-maskable FIQ [NMFI] support enabled)\n"); 7369 mask &= ~CPSR_F; 7370 } 7371 } 7372 } 7373 7374 env->daif &= ~(CPSR_AIF & mask); 7375 env->daif |= val & CPSR_AIF & mask; 7376 7377 if (write_type != CPSRWriteRaw && 7378 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 7379 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 7380 /* Note that we can only get here in USR mode if this is a 7381 * gdb stub write; for this case we follow the architectural 7382 * behaviour for guest writes in USR mode of ignoring an attempt 7383 * to switch mode. (Those are caught by translate.c for writes 7384 * triggered by guest instructions.) 7385 */ 7386 mask &= ~CPSR_M; 7387 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 7388 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in 7389 * v7, and has defined behaviour in v8: 7390 * + leave CPSR.M untouched 7391 * + allow changes to the other CPSR fields 7392 * + set PSTATE.IL 7393 * For user changes via the GDB stub, we don't set PSTATE.IL, 7394 * as this would be unnecessarily harsh for a user error. 7395 */ 7396 mask &= ~CPSR_M; 7397 if (write_type != CPSRWriteByGDBStub && 7398 arm_feature(env, ARM_FEATURE_V8)) { 7399 mask |= CPSR_IL; 7400 val |= CPSR_IL; 7401 } 7402 qemu_log_mask(LOG_GUEST_ERROR, 7403 "Illegal AArch32 mode switch attempt from %s to %s\n", 7404 aarch32_mode_name(env->uncached_cpsr), 7405 aarch32_mode_name(val)); 7406 } else { 7407 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 7408 write_type == CPSRWriteExceptionReturn ? 7409 "Exception return from AArch32" : 7410 "AArch32 mode switch from", 7411 aarch32_mode_name(env->uncached_cpsr), 7412 aarch32_mode_name(val), env->regs[15]); 7413 switch_mode(env, val & CPSR_M); 7414 } 7415 } 7416 mask &= ~CACHED_CPSR_BITS; 7417 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 7418 } 7419 7420 /* Sign/zero extend */ 7421 uint32_t HELPER(sxtb16)(uint32_t x) 7422 { 7423 uint32_t res; 7424 res = (uint16_t)(int8_t)x; 7425 res |= (uint32_t)(int8_t)(x >> 16) << 16; 7426 return res; 7427 } 7428 7429 uint32_t HELPER(uxtb16)(uint32_t x) 7430 { 7431 uint32_t res; 7432 res = (uint16_t)(uint8_t)x; 7433 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 7434 return res; 7435 } 7436 7437 int32_t HELPER(sdiv)(int32_t num, int32_t den) 7438 { 7439 if (den == 0) 7440 return 0; 7441 if (num == INT_MIN && den == -1) 7442 return INT_MIN; 7443 return num / den; 7444 } 7445 7446 uint32_t HELPER(udiv)(uint32_t num, uint32_t den) 7447 { 7448 if (den == 0) 7449 return 0; 7450 return num / den; 7451 } 7452 7453 uint32_t HELPER(rbit)(uint32_t x) 7454 { 7455 return revbit32(x); 7456 } 7457 7458 #ifdef CONFIG_USER_ONLY 7459 7460 static void switch_mode(CPUARMState *env, int mode) 7461 { 7462 ARMCPU *cpu = env_archcpu(env); 7463 7464 if (mode != ARM_CPU_MODE_USR) { 7465 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 7466 } 7467 } 7468 7469 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7470 uint32_t cur_el, bool secure) 7471 { 7472 return 1; 7473 } 7474 7475 void aarch64_sync_64_to_32(CPUARMState *env) 7476 { 7477 g_assert_not_reached(); 7478 } 7479 7480 #else 7481 7482 static void switch_mode(CPUARMState *env, int mode) 7483 { 7484 int old_mode; 7485 int i; 7486 7487 old_mode = env->uncached_cpsr & CPSR_M; 7488 if (mode == old_mode) 7489 return; 7490 7491 if (old_mode == ARM_CPU_MODE_FIQ) { 7492 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7493 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 7494 } else if (mode == ARM_CPU_MODE_FIQ) { 7495 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7496 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 7497 } 7498 7499 i = bank_number(old_mode); 7500 env->banked_r13[i] = env->regs[13]; 7501 env->banked_spsr[i] = env->spsr; 7502 7503 i = bank_number(mode); 7504 env->regs[13] = env->banked_r13[i]; 7505 env->spsr = env->banked_spsr[i]; 7506 7507 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 7508 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 7509 } 7510 7511 /* Physical Interrupt Target EL Lookup Table 7512 * 7513 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 7514 * 7515 * The below multi-dimensional table is used for looking up the target 7516 * exception level given numerous condition criteria. Specifically, the 7517 * target EL is based on SCR and HCR routing controls as well as the 7518 * currently executing EL and secure state. 7519 * 7520 * Dimensions: 7521 * target_el_table[2][2][2][2][2][4] 7522 * | | | | | +--- Current EL 7523 * | | | | +------ Non-secure(0)/Secure(1) 7524 * | | | +--------- HCR mask override 7525 * | | +------------ SCR exec state control 7526 * | +--------------- SCR mask override 7527 * +------------------ 32-bit(0)/64-bit(1) EL3 7528 * 7529 * The table values are as such: 7530 * 0-3 = EL0-EL3 7531 * -1 = Cannot occur 7532 * 7533 * The ARM ARM target EL table includes entries indicating that an "exception 7534 * is not taken". The two cases where this is applicable are: 7535 * 1) An exception is taken from EL3 but the SCR does not have the exception 7536 * routed to EL3. 7537 * 2) An exception is taken from EL2 but the HCR does not have the exception 7538 * routed to EL2. 7539 * In these two cases, the below table contain a target of EL1. This value is 7540 * returned as it is expected that the consumer of the table data will check 7541 * for "target EL >= current EL" to ensure the exception is not taken. 7542 * 7543 * SCR HCR 7544 * 64 EA AMO From 7545 * BIT IRQ IMO Non-secure Secure 7546 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 7547 */ 7548 static const int8_t target_el_table[2][2][2][2][2][4] = { 7549 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7550 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 7551 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7552 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 7553 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7554 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 7555 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7556 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 7557 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 7558 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},}, 7559 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },}, 7560 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},}, 7561 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7562 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 7563 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7564 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},}, 7565 }; 7566 7567 /* 7568 * Determine the target EL for physical exceptions 7569 */ 7570 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7571 uint32_t cur_el, bool secure) 7572 { 7573 CPUARMState *env = cs->env_ptr; 7574 bool rw; 7575 bool scr; 7576 bool hcr; 7577 int target_el; 7578 /* Is the highest EL AArch64? */ 7579 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 7580 uint64_t hcr_el2; 7581 7582 if (arm_feature(env, ARM_FEATURE_EL3)) { 7583 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 7584 } else { 7585 /* Either EL2 is the highest EL (and so the EL2 register width 7586 * is given by is64); or there is no EL2 or EL3, in which case 7587 * the value of 'rw' does not affect the table lookup anyway. 7588 */ 7589 rw = is64; 7590 } 7591 7592 hcr_el2 = arm_hcr_el2_eff(env); 7593 switch (excp_idx) { 7594 case EXCP_IRQ: 7595 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 7596 hcr = hcr_el2 & HCR_IMO; 7597 break; 7598 case EXCP_FIQ: 7599 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 7600 hcr = hcr_el2 & HCR_FMO; 7601 break; 7602 default: 7603 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 7604 hcr = hcr_el2 & HCR_AMO; 7605 break; 7606 }; 7607 7608 /* Perform a table-lookup for the target EL given the current state */ 7609 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 7610 7611 assert(target_el > 0); 7612 7613 return target_el; 7614 } 7615 7616 void arm_log_exception(int idx) 7617 { 7618 if (qemu_loglevel_mask(CPU_LOG_INT)) { 7619 const char *exc = NULL; 7620 static const char * const excnames[] = { 7621 [EXCP_UDEF] = "Undefined Instruction", 7622 [EXCP_SWI] = "SVC", 7623 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 7624 [EXCP_DATA_ABORT] = "Data Abort", 7625 [EXCP_IRQ] = "IRQ", 7626 [EXCP_FIQ] = "FIQ", 7627 [EXCP_BKPT] = "Breakpoint", 7628 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 7629 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 7630 [EXCP_HVC] = "Hypervisor Call", 7631 [EXCP_HYP_TRAP] = "Hypervisor Trap", 7632 [EXCP_SMC] = "Secure Monitor Call", 7633 [EXCP_VIRQ] = "Virtual IRQ", 7634 [EXCP_VFIQ] = "Virtual FIQ", 7635 [EXCP_SEMIHOST] = "Semihosting call", 7636 [EXCP_NOCP] = "v7M NOCP UsageFault", 7637 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 7638 [EXCP_STKOF] = "v8M STKOF UsageFault", 7639 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking", 7640 [EXCP_LSERR] = "v8M LSERR UsageFault", 7641 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault", 7642 }; 7643 7644 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 7645 exc = excnames[idx]; 7646 } 7647 if (!exc) { 7648 exc = "unknown"; 7649 } 7650 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc); 7651 } 7652 } 7653 7654 /* 7655 * Function used to synchronize QEMU's AArch64 register set with AArch32 7656 * register set. This is necessary when switching between AArch32 and AArch64 7657 * execution state. 7658 */ 7659 void aarch64_sync_32_to_64(CPUARMState *env) 7660 { 7661 int i; 7662 uint32_t mode = env->uncached_cpsr & CPSR_M; 7663 7664 /* We can blanket copy R[0:7] to X[0:7] */ 7665 for (i = 0; i < 8; i++) { 7666 env->xregs[i] = env->regs[i]; 7667 } 7668 7669 /* 7670 * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 7671 * Otherwise, they come from the banked user regs. 7672 */ 7673 if (mode == ARM_CPU_MODE_FIQ) { 7674 for (i = 8; i < 13; i++) { 7675 env->xregs[i] = env->usr_regs[i - 8]; 7676 } 7677 } else { 7678 for (i = 8; i < 13; i++) { 7679 env->xregs[i] = env->regs[i]; 7680 } 7681 } 7682 7683 /* 7684 * Registers x13-x23 are the various mode SP and FP registers. Registers 7685 * r13 and r14 are only copied if we are in that mode, otherwise we copy 7686 * from the mode banked register. 7687 */ 7688 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 7689 env->xregs[13] = env->regs[13]; 7690 env->xregs[14] = env->regs[14]; 7691 } else { 7692 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 7693 /* HYP is an exception in that it is copied from r14 */ 7694 if (mode == ARM_CPU_MODE_HYP) { 7695 env->xregs[14] = env->regs[14]; 7696 } else { 7697 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 7698 } 7699 } 7700 7701 if (mode == ARM_CPU_MODE_HYP) { 7702 env->xregs[15] = env->regs[13]; 7703 } else { 7704 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 7705 } 7706 7707 if (mode == ARM_CPU_MODE_IRQ) { 7708 env->xregs[16] = env->regs[14]; 7709 env->xregs[17] = env->regs[13]; 7710 } else { 7711 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 7712 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 7713 } 7714 7715 if (mode == ARM_CPU_MODE_SVC) { 7716 env->xregs[18] = env->regs[14]; 7717 env->xregs[19] = env->regs[13]; 7718 } else { 7719 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 7720 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 7721 } 7722 7723 if (mode == ARM_CPU_MODE_ABT) { 7724 env->xregs[20] = env->regs[14]; 7725 env->xregs[21] = env->regs[13]; 7726 } else { 7727 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 7728 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 7729 } 7730 7731 if (mode == ARM_CPU_MODE_UND) { 7732 env->xregs[22] = env->regs[14]; 7733 env->xregs[23] = env->regs[13]; 7734 } else { 7735 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 7736 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 7737 } 7738 7739 /* 7740 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 7741 * mode, then we can copy from r8-r14. Otherwise, we copy from the 7742 * FIQ bank for r8-r14. 7743 */ 7744 if (mode == ARM_CPU_MODE_FIQ) { 7745 for (i = 24; i < 31; i++) { 7746 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 7747 } 7748 } else { 7749 for (i = 24; i < 29; i++) { 7750 env->xregs[i] = env->fiq_regs[i - 24]; 7751 } 7752 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 7753 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 7754 } 7755 7756 env->pc = env->regs[15]; 7757 } 7758 7759 /* 7760 * Function used to synchronize QEMU's AArch32 register set with AArch64 7761 * register set. This is necessary when switching between AArch32 and AArch64 7762 * execution state. 7763 */ 7764 void aarch64_sync_64_to_32(CPUARMState *env) 7765 { 7766 int i; 7767 uint32_t mode = env->uncached_cpsr & CPSR_M; 7768 7769 /* We can blanket copy X[0:7] to R[0:7] */ 7770 for (i = 0; i < 8; i++) { 7771 env->regs[i] = env->xregs[i]; 7772 } 7773 7774 /* 7775 * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 7776 * Otherwise, we copy x8-x12 into the banked user regs. 7777 */ 7778 if (mode == ARM_CPU_MODE_FIQ) { 7779 for (i = 8; i < 13; i++) { 7780 env->usr_regs[i - 8] = env->xregs[i]; 7781 } 7782 } else { 7783 for (i = 8; i < 13; i++) { 7784 env->regs[i] = env->xregs[i]; 7785 } 7786 } 7787 7788 /* 7789 * Registers r13 & r14 depend on the current mode. 7790 * If we are in a given mode, we copy the corresponding x registers to r13 7791 * and r14. Otherwise, we copy the x register to the banked r13 and r14 7792 * for the mode. 7793 */ 7794 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 7795 env->regs[13] = env->xregs[13]; 7796 env->regs[14] = env->xregs[14]; 7797 } else { 7798 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 7799 7800 /* 7801 * HYP is an exception in that it does not have its own banked r14 but 7802 * shares the USR r14 7803 */ 7804 if (mode == ARM_CPU_MODE_HYP) { 7805 env->regs[14] = env->xregs[14]; 7806 } else { 7807 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 7808 } 7809 } 7810 7811 if (mode == ARM_CPU_MODE_HYP) { 7812 env->regs[13] = env->xregs[15]; 7813 } else { 7814 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 7815 } 7816 7817 if (mode == ARM_CPU_MODE_IRQ) { 7818 env->regs[14] = env->xregs[16]; 7819 env->regs[13] = env->xregs[17]; 7820 } else { 7821 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 7822 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 7823 } 7824 7825 if (mode == ARM_CPU_MODE_SVC) { 7826 env->regs[14] = env->xregs[18]; 7827 env->regs[13] = env->xregs[19]; 7828 } else { 7829 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 7830 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 7831 } 7832 7833 if (mode == ARM_CPU_MODE_ABT) { 7834 env->regs[14] = env->xregs[20]; 7835 env->regs[13] = env->xregs[21]; 7836 } else { 7837 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 7838 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 7839 } 7840 7841 if (mode == ARM_CPU_MODE_UND) { 7842 env->regs[14] = env->xregs[22]; 7843 env->regs[13] = env->xregs[23]; 7844 } else { 7845 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 7846 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 7847 } 7848 7849 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 7850 * mode, then we can copy to r8-r14. Otherwise, we copy to the 7851 * FIQ bank for r8-r14. 7852 */ 7853 if (mode == ARM_CPU_MODE_FIQ) { 7854 for (i = 24; i < 31; i++) { 7855 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 7856 } 7857 } else { 7858 for (i = 24; i < 29; i++) { 7859 env->fiq_regs[i - 24] = env->xregs[i]; 7860 } 7861 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 7862 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 7863 } 7864 7865 env->regs[15] = env->pc; 7866 } 7867 7868 static void take_aarch32_exception(CPUARMState *env, int new_mode, 7869 uint32_t mask, uint32_t offset, 7870 uint32_t newpc) 7871 { 7872 /* Change the CPU state so as to actually take the exception. */ 7873 switch_mode(env, new_mode); 7874 /* 7875 * For exceptions taken to AArch32 we must clear the SS bit in both 7876 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 7877 */ 7878 env->uncached_cpsr &= ~PSTATE_SS; 7879 env->spsr = cpsr_read(env); 7880 /* Clear IT bits. */ 7881 env->condexec_bits = 0; 7882 /* Switch to the new mode, and to the correct instruction set. */ 7883 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 7884 /* Set new mode endianness */ 7885 env->uncached_cpsr &= ~CPSR_E; 7886 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) { 7887 env->uncached_cpsr |= CPSR_E; 7888 } 7889 /* J and IL must always be cleared for exception entry */ 7890 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 7891 env->daif |= mask; 7892 7893 if (new_mode == ARM_CPU_MODE_HYP) { 7894 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 7895 env->elr_el[2] = env->regs[15]; 7896 } else { 7897 /* 7898 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 7899 * and we should just guard the thumb mode on V4 7900 */ 7901 if (arm_feature(env, ARM_FEATURE_V4T)) { 7902 env->thumb = 7903 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 7904 } 7905 env->regs[14] = env->regs[15] + offset; 7906 } 7907 env->regs[15] = newpc; 7908 } 7909 7910 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 7911 { 7912 /* 7913 * Handle exception entry to Hyp mode; this is sufficiently 7914 * different to entry to other AArch32 modes that we handle it 7915 * separately here. 7916 * 7917 * The vector table entry used is always the 0x14 Hyp mode entry point, 7918 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp. 7919 * The offset applied to the preferred return address is always zero 7920 * (see DDI0487C.a section G1.12.3). 7921 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 7922 */ 7923 uint32_t addr, mask; 7924 ARMCPU *cpu = ARM_CPU(cs); 7925 CPUARMState *env = &cpu->env; 7926 7927 switch (cs->exception_index) { 7928 case EXCP_UDEF: 7929 addr = 0x04; 7930 break; 7931 case EXCP_SWI: 7932 addr = 0x14; 7933 break; 7934 case EXCP_BKPT: 7935 /* Fall through to prefetch abort. */ 7936 case EXCP_PREFETCH_ABORT: 7937 env->cp15.ifar_s = env->exception.vaddress; 7938 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 7939 (uint32_t)env->exception.vaddress); 7940 addr = 0x0c; 7941 break; 7942 case EXCP_DATA_ABORT: 7943 env->cp15.dfar_s = env->exception.vaddress; 7944 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 7945 (uint32_t)env->exception.vaddress); 7946 addr = 0x10; 7947 break; 7948 case EXCP_IRQ: 7949 addr = 0x18; 7950 break; 7951 case EXCP_FIQ: 7952 addr = 0x1c; 7953 break; 7954 case EXCP_HVC: 7955 addr = 0x08; 7956 break; 7957 case EXCP_HYP_TRAP: 7958 addr = 0x14; 7959 default: 7960 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 7961 } 7962 7963 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 7964 if (!arm_feature(env, ARM_FEATURE_V8)) { 7965 /* 7966 * QEMU syndrome values are v8-style. v7 has the IL bit 7967 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 7968 * If this is a v7 CPU, squash the IL bit in those cases. 7969 */ 7970 if (cs->exception_index == EXCP_PREFETCH_ABORT || 7971 (cs->exception_index == EXCP_DATA_ABORT && 7972 !(env->exception.syndrome & ARM_EL_ISV)) || 7973 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 7974 env->exception.syndrome &= ~ARM_EL_IL; 7975 } 7976 } 7977 env->cp15.esr_el[2] = env->exception.syndrome; 7978 } 7979 7980 if (arm_current_el(env) != 2 && addr < 0x14) { 7981 addr = 0x14; 7982 } 7983 7984 mask = 0; 7985 if (!(env->cp15.scr_el3 & SCR_EA)) { 7986 mask |= CPSR_A; 7987 } 7988 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 7989 mask |= CPSR_I; 7990 } 7991 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 7992 mask |= CPSR_F; 7993 } 7994 7995 addr += env->cp15.hvbar; 7996 7997 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 7998 } 7999 8000 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 8001 { 8002 ARMCPU *cpu = ARM_CPU(cs); 8003 CPUARMState *env = &cpu->env; 8004 uint32_t addr; 8005 uint32_t mask; 8006 int new_mode; 8007 uint32_t offset; 8008 uint32_t moe; 8009 8010 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 8011 switch (syn_get_ec(env->exception.syndrome)) { 8012 case EC_BREAKPOINT: 8013 case EC_BREAKPOINT_SAME_EL: 8014 moe = 1; 8015 break; 8016 case EC_WATCHPOINT: 8017 case EC_WATCHPOINT_SAME_EL: 8018 moe = 10; 8019 break; 8020 case EC_AA32_BKPT: 8021 moe = 3; 8022 break; 8023 case EC_VECTORCATCH: 8024 moe = 5; 8025 break; 8026 default: 8027 moe = 0; 8028 break; 8029 } 8030 8031 if (moe) { 8032 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 8033 } 8034 8035 if (env->exception.target_el == 2) { 8036 arm_cpu_do_interrupt_aarch32_hyp(cs); 8037 return; 8038 } 8039 8040 switch (cs->exception_index) { 8041 case EXCP_UDEF: 8042 new_mode = ARM_CPU_MODE_UND; 8043 addr = 0x04; 8044 mask = CPSR_I; 8045 if (env->thumb) 8046 offset = 2; 8047 else 8048 offset = 4; 8049 break; 8050 case EXCP_SWI: 8051 new_mode = ARM_CPU_MODE_SVC; 8052 addr = 0x08; 8053 mask = CPSR_I; 8054 /* The PC already points to the next instruction. */ 8055 offset = 0; 8056 break; 8057 case EXCP_BKPT: 8058 /* Fall through to prefetch abort. */ 8059 case EXCP_PREFETCH_ABORT: 8060 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 8061 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 8062 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 8063 env->exception.fsr, (uint32_t)env->exception.vaddress); 8064 new_mode = ARM_CPU_MODE_ABT; 8065 addr = 0x0c; 8066 mask = CPSR_A | CPSR_I; 8067 offset = 4; 8068 break; 8069 case EXCP_DATA_ABORT: 8070 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 8071 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 8072 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 8073 env->exception.fsr, 8074 (uint32_t)env->exception.vaddress); 8075 new_mode = ARM_CPU_MODE_ABT; 8076 addr = 0x10; 8077 mask = CPSR_A | CPSR_I; 8078 offset = 8; 8079 break; 8080 case EXCP_IRQ: 8081 new_mode = ARM_CPU_MODE_IRQ; 8082 addr = 0x18; 8083 /* Disable IRQ and imprecise data aborts. */ 8084 mask = CPSR_A | CPSR_I; 8085 offset = 4; 8086 if (env->cp15.scr_el3 & SCR_IRQ) { 8087 /* IRQ routed to monitor mode */ 8088 new_mode = ARM_CPU_MODE_MON; 8089 mask |= CPSR_F; 8090 } 8091 break; 8092 case EXCP_FIQ: 8093 new_mode = ARM_CPU_MODE_FIQ; 8094 addr = 0x1c; 8095 /* Disable FIQ, IRQ and imprecise data aborts. */ 8096 mask = CPSR_A | CPSR_I | CPSR_F; 8097 if (env->cp15.scr_el3 & SCR_FIQ) { 8098 /* FIQ routed to monitor mode */ 8099 new_mode = ARM_CPU_MODE_MON; 8100 } 8101 offset = 4; 8102 break; 8103 case EXCP_VIRQ: 8104 new_mode = ARM_CPU_MODE_IRQ; 8105 addr = 0x18; 8106 /* Disable IRQ and imprecise data aborts. */ 8107 mask = CPSR_A | CPSR_I; 8108 offset = 4; 8109 break; 8110 case EXCP_VFIQ: 8111 new_mode = ARM_CPU_MODE_FIQ; 8112 addr = 0x1c; 8113 /* Disable FIQ, IRQ and imprecise data aborts. */ 8114 mask = CPSR_A | CPSR_I | CPSR_F; 8115 offset = 4; 8116 break; 8117 case EXCP_SMC: 8118 new_mode = ARM_CPU_MODE_MON; 8119 addr = 0x08; 8120 mask = CPSR_A | CPSR_I | CPSR_F; 8121 offset = 0; 8122 break; 8123 default: 8124 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 8125 return; /* Never happens. Keep compiler happy. */ 8126 } 8127 8128 if (new_mode == ARM_CPU_MODE_MON) { 8129 addr += env->cp15.mvbar; 8130 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 8131 /* High vectors. When enabled, base address cannot be remapped. */ 8132 addr += 0xffff0000; 8133 } else { 8134 /* ARM v7 architectures provide a vector base address register to remap 8135 * the interrupt vector table. 8136 * This register is only followed in non-monitor mode, and is banked. 8137 * Note: only bits 31:5 are valid. 8138 */ 8139 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 8140 } 8141 8142 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 8143 env->cp15.scr_el3 &= ~SCR_NS; 8144 } 8145 8146 take_aarch32_exception(env, new_mode, mask, offset, addr); 8147 } 8148 8149 /* Handle exception entry to a target EL which is using AArch64 */ 8150 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 8151 { 8152 ARMCPU *cpu = ARM_CPU(cs); 8153 CPUARMState *env = &cpu->env; 8154 unsigned int new_el = env->exception.target_el; 8155 target_ulong addr = env->cp15.vbar_el[new_el]; 8156 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 8157 unsigned int cur_el = arm_current_el(env); 8158 8159 /* 8160 * Note that new_el can never be 0. If cur_el is 0, then 8161 * el0_a64 is is_a64(), else el0_a64 is ignored. 8162 */ 8163 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 8164 8165 if (cur_el < new_el) { 8166 /* Entry vector offset depends on whether the implemented EL 8167 * immediately lower than the target level is using AArch32 or AArch64 8168 */ 8169 bool is_aa64; 8170 8171 switch (new_el) { 8172 case 3: 8173 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 8174 break; 8175 case 2: 8176 is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0; 8177 break; 8178 case 1: 8179 is_aa64 = is_a64(env); 8180 break; 8181 default: 8182 g_assert_not_reached(); 8183 } 8184 8185 if (is_aa64) { 8186 addr += 0x400; 8187 } else { 8188 addr += 0x600; 8189 } 8190 } else if (pstate_read(env) & PSTATE_SP) { 8191 addr += 0x200; 8192 } 8193 8194 switch (cs->exception_index) { 8195 case EXCP_PREFETCH_ABORT: 8196 case EXCP_DATA_ABORT: 8197 env->cp15.far_el[new_el] = env->exception.vaddress; 8198 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 8199 env->cp15.far_el[new_el]); 8200 /* fall through */ 8201 case EXCP_BKPT: 8202 case EXCP_UDEF: 8203 case EXCP_SWI: 8204 case EXCP_HVC: 8205 case EXCP_HYP_TRAP: 8206 case EXCP_SMC: 8207 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) { 8208 /* 8209 * QEMU internal FP/SIMD syndromes from AArch32 include the 8210 * TA and coproc fields which are only exposed if the exception 8211 * is taken to AArch32 Hyp mode. Mask them out to get a valid 8212 * AArch64 format syndrome. 8213 */ 8214 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 8215 } 8216 env->cp15.esr_el[new_el] = env->exception.syndrome; 8217 break; 8218 case EXCP_IRQ: 8219 case EXCP_VIRQ: 8220 addr += 0x80; 8221 break; 8222 case EXCP_FIQ: 8223 case EXCP_VFIQ: 8224 addr += 0x100; 8225 break; 8226 case EXCP_SEMIHOST: 8227 qemu_log_mask(CPU_LOG_INT, 8228 "...handling as semihosting call 0x%" PRIx64 "\n", 8229 env->xregs[0]); 8230 env->xregs[0] = do_arm_semihosting(env); 8231 return; 8232 default: 8233 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 8234 } 8235 8236 if (is_a64(env)) { 8237 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env); 8238 aarch64_save_sp(env, arm_current_el(env)); 8239 env->elr_el[new_el] = env->pc; 8240 } else { 8241 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env); 8242 env->elr_el[new_el] = env->regs[15]; 8243 8244 aarch64_sync_32_to_64(env); 8245 8246 env->condexec_bits = 0; 8247 } 8248 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 8249 env->elr_el[new_el]); 8250 8251 pstate_write(env, PSTATE_DAIF | new_mode); 8252 env->aarch64 = 1; 8253 aarch64_restore_sp(env, new_el); 8254 8255 env->pc = addr; 8256 8257 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 8258 new_el, env->pc, pstate_read(env)); 8259 } 8260 8261 static inline bool check_for_semihosting(CPUState *cs) 8262 { 8263 #ifdef CONFIG_TCG 8264 /* Check whether this exception is a semihosting call; if so 8265 * then handle it and return true; otherwise return false. 8266 */ 8267 ARMCPU *cpu = ARM_CPU(cs); 8268 CPUARMState *env = &cpu->env; 8269 8270 if (is_a64(env)) { 8271 if (cs->exception_index == EXCP_SEMIHOST) { 8272 /* This is always the 64-bit semihosting exception. 8273 * The "is this usermode" and "is semihosting enabled" 8274 * checks have been done at translate time. 8275 */ 8276 qemu_log_mask(CPU_LOG_INT, 8277 "...handling as semihosting call 0x%" PRIx64 "\n", 8278 env->xregs[0]); 8279 env->xregs[0] = do_arm_semihosting(env); 8280 return true; 8281 } 8282 return false; 8283 } else { 8284 uint32_t imm; 8285 8286 /* Only intercept calls from privileged modes, to provide some 8287 * semblance of security. 8288 */ 8289 if (cs->exception_index != EXCP_SEMIHOST && 8290 (!semihosting_enabled() || 8291 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) { 8292 return false; 8293 } 8294 8295 switch (cs->exception_index) { 8296 case EXCP_SEMIHOST: 8297 /* This is always a semihosting call; the "is this usermode" 8298 * and "is semihosting enabled" checks have been done at 8299 * translate time. 8300 */ 8301 break; 8302 case EXCP_SWI: 8303 /* Check for semihosting interrupt. */ 8304 if (env->thumb) { 8305 imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env)) 8306 & 0xff; 8307 if (imm == 0xab) { 8308 break; 8309 } 8310 } else { 8311 imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env)) 8312 & 0xffffff; 8313 if (imm == 0x123456) { 8314 break; 8315 } 8316 } 8317 return false; 8318 case EXCP_BKPT: 8319 /* See if this is a semihosting syscall. */ 8320 if (env->thumb) { 8321 imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) 8322 & 0xff; 8323 if (imm == 0xab) { 8324 env->regs[15] += 2; 8325 break; 8326 } 8327 } 8328 return false; 8329 default: 8330 return false; 8331 } 8332 8333 qemu_log_mask(CPU_LOG_INT, 8334 "...handling as semihosting call 0x%x\n", 8335 env->regs[0]); 8336 env->regs[0] = do_arm_semihosting(env); 8337 return true; 8338 } 8339 #else 8340 return false; 8341 #endif 8342 } 8343 8344 /* Handle a CPU exception for A and R profile CPUs. 8345 * Do any appropriate logging, handle PSCI calls, and then hand off 8346 * to the AArch64-entry or AArch32-entry function depending on the 8347 * target exception level's register width. 8348 */ 8349 void arm_cpu_do_interrupt(CPUState *cs) 8350 { 8351 ARMCPU *cpu = ARM_CPU(cs); 8352 CPUARMState *env = &cpu->env; 8353 unsigned int new_el = env->exception.target_el; 8354 8355 assert(!arm_feature(env, ARM_FEATURE_M)); 8356 8357 arm_log_exception(cs->exception_index); 8358 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 8359 new_el); 8360 if (qemu_loglevel_mask(CPU_LOG_INT) 8361 && !excp_is_internal(cs->exception_index)) { 8362 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 8363 syn_get_ec(env->exception.syndrome), 8364 env->exception.syndrome); 8365 } 8366 8367 if (arm_is_psci_call(cpu, cs->exception_index)) { 8368 arm_handle_psci_call(cpu); 8369 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 8370 return; 8371 } 8372 8373 /* Semihosting semantics depend on the register width of the 8374 * code that caused the exception, not the target exception level, 8375 * so must be handled here. 8376 */ 8377 if (check_for_semihosting(cs)) { 8378 return; 8379 } 8380 8381 /* Hooks may change global state so BQL should be held, also the 8382 * BQL needs to be held for any modification of 8383 * cs->interrupt_request. 8384 */ 8385 g_assert(qemu_mutex_iothread_locked()); 8386 8387 arm_call_pre_el_change_hook(cpu); 8388 8389 assert(!excp_is_internal(cs->exception_index)); 8390 if (arm_el_is_aa64(env, new_el)) { 8391 arm_cpu_do_interrupt_aarch64(cs); 8392 } else { 8393 arm_cpu_do_interrupt_aarch32(cs); 8394 } 8395 8396 arm_call_el_change_hook(cpu); 8397 8398 if (!kvm_enabled()) { 8399 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 8400 } 8401 } 8402 #endif /* !CONFIG_USER_ONLY */ 8403 8404 /* Return the exception level which controls this address translation regime */ 8405 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx) 8406 { 8407 switch (mmu_idx) { 8408 case ARMMMUIdx_S2NS: 8409 case ARMMMUIdx_S1E2: 8410 return 2; 8411 case ARMMMUIdx_S1E3: 8412 return 3; 8413 case ARMMMUIdx_S1SE0: 8414 return arm_el_is_aa64(env, 3) ? 1 : 3; 8415 case ARMMMUIdx_S1SE1: 8416 case ARMMMUIdx_S1NSE0: 8417 case ARMMMUIdx_S1NSE1: 8418 case ARMMMUIdx_MPrivNegPri: 8419 case ARMMMUIdx_MUserNegPri: 8420 case ARMMMUIdx_MPriv: 8421 case ARMMMUIdx_MUser: 8422 case ARMMMUIdx_MSPrivNegPri: 8423 case ARMMMUIdx_MSUserNegPri: 8424 case ARMMMUIdx_MSPriv: 8425 case ARMMMUIdx_MSUser: 8426 return 1; 8427 default: 8428 g_assert_not_reached(); 8429 } 8430 } 8431 8432 #ifndef CONFIG_USER_ONLY 8433 8434 /* Return the SCTLR value which controls this address translation regime */ 8435 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx) 8436 { 8437 return env->cp15.sctlr_el[regime_el(env, mmu_idx)]; 8438 } 8439 8440 /* Return true if the specified stage of address translation is disabled */ 8441 static inline bool regime_translation_disabled(CPUARMState *env, 8442 ARMMMUIdx mmu_idx) 8443 { 8444 if (arm_feature(env, ARM_FEATURE_M)) { 8445 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] & 8446 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 8447 case R_V7M_MPU_CTRL_ENABLE_MASK: 8448 /* Enabled, but not for HardFault and NMI */ 8449 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 8450 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 8451 /* Enabled for all cases */ 8452 return false; 8453 case 0: 8454 default: 8455 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 8456 * we warned about that in armv7m_nvic.c when the guest set it. 8457 */ 8458 return true; 8459 } 8460 } 8461 8462 if (mmu_idx == ARMMMUIdx_S2NS) { 8463 /* HCR.DC means HCR.VM behaves as 1 */ 8464 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0; 8465 } 8466 8467 if (env->cp15.hcr_el2 & HCR_TGE) { 8468 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */ 8469 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) { 8470 return true; 8471 } 8472 } 8473 8474 if ((env->cp15.hcr_el2 & HCR_DC) && 8475 (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) { 8476 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 8477 return true; 8478 } 8479 8480 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 8481 } 8482 8483 static inline bool regime_translation_big_endian(CPUARMState *env, 8484 ARMMMUIdx mmu_idx) 8485 { 8486 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 8487 } 8488 8489 /* Return the TTBR associated with this translation regime */ 8490 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, 8491 int ttbrn) 8492 { 8493 if (mmu_idx == ARMMMUIdx_S2NS) { 8494 return env->cp15.vttbr_el2; 8495 } 8496 if (ttbrn == 0) { 8497 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 8498 } else { 8499 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 8500 } 8501 } 8502 8503 #endif /* !CONFIG_USER_ONLY */ 8504 8505 /* Return the TCR controlling this translation regime */ 8506 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx) 8507 { 8508 if (mmu_idx == ARMMMUIdx_S2NS) { 8509 return &env->cp15.vtcr_el2; 8510 } 8511 return &env->cp15.tcr_el[regime_el(env, mmu_idx)]; 8512 } 8513 8514 /* Convert a possible stage1+2 MMU index into the appropriate 8515 * stage 1 MMU index 8516 */ 8517 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 8518 { 8519 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 8520 mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0); 8521 } 8522 return mmu_idx; 8523 } 8524 8525 /* Return true if the translation regime is using LPAE format page tables */ 8526 static inline bool regime_using_lpae_format(CPUARMState *env, 8527 ARMMMUIdx mmu_idx) 8528 { 8529 int el = regime_el(env, mmu_idx); 8530 if (el == 2 || arm_el_is_aa64(env, el)) { 8531 return true; 8532 } 8533 if (arm_feature(env, ARM_FEATURE_LPAE) 8534 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) { 8535 return true; 8536 } 8537 return false; 8538 } 8539 8540 /* Returns true if the stage 1 translation regime is using LPAE format page 8541 * tables. Used when raising alignment exceptions, whose FSR changes depending 8542 * on whether the long or short descriptor format is in use. */ 8543 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx) 8544 { 8545 mmu_idx = stage_1_mmu_idx(mmu_idx); 8546 8547 return regime_using_lpae_format(env, mmu_idx); 8548 } 8549 8550 #ifndef CONFIG_USER_ONLY 8551 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx) 8552 { 8553 switch (mmu_idx) { 8554 case ARMMMUIdx_S1SE0: 8555 case ARMMMUIdx_S1NSE0: 8556 case ARMMMUIdx_MUser: 8557 case ARMMMUIdx_MSUser: 8558 case ARMMMUIdx_MUserNegPri: 8559 case ARMMMUIdx_MSUserNegPri: 8560 return true; 8561 default: 8562 return false; 8563 case ARMMMUIdx_S12NSE0: 8564 case ARMMMUIdx_S12NSE1: 8565 g_assert_not_reached(); 8566 } 8567 } 8568 8569 /* Translate section/page access permissions to page 8570 * R/W protection flags 8571 * 8572 * @env: CPUARMState 8573 * @mmu_idx: MMU index indicating required translation regime 8574 * @ap: The 3-bit access permissions (AP[2:0]) 8575 * @domain_prot: The 2-bit domain access permissions 8576 */ 8577 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 8578 int ap, int domain_prot) 8579 { 8580 bool is_user = regime_is_user(env, mmu_idx); 8581 8582 if (domain_prot == 3) { 8583 return PAGE_READ | PAGE_WRITE; 8584 } 8585 8586 switch (ap) { 8587 case 0: 8588 if (arm_feature(env, ARM_FEATURE_V7)) { 8589 return 0; 8590 } 8591 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 8592 case SCTLR_S: 8593 return is_user ? 0 : PAGE_READ; 8594 case SCTLR_R: 8595 return PAGE_READ; 8596 default: 8597 return 0; 8598 } 8599 case 1: 8600 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 8601 case 2: 8602 if (is_user) { 8603 return PAGE_READ; 8604 } else { 8605 return PAGE_READ | PAGE_WRITE; 8606 } 8607 case 3: 8608 return PAGE_READ | PAGE_WRITE; 8609 case 4: /* Reserved. */ 8610 return 0; 8611 case 5: 8612 return is_user ? 0 : PAGE_READ; 8613 case 6: 8614 return PAGE_READ; 8615 case 7: 8616 if (!arm_feature(env, ARM_FEATURE_V6K)) { 8617 return 0; 8618 } 8619 return PAGE_READ; 8620 default: 8621 g_assert_not_reached(); 8622 } 8623 } 8624 8625 /* Translate section/page access permissions to page 8626 * R/W protection flags. 8627 * 8628 * @ap: The 2-bit simple AP (AP[2:1]) 8629 * @is_user: TRUE if accessing from PL0 8630 */ 8631 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 8632 { 8633 switch (ap) { 8634 case 0: 8635 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 8636 case 1: 8637 return PAGE_READ | PAGE_WRITE; 8638 case 2: 8639 return is_user ? 0 : PAGE_READ; 8640 case 3: 8641 return PAGE_READ; 8642 default: 8643 g_assert_not_reached(); 8644 } 8645 } 8646 8647 static inline int 8648 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 8649 { 8650 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 8651 } 8652 8653 /* Translate S2 section/page access permissions to protection flags 8654 * 8655 * @env: CPUARMState 8656 * @s2ap: The 2-bit stage2 access permissions (S2AP) 8657 * @xn: XN (execute-never) bit 8658 */ 8659 static int get_S2prot(CPUARMState *env, int s2ap, int xn) 8660 { 8661 int prot = 0; 8662 8663 if (s2ap & 1) { 8664 prot |= PAGE_READ; 8665 } 8666 if (s2ap & 2) { 8667 prot |= PAGE_WRITE; 8668 } 8669 if (!xn) { 8670 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 8671 prot |= PAGE_EXEC; 8672 } 8673 } 8674 return prot; 8675 } 8676 8677 /* Translate section/page access permissions to protection flags 8678 * 8679 * @env: CPUARMState 8680 * @mmu_idx: MMU index indicating required translation regime 8681 * @is_aa64: TRUE if AArch64 8682 * @ap: The 2-bit simple AP (AP[2:1]) 8683 * @ns: NS (non-secure) bit 8684 * @xn: XN (execute-never) bit 8685 * @pxn: PXN (privileged execute-never) bit 8686 */ 8687 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 8688 int ap, int ns, int xn, int pxn) 8689 { 8690 bool is_user = regime_is_user(env, mmu_idx); 8691 int prot_rw, user_rw; 8692 bool have_wxn; 8693 int wxn = 0; 8694 8695 assert(mmu_idx != ARMMMUIdx_S2NS); 8696 8697 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 8698 if (is_user) { 8699 prot_rw = user_rw; 8700 } else { 8701 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 8702 } 8703 8704 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 8705 return prot_rw; 8706 } 8707 8708 /* TODO have_wxn should be replaced with 8709 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 8710 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 8711 * compatible processors have EL2, which is required for [U]WXN. 8712 */ 8713 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 8714 8715 if (have_wxn) { 8716 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 8717 } 8718 8719 if (is_aa64) { 8720 switch (regime_el(env, mmu_idx)) { 8721 case 1: 8722 if (!is_user) { 8723 xn = pxn || (user_rw & PAGE_WRITE); 8724 } 8725 break; 8726 case 2: 8727 case 3: 8728 break; 8729 } 8730 } else if (arm_feature(env, ARM_FEATURE_V7)) { 8731 switch (regime_el(env, mmu_idx)) { 8732 case 1: 8733 case 3: 8734 if (is_user) { 8735 xn = xn || !(user_rw & PAGE_READ); 8736 } else { 8737 int uwxn = 0; 8738 if (have_wxn) { 8739 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 8740 } 8741 xn = xn || !(prot_rw & PAGE_READ) || pxn || 8742 (uwxn && (user_rw & PAGE_WRITE)); 8743 } 8744 break; 8745 case 2: 8746 break; 8747 } 8748 } else { 8749 xn = wxn = 0; 8750 } 8751 8752 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 8753 return prot_rw; 8754 } 8755 return prot_rw | PAGE_EXEC; 8756 } 8757 8758 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 8759 uint32_t *table, uint32_t address) 8760 { 8761 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 8762 TCR *tcr = regime_tcr(env, mmu_idx); 8763 8764 if (address & tcr->mask) { 8765 if (tcr->raw_tcr & TTBCR_PD1) { 8766 /* Translation table walk disabled for TTBR1 */ 8767 return false; 8768 } 8769 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 8770 } else { 8771 if (tcr->raw_tcr & TTBCR_PD0) { 8772 /* Translation table walk disabled for TTBR0 */ 8773 return false; 8774 } 8775 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask; 8776 } 8777 *table |= (address >> 18) & 0x3ffc; 8778 return true; 8779 } 8780 8781 /* Translate a S1 pagetable walk through S2 if needed. */ 8782 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx, 8783 hwaddr addr, MemTxAttrs txattrs, 8784 ARMMMUFaultInfo *fi) 8785 { 8786 if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) && 8787 !regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 8788 target_ulong s2size; 8789 hwaddr s2pa; 8790 int s2prot; 8791 int ret; 8792 ARMCacheAttrs cacheattrs = {}; 8793 ARMCacheAttrs *pcacheattrs = NULL; 8794 8795 if (env->cp15.hcr_el2 & HCR_PTW) { 8796 /* 8797 * PTW means we must fault if this S1 walk touches S2 Device 8798 * memory; otherwise we don't care about the attributes and can 8799 * save the S2 translation the effort of computing them. 8800 */ 8801 pcacheattrs = &cacheattrs; 8802 } 8803 8804 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa, 8805 &txattrs, &s2prot, &s2size, fi, pcacheattrs); 8806 if (ret) { 8807 assert(fi->type != ARMFault_None); 8808 fi->s2addr = addr; 8809 fi->stage2 = true; 8810 fi->s1ptw = true; 8811 return ~0; 8812 } 8813 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) { 8814 /* Access was to Device memory: generate Permission fault */ 8815 fi->type = ARMFault_Permission; 8816 fi->s2addr = addr; 8817 fi->stage2 = true; 8818 fi->s1ptw = true; 8819 return ~0; 8820 } 8821 addr = s2pa; 8822 } 8823 return addr; 8824 } 8825 8826 /* All loads done in the course of a page table walk go through here. */ 8827 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure, 8828 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 8829 { 8830 ARMCPU *cpu = ARM_CPU(cs); 8831 CPUARMState *env = &cpu->env; 8832 MemTxAttrs attrs = {}; 8833 MemTxResult result = MEMTX_OK; 8834 AddressSpace *as; 8835 uint32_t data; 8836 8837 attrs.secure = is_secure; 8838 as = arm_addressspace(cs, attrs); 8839 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 8840 if (fi->s1ptw) { 8841 return 0; 8842 } 8843 if (regime_translation_big_endian(env, mmu_idx)) { 8844 data = address_space_ldl_be(as, addr, attrs, &result); 8845 } else { 8846 data = address_space_ldl_le(as, addr, attrs, &result); 8847 } 8848 if (result == MEMTX_OK) { 8849 return data; 8850 } 8851 fi->type = ARMFault_SyncExternalOnWalk; 8852 fi->ea = arm_extabort_type(result); 8853 return 0; 8854 } 8855 8856 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, 8857 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 8858 { 8859 ARMCPU *cpu = ARM_CPU(cs); 8860 CPUARMState *env = &cpu->env; 8861 MemTxAttrs attrs = {}; 8862 MemTxResult result = MEMTX_OK; 8863 AddressSpace *as; 8864 uint64_t data; 8865 8866 attrs.secure = is_secure; 8867 as = arm_addressspace(cs, attrs); 8868 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 8869 if (fi->s1ptw) { 8870 return 0; 8871 } 8872 if (regime_translation_big_endian(env, mmu_idx)) { 8873 data = address_space_ldq_be(as, addr, attrs, &result); 8874 } else { 8875 data = address_space_ldq_le(as, addr, attrs, &result); 8876 } 8877 if (result == MEMTX_OK) { 8878 return data; 8879 } 8880 fi->type = ARMFault_SyncExternalOnWalk; 8881 fi->ea = arm_extabort_type(result); 8882 return 0; 8883 } 8884 8885 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address, 8886 MMUAccessType access_type, ARMMMUIdx mmu_idx, 8887 hwaddr *phys_ptr, int *prot, 8888 target_ulong *page_size, 8889 ARMMMUFaultInfo *fi) 8890 { 8891 CPUState *cs = env_cpu(env); 8892 int level = 1; 8893 uint32_t table; 8894 uint32_t desc; 8895 int type; 8896 int ap; 8897 int domain = 0; 8898 int domain_prot; 8899 hwaddr phys_addr; 8900 uint32_t dacr; 8901 8902 /* Pagetable walk. */ 8903 /* Lookup l1 descriptor. */ 8904 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 8905 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 8906 fi->type = ARMFault_Translation; 8907 goto do_fault; 8908 } 8909 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 8910 mmu_idx, fi); 8911 if (fi->type != ARMFault_None) { 8912 goto do_fault; 8913 } 8914 type = (desc & 3); 8915 domain = (desc >> 5) & 0x0f; 8916 if (regime_el(env, mmu_idx) == 1) { 8917 dacr = env->cp15.dacr_ns; 8918 } else { 8919 dacr = env->cp15.dacr_s; 8920 } 8921 domain_prot = (dacr >> (domain * 2)) & 3; 8922 if (type == 0) { 8923 /* Section translation fault. */ 8924 fi->type = ARMFault_Translation; 8925 goto do_fault; 8926 } 8927 if (type != 2) { 8928 level = 2; 8929 } 8930 if (domain_prot == 0 || domain_prot == 2) { 8931 fi->type = ARMFault_Domain; 8932 goto do_fault; 8933 } 8934 if (type == 2) { 8935 /* 1Mb section. */ 8936 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 8937 ap = (desc >> 10) & 3; 8938 *page_size = 1024 * 1024; 8939 } else { 8940 /* Lookup l2 entry. */ 8941 if (type == 1) { 8942 /* Coarse pagetable. */ 8943 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 8944 } else { 8945 /* Fine pagetable. */ 8946 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 8947 } 8948 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 8949 mmu_idx, fi); 8950 if (fi->type != ARMFault_None) { 8951 goto do_fault; 8952 } 8953 switch (desc & 3) { 8954 case 0: /* Page translation fault. */ 8955 fi->type = ARMFault_Translation; 8956 goto do_fault; 8957 case 1: /* 64k page. */ 8958 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 8959 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 8960 *page_size = 0x10000; 8961 break; 8962 case 2: /* 4k page. */ 8963 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 8964 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 8965 *page_size = 0x1000; 8966 break; 8967 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 8968 if (type == 1) { 8969 /* ARMv6/XScale extended small page format */ 8970 if (arm_feature(env, ARM_FEATURE_XSCALE) 8971 || arm_feature(env, ARM_FEATURE_V6)) { 8972 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 8973 *page_size = 0x1000; 8974 } else { 8975 /* UNPREDICTABLE in ARMv5; we choose to take a 8976 * page translation fault. 8977 */ 8978 fi->type = ARMFault_Translation; 8979 goto do_fault; 8980 } 8981 } else { 8982 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 8983 *page_size = 0x400; 8984 } 8985 ap = (desc >> 4) & 3; 8986 break; 8987 default: 8988 /* Never happens, but compiler isn't smart enough to tell. */ 8989 abort(); 8990 } 8991 } 8992 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 8993 *prot |= *prot ? PAGE_EXEC : 0; 8994 if (!(*prot & (1 << access_type))) { 8995 /* Access permission fault. */ 8996 fi->type = ARMFault_Permission; 8997 goto do_fault; 8998 } 8999 *phys_ptr = phys_addr; 9000 return false; 9001 do_fault: 9002 fi->domain = domain; 9003 fi->level = level; 9004 return true; 9005 } 9006 9007 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, 9008 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9009 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 9010 target_ulong *page_size, ARMMMUFaultInfo *fi) 9011 { 9012 CPUState *cs = env_cpu(env); 9013 int level = 1; 9014 uint32_t table; 9015 uint32_t desc; 9016 uint32_t xn; 9017 uint32_t pxn = 0; 9018 int type; 9019 int ap; 9020 int domain = 0; 9021 int domain_prot; 9022 hwaddr phys_addr; 9023 uint32_t dacr; 9024 bool ns; 9025 9026 /* Pagetable walk. */ 9027 /* Lookup l1 descriptor. */ 9028 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 9029 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 9030 fi->type = ARMFault_Translation; 9031 goto do_fault; 9032 } 9033 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9034 mmu_idx, fi); 9035 if (fi->type != ARMFault_None) { 9036 goto do_fault; 9037 } 9038 type = (desc & 3); 9039 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) { 9040 /* Section translation fault, or attempt to use the encoding 9041 * which is Reserved on implementations without PXN. 9042 */ 9043 fi->type = ARMFault_Translation; 9044 goto do_fault; 9045 } 9046 if ((type == 1) || !(desc & (1 << 18))) { 9047 /* Page or Section. */ 9048 domain = (desc >> 5) & 0x0f; 9049 } 9050 if (regime_el(env, mmu_idx) == 1) { 9051 dacr = env->cp15.dacr_ns; 9052 } else { 9053 dacr = env->cp15.dacr_s; 9054 } 9055 if (type == 1) { 9056 level = 2; 9057 } 9058 domain_prot = (dacr >> (domain * 2)) & 3; 9059 if (domain_prot == 0 || domain_prot == 2) { 9060 /* Section or Page domain fault */ 9061 fi->type = ARMFault_Domain; 9062 goto do_fault; 9063 } 9064 if (type != 1) { 9065 if (desc & (1 << 18)) { 9066 /* Supersection. */ 9067 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 9068 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 9069 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 9070 *page_size = 0x1000000; 9071 } else { 9072 /* Section. */ 9073 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 9074 *page_size = 0x100000; 9075 } 9076 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 9077 xn = desc & (1 << 4); 9078 pxn = desc & 1; 9079 ns = extract32(desc, 19, 1); 9080 } else { 9081 if (arm_feature(env, ARM_FEATURE_PXN)) { 9082 pxn = (desc >> 2) & 1; 9083 } 9084 ns = extract32(desc, 3, 1); 9085 /* Lookup l2 entry. */ 9086 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 9087 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9088 mmu_idx, fi); 9089 if (fi->type != ARMFault_None) { 9090 goto do_fault; 9091 } 9092 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 9093 switch (desc & 3) { 9094 case 0: /* Page translation fault. */ 9095 fi->type = ARMFault_Translation; 9096 goto do_fault; 9097 case 1: /* 64k page. */ 9098 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 9099 xn = desc & (1 << 15); 9100 *page_size = 0x10000; 9101 break; 9102 case 2: case 3: /* 4k page. */ 9103 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 9104 xn = desc & 1; 9105 *page_size = 0x1000; 9106 break; 9107 default: 9108 /* Never happens, but compiler isn't smart enough to tell. */ 9109 abort(); 9110 } 9111 } 9112 if (domain_prot == 3) { 9113 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 9114 } else { 9115 if (pxn && !regime_is_user(env, mmu_idx)) { 9116 xn = 1; 9117 } 9118 if (xn && access_type == MMU_INST_FETCH) { 9119 fi->type = ARMFault_Permission; 9120 goto do_fault; 9121 } 9122 9123 if (arm_feature(env, ARM_FEATURE_V6K) && 9124 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 9125 /* The simplified model uses AP[0] as an access control bit. */ 9126 if ((ap & 1) == 0) { 9127 /* Access flag fault. */ 9128 fi->type = ARMFault_AccessFlag; 9129 goto do_fault; 9130 } 9131 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 9132 } else { 9133 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 9134 } 9135 if (*prot && !xn) { 9136 *prot |= PAGE_EXEC; 9137 } 9138 if (!(*prot & (1 << access_type))) { 9139 /* Access permission fault. */ 9140 fi->type = ARMFault_Permission; 9141 goto do_fault; 9142 } 9143 } 9144 if (ns) { 9145 /* The NS bit will (as required by the architecture) have no effect if 9146 * the CPU doesn't support TZ or this is a non-secure translation 9147 * regime, because the attribute will already be non-secure. 9148 */ 9149 attrs->secure = false; 9150 } 9151 *phys_ptr = phys_addr; 9152 return false; 9153 do_fault: 9154 fi->domain = domain; 9155 fi->level = level; 9156 return true; 9157 } 9158 9159 /* 9160 * check_s2_mmu_setup 9161 * @cpu: ARMCPU 9162 * @is_aa64: True if the translation regime is in AArch64 state 9163 * @startlevel: Suggested starting level 9164 * @inputsize: Bitsize of IPAs 9165 * @stride: Page-table stride (See the ARM ARM) 9166 * 9167 * Returns true if the suggested S2 translation parameters are OK and 9168 * false otherwise. 9169 */ 9170 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, 9171 int inputsize, int stride) 9172 { 9173 const int grainsize = stride + 3; 9174 int startsizecheck; 9175 9176 /* Negative levels are never allowed. */ 9177 if (level < 0) { 9178 return false; 9179 } 9180 9181 startsizecheck = inputsize - ((3 - level) * stride + grainsize); 9182 if (startsizecheck < 1 || startsizecheck > stride + 4) { 9183 return false; 9184 } 9185 9186 if (is_aa64) { 9187 CPUARMState *env = &cpu->env; 9188 unsigned int pamax = arm_pamax(cpu); 9189 9190 switch (stride) { 9191 case 13: /* 64KB Pages. */ 9192 if (level == 0 || (level == 1 && pamax <= 42)) { 9193 return false; 9194 } 9195 break; 9196 case 11: /* 16KB Pages. */ 9197 if (level == 0 || (level == 1 && pamax <= 40)) { 9198 return false; 9199 } 9200 break; 9201 case 9: /* 4KB Pages. */ 9202 if (level == 0 && pamax <= 42) { 9203 return false; 9204 } 9205 break; 9206 default: 9207 g_assert_not_reached(); 9208 } 9209 9210 /* Inputsize checks. */ 9211 if (inputsize > pamax && 9212 (arm_el_is_aa64(env, 1) || inputsize > 40)) { 9213 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */ 9214 return false; 9215 } 9216 } else { 9217 /* AArch32 only supports 4KB pages. Assert on that. */ 9218 assert(stride == 9); 9219 9220 if (level == 0) { 9221 return false; 9222 } 9223 } 9224 return true; 9225 } 9226 9227 /* Translate from the 4-bit stage 2 representation of 9228 * memory attributes (without cache-allocation hints) to 9229 * the 8-bit representation of the stage 1 MAIR registers 9230 * (which includes allocation hints). 9231 * 9232 * ref: shared/translation/attrs/S2AttrDecode() 9233 * .../S2ConvertAttrsHints() 9234 */ 9235 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs) 9236 { 9237 uint8_t hiattr = extract32(s2attrs, 2, 2); 9238 uint8_t loattr = extract32(s2attrs, 0, 2); 9239 uint8_t hihint = 0, lohint = 0; 9240 9241 if (hiattr != 0) { /* normal memory */ 9242 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */ 9243 hiattr = loattr = 1; /* non-cacheable */ 9244 } else { 9245 if (hiattr != 1) { /* Write-through or write-back */ 9246 hihint = 3; /* RW allocate */ 9247 } 9248 if (loattr != 1) { /* Write-through or write-back */ 9249 lohint = 3; /* RW allocate */ 9250 } 9251 } 9252 } 9253 9254 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 9255 } 9256 #endif /* !CONFIG_USER_ONLY */ 9257 9258 ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va, 9259 ARMMMUIdx mmu_idx) 9260 { 9261 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 9262 uint32_t el = regime_el(env, mmu_idx); 9263 bool tbi, tbid, epd, hpd, using16k, using64k; 9264 int select, tsz; 9265 9266 /* 9267 * Bit 55 is always between the two regions, and is canonical for 9268 * determining if address tagging is enabled. 9269 */ 9270 select = extract64(va, 55, 1); 9271 9272 if (el > 1) { 9273 tsz = extract32(tcr, 0, 6); 9274 using64k = extract32(tcr, 14, 1); 9275 using16k = extract32(tcr, 15, 1); 9276 if (mmu_idx == ARMMMUIdx_S2NS) { 9277 /* VTCR_EL2 */ 9278 tbi = tbid = hpd = false; 9279 } else { 9280 tbi = extract32(tcr, 20, 1); 9281 hpd = extract32(tcr, 24, 1); 9282 tbid = extract32(tcr, 29, 1); 9283 } 9284 epd = false; 9285 } else if (!select) { 9286 tsz = extract32(tcr, 0, 6); 9287 epd = extract32(tcr, 7, 1); 9288 using64k = extract32(tcr, 14, 1); 9289 using16k = extract32(tcr, 15, 1); 9290 tbi = extract64(tcr, 37, 1); 9291 hpd = extract64(tcr, 41, 1); 9292 tbid = extract64(tcr, 51, 1); 9293 } else { 9294 int tg = extract32(tcr, 30, 2); 9295 using16k = tg == 1; 9296 using64k = tg == 3; 9297 tsz = extract32(tcr, 16, 6); 9298 epd = extract32(tcr, 23, 1); 9299 tbi = extract64(tcr, 38, 1); 9300 hpd = extract64(tcr, 42, 1); 9301 tbid = extract64(tcr, 52, 1); 9302 } 9303 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */ 9304 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */ 9305 9306 return (ARMVAParameters) { 9307 .tsz = tsz, 9308 .select = select, 9309 .tbi = tbi, 9310 .tbid = tbid, 9311 .epd = epd, 9312 .hpd = hpd, 9313 .using16k = using16k, 9314 .using64k = using64k, 9315 }; 9316 } 9317 9318 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 9319 ARMMMUIdx mmu_idx, bool data) 9320 { 9321 ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx); 9322 9323 /* Present TBI as a composite with TBID. */ 9324 ret.tbi &= (data || !ret.tbid); 9325 return ret; 9326 } 9327 9328 #ifndef CONFIG_USER_ONLY 9329 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 9330 ARMMMUIdx mmu_idx) 9331 { 9332 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 9333 uint32_t el = regime_el(env, mmu_idx); 9334 int select, tsz; 9335 bool epd, hpd; 9336 9337 if (mmu_idx == ARMMMUIdx_S2NS) { 9338 /* VTCR */ 9339 bool sext = extract32(tcr, 4, 1); 9340 bool sign = extract32(tcr, 3, 1); 9341 9342 /* 9343 * If the sign-extend bit is not the same as t0sz[3], the result 9344 * is unpredictable. Flag this as a guest error. 9345 */ 9346 if (sign != sext) { 9347 qemu_log_mask(LOG_GUEST_ERROR, 9348 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 9349 } 9350 tsz = sextract32(tcr, 0, 4) + 8; 9351 select = 0; 9352 hpd = false; 9353 epd = false; 9354 } else if (el == 2) { 9355 /* HTCR */ 9356 tsz = extract32(tcr, 0, 3); 9357 select = 0; 9358 hpd = extract64(tcr, 24, 1); 9359 epd = false; 9360 } else { 9361 int t0sz = extract32(tcr, 0, 3); 9362 int t1sz = extract32(tcr, 16, 3); 9363 9364 if (t1sz == 0) { 9365 select = va > (0xffffffffu >> t0sz); 9366 } else { 9367 /* Note that we will detect errors later. */ 9368 select = va >= ~(0xffffffffu >> t1sz); 9369 } 9370 if (!select) { 9371 tsz = t0sz; 9372 epd = extract32(tcr, 7, 1); 9373 hpd = extract64(tcr, 41, 1); 9374 } else { 9375 tsz = t1sz; 9376 epd = extract32(tcr, 23, 1); 9377 hpd = extract64(tcr, 42, 1); 9378 } 9379 /* For aarch32, hpd0 is not enabled without t2e as well. */ 9380 hpd &= extract32(tcr, 6, 1); 9381 } 9382 9383 return (ARMVAParameters) { 9384 .tsz = tsz, 9385 .select = select, 9386 .epd = epd, 9387 .hpd = hpd, 9388 }; 9389 } 9390 9391 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 9392 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9393 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 9394 target_ulong *page_size_ptr, 9395 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 9396 { 9397 ARMCPU *cpu = env_archcpu(env); 9398 CPUState *cs = CPU(cpu); 9399 /* Read an LPAE long-descriptor translation table. */ 9400 ARMFaultType fault_type = ARMFault_Translation; 9401 uint32_t level; 9402 ARMVAParameters param; 9403 uint64_t ttbr; 9404 hwaddr descaddr, indexmask, indexmask_grainsize; 9405 uint32_t tableattrs; 9406 target_ulong page_size; 9407 uint32_t attrs; 9408 int32_t stride; 9409 int addrsize, inputsize; 9410 TCR *tcr = regime_tcr(env, mmu_idx); 9411 int ap, ns, xn, pxn; 9412 uint32_t el = regime_el(env, mmu_idx); 9413 bool ttbr1_valid; 9414 uint64_t descaddrmask; 9415 bool aarch64 = arm_el_is_aa64(env, el); 9416 bool guarded = false; 9417 9418 /* TODO: 9419 * This code does not handle the different format TCR for VTCR_EL2. 9420 * This code also does not support shareability levels. 9421 * Attribute and permission bit handling should also be checked when adding 9422 * support for those page table walks. 9423 */ 9424 if (aarch64) { 9425 param = aa64_va_parameters(env, address, mmu_idx, 9426 access_type != MMU_INST_FETCH); 9427 level = 0; 9428 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it 9429 * invalid. 9430 */ 9431 ttbr1_valid = (el < 2); 9432 addrsize = 64 - 8 * param.tbi; 9433 inputsize = 64 - param.tsz; 9434 } else { 9435 param = aa32_va_parameters(env, address, mmu_idx); 9436 level = 1; 9437 /* There is no TTBR1 for EL2 */ 9438 ttbr1_valid = (el != 2); 9439 addrsize = (mmu_idx == ARMMMUIdx_S2NS ? 40 : 32); 9440 inputsize = addrsize - param.tsz; 9441 } 9442 9443 /* 9444 * We determined the region when collecting the parameters, but we 9445 * have not yet validated that the address is valid for the region. 9446 * Extract the top bits and verify that they all match select. 9447 * 9448 * For aa32, if inputsize == addrsize, then we have selected the 9449 * region by exclusion in aa32_va_parameters and there is no more 9450 * validation to do here. 9451 */ 9452 if (inputsize < addrsize) { 9453 target_ulong top_bits = sextract64(address, inputsize, 9454 addrsize - inputsize); 9455 if (-top_bits != param.select || (param.select && !ttbr1_valid)) { 9456 /* The gap between the two regions is a Translation fault */ 9457 fault_type = ARMFault_Translation; 9458 goto do_fault; 9459 } 9460 } 9461 9462 if (param.using64k) { 9463 stride = 13; 9464 } else if (param.using16k) { 9465 stride = 11; 9466 } else { 9467 stride = 9; 9468 } 9469 9470 /* Note that QEMU ignores shareability and cacheability attributes, 9471 * so we don't need to do anything with the SH, ORGN, IRGN fields 9472 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 9473 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 9474 * implement any ASID-like capability so we can ignore it (instead 9475 * we will always flush the TLB any time the ASID is changed). 9476 */ 9477 ttbr = regime_ttbr(env, mmu_idx, param.select); 9478 9479 /* Here we should have set up all the parameters for the translation: 9480 * inputsize, ttbr, epd, stride, tbi 9481 */ 9482 9483 if (param.epd) { 9484 /* Translation table walk disabled => Translation fault on TLB miss 9485 * Note: This is always 0 on 64-bit EL2 and EL3. 9486 */ 9487 goto do_fault; 9488 } 9489 9490 if (mmu_idx != ARMMMUIdx_S2NS) { 9491 /* The starting level depends on the virtual address size (which can 9492 * be up to 48 bits) and the translation granule size. It indicates 9493 * the number of strides (stride bits at a time) needed to 9494 * consume the bits of the input address. In the pseudocode this is: 9495 * level = 4 - RoundUp((inputsize - grainsize) / stride) 9496 * where their 'inputsize' is our 'inputsize', 'grainsize' is 9497 * our 'stride + 3' and 'stride' is our 'stride'. 9498 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 9499 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 9500 * = 4 - (inputsize - 4) / stride; 9501 */ 9502 level = 4 - (inputsize - 4) / stride; 9503 } else { 9504 /* For stage 2 translations the starting level is specified by the 9505 * VTCR_EL2.SL0 field (whose interpretation depends on the page size) 9506 */ 9507 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2); 9508 uint32_t startlevel; 9509 bool ok; 9510 9511 if (!aarch64 || stride == 9) { 9512 /* AArch32 or 4KB pages */ 9513 startlevel = 2 - sl0; 9514 } else { 9515 /* 16KB or 64KB pages */ 9516 startlevel = 3 - sl0; 9517 } 9518 9519 /* Check that the starting level is valid. */ 9520 ok = check_s2_mmu_setup(cpu, aarch64, startlevel, 9521 inputsize, stride); 9522 if (!ok) { 9523 fault_type = ARMFault_Translation; 9524 goto do_fault; 9525 } 9526 level = startlevel; 9527 } 9528 9529 indexmask_grainsize = (1ULL << (stride + 3)) - 1; 9530 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1; 9531 9532 /* Now we can extract the actual base address from the TTBR */ 9533 descaddr = extract64(ttbr, 0, 48); 9534 descaddr &= ~indexmask; 9535 9536 /* The address field in the descriptor goes up to bit 39 for ARMv7 9537 * but up to bit 47 for ARMv8, but we use the descaddrmask 9538 * up to bit 39 for AArch32, because we don't need other bits in that case 9539 * to construct next descriptor address (anyway they should be all zeroes). 9540 */ 9541 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) & 9542 ~indexmask_grainsize; 9543 9544 /* Secure accesses start with the page table in secure memory and 9545 * can be downgraded to non-secure at any step. Non-secure accesses 9546 * remain non-secure. We implement this by just ORing in the NSTable/NS 9547 * bits at each step. 9548 */ 9549 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4); 9550 for (;;) { 9551 uint64_t descriptor; 9552 bool nstable; 9553 9554 descaddr |= (address >> (stride * (4 - level))) & indexmask; 9555 descaddr &= ~7ULL; 9556 nstable = extract32(tableattrs, 4, 1); 9557 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi); 9558 if (fi->type != ARMFault_None) { 9559 goto do_fault; 9560 } 9561 9562 if (!(descriptor & 1) || 9563 (!(descriptor & 2) && (level == 3))) { 9564 /* Invalid, or the Reserved level 3 encoding */ 9565 goto do_fault; 9566 } 9567 descaddr = descriptor & descaddrmask; 9568 9569 if ((descriptor & 2) && (level < 3)) { 9570 /* Table entry. The top five bits are attributes which may 9571 * propagate down through lower levels of the table (and 9572 * which are all arranged so that 0 means "no effect", so 9573 * we can gather them up by ORing in the bits at each level). 9574 */ 9575 tableattrs |= extract64(descriptor, 59, 5); 9576 level++; 9577 indexmask = indexmask_grainsize; 9578 continue; 9579 } 9580 /* Block entry at level 1 or 2, or page entry at level 3. 9581 * These are basically the same thing, although the number 9582 * of bits we pull in from the vaddr varies. 9583 */ 9584 page_size = (1ULL << ((stride * (4 - level)) + 3)); 9585 descaddr |= (address & (page_size - 1)); 9586 /* Extract attributes from the descriptor */ 9587 attrs = extract64(descriptor, 2, 10) 9588 | (extract64(descriptor, 52, 12) << 10); 9589 9590 if (mmu_idx == ARMMMUIdx_S2NS) { 9591 /* Stage 2 table descriptors do not include any attribute fields */ 9592 break; 9593 } 9594 /* Merge in attributes from table descriptors */ 9595 attrs |= nstable << 3; /* NS */ 9596 guarded = extract64(descriptor, 50, 1); /* GP */ 9597 if (param.hpd) { 9598 /* HPD disables all the table attributes except NSTable. */ 9599 break; 9600 } 9601 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */ 9602 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 9603 * means "force PL1 access only", which means forcing AP[1] to 0. 9604 */ 9605 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */ 9606 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */ 9607 break; 9608 } 9609 /* Here descaddr is the final physical address, and attributes 9610 * are all in attrs. 9611 */ 9612 fault_type = ARMFault_AccessFlag; 9613 if ((attrs & (1 << 8)) == 0) { 9614 /* Access flag */ 9615 goto do_fault; 9616 } 9617 9618 ap = extract32(attrs, 4, 2); 9619 xn = extract32(attrs, 12, 1); 9620 9621 if (mmu_idx == ARMMMUIdx_S2NS) { 9622 ns = true; 9623 *prot = get_S2prot(env, ap, xn); 9624 } else { 9625 ns = extract32(attrs, 3, 1); 9626 pxn = extract32(attrs, 11, 1); 9627 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 9628 } 9629 9630 fault_type = ARMFault_Permission; 9631 if (!(*prot & (1 << access_type))) { 9632 goto do_fault; 9633 } 9634 9635 if (ns) { 9636 /* The NS bit will (as required by the architecture) have no effect if 9637 * the CPU doesn't support TZ or this is a non-secure translation 9638 * regime, because the attribute will already be non-secure. 9639 */ 9640 txattrs->secure = false; 9641 } 9642 /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB. */ 9643 if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) { 9644 txattrs->target_tlb_bit0 = true; 9645 } 9646 9647 if (cacheattrs != NULL) { 9648 if (mmu_idx == ARMMMUIdx_S2NS) { 9649 cacheattrs->attrs = convert_stage2_attrs(env, 9650 extract32(attrs, 0, 4)); 9651 } else { 9652 /* Index into MAIR registers for cache attributes */ 9653 uint8_t attrindx = extract32(attrs, 0, 3); 9654 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 9655 assert(attrindx <= 7); 9656 cacheattrs->attrs = extract64(mair, attrindx * 8, 8); 9657 } 9658 cacheattrs->shareability = extract32(attrs, 6, 2); 9659 } 9660 9661 *phys_ptr = descaddr; 9662 *page_size_ptr = page_size; 9663 return false; 9664 9665 do_fault: 9666 fi->type = fault_type; 9667 fi->level = level; 9668 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 9669 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS); 9670 return true; 9671 } 9672 9673 static inline void get_phys_addr_pmsav7_default(CPUARMState *env, 9674 ARMMMUIdx mmu_idx, 9675 int32_t address, int *prot) 9676 { 9677 if (!arm_feature(env, ARM_FEATURE_M)) { 9678 *prot = PAGE_READ | PAGE_WRITE; 9679 switch (address) { 9680 case 0xF0000000 ... 0xFFFFFFFF: 9681 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 9682 /* hivecs execing is ok */ 9683 *prot |= PAGE_EXEC; 9684 } 9685 break; 9686 case 0x00000000 ... 0x7FFFFFFF: 9687 *prot |= PAGE_EXEC; 9688 break; 9689 } 9690 } else { 9691 /* Default system address map for M profile cores. 9692 * The architecture specifies which regions are execute-never; 9693 * at the MPU level no other checks are defined. 9694 */ 9695 switch (address) { 9696 case 0x00000000 ... 0x1fffffff: /* ROM */ 9697 case 0x20000000 ... 0x3fffffff: /* SRAM */ 9698 case 0x60000000 ... 0x7fffffff: /* RAM */ 9699 case 0x80000000 ... 0x9fffffff: /* RAM */ 9700 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 9701 break; 9702 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 9703 case 0xa0000000 ... 0xbfffffff: /* Device */ 9704 case 0xc0000000 ... 0xdfffffff: /* Device */ 9705 case 0xe0000000 ... 0xffffffff: /* System */ 9706 *prot = PAGE_READ | PAGE_WRITE; 9707 break; 9708 default: 9709 g_assert_not_reached(); 9710 } 9711 } 9712 } 9713 9714 static bool pmsav7_use_background_region(ARMCPU *cpu, 9715 ARMMMUIdx mmu_idx, bool is_user) 9716 { 9717 /* Return true if we should use the default memory map as a 9718 * "background" region if there are no hits against any MPU regions. 9719 */ 9720 CPUARMState *env = &cpu->env; 9721 9722 if (is_user) { 9723 return false; 9724 } 9725 9726 if (arm_feature(env, ARM_FEATURE_M)) { 9727 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] 9728 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 9729 } else { 9730 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 9731 } 9732 } 9733 9734 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address) 9735 { 9736 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 9737 return arm_feature(env, ARM_FEATURE_M) && 9738 extract32(address, 20, 12) == 0xe00; 9739 } 9740 9741 static inline bool m_is_system_region(CPUARMState *env, uint32_t address) 9742 { 9743 /* True if address is in the M profile system region 9744 * 0xe0000000 - 0xffffffff 9745 */ 9746 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 9747 } 9748 9749 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 9750 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9751 hwaddr *phys_ptr, int *prot, 9752 target_ulong *page_size, 9753 ARMMMUFaultInfo *fi) 9754 { 9755 ARMCPU *cpu = env_archcpu(env); 9756 int n; 9757 bool is_user = regime_is_user(env, mmu_idx); 9758 9759 *phys_ptr = address; 9760 *page_size = TARGET_PAGE_SIZE; 9761 *prot = 0; 9762 9763 if (regime_translation_disabled(env, mmu_idx) || 9764 m_is_ppb_region(env, address)) { 9765 /* MPU disabled or M profile PPB access: use default memory map. 9766 * The other case which uses the default memory map in the 9767 * v7M ARM ARM pseudocode is exception vector reads from the vector 9768 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 9769 * which always does a direct read using address_space_ldl(), rather 9770 * than going via this function, so we don't need to check that here. 9771 */ 9772 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 9773 } else { /* MPU enabled */ 9774 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 9775 /* region search */ 9776 uint32_t base = env->pmsav7.drbar[n]; 9777 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 9778 uint32_t rmask; 9779 bool srdis = false; 9780 9781 if (!(env->pmsav7.drsr[n] & 0x1)) { 9782 continue; 9783 } 9784 9785 if (!rsize) { 9786 qemu_log_mask(LOG_GUEST_ERROR, 9787 "DRSR[%d]: Rsize field cannot be 0\n", n); 9788 continue; 9789 } 9790 rsize++; 9791 rmask = (1ull << rsize) - 1; 9792 9793 if (base & rmask) { 9794 qemu_log_mask(LOG_GUEST_ERROR, 9795 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 9796 "to DRSR region size, mask = 0x%" PRIx32 "\n", 9797 n, base, rmask); 9798 continue; 9799 } 9800 9801 if (address < base || address > base + rmask) { 9802 /* 9803 * Address not in this region. We must check whether the 9804 * region covers addresses in the same page as our address. 9805 * In that case we must not report a size that covers the 9806 * whole page for a subsequent hit against a different MPU 9807 * region or the background region, because it would result in 9808 * incorrect TLB hits for subsequent accesses to addresses that 9809 * are in this MPU region. 9810 */ 9811 if (ranges_overlap(base, rmask, 9812 address & TARGET_PAGE_MASK, 9813 TARGET_PAGE_SIZE)) { 9814 *page_size = 1; 9815 } 9816 continue; 9817 } 9818 9819 /* Region matched */ 9820 9821 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 9822 int i, snd; 9823 uint32_t srdis_mask; 9824 9825 rsize -= 3; /* sub region size (power of 2) */ 9826 snd = ((address - base) >> rsize) & 0x7; 9827 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 9828 9829 srdis_mask = srdis ? 0x3 : 0x0; 9830 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 9831 /* This will check in groups of 2, 4 and then 8, whether 9832 * the subregion bits are consistent. rsize is incremented 9833 * back up to give the region size, considering consistent 9834 * adjacent subregions as one region. Stop testing if rsize 9835 * is already big enough for an entire QEMU page. 9836 */ 9837 int snd_rounded = snd & ~(i - 1); 9838 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 9839 snd_rounded + 8, i); 9840 if (srdis_mask ^ srdis_multi) { 9841 break; 9842 } 9843 srdis_mask = (srdis_mask << i) | srdis_mask; 9844 rsize++; 9845 } 9846 } 9847 if (srdis) { 9848 continue; 9849 } 9850 if (rsize < TARGET_PAGE_BITS) { 9851 *page_size = 1 << rsize; 9852 } 9853 break; 9854 } 9855 9856 if (n == -1) { /* no hits */ 9857 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 9858 /* background fault */ 9859 fi->type = ARMFault_Background; 9860 return true; 9861 } 9862 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 9863 } else { /* a MPU hit! */ 9864 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 9865 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 9866 9867 if (m_is_system_region(env, address)) { 9868 /* System space is always execute never */ 9869 xn = 1; 9870 } 9871 9872 if (is_user) { /* User mode AP bit decoding */ 9873 switch (ap) { 9874 case 0: 9875 case 1: 9876 case 5: 9877 break; /* no access */ 9878 case 3: 9879 *prot |= PAGE_WRITE; 9880 /* fall through */ 9881 case 2: 9882 case 6: 9883 *prot |= PAGE_READ | PAGE_EXEC; 9884 break; 9885 case 7: 9886 /* for v7M, same as 6; for R profile a reserved value */ 9887 if (arm_feature(env, ARM_FEATURE_M)) { 9888 *prot |= PAGE_READ | PAGE_EXEC; 9889 break; 9890 } 9891 /* fall through */ 9892 default: 9893 qemu_log_mask(LOG_GUEST_ERROR, 9894 "DRACR[%d]: Bad value for AP bits: 0x%" 9895 PRIx32 "\n", n, ap); 9896 } 9897 } else { /* Priv. mode AP bits decoding */ 9898 switch (ap) { 9899 case 0: 9900 break; /* no access */ 9901 case 1: 9902 case 2: 9903 case 3: 9904 *prot |= PAGE_WRITE; 9905 /* fall through */ 9906 case 5: 9907 case 6: 9908 *prot |= PAGE_READ | PAGE_EXEC; 9909 break; 9910 case 7: 9911 /* for v7M, same as 6; for R profile a reserved value */ 9912 if (arm_feature(env, ARM_FEATURE_M)) { 9913 *prot |= PAGE_READ | PAGE_EXEC; 9914 break; 9915 } 9916 /* fall through */ 9917 default: 9918 qemu_log_mask(LOG_GUEST_ERROR, 9919 "DRACR[%d]: Bad value for AP bits: 0x%" 9920 PRIx32 "\n", n, ap); 9921 } 9922 } 9923 9924 /* execute never */ 9925 if (xn) { 9926 *prot &= ~PAGE_EXEC; 9927 } 9928 } 9929 } 9930 9931 fi->type = ARMFault_Permission; 9932 fi->level = 1; 9933 return !(*prot & (1 << access_type)); 9934 } 9935 9936 static bool v8m_is_sau_exempt(CPUARMState *env, 9937 uint32_t address, MMUAccessType access_type) 9938 { 9939 /* The architecture specifies that certain address ranges are 9940 * exempt from v8M SAU/IDAU checks. 9941 */ 9942 return 9943 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 9944 (address >= 0xe0000000 && address <= 0xe0002fff) || 9945 (address >= 0xe000e000 && address <= 0xe000efff) || 9946 (address >= 0xe002e000 && address <= 0xe002efff) || 9947 (address >= 0xe0040000 && address <= 0xe0041fff) || 9948 (address >= 0xe00ff000 && address <= 0xe00fffff); 9949 } 9950 9951 void v8m_security_lookup(CPUARMState *env, uint32_t address, 9952 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9953 V8M_SAttributes *sattrs) 9954 { 9955 /* Look up the security attributes for this address. Compare the 9956 * pseudocode SecurityCheck() function. 9957 * We assume the caller has zero-initialized *sattrs. 9958 */ 9959 ARMCPU *cpu = env_archcpu(env); 9960 int r; 9961 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 9962 int idau_region = IREGION_NOTVALID; 9963 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 9964 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 9965 9966 if (cpu->idau) { 9967 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 9968 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 9969 9970 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 9971 &idau_nsc); 9972 } 9973 9974 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 9975 /* 0xf0000000..0xffffffff is always S for insn fetches */ 9976 return; 9977 } 9978 9979 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 9980 sattrs->ns = !regime_is_secure(env, mmu_idx); 9981 return; 9982 } 9983 9984 if (idau_region != IREGION_NOTVALID) { 9985 sattrs->irvalid = true; 9986 sattrs->iregion = idau_region; 9987 } 9988 9989 switch (env->sau.ctrl & 3) { 9990 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 9991 break; 9992 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 9993 sattrs->ns = true; 9994 break; 9995 default: /* SAU.ENABLE == 1 */ 9996 for (r = 0; r < cpu->sau_sregion; r++) { 9997 if (env->sau.rlar[r] & 1) { 9998 uint32_t base = env->sau.rbar[r] & ~0x1f; 9999 uint32_t limit = env->sau.rlar[r] | 0x1f; 10000 10001 if (base <= address && limit >= address) { 10002 if (base > addr_page_base || limit < addr_page_limit) { 10003 sattrs->subpage = true; 10004 } 10005 if (sattrs->srvalid) { 10006 /* If we hit in more than one region then we must report 10007 * as Secure, not NS-Callable, with no valid region 10008 * number info. 10009 */ 10010 sattrs->ns = false; 10011 sattrs->nsc = false; 10012 sattrs->sregion = 0; 10013 sattrs->srvalid = false; 10014 break; 10015 } else { 10016 if (env->sau.rlar[r] & 2) { 10017 sattrs->nsc = true; 10018 } else { 10019 sattrs->ns = true; 10020 } 10021 sattrs->srvalid = true; 10022 sattrs->sregion = r; 10023 } 10024 } else { 10025 /* 10026 * Address not in this region. We must check whether the 10027 * region covers addresses in the same page as our address. 10028 * In that case we must not report a size that covers the 10029 * whole page for a subsequent hit against a different MPU 10030 * region or the background region, because it would result 10031 * in incorrect TLB hits for subsequent accesses to 10032 * addresses that are in this MPU region. 10033 */ 10034 if (limit >= base && 10035 ranges_overlap(base, limit - base + 1, 10036 addr_page_base, 10037 TARGET_PAGE_SIZE)) { 10038 sattrs->subpage = true; 10039 } 10040 } 10041 } 10042 } 10043 break; 10044 } 10045 10046 /* 10047 * The IDAU will override the SAU lookup results if it specifies 10048 * higher security than the SAU does. 10049 */ 10050 if (!idau_ns) { 10051 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 10052 sattrs->ns = false; 10053 sattrs->nsc = idau_nsc; 10054 } 10055 } 10056 } 10057 10058 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 10059 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10060 hwaddr *phys_ptr, MemTxAttrs *txattrs, 10061 int *prot, bool *is_subpage, 10062 ARMMMUFaultInfo *fi, uint32_t *mregion) 10063 { 10064 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check 10065 * that a full phys-to-virt translation does). 10066 * mregion is (if not NULL) set to the region number which matched, 10067 * or -1 if no region number is returned (MPU off, address did not 10068 * hit a region, address hit in multiple regions). 10069 * We set is_subpage to true if the region hit doesn't cover the 10070 * entire TARGET_PAGE the address is within. 10071 */ 10072 ARMCPU *cpu = env_archcpu(env); 10073 bool is_user = regime_is_user(env, mmu_idx); 10074 uint32_t secure = regime_is_secure(env, mmu_idx); 10075 int n; 10076 int matchregion = -1; 10077 bool hit = false; 10078 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 10079 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 10080 10081 *is_subpage = false; 10082 *phys_ptr = address; 10083 *prot = 0; 10084 if (mregion) { 10085 *mregion = -1; 10086 } 10087 10088 /* Unlike the ARM ARM pseudocode, we don't need to check whether this 10089 * was an exception vector read from the vector table (which is always 10090 * done using the default system address map), because those accesses 10091 * are done in arm_v7m_load_vector(), which always does a direct 10092 * read using address_space_ldl(), rather than going via this function. 10093 */ 10094 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */ 10095 hit = true; 10096 } else if (m_is_ppb_region(env, address)) { 10097 hit = true; 10098 } else { 10099 if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 10100 hit = true; 10101 } 10102 10103 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 10104 /* region search */ 10105 /* Note that the base address is bits [31:5] from the register 10106 * with bits [4:0] all zeroes, but the limit address is bits 10107 * [31:5] from the register with bits [4:0] all ones. 10108 */ 10109 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f; 10110 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f; 10111 10112 if (!(env->pmsav8.rlar[secure][n] & 0x1)) { 10113 /* Region disabled */ 10114 continue; 10115 } 10116 10117 if (address < base || address > limit) { 10118 /* 10119 * Address not in this region. We must check whether the 10120 * region covers addresses in the same page as our address. 10121 * In that case we must not report a size that covers the 10122 * whole page for a subsequent hit against a different MPU 10123 * region or the background region, because it would result in 10124 * incorrect TLB hits for subsequent accesses to addresses that 10125 * are in this MPU region. 10126 */ 10127 if (limit >= base && 10128 ranges_overlap(base, limit - base + 1, 10129 addr_page_base, 10130 TARGET_PAGE_SIZE)) { 10131 *is_subpage = true; 10132 } 10133 continue; 10134 } 10135 10136 if (base > addr_page_base || limit < addr_page_limit) { 10137 *is_subpage = true; 10138 } 10139 10140 if (matchregion != -1) { 10141 /* Multiple regions match -- always a failure (unlike 10142 * PMSAv7 where highest-numbered-region wins) 10143 */ 10144 fi->type = ARMFault_Permission; 10145 fi->level = 1; 10146 return true; 10147 } 10148 10149 matchregion = n; 10150 hit = true; 10151 } 10152 } 10153 10154 if (!hit) { 10155 /* background fault */ 10156 fi->type = ARMFault_Background; 10157 return true; 10158 } 10159 10160 if (matchregion == -1) { 10161 /* hit using the background region */ 10162 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10163 } else { 10164 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2); 10165 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1); 10166 10167 if (m_is_system_region(env, address)) { 10168 /* System space is always execute never */ 10169 xn = 1; 10170 } 10171 10172 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 10173 if (*prot && !xn) { 10174 *prot |= PAGE_EXEC; 10175 } 10176 /* We don't need to look the attribute up in the MAIR0/MAIR1 10177 * registers because that only tells us about cacheability. 10178 */ 10179 if (mregion) { 10180 *mregion = matchregion; 10181 } 10182 } 10183 10184 fi->type = ARMFault_Permission; 10185 fi->level = 1; 10186 return !(*prot & (1 << access_type)); 10187 } 10188 10189 10190 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 10191 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10192 hwaddr *phys_ptr, MemTxAttrs *txattrs, 10193 int *prot, target_ulong *page_size, 10194 ARMMMUFaultInfo *fi) 10195 { 10196 uint32_t secure = regime_is_secure(env, mmu_idx); 10197 V8M_SAttributes sattrs = {}; 10198 bool ret; 10199 bool mpu_is_subpage; 10200 10201 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 10202 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs); 10203 if (access_type == MMU_INST_FETCH) { 10204 /* Instruction fetches always use the MMU bank and the 10205 * transaction attribute determined by the fetch address, 10206 * regardless of CPU state. This is painful for QEMU 10207 * to handle, because it would mean we need to encode 10208 * into the mmu_idx not just the (user, negpri) information 10209 * for the current security state but also that for the 10210 * other security state, which would balloon the number 10211 * of mmu_idx values needed alarmingly. 10212 * Fortunately we can avoid this because it's not actually 10213 * possible to arbitrarily execute code from memory with 10214 * the wrong security attribute: it will always generate 10215 * an exception of some kind or another, apart from the 10216 * special case of an NS CPU executing an SG instruction 10217 * in S&NSC memory. So we always just fail the translation 10218 * here and sort things out in the exception handler 10219 * (including possibly emulating an SG instruction). 10220 */ 10221 if (sattrs.ns != !secure) { 10222 if (sattrs.nsc) { 10223 fi->type = ARMFault_QEMU_NSCExec; 10224 } else { 10225 fi->type = ARMFault_QEMU_SFault; 10226 } 10227 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 10228 *phys_ptr = address; 10229 *prot = 0; 10230 return true; 10231 } 10232 } else { 10233 /* For data accesses we always use the MMU bank indicated 10234 * by the current CPU state, but the security attributes 10235 * might downgrade a secure access to nonsecure. 10236 */ 10237 if (sattrs.ns) { 10238 txattrs->secure = false; 10239 } else if (!secure) { 10240 /* NS access to S memory must fault. 10241 * Architecturally we should first check whether the 10242 * MPU information for this address indicates that we 10243 * are doing an unaligned access to Device memory, which 10244 * should generate a UsageFault instead. QEMU does not 10245 * currently check for that kind of unaligned access though. 10246 * If we added it we would need to do so as a special case 10247 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 10248 */ 10249 fi->type = ARMFault_QEMU_SFault; 10250 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 10251 *phys_ptr = address; 10252 *prot = 0; 10253 return true; 10254 } 10255 } 10256 } 10257 10258 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr, 10259 txattrs, prot, &mpu_is_subpage, fi, NULL); 10260 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE; 10261 return ret; 10262 } 10263 10264 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 10265 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10266 hwaddr *phys_ptr, int *prot, 10267 ARMMMUFaultInfo *fi) 10268 { 10269 int n; 10270 uint32_t mask; 10271 uint32_t base; 10272 bool is_user = regime_is_user(env, mmu_idx); 10273 10274 if (regime_translation_disabled(env, mmu_idx)) { 10275 /* MPU disabled. */ 10276 *phys_ptr = address; 10277 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10278 return false; 10279 } 10280 10281 *phys_ptr = address; 10282 for (n = 7; n >= 0; n--) { 10283 base = env->cp15.c6_region[n]; 10284 if ((base & 1) == 0) { 10285 continue; 10286 } 10287 mask = 1 << ((base >> 1) & 0x1f); 10288 /* Keep this shift separate from the above to avoid an 10289 (undefined) << 32. */ 10290 mask = (mask << 1) - 1; 10291 if (((base ^ address) & ~mask) == 0) { 10292 break; 10293 } 10294 } 10295 if (n < 0) { 10296 fi->type = ARMFault_Background; 10297 return true; 10298 } 10299 10300 if (access_type == MMU_INST_FETCH) { 10301 mask = env->cp15.pmsav5_insn_ap; 10302 } else { 10303 mask = env->cp15.pmsav5_data_ap; 10304 } 10305 mask = (mask >> (n * 4)) & 0xf; 10306 switch (mask) { 10307 case 0: 10308 fi->type = ARMFault_Permission; 10309 fi->level = 1; 10310 return true; 10311 case 1: 10312 if (is_user) { 10313 fi->type = ARMFault_Permission; 10314 fi->level = 1; 10315 return true; 10316 } 10317 *prot = PAGE_READ | PAGE_WRITE; 10318 break; 10319 case 2: 10320 *prot = PAGE_READ; 10321 if (!is_user) { 10322 *prot |= PAGE_WRITE; 10323 } 10324 break; 10325 case 3: 10326 *prot = PAGE_READ | PAGE_WRITE; 10327 break; 10328 case 5: 10329 if (is_user) { 10330 fi->type = ARMFault_Permission; 10331 fi->level = 1; 10332 return true; 10333 } 10334 *prot = PAGE_READ; 10335 break; 10336 case 6: 10337 *prot = PAGE_READ; 10338 break; 10339 default: 10340 /* Bad permission. */ 10341 fi->type = ARMFault_Permission; 10342 fi->level = 1; 10343 return true; 10344 } 10345 *prot |= PAGE_EXEC; 10346 return false; 10347 } 10348 10349 /* Combine either inner or outer cacheability attributes for normal 10350 * memory, according to table D4-42 and pseudocode procedure 10351 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 10352 * 10353 * NB: only stage 1 includes allocation hints (RW bits), leading to 10354 * some asymmetry. 10355 */ 10356 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 10357 { 10358 if (s1 == 4 || s2 == 4) { 10359 /* non-cacheable has precedence */ 10360 return 4; 10361 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 10362 /* stage 1 write-through takes precedence */ 10363 return s1; 10364 } else if (extract32(s2, 2, 2) == 2) { 10365 /* stage 2 write-through takes precedence, but the allocation hint 10366 * is still taken from stage 1 10367 */ 10368 return (2 << 2) | extract32(s1, 0, 2); 10369 } else { /* write-back */ 10370 return s1; 10371 } 10372 } 10373 10374 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 10375 * and CombineS1S2Desc() 10376 * 10377 * @s1: Attributes from stage 1 walk 10378 * @s2: Attributes from stage 2 walk 10379 */ 10380 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2) 10381 { 10382 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4); 10383 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4); 10384 ARMCacheAttrs ret; 10385 10386 /* Combine shareability attributes (table D4-43) */ 10387 if (s1.shareability == 2 || s2.shareability == 2) { 10388 /* if either are outer-shareable, the result is outer-shareable */ 10389 ret.shareability = 2; 10390 } else if (s1.shareability == 3 || s2.shareability == 3) { 10391 /* if either are inner-shareable, the result is inner-shareable */ 10392 ret.shareability = 3; 10393 } else { 10394 /* both non-shareable */ 10395 ret.shareability = 0; 10396 } 10397 10398 /* Combine memory type and cacheability attributes */ 10399 if (s1hi == 0 || s2hi == 0) { 10400 /* Device has precedence over normal */ 10401 if (s1lo == 0 || s2lo == 0) { 10402 /* nGnRnE has precedence over anything */ 10403 ret.attrs = 0; 10404 } else if (s1lo == 4 || s2lo == 4) { 10405 /* non-Reordering has precedence over Reordering */ 10406 ret.attrs = 4; /* nGnRE */ 10407 } else if (s1lo == 8 || s2lo == 8) { 10408 /* non-Gathering has precedence over Gathering */ 10409 ret.attrs = 8; /* nGRE */ 10410 } else { 10411 ret.attrs = 0xc; /* GRE */ 10412 } 10413 10414 /* Any location for which the resultant memory type is any 10415 * type of Device memory is always treated as Outer Shareable. 10416 */ 10417 ret.shareability = 2; 10418 } else { /* Normal memory */ 10419 /* Outer/inner cacheability combine independently */ 10420 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 10421 | combine_cacheattr_nibble(s1lo, s2lo); 10422 10423 if (ret.attrs == 0x44) { 10424 /* Any location for which the resultant memory type is Normal 10425 * Inner Non-cacheable, Outer Non-cacheable is always treated 10426 * as Outer Shareable. 10427 */ 10428 ret.shareability = 2; 10429 } 10430 } 10431 10432 return ret; 10433 } 10434 10435 10436 /* get_phys_addr - get the physical address for this virtual address 10437 * 10438 * Find the physical address corresponding to the given virtual address, 10439 * by doing a translation table walk on MMU based systems or using the 10440 * MPU state on MPU based systems. 10441 * 10442 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs, 10443 * prot and page_size may not be filled in, and the populated fsr value provides 10444 * information on why the translation aborted, in the format of a 10445 * DFSR/IFSR fault register, with the following caveats: 10446 * * we honour the short vs long DFSR format differences. 10447 * * the WnR bit is never set (the caller must do this). 10448 * * for PSMAv5 based systems we don't bother to return a full FSR format 10449 * value. 10450 * 10451 * @env: CPUARMState 10452 * @address: virtual address to get physical address for 10453 * @access_type: 0 for read, 1 for write, 2 for execute 10454 * @mmu_idx: MMU index indicating required translation regime 10455 * @phys_ptr: set to the physical address corresponding to the virtual address 10456 * @attrs: set to the memory transaction attributes to use 10457 * @prot: set to the permissions for the page containing phys_ptr 10458 * @page_size: set to the size of the page containing phys_ptr 10459 * @fi: set to fault info if the translation fails 10460 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes 10461 */ 10462 bool get_phys_addr(CPUARMState *env, target_ulong address, 10463 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10464 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 10465 target_ulong *page_size, 10466 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 10467 { 10468 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 10469 /* Call ourselves recursively to do the stage 1 and then stage 2 10470 * translations. 10471 */ 10472 if (arm_feature(env, ARM_FEATURE_EL2)) { 10473 hwaddr ipa; 10474 int s2_prot; 10475 int ret; 10476 ARMCacheAttrs cacheattrs2 = {}; 10477 10478 ret = get_phys_addr(env, address, access_type, 10479 stage_1_mmu_idx(mmu_idx), &ipa, attrs, 10480 prot, page_size, fi, cacheattrs); 10481 10482 /* If S1 fails or S2 is disabled, return early. */ 10483 if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 10484 *phys_ptr = ipa; 10485 return ret; 10486 } 10487 10488 /* S1 is done. Now do S2 translation. */ 10489 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS, 10490 phys_ptr, attrs, &s2_prot, 10491 page_size, fi, 10492 cacheattrs != NULL ? &cacheattrs2 : NULL); 10493 fi->s2addr = ipa; 10494 /* Combine the S1 and S2 perms. */ 10495 *prot &= s2_prot; 10496 10497 /* Combine the S1 and S2 cache attributes, if needed */ 10498 if (!ret && cacheattrs != NULL) { 10499 if (env->cp15.hcr_el2 & HCR_DC) { 10500 /* 10501 * HCR.DC forces the first stage attributes to 10502 * Normal Non-Shareable, 10503 * Inner Write-Back Read-Allocate Write-Allocate, 10504 * Outer Write-Back Read-Allocate Write-Allocate. 10505 */ 10506 cacheattrs->attrs = 0xff; 10507 cacheattrs->shareability = 0; 10508 } 10509 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2); 10510 } 10511 10512 return ret; 10513 } else { 10514 /* 10515 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1. 10516 */ 10517 mmu_idx = stage_1_mmu_idx(mmu_idx); 10518 } 10519 } 10520 10521 /* The page table entries may downgrade secure to non-secure, but 10522 * cannot upgrade an non-secure translation regime's attributes 10523 * to secure. 10524 */ 10525 attrs->secure = regime_is_secure(env, mmu_idx); 10526 attrs->user = regime_is_user(env, mmu_idx); 10527 10528 /* Fast Context Switch Extension. This doesn't exist at all in v8. 10529 * In v7 and earlier it affects all stage 1 translations. 10530 */ 10531 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS 10532 && !arm_feature(env, ARM_FEATURE_V8)) { 10533 if (regime_el(env, mmu_idx) == 3) { 10534 address += env->cp15.fcseidr_s; 10535 } else { 10536 address += env->cp15.fcseidr_ns; 10537 } 10538 } 10539 10540 if (arm_feature(env, ARM_FEATURE_PMSA)) { 10541 bool ret; 10542 *page_size = TARGET_PAGE_SIZE; 10543 10544 if (arm_feature(env, ARM_FEATURE_V8)) { 10545 /* PMSAv8 */ 10546 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 10547 phys_ptr, attrs, prot, page_size, fi); 10548 } else if (arm_feature(env, ARM_FEATURE_V7)) { 10549 /* PMSAv7 */ 10550 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 10551 phys_ptr, prot, page_size, fi); 10552 } else { 10553 /* Pre-v7 MPU */ 10554 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 10555 phys_ptr, prot, fi); 10556 } 10557 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 10558 " mmu_idx %u -> %s (prot %c%c%c)\n", 10559 access_type == MMU_DATA_LOAD ? "reading" : 10560 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 10561 (uint32_t)address, mmu_idx, 10562 ret ? "Miss" : "Hit", 10563 *prot & PAGE_READ ? 'r' : '-', 10564 *prot & PAGE_WRITE ? 'w' : '-', 10565 *prot & PAGE_EXEC ? 'x' : '-'); 10566 10567 return ret; 10568 } 10569 10570 /* Definitely a real MMU, not an MPU */ 10571 10572 if (regime_translation_disabled(env, mmu_idx)) { 10573 /* MMU disabled. */ 10574 *phys_ptr = address; 10575 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10576 *page_size = TARGET_PAGE_SIZE; 10577 return 0; 10578 } 10579 10580 if (regime_using_lpae_format(env, mmu_idx)) { 10581 return get_phys_addr_lpae(env, address, access_type, mmu_idx, 10582 phys_ptr, attrs, prot, page_size, 10583 fi, cacheattrs); 10584 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) { 10585 return get_phys_addr_v6(env, address, access_type, mmu_idx, 10586 phys_ptr, attrs, prot, page_size, fi); 10587 } else { 10588 return get_phys_addr_v5(env, address, access_type, mmu_idx, 10589 phys_ptr, prot, page_size, fi); 10590 } 10591 } 10592 10593 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 10594 MemTxAttrs *attrs) 10595 { 10596 ARMCPU *cpu = ARM_CPU(cs); 10597 CPUARMState *env = &cpu->env; 10598 hwaddr phys_addr; 10599 target_ulong page_size; 10600 int prot; 10601 bool ret; 10602 ARMMMUFaultInfo fi = {}; 10603 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 10604 10605 *attrs = (MemTxAttrs) {}; 10606 10607 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr, 10608 attrs, &prot, &page_size, &fi, NULL); 10609 10610 if (ret) { 10611 return -1; 10612 } 10613 return phys_addr; 10614 } 10615 10616 #endif 10617 10618 /* Note that signed overflow is undefined in C. The following routines are 10619 careful to use unsigned types where modulo arithmetic is required. 10620 Failure to do so _will_ break on newer gcc. */ 10621 10622 /* Signed saturating arithmetic. */ 10623 10624 /* Perform 16-bit signed saturating addition. */ 10625 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 10626 { 10627 uint16_t res; 10628 10629 res = a + b; 10630 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 10631 if (a & 0x8000) 10632 res = 0x8000; 10633 else 10634 res = 0x7fff; 10635 } 10636 return res; 10637 } 10638 10639 /* Perform 8-bit signed saturating addition. */ 10640 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 10641 { 10642 uint8_t res; 10643 10644 res = a + b; 10645 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 10646 if (a & 0x80) 10647 res = 0x80; 10648 else 10649 res = 0x7f; 10650 } 10651 return res; 10652 } 10653 10654 /* Perform 16-bit signed saturating subtraction. */ 10655 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 10656 { 10657 uint16_t res; 10658 10659 res = a - b; 10660 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 10661 if (a & 0x8000) 10662 res = 0x8000; 10663 else 10664 res = 0x7fff; 10665 } 10666 return res; 10667 } 10668 10669 /* Perform 8-bit signed saturating subtraction. */ 10670 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 10671 { 10672 uint8_t res; 10673 10674 res = a - b; 10675 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 10676 if (a & 0x80) 10677 res = 0x80; 10678 else 10679 res = 0x7f; 10680 } 10681 return res; 10682 } 10683 10684 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 10685 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 10686 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 10687 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 10688 #define PFX q 10689 10690 #include "op_addsub.h" 10691 10692 /* Unsigned saturating arithmetic. */ 10693 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 10694 { 10695 uint16_t res; 10696 res = a + b; 10697 if (res < a) 10698 res = 0xffff; 10699 return res; 10700 } 10701 10702 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 10703 { 10704 if (a > b) 10705 return a - b; 10706 else 10707 return 0; 10708 } 10709 10710 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 10711 { 10712 uint8_t res; 10713 res = a + b; 10714 if (res < a) 10715 res = 0xff; 10716 return res; 10717 } 10718 10719 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 10720 { 10721 if (a > b) 10722 return a - b; 10723 else 10724 return 0; 10725 } 10726 10727 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 10728 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 10729 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 10730 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 10731 #define PFX uq 10732 10733 #include "op_addsub.h" 10734 10735 /* Signed modulo arithmetic. */ 10736 #define SARITH16(a, b, n, op) do { \ 10737 int32_t sum; \ 10738 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 10739 RESULT(sum, n, 16); \ 10740 if (sum >= 0) \ 10741 ge |= 3 << (n * 2); \ 10742 } while(0) 10743 10744 #define SARITH8(a, b, n, op) do { \ 10745 int32_t sum; \ 10746 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 10747 RESULT(sum, n, 8); \ 10748 if (sum >= 0) \ 10749 ge |= 1 << n; \ 10750 } while(0) 10751 10752 10753 #define ADD16(a, b, n) SARITH16(a, b, n, +) 10754 #define SUB16(a, b, n) SARITH16(a, b, n, -) 10755 #define ADD8(a, b, n) SARITH8(a, b, n, +) 10756 #define SUB8(a, b, n) SARITH8(a, b, n, -) 10757 #define PFX s 10758 #define ARITH_GE 10759 10760 #include "op_addsub.h" 10761 10762 /* Unsigned modulo arithmetic. */ 10763 #define ADD16(a, b, n) do { \ 10764 uint32_t sum; \ 10765 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 10766 RESULT(sum, n, 16); \ 10767 if ((sum >> 16) == 1) \ 10768 ge |= 3 << (n * 2); \ 10769 } while(0) 10770 10771 #define ADD8(a, b, n) do { \ 10772 uint32_t sum; \ 10773 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 10774 RESULT(sum, n, 8); \ 10775 if ((sum >> 8) == 1) \ 10776 ge |= 1 << n; \ 10777 } while(0) 10778 10779 #define SUB16(a, b, n) do { \ 10780 uint32_t sum; \ 10781 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 10782 RESULT(sum, n, 16); \ 10783 if ((sum >> 16) == 0) \ 10784 ge |= 3 << (n * 2); \ 10785 } while(0) 10786 10787 #define SUB8(a, b, n) do { \ 10788 uint32_t sum; \ 10789 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 10790 RESULT(sum, n, 8); \ 10791 if ((sum >> 8) == 0) \ 10792 ge |= 1 << n; \ 10793 } while(0) 10794 10795 #define PFX u 10796 #define ARITH_GE 10797 10798 #include "op_addsub.h" 10799 10800 /* Halved signed arithmetic. */ 10801 #define ADD16(a, b, n) \ 10802 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 10803 #define SUB16(a, b, n) \ 10804 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 10805 #define ADD8(a, b, n) \ 10806 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 10807 #define SUB8(a, b, n) \ 10808 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 10809 #define PFX sh 10810 10811 #include "op_addsub.h" 10812 10813 /* Halved unsigned arithmetic. */ 10814 #define ADD16(a, b, n) \ 10815 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 10816 #define SUB16(a, b, n) \ 10817 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 10818 #define ADD8(a, b, n) \ 10819 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 10820 #define SUB8(a, b, n) \ 10821 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 10822 #define PFX uh 10823 10824 #include "op_addsub.h" 10825 10826 static inline uint8_t do_usad(uint8_t a, uint8_t b) 10827 { 10828 if (a > b) 10829 return a - b; 10830 else 10831 return b - a; 10832 } 10833 10834 /* Unsigned sum of absolute byte differences. */ 10835 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 10836 { 10837 uint32_t sum; 10838 sum = do_usad(a, b); 10839 sum += do_usad(a >> 8, b >> 8); 10840 sum += do_usad(a >> 16, b >>16); 10841 sum += do_usad(a >> 24, b >> 24); 10842 return sum; 10843 } 10844 10845 /* For ARMv6 SEL instruction. */ 10846 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 10847 { 10848 uint32_t mask; 10849 10850 mask = 0; 10851 if (flags & 1) 10852 mask |= 0xff; 10853 if (flags & 2) 10854 mask |= 0xff00; 10855 if (flags & 4) 10856 mask |= 0xff0000; 10857 if (flags & 8) 10858 mask |= 0xff000000; 10859 return (a & mask) | (b & ~mask); 10860 } 10861 10862 /* CRC helpers. 10863 * The upper bytes of val (above the number specified by 'bytes') must have 10864 * been zeroed out by the caller. 10865 */ 10866 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 10867 { 10868 uint8_t buf[4]; 10869 10870 stl_le_p(buf, val); 10871 10872 /* zlib crc32 converts the accumulator and output to one's complement. */ 10873 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 10874 } 10875 10876 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 10877 { 10878 uint8_t buf[4]; 10879 10880 stl_le_p(buf, val); 10881 10882 /* Linux crc32c converts the output to one's complement. */ 10883 return crc32c(acc, buf, bytes) ^ 0xffffffff; 10884 } 10885 10886 /* Return the exception level to which FP-disabled exceptions should 10887 * be taken, or 0 if FP is enabled. 10888 */ 10889 int fp_exception_el(CPUARMState *env, int cur_el) 10890 { 10891 #ifndef CONFIG_USER_ONLY 10892 int fpen; 10893 10894 /* CPACR and the CPTR registers don't exist before v6, so FP is 10895 * always accessible 10896 */ 10897 if (!arm_feature(env, ARM_FEATURE_V6)) { 10898 return 0; 10899 } 10900 10901 if (arm_feature(env, ARM_FEATURE_M)) { 10902 /* CPACR can cause a NOCP UsageFault taken to current security state */ 10903 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) { 10904 return 1; 10905 } 10906 10907 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) { 10908 if (!extract32(env->v7m.nsacr, 10, 1)) { 10909 /* FP insns cause a NOCP UsageFault taken to Secure */ 10910 return 3; 10911 } 10912 } 10913 10914 return 0; 10915 } 10916 10917 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit: 10918 * 0, 2 : trap EL0 and EL1/PL1 accesses 10919 * 1 : trap only EL0 accesses 10920 * 3 : trap no accesses 10921 */ 10922 fpen = extract32(env->cp15.cpacr_el1, 20, 2); 10923 switch (fpen) { 10924 case 0: 10925 case 2: 10926 if (cur_el == 0 || cur_el == 1) { 10927 /* Trap to PL1, which might be EL1 or EL3 */ 10928 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) { 10929 return 3; 10930 } 10931 return 1; 10932 } 10933 if (cur_el == 3 && !is_a64(env)) { 10934 /* Secure PL1 running at EL3 */ 10935 return 3; 10936 } 10937 break; 10938 case 1: 10939 if (cur_el == 0) { 10940 return 1; 10941 } 10942 break; 10943 case 3: 10944 break; 10945 } 10946 10947 /* 10948 * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode 10949 * to control non-secure access to the FPU. It doesn't have any 10950 * effect if EL3 is AArch64 or if EL3 doesn't exist at all. 10951 */ 10952 if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 10953 cur_el <= 2 && !arm_is_secure_below_el3(env))) { 10954 if (!extract32(env->cp15.nsacr, 10, 1)) { 10955 /* FP insns act as UNDEF */ 10956 return cur_el == 2 ? 2 : 1; 10957 } 10958 } 10959 10960 /* For the CPTR registers we don't need to guard with an ARM_FEATURE 10961 * check because zero bits in the registers mean "don't trap". 10962 */ 10963 10964 /* CPTR_EL2 : present in v7VE or v8 */ 10965 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1) 10966 && !arm_is_secure_below_el3(env)) { 10967 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */ 10968 return 2; 10969 } 10970 10971 /* CPTR_EL3 : present in v8 */ 10972 if (extract32(env->cp15.cptr_el[3], 10, 1)) { 10973 /* Trap all FP ops to EL3 */ 10974 return 3; 10975 } 10976 #endif 10977 return 0; 10978 } 10979 10980 #ifndef CONFIG_TCG 10981 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 10982 { 10983 g_assert_not_reached(); 10984 } 10985 #endif 10986 10987 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 10988 { 10989 int el; 10990 10991 if (arm_feature(env, ARM_FEATURE_M)) { 10992 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 10993 } 10994 10995 el = arm_current_el(env); 10996 if (el < 2 && arm_is_secure_below_el3(env)) { 10997 return ARMMMUIdx_S1SE0 + el; 10998 } else { 10999 return ARMMMUIdx_S12NSE0 + el; 11000 } 11001 } 11002 11003 int cpu_mmu_index(CPUARMState *env, bool ifetch) 11004 { 11005 return arm_to_core_mmu_idx(arm_mmu_idx(env)); 11006 } 11007 11008 #ifndef CONFIG_USER_ONLY 11009 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 11010 { 11011 return stage_1_mmu_idx(arm_mmu_idx(env)); 11012 } 11013 #endif 11014 11015 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 11016 target_ulong *cs_base, uint32_t *pflags) 11017 { 11018 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 11019 int current_el = arm_current_el(env); 11020 int fp_el = fp_exception_el(env, current_el); 11021 uint32_t flags = 0; 11022 11023 if (is_a64(env)) { 11024 ARMCPU *cpu = env_archcpu(env); 11025 uint64_t sctlr; 11026 11027 *pc = env->pc; 11028 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1); 11029 11030 /* Get control bits for tagged addresses. */ 11031 { 11032 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx); 11033 ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1); 11034 int tbii, tbid; 11035 11036 /* FIXME: ARMv8.1-VHE S2 translation regime. */ 11037 if (regime_el(env, stage1) < 2) { 11038 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1); 11039 tbid = (p1.tbi << 1) | p0.tbi; 11040 tbii = tbid & ~((p1.tbid << 1) | p0.tbid); 11041 } else { 11042 tbid = p0.tbi; 11043 tbii = tbid & !p0.tbid; 11044 } 11045 11046 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii); 11047 flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid); 11048 } 11049 11050 if (cpu_isar_feature(aa64_sve, cpu)) { 11051 int sve_el = sve_exception_el(env, current_el); 11052 uint32_t zcr_len; 11053 11054 /* If SVE is disabled, but FP is enabled, 11055 * then the effective len is 0. 11056 */ 11057 if (sve_el != 0 && fp_el == 0) { 11058 zcr_len = 0; 11059 } else { 11060 zcr_len = sve_zcr_len_for_el(env, current_el); 11061 } 11062 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el); 11063 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len); 11064 } 11065 11066 sctlr = arm_sctlr(env, current_el); 11067 11068 if (cpu_isar_feature(aa64_pauth, cpu)) { 11069 /* 11070 * In order to save space in flags, we record only whether 11071 * pauth is "inactive", meaning all insns are implemented as 11072 * a nop, or "active" when some action must be performed. 11073 * The decision of which action to take is left to a helper. 11074 */ 11075 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) { 11076 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1); 11077 } 11078 } 11079 11080 if (cpu_isar_feature(aa64_bti, cpu)) { 11081 /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */ 11082 if (sctlr & (current_el == 0 ? SCTLR_BT0 : SCTLR_BT1)) { 11083 flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1); 11084 } 11085 flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype); 11086 } 11087 } else { 11088 *pc = env->regs[15]; 11089 flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb); 11090 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, env->vfp.vec_len); 11091 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, env->vfp.vec_stride); 11092 flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits); 11093 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, arm_sctlr_b(env)); 11094 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env)); 11095 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30) 11096 || arm_el_is_aa64(env, 1) || arm_feature(env, ARM_FEATURE_M)) { 11097 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 11098 } 11099 /* Note that XSCALE_CPAR shares bits with VECSTRIDE */ 11100 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 11101 flags = FIELD_DP32(flags, TBFLAG_A32, 11102 XSCALE_CPAR, env->cp15.c15_cpar); 11103 } 11104 } 11105 11106 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, arm_to_core_mmu_idx(mmu_idx)); 11107 11108 /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 11109 * states defined in the ARM ARM for software singlestep: 11110 * SS_ACTIVE PSTATE.SS State 11111 * 0 x Inactive (the TB flag for SS is always 0) 11112 * 1 0 Active-pending 11113 * 1 1 Active-not-pending 11114 */ 11115 if (arm_singlestep_active(env)) { 11116 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1); 11117 if (is_a64(env)) { 11118 if (env->pstate & PSTATE_SS) { 11119 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 11120 } 11121 } else { 11122 if (env->uncached_cpsr & PSTATE_SS) { 11123 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 11124 } 11125 } 11126 } 11127 if (arm_cpu_data_is_big_endian(env)) { 11128 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 11129 } 11130 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el); 11131 11132 if (arm_v7m_is_handler_mode(env)) { 11133 flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1); 11134 } 11135 11136 /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is 11137 * suppressing them because the requested execution priority is less than 0. 11138 */ 11139 if (arm_feature(env, ARM_FEATURE_V8) && 11140 arm_feature(env, ARM_FEATURE_M) && 11141 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) && 11142 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) { 11143 flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1); 11144 } 11145 11146 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 11147 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) != env->v7m.secure) { 11148 flags = FIELD_DP32(flags, TBFLAG_A32, FPCCR_S_WRONG, 1); 11149 } 11150 11151 if (arm_feature(env, ARM_FEATURE_M) && 11152 (env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) && 11153 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) || 11154 (env->v7m.secure && 11155 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) { 11156 /* 11157 * ASPEN is set, but FPCA/SFPA indicate that there is no active 11158 * FP context; we must create a new FP context before executing 11159 * any FP insn. 11160 */ 11161 flags = FIELD_DP32(flags, TBFLAG_A32, NEW_FP_CTXT_NEEDED, 1); 11162 } 11163 11164 if (arm_feature(env, ARM_FEATURE_M)) { 11165 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 11166 11167 if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) { 11168 flags = FIELD_DP32(flags, TBFLAG_A32, LSPACT, 1); 11169 } 11170 } 11171 11172 *pflags = flags; 11173 *cs_base = 0; 11174 } 11175 11176 #ifdef TARGET_AARCH64 11177 /* 11178 * The manual says that when SVE is enabled and VQ is widened the 11179 * implementation is allowed to zero the previously inaccessible 11180 * portion of the registers. The corollary to that is that when 11181 * SVE is enabled and VQ is narrowed we are also allowed to zero 11182 * the now inaccessible portion of the registers. 11183 * 11184 * The intent of this is that no predicate bit beyond VQ is ever set. 11185 * Which means that some operations on predicate registers themselves 11186 * may operate on full uint64_t or even unrolled across the maximum 11187 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 11188 * may well be cheaper than conditionals to restrict the operation 11189 * to the relevant portion of a uint16_t[16]. 11190 */ 11191 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 11192 { 11193 int i, j; 11194 uint64_t pmask; 11195 11196 assert(vq >= 1 && vq <= ARM_MAX_VQ); 11197 assert(vq <= env_archcpu(env)->sve_max_vq); 11198 11199 /* Zap the high bits of the zregs. */ 11200 for (i = 0; i < 32; i++) { 11201 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 11202 } 11203 11204 /* Zap the high bits of the pregs and ffr. */ 11205 pmask = 0; 11206 if (vq & 3) { 11207 pmask = ~(-1ULL << (16 * (vq & 3))); 11208 } 11209 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 11210 for (i = 0; i < 17; ++i) { 11211 env->vfp.pregs[i].p[j] &= pmask; 11212 } 11213 pmask = 0; 11214 } 11215 } 11216 11217 /* 11218 * Notice a change in SVE vector size when changing EL. 11219 */ 11220 void aarch64_sve_change_el(CPUARMState *env, int old_el, 11221 int new_el, bool el0_a64) 11222 { 11223 ARMCPU *cpu = env_archcpu(env); 11224 int old_len, new_len; 11225 bool old_a64, new_a64; 11226 11227 /* Nothing to do if no SVE. */ 11228 if (!cpu_isar_feature(aa64_sve, cpu)) { 11229 return; 11230 } 11231 11232 /* Nothing to do if FP is disabled in either EL. */ 11233 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 11234 return; 11235 } 11236 11237 /* 11238 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 11239 * at ELx, or not available because the EL is in AArch32 state, then 11240 * for all purposes other than a direct read, the ZCR_ELx.LEN field 11241 * has an effective value of 0". 11242 * 11243 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 11244 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 11245 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 11246 * we already have the correct register contents when encountering the 11247 * vq0->vq0 transition between EL0->EL1. 11248 */ 11249 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 11250 old_len = (old_a64 && !sve_exception_el(env, old_el) 11251 ? sve_zcr_len_for_el(env, old_el) : 0); 11252 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 11253 new_len = (new_a64 && !sve_exception_el(env, new_el) 11254 ? sve_zcr_len_for_el(env, new_el) : 0); 11255 11256 /* When changing vector length, clear inaccessible state. */ 11257 if (new_len < old_len) { 11258 aarch64_sve_narrow_vq(env, new_len + 1); 11259 } 11260 } 11261 #endif 11262