1 #include "qemu/osdep.h" 2 #include "target/arm/idau.h" 3 #include "trace.h" 4 #include "cpu.h" 5 #include "internals.h" 6 #include "exec/gdbstub.h" 7 #include "exec/helper-proto.h" 8 #include "qemu/host-utils.h" 9 #include "sysemu/arch_init.h" 10 #include "sysemu/sysemu.h" 11 #include "qemu/bitops.h" 12 #include "qemu/crc32c.h" 13 #include "exec/exec-all.h" 14 #include "exec/cpu_ldst.h" 15 #include "arm_ldst.h" 16 #include <zlib.h> /* For crc32 */ 17 #include "exec/semihost.h" 18 #include "sysemu/cpus.h" 19 #include "sysemu/kvm.h" 20 #include "fpu/softfloat.h" 21 #include "qemu/range.h" 22 23 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 24 25 #ifndef CONFIG_USER_ONLY 26 /* Cacheability and shareability attributes for a memory access */ 27 typedef struct ARMCacheAttrs { 28 unsigned int attrs:8; /* as in the MAIR register encoding */ 29 unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */ 30 } ARMCacheAttrs; 31 32 static bool get_phys_addr(CPUARMState *env, target_ulong address, 33 MMUAccessType access_type, ARMMMUIdx mmu_idx, 34 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 35 target_ulong *page_size, 36 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 37 38 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 39 MMUAccessType access_type, ARMMMUIdx mmu_idx, 40 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 41 target_ulong *page_size_ptr, 42 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 43 44 /* Security attributes for an address, as returned by v8m_security_lookup. */ 45 typedef struct V8M_SAttributes { 46 bool subpage; /* true if these attrs don't cover the whole TARGET_PAGE */ 47 bool ns; 48 bool nsc; 49 uint8_t sregion; 50 bool srvalid; 51 uint8_t iregion; 52 bool irvalid; 53 } V8M_SAttributes; 54 55 static void v8m_security_lookup(CPUARMState *env, uint32_t address, 56 MMUAccessType access_type, ARMMMUIdx mmu_idx, 57 V8M_SAttributes *sattrs); 58 #endif 59 60 static void switch_mode(CPUARMState *env, int mode); 61 62 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 63 { 64 int nregs; 65 66 /* VFP data registers are always little-endian. */ 67 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 68 if (reg < nregs) { 69 stq_le_p(buf, *aa32_vfp_dreg(env, reg)); 70 return 8; 71 } 72 if (arm_feature(env, ARM_FEATURE_NEON)) { 73 /* Aliases for Q regs. */ 74 nregs += 16; 75 if (reg < nregs) { 76 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 77 stq_le_p(buf, q[0]); 78 stq_le_p(buf + 8, q[1]); 79 return 16; 80 } 81 } 82 switch (reg - nregs) { 83 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4; 84 case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4; 85 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4; 86 } 87 return 0; 88 } 89 90 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 91 { 92 int nregs; 93 94 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 95 if (reg < nregs) { 96 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf); 97 return 8; 98 } 99 if (arm_feature(env, ARM_FEATURE_NEON)) { 100 nregs += 16; 101 if (reg < nregs) { 102 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 103 q[0] = ldq_le_p(buf); 104 q[1] = ldq_le_p(buf + 8); 105 return 16; 106 } 107 } 108 switch (reg - nregs) { 109 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4; 110 case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4; 111 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4; 112 } 113 return 0; 114 } 115 116 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 117 { 118 switch (reg) { 119 case 0 ... 31: 120 /* 128 bit FP register */ 121 { 122 uint64_t *q = aa64_vfp_qreg(env, reg); 123 stq_le_p(buf, q[0]); 124 stq_le_p(buf + 8, q[1]); 125 return 16; 126 } 127 case 32: 128 /* FPSR */ 129 stl_p(buf, vfp_get_fpsr(env)); 130 return 4; 131 case 33: 132 /* FPCR */ 133 stl_p(buf, vfp_get_fpcr(env)); 134 return 4; 135 default: 136 return 0; 137 } 138 } 139 140 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 141 { 142 switch (reg) { 143 case 0 ... 31: 144 /* 128 bit FP register */ 145 { 146 uint64_t *q = aa64_vfp_qreg(env, reg); 147 q[0] = ldq_le_p(buf); 148 q[1] = ldq_le_p(buf + 8); 149 return 16; 150 } 151 case 32: 152 /* FPSR */ 153 vfp_set_fpsr(env, ldl_p(buf)); 154 return 4; 155 case 33: 156 /* FPCR */ 157 vfp_set_fpcr(env, ldl_p(buf)); 158 return 4; 159 default: 160 return 0; 161 } 162 } 163 164 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 165 { 166 assert(ri->fieldoffset); 167 if (cpreg_field_is_64bit(ri)) { 168 return CPREG_FIELD64(env, ri); 169 } else { 170 return CPREG_FIELD32(env, ri); 171 } 172 } 173 174 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 175 uint64_t value) 176 { 177 assert(ri->fieldoffset); 178 if (cpreg_field_is_64bit(ri)) { 179 CPREG_FIELD64(env, ri) = value; 180 } else { 181 CPREG_FIELD32(env, ri) = value; 182 } 183 } 184 185 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 186 { 187 return (char *)env + ri->fieldoffset; 188 } 189 190 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 191 { 192 /* Raw read of a coprocessor register (as needed for migration, etc). */ 193 if (ri->type & ARM_CP_CONST) { 194 return ri->resetvalue; 195 } else if (ri->raw_readfn) { 196 return ri->raw_readfn(env, ri); 197 } else if (ri->readfn) { 198 return ri->readfn(env, ri); 199 } else { 200 return raw_read(env, ri); 201 } 202 } 203 204 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 205 uint64_t v) 206 { 207 /* Raw write of a coprocessor register (as needed for migration, etc). 208 * Note that constant registers are treated as write-ignored; the 209 * caller should check for success by whether a readback gives the 210 * value written. 211 */ 212 if (ri->type & ARM_CP_CONST) { 213 return; 214 } else if (ri->raw_writefn) { 215 ri->raw_writefn(env, ri, v); 216 } else if (ri->writefn) { 217 ri->writefn(env, ri, v); 218 } else { 219 raw_write(env, ri, v); 220 } 221 } 222 223 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg) 224 { 225 ARMCPU *cpu = arm_env_get_cpu(env); 226 const ARMCPRegInfo *ri; 227 uint32_t key; 228 229 key = cpu->dyn_xml.cpregs_keys[reg]; 230 ri = get_arm_cp_reginfo(cpu->cp_regs, key); 231 if (ri) { 232 if (cpreg_field_is_64bit(ri)) { 233 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri)); 234 } else { 235 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri)); 236 } 237 } 238 return 0; 239 } 240 241 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg) 242 { 243 return 0; 244 } 245 246 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 247 { 248 /* Return true if the regdef would cause an assertion if you called 249 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 250 * program bug for it not to have the NO_RAW flag). 251 * NB that returning false here doesn't necessarily mean that calling 252 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 253 * read/write access functions which are safe for raw use" from "has 254 * read/write access functions which have side effects but has forgotten 255 * to provide raw access functions". 256 * The tests here line up with the conditions in read/write_raw_cp_reg() 257 * and assertions in raw_read()/raw_write(). 258 */ 259 if ((ri->type & ARM_CP_CONST) || 260 ri->fieldoffset || 261 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 262 return false; 263 } 264 return true; 265 } 266 267 bool write_cpustate_to_list(ARMCPU *cpu) 268 { 269 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 270 int i; 271 bool ok = true; 272 273 for (i = 0; i < cpu->cpreg_array_len; i++) { 274 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 275 const ARMCPRegInfo *ri; 276 277 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 278 if (!ri) { 279 ok = false; 280 continue; 281 } 282 if (ri->type & ARM_CP_NO_RAW) { 283 continue; 284 } 285 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri); 286 } 287 return ok; 288 } 289 290 bool write_list_to_cpustate(ARMCPU *cpu) 291 { 292 int i; 293 bool ok = true; 294 295 for (i = 0; i < cpu->cpreg_array_len; i++) { 296 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 297 uint64_t v = cpu->cpreg_values[i]; 298 const ARMCPRegInfo *ri; 299 300 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 301 if (!ri) { 302 ok = false; 303 continue; 304 } 305 if (ri->type & ARM_CP_NO_RAW) { 306 continue; 307 } 308 /* Write value and confirm it reads back as written 309 * (to catch read-only registers and partially read-only 310 * registers where the incoming migration value doesn't match) 311 */ 312 write_raw_cp_reg(&cpu->env, ri, v); 313 if (read_raw_cp_reg(&cpu->env, ri) != v) { 314 ok = false; 315 } 316 } 317 return ok; 318 } 319 320 static void add_cpreg_to_list(gpointer key, gpointer opaque) 321 { 322 ARMCPU *cpu = opaque; 323 uint64_t regidx; 324 const ARMCPRegInfo *ri; 325 326 regidx = *(uint32_t *)key; 327 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 328 329 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 330 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 331 /* The value array need not be initialized at this point */ 332 cpu->cpreg_array_len++; 333 } 334 } 335 336 static void count_cpreg(gpointer key, gpointer opaque) 337 { 338 ARMCPU *cpu = opaque; 339 uint64_t regidx; 340 const ARMCPRegInfo *ri; 341 342 regidx = *(uint32_t *)key; 343 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 344 345 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 346 cpu->cpreg_array_len++; 347 } 348 } 349 350 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 351 { 352 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a); 353 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b); 354 355 if (aidx > bidx) { 356 return 1; 357 } 358 if (aidx < bidx) { 359 return -1; 360 } 361 return 0; 362 } 363 364 void init_cpreg_list(ARMCPU *cpu) 365 { 366 /* Initialise the cpreg_tuples[] array based on the cp_regs hash. 367 * Note that we require cpreg_tuples[] to be sorted by key ID. 368 */ 369 GList *keys; 370 int arraylen; 371 372 keys = g_hash_table_get_keys(cpu->cp_regs); 373 keys = g_list_sort(keys, cpreg_key_compare); 374 375 cpu->cpreg_array_len = 0; 376 377 g_list_foreach(keys, count_cpreg, cpu); 378 379 arraylen = cpu->cpreg_array_len; 380 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 381 cpu->cpreg_values = g_new(uint64_t, arraylen); 382 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 383 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 384 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 385 cpu->cpreg_array_len = 0; 386 387 g_list_foreach(keys, add_cpreg_to_list, cpu); 388 389 assert(cpu->cpreg_array_len == arraylen); 390 391 g_list_free(keys); 392 } 393 394 /* 395 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but 396 * they are accessible when EL3 is using AArch64 regardless of EL3.NS. 397 * 398 * access_el3_aa32ns: Used to check AArch32 register views. 399 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views. 400 */ 401 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 402 const ARMCPRegInfo *ri, 403 bool isread) 404 { 405 bool secure = arm_is_secure_below_el3(env); 406 407 assert(!arm_el_is_aa64(env, 3)); 408 if (secure) { 409 return CP_ACCESS_TRAP_UNCATEGORIZED; 410 } 411 return CP_ACCESS_OK; 412 } 413 414 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env, 415 const ARMCPRegInfo *ri, 416 bool isread) 417 { 418 if (!arm_el_is_aa64(env, 3)) { 419 return access_el3_aa32ns(env, ri, isread); 420 } 421 return CP_ACCESS_OK; 422 } 423 424 /* Some secure-only AArch32 registers trap to EL3 if used from 425 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 426 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 427 * We assume that the .access field is set to PL1_RW. 428 */ 429 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 430 const ARMCPRegInfo *ri, 431 bool isread) 432 { 433 if (arm_current_el(env) == 3) { 434 return CP_ACCESS_OK; 435 } 436 if (arm_is_secure_below_el3(env)) { 437 return CP_ACCESS_TRAP_EL3; 438 } 439 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 440 return CP_ACCESS_TRAP_UNCATEGORIZED; 441 } 442 443 /* Check for traps to "powerdown debug" registers, which are controlled 444 * by MDCR.TDOSA 445 */ 446 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, 447 bool isread) 448 { 449 int el = arm_current_el(env); 450 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) || 451 (env->cp15.mdcr_el2 & MDCR_TDE) || 452 (arm_hcr_el2_eff(env) & HCR_TGE); 453 454 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) { 455 return CP_ACCESS_TRAP_EL2; 456 } 457 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { 458 return CP_ACCESS_TRAP_EL3; 459 } 460 return CP_ACCESS_OK; 461 } 462 463 /* Check for traps to "debug ROM" registers, which are controlled 464 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. 465 */ 466 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, 467 bool isread) 468 { 469 int el = arm_current_el(env); 470 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) || 471 (env->cp15.mdcr_el2 & MDCR_TDE) || 472 (arm_hcr_el2_eff(env) & HCR_TGE); 473 474 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) { 475 return CP_ACCESS_TRAP_EL2; 476 } 477 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 478 return CP_ACCESS_TRAP_EL3; 479 } 480 return CP_ACCESS_OK; 481 } 482 483 /* Check for traps to general debug registers, which are controlled 484 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. 485 */ 486 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, 487 bool isread) 488 { 489 int el = arm_current_el(env); 490 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) || 491 (env->cp15.mdcr_el2 & MDCR_TDE) || 492 (arm_hcr_el2_eff(env) & HCR_TGE); 493 494 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) { 495 return CP_ACCESS_TRAP_EL2; 496 } 497 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 498 return CP_ACCESS_TRAP_EL3; 499 } 500 return CP_ACCESS_OK; 501 } 502 503 /* Check for traps to performance monitor registers, which are controlled 504 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 505 */ 506 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 507 bool isread) 508 { 509 int el = arm_current_el(env); 510 511 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 512 && !arm_is_secure_below_el3(env)) { 513 return CP_ACCESS_TRAP_EL2; 514 } 515 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 516 return CP_ACCESS_TRAP_EL3; 517 } 518 return CP_ACCESS_OK; 519 } 520 521 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 522 { 523 ARMCPU *cpu = arm_env_get_cpu(env); 524 525 raw_write(env, ri, value); 526 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 527 } 528 529 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 530 { 531 ARMCPU *cpu = arm_env_get_cpu(env); 532 533 if (raw_read(env, ri) != value) { 534 /* Unlike real hardware the qemu TLB uses virtual addresses, 535 * not modified virtual addresses, so this causes a TLB flush. 536 */ 537 tlb_flush(CPU(cpu)); 538 raw_write(env, ri, value); 539 } 540 } 541 542 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 543 uint64_t value) 544 { 545 ARMCPU *cpu = arm_env_get_cpu(env); 546 547 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 548 && !extended_addresses_enabled(env)) { 549 /* For VMSA (when not using the LPAE long descriptor page table 550 * format) this register includes the ASID, so do a TLB flush. 551 * For PMSA it is purely a process ID and no action is needed. 552 */ 553 tlb_flush(CPU(cpu)); 554 } 555 raw_write(env, ri, value); 556 } 557 558 /* IS variants of TLB operations must affect all cores */ 559 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 560 uint64_t value) 561 { 562 CPUState *cs = ENV_GET_CPU(env); 563 564 tlb_flush_all_cpus_synced(cs); 565 } 566 567 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 568 uint64_t value) 569 { 570 CPUState *cs = ENV_GET_CPU(env); 571 572 tlb_flush_all_cpus_synced(cs); 573 } 574 575 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 576 uint64_t value) 577 { 578 CPUState *cs = ENV_GET_CPU(env); 579 580 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 581 } 582 583 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 584 uint64_t value) 585 { 586 CPUState *cs = ENV_GET_CPU(env); 587 588 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 589 } 590 591 /* 592 * Non-IS variants of TLB operations are upgraded to 593 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to 594 * force broadcast of these operations. 595 */ 596 static bool tlb_force_broadcast(CPUARMState *env) 597 { 598 return (env->cp15.hcr_el2 & HCR_FB) && 599 arm_current_el(env) == 1 && arm_is_secure_below_el3(env); 600 } 601 602 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 603 uint64_t value) 604 { 605 /* Invalidate all (TLBIALL) */ 606 ARMCPU *cpu = arm_env_get_cpu(env); 607 608 if (tlb_force_broadcast(env)) { 609 tlbiall_is_write(env, NULL, value); 610 return; 611 } 612 613 tlb_flush(CPU(cpu)); 614 } 615 616 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 617 uint64_t value) 618 { 619 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 620 ARMCPU *cpu = arm_env_get_cpu(env); 621 622 if (tlb_force_broadcast(env)) { 623 tlbimva_is_write(env, NULL, value); 624 return; 625 } 626 627 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 628 } 629 630 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 631 uint64_t value) 632 { 633 /* Invalidate by ASID (TLBIASID) */ 634 ARMCPU *cpu = arm_env_get_cpu(env); 635 636 if (tlb_force_broadcast(env)) { 637 tlbiasid_is_write(env, NULL, value); 638 return; 639 } 640 641 tlb_flush(CPU(cpu)); 642 } 643 644 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 645 uint64_t value) 646 { 647 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 648 ARMCPU *cpu = arm_env_get_cpu(env); 649 650 if (tlb_force_broadcast(env)) { 651 tlbimvaa_is_write(env, NULL, value); 652 return; 653 } 654 655 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 656 } 657 658 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 659 uint64_t value) 660 { 661 CPUState *cs = ENV_GET_CPU(env); 662 663 tlb_flush_by_mmuidx(cs, 664 ARMMMUIdxBit_S12NSE1 | 665 ARMMMUIdxBit_S12NSE0 | 666 ARMMMUIdxBit_S2NS); 667 } 668 669 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 670 uint64_t value) 671 { 672 CPUState *cs = ENV_GET_CPU(env); 673 674 tlb_flush_by_mmuidx_all_cpus_synced(cs, 675 ARMMMUIdxBit_S12NSE1 | 676 ARMMMUIdxBit_S12NSE0 | 677 ARMMMUIdxBit_S2NS); 678 } 679 680 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri, 681 uint64_t value) 682 { 683 /* Invalidate by IPA. This has to invalidate any structures that 684 * contain only stage 2 translation information, but does not need 685 * to apply to structures that contain combined stage 1 and stage 2 686 * translation information. 687 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 688 */ 689 CPUState *cs = ENV_GET_CPU(env); 690 uint64_t pageaddr; 691 692 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 693 return; 694 } 695 696 pageaddr = sextract64(value << 12, 0, 40); 697 698 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 699 } 700 701 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 702 uint64_t value) 703 { 704 CPUState *cs = ENV_GET_CPU(env); 705 uint64_t pageaddr; 706 707 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 708 return; 709 } 710 711 pageaddr = sextract64(value << 12, 0, 40); 712 713 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 714 ARMMMUIdxBit_S2NS); 715 } 716 717 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 718 uint64_t value) 719 { 720 CPUState *cs = ENV_GET_CPU(env); 721 722 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 723 } 724 725 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 726 uint64_t value) 727 { 728 CPUState *cs = ENV_GET_CPU(env); 729 730 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 731 } 732 733 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 734 uint64_t value) 735 { 736 CPUState *cs = ENV_GET_CPU(env); 737 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 738 739 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 740 } 741 742 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 743 uint64_t value) 744 { 745 CPUState *cs = ENV_GET_CPU(env); 746 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 747 748 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 749 ARMMMUIdxBit_S1E2); 750 } 751 752 static const ARMCPRegInfo cp_reginfo[] = { 753 /* Define the secure and non-secure FCSE identifier CP registers 754 * separately because there is no secure bank in V8 (no _EL3). This allows 755 * the secure register to be properly reset and migrated. There is also no 756 * v8 EL1 version of the register so the non-secure instance stands alone. 757 */ 758 { .name = "FCSEIDR", 759 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 760 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 761 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 762 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 763 { .name = "FCSEIDR_S", 764 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 765 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 766 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 767 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 768 /* Define the secure and non-secure context identifier CP registers 769 * separately because there is no secure bank in V8 (no _EL3). This allows 770 * the secure register to be properly reset and migrated. In the 771 * non-secure case, the 32-bit register will have reset and migration 772 * disabled during registration as it is handled by the 64-bit instance. 773 */ 774 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 775 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 776 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 777 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 778 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 779 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 780 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 781 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 782 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 783 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 784 REGINFO_SENTINEL 785 }; 786 787 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 788 /* NB: Some of these registers exist in v8 but with more precise 789 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 790 */ 791 /* MMU Domain access control / MPU write buffer control */ 792 { .name = "DACR", 793 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 794 .access = PL1_RW, .resetvalue = 0, 795 .writefn = dacr_write, .raw_writefn = raw_write, 796 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 797 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 798 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 799 * For v6 and v5, these mappings are overly broad. 800 */ 801 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 802 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 803 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 804 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 805 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 806 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 807 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 808 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 809 /* Cache maintenance ops; some of this space may be overridden later. */ 810 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 811 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 812 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 813 REGINFO_SENTINEL 814 }; 815 816 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 817 /* Not all pre-v6 cores implemented this WFI, so this is slightly 818 * over-broad. 819 */ 820 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 821 .access = PL1_W, .type = ARM_CP_WFI }, 822 REGINFO_SENTINEL 823 }; 824 825 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 826 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 827 * is UNPREDICTABLE; we choose to NOP as most implementations do). 828 */ 829 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 830 .access = PL1_W, .type = ARM_CP_WFI }, 831 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice 832 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 833 * OMAPCP will override this space. 834 */ 835 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 836 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 837 .resetvalue = 0 }, 838 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 839 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 840 .resetvalue = 0 }, 841 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 842 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 843 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 844 .resetvalue = 0 }, 845 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 846 * implementing it as RAZ means the "debug architecture version" bits 847 * will read as a reserved value, which should cause Linux to not try 848 * to use the debug hardware. 849 */ 850 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 851 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 852 /* MMU TLB control. Note that the wildcarding means we cover not just 853 * the unified TLB ops but also the dside/iside/inner-shareable variants. 854 */ 855 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 856 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 857 .type = ARM_CP_NO_RAW }, 858 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 859 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 860 .type = ARM_CP_NO_RAW }, 861 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 862 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 863 .type = ARM_CP_NO_RAW }, 864 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 865 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 866 .type = ARM_CP_NO_RAW }, 867 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 868 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 869 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 870 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 871 REGINFO_SENTINEL 872 }; 873 874 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 875 uint64_t value) 876 { 877 uint32_t mask = 0; 878 879 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 880 if (!arm_feature(env, ARM_FEATURE_V8)) { 881 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 882 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 883 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 884 */ 885 if (arm_feature(env, ARM_FEATURE_VFP)) { 886 /* VFP coprocessor: cp10 & cp11 [23:20] */ 887 mask |= (1 << 31) | (1 << 30) | (0xf << 20); 888 889 if (!arm_feature(env, ARM_FEATURE_NEON)) { 890 /* ASEDIS [31] bit is RAO/WI */ 891 value |= (1 << 31); 892 } 893 894 /* VFPv3 and upwards with NEON implement 32 double precision 895 * registers (D0-D31). 896 */ 897 if (!arm_feature(env, ARM_FEATURE_NEON) || 898 !arm_feature(env, ARM_FEATURE_VFP3)) { 899 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 900 value |= (1 << 30); 901 } 902 } 903 value &= mask; 904 } 905 env->cp15.cpacr_el1 = value; 906 } 907 908 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 909 { 910 /* Call cpacr_write() so that we reset with the correct RAO bits set 911 * for our CPU features. 912 */ 913 cpacr_write(env, ri, 0); 914 } 915 916 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 917 bool isread) 918 { 919 if (arm_feature(env, ARM_FEATURE_V8)) { 920 /* Check if CPACR accesses are to be trapped to EL2 */ 921 if (arm_current_el(env) == 1 && 922 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) { 923 return CP_ACCESS_TRAP_EL2; 924 /* Check if CPACR accesses are to be trapped to EL3 */ 925 } else if (arm_current_el(env) < 3 && 926 (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 927 return CP_ACCESS_TRAP_EL3; 928 } 929 } 930 931 return CP_ACCESS_OK; 932 } 933 934 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 935 bool isread) 936 { 937 /* Check if CPTR accesses are set to trap to EL3 */ 938 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 939 return CP_ACCESS_TRAP_EL3; 940 } 941 942 return CP_ACCESS_OK; 943 } 944 945 static const ARMCPRegInfo v6_cp_reginfo[] = { 946 /* prefetch by MVA in v6, NOP in v7 */ 947 { .name = "MVA_prefetch", 948 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 949 .access = PL1_W, .type = ARM_CP_NOP }, 950 /* We need to break the TB after ISB to execute self-modifying code 951 * correctly and also to take any pending interrupts immediately. 952 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 953 */ 954 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 955 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 956 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 957 .access = PL0_W, .type = ARM_CP_NOP }, 958 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 959 .access = PL0_W, .type = ARM_CP_NOP }, 960 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 961 .access = PL1_RW, 962 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 963 offsetof(CPUARMState, cp15.ifar_ns) }, 964 .resetvalue = 0, }, 965 /* Watchpoint Fault Address Register : should actually only be present 966 * for 1136, 1176, 11MPCore. 967 */ 968 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 969 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 970 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 971 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 972 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 973 .resetfn = cpacr_reset, .writefn = cpacr_write }, 974 REGINFO_SENTINEL 975 }; 976 977 /* Definitions for the PMU registers */ 978 #define PMCRN_MASK 0xf800 979 #define PMCRN_SHIFT 11 980 #define PMCRDP 0x10 981 #define PMCRD 0x8 982 #define PMCRC 0x4 983 #define PMCRP 0x2 984 #define PMCRE 0x1 985 986 #define PMXEVTYPER_P 0x80000000 987 #define PMXEVTYPER_U 0x40000000 988 #define PMXEVTYPER_NSK 0x20000000 989 #define PMXEVTYPER_NSU 0x10000000 990 #define PMXEVTYPER_NSH 0x08000000 991 #define PMXEVTYPER_M 0x04000000 992 #define PMXEVTYPER_MT 0x02000000 993 #define PMXEVTYPER_EVTCOUNT 0x0000ffff 994 #define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \ 995 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \ 996 PMXEVTYPER_M | PMXEVTYPER_MT | \ 997 PMXEVTYPER_EVTCOUNT) 998 999 #define PMCCFILTR 0xf8000000 1000 #define PMCCFILTR_M PMXEVTYPER_M 1001 #define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M) 1002 1003 static inline uint32_t pmu_num_counters(CPUARMState *env) 1004 { 1005 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT; 1006 } 1007 1008 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */ 1009 static inline uint64_t pmu_counter_mask(CPUARMState *env) 1010 { 1011 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1); 1012 } 1013 1014 typedef struct pm_event { 1015 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 1016 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 1017 bool (*supported)(CPUARMState *); 1018 /* 1019 * Retrieve the current count of the underlying event. The programmed 1020 * counters hold a difference from the return value from this function 1021 */ 1022 uint64_t (*get_count)(CPUARMState *); 1023 } pm_event; 1024 1025 static bool event_always_supported(CPUARMState *env) 1026 { 1027 return true; 1028 } 1029 1030 static uint64_t swinc_get_count(CPUARMState *env) 1031 { 1032 /* 1033 * SW_INCR events are written directly to the pmevcntr's by writes to 1034 * PMSWINC, so there is no underlying count maintained by the PMU itself 1035 */ 1036 return 0; 1037 } 1038 1039 /* 1040 * Return the underlying cycle count for the PMU cycle counters. If we're in 1041 * usermode, simply return 0. 1042 */ 1043 static uint64_t cycles_get_count(CPUARMState *env) 1044 { 1045 #ifndef CONFIG_USER_ONLY 1046 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1047 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 1048 #else 1049 return cpu_get_host_ticks(); 1050 #endif 1051 } 1052 1053 #ifndef CONFIG_USER_ONLY 1054 static bool instructions_supported(CPUARMState *env) 1055 { 1056 return use_icount == 1 /* Precise instruction counting */; 1057 } 1058 1059 static uint64_t instructions_get_count(CPUARMState *env) 1060 { 1061 return (uint64_t)cpu_get_icount_raw(); 1062 } 1063 #endif 1064 1065 static const pm_event pm_events[] = { 1066 { .number = 0x000, /* SW_INCR */ 1067 .supported = event_always_supported, 1068 .get_count = swinc_get_count, 1069 }, 1070 #ifndef CONFIG_USER_ONLY 1071 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 1072 .supported = instructions_supported, 1073 .get_count = instructions_get_count, 1074 }, 1075 { .number = 0x011, /* CPU_CYCLES, Cycle */ 1076 .supported = event_always_supported, 1077 .get_count = cycles_get_count, 1078 } 1079 #endif 1080 }; 1081 1082 /* 1083 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1084 * events (i.e. the statistical profiling extension), this implementation 1085 * should first be updated to something sparse instead of the current 1086 * supported_event_map[] array. 1087 */ 1088 #define MAX_EVENT_ID 0x11 1089 #define UNSUPPORTED_EVENT UINT16_MAX 1090 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1091 1092 /* 1093 * Called upon initialization to build PMCEID0_EL0 or PMCEID1_EL0 (indicated by 1094 * 'which'). We also use it to build a map of ARM event numbers to indices in 1095 * our pm_events array. 1096 * 1097 * Note: Events in the 0x40XX range are not currently supported. 1098 */ 1099 uint64_t get_pmceid(CPUARMState *env, unsigned which) 1100 { 1101 uint64_t pmceid = 0; 1102 unsigned int i; 1103 1104 assert(which <= 1); 1105 1106 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1107 supported_event_map[i] = UNSUPPORTED_EVENT; 1108 } 1109 1110 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1111 const pm_event *cnt = &pm_events[i]; 1112 assert(cnt->number <= MAX_EVENT_ID); 1113 /* We do not currently support events in the 0x40xx range */ 1114 assert(cnt->number <= 0x3f); 1115 1116 if ((cnt->number & 0x20) == (which << 6) && 1117 cnt->supported(env)) { 1118 pmceid |= (1 << (cnt->number & 0x1f)); 1119 supported_event_map[cnt->number] = i; 1120 } 1121 } 1122 return pmceid; 1123 } 1124 1125 /* 1126 * Check at runtime whether a PMU event is supported for the current machine 1127 */ 1128 static bool event_supported(uint16_t number) 1129 { 1130 if (number > MAX_EVENT_ID) { 1131 return false; 1132 } 1133 return supported_event_map[number] != UNSUPPORTED_EVENT; 1134 } 1135 1136 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1137 bool isread) 1138 { 1139 /* Performance monitor registers user accessibility is controlled 1140 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1141 * trapping to EL2 or EL3 for other accesses. 1142 */ 1143 int el = arm_current_el(env); 1144 1145 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1146 return CP_ACCESS_TRAP; 1147 } 1148 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 1149 && !arm_is_secure_below_el3(env)) { 1150 return CP_ACCESS_TRAP_EL2; 1151 } 1152 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1153 return CP_ACCESS_TRAP_EL3; 1154 } 1155 1156 return CP_ACCESS_OK; 1157 } 1158 1159 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1160 const ARMCPRegInfo *ri, 1161 bool isread) 1162 { 1163 /* ER: event counter read trap control */ 1164 if (arm_feature(env, ARM_FEATURE_V8) 1165 && arm_current_el(env) == 0 1166 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1167 && isread) { 1168 return CP_ACCESS_OK; 1169 } 1170 1171 return pmreg_access(env, ri, isread); 1172 } 1173 1174 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1175 const ARMCPRegInfo *ri, 1176 bool isread) 1177 { 1178 /* SW: software increment write trap control */ 1179 if (arm_feature(env, ARM_FEATURE_V8) 1180 && arm_current_el(env) == 0 1181 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1182 && !isread) { 1183 return CP_ACCESS_OK; 1184 } 1185 1186 return pmreg_access(env, ri, isread); 1187 } 1188 1189 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1190 const ARMCPRegInfo *ri, 1191 bool isread) 1192 { 1193 /* ER: event counter read trap control */ 1194 if (arm_feature(env, ARM_FEATURE_V8) 1195 && arm_current_el(env) == 0 1196 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1197 return CP_ACCESS_OK; 1198 } 1199 1200 return pmreg_access(env, ri, isread); 1201 } 1202 1203 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1204 const ARMCPRegInfo *ri, 1205 bool isread) 1206 { 1207 /* CR: cycle counter read trap control */ 1208 if (arm_feature(env, ARM_FEATURE_V8) 1209 && arm_current_el(env) == 0 1210 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1211 && isread) { 1212 return CP_ACCESS_OK; 1213 } 1214 1215 return pmreg_access(env, ri, isread); 1216 } 1217 1218 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using 1219 * the current EL, security state, and register configuration. 1220 */ 1221 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1222 { 1223 uint64_t filter; 1224 bool e, p, u, nsk, nsu, nsh, m; 1225 bool enabled, prohibited, filtered; 1226 bool secure = arm_is_secure(env); 1227 int el = arm_current_el(env); 1228 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1229 1230 if (!arm_feature(env, ARM_FEATURE_EL2) || 1231 (counter < hpmn || counter == 31)) { 1232 e = env->cp15.c9_pmcr & PMCRE; 1233 } else { 1234 e = env->cp15.mdcr_el2 & MDCR_HPME; 1235 } 1236 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1237 1238 if (!secure) { 1239 if (el == 2 && (counter < hpmn || counter == 31)) { 1240 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD; 1241 } else { 1242 prohibited = false; 1243 } 1244 } else { 1245 prohibited = arm_feature(env, ARM_FEATURE_EL3) && 1246 (env->cp15.mdcr_el3 & MDCR_SPME); 1247 } 1248 1249 if (prohibited && counter == 31) { 1250 prohibited = env->cp15.c9_pmcr & PMCRDP; 1251 } 1252 1253 if (counter == 31) { 1254 filter = env->cp15.pmccfiltr_el0; 1255 } else { 1256 filter = env->cp15.c14_pmevtyper[counter]; 1257 } 1258 1259 p = filter & PMXEVTYPER_P; 1260 u = filter & PMXEVTYPER_U; 1261 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1262 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1263 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1264 m = arm_el_is_aa64(env, 1) && 1265 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1266 1267 if (el == 0) { 1268 filtered = secure ? u : u != nsu; 1269 } else if (el == 1) { 1270 filtered = secure ? p : p != nsk; 1271 } else if (el == 2) { 1272 filtered = !nsh; 1273 } else { /* EL3 */ 1274 filtered = m != p; 1275 } 1276 1277 if (counter != 31) { 1278 /* 1279 * If not checking PMCCNTR, ensure the counter is setup to an event we 1280 * support 1281 */ 1282 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1283 if (!event_supported(event)) { 1284 return false; 1285 } 1286 } 1287 1288 return enabled && !prohibited && !filtered; 1289 } 1290 1291 /* 1292 * Ensure c15_ccnt is the guest-visible count so that operations such as 1293 * enabling/disabling the counter or filtering, modifying the count itself, 1294 * etc. can be done logically. This is essentially a no-op if the counter is 1295 * not enabled at the time of the call. 1296 */ 1297 void pmccntr_op_start(CPUARMState *env) 1298 { 1299 uint64_t cycles = cycles_get_count(env); 1300 1301 if (pmu_counter_enabled(env, 31)) { 1302 uint64_t eff_cycles = cycles; 1303 if (env->cp15.c9_pmcr & PMCRD) { 1304 /* Increment once every 64 processor clock cycles */ 1305 eff_cycles /= 64; 1306 } 1307 1308 env->cp15.c15_ccnt = eff_cycles - env->cp15.c15_ccnt_delta; 1309 } 1310 env->cp15.c15_ccnt_delta = cycles; 1311 } 1312 1313 /* 1314 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1315 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1316 * pmccntr_op_start. 1317 */ 1318 void pmccntr_op_finish(CPUARMState *env) 1319 { 1320 if (pmu_counter_enabled(env, 31)) { 1321 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1322 1323 if (env->cp15.c9_pmcr & PMCRD) { 1324 /* Increment once every 64 processor clock cycles */ 1325 prev_cycles /= 64; 1326 } 1327 1328 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1329 } 1330 } 1331 1332 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1333 { 1334 1335 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1336 uint64_t count = 0; 1337 if (event_supported(event)) { 1338 uint16_t event_idx = supported_event_map[event]; 1339 count = pm_events[event_idx].get_count(env); 1340 } 1341 1342 if (pmu_counter_enabled(env, counter)) { 1343 env->cp15.c14_pmevcntr[counter] = 1344 count - env->cp15.c14_pmevcntr_delta[counter]; 1345 } 1346 env->cp15.c14_pmevcntr_delta[counter] = count; 1347 } 1348 1349 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1350 { 1351 if (pmu_counter_enabled(env, counter)) { 1352 env->cp15.c14_pmevcntr_delta[counter] -= 1353 env->cp15.c14_pmevcntr[counter]; 1354 } 1355 } 1356 1357 void pmu_op_start(CPUARMState *env) 1358 { 1359 unsigned int i; 1360 pmccntr_op_start(env); 1361 for (i = 0; i < pmu_num_counters(env); i++) { 1362 pmevcntr_op_start(env, i); 1363 } 1364 } 1365 1366 void pmu_op_finish(CPUARMState *env) 1367 { 1368 unsigned int i; 1369 pmccntr_op_finish(env); 1370 for (i = 0; i < pmu_num_counters(env); i++) { 1371 pmevcntr_op_finish(env, i); 1372 } 1373 } 1374 1375 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1376 { 1377 pmu_op_start(&cpu->env); 1378 } 1379 1380 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1381 { 1382 pmu_op_finish(&cpu->env); 1383 } 1384 1385 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1386 uint64_t value) 1387 { 1388 pmu_op_start(env); 1389 1390 if (value & PMCRC) { 1391 /* The counter has been reset */ 1392 env->cp15.c15_ccnt = 0; 1393 } 1394 1395 if (value & PMCRP) { 1396 unsigned int i; 1397 for (i = 0; i < pmu_num_counters(env); i++) { 1398 env->cp15.c14_pmevcntr[i] = 0; 1399 } 1400 } 1401 1402 /* only the DP, X, D and E bits are writable */ 1403 env->cp15.c9_pmcr &= ~0x39; 1404 env->cp15.c9_pmcr |= (value & 0x39); 1405 1406 pmu_op_finish(env); 1407 } 1408 1409 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1410 uint64_t value) 1411 { 1412 unsigned int i; 1413 for (i = 0; i < pmu_num_counters(env); i++) { 1414 /* Increment a counter's count iff: */ 1415 if ((value & (1 << i)) && /* counter's bit is set */ 1416 /* counter is enabled and not filtered */ 1417 pmu_counter_enabled(env, i) && 1418 /* counter is SW_INCR */ 1419 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1420 pmevcntr_op_start(env, i); 1421 env->cp15.c14_pmevcntr[i]++; 1422 pmevcntr_op_finish(env, i); 1423 } 1424 } 1425 } 1426 1427 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1428 { 1429 uint64_t ret; 1430 pmccntr_op_start(env); 1431 ret = env->cp15.c15_ccnt; 1432 pmccntr_op_finish(env); 1433 return ret; 1434 } 1435 1436 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1437 uint64_t value) 1438 { 1439 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1440 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1441 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1442 * accessed. 1443 */ 1444 env->cp15.c9_pmselr = value & 0x1f; 1445 } 1446 1447 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1448 uint64_t value) 1449 { 1450 pmccntr_op_start(env); 1451 env->cp15.c15_ccnt = value; 1452 pmccntr_op_finish(env); 1453 } 1454 1455 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1456 uint64_t value) 1457 { 1458 uint64_t cur_val = pmccntr_read(env, NULL); 1459 1460 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1461 } 1462 1463 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1464 uint64_t value) 1465 { 1466 pmccntr_op_start(env); 1467 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1468 pmccntr_op_finish(env); 1469 } 1470 1471 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1472 uint64_t value) 1473 { 1474 pmccntr_op_start(env); 1475 /* M is not accessible from AArch32 */ 1476 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1477 (value & PMCCFILTR); 1478 pmccntr_op_finish(env); 1479 } 1480 1481 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1482 { 1483 /* M is not visible in AArch32 */ 1484 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1485 } 1486 1487 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1488 uint64_t value) 1489 { 1490 value &= pmu_counter_mask(env); 1491 env->cp15.c9_pmcnten |= value; 1492 } 1493 1494 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1495 uint64_t value) 1496 { 1497 value &= pmu_counter_mask(env); 1498 env->cp15.c9_pmcnten &= ~value; 1499 } 1500 1501 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1502 uint64_t value) 1503 { 1504 value &= pmu_counter_mask(env); 1505 env->cp15.c9_pmovsr &= ~value; 1506 } 1507 1508 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1509 uint64_t value) 1510 { 1511 value &= pmu_counter_mask(env); 1512 env->cp15.c9_pmovsr |= value; 1513 } 1514 1515 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1516 uint64_t value, const uint8_t counter) 1517 { 1518 if (counter == 31) { 1519 pmccfiltr_write(env, ri, value); 1520 } else if (counter < pmu_num_counters(env)) { 1521 pmevcntr_op_start(env, counter); 1522 1523 /* 1524 * If this counter's event type is changing, store the current 1525 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1526 * pmevcntr_op_finish has the correct baseline when it converts back to 1527 * a delta. 1528 */ 1529 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1530 PMXEVTYPER_EVTCOUNT; 1531 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1532 if (old_event != new_event) { 1533 uint64_t count = 0; 1534 if (event_supported(new_event)) { 1535 uint16_t event_idx = supported_event_map[new_event]; 1536 count = pm_events[event_idx].get_count(env); 1537 } 1538 env->cp15.c14_pmevcntr_delta[counter] = count; 1539 } 1540 1541 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1542 pmevcntr_op_finish(env, counter); 1543 } 1544 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1545 * PMSELR value is equal to or greater than the number of implemented 1546 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1547 */ 1548 } 1549 1550 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1551 const uint8_t counter) 1552 { 1553 if (counter == 31) { 1554 return env->cp15.pmccfiltr_el0; 1555 } else if (counter < pmu_num_counters(env)) { 1556 return env->cp15.c14_pmevtyper[counter]; 1557 } else { 1558 /* 1559 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1560 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1561 */ 1562 return 0; 1563 } 1564 } 1565 1566 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1567 uint64_t value) 1568 { 1569 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1570 pmevtyper_write(env, ri, value, counter); 1571 } 1572 1573 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1574 uint64_t value) 1575 { 1576 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1577 env->cp15.c14_pmevtyper[counter] = value; 1578 1579 /* 1580 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1581 * pmu_op_finish calls when loading saved state for a migration. Because 1582 * we're potentially updating the type of event here, the value written to 1583 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a 1584 * different counter type. Therefore, we need to set this value to the 1585 * current count for the counter type we're writing so that pmu_op_finish 1586 * has the correct count for its calculation. 1587 */ 1588 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1589 if (event_supported(event)) { 1590 uint16_t event_idx = supported_event_map[event]; 1591 env->cp15.c14_pmevcntr_delta[counter] = 1592 pm_events[event_idx].get_count(env); 1593 } 1594 } 1595 1596 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1597 { 1598 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1599 return pmevtyper_read(env, ri, counter); 1600 } 1601 1602 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1603 uint64_t value) 1604 { 1605 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1606 } 1607 1608 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1609 { 1610 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1611 } 1612 1613 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1614 uint64_t value, uint8_t counter) 1615 { 1616 if (counter < pmu_num_counters(env)) { 1617 pmevcntr_op_start(env, counter); 1618 env->cp15.c14_pmevcntr[counter] = value; 1619 pmevcntr_op_finish(env, counter); 1620 } 1621 /* 1622 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1623 * are CONSTRAINED UNPREDICTABLE. 1624 */ 1625 } 1626 1627 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1628 uint8_t counter) 1629 { 1630 if (counter < pmu_num_counters(env)) { 1631 uint64_t ret; 1632 pmevcntr_op_start(env, counter); 1633 ret = env->cp15.c14_pmevcntr[counter]; 1634 pmevcntr_op_finish(env, counter); 1635 return ret; 1636 } else { 1637 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1638 * are CONSTRAINED UNPREDICTABLE. */ 1639 return 0; 1640 } 1641 } 1642 1643 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1644 uint64_t value) 1645 { 1646 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1647 pmevcntr_write(env, ri, value, counter); 1648 } 1649 1650 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1651 { 1652 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1653 return pmevcntr_read(env, ri, counter); 1654 } 1655 1656 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1657 uint64_t value) 1658 { 1659 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1660 assert(counter < pmu_num_counters(env)); 1661 env->cp15.c14_pmevcntr[counter] = value; 1662 pmevcntr_write(env, ri, value, counter); 1663 } 1664 1665 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1666 { 1667 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1668 assert(counter < pmu_num_counters(env)); 1669 return env->cp15.c14_pmevcntr[counter]; 1670 } 1671 1672 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1673 uint64_t value) 1674 { 1675 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1676 } 1677 1678 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1679 { 1680 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1681 } 1682 1683 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1684 uint64_t value) 1685 { 1686 if (arm_feature(env, ARM_FEATURE_V8)) { 1687 env->cp15.c9_pmuserenr = value & 0xf; 1688 } else { 1689 env->cp15.c9_pmuserenr = value & 1; 1690 } 1691 } 1692 1693 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1694 uint64_t value) 1695 { 1696 /* We have no event counters so only the C bit can be changed */ 1697 value &= pmu_counter_mask(env); 1698 env->cp15.c9_pminten |= value; 1699 } 1700 1701 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1702 uint64_t value) 1703 { 1704 value &= pmu_counter_mask(env); 1705 env->cp15.c9_pminten &= ~value; 1706 } 1707 1708 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1709 uint64_t value) 1710 { 1711 /* Note that even though the AArch64 view of this register has bits 1712 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1713 * architectural requirements for bits which are RES0 only in some 1714 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1715 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1716 */ 1717 raw_write(env, ri, value & ~0x1FULL); 1718 } 1719 1720 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1721 { 1722 /* Begin with base v8.0 state. */ 1723 uint32_t valid_mask = 0x3fff; 1724 ARMCPU *cpu = arm_env_get_cpu(env); 1725 1726 if (arm_el_is_aa64(env, 3)) { 1727 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */ 1728 valid_mask &= ~SCR_NET; 1729 } else { 1730 valid_mask &= ~(SCR_RW | SCR_ST); 1731 } 1732 1733 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1734 valid_mask &= ~SCR_HCE; 1735 1736 /* On ARMv7, SMD (or SCD as it is called in v7) is only 1737 * supported if EL2 exists. The bit is UNK/SBZP when 1738 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1739 * when EL2 is unavailable. 1740 * On ARMv8, this bit is always available. 1741 */ 1742 if (arm_feature(env, ARM_FEATURE_V7) && 1743 !arm_feature(env, ARM_FEATURE_V8)) { 1744 valid_mask &= ~SCR_SMD; 1745 } 1746 } 1747 if (cpu_isar_feature(aa64_lor, cpu)) { 1748 valid_mask |= SCR_TLOR; 1749 } 1750 1751 /* Clear all-context RES0 bits. */ 1752 value &= valid_mask; 1753 raw_write(env, ri, value); 1754 } 1755 1756 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1757 { 1758 ARMCPU *cpu = arm_env_get_cpu(env); 1759 1760 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR 1761 * bank 1762 */ 1763 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1764 ri->secure & ARM_CP_SECSTATE_S); 1765 1766 return cpu->ccsidr[index]; 1767 } 1768 1769 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1770 uint64_t value) 1771 { 1772 raw_write(env, ri, value & 0xf); 1773 } 1774 1775 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1776 { 1777 CPUState *cs = ENV_GET_CPU(env); 1778 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 1779 uint64_t ret = 0; 1780 1781 if (hcr_el2 & HCR_IMO) { 1782 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1783 ret |= CPSR_I; 1784 } 1785 } else { 1786 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1787 ret |= CPSR_I; 1788 } 1789 } 1790 1791 if (hcr_el2 & HCR_FMO) { 1792 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1793 ret |= CPSR_F; 1794 } 1795 } else { 1796 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1797 ret |= CPSR_F; 1798 } 1799 } 1800 1801 /* External aborts are not possible in QEMU so A bit is always clear */ 1802 return ret; 1803 } 1804 1805 static const ARMCPRegInfo v7_cp_reginfo[] = { 1806 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 1807 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 1808 .access = PL1_W, .type = ARM_CP_NOP }, 1809 /* Performance monitors are implementation defined in v7, 1810 * but with an ARM recommended set of registers, which we 1811 * follow. 1812 * 1813 * Performance registers fall into three categories: 1814 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 1815 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 1816 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 1817 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 1818 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 1819 */ 1820 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 1821 .access = PL0_RW, .type = ARM_CP_ALIAS, 1822 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1823 .writefn = pmcntenset_write, 1824 .accessfn = pmreg_access, 1825 .raw_writefn = raw_write }, 1826 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, 1827 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 1828 .access = PL0_RW, .accessfn = pmreg_access, 1829 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 1830 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 1831 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 1832 .access = PL0_RW, 1833 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1834 .accessfn = pmreg_access, 1835 .writefn = pmcntenclr_write, 1836 .type = ARM_CP_ALIAS }, 1837 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 1838 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 1839 .access = PL0_RW, .accessfn = pmreg_access, 1840 .type = ARM_CP_ALIAS, 1841 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 1842 .writefn = pmcntenclr_write }, 1843 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 1844 .access = PL0_RW, 1845 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 1846 .accessfn = pmreg_access, 1847 .writefn = pmovsr_write, 1848 .raw_writefn = raw_write }, 1849 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 1850 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 1851 .access = PL0_RW, .accessfn = pmreg_access, 1852 .type = ARM_CP_ALIAS, 1853 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 1854 .writefn = pmovsr_write, 1855 .raw_writefn = raw_write }, 1856 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 1857 .access = PL0_W, .accessfn = pmreg_access_swinc, .type = ARM_CP_NO_RAW, 1858 .writefn = pmswinc_write }, 1859 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 1860 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 1861 .access = PL0_W, .accessfn = pmreg_access_swinc, .type = ARM_CP_NO_RAW, 1862 .writefn = pmswinc_write }, 1863 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 1864 .access = PL0_RW, .type = ARM_CP_ALIAS, 1865 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 1866 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 1867 .raw_writefn = raw_write}, 1868 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 1869 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 1870 .access = PL0_RW, .accessfn = pmreg_access_selr, 1871 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 1872 .writefn = pmselr_write, .raw_writefn = raw_write, }, 1873 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 1874 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 1875 .readfn = pmccntr_read, .writefn = pmccntr_write32, 1876 .accessfn = pmreg_access_ccntr }, 1877 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 1878 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 1879 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 1880 .type = ARM_CP_IO, 1881 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 1882 .readfn = pmccntr_read, .writefn = pmccntr_write, 1883 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 1884 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 1885 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 1886 .access = PL0_RW, .accessfn = pmreg_access, 1887 .type = ARM_CP_ALIAS | ARM_CP_IO, 1888 .resetvalue = 0, }, 1889 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 1890 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 1891 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 1892 .access = PL0_RW, .accessfn = pmreg_access, 1893 .type = ARM_CP_IO, 1894 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 1895 .resetvalue = 0, }, 1896 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 1897 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 1898 .accessfn = pmreg_access, 1899 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 1900 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 1901 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 1902 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 1903 .accessfn = pmreg_access, 1904 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 1905 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 1906 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 1907 .accessfn = pmreg_access_xevcntr, 1908 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 1909 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 1910 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 1911 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 1912 .accessfn = pmreg_access_xevcntr, 1913 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 1914 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 1915 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 1916 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 1917 .resetvalue = 0, 1918 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 1919 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 1920 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 1921 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 1922 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 1923 .resetvalue = 0, 1924 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 1925 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 1926 .access = PL1_RW, .accessfn = access_tpm, 1927 .type = ARM_CP_ALIAS | ARM_CP_IO, 1928 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 1929 .resetvalue = 0, 1930 .writefn = pmintenset_write, .raw_writefn = raw_write }, 1931 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 1932 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 1933 .access = PL1_RW, .accessfn = access_tpm, 1934 .type = ARM_CP_IO, 1935 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 1936 .writefn = pmintenset_write, .raw_writefn = raw_write, 1937 .resetvalue = 0x0 }, 1938 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 1939 .access = PL1_RW, .accessfn = access_tpm, 1940 .type = ARM_CP_ALIAS | ARM_CP_IO, 1941 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 1942 .writefn = pmintenclr_write, }, 1943 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 1944 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 1945 .access = PL1_RW, .accessfn = access_tpm, 1946 .type = ARM_CP_ALIAS | ARM_CP_IO, 1947 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 1948 .writefn = pmintenclr_write }, 1949 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 1950 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 1951 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 1952 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 1953 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 1954 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0, 1955 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 1956 offsetof(CPUARMState, cp15.csselr_ns) } }, 1957 /* Auxiliary ID register: this actually has an IMPDEF value but for now 1958 * just RAZ for all cores: 1959 */ 1960 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 1961 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 1962 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 1963 /* Auxiliary fault status registers: these also are IMPDEF, and we 1964 * choose to RAZ/WI for all cores. 1965 */ 1966 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 1967 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 1968 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 1969 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 1970 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 1971 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 1972 /* MAIR can just read-as-written because we don't implement caches 1973 * and so don't need to care about memory attributes. 1974 */ 1975 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 1976 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 1977 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 1978 .resetvalue = 0 }, 1979 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 1980 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 1981 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 1982 .resetvalue = 0 }, 1983 /* For non-long-descriptor page tables these are PRRR and NMRR; 1984 * regardless they still act as reads-as-written for QEMU. 1985 */ 1986 /* MAIR0/1 are defined separately from their 64-bit counterpart which 1987 * allows them to assign the correct fieldoffset based on the endianness 1988 * handled in the field definitions. 1989 */ 1990 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 1991 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW, 1992 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 1993 offsetof(CPUARMState, cp15.mair0_ns) }, 1994 .resetfn = arm_cp_reset_ignore }, 1995 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 1996 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW, 1997 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 1998 offsetof(CPUARMState, cp15.mair1_ns) }, 1999 .resetfn = arm_cp_reset_ignore }, 2000 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2001 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2002 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2003 /* 32 bit ITLB invalidates */ 2004 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2005 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2006 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2007 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2008 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2009 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2010 /* 32 bit DTLB invalidates */ 2011 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2012 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2013 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2014 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2015 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2016 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2017 /* 32 bit TLB invalidates */ 2018 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2019 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2020 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2021 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2022 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2023 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2024 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2025 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 2026 REGINFO_SENTINEL 2027 }; 2028 2029 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2030 /* 32 bit TLB invalidates, Inner Shareable */ 2031 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2032 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write }, 2033 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2034 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 2035 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2036 .type = ARM_CP_NO_RAW, .access = PL1_W, 2037 .writefn = tlbiasid_is_write }, 2038 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2039 .type = ARM_CP_NO_RAW, .access = PL1_W, 2040 .writefn = tlbimvaa_is_write }, 2041 REGINFO_SENTINEL 2042 }; 2043 2044 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2045 /* PMOVSSET is not implemented in v7 before v7ve */ 2046 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2047 .access = PL0_RW, .accessfn = pmreg_access, 2048 .type = ARM_CP_ALIAS, 2049 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2050 .writefn = pmovsset_write, 2051 .raw_writefn = raw_write }, 2052 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2053 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2054 .access = PL0_RW, .accessfn = pmreg_access, 2055 .type = ARM_CP_ALIAS, 2056 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2057 .writefn = pmovsset_write, 2058 .raw_writefn = raw_write }, 2059 REGINFO_SENTINEL 2060 }; 2061 2062 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2063 uint64_t value) 2064 { 2065 value &= 1; 2066 env->teecr = value; 2067 } 2068 2069 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2070 bool isread) 2071 { 2072 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2073 return CP_ACCESS_TRAP; 2074 } 2075 return CP_ACCESS_OK; 2076 } 2077 2078 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2079 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2080 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2081 .resetvalue = 0, 2082 .writefn = teecr_write }, 2083 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2084 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2085 .accessfn = teehbr_access, .resetvalue = 0 }, 2086 REGINFO_SENTINEL 2087 }; 2088 2089 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2090 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2091 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2092 .access = PL0_RW, 2093 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2094 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2095 .access = PL0_RW, 2096 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2097 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2098 .resetfn = arm_cp_reset_ignore }, 2099 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2100 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2101 .access = PL0_R|PL1_W, 2102 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2103 .resetvalue = 0}, 2104 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2105 .access = PL0_R|PL1_W, 2106 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2107 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2108 .resetfn = arm_cp_reset_ignore }, 2109 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2110 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2111 .access = PL1_RW, 2112 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2113 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2114 .access = PL1_RW, 2115 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2116 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2117 .resetvalue = 0 }, 2118 REGINFO_SENTINEL 2119 }; 2120 2121 #ifndef CONFIG_USER_ONLY 2122 2123 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2124 bool isread) 2125 { 2126 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2127 * Writable only at the highest implemented exception level. 2128 */ 2129 int el = arm_current_el(env); 2130 2131 switch (el) { 2132 case 0: 2133 if (!extract32(env->cp15.c14_cntkctl, 0, 2)) { 2134 return CP_ACCESS_TRAP; 2135 } 2136 break; 2137 case 1: 2138 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2139 arm_is_secure_below_el3(env)) { 2140 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2141 return CP_ACCESS_TRAP_UNCATEGORIZED; 2142 } 2143 break; 2144 case 2: 2145 case 3: 2146 break; 2147 } 2148 2149 if (!isread && el < arm_highest_el(env)) { 2150 return CP_ACCESS_TRAP_UNCATEGORIZED; 2151 } 2152 2153 return CP_ACCESS_OK; 2154 } 2155 2156 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2157 bool isread) 2158 { 2159 unsigned int cur_el = arm_current_el(env); 2160 bool secure = arm_is_secure(env); 2161 2162 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */ 2163 if (cur_el == 0 && 2164 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2165 return CP_ACCESS_TRAP; 2166 } 2167 2168 if (arm_feature(env, ARM_FEATURE_EL2) && 2169 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2170 !extract32(env->cp15.cnthctl_el2, 0, 1)) { 2171 return CP_ACCESS_TRAP_EL2; 2172 } 2173 return CP_ACCESS_OK; 2174 } 2175 2176 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2177 bool isread) 2178 { 2179 unsigned int cur_el = arm_current_el(env); 2180 bool secure = arm_is_secure(env); 2181 2182 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if 2183 * EL0[PV]TEN is zero. 2184 */ 2185 if (cur_el == 0 && 2186 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2187 return CP_ACCESS_TRAP; 2188 } 2189 2190 if (arm_feature(env, ARM_FEATURE_EL2) && 2191 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2192 !extract32(env->cp15.cnthctl_el2, 1, 1)) { 2193 return CP_ACCESS_TRAP_EL2; 2194 } 2195 return CP_ACCESS_OK; 2196 } 2197 2198 static CPAccessResult gt_pct_access(CPUARMState *env, 2199 const ARMCPRegInfo *ri, 2200 bool isread) 2201 { 2202 return gt_counter_access(env, GTIMER_PHYS, isread); 2203 } 2204 2205 static CPAccessResult gt_vct_access(CPUARMState *env, 2206 const ARMCPRegInfo *ri, 2207 bool isread) 2208 { 2209 return gt_counter_access(env, GTIMER_VIRT, isread); 2210 } 2211 2212 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2213 bool isread) 2214 { 2215 return gt_timer_access(env, GTIMER_PHYS, isread); 2216 } 2217 2218 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2219 bool isread) 2220 { 2221 return gt_timer_access(env, GTIMER_VIRT, isread); 2222 } 2223 2224 static CPAccessResult gt_stimer_access(CPUARMState *env, 2225 const ARMCPRegInfo *ri, 2226 bool isread) 2227 { 2228 /* The AArch64 register view of the secure physical timer is 2229 * always accessible from EL3, and configurably accessible from 2230 * Secure EL1. 2231 */ 2232 switch (arm_current_el(env)) { 2233 case 1: 2234 if (!arm_is_secure(env)) { 2235 return CP_ACCESS_TRAP; 2236 } 2237 if (!(env->cp15.scr_el3 & SCR_ST)) { 2238 return CP_ACCESS_TRAP_EL3; 2239 } 2240 return CP_ACCESS_OK; 2241 case 0: 2242 case 2: 2243 return CP_ACCESS_TRAP; 2244 case 3: 2245 return CP_ACCESS_OK; 2246 default: 2247 g_assert_not_reached(); 2248 } 2249 } 2250 2251 static uint64_t gt_get_countervalue(CPUARMState *env) 2252 { 2253 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE; 2254 } 2255 2256 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2257 { 2258 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2259 2260 if (gt->ctl & 1) { 2261 /* Timer enabled: calculate and set current ISTATUS, irq, and 2262 * reset timer to when ISTATUS next has to change 2263 */ 2264 uint64_t offset = timeridx == GTIMER_VIRT ? 2265 cpu->env.cp15.cntvoff_el2 : 0; 2266 uint64_t count = gt_get_countervalue(&cpu->env); 2267 /* Note that this must be unsigned 64 bit arithmetic: */ 2268 int istatus = count - offset >= gt->cval; 2269 uint64_t nexttick; 2270 int irqstate; 2271 2272 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2273 2274 irqstate = (istatus && !(gt->ctl & 2)); 2275 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2276 2277 if (istatus) { 2278 /* Next transition is when count rolls back over to zero */ 2279 nexttick = UINT64_MAX; 2280 } else { 2281 /* Next transition is when we hit cval */ 2282 nexttick = gt->cval + offset; 2283 } 2284 /* Note that the desired next expiry time might be beyond the 2285 * signed-64-bit range of a QEMUTimer -- in this case we just 2286 * set the timer for as far in the future as possible. When the 2287 * timer expires we will reset the timer for any remaining period. 2288 */ 2289 if (nexttick > INT64_MAX / GTIMER_SCALE) { 2290 nexttick = INT64_MAX / GTIMER_SCALE; 2291 } 2292 timer_mod(cpu->gt_timer[timeridx], nexttick); 2293 trace_arm_gt_recalc(timeridx, irqstate, nexttick); 2294 } else { 2295 /* Timer disabled: ISTATUS and timer output always clear */ 2296 gt->ctl &= ~4; 2297 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0); 2298 timer_del(cpu->gt_timer[timeridx]); 2299 trace_arm_gt_recalc_disabled(timeridx); 2300 } 2301 } 2302 2303 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2304 int timeridx) 2305 { 2306 ARMCPU *cpu = arm_env_get_cpu(env); 2307 2308 timer_del(cpu->gt_timer[timeridx]); 2309 } 2310 2311 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2312 { 2313 return gt_get_countervalue(env); 2314 } 2315 2316 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2317 { 2318 return gt_get_countervalue(env) - env->cp15.cntvoff_el2; 2319 } 2320 2321 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2322 int timeridx, 2323 uint64_t value) 2324 { 2325 trace_arm_gt_cval_write(timeridx, value); 2326 env->cp15.c14_timer[timeridx].cval = value; 2327 gt_recalc_timer(arm_env_get_cpu(env), timeridx); 2328 } 2329 2330 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2331 int timeridx) 2332 { 2333 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2334 2335 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2336 (gt_get_countervalue(env) - offset)); 2337 } 2338 2339 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2340 int timeridx, 2341 uint64_t value) 2342 { 2343 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2344 2345 trace_arm_gt_tval_write(timeridx, value); 2346 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2347 sextract64(value, 0, 32); 2348 gt_recalc_timer(arm_env_get_cpu(env), timeridx); 2349 } 2350 2351 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2352 int timeridx, 2353 uint64_t value) 2354 { 2355 ARMCPU *cpu = arm_env_get_cpu(env); 2356 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2357 2358 trace_arm_gt_ctl_write(timeridx, value); 2359 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2360 if ((oldval ^ value) & 1) { 2361 /* Enable toggled */ 2362 gt_recalc_timer(cpu, timeridx); 2363 } else if ((oldval ^ value) & 2) { 2364 /* IMASK toggled: don't need to recalculate, 2365 * just set the interrupt line based on ISTATUS 2366 */ 2367 int irqstate = (oldval & 4) && !(value & 2); 2368 2369 trace_arm_gt_imask_toggle(timeridx, irqstate); 2370 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2371 } 2372 } 2373 2374 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2375 { 2376 gt_timer_reset(env, ri, GTIMER_PHYS); 2377 } 2378 2379 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2380 uint64_t value) 2381 { 2382 gt_cval_write(env, ri, GTIMER_PHYS, value); 2383 } 2384 2385 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2386 { 2387 return gt_tval_read(env, ri, GTIMER_PHYS); 2388 } 2389 2390 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2391 uint64_t value) 2392 { 2393 gt_tval_write(env, ri, GTIMER_PHYS, value); 2394 } 2395 2396 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2397 uint64_t value) 2398 { 2399 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2400 } 2401 2402 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2403 { 2404 gt_timer_reset(env, ri, GTIMER_VIRT); 2405 } 2406 2407 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2408 uint64_t value) 2409 { 2410 gt_cval_write(env, ri, GTIMER_VIRT, value); 2411 } 2412 2413 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2414 { 2415 return gt_tval_read(env, ri, GTIMER_VIRT); 2416 } 2417 2418 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2419 uint64_t value) 2420 { 2421 gt_tval_write(env, ri, GTIMER_VIRT, value); 2422 } 2423 2424 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2425 uint64_t value) 2426 { 2427 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2428 } 2429 2430 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2431 uint64_t value) 2432 { 2433 ARMCPU *cpu = arm_env_get_cpu(env); 2434 2435 trace_arm_gt_cntvoff_write(value); 2436 raw_write(env, ri, value); 2437 gt_recalc_timer(cpu, GTIMER_VIRT); 2438 } 2439 2440 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2441 { 2442 gt_timer_reset(env, ri, GTIMER_HYP); 2443 } 2444 2445 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2446 uint64_t value) 2447 { 2448 gt_cval_write(env, ri, GTIMER_HYP, value); 2449 } 2450 2451 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2452 { 2453 return gt_tval_read(env, ri, GTIMER_HYP); 2454 } 2455 2456 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2457 uint64_t value) 2458 { 2459 gt_tval_write(env, ri, GTIMER_HYP, value); 2460 } 2461 2462 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2463 uint64_t value) 2464 { 2465 gt_ctl_write(env, ri, GTIMER_HYP, value); 2466 } 2467 2468 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2469 { 2470 gt_timer_reset(env, ri, GTIMER_SEC); 2471 } 2472 2473 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2474 uint64_t value) 2475 { 2476 gt_cval_write(env, ri, GTIMER_SEC, value); 2477 } 2478 2479 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2480 { 2481 return gt_tval_read(env, ri, GTIMER_SEC); 2482 } 2483 2484 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2485 uint64_t value) 2486 { 2487 gt_tval_write(env, ri, GTIMER_SEC, value); 2488 } 2489 2490 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2491 uint64_t value) 2492 { 2493 gt_ctl_write(env, ri, GTIMER_SEC, value); 2494 } 2495 2496 void arm_gt_ptimer_cb(void *opaque) 2497 { 2498 ARMCPU *cpu = opaque; 2499 2500 gt_recalc_timer(cpu, GTIMER_PHYS); 2501 } 2502 2503 void arm_gt_vtimer_cb(void *opaque) 2504 { 2505 ARMCPU *cpu = opaque; 2506 2507 gt_recalc_timer(cpu, GTIMER_VIRT); 2508 } 2509 2510 void arm_gt_htimer_cb(void *opaque) 2511 { 2512 ARMCPU *cpu = opaque; 2513 2514 gt_recalc_timer(cpu, GTIMER_HYP); 2515 } 2516 2517 void arm_gt_stimer_cb(void *opaque) 2518 { 2519 ARMCPU *cpu = opaque; 2520 2521 gt_recalc_timer(cpu, GTIMER_SEC); 2522 } 2523 2524 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2525 /* Note that CNTFRQ is purely reads-as-written for the benefit 2526 * of software; writing it doesn't actually change the timer frequency. 2527 * Our reset value matches the fixed frequency we implement the timer at. 2528 */ 2529 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 2530 .type = ARM_CP_ALIAS, 2531 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2532 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 2533 }, 2534 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2535 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2536 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2537 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2538 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE, 2539 }, 2540 /* overall control: mostly access permissions */ 2541 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 2542 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 2543 .access = PL1_RW, 2544 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 2545 .resetvalue = 0, 2546 }, 2547 /* per-timer control */ 2548 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2549 .secure = ARM_CP_SECSTATE_NS, 2550 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R, 2551 .accessfn = gt_ptimer_access, 2552 .fieldoffset = offsetoflow32(CPUARMState, 2553 cp15.c14_timer[GTIMER_PHYS].ctl), 2554 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2555 }, 2556 { .name = "CNTP_CTL_S", 2557 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2558 .secure = ARM_CP_SECSTATE_S, 2559 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R, 2560 .accessfn = gt_ptimer_access, 2561 .fieldoffset = offsetoflow32(CPUARMState, 2562 cp15.c14_timer[GTIMER_SEC].ctl), 2563 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2564 }, 2565 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 2566 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 2567 .type = ARM_CP_IO, .access = PL1_RW | PL0_R, 2568 .accessfn = gt_ptimer_access, 2569 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 2570 .resetvalue = 0, 2571 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2572 }, 2573 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 2574 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R, 2575 .accessfn = gt_vtimer_access, 2576 .fieldoffset = offsetoflow32(CPUARMState, 2577 cp15.c14_timer[GTIMER_VIRT].ctl), 2578 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2579 }, 2580 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 2581 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 2582 .type = ARM_CP_IO, .access = PL1_RW | PL0_R, 2583 .accessfn = gt_vtimer_access, 2584 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 2585 .resetvalue = 0, 2586 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2587 }, 2588 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 2589 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2590 .secure = ARM_CP_SECSTATE_NS, 2591 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2592 .accessfn = gt_ptimer_access, 2593 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2594 }, 2595 { .name = "CNTP_TVAL_S", 2596 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2597 .secure = ARM_CP_SECSTATE_S, 2598 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2599 .accessfn = gt_ptimer_access, 2600 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 2601 }, 2602 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2603 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 2604 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2605 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 2606 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2607 }, 2608 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 2609 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2610 .accessfn = gt_vtimer_access, 2611 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2612 }, 2613 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2614 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 2615 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2616 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 2617 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2618 }, 2619 /* The counter itself */ 2620 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 2621 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2622 .accessfn = gt_pct_access, 2623 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 2624 }, 2625 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 2626 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 2627 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2628 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 2629 }, 2630 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 2631 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2632 .accessfn = gt_vct_access, 2633 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 2634 }, 2635 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2636 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2637 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2638 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 2639 }, 2640 /* Comparison value, indicating when the timer goes off */ 2641 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 2642 .secure = ARM_CP_SECSTATE_NS, 2643 .access = PL1_RW | PL0_R, 2644 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2645 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2646 .accessfn = gt_ptimer_access, 2647 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2648 }, 2649 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 2650 .secure = ARM_CP_SECSTATE_S, 2651 .access = PL1_RW | PL0_R, 2652 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2653 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2654 .accessfn = gt_ptimer_access, 2655 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2656 }, 2657 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2658 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 2659 .access = PL1_RW | PL0_R, 2660 .type = ARM_CP_IO, 2661 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2662 .resetvalue = 0, .accessfn = gt_ptimer_access, 2663 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2664 }, 2665 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 2666 .access = PL1_RW | PL0_R, 2667 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2668 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2669 .accessfn = gt_vtimer_access, 2670 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2671 }, 2672 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2673 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 2674 .access = PL1_RW | PL0_R, 2675 .type = ARM_CP_IO, 2676 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2677 .resetvalue = 0, .accessfn = gt_vtimer_access, 2678 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2679 }, 2680 /* Secure timer -- this is actually restricted to only EL3 2681 * and configurably Secure-EL1 via the accessfn. 2682 */ 2683 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 2684 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 2685 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 2686 .accessfn = gt_stimer_access, 2687 .readfn = gt_sec_tval_read, 2688 .writefn = gt_sec_tval_write, 2689 .resetfn = gt_sec_timer_reset, 2690 }, 2691 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 2692 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 2693 .type = ARM_CP_IO, .access = PL1_RW, 2694 .accessfn = gt_stimer_access, 2695 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 2696 .resetvalue = 0, 2697 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2698 }, 2699 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 2700 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 2701 .type = ARM_CP_IO, .access = PL1_RW, 2702 .accessfn = gt_stimer_access, 2703 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2704 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2705 }, 2706 REGINFO_SENTINEL 2707 }; 2708 2709 #else 2710 2711 /* In user-mode most of the generic timer registers are inaccessible 2712 * however modern kernels (4.12+) allow access to cntvct_el0 2713 */ 2714 2715 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2716 { 2717 /* Currently we have no support for QEMUTimer in linux-user so we 2718 * can't call gt_get_countervalue(env), instead we directly 2719 * call the lower level functions. 2720 */ 2721 return cpu_get_clock() / GTIMER_SCALE; 2722 } 2723 2724 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2725 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2726 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2727 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 2728 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2729 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE, 2730 }, 2731 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2732 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2733 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2734 .readfn = gt_virt_cnt_read, 2735 }, 2736 REGINFO_SENTINEL 2737 }; 2738 2739 #endif 2740 2741 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2742 { 2743 if (arm_feature(env, ARM_FEATURE_LPAE)) { 2744 raw_write(env, ri, value); 2745 } else if (arm_feature(env, ARM_FEATURE_V7)) { 2746 raw_write(env, ri, value & 0xfffff6ff); 2747 } else { 2748 raw_write(env, ri, value & 0xfffff1ff); 2749 } 2750 } 2751 2752 #ifndef CONFIG_USER_ONLY 2753 /* get_phys_addr() isn't present for user-mode-only targets */ 2754 2755 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 2756 bool isread) 2757 { 2758 if (ri->opc2 & 4) { 2759 /* The ATS12NSO* operations must trap to EL3 if executed in 2760 * Secure EL1 (which can only happen if EL3 is AArch64). 2761 * They are simply UNDEF if executed from NS EL1. 2762 * They function normally from EL2 or EL3. 2763 */ 2764 if (arm_current_el(env) == 1) { 2765 if (arm_is_secure_below_el3(env)) { 2766 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3; 2767 } 2768 return CP_ACCESS_TRAP_UNCATEGORIZED; 2769 } 2770 } 2771 return CP_ACCESS_OK; 2772 } 2773 2774 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 2775 MMUAccessType access_type, ARMMMUIdx mmu_idx) 2776 { 2777 hwaddr phys_addr; 2778 target_ulong page_size; 2779 int prot; 2780 bool ret; 2781 uint64_t par64; 2782 bool format64 = false; 2783 MemTxAttrs attrs = {}; 2784 ARMMMUFaultInfo fi = {}; 2785 ARMCacheAttrs cacheattrs = {}; 2786 2787 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs, 2788 &prot, &page_size, &fi, &cacheattrs); 2789 2790 if (is_a64(env)) { 2791 format64 = true; 2792 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 2793 /* 2794 * ATS1Cxx: 2795 * * TTBCR.EAE determines whether the result is returned using the 2796 * 32-bit or the 64-bit PAR format 2797 * * Instructions executed in Hyp mode always use the 64bit format 2798 * 2799 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 2800 * * The Non-secure TTBCR.EAE bit is set to 1 2801 * * The implementation includes EL2, and the value of HCR.VM is 1 2802 * 2803 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 2804 * 2805 * ATS1Hx always uses the 64bit format. 2806 */ 2807 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 2808 2809 if (arm_feature(env, ARM_FEATURE_EL2)) { 2810 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 2811 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 2812 } else { 2813 format64 |= arm_current_el(env) == 2; 2814 } 2815 } 2816 } 2817 2818 if (format64) { 2819 /* Create a 64-bit PAR */ 2820 par64 = (1 << 11); /* LPAE bit always set */ 2821 if (!ret) { 2822 par64 |= phys_addr & ~0xfffULL; 2823 if (!attrs.secure) { 2824 par64 |= (1 << 9); /* NS */ 2825 } 2826 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */ 2827 par64 |= cacheattrs.shareability << 7; /* SH */ 2828 } else { 2829 uint32_t fsr = arm_fi_to_lfsc(&fi); 2830 2831 par64 |= 1; /* F */ 2832 par64 |= (fsr & 0x3f) << 1; /* FS */ 2833 if (fi.stage2) { 2834 par64 |= (1 << 9); /* S */ 2835 } 2836 if (fi.s1ptw) { 2837 par64 |= (1 << 8); /* PTW */ 2838 } 2839 } 2840 } else { 2841 /* fsr is a DFSR/IFSR value for the short descriptor 2842 * translation table format (with WnR always clear). 2843 * Convert it to a 32-bit PAR. 2844 */ 2845 if (!ret) { 2846 /* We do not set any attribute bits in the PAR */ 2847 if (page_size == (1 << 24) 2848 && arm_feature(env, ARM_FEATURE_V7)) { 2849 par64 = (phys_addr & 0xff000000) | (1 << 1); 2850 } else { 2851 par64 = phys_addr & 0xfffff000; 2852 } 2853 if (!attrs.secure) { 2854 par64 |= (1 << 9); /* NS */ 2855 } 2856 } else { 2857 uint32_t fsr = arm_fi_to_sfsc(&fi); 2858 2859 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 2860 ((fsr & 0xf) << 1) | 1; 2861 } 2862 } 2863 return par64; 2864 } 2865 2866 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2867 { 2868 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 2869 uint64_t par64; 2870 ARMMMUIdx mmu_idx; 2871 int el = arm_current_el(env); 2872 bool secure = arm_is_secure_below_el3(env); 2873 2874 switch (ri->opc2 & 6) { 2875 case 0: 2876 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */ 2877 switch (el) { 2878 case 3: 2879 mmu_idx = ARMMMUIdx_S1E3; 2880 break; 2881 case 2: 2882 mmu_idx = ARMMMUIdx_S1NSE1; 2883 break; 2884 case 1: 2885 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 2886 break; 2887 default: 2888 g_assert_not_reached(); 2889 } 2890 break; 2891 case 2: 2892 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 2893 switch (el) { 2894 case 3: 2895 mmu_idx = ARMMMUIdx_S1SE0; 2896 break; 2897 case 2: 2898 mmu_idx = ARMMMUIdx_S1NSE0; 2899 break; 2900 case 1: 2901 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 2902 break; 2903 default: 2904 g_assert_not_reached(); 2905 } 2906 break; 2907 case 4: 2908 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 2909 mmu_idx = ARMMMUIdx_S12NSE1; 2910 break; 2911 case 6: 2912 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 2913 mmu_idx = ARMMMUIdx_S12NSE0; 2914 break; 2915 default: 2916 g_assert_not_reached(); 2917 } 2918 2919 par64 = do_ats_write(env, value, access_type, mmu_idx); 2920 2921 A32_BANKED_CURRENT_REG_SET(env, par, par64); 2922 } 2923 2924 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 2925 uint64_t value) 2926 { 2927 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 2928 uint64_t par64; 2929 2930 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2); 2931 2932 A32_BANKED_CURRENT_REG_SET(env, par, par64); 2933 } 2934 2935 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 2936 bool isread) 2937 { 2938 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) { 2939 return CP_ACCESS_TRAP; 2940 } 2941 return CP_ACCESS_OK; 2942 } 2943 2944 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 2945 uint64_t value) 2946 { 2947 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 2948 ARMMMUIdx mmu_idx; 2949 int secure = arm_is_secure_below_el3(env); 2950 2951 switch (ri->opc2 & 6) { 2952 case 0: 2953 switch (ri->opc1) { 2954 case 0: /* AT S1E1R, AT S1E1W */ 2955 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 2956 break; 2957 case 4: /* AT S1E2R, AT S1E2W */ 2958 mmu_idx = ARMMMUIdx_S1E2; 2959 break; 2960 case 6: /* AT S1E3R, AT S1E3W */ 2961 mmu_idx = ARMMMUIdx_S1E3; 2962 break; 2963 default: 2964 g_assert_not_reached(); 2965 } 2966 break; 2967 case 2: /* AT S1E0R, AT S1E0W */ 2968 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 2969 break; 2970 case 4: /* AT S12E1R, AT S12E1W */ 2971 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1; 2972 break; 2973 case 6: /* AT S12E0R, AT S12E0W */ 2974 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0; 2975 break; 2976 default: 2977 g_assert_not_reached(); 2978 } 2979 2980 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx); 2981 } 2982 #endif 2983 2984 static const ARMCPRegInfo vapa_cp_reginfo[] = { 2985 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 2986 .access = PL1_RW, .resetvalue = 0, 2987 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 2988 offsetoflow32(CPUARMState, cp15.par_ns) }, 2989 .writefn = par_write }, 2990 #ifndef CONFIG_USER_ONLY 2991 /* This underdecoding is safe because the reginfo is NO_RAW. */ 2992 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 2993 .access = PL1_W, .accessfn = ats_access, 2994 .writefn = ats_write, .type = ARM_CP_NO_RAW }, 2995 #endif 2996 REGINFO_SENTINEL 2997 }; 2998 2999 /* Return basic MPU access permission bits. */ 3000 static uint32_t simple_mpu_ap_bits(uint32_t val) 3001 { 3002 uint32_t ret; 3003 uint32_t mask; 3004 int i; 3005 ret = 0; 3006 mask = 3; 3007 for (i = 0; i < 16; i += 2) { 3008 ret |= (val >> i) & mask; 3009 mask <<= 2; 3010 } 3011 return ret; 3012 } 3013 3014 /* Pad basic MPU access permission bits to extended format. */ 3015 static uint32_t extended_mpu_ap_bits(uint32_t val) 3016 { 3017 uint32_t ret; 3018 uint32_t mask; 3019 int i; 3020 ret = 0; 3021 mask = 3; 3022 for (i = 0; i < 16; i += 2) { 3023 ret |= (val & mask) << i; 3024 mask <<= 2; 3025 } 3026 return ret; 3027 } 3028 3029 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3030 uint64_t value) 3031 { 3032 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3033 } 3034 3035 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3036 { 3037 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3038 } 3039 3040 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3041 uint64_t value) 3042 { 3043 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3044 } 3045 3046 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3047 { 3048 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3049 } 3050 3051 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3052 { 3053 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3054 3055 if (!u32p) { 3056 return 0; 3057 } 3058 3059 u32p += env->pmsav7.rnr[M_REG_NS]; 3060 return *u32p; 3061 } 3062 3063 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3064 uint64_t value) 3065 { 3066 ARMCPU *cpu = arm_env_get_cpu(env); 3067 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3068 3069 if (!u32p) { 3070 return; 3071 } 3072 3073 u32p += env->pmsav7.rnr[M_REG_NS]; 3074 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3075 *u32p = value; 3076 } 3077 3078 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3079 uint64_t value) 3080 { 3081 ARMCPU *cpu = arm_env_get_cpu(env); 3082 uint32_t nrgs = cpu->pmsav7_dregion; 3083 3084 if (value >= nrgs) { 3085 qemu_log_mask(LOG_GUEST_ERROR, 3086 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3087 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3088 return; 3089 } 3090 3091 raw_write(env, ri, value); 3092 } 3093 3094 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 3095 /* Reset for all these registers is handled in arm_cpu_reset(), 3096 * because the PMSAv7 is also used by M-profile CPUs, which do 3097 * not register cpregs but still need the state to be reset. 3098 */ 3099 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 3100 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3101 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 3102 .readfn = pmsav7_read, .writefn = pmsav7_write, 3103 .resetfn = arm_cp_reset_ignore }, 3104 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 3105 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3106 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 3107 .readfn = pmsav7_read, .writefn = pmsav7_write, 3108 .resetfn = arm_cp_reset_ignore }, 3109 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 3110 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3111 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 3112 .readfn = pmsav7_read, .writefn = pmsav7_write, 3113 .resetfn = arm_cp_reset_ignore }, 3114 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 3115 .access = PL1_RW, 3116 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 3117 .writefn = pmsav7_rgnr_write, 3118 .resetfn = arm_cp_reset_ignore }, 3119 REGINFO_SENTINEL 3120 }; 3121 3122 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 3123 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3124 .access = PL1_RW, .type = ARM_CP_ALIAS, 3125 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3126 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 3127 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3128 .access = PL1_RW, .type = ARM_CP_ALIAS, 3129 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3130 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 3131 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 3132 .access = PL1_RW, 3133 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3134 .resetvalue = 0, }, 3135 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 3136 .access = PL1_RW, 3137 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3138 .resetvalue = 0, }, 3139 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 3140 .access = PL1_RW, 3141 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 3142 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 3143 .access = PL1_RW, 3144 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 3145 /* Protection region base and size registers */ 3146 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 3147 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3148 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 3149 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 3150 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3151 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 3152 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 3153 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3154 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 3155 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 3156 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3157 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 3158 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 3159 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3160 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 3161 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 3162 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3163 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 3164 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 3165 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3166 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 3167 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 3168 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3169 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 3170 REGINFO_SENTINEL 3171 }; 3172 3173 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 3174 uint64_t value) 3175 { 3176 TCR *tcr = raw_ptr(env, ri); 3177 int maskshift = extract32(value, 0, 3); 3178 3179 if (!arm_feature(env, ARM_FEATURE_V8)) { 3180 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 3181 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 3182 * using Long-desciptor translation table format */ 3183 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 3184 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 3185 /* In an implementation that includes the Security Extensions 3186 * TTBCR has additional fields PD0 [4] and PD1 [5] for 3187 * Short-descriptor translation table format. 3188 */ 3189 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 3190 } else { 3191 value &= TTBCR_N; 3192 } 3193 } 3194 3195 /* Update the masks corresponding to the TCR bank being written 3196 * Note that we always calculate mask and base_mask, but 3197 * they are only used for short-descriptor tables (ie if EAE is 0); 3198 * for long-descriptor tables the TCR fields are used differently 3199 * and the mask and base_mask values are meaningless. 3200 */ 3201 tcr->raw_tcr = value; 3202 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift); 3203 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift); 3204 } 3205 3206 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3207 uint64_t value) 3208 { 3209 ARMCPU *cpu = arm_env_get_cpu(env); 3210 TCR *tcr = raw_ptr(env, ri); 3211 3212 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3213 /* With LPAE the TTBCR could result in a change of ASID 3214 * via the TTBCR.A1 bit, so do a TLB flush. 3215 */ 3216 tlb_flush(CPU(cpu)); 3217 } 3218 /* Preserve the high half of TCR_EL1, set via TTBCR2. */ 3219 value = deposit64(tcr->raw_tcr, 0, 32, value); 3220 vmsa_ttbcr_raw_write(env, ri, value); 3221 } 3222 3223 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3224 { 3225 TCR *tcr = raw_ptr(env, ri); 3226 3227 /* Reset both the TCR as well as the masks corresponding to the bank of 3228 * the TCR being reset. 3229 */ 3230 tcr->raw_tcr = 0; 3231 tcr->mask = 0; 3232 tcr->base_mask = 0xffffc000u; 3233 } 3234 3235 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3236 uint64_t value) 3237 { 3238 ARMCPU *cpu = arm_env_get_cpu(env); 3239 TCR *tcr = raw_ptr(env, ri); 3240 3241 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 3242 tlb_flush(CPU(cpu)); 3243 tcr->raw_tcr = value; 3244 } 3245 3246 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3247 uint64_t value) 3248 { 3249 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 3250 if (cpreg_field_is_64bit(ri) && 3251 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 3252 ARMCPU *cpu = arm_env_get_cpu(env); 3253 tlb_flush(CPU(cpu)); 3254 } 3255 raw_write(env, ri, value); 3256 } 3257 3258 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3259 uint64_t value) 3260 { 3261 ARMCPU *cpu = arm_env_get_cpu(env); 3262 CPUState *cs = CPU(cpu); 3263 3264 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */ 3265 if (raw_read(env, ri) != value) { 3266 tlb_flush_by_mmuidx(cs, 3267 ARMMMUIdxBit_S12NSE1 | 3268 ARMMMUIdxBit_S12NSE0 | 3269 ARMMMUIdxBit_S2NS); 3270 raw_write(env, ri, value); 3271 } 3272 } 3273 3274 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 3275 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3276 .access = PL1_RW, .type = ARM_CP_ALIAS, 3277 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 3278 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 3279 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3280 .access = PL1_RW, .resetvalue = 0, 3281 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 3282 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 3283 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 3284 .access = PL1_RW, .resetvalue = 0, 3285 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 3286 offsetof(CPUARMState, cp15.dfar_ns) } }, 3287 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 3288 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 3289 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 3290 .resetvalue = 0, }, 3291 REGINFO_SENTINEL 3292 }; 3293 3294 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 3295 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 3296 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 3297 .access = PL1_RW, 3298 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 3299 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 3300 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 3301 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3302 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3303 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 3304 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 3305 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 3306 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3307 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3308 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 3309 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 3310 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3311 .access = PL1_RW, .writefn = vmsa_tcr_el1_write, 3312 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write, 3313 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 3314 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3315 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 3316 .raw_writefn = vmsa_ttbcr_raw_write, 3317 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 3318 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 3319 REGINFO_SENTINEL 3320 }; 3321 3322 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing 3323 * qemu tlbs nor adjusting cached masks. 3324 */ 3325 static const ARMCPRegInfo ttbcr2_reginfo = { 3326 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 3327 .access = PL1_RW, .type = ARM_CP_ALIAS, 3328 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 3329 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) }, 3330 }; 3331 3332 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 3333 uint64_t value) 3334 { 3335 env->cp15.c15_ticonfig = value & 0xe7; 3336 /* The OS_TYPE bit in this register changes the reported CPUID! */ 3337 env->cp15.c0_cpuid = (value & (1 << 5)) ? 3338 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 3339 } 3340 3341 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 3342 uint64_t value) 3343 { 3344 env->cp15.c15_threadid = value & 0xffff; 3345 } 3346 3347 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 3348 uint64_t value) 3349 { 3350 /* Wait-for-interrupt (deprecated) */ 3351 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT); 3352 } 3353 3354 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 3355 uint64_t value) 3356 { 3357 /* On OMAP there are registers indicating the max/min index of dcache lines 3358 * containing a dirty line; cache flush operations have to reset these. 3359 */ 3360 env->cp15.c15_i_max = 0x000; 3361 env->cp15.c15_i_min = 0xff0; 3362 } 3363 3364 static const ARMCPRegInfo omap_cp_reginfo[] = { 3365 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 3366 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 3367 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 3368 .resetvalue = 0, }, 3369 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 3370 .access = PL1_RW, .type = ARM_CP_NOP }, 3371 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 3372 .access = PL1_RW, 3373 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 3374 .writefn = omap_ticonfig_write }, 3375 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 3376 .access = PL1_RW, 3377 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 3378 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 3379 .access = PL1_RW, .resetvalue = 0xff0, 3380 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 3381 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 3382 .access = PL1_RW, 3383 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 3384 .writefn = omap_threadid_write }, 3385 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 3386 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3387 .type = ARM_CP_NO_RAW, 3388 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 3389 /* TODO: Peripheral port remap register: 3390 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 3391 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 3392 * when MMU is off. 3393 */ 3394 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 3395 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 3396 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 3397 .writefn = omap_cachemaint_write }, 3398 { .name = "C9", .cp = 15, .crn = 9, 3399 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 3400 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 3401 REGINFO_SENTINEL 3402 }; 3403 3404 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3405 uint64_t value) 3406 { 3407 env->cp15.c15_cpar = value & 0x3fff; 3408 } 3409 3410 static const ARMCPRegInfo xscale_cp_reginfo[] = { 3411 { .name = "XSCALE_CPAR", 3412 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3413 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 3414 .writefn = xscale_cpar_write, }, 3415 { .name = "XSCALE_AUXCR", 3416 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 3417 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 3418 .resetvalue = 0, }, 3419 /* XScale specific cache-lockdown: since we have no cache we NOP these 3420 * and hope the guest does not really rely on cache behaviour. 3421 */ 3422 { .name = "XSCALE_LOCK_ICACHE_LINE", 3423 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 3424 .access = PL1_W, .type = ARM_CP_NOP }, 3425 { .name = "XSCALE_UNLOCK_ICACHE", 3426 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 3427 .access = PL1_W, .type = ARM_CP_NOP }, 3428 { .name = "XSCALE_DCACHE_LOCK", 3429 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 3430 .access = PL1_RW, .type = ARM_CP_NOP }, 3431 { .name = "XSCALE_UNLOCK_DCACHE", 3432 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 3433 .access = PL1_W, .type = ARM_CP_NOP }, 3434 REGINFO_SENTINEL 3435 }; 3436 3437 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 3438 /* RAZ/WI the whole crn=15 space, when we don't have a more specific 3439 * implementation of this implementation-defined space. 3440 * Ideally this should eventually disappear in favour of actually 3441 * implementing the correct behaviour for all cores. 3442 */ 3443 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 3444 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3445 .access = PL1_RW, 3446 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 3447 .resetvalue = 0 }, 3448 REGINFO_SENTINEL 3449 }; 3450 3451 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 3452 /* Cache status: RAZ because we have no cache so it's always clean */ 3453 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 3454 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3455 .resetvalue = 0 }, 3456 REGINFO_SENTINEL 3457 }; 3458 3459 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 3460 /* We never have a a block transfer operation in progress */ 3461 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 3462 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3463 .resetvalue = 0 }, 3464 /* The cache ops themselves: these all NOP for QEMU */ 3465 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 3466 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3467 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 3468 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3469 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 3470 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3471 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 3472 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3473 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 3474 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3475 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 3476 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3477 REGINFO_SENTINEL 3478 }; 3479 3480 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 3481 /* The cache test-and-clean instructions always return (1 << 30) 3482 * to indicate that there are no dirty cache lines. 3483 */ 3484 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 3485 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3486 .resetvalue = (1 << 30) }, 3487 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 3488 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3489 .resetvalue = (1 << 30) }, 3490 REGINFO_SENTINEL 3491 }; 3492 3493 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 3494 /* Ignore ReadBuffer accesses */ 3495 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 3496 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3497 .access = PL1_RW, .resetvalue = 0, 3498 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 3499 REGINFO_SENTINEL 3500 }; 3501 3502 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3503 { 3504 ARMCPU *cpu = arm_env_get_cpu(env); 3505 unsigned int cur_el = arm_current_el(env); 3506 bool secure = arm_is_secure(env); 3507 3508 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3509 return env->cp15.vpidr_el2; 3510 } 3511 return raw_read(env, ri); 3512 } 3513 3514 static uint64_t mpidr_read_val(CPUARMState *env) 3515 { 3516 ARMCPU *cpu = ARM_CPU(arm_env_get_cpu(env)); 3517 uint64_t mpidr = cpu->mp_affinity; 3518 3519 if (arm_feature(env, ARM_FEATURE_V7MP)) { 3520 mpidr |= (1U << 31); 3521 /* Cores which are uniprocessor (non-coherent) 3522 * but still implement the MP extensions set 3523 * bit 30. (For instance, Cortex-R5). 3524 */ 3525 if (cpu->mp_is_up) { 3526 mpidr |= (1u << 30); 3527 } 3528 } 3529 return mpidr; 3530 } 3531 3532 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3533 { 3534 unsigned int cur_el = arm_current_el(env); 3535 bool secure = arm_is_secure(env); 3536 3537 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3538 return env->cp15.vmpidr_el2; 3539 } 3540 return mpidr_read_val(env); 3541 } 3542 3543 static const ARMCPRegInfo mpidr_cp_reginfo[] = { 3544 { .name = "MPIDR", .state = ARM_CP_STATE_BOTH, 3545 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 3546 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 3547 REGINFO_SENTINEL 3548 }; 3549 3550 static const ARMCPRegInfo lpae_cp_reginfo[] = { 3551 /* NOP AMAIR0/1 */ 3552 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 3553 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 3554 .access = PL1_RW, .type = ARM_CP_CONST, 3555 .resetvalue = 0 }, 3556 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 3557 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 3558 .access = PL1_RW, .type = ARM_CP_CONST, 3559 .resetvalue = 0 }, 3560 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 3561 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 3562 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 3563 offsetof(CPUARMState, cp15.par_ns)} }, 3564 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 3565 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3566 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3567 offsetof(CPUARMState, cp15.ttbr0_ns) }, 3568 .writefn = vmsa_ttbr_write, }, 3569 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 3570 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3571 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3572 offsetof(CPUARMState, cp15.ttbr1_ns) }, 3573 .writefn = vmsa_ttbr_write, }, 3574 REGINFO_SENTINEL 3575 }; 3576 3577 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3578 { 3579 return vfp_get_fpcr(env); 3580 } 3581 3582 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3583 uint64_t value) 3584 { 3585 vfp_set_fpcr(env, value); 3586 } 3587 3588 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3589 { 3590 return vfp_get_fpsr(env); 3591 } 3592 3593 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3594 uint64_t value) 3595 { 3596 vfp_set_fpsr(env, value); 3597 } 3598 3599 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 3600 bool isread) 3601 { 3602 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) { 3603 return CP_ACCESS_TRAP; 3604 } 3605 return CP_ACCESS_OK; 3606 } 3607 3608 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 3609 uint64_t value) 3610 { 3611 env->daif = value & PSTATE_DAIF; 3612 } 3613 3614 static CPAccessResult aa64_cacheop_access(CPUARMState *env, 3615 const ARMCPRegInfo *ri, 3616 bool isread) 3617 { 3618 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless 3619 * SCTLR_EL1.UCI is set. 3620 */ 3621 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) { 3622 return CP_ACCESS_TRAP; 3623 } 3624 return CP_ACCESS_OK; 3625 } 3626 3627 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 3628 * Page D4-1736 (DDI0487A.b) 3629 */ 3630 3631 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3632 uint64_t value) 3633 { 3634 CPUState *cs = ENV_GET_CPU(env); 3635 bool sec = arm_is_secure_below_el3(env); 3636 3637 if (sec) { 3638 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3639 ARMMMUIdxBit_S1SE1 | 3640 ARMMMUIdxBit_S1SE0); 3641 } else { 3642 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3643 ARMMMUIdxBit_S12NSE1 | 3644 ARMMMUIdxBit_S12NSE0); 3645 } 3646 } 3647 3648 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3649 uint64_t value) 3650 { 3651 CPUState *cs = ENV_GET_CPU(env); 3652 3653 if (tlb_force_broadcast(env)) { 3654 tlbi_aa64_vmalle1is_write(env, NULL, value); 3655 return; 3656 } 3657 3658 if (arm_is_secure_below_el3(env)) { 3659 tlb_flush_by_mmuidx(cs, 3660 ARMMMUIdxBit_S1SE1 | 3661 ARMMMUIdxBit_S1SE0); 3662 } else { 3663 tlb_flush_by_mmuidx(cs, 3664 ARMMMUIdxBit_S12NSE1 | 3665 ARMMMUIdxBit_S12NSE0); 3666 } 3667 } 3668 3669 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3670 uint64_t value) 3671 { 3672 /* Note that the 'ALL' scope must invalidate both stage 1 and 3673 * stage 2 translations, whereas most other scopes only invalidate 3674 * stage 1 translations. 3675 */ 3676 ARMCPU *cpu = arm_env_get_cpu(env); 3677 CPUState *cs = CPU(cpu); 3678 3679 if (arm_is_secure_below_el3(env)) { 3680 tlb_flush_by_mmuidx(cs, 3681 ARMMMUIdxBit_S1SE1 | 3682 ARMMMUIdxBit_S1SE0); 3683 } else { 3684 if (arm_feature(env, ARM_FEATURE_EL2)) { 3685 tlb_flush_by_mmuidx(cs, 3686 ARMMMUIdxBit_S12NSE1 | 3687 ARMMMUIdxBit_S12NSE0 | 3688 ARMMMUIdxBit_S2NS); 3689 } else { 3690 tlb_flush_by_mmuidx(cs, 3691 ARMMMUIdxBit_S12NSE1 | 3692 ARMMMUIdxBit_S12NSE0); 3693 } 3694 } 3695 } 3696 3697 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3698 uint64_t value) 3699 { 3700 ARMCPU *cpu = arm_env_get_cpu(env); 3701 CPUState *cs = CPU(cpu); 3702 3703 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 3704 } 3705 3706 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3707 uint64_t value) 3708 { 3709 ARMCPU *cpu = arm_env_get_cpu(env); 3710 CPUState *cs = CPU(cpu); 3711 3712 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3); 3713 } 3714 3715 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3716 uint64_t value) 3717 { 3718 /* Note that the 'ALL' scope must invalidate both stage 1 and 3719 * stage 2 translations, whereas most other scopes only invalidate 3720 * stage 1 translations. 3721 */ 3722 CPUState *cs = ENV_GET_CPU(env); 3723 bool sec = arm_is_secure_below_el3(env); 3724 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2); 3725 3726 if (sec) { 3727 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3728 ARMMMUIdxBit_S1SE1 | 3729 ARMMMUIdxBit_S1SE0); 3730 } else if (has_el2) { 3731 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3732 ARMMMUIdxBit_S12NSE1 | 3733 ARMMMUIdxBit_S12NSE0 | 3734 ARMMMUIdxBit_S2NS); 3735 } else { 3736 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3737 ARMMMUIdxBit_S12NSE1 | 3738 ARMMMUIdxBit_S12NSE0); 3739 } 3740 } 3741 3742 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3743 uint64_t value) 3744 { 3745 CPUState *cs = ENV_GET_CPU(env); 3746 3747 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 3748 } 3749 3750 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3751 uint64_t value) 3752 { 3753 CPUState *cs = ENV_GET_CPU(env); 3754 3755 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3); 3756 } 3757 3758 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3759 uint64_t value) 3760 { 3761 /* Invalidate by VA, EL2 3762 * Currently handles both VAE2 and VALE2, since we don't support 3763 * flush-last-level-only. 3764 */ 3765 ARMCPU *cpu = arm_env_get_cpu(env); 3766 CPUState *cs = CPU(cpu); 3767 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3768 3769 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 3770 } 3771 3772 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3773 uint64_t value) 3774 { 3775 /* Invalidate by VA, EL3 3776 * Currently handles both VAE3 and VALE3, since we don't support 3777 * flush-last-level-only. 3778 */ 3779 ARMCPU *cpu = arm_env_get_cpu(env); 3780 CPUState *cs = CPU(cpu); 3781 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3782 3783 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3); 3784 } 3785 3786 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3787 uint64_t value) 3788 { 3789 ARMCPU *cpu = arm_env_get_cpu(env); 3790 CPUState *cs = CPU(cpu); 3791 bool sec = arm_is_secure_below_el3(env); 3792 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3793 3794 if (sec) { 3795 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3796 ARMMMUIdxBit_S1SE1 | 3797 ARMMMUIdxBit_S1SE0); 3798 } else { 3799 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3800 ARMMMUIdxBit_S12NSE1 | 3801 ARMMMUIdxBit_S12NSE0); 3802 } 3803 } 3804 3805 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3806 uint64_t value) 3807 { 3808 /* Invalidate by VA, EL1&0 (AArch64 version). 3809 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 3810 * since we don't support flush-for-specific-ASID-only or 3811 * flush-last-level-only. 3812 */ 3813 ARMCPU *cpu = arm_env_get_cpu(env); 3814 CPUState *cs = CPU(cpu); 3815 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3816 3817 if (tlb_force_broadcast(env)) { 3818 tlbi_aa64_vae1is_write(env, NULL, value); 3819 return; 3820 } 3821 3822 if (arm_is_secure_below_el3(env)) { 3823 tlb_flush_page_by_mmuidx(cs, pageaddr, 3824 ARMMMUIdxBit_S1SE1 | 3825 ARMMMUIdxBit_S1SE0); 3826 } else { 3827 tlb_flush_page_by_mmuidx(cs, pageaddr, 3828 ARMMMUIdxBit_S12NSE1 | 3829 ARMMMUIdxBit_S12NSE0); 3830 } 3831 } 3832 3833 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3834 uint64_t value) 3835 { 3836 CPUState *cs = ENV_GET_CPU(env); 3837 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3838 3839 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3840 ARMMMUIdxBit_S1E2); 3841 } 3842 3843 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3844 uint64_t value) 3845 { 3846 CPUState *cs = ENV_GET_CPU(env); 3847 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3848 3849 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3850 ARMMMUIdxBit_S1E3); 3851 } 3852 3853 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3854 uint64_t value) 3855 { 3856 /* Invalidate by IPA. This has to invalidate any structures that 3857 * contain only stage 2 translation information, but does not need 3858 * to apply to structures that contain combined stage 1 and stage 2 3859 * translation information. 3860 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 3861 */ 3862 ARMCPU *cpu = arm_env_get_cpu(env); 3863 CPUState *cs = CPU(cpu); 3864 uint64_t pageaddr; 3865 3866 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 3867 return; 3868 } 3869 3870 pageaddr = sextract64(value << 12, 0, 48); 3871 3872 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 3873 } 3874 3875 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3876 uint64_t value) 3877 { 3878 CPUState *cs = ENV_GET_CPU(env); 3879 uint64_t pageaddr; 3880 3881 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 3882 return; 3883 } 3884 3885 pageaddr = sextract64(value << 12, 0, 48); 3886 3887 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3888 ARMMMUIdxBit_S2NS); 3889 } 3890 3891 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 3892 bool isread) 3893 { 3894 /* We don't implement EL2, so the only control on DC ZVA is the 3895 * bit in the SCTLR which can prohibit access for EL0. 3896 */ 3897 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 3898 return CP_ACCESS_TRAP; 3899 } 3900 return CP_ACCESS_OK; 3901 } 3902 3903 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 3904 { 3905 ARMCPU *cpu = arm_env_get_cpu(env); 3906 int dzp_bit = 1 << 4; 3907 3908 /* DZP indicates whether DC ZVA access is allowed */ 3909 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 3910 dzp_bit = 0; 3911 } 3912 return cpu->dcz_blocksize | dzp_bit; 3913 } 3914 3915 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 3916 bool isread) 3917 { 3918 if (!(env->pstate & PSTATE_SP)) { 3919 /* Access to SP_EL0 is undefined if it's being used as 3920 * the stack pointer. 3921 */ 3922 return CP_ACCESS_TRAP_UNCATEGORIZED; 3923 } 3924 return CP_ACCESS_OK; 3925 } 3926 3927 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 3928 { 3929 return env->pstate & PSTATE_SP; 3930 } 3931 3932 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 3933 { 3934 update_spsel(env, val); 3935 } 3936 3937 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3938 uint64_t value) 3939 { 3940 ARMCPU *cpu = arm_env_get_cpu(env); 3941 3942 if (raw_read(env, ri) == value) { 3943 /* Skip the TLB flush if nothing actually changed; Linux likes 3944 * to do a lot of pointless SCTLR writes. 3945 */ 3946 return; 3947 } 3948 3949 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 3950 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 3951 value &= ~SCTLR_M; 3952 } 3953 3954 raw_write(env, ri, value); 3955 /* ??? Lots of these bits are not implemented. */ 3956 /* This may enable/disable the MMU, so do a TLB flush. */ 3957 tlb_flush(CPU(cpu)); 3958 } 3959 3960 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri, 3961 bool isread) 3962 { 3963 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) { 3964 return CP_ACCESS_TRAP_FP_EL2; 3965 } 3966 if (env->cp15.cptr_el[3] & CPTR_TFP) { 3967 return CP_ACCESS_TRAP_FP_EL3; 3968 } 3969 return CP_ACCESS_OK; 3970 } 3971 3972 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3973 uint64_t value) 3974 { 3975 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK; 3976 } 3977 3978 static const ARMCPRegInfo v8_cp_reginfo[] = { 3979 /* Minimal set of EL0-visible registers. This will need to be expanded 3980 * significantly for system emulation of AArch64 CPUs. 3981 */ 3982 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 3983 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 3984 .access = PL0_RW, .type = ARM_CP_NZCV }, 3985 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 3986 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 3987 .type = ARM_CP_NO_RAW, 3988 .access = PL0_RW, .accessfn = aa64_daif_access, 3989 .fieldoffset = offsetof(CPUARMState, daif), 3990 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 3991 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 3992 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 3993 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 3994 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 3995 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 3996 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 3997 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 3998 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 3999 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 4000 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 4001 .access = PL0_R, .type = ARM_CP_NO_RAW, 4002 .readfn = aa64_dczid_read }, 4003 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 4004 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 4005 .access = PL0_W, .type = ARM_CP_DC_ZVA, 4006 #ifndef CONFIG_USER_ONLY 4007 /* Avoid overhead of an access check that always passes in user-mode */ 4008 .accessfn = aa64_zva_access, 4009 #endif 4010 }, 4011 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 4012 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 4013 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 4014 /* Cache ops: all NOPs since we don't emulate caches */ 4015 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 4016 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4017 .access = PL1_W, .type = ARM_CP_NOP }, 4018 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 4019 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4020 .access = PL1_W, .type = ARM_CP_NOP }, 4021 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 4022 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 4023 .access = PL0_W, .type = ARM_CP_NOP, 4024 .accessfn = aa64_cacheop_access }, 4025 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 4026 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4027 .access = PL1_W, .type = ARM_CP_NOP }, 4028 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 4029 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4030 .access = PL1_W, .type = ARM_CP_NOP }, 4031 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 4032 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 4033 .access = PL0_W, .type = ARM_CP_NOP, 4034 .accessfn = aa64_cacheop_access }, 4035 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 4036 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4037 .access = PL1_W, .type = ARM_CP_NOP }, 4038 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 4039 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 4040 .access = PL0_W, .type = ARM_CP_NOP, 4041 .accessfn = aa64_cacheop_access }, 4042 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 4043 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 4044 .access = PL0_W, .type = ARM_CP_NOP, 4045 .accessfn = aa64_cacheop_access }, 4046 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 4047 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4048 .access = PL1_W, .type = ARM_CP_NOP }, 4049 /* TLBI operations */ 4050 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 4051 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 4052 .access = PL1_W, .type = ARM_CP_NO_RAW, 4053 .writefn = tlbi_aa64_vmalle1is_write }, 4054 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 4055 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 4056 .access = PL1_W, .type = ARM_CP_NO_RAW, 4057 .writefn = tlbi_aa64_vae1is_write }, 4058 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 4059 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 4060 .access = PL1_W, .type = ARM_CP_NO_RAW, 4061 .writefn = tlbi_aa64_vmalle1is_write }, 4062 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 4063 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 4064 .access = PL1_W, .type = ARM_CP_NO_RAW, 4065 .writefn = tlbi_aa64_vae1is_write }, 4066 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 4067 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4068 .access = PL1_W, .type = ARM_CP_NO_RAW, 4069 .writefn = tlbi_aa64_vae1is_write }, 4070 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 4071 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4072 .access = PL1_W, .type = ARM_CP_NO_RAW, 4073 .writefn = tlbi_aa64_vae1is_write }, 4074 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 4075 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 4076 .access = PL1_W, .type = ARM_CP_NO_RAW, 4077 .writefn = tlbi_aa64_vmalle1_write }, 4078 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 4079 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 4080 .access = PL1_W, .type = ARM_CP_NO_RAW, 4081 .writefn = tlbi_aa64_vae1_write }, 4082 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 4083 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 4084 .access = PL1_W, .type = ARM_CP_NO_RAW, 4085 .writefn = tlbi_aa64_vmalle1_write }, 4086 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 4087 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 4088 .access = PL1_W, .type = ARM_CP_NO_RAW, 4089 .writefn = tlbi_aa64_vae1_write }, 4090 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 4091 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4092 .access = PL1_W, .type = ARM_CP_NO_RAW, 4093 .writefn = tlbi_aa64_vae1_write }, 4094 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 4095 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4096 .access = PL1_W, .type = ARM_CP_NO_RAW, 4097 .writefn = tlbi_aa64_vae1_write }, 4098 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 4099 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4100 .access = PL2_W, .type = ARM_CP_NO_RAW, 4101 .writefn = tlbi_aa64_ipas2e1is_write }, 4102 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 4103 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4104 .access = PL2_W, .type = ARM_CP_NO_RAW, 4105 .writefn = tlbi_aa64_ipas2e1is_write }, 4106 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 4107 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4108 .access = PL2_W, .type = ARM_CP_NO_RAW, 4109 .writefn = tlbi_aa64_alle1is_write }, 4110 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 4111 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 4112 .access = PL2_W, .type = ARM_CP_NO_RAW, 4113 .writefn = tlbi_aa64_alle1is_write }, 4114 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 4115 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4116 .access = PL2_W, .type = ARM_CP_NO_RAW, 4117 .writefn = tlbi_aa64_ipas2e1_write }, 4118 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 4119 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4120 .access = PL2_W, .type = ARM_CP_NO_RAW, 4121 .writefn = tlbi_aa64_ipas2e1_write }, 4122 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 4123 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4124 .access = PL2_W, .type = ARM_CP_NO_RAW, 4125 .writefn = tlbi_aa64_alle1_write }, 4126 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 4127 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 4128 .access = PL2_W, .type = ARM_CP_NO_RAW, 4129 .writefn = tlbi_aa64_alle1is_write }, 4130 #ifndef CONFIG_USER_ONLY 4131 /* 64 bit address translation operations */ 4132 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 4133 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 4134 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4135 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 4136 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 4137 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4138 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 4139 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 4140 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4141 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 4142 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 4143 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4144 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 4145 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 4146 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4147 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 4148 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 4149 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4150 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 4151 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 4152 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4153 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 4154 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 4155 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4156 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 4157 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 4158 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 4159 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4160 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 4161 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 4162 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4163 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 4164 .type = ARM_CP_ALIAS, 4165 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 4166 .access = PL1_RW, .resetvalue = 0, 4167 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 4168 .writefn = par_write }, 4169 #endif 4170 /* TLB invalidate last level of translation table walk */ 4171 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4172 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 4173 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4174 .type = ARM_CP_NO_RAW, .access = PL1_W, 4175 .writefn = tlbimvaa_is_write }, 4176 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4177 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 4178 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4179 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 4180 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4181 .type = ARM_CP_NO_RAW, .access = PL2_W, 4182 .writefn = tlbimva_hyp_write }, 4183 { .name = "TLBIMVALHIS", 4184 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4185 .type = ARM_CP_NO_RAW, .access = PL2_W, 4186 .writefn = tlbimva_hyp_is_write }, 4187 { .name = "TLBIIPAS2", 4188 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4189 .type = ARM_CP_NO_RAW, .access = PL2_W, 4190 .writefn = tlbiipas2_write }, 4191 { .name = "TLBIIPAS2IS", 4192 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4193 .type = ARM_CP_NO_RAW, .access = PL2_W, 4194 .writefn = tlbiipas2_is_write }, 4195 { .name = "TLBIIPAS2L", 4196 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4197 .type = ARM_CP_NO_RAW, .access = PL2_W, 4198 .writefn = tlbiipas2_write }, 4199 { .name = "TLBIIPAS2LIS", 4200 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4201 .type = ARM_CP_NO_RAW, .access = PL2_W, 4202 .writefn = tlbiipas2_is_write }, 4203 /* 32 bit cache operations */ 4204 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4205 .type = ARM_CP_NOP, .access = PL1_W }, 4206 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 4207 .type = ARM_CP_NOP, .access = PL1_W }, 4208 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4209 .type = ARM_CP_NOP, .access = PL1_W }, 4210 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 4211 .type = ARM_CP_NOP, .access = PL1_W }, 4212 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 4213 .type = ARM_CP_NOP, .access = PL1_W }, 4214 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 4215 .type = ARM_CP_NOP, .access = PL1_W }, 4216 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4217 .type = ARM_CP_NOP, .access = PL1_W }, 4218 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4219 .type = ARM_CP_NOP, .access = PL1_W }, 4220 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 4221 .type = ARM_CP_NOP, .access = PL1_W }, 4222 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4223 .type = ARM_CP_NOP, .access = PL1_W }, 4224 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 4225 .type = ARM_CP_NOP, .access = PL1_W }, 4226 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 4227 .type = ARM_CP_NOP, .access = PL1_W }, 4228 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4229 .type = ARM_CP_NOP, .access = PL1_W }, 4230 /* MMU Domain access control / MPU write buffer control */ 4231 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 4232 .access = PL1_RW, .resetvalue = 0, 4233 .writefn = dacr_write, .raw_writefn = raw_write, 4234 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 4235 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 4236 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 4237 .type = ARM_CP_ALIAS, 4238 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 4239 .access = PL1_RW, 4240 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 4241 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 4242 .type = ARM_CP_ALIAS, 4243 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 4244 .access = PL1_RW, 4245 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 4246 /* We rely on the access checks not allowing the guest to write to the 4247 * state field when SPSel indicates that it's being used as the stack 4248 * pointer. 4249 */ 4250 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 4251 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 4252 .access = PL1_RW, .accessfn = sp_el0_access, 4253 .type = ARM_CP_ALIAS, 4254 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 4255 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 4256 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 4257 .access = PL2_RW, .type = ARM_CP_ALIAS, 4258 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 4259 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 4260 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 4261 .type = ARM_CP_NO_RAW, 4262 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 4263 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 4264 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 4265 .type = ARM_CP_ALIAS, 4266 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]), 4267 .access = PL2_RW, .accessfn = fpexc32_access }, 4268 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 4269 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 4270 .access = PL2_RW, .resetvalue = 0, 4271 .writefn = dacr_write, .raw_writefn = raw_write, 4272 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 4273 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 4274 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 4275 .access = PL2_RW, .resetvalue = 0, 4276 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 4277 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 4278 .type = ARM_CP_ALIAS, 4279 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 4280 .access = PL2_RW, 4281 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 4282 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 4283 .type = ARM_CP_ALIAS, 4284 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 4285 .access = PL2_RW, 4286 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 4287 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 4288 .type = ARM_CP_ALIAS, 4289 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 4290 .access = PL2_RW, 4291 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 4292 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 4293 .type = ARM_CP_ALIAS, 4294 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 4295 .access = PL2_RW, 4296 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 4297 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 4298 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 4299 .resetvalue = 0, 4300 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 4301 { .name = "SDCR", .type = ARM_CP_ALIAS, 4302 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 4303 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4304 .writefn = sdcr_write, 4305 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 4306 REGINFO_SENTINEL 4307 }; 4308 4309 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */ 4310 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = { 4311 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4312 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4313 .access = PL2_RW, 4314 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore }, 4315 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH, 4316 .type = ARM_CP_NO_RAW, 4317 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4318 .access = PL2_RW, 4319 .type = ARM_CP_CONST, .resetvalue = 0 }, 4320 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4321 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4322 .access = PL2_RW, 4323 .type = ARM_CP_CONST, .resetvalue = 0 }, 4324 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4325 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4326 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4327 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4328 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4329 .access = PL2_RW, .type = ARM_CP_CONST, 4330 .resetvalue = 0 }, 4331 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4332 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4333 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4334 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4335 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4336 .access = PL2_RW, .type = ARM_CP_CONST, 4337 .resetvalue = 0 }, 4338 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4339 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4340 .access = PL2_RW, .type = ARM_CP_CONST, 4341 .resetvalue = 0 }, 4342 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4343 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4344 .access = PL2_RW, .type = ARM_CP_CONST, 4345 .resetvalue = 0 }, 4346 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4347 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4348 .access = PL2_RW, .type = ARM_CP_CONST, 4349 .resetvalue = 0 }, 4350 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4351 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4352 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4353 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH, 4354 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4355 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4356 .type = ARM_CP_CONST, .resetvalue = 0 }, 4357 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4358 .cp = 15, .opc1 = 6, .crm = 2, 4359 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4360 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 }, 4361 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4362 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4363 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4364 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4365 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4366 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4367 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4368 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4369 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4370 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4371 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4372 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4373 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4374 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4375 .resetvalue = 0 }, 4376 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4377 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4378 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4379 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4380 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4381 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4382 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4383 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4384 .resetvalue = 0 }, 4385 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4386 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4387 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4388 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4389 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4390 .resetvalue = 0 }, 4391 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4392 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4393 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4394 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4395 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4396 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4397 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4398 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4399 .access = PL2_RW, .accessfn = access_tda, 4400 .type = ARM_CP_CONST, .resetvalue = 0 }, 4401 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH, 4402 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4403 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4404 .type = ARM_CP_CONST, .resetvalue = 0 }, 4405 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4406 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4407 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4408 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4409 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4410 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4411 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4412 .type = ARM_CP_CONST, 4413 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4414 .access = PL2_RW, .resetvalue = 0 }, 4415 REGINFO_SENTINEL 4416 }; 4417 4418 /* Ditto, but for registers which exist in ARMv8 but not v7 */ 4419 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = { 4420 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4421 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4422 .access = PL2_RW, 4423 .type = ARM_CP_CONST, .resetvalue = 0 }, 4424 REGINFO_SENTINEL 4425 }; 4426 4427 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 4428 { 4429 ARMCPU *cpu = arm_env_get_cpu(env); 4430 uint64_t valid_mask = HCR_MASK; 4431 4432 if (arm_feature(env, ARM_FEATURE_EL3)) { 4433 valid_mask &= ~HCR_HCD; 4434 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 4435 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented. 4436 * However, if we're using the SMC PSCI conduit then QEMU is 4437 * effectively acting like EL3 firmware and so the guest at 4438 * EL2 should retain the ability to prevent EL1 from being 4439 * able to make SMC calls into the ersatz firmware, so in 4440 * that case HCR.TSC should be read/write. 4441 */ 4442 valid_mask &= ~HCR_TSC; 4443 } 4444 if (cpu_isar_feature(aa64_lor, cpu)) { 4445 valid_mask |= HCR_TLOR; 4446 } 4447 4448 /* Clear RES0 bits. */ 4449 value &= valid_mask; 4450 4451 /* These bits change the MMU setup: 4452 * HCR_VM enables stage 2 translation 4453 * HCR_PTW forbids certain page-table setups 4454 * HCR_DC Disables stage1 and enables stage2 translation 4455 */ 4456 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) { 4457 tlb_flush(CPU(cpu)); 4458 } 4459 env->cp15.hcr_el2 = value; 4460 4461 /* 4462 * Updates to VI and VF require us to update the status of 4463 * virtual interrupts, which are the logical OR of these bits 4464 * and the state of the input lines from the GIC. (This requires 4465 * that we have the iothread lock, which is done by marking the 4466 * reginfo structs as ARM_CP_IO.) 4467 * Note that if a write to HCR pends a VIRQ or VFIQ it is never 4468 * possible for it to be taken immediately, because VIRQ and 4469 * VFIQ are masked unless running at EL0 or EL1, and HCR 4470 * can only be written at EL2. 4471 */ 4472 g_assert(qemu_mutex_iothread_locked()); 4473 arm_cpu_update_virq(cpu); 4474 arm_cpu_update_vfiq(cpu); 4475 } 4476 4477 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 4478 uint64_t value) 4479 { 4480 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 4481 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 4482 hcr_write(env, NULL, value); 4483 } 4484 4485 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 4486 uint64_t value) 4487 { 4488 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 4489 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 4490 hcr_write(env, NULL, value); 4491 } 4492 4493 /* 4494 * Return the effective value of HCR_EL2. 4495 * Bits that are not included here: 4496 * RW (read from SCR_EL3.RW as needed) 4497 */ 4498 uint64_t arm_hcr_el2_eff(CPUARMState *env) 4499 { 4500 uint64_t ret = env->cp15.hcr_el2; 4501 4502 if (arm_is_secure_below_el3(env)) { 4503 /* 4504 * "This register has no effect if EL2 is not enabled in the 4505 * current Security state". This is ARMv8.4-SecEL2 speak for 4506 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 4507 * 4508 * Prior to that, the language was "In an implementation that 4509 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 4510 * as if this field is 0 for all purposes other than a direct 4511 * read or write access of HCR_EL2". With lots of enumeration 4512 * on a per-field basis. In current QEMU, this is condition 4513 * is arm_is_secure_below_el3. 4514 * 4515 * Since the v8.4 language applies to the entire register, and 4516 * appears to be backward compatible, use that. 4517 */ 4518 ret = 0; 4519 } else if (ret & HCR_TGE) { 4520 /* These bits are up-to-date as of ARMv8.4. */ 4521 if (ret & HCR_E2H) { 4522 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 4523 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 4524 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 4525 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE); 4526 } else { 4527 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 4528 } 4529 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 4530 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 4531 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 4532 HCR_TLOR); 4533 } 4534 4535 return ret; 4536 } 4537 4538 static const ARMCPRegInfo el2_cp_reginfo[] = { 4539 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 4540 .type = ARM_CP_IO, 4541 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4542 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4543 .writefn = hcr_write }, 4544 { .name = "HCR", .state = ARM_CP_STATE_AA32, 4545 .type = ARM_CP_ALIAS | ARM_CP_IO, 4546 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4547 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4548 .writefn = hcr_writelow }, 4549 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 4550 .type = ARM_CP_ALIAS, 4551 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 4552 .access = PL2_RW, 4553 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 4554 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4555 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4556 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 4557 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4558 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4559 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 4560 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4561 .type = ARM_CP_ALIAS, 4562 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4563 .access = PL2_RW, 4564 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 4565 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 4566 .type = ARM_CP_ALIAS, 4567 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 4568 .access = PL2_RW, 4569 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 4570 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4571 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4572 .access = PL2_RW, .writefn = vbar_write, 4573 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 4574 .resetvalue = 0 }, 4575 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 4576 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 4577 .access = PL3_RW, .type = ARM_CP_ALIAS, 4578 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 4579 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4580 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4581 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 4582 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]) }, 4583 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4584 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4585 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 4586 .resetvalue = 0 }, 4587 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4588 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4589 .access = PL2_RW, .type = ARM_CP_ALIAS, 4590 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 4591 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4592 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4593 .access = PL2_RW, .type = ARM_CP_CONST, 4594 .resetvalue = 0 }, 4595 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 4596 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4597 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4598 .access = PL2_RW, .type = ARM_CP_CONST, 4599 .resetvalue = 0 }, 4600 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4601 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4602 .access = PL2_RW, .type = ARM_CP_CONST, 4603 .resetvalue = 0 }, 4604 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4605 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4606 .access = PL2_RW, .type = ARM_CP_CONST, 4607 .resetvalue = 0 }, 4608 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4609 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4610 .access = PL2_RW, 4611 /* no .writefn needed as this can't cause an ASID change; 4612 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4613 */ 4614 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 4615 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 4616 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4617 .type = ARM_CP_ALIAS, 4618 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4619 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4620 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 4621 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4622 .access = PL2_RW, 4623 /* no .writefn needed as this can't cause an ASID change; 4624 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4625 */ 4626 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4627 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4628 .cp = 15, .opc1 = 6, .crm = 2, 4629 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4630 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4631 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 4632 .writefn = vttbr_write }, 4633 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4634 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4635 .access = PL2_RW, .writefn = vttbr_write, 4636 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 4637 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4638 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4639 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 4640 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 4641 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4642 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4643 .access = PL2_RW, .resetvalue = 0, 4644 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 4645 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4646 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4647 .access = PL2_RW, .resetvalue = 0, 4648 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4649 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4650 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4651 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4652 { .name = "TLBIALLNSNH", 4653 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4654 .type = ARM_CP_NO_RAW, .access = PL2_W, 4655 .writefn = tlbiall_nsnh_write }, 4656 { .name = "TLBIALLNSNHIS", 4657 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4658 .type = ARM_CP_NO_RAW, .access = PL2_W, 4659 .writefn = tlbiall_nsnh_is_write }, 4660 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4661 .type = ARM_CP_NO_RAW, .access = PL2_W, 4662 .writefn = tlbiall_hyp_write }, 4663 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4664 .type = ARM_CP_NO_RAW, .access = PL2_W, 4665 .writefn = tlbiall_hyp_is_write }, 4666 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4667 .type = ARM_CP_NO_RAW, .access = PL2_W, 4668 .writefn = tlbimva_hyp_write }, 4669 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4670 .type = ARM_CP_NO_RAW, .access = PL2_W, 4671 .writefn = tlbimva_hyp_is_write }, 4672 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 4673 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4674 .type = ARM_CP_NO_RAW, .access = PL2_W, 4675 .writefn = tlbi_aa64_alle2_write }, 4676 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 4677 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4678 .type = ARM_CP_NO_RAW, .access = PL2_W, 4679 .writefn = tlbi_aa64_vae2_write }, 4680 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 4681 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4682 .access = PL2_W, .type = ARM_CP_NO_RAW, 4683 .writefn = tlbi_aa64_vae2_write }, 4684 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 4685 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4686 .access = PL2_W, .type = ARM_CP_NO_RAW, 4687 .writefn = tlbi_aa64_alle2is_write }, 4688 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 4689 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4690 .type = ARM_CP_NO_RAW, .access = PL2_W, 4691 .writefn = tlbi_aa64_vae2is_write }, 4692 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 4693 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4694 .access = PL2_W, .type = ARM_CP_NO_RAW, 4695 .writefn = tlbi_aa64_vae2is_write }, 4696 #ifndef CONFIG_USER_ONLY 4697 /* Unlike the other EL2-related AT operations, these must 4698 * UNDEF from EL3 if EL2 is not implemented, which is why we 4699 * define them here rather than with the rest of the AT ops. 4700 */ 4701 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 4702 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4703 .access = PL2_W, .accessfn = at_s1e2_access, 4704 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4705 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 4706 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4707 .access = PL2_W, .accessfn = at_s1e2_access, 4708 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4709 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 4710 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 4711 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 4712 * to behave as if SCR.NS was 1. 4713 */ 4714 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4715 .access = PL2_W, 4716 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4717 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4718 .access = PL2_W, 4719 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4720 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4721 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4722 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 4723 * reset values as IMPDEF. We choose to reset to 3 to comply with 4724 * both ARMv7 and ARMv8. 4725 */ 4726 .access = PL2_RW, .resetvalue = 3, 4727 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 4728 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4729 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4730 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 4731 .writefn = gt_cntvoff_write, 4732 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4733 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4734 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 4735 .writefn = gt_cntvoff_write, 4736 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4737 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4738 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4739 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4740 .type = ARM_CP_IO, .access = PL2_RW, 4741 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4742 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4743 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4744 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 4745 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4746 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4747 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4748 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 4749 .resetfn = gt_hyp_timer_reset, 4750 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 4751 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4752 .type = ARM_CP_IO, 4753 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4754 .access = PL2_RW, 4755 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 4756 .resetvalue = 0, 4757 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 4758 #endif 4759 /* The only field of MDCR_EL2 that has a defined architectural reset value 4760 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we 4761 * don't implement any PMU event counters, so using zero as a reset 4762 * value for MDCR_EL2 is okay 4763 */ 4764 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4765 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4766 .access = PL2_RW, .resetvalue = 0, 4767 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), }, 4768 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 4769 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4770 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4771 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4772 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 4773 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4774 .access = PL2_RW, 4775 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4776 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4777 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4778 .access = PL2_RW, 4779 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 4780 REGINFO_SENTINEL 4781 }; 4782 4783 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 4784 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4785 .type = ARM_CP_ALIAS | ARM_CP_IO, 4786 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4787 .access = PL2_RW, 4788 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 4789 .writefn = hcr_writehigh }, 4790 REGINFO_SENTINEL 4791 }; 4792 4793 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 4794 bool isread) 4795 { 4796 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 4797 * At Secure EL1 it traps to EL3. 4798 */ 4799 if (arm_current_el(env) == 3) { 4800 return CP_ACCESS_OK; 4801 } 4802 if (arm_is_secure_below_el3(env)) { 4803 return CP_ACCESS_TRAP_EL3; 4804 } 4805 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 4806 if (isread) { 4807 return CP_ACCESS_OK; 4808 } 4809 return CP_ACCESS_TRAP_UNCATEGORIZED; 4810 } 4811 4812 static const ARMCPRegInfo el3_cp_reginfo[] = { 4813 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 4814 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 4815 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 4816 .resetvalue = 0, .writefn = scr_write }, 4817 { .name = "SCR", .type = ARM_CP_ALIAS, 4818 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 4819 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4820 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 4821 .writefn = scr_write }, 4822 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 4823 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 4824 .access = PL3_RW, .resetvalue = 0, 4825 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 4826 { .name = "SDER", 4827 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 4828 .access = PL3_RW, .resetvalue = 0, 4829 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 4830 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 4831 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4832 .writefn = vbar_write, .resetvalue = 0, 4833 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 4834 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 4835 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 4836 .access = PL3_RW, .resetvalue = 0, 4837 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 4838 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 4839 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 4840 .access = PL3_RW, 4841 /* no .writefn needed as this can't cause an ASID change; 4842 * we must provide a .raw_writefn and .resetfn because we handle 4843 * reset and migration for the AArch32 TTBCR(S), which might be 4844 * using mask and base_mask. 4845 */ 4846 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write, 4847 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 4848 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 4849 .type = ARM_CP_ALIAS, 4850 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 4851 .access = PL3_RW, 4852 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 4853 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 4854 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 4855 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 4856 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 4857 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 4858 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 4859 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 4860 .type = ARM_CP_ALIAS, 4861 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 4862 .access = PL3_RW, 4863 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 4864 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 4865 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 4866 .access = PL3_RW, .writefn = vbar_write, 4867 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 4868 .resetvalue = 0 }, 4869 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 4870 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 4871 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 4872 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 4873 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 4874 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 4875 .access = PL3_RW, .resetvalue = 0, 4876 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 4877 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 4878 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 4879 .access = PL3_RW, .type = ARM_CP_CONST, 4880 .resetvalue = 0 }, 4881 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 4882 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 4883 .access = PL3_RW, .type = ARM_CP_CONST, 4884 .resetvalue = 0 }, 4885 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 4886 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 4887 .access = PL3_RW, .type = ARM_CP_CONST, 4888 .resetvalue = 0 }, 4889 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 4890 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 4891 .access = PL3_W, .type = ARM_CP_NO_RAW, 4892 .writefn = tlbi_aa64_alle3is_write }, 4893 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 4894 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 4895 .access = PL3_W, .type = ARM_CP_NO_RAW, 4896 .writefn = tlbi_aa64_vae3is_write }, 4897 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 4898 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 4899 .access = PL3_W, .type = ARM_CP_NO_RAW, 4900 .writefn = tlbi_aa64_vae3is_write }, 4901 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 4902 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 4903 .access = PL3_W, .type = ARM_CP_NO_RAW, 4904 .writefn = tlbi_aa64_alle3_write }, 4905 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 4906 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 4907 .access = PL3_W, .type = ARM_CP_NO_RAW, 4908 .writefn = tlbi_aa64_vae3_write }, 4909 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 4910 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 4911 .access = PL3_W, .type = ARM_CP_NO_RAW, 4912 .writefn = tlbi_aa64_vae3_write }, 4913 REGINFO_SENTINEL 4914 }; 4915 4916 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 4917 bool isread) 4918 { 4919 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64, 4920 * but the AArch32 CTR has its own reginfo struct) 4921 */ 4922 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 4923 return CP_ACCESS_TRAP; 4924 } 4925 return CP_ACCESS_OK; 4926 } 4927 4928 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4929 uint64_t value) 4930 { 4931 /* Writes to OSLAR_EL1 may update the OS lock status, which can be 4932 * read via a bit in OSLSR_EL1. 4933 */ 4934 int oslock; 4935 4936 if (ri->state == ARM_CP_STATE_AA32) { 4937 oslock = (value == 0xC5ACCE55); 4938 } else { 4939 oslock = value & 1; 4940 } 4941 4942 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock); 4943 } 4944 4945 static const ARMCPRegInfo debug_cp_reginfo[] = { 4946 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped 4947 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; 4948 * unlike DBGDRAR it is never accessible from EL0. 4949 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64 4950 * accessor. 4951 */ 4952 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, 4953 .access = PL0_R, .accessfn = access_tdra, 4954 .type = ARM_CP_CONST, .resetvalue = 0 }, 4955 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, 4956 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 4957 .access = PL1_R, .accessfn = access_tdra, 4958 .type = ARM_CP_CONST, .resetvalue = 0 }, 4959 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 4960 .access = PL0_R, .accessfn = access_tdra, 4961 .type = ARM_CP_CONST, .resetvalue = 0 }, 4962 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ 4963 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, 4964 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 4965 .access = PL1_RW, .accessfn = access_tda, 4966 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), 4967 .resetvalue = 0 }, 4968 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1. 4969 * We don't implement the configurable EL0 access. 4970 */ 4971 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH, 4972 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 4973 .type = ARM_CP_ALIAS, 4974 .access = PL1_R, .accessfn = access_tda, 4975 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, 4976 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, 4977 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, 4978 .access = PL1_W, .type = ARM_CP_NO_RAW, 4979 .accessfn = access_tdosa, 4980 .writefn = oslar_write }, 4981 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, 4982 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, 4983 .access = PL1_R, .resetvalue = 10, 4984 .accessfn = access_tdosa, 4985 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, 4986 /* Dummy OSDLR_EL1: 32-bit Linux will read this */ 4987 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, 4988 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, 4989 .access = PL1_RW, .accessfn = access_tdosa, 4990 .type = ARM_CP_NOP }, 4991 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't 4992 * implement vector catch debug events yet. 4993 */ 4994 { .name = "DBGVCR", 4995 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 4996 .access = PL1_RW, .accessfn = access_tda, 4997 .type = ARM_CP_NOP }, 4998 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor 4999 * to save and restore a 32-bit guest's DBGVCR) 5000 */ 5001 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64, 5002 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0, 5003 .access = PL2_RW, .accessfn = access_tda, 5004 .type = ARM_CP_NOP }, 5005 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications 5006 * Channel but Linux may try to access this register. The 32-bit 5007 * alias is DBGDCCINT. 5008 */ 5009 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH, 5010 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5011 .access = PL1_RW, .accessfn = access_tda, 5012 .type = ARM_CP_NOP }, 5013 REGINFO_SENTINEL 5014 }; 5015 5016 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = { 5017 /* 64 bit access versions of the (dummy) debug registers */ 5018 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0, 5019 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5020 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0, 5021 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5022 REGINFO_SENTINEL 5023 }; 5024 5025 /* Return the exception level to which exceptions should be taken 5026 * via SVEAccessTrap. If an exception should be routed through 5027 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should 5028 * take care of raising that exception. 5029 * C.f. the ARM pseudocode function CheckSVEEnabled. 5030 */ 5031 int sve_exception_el(CPUARMState *env, int el) 5032 { 5033 #ifndef CONFIG_USER_ONLY 5034 if (el <= 1) { 5035 bool disabled = false; 5036 5037 /* The CPACR.ZEN controls traps to EL1: 5038 * 0, 2 : trap EL0 and EL1 accesses 5039 * 1 : trap only EL0 accesses 5040 * 3 : trap no accesses 5041 */ 5042 if (!extract32(env->cp15.cpacr_el1, 16, 1)) { 5043 disabled = true; 5044 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) { 5045 disabled = el == 0; 5046 } 5047 if (disabled) { 5048 /* route_to_el2 */ 5049 return (arm_feature(env, ARM_FEATURE_EL2) 5050 && (arm_hcr_el2_eff(env) & HCR_TGE) ? 2 : 1); 5051 } 5052 5053 /* Check CPACR.FPEN. */ 5054 if (!extract32(env->cp15.cpacr_el1, 20, 1)) { 5055 disabled = true; 5056 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) { 5057 disabled = el == 0; 5058 } 5059 if (disabled) { 5060 return 0; 5061 } 5062 } 5063 5064 /* CPTR_EL2. Since TZ and TFP are positive, 5065 * they will be zero when EL2 is not present. 5066 */ 5067 if (el <= 2 && !arm_is_secure_below_el3(env)) { 5068 if (env->cp15.cptr_el[2] & CPTR_TZ) { 5069 return 2; 5070 } 5071 if (env->cp15.cptr_el[2] & CPTR_TFP) { 5072 return 0; 5073 } 5074 } 5075 5076 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 5077 if (arm_feature(env, ARM_FEATURE_EL3) 5078 && !(env->cp15.cptr_el[3] & CPTR_EZ)) { 5079 return 3; 5080 } 5081 #endif 5082 return 0; 5083 } 5084 5085 /* 5086 * Given that SVE is enabled, return the vector length for EL. 5087 */ 5088 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) 5089 { 5090 ARMCPU *cpu = arm_env_get_cpu(env); 5091 uint32_t zcr_len = cpu->sve_max_vq - 1; 5092 5093 if (el <= 1) { 5094 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]); 5095 } 5096 if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) { 5097 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]); 5098 } 5099 if (el < 3 && arm_feature(env, ARM_FEATURE_EL3)) { 5100 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); 5101 } 5102 return zcr_len; 5103 } 5104 5105 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5106 uint64_t value) 5107 { 5108 int cur_el = arm_current_el(env); 5109 int old_len = sve_zcr_len_for_el(env, cur_el); 5110 int new_len; 5111 5112 /* Bits other than [3:0] are RAZ/WI. */ 5113 raw_write(env, ri, value & 0xf); 5114 5115 /* 5116 * Because we arrived here, we know both FP and SVE are enabled; 5117 * otherwise we would have trapped access to the ZCR_ELn register. 5118 */ 5119 new_len = sve_zcr_len_for_el(env, cur_el); 5120 if (new_len < old_len) { 5121 aarch64_sve_narrow_vq(env, new_len + 1); 5122 } 5123 } 5124 5125 static const ARMCPRegInfo zcr_el1_reginfo = { 5126 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 5127 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 5128 .access = PL1_RW, .type = ARM_CP_SVE, 5129 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 5130 .writefn = zcr_write, .raw_writefn = raw_write 5131 }; 5132 5133 static const ARMCPRegInfo zcr_el2_reginfo = { 5134 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5135 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5136 .access = PL2_RW, .type = ARM_CP_SVE, 5137 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 5138 .writefn = zcr_write, .raw_writefn = raw_write 5139 }; 5140 5141 static const ARMCPRegInfo zcr_no_el2_reginfo = { 5142 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5143 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5144 .access = PL2_RW, .type = ARM_CP_SVE, 5145 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore 5146 }; 5147 5148 static const ARMCPRegInfo zcr_el3_reginfo = { 5149 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 5150 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 5151 .access = PL3_RW, .type = ARM_CP_SVE, 5152 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 5153 .writefn = zcr_write, .raw_writefn = raw_write 5154 }; 5155 5156 void hw_watchpoint_update(ARMCPU *cpu, int n) 5157 { 5158 CPUARMState *env = &cpu->env; 5159 vaddr len = 0; 5160 vaddr wvr = env->cp15.dbgwvr[n]; 5161 uint64_t wcr = env->cp15.dbgwcr[n]; 5162 int mask; 5163 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 5164 5165 if (env->cpu_watchpoint[n]) { 5166 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); 5167 env->cpu_watchpoint[n] = NULL; 5168 } 5169 5170 if (!extract64(wcr, 0, 1)) { 5171 /* E bit clear : watchpoint disabled */ 5172 return; 5173 } 5174 5175 switch (extract64(wcr, 3, 2)) { 5176 case 0: 5177 /* LSC 00 is reserved and must behave as if the wp is disabled */ 5178 return; 5179 case 1: 5180 flags |= BP_MEM_READ; 5181 break; 5182 case 2: 5183 flags |= BP_MEM_WRITE; 5184 break; 5185 case 3: 5186 flags |= BP_MEM_ACCESS; 5187 break; 5188 } 5189 5190 /* Attempts to use both MASK and BAS fields simultaneously are 5191 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, 5192 * thus generating a watchpoint for every byte in the masked region. 5193 */ 5194 mask = extract64(wcr, 24, 4); 5195 if (mask == 1 || mask == 2) { 5196 /* Reserved values of MASK; we must act as if the mask value was 5197 * some non-reserved value, or as if the watchpoint were disabled. 5198 * We choose the latter. 5199 */ 5200 return; 5201 } else if (mask) { 5202 /* Watchpoint covers an aligned area up to 2GB in size */ 5203 len = 1ULL << mask; 5204 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE 5205 * whether the watchpoint fires when the unmasked bits match; we opt 5206 * to generate the exceptions. 5207 */ 5208 wvr &= ~(len - 1); 5209 } else { 5210 /* Watchpoint covers bytes defined by the byte address select bits */ 5211 int bas = extract64(wcr, 5, 8); 5212 int basstart; 5213 5214 if (bas == 0) { 5215 /* This must act as if the watchpoint is disabled */ 5216 return; 5217 } 5218 5219 if (extract64(wvr, 2, 1)) { 5220 /* Deprecated case of an only 4-aligned address. BAS[7:4] are 5221 * ignored, and BAS[3:0] define which bytes to watch. 5222 */ 5223 bas &= 0xf; 5224 } 5225 /* The BAS bits are supposed to be programmed to indicate a contiguous 5226 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether 5227 * we fire for each byte in the word/doubleword addressed by the WVR. 5228 * We choose to ignore any non-zero bits after the first range of 1s. 5229 */ 5230 basstart = ctz32(bas); 5231 len = cto32(bas >> basstart); 5232 wvr += basstart; 5233 } 5234 5235 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, 5236 &env->cpu_watchpoint[n]); 5237 } 5238 5239 void hw_watchpoint_update_all(ARMCPU *cpu) 5240 { 5241 int i; 5242 CPUARMState *env = &cpu->env; 5243 5244 /* Completely clear out existing QEMU watchpoints and our array, to 5245 * avoid possible stale entries following migration load. 5246 */ 5247 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); 5248 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); 5249 5250 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { 5251 hw_watchpoint_update(cpu, i); 5252 } 5253 } 5254 5255 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5256 uint64_t value) 5257 { 5258 ARMCPU *cpu = arm_env_get_cpu(env); 5259 int i = ri->crm; 5260 5261 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the 5262 * register reads and behaves as if values written are sign extended. 5263 * Bits [1:0] are RES0. 5264 */ 5265 value = sextract64(value, 0, 49) & ~3ULL; 5266 5267 raw_write(env, ri, value); 5268 hw_watchpoint_update(cpu, i); 5269 } 5270 5271 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5272 uint64_t value) 5273 { 5274 ARMCPU *cpu = arm_env_get_cpu(env); 5275 int i = ri->crm; 5276 5277 raw_write(env, ri, value); 5278 hw_watchpoint_update(cpu, i); 5279 } 5280 5281 void hw_breakpoint_update(ARMCPU *cpu, int n) 5282 { 5283 CPUARMState *env = &cpu->env; 5284 uint64_t bvr = env->cp15.dbgbvr[n]; 5285 uint64_t bcr = env->cp15.dbgbcr[n]; 5286 vaddr addr; 5287 int bt; 5288 int flags = BP_CPU; 5289 5290 if (env->cpu_breakpoint[n]) { 5291 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); 5292 env->cpu_breakpoint[n] = NULL; 5293 } 5294 5295 if (!extract64(bcr, 0, 1)) { 5296 /* E bit clear : watchpoint disabled */ 5297 return; 5298 } 5299 5300 bt = extract64(bcr, 20, 4); 5301 5302 switch (bt) { 5303 case 4: /* unlinked address mismatch (reserved if AArch64) */ 5304 case 5: /* linked address mismatch (reserved if AArch64) */ 5305 qemu_log_mask(LOG_UNIMP, 5306 "arm: address mismatch breakpoint types not implemented\n"); 5307 return; 5308 case 0: /* unlinked address match */ 5309 case 1: /* linked address match */ 5310 { 5311 /* Bits [63:49] are hardwired to the value of bit [48]; that is, 5312 * we behave as if the register was sign extended. Bits [1:0] are 5313 * RES0. The BAS field is used to allow setting breakpoints on 16 5314 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether 5315 * a bp will fire if the addresses covered by the bp and the addresses 5316 * covered by the insn overlap but the insn doesn't start at the 5317 * start of the bp address range. We choose to require the insn and 5318 * the bp to have the same address. The constraints on writing to 5319 * BAS enforced in dbgbcr_write mean we have only four cases: 5320 * 0b0000 => no breakpoint 5321 * 0b0011 => breakpoint on addr 5322 * 0b1100 => breakpoint on addr + 2 5323 * 0b1111 => breakpoint on addr 5324 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). 5325 */ 5326 int bas = extract64(bcr, 5, 4); 5327 addr = sextract64(bvr, 0, 49) & ~3ULL; 5328 if (bas == 0) { 5329 return; 5330 } 5331 if (bas == 0xc) { 5332 addr += 2; 5333 } 5334 break; 5335 } 5336 case 2: /* unlinked context ID match */ 5337 case 8: /* unlinked VMID match (reserved if no EL2) */ 5338 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ 5339 qemu_log_mask(LOG_UNIMP, 5340 "arm: unlinked context breakpoint types not implemented\n"); 5341 return; 5342 case 9: /* linked VMID match (reserved if no EL2) */ 5343 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 5344 case 3: /* linked context ID match */ 5345 default: 5346 /* We must generate no events for Linked context matches (unless 5347 * they are linked to by some other bp/wp, which is handled in 5348 * updates for the linking bp/wp). We choose to also generate no events 5349 * for reserved values. 5350 */ 5351 return; 5352 } 5353 5354 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); 5355 } 5356 5357 void hw_breakpoint_update_all(ARMCPU *cpu) 5358 { 5359 int i; 5360 CPUARMState *env = &cpu->env; 5361 5362 /* Completely clear out existing QEMU breakpoints and our array, to 5363 * avoid possible stale entries following migration load. 5364 */ 5365 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); 5366 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); 5367 5368 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { 5369 hw_breakpoint_update(cpu, i); 5370 } 5371 } 5372 5373 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5374 uint64_t value) 5375 { 5376 ARMCPU *cpu = arm_env_get_cpu(env); 5377 int i = ri->crm; 5378 5379 raw_write(env, ri, value); 5380 hw_breakpoint_update(cpu, i); 5381 } 5382 5383 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5384 uint64_t value) 5385 { 5386 ARMCPU *cpu = arm_env_get_cpu(env); 5387 int i = ri->crm; 5388 5389 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only 5390 * copy of BAS[0]. 5391 */ 5392 value = deposit64(value, 6, 1, extract64(value, 5, 1)); 5393 value = deposit64(value, 8, 1, extract64(value, 7, 1)); 5394 5395 raw_write(env, ri, value); 5396 hw_breakpoint_update(cpu, i); 5397 } 5398 5399 static void define_debug_regs(ARMCPU *cpu) 5400 { 5401 /* Define v7 and v8 architectural debug registers. 5402 * These are just dummy implementations for now. 5403 */ 5404 int i; 5405 int wrps, brps, ctx_cmps; 5406 ARMCPRegInfo dbgdidr = { 5407 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 5408 .access = PL0_R, .accessfn = access_tda, 5409 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, 5410 }; 5411 5412 /* Note that all these register fields hold "number of Xs minus 1". */ 5413 brps = extract32(cpu->dbgdidr, 24, 4); 5414 wrps = extract32(cpu->dbgdidr, 28, 4); 5415 ctx_cmps = extract32(cpu->dbgdidr, 20, 4); 5416 5417 assert(ctx_cmps <= brps); 5418 5419 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties 5420 * of the debug registers such as number of breakpoints; 5421 * check that if they both exist then they agree. 5422 */ 5423 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 5424 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps); 5425 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps); 5426 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps); 5427 } 5428 5429 define_one_arm_cp_reg(cpu, &dbgdidr); 5430 define_arm_cp_regs(cpu, debug_cp_reginfo); 5431 5432 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { 5433 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); 5434 } 5435 5436 for (i = 0; i < brps + 1; i++) { 5437 ARMCPRegInfo dbgregs[] = { 5438 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH, 5439 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, 5440 .access = PL1_RW, .accessfn = access_tda, 5441 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), 5442 .writefn = dbgbvr_write, .raw_writefn = raw_write 5443 }, 5444 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH, 5445 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, 5446 .access = PL1_RW, .accessfn = access_tda, 5447 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), 5448 .writefn = dbgbcr_write, .raw_writefn = raw_write 5449 }, 5450 REGINFO_SENTINEL 5451 }; 5452 define_arm_cp_regs(cpu, dbgregs); 5453 } 5454 5455 for (i = 0; i < wrps + 1; i++) { 5456 ARMCPRegInfo dbgregs[] = { 5457 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH, 5458 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, 5459 .access = PL1_RW, .accessfn = access_tda, 5460 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), 5461 .writefn = dbgwvr_write, .raw_writefn = raw_write 5462 }, 5463 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH, 5464 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, 5465 .access = PL1_RW, .accessfn = access_tda, 5466 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), 5467 .writefn = dbgwcr_write, .raw_writefn = raw_write 5468 }, 5469 REGINFO_SENTINEL 5470 }; 5471 define_arm_cp_regs(cpu, dbgregs); 5472 } 5473 } 5474 5475 /* We don't know until after realize whether there's a GICv3 5476 * attached, and that is what registers the gicv3 sysregs. 5477 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 5478 * at runtime. 5479 */ 5480 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 5481 { 5482 ARMCPU *cpu = arm_env_get_cpu(env); 5483 uint64_t pfr1 = cpu->id_pfr1; 5484 5485 if (env->gicv3state) { 5486 pfr1 |= 1 << 28; 5487 } 5488 return pfr1; 5489 } 5490 5491 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 5492 { 5493 ARMCPU *cpu = arm_env_get_cpu(env); 5494 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 5495 5496 if (env->gicv3state) { 5497 pfr0 |= 1 << 24; 5498 } 5499 return pfr0; 5500 } 5501 5502 /* Shared logic between LORID and the rest of the LOR* registers. 5503 * Secure state has already been delt with. 5504 */ 5505 static CPAccessResult access_lor_ns(CPUARMState *env) 5506 { 5507 int el = arm_current_el(env); 5508 5509 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 5510 return CP_ACCESS_TRAP_EL2; 5511 } 5512 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 5513 return CP_ACCESS_TRAP_EL3; 5514 } 5515 return CP_ACCESS_OK; 5516 } 5517 5518 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri, 5519 bool isread) 5520 { 5521 if (arm_is_secure_below_el3(env)) { 5522 /* Access ok in secure mode. */ 5523 return CP_ACCESS_OK; 5524 } 5525 return access_lor_ns(env); 5526 } 5527 5528 static CPAccessResult access_lor_other(CPUARMState *env, 5529 const ARMCPRegInfo *ri, bool isread) 5530 { 5531 if (arm_is_secure_below_el3(env)) { 5532 /* Access denied in secure mode. */ 5533 return CP_ACCESS_TRAP; 5534 } 5535 return access_lor_ns(env); 5536 } 5537 5538 #ifdef TARGET_AARCH64 5539 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 5540 bool isread) 5541 { 5542 int el = arm_current_el(env); 5543 5544 if (el < 2 && 5545 arm_feature(env, ARM_FEATURE_EL2) && 5546 !(arm_hcr_el2_eff(env) & HCR_APK)) { 5547 return CP_ACCESS_TRAP_EL2; 5548 } 5549 if (el < 3 && 5550 arm_feature(env, ARM_FEATURE_EL3) && 5551 !(env->cp15.scr_el3 & SCR_APK)) { 5552 return CP_ACCESS_TRAP_EL3; 5553 } 5554 return CP_ACCESS_OK; 5555 } 5556 5557 static const ARMCPRegInfo pauth_reginfo[] = { 5558 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5559 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 5560 .access = PL1_RW, .accessfn = access_pauth, 5561 .fieldoffset = offsetof(CPUARMState, apda_key.lo) }, 5562 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5563 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 5564 .access = PL1_RW, .accessfn = access_pauth, 5565 .fieldoffset = offsetof(CPUARMState, apda_key.hi) }, 5566 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5567 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 5568 .access = PL1_RW, .accessfn = access_pauth, 5569 .fieldoffset = offsetof(CPUARMState, apdb_key.lo) }, 5570 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5571 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 5572 .access = PL1_RW, .accessfn = access_pauth, 5573 .fieldoffset = offsetof(CPUARMState, apdb_key.hi) }, 5574 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5575 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 5576 .access = PL1_RW, .accessfn = access_pauth, 5577 .fieldoffset = offsetof(CPUARMState, apga_key.lo) }, 5578 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5579 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 5580 .access = PL1_RW, .accessfn = access_pauth, 5581 .fieldoffset = offsetof(CPUARMState, apga_key.hi) }, 5582 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5583 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 5584 .access = PL1_RW, .accessfn = access_pauth, 5585 .fieldoffset = offsetof(CPUARMState, apia_key.lo) }, 5586 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5587 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 5588 .access = PL1_RW, .accessfn = access_pauth, 5589 .fieldoffset = offsetof(CPUARMState, apia_key.hi) }, 5590 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5591 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 5592 .access = PL1_RW, .accessfn = access_pauth, 5593 .fieldoffset = offsetof(CPUARMState, apib_key.lo) }, 5594 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5595 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 5596 .access = PL1_RW, .accessfn = access_pauth, 5597 .fieldoffset = offsetof(CPUARMState, apib_key.hi) }, 5598 REGINFO_SENTINEL 5599 }; 5600 #endif 5601 5602 void register_cp_regs_for_features(ARMCPU *cpu) 5603 { 5604 /* Register all the coprocessor registers based on feature bits */ 5605 CPUARMState *env = &cpu->env; 5606 if (arm_feature(env, ARM_FEATURE_M)) { 5607 /* M profile has no coprocessor registers */ 5608 return; 5609 } 5610 5611 define_arm_cp_regs(cpu, cp_reginfo); 5612 if (!arm_feature(env, ARM_FEATURE_V8)) { 5613 /* Must go early as it is full of wildcards that may be 5614 * overridden by later definitions. 5615 */ 5616 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 5617 } 5618 5619 if (arm_feature(env, ARM_FEATURE_V6)) { 5620 /* The ID registers all have impdef reset values */ 5621 ARMCPRegInfo v6_idregs[] = { 5622 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 5623 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5624 .access = PL1_R, .type = ARM_CP_CONST, 5625 .resetvalue = cpu->id_pfr0 }, 5626 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know 5627 * the value of the GIC field until after we define these regs. 5628 */ 5629 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 5630 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 5631 .access = PL1_R, .type = ARM_CP_NO_RAW, 5632 .readfn = id_pfr1_read, 5633 .writefn = arm_cp_write_ignore }, 5634 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 5635 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 5636 .access = PL1_R, .type = ARM_CP_CONST, 5637 .resetvalue = cpu->id_dfr0 }, 5638 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 5639 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 5640 .access = PL1_R, .type = ARM_CP_CONST, 5641 .resetvalue = cpu->id_afr0 }, 5642 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 5643 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 5644 .access = PL1_R, .type = ARM_CP_CONST, 5645 .resetvalue = cpu->id_mmfr0 }, 5646 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 5647 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 5648 .access = PL1_R, .type = ARM_CP_CONST, 5649 .resetvalue = cpu->id_mmfr1 }, 5650 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 5651 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 5652 .access = PL1_R, .type = ARM_CP_CONST, 5653 .resetvalue = cpu->id_mmfr2 }, 5654 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 5655 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 5656 .access = PL1_R, .type = ARM_CP_CONST, 5657 .resetvalue = cpu->id_mmfr3 }, 5658 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 5659 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5660 .access = PL1_R, .type = ARM_CP_CONST, 5661 .resetvalue = cpu->isar.id_isar0 }, 5662 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 5663 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 5664 .access = PL1_R, .type = ARM_CP_CONST, 5665 .resetvalue = cpu->isar.id_isar1 }, 5666 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 5667 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5668 .access = PL1_R, .type = ARM_CP_CONST, 5669 .resetvalue = cpu->isar.id_isar2 }, 5670 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 5671 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 5672 .access = PL1_R, .type = ARM_CP_CONST, 5673 .resetvalue = cpu->isar.id_isar3 }, 5674 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 5675 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 5676 .access = PL1_R, .type = ARM_CP_CONST, 5677 .resetvalue = cpu->isar.id_isar4 }, 5678 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 5679 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 5680 .access = PL1_R, .type = ARM_CP_CONST, 5681 .resetvalue = cpu->isar.id_isar5 }, 5682 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 5683 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 5684 .access = PL1_R, .type = ARM_CP_CONST, 5685 .resetvalue = cpu->id_mmfr4 }, 5686 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 5687 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 5688 .access = PL1_R, .type = ARM_CP_CONST, 5689 .resetvalue = cpu->isar.id_isar6 }, 5690 REGINFO_SENTINEL 5691 }; 5692 define_arm_cp_regs(cpu, v6_idregs); 5693 define_arm_cp_regs(cpu, v6_cp_reginfo); 5694 } else { 5695 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 5696 } 5697 if (arm_feature(env, ARM_FEATURE_V6K)) { 5698 define_arm_cp_regs(cpu, v6k_cp_reginfo); 5699 } 5700 if (arm_feature(env, ARM_FEATURE_V7MP) && 5701 !arm_feature(env, ARM_FEATURE_PMSA)) { 5702 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 5703 } 5704 if (arm_feature(env, ARM_FEATURE_V7VE)) { 5705 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 5706 } 5707 if (arm_feature(env, ARM_FEATURE_V7)) { 5708 /* v7 performance monitor control register: same implementor 5709 * field as main ID register, and we implement four counters in 5710 * addition to the cycle count register. 5711 */ 5712 unsigned int i, pmcrn = 4; 5713 ARMCPRegInfo pmcr = { 5714 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 5715 .access = PL0_RW, 5716 .type = ARM_CP_IO | ARM_CP_ALIAS, 5717 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 5718 .accessfn = pmreg_access, .writefn = pmcr_write, 5719 .raw_writefn = raw_write, 5720 }; 5721 ARMCPRegInfo pmcr64 = { 5722 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 5723 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 5724 .access = PL0_RW, .accessfn = pmreg_access, 5725 .type = ARM_CP_IO, 5726 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 5727 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT), 5728 .writefn = pmcr_write, .raw_writefn = raw_write, 5729 }; 5730 define_one_arm_cp_reg(cpu, &pmcr); 5731 define_one_arm_cp_reg(cpu, &pmcr64); 5732 for (i = 0; i < pmcrn; i++) { 5733 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 5734 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 5735 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 5736 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 5737 ARMCPRegInfo pmev_regs[] = { 5738 { .name = pmevcntr_name, .cp = 15, .crn = 15, 5739 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 5740 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 5741 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 5742 .accessfn = pmreg_access }, 5743 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 5744 .opc0 = 3, .opc1 = 3, .crn = 15, .crm = 8 | (3 & (i >> 3)), 5745 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 5746 .type = ARM_CP_IO, 5747 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 5748 .raw_readfn = pmevcntr_rawread, 5749 .raw_writefn = pmevcntr_rawwrite }, 5750 { .name = pmevtyper_name, .cp = 15, .crn = 15, 5751 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 5752 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 5753 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 5754 .accessfn = pmreg_access }, 5755 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 5756 .opc0 = 3, .opc1 = 3, .crn = 15, .crm = 12 | (3 & (i >> 3)), 5757 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 5758 .type = ARM_CP_IO, 5759 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 5760 .raw_writefn = pmevtyper_rawwrite }, 5761 REGINFO_SENTINEL 5762 }; 5763 define_arm_cp_regs(cpu, pmev_regs); 5764 g_free(pmevcntr_name); 5765 g_free(pmevcntr_el0_name); 5766 g_free(pmevtyper_name); 5767 g_free(pmevtyper_el0_name); 5768 } 5769 ARMCPRegInfo clidr = { 5770 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 5771 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 5772 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr 5773 }; 5774 define_one_arm_cp_reg(cpu, &clidr); 5775 define_arm_cp_regs(cpu, v7_cp_reginfo); 5776 define_debug_regs(cpu); 5777 } else { 5778 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 5779 } 5780 if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 && 5781 FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) { 5782 ARMCPRegInfo v81_pmu_regs[] = { 5783 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 5784 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 5785 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5786 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 5787 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 5788 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 5789 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5790 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 5791 REGINFO_SENTINEL 5792 }; 5793 define_arm_cp_regs(cpu, v81_pmu_regs); 5794 } 5795 if (arm_feature(env, ARM_FEATURE_V8)) { 5796 /* AArch64 ID registers, which all have impdef reset values. 5797 * Note that within the ID register ranges the unused slots 5798 * must all RAZ, not UNDEF; future architecture versions may 5799 * define new registers here. 5800 */ 5801 ARMCPRegInfo v8_idregs[] = { 5802 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't 5803 * know the right value for the GIC field until after we 5804 * define these regs. 5805 */ 5806 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 5807 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 5808 .access = PL1_R, .type = ARM_CP_NO_RAW, 5809 .readfn = id_aa64pfr0_read, 5810 .writefn = arm_cp_write_ignore }, 5811 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 5812 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 5813 .access = PL1_R, .type = ARM_CP_CONST, 5814 .resetvalue = cpu->isar.id_aa64pfr1}, 5815 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5816 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 5817 .access = PL1_R, .type = ARM_CP_CONST, 5818 .resetvalue = 0 }, 5819 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5820 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 5821 .access = PL1_R, .type = ARM_CP_CONST, 5822 .resetvalue = 0 }, 5823 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 5824 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 5825 .access = PL1_R, .type = ARM_CP_CONST, 5826 /* At present, only SVEver == 0 is defined anyway. */ 5827 .resetvalue = 0 }, 5828 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5829 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 5830 .access = PL1_R, .type = ARM_CP_CONST, 5831 .resetvalue = 0 }, 5832 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5833 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 5834 .access = PL1_R, .type = ARM_CP_CONST, 5835 .resetvalue = 0 }, 5836 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5837 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 5838 .access = PL1_R, .type = ARM_CP_CONST, 5839 .resetvalue = 0 }, 5840 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 5841 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 5842 .access = PL1_R, .type = ARM_CP_CONST, 5843 .resetvalue = cpu->id_aa64dfr0 }, 5844 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 5845 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 5846 .access = PL1_R, .type = ARM_CP_CONST, 5847 .resetvalue = cpu->id_aa64dfr1 }, 5848 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5849 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 5850 .access = PL1_R, .type = ARM_CP_CONST, 5851 .resetvalue = 0 }, 5852 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5853 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 5854 .access = PL1_R, .type = ARM_CP_CONST, 5855 .resetvalue = 0 }, 5856 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 5857 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 5858 .access = PL1_R, .type = ARM_CP_CONST, 5859 .resetvalue = cpu->id_aa64afr0 }, 5860 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 5861 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 5862 .access = PL1_R, .type = ARM_CP_CONST, 5863 .resetvalue = cpu->id_aa64afr1 }, 5864 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5865 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 5866 .access = PL1_R, .type = ARM_CP_CONST, 5867 .resetvalue = 0 }, 5868 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5869 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 5870 .access = PL1_R, .type = ARM_CP_CONST, 5871 .resetvalue = 0 }, 5872 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 5873 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 5874 .access = PL1_R, .type = ARM_CP_CONST, 5875 .resetvalue = cpu->isar.id_aa64isar0 }, 5876 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 5877 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 5878 .access = PL1_R, .type = ARM_CP_CONST, 5879 .resetvalue = cpu->isar.id_aa64isar1 }, 5880 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5881 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 5882 .access = PL1_R, .type = ARM_CP_CONST, 5883 .resetvalue = 0 }, 5884 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5885 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 5886 .access = PL1_R, .type = ARM_CP_CONST, 5887 .resetvalue = 0 }, 5888 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5889 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 5890 .access = PL1_R, .type = ARM_CP_CONST, 5891 .resetvalue = 0 }, 5892 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5893 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 5894 .access = PL1_R, .type = ARM_CP_CONST, 5895 .resetvalue = 0 }, 5896 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5897 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 5898 .access = PL1_R, .type = ARM_CP_CONST, 5899 .resetvalue = 0 }, 5900 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5901 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 5902 .access = PL1_R, .type = ARM_CP_CONST, 5903 .resetvalue = 0 }, 5904 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 5905 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 5906 .access = PL1_R, .type = ARM_CP_CONST, 5907 .resetvalue = cpu->isar.id_aa64mmfr0 }, 5908 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 5909 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 5910 .access = PL1_R, .type = ARM_CP_CONST, 5911 .resetvalue = cpu->isar.id_aa64mmfr1 }, 5912 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5913 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 5914 .access = PL1_R, .type = ARM_CP_CONST, 5915 .resetvalue = 0 }, 5916 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5917 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 5918 .access = PL1_R, .type = ARM_CP_CONST, 5919 .resetvalue = 0 }, 5920 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5921 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 5922 .access = PL1_R, .type = ARM_CP_CONST, 5923 .resetvalue = 0 }, 5924 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5925 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 5926 .access = PL1_R, .type = ARM_CP_CONST, 5927 .resetvalue = 0 }, 5928 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5929 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 5930 .access = PL1_R, .type = ARM_CP_CONST, 5931 .resetvalue = 0 }, 5932 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5933 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 5934 .access = PL1_R, .type = ARM_CP_CONST, 5935 .resetvalue = 0 }, 5936 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 5937 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 5938 .access = PL1_R, .type = ARM_CP_CONST, 5939 .resetvalue = cpu->isar.mvfr0 }, 5940 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 5941 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 5942 .access = PL1_R, .type = ARM_CP_CONST, 5943 .resetvalue = cpu->isar.mvfr1 }, 5944 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 5945 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 5946 .access = PL1_R, .type = ARM_CP_CONST, 5947 .resetvalue = cpu->isar.mvfr2 }, 5948 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5949 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 5950 .access = PL1_R, .type = ARM_CP_CONST, 5951 .resetvalue = 0 }, 5952 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5953 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 5954 .access = PL1_R, .type = ARM_CP_CONST, 5955 .resetvalue = 0 }, 5956 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5957 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 5958 .access = PL1_R, .type = ARM_CP_CONST, 5959 .resetvalue = 0 }, 5960 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5961 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 5962 .access = PL1_R, .type = ARM_CP_CONST, 5963 .resetvalue = 0 }, 5964 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5965 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 5966 .access = PL1_R, .type = ARM_CP_CONST, 5967 .resetvalue = 0 }, 5968 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 5969 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 5970 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5971 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 5972 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 5973 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 5974 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5975 .resetvalue = cpu->pmceid0 }, 5976 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 5977 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 5978 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5979 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 5980 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 5981 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 5982 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5983 .resetvalue = cpu->pmceid1 }, 5984 REGINFO_SENTINEL 5985 }; 5986 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ 5987 if (!arm_feature(env, ARM_FEATURE_EL3) && 5988 !arm_feature(env, ARM_FEATURE_EL2)) { 5989 ARMCPRegInfo rvbar = { 5990 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64, 5991 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 5992 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar 5993 }; 5994 define_one_arm_cp_reg(cpu, &rvbar); 5995 } 5996 define_arm_cp_regs(cpu, v8_idregs); 5997 define_arm_cp_regs(cpu, v8_cp_reginfo); 5998 } 5999 if (arm_feature(env, ARM_FEATURE_EL2)) { 6000 uint64_t vmpidr_def = mpidr_read_val(env); 6001 ARMCPRegInfo vpidr_regs[] = { 6002 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 6003 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6004 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6005 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS, 6006 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 6007 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 6008 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6009 .access = PL2_RW, .resetvalue = cpu->midr, 6010 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6011 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 6012 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6013 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6014 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS, 6015 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 6016 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 6017 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6018 .access = PL2_RW, 6019 .resetvalue = vmpidr_def, 6020 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 6021 REGINFO_SENTINEL 6022 }; 6023 define_arm_cp_regs(cpu, vpidr_regs); 6024 define_arm_cp_regs(cpu, el2_cp_reginfo); 6025 if (arm_feature(env, ARM_FEATURE_V8)) { 6026 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 6027 } 6028 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */ 6029 if (!arm_feature(env, ARM_FEATURE_EL3)) { 6030 ARMCPRegInfo rvbar = { 6031 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 6032 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 6033 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar 6034 }; 6035 define_one_arm_cp_reg(cpu, &rvbar); 6036 } 6037 } else { 6038 /* If EL2 is missing but higher ELs are enabled, we need to 6039 * register the no_el2 reginfos. 6040 */ 6041 if (arm_feature(env, ARM_FEATURE_EL3)) { 6042 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value 6043 * of MIDR_EL1 and MPIDR_EL1. 6044 */ 6045 ARMCPRegInfo vpidr_regs[] = { 6046 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6047 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6048 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6049 .type = ARM_CP_CONST, .resetvalue = cpu->midr, 6050 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6051 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6052 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6053 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6054 .type = ARM_CP_NO_RAW, 6055 .writefn = arm_cp_write_ignore, .readfn = mpidr_read }, 6056 REGINFO_SENTINEL 6057 }; 6058 define_arm_cp_regs(cpu, vpidr_regs); 6059 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo); 6060 if (arm_feature(env, ARM_FEATURE_V8)) { 6061 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo); 6062 } 6063 } 6064 } 6065 if (arm_feature(env, ARM_FEATURE_EL3)) { 6066 define_arm_cp_regs(cpu, el3_cp_reginfo); 6067 ARMCPRegInfo el3_regs[] = { 6068 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 6069 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 6070 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar }, 6071 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 6072 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 6073 .access = PL3_RW, 6074 .raw_writefn = raw_write, .writefn = sctlr_write, 6075 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 6076 .resetvalue = cpu->reset_sctlr }, 6077 REGINFO_SENTINEL 6078 }; 6079 6080 define_arm_cp_regs(cpu, el3_regs); 6081 } 6082 /* The behaviour of NSACR is sufficiently various that we don't 6083 * try to describe it in a single reginfo: 6084 * if EL3 is 64 bit, then trap to EL3 from S EL1, 6085 * reads as constant 0xc00 from NS EL1 and NS EL2 6086 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 6087 * if v7 without EL3, register doesn't exist 6088 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 6089 */ 6090 if (arm_feature(env, ARM_FEATURE_EL3)) { 6091 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6092 ARMCPRegInfo nsacr = { 6093 .name = "NSACR", .type = ARM_CP_CONST, 6094 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6095 .access = PL1_RW, .accessfn = nsacr_access, 6096 .resetvalue = 0xc00 6097 }; 6098 define_one_arm_cp_reg(cpu, &nsacr); 6099 } else { 6100 ARMCPRegInfo nsacr = { 6101 .name = "NSACR", 6102 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6103 .access = PL3_RW | PL1_R, 6104 .resetvalue = 0, 6105 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 6106 }; 6107 define_one_arm_cp_reg(cpu, &nsacr); 6108 } 6109 } else { 6110 if (arm_feature(env, ARM_FEATURE_V8)) { 6111 ARMCPRegInfo nsacr = { 6112 .name = "NSACR", .type = ARM_CP_CONST, 6113 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6114 .access = PL1_R, 6115 .resetvalue = 0xc00 6116 }; 6117 define_one_arm_cp_reg(cpu, &nsacr); 6118 } 6119 } 6120 6121 if (arm_feature(env, ARM_FEATURE_PMSA)) { 6122 if (arm_feature(env, ARM_FEATURE_V6)) { 6123 /* PMSAv6 not implemented */ 6124 assert(arm_feature(env, ARM_FEATURE_V7)); 6125 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6126 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 6127 } else { 6128 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 6129 } 6130 } else { 6131 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6132 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 6133 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */ 6134 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) { 6135 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 6136 } 6137 } 6138 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 6139 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 6140 } 6141 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 6142 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 6143 } 6144 if (arm_feature(env, ARM_FEATURE_VAPA)) { 6145 define_arm_cp_regs(cpu, vapa_cp_reginfo); 6146 } 6147 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 6148 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 6149 } 6150 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 6151 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 6152 } 6153 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 6154 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 6155 } 6156 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 6157 define_arm_cp_regs(cpu, omap_cp_reginfo); 6158 } 6159 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 6160 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 6161 } 6162 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6163 define_arm_cp_regs(cpu, xscale_cp_reginfo); 6164 } 6165 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 6166 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 6167 } 6168 if (arm_feature(env, ARM_FEATURE_LPAE)) { 6169 define_arm_cp_regs(cpu, lpae_cp_reginfo); 6170 } 6171 /* Slightly awkwardly, the OMAP and StrongARM cores need all of 6172 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 6173 * be read-only (ie write causes UNDEF exception). 6174 */ 6175 { 6176 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 6177 /* Pre-v8 MIDR space. 6178 * Note that the MIDR isn't a simple constant register because 6179 * of the TI925 behaviour where writes to another register can 6180 * cause the MIDR value to change. 6181 * 6182 * Unimplemented registers in the c15 0 0 0 space default to 6183 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 6184 * and friends override accordingly. 6185 */ 6186 { .name = "MIDR", 6187 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 6188 .access = PL1_R, .resetvalue = cpu->midr, 6189 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 6190 .readfn = midr_read, 6191 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6192 .type = ARM_CP_OVERRIDE }, 6193 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 6194 { .name = "DUMMY", 6195 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 6196 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6197 { .name = "DUMMY", 6198 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 6199 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6200 { .name = "DUMMY", 6201 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 6202 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6203 { .name = "DUMMY", 6204 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 6205 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6206 { .name = "DUMMY", 6207 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 6208 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6209 REGINFO_SENTINEL 6210 }; 6211 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 6212 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 6213 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 6214 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 6215 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6216 .readfn = midr_read }, 6217 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */ 6218 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6219 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6220 .access = PL1_R, .resetvalue = cpu->midr }, 6221 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6222 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 6223 .access = PL1_R, .resetvalue = cpu->midr }, 6224 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 6225 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 6226 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 6227 REGINFO_SENTINEL 6228 }; 6229 ARMCPRegInfo id_cp_reginfo[] = { 6230 /* These are common to v8 and pre-v8 */ 6231 { .name = "CTR", 6232 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 6233 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6234 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 6235 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 6236 .access = PL0_R, .accessfn = ctr_el0_access, 6237 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6238 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 6239 { .name = "TCMTR", 6240 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 6241 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6242 REGINFO_SENTINEL 6243 }; 6244 /* TLBTR is specific to VMSA */ 6245 ARMCPRegInfo id_tlbtr_reginfo = { 6246 .name = "TLBTR", 6247 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 6248 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0, 6249 }; 6250 /* MPUIR is specific to PMSA V6+ */ 6251 ARMCPRegInfo id_mpuir_reginfo = { 6252 .name = "MPUIR", 6253 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6254 .access = PL1_R, .type = ARM_CP_CONST, 6255 .resetvalue = cpu->pmsav7_dregion << 8 6256 }; 6257 ARMCPRegInfo crn0_wi_reginfo = { 6258 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 6259 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 6260 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 6261 }; 6262 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 6263 arm_feature(env, ARM_FEATURE_STRONGARM)) { 6264 ARMCPRegInfo *r; 6265 /* Register the blanket "writes ignored" value first to cover the 6266 * whole space. Then update the specific ID registers to allow write 6267 * access, so that they ignore writes rather than causing them to 6268 * UNDEF. 6269 */ 6270 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 6271 for (r = id_pre_v8_midr_cp_reginfo; 6272 r->type != ARM_CP_SENTINEL; r++) { 6273 r->access = PL1_RW; 6274 } 6275 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) { 6276 r->access = PL1_RW; 6277 } 6278 id_mpuir_reginfo.access = PL1_RW; 6279 id_tlbtr_reginfo.access = PL1_RW; 6280 } 6281 if (arm_feature(env, ARM_FEATURE_V8)) { 6282 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 6283 } else { 6284 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 6285 } 6286 define_arm_cp_regs(cpu, id_cp_reginfo); 6287 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 6288 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 6289 } else if (arm_feature(env, ARM_FEATURE_V7)) { 6290 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 6291 } 6292 } 6293 6294 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 6295 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 6296 } 6297 6298 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 6299 ARMCPRegInfo auxcr_reginfo[] = { 6300 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 6301 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 6302 .access = PL1_RW, .type = ARM_CP_CONST, 6303 .resetvalue = cpu->reset_auxcr }, 6304 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 6305 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 6306 .access = PL2_RW, .type = ARM_CP_CONST, 6307 .resetvalue = 0 }, 6308 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 6309 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 6310 .access = PL3_RW, .type = ARM_CP_CONST, 6311 .resetvalue = 0 }, 6312 REGINFO_SENTINEL 6313 }; 6314 define_arm_cp_regs(cpu, auxcr_reginfo); 6315 if (arm_feature(env, ARM_FEATURE_V8)) { 6316 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */ 6317 ARMCPRegInfo hactlr2_reginfo = { 6318 .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 6319 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 6320 .access = PL2_RW, .type = ARM_CP_CONST, 6321 .resetvalue = 0 6322 }; 6323 define_one_arm_cp_reg(cpu, &hactlr2_reginfo); 6324 } 6325 } 6326 6327 if (arm_feature(env, ARM_FEATURE_CBAR)) { 6328 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6329 /* 32 bit view is [31:18] 0...0 [43:32]. */ 6330 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 6331 | extract64(cpu->reset_cbar, 32, 12); 6332 ARMCPRegInfo cbar_reginfo[] = { 6333 { .name = "CBAR", 6334 .type = ARM_CP_CONST, 6335 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6336 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 6337 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 6338 .type = ARM_CP_CONST, 6339 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 6340 .access = PL1_R, .resetvalue = cbar32 }, 6341 REGINFO_SENTINEL 6342 }; 6343 /* We don't implement a r/w 64 bit CBAR currently */ 6344 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 6345 define_arm_cp_regs(cpu, cbar_reginfo); 6346 } else { 6347 ARMCPRegInfo cbar = { 6348 .name = "CBAR", 6349 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6350 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar, 6351 .fieldoffset = offsetof(CPUARMState, 6352 cp15.c15_config_base_address) 6353 }; 6354 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 6355 cbar.access = PL1_R; 6356 cbar.fieldoffset = 0; 6357 cbar.type = ARM_CP_CONST; 6358 } 6359 define_one_arm_cp_reg(cpu, &cbar); 6360 } 6361 } 6362 6363 if (arm_feature(env, ARM_FEATURE_VBAR)) { 6364 ARMCPRegInfo vbar_cp_reginfo[] = { 6365 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 6366 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 6367 .access = PL1_RW, .writefn = vbar_write, 6368 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 6369 offsetof(CPUARMState, cp15.vbar_ns) }, 6370 .resetvalue = 0 }, 6371 REGINFO_SENTINEL 6372 }; 6373 define_arm_cp_regs(cpu, vbar_cp_reginfo); 6374 } 6375 6376 /* Generic registers whose values depend on the implementation */ 6377 { 6378 ARMCPRegInfo sctlr = { 6379 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 6380 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 6381 .access = PL1_RW, 6382 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 6383 offsetof(CPUARMState, cp15.sctlr_ns) }, 6384 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 6385 .raw_writefn = raw_write, 6386 }; 6387 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6388 /* Normally we would always end the TB on an SCTLR write, but Linux 6389 * arch/arm/mach-pxa/sleep.S expects two instructions following 6390 * an MMU enable to execute from cache. Imitate this behaviour. 6391 */ 6392 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 6393 } 6394 define_one_arm_cp_reg(cpu, &sctlr); 6395 } 6396 6397 if (cpu_isar_feature(aa64_lor, cpu)) { 6398 /* 6399 * A trivial implementation of ARMv8.1-LOR leaves all of these 6400 * registers fixed at 0, which indicates that there are zero 6401 * supported Limited Ordering regions. 6402 */ 6403 static const ARMCPRegInfo lor_reginfo[] = { 6404 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 6405 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 6406 .access = PL1_RW, .accessfn = access_lor_other, 6407 .type = ARM_CP_CONST, .resetvalue = 0 }, 6408 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 6409 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 6410 .access = PL1_RW, .accessfn = access_lor_other, 6411 .type = ARM_CP_CONST, .resetvalue = 0 }, 6412 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 6413 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 6414 .access = PL1_RW, .accessfn = access_lor_other, 6415 .type = ARM_CP_CONST, .resetvalue = 0 }, 6416 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 6417 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 6418 .access = PL1_RW, .accessfn = access_lor_other, 6419 .type = ARM_CP_CONST, .resetvalue = 0 }, 6420 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 6421 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 6422 .access = PL1_R, .accessfn = access_lorid, 6423 .type = ARM_CP_CONST, .resetvalue = 0 }, 6424 REGINFO_SENTINEL 6425 }; 6426 define_arm_cp_regs(cpu, lor_reginfo); 6427 } 6428 6429 if (cpu_isar_feature(aa64_sve, cpu)) { 6430 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo); 6431 if (arm_feature(env, ARM_FEATURE_EL2)) { 6432 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo); 6433 } else { 6434 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo); 6435 } 6436 if (arm_feature(env, ARM_FEATURE_EL3)) { 6437 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo); 6438 } 6439 } 6440 6441 #ifdef TARGET_AARCH64 6442 if (cpu_isar_feature(aa64_pauth, cpu)) { 6443 define_arm_cp_regs(cpu, pauth_reginfo); 6444 } 6445 #endif 6446 } 6447 6448 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) 6449 { 6450 CPUState *cs = CPU(cpu); 6451 CPUARMState *env = &cpu->env; 6452 6453 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6454 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg, 6455 aarch64_fpu_gdb_set_reg, 6456 34, "aarch64-fpu.xml", 0); 6457 } else if (arm_feature(env, ARM_FEATURE_NEON)) { 6458 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6459 51, "arm-neon.xml", 0); 6460 } else if (arm_feature(env, ARM_FEATURE_VFP3)) { 6461 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6462 35, "arm-vfp3.xml", 0); 6463 } else if (arm_feature(env, ARM_FEATURE_VFP)) { 6464 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6465 19, "arm-vfp.xml", 0); 6466 } 6467 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg, 6468 arm_gen_dynamic_xml(cs), 6469 "system-registers.xml", 0); 6470 } 6471 6472 /* Sort alphabetically by type name, except for "any". */ 6473 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b) 6474 { 6475 ObjectClass *class_a = (ObjectClass *)a; 6476 ObjectClass *class_b = (ObjectClass *)b; 6477 const char *name_a, *name_b; 6478 6479 name_a = object_class_get_name(class_a); 6480 name_b = object_class_get_name(class_b); 6481 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) { 6482 return 1; 6483 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) { 6484 return -1; 6485 } else { 6486 return strcmp(name_a, name_b); 6487 } 6488 } 6489 6490 static void arm_cpu_list_entry(gpointer data, gpointer user_data) 6491 { 6492 ObjectClass *oc = data; 6493 CPUListState *s = user_data; 6494 const char *typename; 6495 char *name; 6496 6497 typename = object_class_get_name(oc); 6498 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6499 (*s->cpu_fprintf)(s->file, " %s\n", 6500 name); 6501 g_free(name); 6502 } 6503 6504 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf) 6505 { 6506 CPUListState s = { 6507 .file = f, 6508 .cpu_fprintf = cpu_fprintf, 6509 }; 6510 GSList *list; 6511 6512 list = object_class_get_list(TYPE_ARM_CPU, false); 6513 list = g_slist_sort(list, arm_cpu_list_compare); 6514 (*cpu_fprintf)(f, "Available CPUs:\n"); 6515 g_slist_foreach(list, arm_cpu_list_entry, &s); 6516 g_slist_free(list); 6517 } 6518 6519 static void arm_cpu_add_definition(gpointer data, gpointer user_data) 6520 { 6521 ObjectClass *oc = data; 6522 CpuDefinitionInfoList **cpu_list = user_data; 6523 CpuDefinitionInfoList *entry; 6524 CpuDefinitionInfo *info; 6525 const char *typename; 6526 6527 typename = object_class_get_name(oc); 6528 info = g_malloc0(sizeof(*info)); 6529 info->name = g_strndup(typename, 6530 strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6531 info->q_typename = g_strdup(typename); 6532 6533 entry = g_malloc0(sizeof(*entry)); 6534 entry->value = info; 6535 entry->next = *cpu_list; 6536 *cpu_list = entry; 6537 } 6538 6539 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp) 6540 { 6541 CpuDefinitionInfoList *cpu_list = NULL; 6542 GSList *list; 6543 6544 list = object_class_get_list(TYPE_ARM_CPU, false); 6545 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list); 6546 g_slist_free(list); 6547 6548 return cpu_list; 6549 } 6550 6551 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 6552 void *opaque, int state, int secstate, 6553 int crm, int opc1, int opc2, 6554 const char *name) 6555 { 6556 /* Private utility function for define_one_arm_cp_reg_with_opaque(): 6557 * add a single reginfo struct to the hash table. 6558 */ 6559 uint32_t *key = g_new(uint32_t, 1); 6560 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo)); 6561 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0; 6562 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0; 6563 6564 r2->name = g_strdup(name); 6565 /* Reset the secure state to the specific incoming state. This is 6566 * necessary as the register may have been defined with both states. 6567 */ 6568 r2->secure = secstate; 6569 6570 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6571 /* Register is banked (using both entries in array). 6572 * Overwriting fieldoffset as the array is only used to define 6573 * banked registers but later only fieldoffset is used. 6574 */ 6575 r2->fieldoffset = r->bank_fieldoffsets[ns]; 6576 } 6577 6578 if (state == ARM_CP_STATE_AA32) { 6579 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6580 /* If the register is banked then we don't need to migrate or 6581 * reset the 32-bit instance in certain cases: 6582 * 6583 * 1) If the register has both 32-bit and 64-bit instances then we 6584 * can count on the 64-bit instance taking care of the 6585 * non-secure bank. 6586 * 2) If ARMv8 is enabled then we can count on a 64-bit version 6587 * taking care of the secure bank. This requires that separate 6588 * 32 and 64-bit definitions are provided. 6589 */ 6590 if ((r->state == ARM_CP_STATE_BOTH && ns) || 6591 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) { 6592 r2->type |= ARM_CP_ALIAS; 6593 } 6594 } else if ((secstate != r->secure) && !ns) { 6595 /* The register is not banked so we only want to allow migration of 6596 * the non-secure instance. 6597 */ 6598 r2->type |= ARM_CP_ALIAS; 6599 } 6600 6601 if (r->state == ARM_CP_STATE_BOTH) { 6602 /* We assume it is a cp15 register if the .cp field is left unset. 6603 */ 6604 if (r2->cp == 0) { 6605 r2->cp = 15; 6606 } 6607 6608 #ifdef HOST_WORDS_BIGENDIAN 6609 if (r2->fieldoffset) { 6610 r2->fieldoffset += sizeof(uint32_t); 6611 } 6612 #endif 6613 } 6614 } 6615 if (state == ARM_CP_STATE_AA64) { 6616 /* To allow abbreviation of ARMCPRegInfo 6617 * definitions, we treat cp == 0 as equivalent to 6618 * the value for "standard guest-visible sysreg". 6619 * STATE_BOTH definitions are also always "standard 6620 * sysreg" in their AArch64 view (the .cp value may 6621 * be non-zero for the benefit of the AArch32 view). 6622 */ 6623 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) { 6624 r2->cp = CP_REG_ARM64_SYSREG_CP; 6625 } 6626 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm, 6627 r2->opc0, opc1, opc2); 6628 } else { 6629 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2); 6630 } 6631 if (opaque) { 6632 r2->opaque = opaque; 6633 } 6634 /* reginfo passed to helpers is correct for the actual access, 6635 * and is never ARM_CP_STATE_BOTH: 6636 */ 6637 r2->state = state; 6638 /* Make sure reginfo passed to helpers for wildcarded regs 6639 * has the correct crm/opc1/opc2 for this reg, not CP_ANY: 6640 */ 6641 r2->crm = crm; 6642 r2->opc1 = opc1; 6643 r2->opc2 = opc2; 6644 /* By convention, for wildcarded registers only the first 6645 * entry is used for migration; the others are marked as 6646 * ALIAS so we don't try to transfer the register 6647 * multiple times. Special registers (ie NOP/WFI) are 6648 * never migratable and not even raw-accessible. 6649 */ 6650 if ((r->type & ARM_CP_SPECIAL)) { 6651 r2->type |= ARM_CP_NO_RAW; 6652 } 6653 if (((r->crm == CP_ANY) && crm != 0) || 6654 ((r->opc1 == CP_ANY) && opc1 != 0) || 6655 ((r->opc2 == CP_ANY) && opc2 != 0)) { 6656 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 6657 } 6658 6659 /* Check that raw accesses are either forbidden or handled. Note that 6660 * we can't assert this earlier because the setup of fieldoffset for 6661 * banked registers has to be done first. 6662 */ 6663 if (!(r2->type & ARM_CP_NO_RAW)) { 6664 assert(!raw_accessors_invalid(r2)); 6665 } 6666 6667 /* Overriding of an existing definition must be explicitly 6668 * requested. 6669 */ 6670 if (!(r->type & ARM_CP_OVERRIDE)) { 6671 ARMCPRegInfo *oldreg; 6672 oldreg = g_hash_table_lookup(cpu->cp_regs, key); 6673 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) { 6674 fprintf(stderr, "Register redefined: cp=%d %d bit " 6675 "crn=%d crm=%d opc1=%d opc2=%d, " 6676 "was %s, now %s\n", r2->cp, 32 + 32 * is64, 6677 r2->crn, r2->crm, r2->opc1, r2->opc2, 6678 oldreg->name, r2->name); 6679 g_assert_not_reached(); 6680 } 6681 } 6682 g_hash_table_insert(cpu->cp_regs, key, r2); 6683 } 6684 6685 6686 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 6687 const ARMCPRegInfo *r, void *opaque) 6688 { 6689 /* Define implementations of coprocessor registers. 6690 * We store these in a hashtable because typically 6691 * there are less than 150 registers in a space which 6692 * is 16*16*16*8*8 = 262144 in size. 6693 * Wildcarding is supported for the crm, opc1 and opc2 fields. 6694 * If a register is defined twice then the second definition is 6695 * used, so this can be used to define some generic registers and 6696 * then override them with implementation specific variations. 6697 * At least one of the original and the second definition should 6698 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 6699 * against accidental use. 6700 * 6701 * The state field defines whether the register is to be 6702 * visible in the AArch32 or AArch64 execution state. If the 6703 * state is set to ARM_CP_STATE_BOTH then we synthesise a 6704 * reginfo structure for the AArch32 view, which sees the lower 6705 * 32 bits of the 64 bit register. 6706 * 6707 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 6708 * be wildcarded. AArch64 registers are always considered to be 64 6709 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 6710 * the register, if any. 6711 */ 6712 int crm, opc1, opc2, state; 6713 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 6714 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 6715 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 6716 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 6717 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 6718 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 6719 /* 64 bit registers have only CRm and Opc1 fields */ 6720 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 6721 /* op0 only exists in the AArch64 encodings */ 6722 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 6723 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 6724 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 6725 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1 6726 * encodes a minimum access level for the register. We roll this 6727 * runtime check into our general permission check code, so check 6728 * here that the reginfo's specified permissions are strict enough 6729 * to encompass the generic architectural permission check. 6730 */ 6731 if (r->state != ARM_CP_STATE_AA32) { 6732 int mask = 0; 6733 switch (r->opc1) { 6734 case 0: case 1: case 2: 6735 /* min_EL EL1 */ 6736 mask = PL1_RW; 6737 break; 6738 case 3: 6739 /* min_EL EL0 */ 6740 mask = PL0_RW; 6741 break; 6742 case 4: 6743 /* min_EL EL2 */ 6744 mask = PL2_RW; 6745 break; 6746 case 5: 6747 /* unallocated encoding, so not possible */ 6748 assert(false); 6749 break; 6750 case 6: 6751 /* min_EL EL3 */ 6752 mask = PL3_RW; 6753 break; 6754 case 7: 6755 /* min_EL EL1, secure mode only (we don't check the latter) */ 6756 mask = PL1_RW; 6757 break; 6758 default: 6759 /* broken reginfo with out-of-range opc1 */ 6760 assert(false); 6761 break; 6762 } 6763 /* assert our permissions are not too lax (stricter is fine) */ 6764 assert((r->access & ~mask) == 0); 6765 } 6766 6767 /* Check that the register definition has enough info to handle 6768 * reads and writes if they are permitted. 6769 */ 6770 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) { 6771 if (r->access & PL3_R) { 6772 assert((r->fieldoffset || 6773 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 6774 r->readfn); 6775 } 6776 if (r->access & PL3_W) { 6777 assert((r->fieldoffset || 6778 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 6779 r->writefn); 6780 } 6781 } 6782 /* Bad type field probably means missing sentinel at end of reg list */ 6783 assert(cptype_valid(r->type)); 6784 for (crm = crmmin; crm <= crmmax; crm++) { 6785 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 6786 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 6787 for (state = ARM_CP_STATE_AA32; 6788 state <= ARM_CP_STATE_AA64; state++) { 6789 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 6790 continue; 6791 } 6792 if (state == ARM_CP_STATE_AA32) { 6793 /* Under AArch32 CP registers can be common 6794 * (same for secure and non-secure world) or banked. 6795 */ 6796 char *name; 6797 6798 switch (r->secure) { 6799 case ARM_CP_SECSTATE_S: 6800 case ARM_CP_SECSTATE_NS: 6801 add_cpreg_to_hashtable(cpu, r, opaque, state, 6802 r->secure, crm, opc1, opc2, 6803 r->name); 6804 break; 6805 default: 6806 name = g_strdup_printf("%s_S", r->name); 6807 add_cpreg_to_hashtable(cpu, r, opaque, state, 6808 ARM_CP_SECSTATE_S, 6809 crm, opc1, opc2, name); 6810 g_free(name); 6811 add_cpreg_to_hashtable(cpu, r, opaque, state, 6812 ARM_CP_SECSTATE_NS, 6813 crm, opc1, opc2, r->name); 6814 break; 6815 } 6816 } else { 6817 /* AArch64 registers get mapped to non-secure instance 6818 * of AArch32 */ 6819 add_cpreg_to_hashtable(cpu, r, opaque, state, 6820 ARM_CP_SECSTATE_NS, 6821 crm, opc1, opc2, r->name); 6822 } 6823 } 6824 } 6825 } 6826 } 6827 } 6828 6829 void define_arm_cp_regs_with_opaque(ARMCPU *cpu, 6830 const ARMCPRegInfo *regs, void *opaque) 6831 { 6832 /* Define a whole list of registers */ 6833 const ARMCPRegInfo *r; 6834 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 6835 define_one_arm_cp_reg_with_opaque(cpu, r, opaque); 6836 } 6837 } 6838 6839 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 6840 { 6841 return g_hash_table_lookup(cpregs, &encoded_cp); 6842 } 6843 6844 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 6845 uint64_t value) 6846 { 6847 /* Helper coprocessor write function for write-ignore registers */ 6848 } 6849 6850 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 6851 { 6852 /* Helper coprocessor write function for read-as-zero registers */ 6853 return 0; 6854 } 6855 6856 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 6857 { 6858 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 6859 } 6860 6861 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 6862 { 6863 /* Return true if it is not valid for us to switch to 6864 * this CPU mode (ie all the UNPREDICTABLE cases in 6865 * the ARM ARM CPSRWriteByInstr pseudocode). 6866 */ 6867 6868 /* Changes to or from Hyp via MSR and CPS are illegal. */ 6869 if (write_type == CPSRWriteByInstr && 6870 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 6871 mode == ARM_CPU_MODE_HYP)) { 6872 return 1; 6873 } 6874 6875 switch (mode) { 6876 case ARM_CPU_MODE_USR: 6877 return 0; 6878 case ARM_CPU_MODE_SYS: 6879 case ARM_CPU_MODE_SVC: 6880 case ARM_CPU_MODE_ABT: 6881 case ARM_CPU_MODE_UND: 6882 case ARM_CPU_MODE_IRQ: 6883 case ARM_CPU_MODE_FIQ: 6884 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7 6885 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 6886 */ 6887 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 6888 * and CPS are treated as illegal mode changes. 6889 */ 6890 if (write_type == CPSRWriteByInstr && 6891 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 6892 (arm_hcr_el2_eff(env) & HCR_TGE)) { 6893 return 1; 6894 } 6895 return 0; 6896 case ARM_CPU_MODE_HYP: 6897 return !arm_feature(env, ARM_FEATURE_EL2) 6898 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env); 6899 case ARM_CPU_MODE_MON: 6900 return arm_current_el(env) < 3; 6901 default: 6902 return 1; 6903 } 6904 } 6905 6906 uint32_t cpsr_read(CPUARMState *env) 6907 { 6908 int ZF; 6909 ZF = (env->ZF == 0); 6910 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 6911 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 6912 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 6913 | ((env->condexec_bits & 0xfc) << 8) 6914 | (env->GE << 16) | (env->daif & CPSR_AIF); 6915 } 6916 6917 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 6918 CPSRWriteType write_type) 6919 { 6920 uint32_t changed_daif; 6921 6922 if (mask & CPSR_NZCV) { 6923 env->ZF = (~val) & CPSR_Z; 6924 env->NF = val; 6925 env->CF = (val >> 29) & 1; 6926 env->VF = (val << 3) & 0x80000000; 6927 } 6928 if (mask & CPSR_Q) 6929 env->QF = ((val & CPSR_Q) != 0); 6930 if (mask & CPSR_T) 6931 env->thumb = ((val & CPSR_T) != 0); 6932 if (mask & CPSR_IT_0_1) { 6933 env->condexec_bits &= ~3; 6934 env->condexec_bits |= (val >> 25) & 3; 6935 } 6936 if (mask & CPSR_IT_2_7) { 6937 env->condexec_bits &= 3; 6938 env->condexec_bits |= (val >> 8) & 0xfc; 6939 } 6940 if (mask & CPSR_GE) { 6941 env->GE = (val >> 16) & 0xf; 6942 } 6943 6944 /* In a V7 implementation that includes the security extensions but does 6945 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 6946 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 6947 * bits respectively. 6948 * 6949 * In a V8 implementation, it is permitted for privileged software to 6950 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 6951 */ 6952 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 6953 arm_feature(env, ARM_FEATURE_EL3) && 6954 !arm_feature(env, ARM_FEATURE_EL2) && 6955 !arm_is_secure(env)) { 6956 6957 changed_daif = (env->daif ^ val) & mask; 6958 6959 if (changed_daif & CPSR_A) { 6960 /* Check to see if we are allowed to change the masking of async 6961 * abort exceptions from a non-secure state. 6962 */ 6963 if (!(env->cp15.scr_el3 & SCR_AW)) { 6964 qemu_log_mask(LOG_GUEST_ERROR, 6965 "Ignoring attempt to switch CPSR_A flag from " 6966 "non-secure world with SCR.AW bit clear\n"); 6967 mask &= ~CPSR_A; 6968 } 6969 } 6970 6971 if (changed_daif & CPSR_F) { 6972 /* Check to see if we are allowed to change the masking of FIQ 6973 * exceptions from a non-secure state. 6974 */ 6975 if (!(env->cp15.scr_el3 & SCR_FW)) { 6976 qemu_log_mask(LOG_GUEST_ERROR, 6977 "Ignoring attempt to switch CPSR_F flag from " 6978 "non-secure world with SCR.FW bit clear\n"); 6979 mask &= ~CPSR_F; 6980 } 6981 6982 /* Check whether non-maskable FIQ (NMFI) support is enabled. 6983 * If this bit is set software is not allowed to mask 6984 * FIQs, but is allowed to set CPSR_F to 0. 6985 */ 6986 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 6987 (val & CPSR_F)) { 6988 qemu_log_mask(LOG_GUEST_ERROR, 6989 "Ignoring attempt to enable CPSR_F flag " 6990 "(non-maskable FIQ [NMFI] support enabled)\n"); 6991 mask &= ~CPSR_F; 6992 } 6993 } 6994 } 6995 6996 env->daif &= ~(CPSR_AIF & mask); 6997 env->daif |= val & CPSR_AIF & mask; 6998 6999 if (write_type != CPSRWriteRaw && 7000 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 7001 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 7002 /* Note that we can only get here in USR mode if this is a 7003 * gdb stub write; for this case we follow the architectural 7004 * behaviour for guest writes in USR mode of ignoring an attempt 7005 * to switch mode. (Those are caught by translate.c for writes 7006 * triggered by guest instructions.) 7007 */ 7008 mask &= ~CPSR_M; 7009 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 7010 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in 7011 * v7, and has defined behaviour in v8: 7012 * + leave CPSR.M untouched 7013 * + allow changes to the other CPSR fields 7014 * + set PSTATE.IL 7015 * For user changes via the GDB stub, we don't set PSTATE.IL, 7016 * as this would be unnecessarily harsh for a user error. 7017 */ 7018 mask &= ~CPSR_M; 7019 if (write_type != CPSRWriteByGDBStub && 7020 arm_feature(env, ARM_FEATURE_V8)) { 7021 mask |= CPSR_IL; 7022 val |= CPSR_IL; 7023 } 7024 qemu_log_mask(LOG_GUEST_ERROR, 7025 "Illegal AArch32 mode switch attempt from %s to %s\n", 7026 aarch32_mode_name(env->uncached_cpsr), 7027 aarch32_mode_name(val)); 7028 } else { 7029 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 7030 write_type == CPSRWriteExceptionReturn ? 7031 "Exception return from AArch32" : 7032 "AArch32 mode switch from", 7033 aarch32_mode_name(env->uncached_cpsr), 7034 aarch32_mode_name(val), env->regs[15]); 7035 switch_mode(env, val & CPSR_M); 7036 } 7037 } 7038 mask &= ~CACHED_CPSR_BITS; 7039 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 7040 } 7041 7042 /* Sign/zero extend */ 7043 uint32_t HELPER(sxtb16)(uint32_t x) 7044 { 7045 uint32_t res; 7046 res = (uint16_t)(int8_t)x; 7047 res |= (uint32_t)(int8_t)(x >> 16) << 16; 7048 return res; 7049 } 7050 7051 uint32_t HELPER(uxtb16)(uint32_t x) 7052 { 7053 uint32_t res; 7054 res = (uint16_t)(uint8_t)x; 7055 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 7056 return res; 7057 } 7058 7059 int32_t HELPER(sdiv)(int32_t num, int32_t den) 7060 { 7061 if (den == 0) 7062 return 0; 7063 if (num == INT_MIN && den == -1) 7064 return INT_MIN; 7065 return num / den; 7066 } 7067 7068 uint32_t HELPER(udiv)(uint32_t num, uint32_t den) 7069 { 7070 if (den == 0) 7071 return 0; 7072 return num / den; 7073 } 7074 7075 uint32_t HELPER(rbit)(uint32_t x) 7076 { 7077 return revbit32(x); 7078 } 7079 7080 #if defined(CONFIG_USER_ONLY) 7081 7082 /* These should probably raise undefined insn exceptions. */ 7083 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val) 7084 { 7085 ARMCPU *cpu = arm_env_get_cpu(env); 7086 7087 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg); 7088 } 7089 7090 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) 7091 { 7092 ARMCPU *cpu = arm_env_get_cpu(env); 7093 7094 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg); 7095 return 0; 7096 } 7097 7098 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest) 7099 { 7100 /* translate.c should never generate calls here in user-only mode */ 7101 g_assert_not_reached(); 7102 } 7103 7104 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest) 7105 { 7106 /* translate.c should never generate calls here in user-only mode */ 7107 g_assert_not_reached(); 7108 } 7109 7110 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) 7111 { 7112 /* The TT instructions can be used by unprivileged code, but in 7113 * user-only emulation we don't have the MPU. 7114 * Luckily since we know we are NonSecure unprivileged (and that in 7115 * turn means that the A flag wasn't specified), all the bits in the 7116 * register must be zero: 7117 * IREGION: 0 because IRVALID is 0 7118 * IRVALID: 0 because NS 7119 * S: 0 because NS 7120 * NSRW: 0 because NS 7121 * NSR: 0 because NS 7122 * RW: 0 because unpriv and A flag not set 7123 * R: 0 because unpriv and A flag not set 7124 * SRVALID: 0 because NS 7125 * MRVALID: 0 because unpriv and A flag not set 7126 * SREGION: 0 becaus SRVALID is 0 7127 * MREGION: 0 because MRVALID is 0 7128 */ 7129 return 0; 7130 } 7131 7132 static void switch_mode(CPUARMState *env, int mode) 7133 { 7134 ARMCPU *cpu = arm_env_get_cpu(env); 7135 7136 if (mode != ARM_CPU_MODE_USR) { 7137 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 7138 } 7139 } 7140 7141 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7142 uint32_t cur_el, bool secure) 7143 { 7144 return 1; 7145 } 7146 7147 void aarch64_sync_64_to_32(CPUARMState *env) 7148 { 7149 g_assert_not_reached(); 7150 } 7151 7152 #else 7153 7154 static void switch_mode(CPUARMState *env, int mode) 7155 { 7156 int old_mode; 7157 int i; 7158 7159 old_mode = env->uncached_cpsr & CPSR_M; 7160 if (mode == old_mode) 7161 return; 7162 7163 if (old_mode == ARM_CPU_MODE_FIQ) { 7164 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7165 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 7166 } else if (mode == ARM_CPU_MODE_FIQ) { 7167 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7168 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 7169 } 7170 7171 i = bank_number(old_mode); 7172 env->banked_r13[i] = env->regs[13]; 7173 env->banked_spsr[i] = env->spsr; 7174 7175 i = bank_number(mode); 7176 env->regs[13] = env->banked_r13[i]; 7177 env->spsr = env->banked_spsr[i]; 7178 7179 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 7180 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 7181 } 7182 7183 /* Physical Interrupt Target EL Lookup Table 7184 * 7185 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 7186 * 7187 * The below multi-dimensional table is used for looking up the target 7188 * exception level given numerous condition criteria. Specifically, the 7189 * target EL is based on SCR and HCR routing controls as well as the 7190 * currently executing EL and secure state. 7191 * 7192 * Dimensions: 7193 * target_el_table[2][2][2][2][2][4] 7194 * | | | | | +--- Current EL 7195 * | | | | +------ Non-secure(0)/Secure(1) 7196 * | | | +--------- HCR mask override 7197 * | | +------------ SCR exec state control 7198 * | +--------------- SCR mask override 7199 * +------------------ 32-bit(0)/64-bit(1) EL3 7200 * 7201 * The table values are as such: 7202 * 0-3 = EL0-EL3 7203 * -1 = Cannot occur 7204 * 7205 * The ARM ARM target EL table includes entries indicating that an "exception 7206 * is not taken". The two cases where this is applicable are: 7207 * 1) An exception is taken from EL3 but the SCR does not have the exception 7208 * routed to EL3. 7209 * 2) An exception is taken from EL2 but the HCR does not have the exception 7210 * routed to EL2. 7211 * In these two cases, the below table contain a target of EL1. This value is 7212 * returned as it is expected that the consumer of the table data will check 7213 * for "target EL >= current EL" to ensure the exception is not taken. 7214 * 7215 * SCR HCR 7216 * 64 EA AMO From 7217 * BIT IRQ IMO Non-secure Secure 7218 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 7219 */ 7220 static const int8_t target_el_table[2][2][2][2][2][4] = { 7221 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7222 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 7223 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7224 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 7225 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7226 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 7227 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7228 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 7229 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 7230 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},}, 7231 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },}, 7232 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},}, 7233 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7234 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 7235 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7236 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},}, 7237 }; 7238 7239 /* 7240 * Determine the target EL for physical exceptions 7241 */ 7242 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7243 uint32_t cur_el, bool secure) 7244 { 7245 CPUARMState *env = cs->env_ptr; 7246 bool rw; 7247 bool scr; 7248 bool hcr; 7249 int target_el; 7250 /* Is the highest EL AArch64? */ 7251 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 7252 uint64_t hcr_el2; 7253 7254 if (arm_feature(env, ARM_FEATURE_EL3)) { 7255 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 7256 } else { 7257 /* Either EL2 is the highest EL (and so the EL2 register width 7258 * is given by is64); or there is no EL2 or EL3, in which case 7259 * the value of 'rw' does not affect the table lookup anyway. 7260 */ 7261 rw = is64; 7262 } 7263 7264 hcr_el2 = arm_hcr_el2_eff(env); 7265 switch (excp_idx) { 7266 case EXCP_IRQ: 7267 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 7268 hcr = hcr_el2 & HCR_IMO; 7269 break; 7270 case EXCP_FIQ: 7271 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 7272 hcr = hcr_el2 & HCR_FMO; 7273 break; 7274 default: 7275 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 7276 hcr = hcr_el2 & HCR_AMO; 7277 break; 7278 }; 7279 7280 /* Perform a table-lookup for the target EL given the current state */ 7281 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 7282 7283 assert(target_el > 0); 7284 7285 return target_el; 7286 } 7287 7288 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value, 7289 ARMMMUIdx mmu_idx, bool ignfault) 7290 { 7291 CPUState *cs = CPU(cpu); 7292 CPUARMState *env = &cpu->env; 7293 MemTxAttrs attrs = {}; 7294 MemTxResult txres; 7295 target_ulong page_size; 7296 hwaddr physaddr; 7297 int prot; 7298 ARMMMUFaultInfo fi = {}; 7299 bool secure = mmu_idx & ARM_MMU_IDX_M_S; 7300 int exc; 7301 bool exc_secure; 7302 7303 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr, 7304 &attrs, &prot, &page_size, &fi, NULL)) { 7305 /* MPU/SAU lookup failed */ 7306 if (fi.type == ARMFault_QEMU_SFault) { 7307 qemu_log_mask(CPU_LOG_INT, 7308 "...SecureFault with SFSR.AUVIOL during stacking\n"); 7309 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK; 7310 env->v7m.sfar = addr; 7311 exc = ARMV7M_EXCP_SECURE; 7312 exc_secure = false; 7313 } else { 7314 qemu_log_mask(CPU_LOG_INT, "...MemManageFault with CFSR.MSTKERR\n"); 7315 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK; 7316 exc = ARMV7M_EXCP_MEM; 7317 exc_secure = secure; 7318 } 7319 goto pend_fault; 7320 } 7321 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value, 7322 attrs, &txres); 7323 if (txres != MEMTX_OK) { 7324 /* BusFault trying to write the data */ 7325 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n"); 7326 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK; 7327 exc = ARMV7M_EXCP_BUS; 7328 exc_secure = false; 7329 goto pend_fault; 7330 } 7331 return true; 7332 7333 pend_fault: 7334 /* By pending the exception at this point we are making 7335 * the IMPDEF choice "overridden exceptions pended" (see the 7336 * MergeExcInfo() pseudocode). The other choice would be to not 7337 * pend them now and then make a choice about which to throw away 7338 * later if we have two derived exceptions. 7339 * The only case when we must not pend the exception but instead 7340 * throw it away is if we are doing the push of the callee registers 7341 * and we've already generated a derived exception. Even in this 7342 * case we will still update the fault status registers. 7343 */ 7344 if (!ignfault) { 7345 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure); 7346 } 7347 return false; 7348 } 7349 7350 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr, 7351 ARMMMUIdx mmu_idx) 7352 { 7353 CPUState *cs = CPU(cpu); 7354 CPUARMState *env = &cpu->env; 7355 MemTxAttrs attrs = {}; 7356 MemTxResult txres; 7357 target_ulong page_size; 7358 hwaddr physaddr; 7359 int prot; 7360 ARMMMUFaultInfo fi = {}; 7361 bool secure = mmu_idx & ARM_MMU_IDX_M_S; 7362 int exc; 7363 bool exc_secure; 7364 uint32_t value; 7365 7366 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr, 7367 &attrs, &prot, &page_size, &fi, NULL)) { 7368 /* MPU/SAU lookup failed */ 7369 if (fi.type == ARMFault_QEMU_SFault) { 7370 qemu_log_mask(CPU_LOG_INT, 7371 "...SecureFault with SFSR.AUVIOL during unstack\n"); 7372 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK; 7373 env->v7m.sfar = addr; 7374 exc = ARMV7M_EXCP_SECURE; 7375 exc_secure = false; 7376 } else { 7377 qemu_log_mask(CPU_LOG_INT, 7378 "...MemManageFault with CFSR.MUNSTKERR\n"); 7379 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK; 7380 exc = ARMV7M_EXCP_MEM; 7381 exc_secure = secure; 7382 } 7383 goto pend_fault; 7384 } 7385 7386 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr, 7387 attrs, &txres); 7388 if (txres != MEMTX_OK) { 7389 /* BusFault trying to read the data */ 7390 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n"); 7391 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK; 7392 exc = ARMV7M_EXCP_BUS; 7393 exc_secure = false; 7394 goto pend_fault; 7395 } 7396 7397 *dest = value; 7398 return true; 7399 7400 pend_fault: 7401 /* By pending the exception at this point we are making 7402 * the IMPDEF choice "overridden exceptions pended" (see the 7403 * MergeExcInfo() pseudocode). The other choice would be to not 7404 * pend them now and then make a choice about which to throw away 7405 * later if we have two derived exceptions. 7406 */ 7407 armv7m_nvic_set_pending(env->nvic, exc, exc_secure); 7408 return false; 7409 } 7410 7411 /* Write to v7M CONTROL.SPSEL bit for the specified security bank. 7412 * This may change the current stack pointer between Main and Process 7413 * stack pointers if it is done for the CONTROL register for the current 7414 * security state. 7415 */ 7416 static void write_v7m_control_spsel_for_secstate(CPUARMState *env, 7417 bool new_spsel, 7418 bool secstate) 7419 { 7420 bool old_is_psp = v7m_using_psp(env); 7421 7422 env->v7m.control[secstate] = 7423 deposit32(env->v7m.control[secstate], 7424 R_V7M_CONTROL_SPSEL_SHIFT, 7425 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel); 7426 7427 if (secstate == env->v7m.secure) { 7428 bool new_is_psp = v7m_using_psp(env); 7429 uint32_t tmp; 7430 7431 if (old_is_psp != new_is_psp) { 7432 tmp = env->v7m.other_sp; 7433 env->v7m.other_sp = env->regs[13]; 7434 env->regs[13] = tmp; 7435 } 7436 } 7437 } 7438 7439 /* Write to v7M CONTROL.SPSEL bit. This may change the current 7440 * stack pointer between Main and Process stack pointers. 7441 */ 7442 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel) 7443 { 7444 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure); 7445 } 7446 7447 void write_v7m_exception(CPUARMState *env, uint32_t new_exc) 7448 { 7449 /* Write a new value to v7m.exception, thus transitioning into or out 7450 * of Handler mode; this may result in a change of active stack pointer. 7451 */ 7452 bool new_is_psp, old_is_psp = v7m_using_psp(env); 7453 uint32_t tmp; 7454 7455 env->v7m.exception = new_exc; 7456 7457 new_is_psp = v7m_using_psp(env); 7458 7459 if (old_is_psp != new_is_psp) { 7460 tmp = env->v7m.other_sp; 7461 env->v7m.other_sp = env->regs[13]; 7462 env->regs[13] = tmp; 7463 } 7464 } 7465 7466 /* Switch M profile security state between NS and S */ 7467 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate) 7468 { 7469 uint32_t new_ss_msp, new_ss_psp; 7470 7471 if (env->v7m.secure == new_secstate) { 7472 return; 7473 } 7474 7475 /* All the banked state is accessed by looking at env->v7m.secure 7476 * except for the stack pointer; rearrange the SP appropriately. 7477 */ 7478 new_ss_msp = env->v7m.other_ss_msp; 7479 new_ss_psp = env->v7m.other_ss_psp; 7480 7481 if (v7m_using_psp(env)) { 7482 env->v7m.other_ss_psp = env->regs[13]; 7483 env->v7m.other_ss_msp = env->v7m.other_sp; 7484 } else { 7485 env->v7m.other_ss_msp = env->regs[13]; 7486 env->v7m.other_ss_psp = env->v7m.other_sp; 7487 } 7488 7489 env->v7m.secure = new_secstate; 7490 7491 if (v7m_using_psp(env)) { 7492 env->regs[13] = new_ss_psp; 7493 env->v7m.other_sp = new_ss_msp; 7494 } else { 7495 env->regs[13] = new_ss_msp; 7496 env->v7m.other_sp = new_ss_psp; 7497 } 7498 } 7499 7500 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest) 7501 { 7502 /* Handle v7M BXNS: 7503 * - if the return value is a magic value, do exception return (like BX) 7504 * - otherwise bit 0 of the return value is the target security state 7505 */ 7506 uint32_t min_magic; 7507 7508 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7509 /* Covers FNC_RETURN and EXC_RETURN magic */ 7510 min_magic = FNC_RETURN_MIN_MAGIC; 7511 } else { 7512 /* EXC_RETURN magic only */ 7513 min_magic = EXC_RETURN_MIN_MAGIC; 7514 } 7515 7516 if (dest >= min_magic) { 7517 /* This is an exception return magic value; put it where 7518 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT. 7519 * Note that if we ever add gen_ss_advance() singlestep support to 7520 * M profile this should count as an "instruction execution complete" 7521 * event (compare gen_bx_excret_final_code()). 7522 */ 7523 env->regs[15] = dest & ~1; 7524 env->thumb = dest & 1; 7525 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT); 7526 /* notreached */ 7527 } 7528 7529 /* translate.c should have made BXNS UNDEF unless we're secure */ 7530 assert(env->v7m.secure); 7531 7532 switch_v7m_security_state(env, dest & 1); 7533 env->thumb = 1; 7534 env->regs[15] = dest & ~1; 7535 } 7536 7537 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest) 7538 { 7539 /* Handle v7M BLXNS: 7540 * - bit 0 of the destination address is the target security state 7541 */ 7542 7543 /* At this point regs[15] is the address just after the BLXNS */ 7544 uint32_t nextinst = env->regs[15] | 1; 7545 uint32_t sp = env->regs[13] - 8; 7546 uint32_t saved_psr; 7547 7548 /* translate.c will have made BLXNS UNDEF unless we're secure */ 7549 assert(env->v7m.secure); 7550 7551 if (dest & 1) { 7552 /* target is Secure, so this is just a normal BLX, 7553 * except that the low bit doesn't indicate Thumb/not. 7554 */ 7555 env->regs[14] = nextinst; 7556 env->thumb = 1; 7557 env->regs[15] = dest & ~1; 7558 return; 7559 } 7560 7561 /* Target is non-secure: first push a stack frame */ 7562 if (!QEMU_IS_ALIGNED(sp, 8)) { 7563 qemu_log_mask(LOG_GUEST_ERROR, 7564 "BLXNS with misaligned SP is UNPREDICTABLE\n"); 7565 } 7566 7567 if (sp < v7m_sp_limit(env)) { 7568 raise_exception(env, EXCP_STKOF, 0, 1); 7569 } 7570 7571 saved_psr = env->v7m.exception; 7572 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) { 7573 saved_psr |= XPSR_SFPA; 7574 } 7575 7576 /* Note that these stores can throw exceptions on MPU faults */ 7577 cpu_stl_data(env, sp, nextinst); 7578 cpu_stl_data(env, sp + 4, saved_psr); 7579 7580 env->regs[13] = sp; 7581 env->regs[14] = 0xfeffffff; 7582 if (arm_v7m_is_handler_mode(env)) { 7583 /* Write a dummy value to IPSR, to avoid leaking the current secure 7584 * exception number to non-secure code. This is guaranteed not 7585 * to cause write_v7m_exception() to actually change stacks. 7586 */ 7587 write_v7m_exception(env, 1); 7588 } 7589 switch_v7m_security_state(env, 0); 7590 env->thumb = 1; 7591 env->regs[15] = dest; 7592 } 7593 7594 static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode, 7595 bool spsel) 7596 { 7597 /* Return a pointer to the location where we currently store the 7598 * stack pointer for the requested security state and thread mode. 7599 * This pointer will become invalid if the CPU state is updated 7600 * such that the stack pointers are switched around (eg changing 7601 * the SPSEL control bit). 7602 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode(). 7603 * Unlike that pseudocode, we require the caller to pass us in the 7604 * SPSEL control bit value; this is because we also use this 7605 * function in handling of pushing of the callee-saves registers 7606 * part of the v8M stack frame (pseudocode PushCalleeStack()), 7607 * and in the tailchain codepath the SPSEL bit comes from the exception 7608 * return magic LR value from the previous exception. The pseudocode 7609 * opencodes the stack-selection in PushCalleeStack(), but we prefer 7610 * to make this utility function generic enough to do the job. 7611 */ 7612 bool want_psp = threadmode && spsel; 7613 7614 if (secure == env->v7m.secure) { 7615 if (want_psp == v7m_using_psp(env)) { 7616 return &env->regs[13]; 7617 } else { 7618 return &env->v7m.other_sp; 7619 } 7620 } else { 7621 if (want_psp) { 7622 return &env->v7m.other_ss_psp; 7623 } else { 7624 return &env->v7m.other_ss_msp; 7625 } 7626 } 7627 } 7628 7629 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure, 7630 uint32_t *pvec) 7631 { 7632 CPUState *cs = CPU(cpu); 7633 CPUARMState *env = &cpu->env; 7634 MemTxResult result; 7635 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4; 7636 uint32_t vector_entry; 7637 MemTxAttrs attrs = {}; 7638 ARMMMUIdx mmu_idx; 7639 bool exc_secure; 7640 7641 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true); 7642 7643 /* We don't do a get_phys_addr() here because the rules for vector 7644 * loads are special: they always use the default memory map, and 7645 * the default memory map permits reads from all addresses. 7646 * Since there's no easy way to pass through to pmsav8_mpu_lookup() 7647 * that we want this special case which would always say "yes", 7648 * we just do the SAU lookup here followed by a direct physical load. 7649 */ 7650 attrs.secure = targets_secure; 7651 attrs.user = false; 7652 7653 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7654 V8M_SAttributes sattrs = {}; 7655 7656 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs); 7657 if (sattrs.ns) { 7658 attrs.secure = false; 7659 } else if (!targets_secure) { 7660 /* NS access to S memory */ 7661 goto load_fail; 7662 } 7663 } 7664 7665 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr, 7666 attrs, &result); 7667 if (result != MEMTX_OK) { 7668 goto load_fail; 7669 } 7670 *pvec = vector_entry; 7671 return true; 7672 7673 load_fail: 7674 /* All vector table fetch fails are reported as HardFault, with 7675 * HFSR.VECTTBL and .FORCED set. (FORCED is set because 7676 * technically the underlying exception is a MemManage or BusFault 7677 * that is escalated to HardFault.) This is a terminal exception, 7678 * so we will either take the HardFault immediately or else enter 7679 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()). 7680 */ 7681 exc_secure = targets_secure || 7682 !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK); 7683 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK; 7684 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure); 7685 return false; 7686 } 7687 7688 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain, 7689 bool ignore_faults) 7690 { 7691 /* For v8M, push the callee-saves register part of the stack frame. 7692 * Compare the v8M pseudocode PushCalleeStack(). 7693 * In the tailchaining case this may not be the current stack. 7694 */ 7695 CPUARMState *env = &cpu->env; 7696 uint32_t *frame_sp_p; 7697 uint32_t frameptr; 7698 ARMMMUIdx mmu_idx; 7699 bool stacked_ok; 7700 uint32_t limit; 7701 bool want_psp; 7702 7703 if (dotailchain) { 7704 bool mode = lr & R_V7M_EXCRET_MODE_MASK; 7705 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) || 7706 !mode; 7707 7708 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv); 7709 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode, 7710 lr & R_V7M_EXCRET_SPSEL_MASK); 7711 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK); 7712 if (want_psp) { 7713 limit = env->v7m.psplim[M_REG_S]; 7714 } else { 7715 limit = env->v7m.msplim[M_REG_S]; 7716 } 7717 } else { 7718 mmu_idx = arm_mmu_idx(env); 7719 frame_sp_p = &env->regs[13]; 7720 limit = v7m_sp_limit(env); 7721 } 7722 7723 frameptr = *frame_sp_p - 0x28; 7724 if (frameptr < limit) { 7725 /* 7726 * Stack limit failure: set SP to the limit value, and generate 7727 * STKOF UsageFault. Stack pushes below the limit must not be 7728 * performed. It is IMPDEF whether pushes above the limit are 7729 * performed; we choose not to. 7730 */ 7731 qemu_log_mask(CPU_LOG_INT, 7732 "...STKOF during callee-saves register stacking\n"); 7733 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 7734 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 7735 env->v7m.secure); 7736 *frame_sp_p = limit; 7737 return true; 7738 } 7739 7740 /* Write as much of the stack frame as we can. A write failure may 7741 * cause us to pend a derived exception. 7742 */ 7743 stacked_ok = 7744 v7m_stack_write(cpu, frameptr, 0xfefa125b, mmu_idx, ignore_faults) && 7745 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, 7746 ignore_faults) && 7747 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, 7748 ignore_faults) && 7749 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, 7750 ignore_faults) && 7751 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, 7752 ignore_faults) && 7753 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, 7754 ignore_faults) && 7755 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, 7756 ignore_faults) && 7757 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, 7758 ignore_faults) && 7759 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, 7760 ignore_faults); 7761 7762 /* Update SP regardless of whether any of the stack accesses failed. */ 7763 *frame_sp_p = frameptr; 7764 7765 return !stacked_ok; 7766 } 7767 7768 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain, 7769 bool ignore_stackfaults) 7770 { 7771 /* Do the "take the exception" parts of exception entry, 7772 * but not the pushing of state to the stack. This is 7773 * similar to the pseudocode ExceptionTaken() function. 7774 */ 7775 CPUARMState *env = &cpu->env; 7776 uint32_t addr; 7777 bool targets_secure; 7778 int exc; 7779 bool push_failed = false; 7780 7781 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure); 7782 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n", 7783 targets_secure ? "secure" : "nonsecure", exc); 7784 7785 if (arm_feature(env, ARM_FEATURE_V8)) { 7786 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 7787 (lr & R_V7M_EXCRET_S_MASK)) { 7788 /* The background code (the owner of the registers in the 7789 * exception frame) is Secure. This means it may either already 7790 * have or now needs to push callee-saves registers. 7791 */ 7792 if (targets_secure) { 7793 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) { 7794 /* We took an exception from Secure to NonSecure 7795 * (which means the callee-saved registers got stacked) 7796 * and are now tailchaining to a Secure exception. 7797 * Clear DCRS so eventual return from this Secure 7798 * exception unstacks the callee-saved registers. 7799 */ 7800 lr &= ~R_V7M_EXCRET_DCRS_MASK; 7801 } 7802 } else { 7803 /* We're going to a non-secure exception; push the 7804 * callee-saves registers to the stack now, if they're 7805 * not already saved. 7806 */ 7807 if (lr & R_V7M_EXCRET_DCRS_MASK && 7808 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) { 7809 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain, 7810 ignore_stackfaults); 7811 } 7812 lr |= R_V7M_EXCRET_DCRS_MASK; 7813 } 7814 } 7815 7816 lr &= ~R_V7M_EXCRET_ES_MASK; 7817 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7818 lr |= R_V7M_EXCRET_ES_MASK; 7819 } 7820 lr &= ~R_V7M_EXCRET_SPSEL_MASK; 7821 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) { 7822 lr |= R_V7M_EXCRET_SPSEL_MASK; 7823 } 7824 7825 /* Clear registers if necessary to prevent non-secure exception 7826 * code being able to see register values from secure code. 7827 * Where register values become architecturally UNKNOWN we leave 7828 * them with their previous values. 7829 */ 7830 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7831 if (!targets_secure) { 7832 /* Always clear the caller-saved registers (they have been 7833 * pushed to the stack earlier in v7m_push_stack()). 7834 * Clear callee-saved registers if the background code is 7835 * Secure (in which case these regs were saved in 7836 * v7m_push_callee_stack()). 7837 */ 7838 int i; 7839 7840 for (i = 0; i < 13; i++) { 7841 /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */ 7842 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) { 7843 env->regs[i] = 0; 7844 } 7845 } 7846 /* Clear EAPSR */ 7847 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT); 7848 } 7849 } 7850 } 7851 7852 if (push_failed && !ignore_stackfaults) { 7853 /* Derived exception on callee-saves register stacking: 7854 * we might now want to take a different exception which 7855 * targets a different security state, so try again from the top. 7856 */ 7857 qemu_log_mask(CPU_LOG_INT, 7858 "...derived exception on callee-saves register stacking"); 7859 v7m_exception_taken(cpu, lr, true, true); 7860 return; 7861 } 7862 7863 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) { 7864 /* Vector load failed: derived exception */ 7865 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load"); 7866 v7m_exception_taken(cpu, lr, true, true); 7867 return; 7868 } 7869 7870 /* Now we've done everything that might cause a derived exception 7871 * we can go ahead and activate whichever exception we're going to 7872 * take (which might now be the derived exception). 7873 */ 7874 armv7m_nvic_acknowledge_irq(env->nvic); 7875 7876 /* Switch to target security state -- must do this before writing SPSEL */ 7877 switch_v7m_security_state(env, targets_secure); 7878 write_v7m_control_spsel(env, 0); 7879 arm_clear_exclusive(env); 7880 /* Clear IT bits */ 7881 env->condexec_bits = 0; 7882 env->regs[14] = lr; 7883 env->regs[15] = addr & 0xfffffffe; 7884 env->thumb = addr & 1; 7885 } 7886 7887 static bool v7m_push_stack(ARMCPU *cpu) 7888 { 7889 /* Do the "set up stack frame" part of exception entry, 7890 * similar to pseudocode PushStack(). 7891 * Return true if we generate a derived exception (and so 7892 * should ignore further stack faults trying to process 7893 * that derived exception.) 7894 */ 7895 bool stacked_ok; 7896 CPUARMState *env = &cpu->env; 7897 uint32_t xpsr = xpsr_read(env); 7898 uint32_t frameptr = env->regs[13]; 7899 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 7900 7901 /* Align stack pointer if the guest wants that */ 7902 if ((frameptr & 4) && 7903 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) { 7904 frameptr -= 4; 7905 xpsr |= XPSR_SPREALIGN; 7906 } 7907 7908 frameptr -= 0x20; 7909 7910 if (arm_feature(env, ARM_FEATURE_V8)) { 7911 uint32_t limit = v7m_sp_limit(env); 7912 7913 if (frameptr < limit) { 7914 /* 7915 * Stack limit failure: set SP to the limit value, and generate 7916 * STKOF UsageFault. Stack pushes below the limit must not be 7917 * performed. It is IMPDEF whether pushes above the limit are 7918 * performed; we choose not to. 7919 */ 7920 qemu_log_mask(CPU_LOG_INT, 7921 "...STKOF during stacking\n"); 7922 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 7923 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 7924 env->v7m.secure); 7925 env->regs[13] = limit; 7926 return true; 7927 } 7928 } 7929 7930 /* Write as much of the stack frame as we can. If we fail a stack 7931 * write this will result in a derived exception being pended 7932 * (which may be taken in preference to the one we started with 7933 * if it has higher priority). 7934 */ 7935 stacked_ok = 7936 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, false) && 7937 v7m_stack_write(cpu, frameptr + 4, env->regs[1], mmu_idx, false) && 7938 v7m_stack_write(cpu, frameptr + 8, env->regs[2], mmu_idx, false) && 7939 v7m_stack_write(cpu, frameptr + 12, env->regs[3], mmu_idx, false) && 7940 v7m_stack_write(cpu, frameptr + 16, env->regs[12], mmu_idx, false) && 7941 v7m_stack_write(cpu, frameptr + 20, env->regs[14], mmu_idx, false) && 7942 v7m_stack_write(cpu, frameptr + 24, env->regs[15], mmu_idx, false) && 7943 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, false); 7944 7945 /* Update SP regardless of whether any of the stack accesses failed. */ 7946 env->regs[13] = frameptr; 7947 7948 return !stacked_ok; 7949 } 7950 7951 static void do_v7m_exception_exit(ARMCPU *cpu) 7952 { 7953 CPUARMState *env = &cpu->env; 7954 uint32_t excret; 7955 uint32_t xpsr; 7956 bool ufault = false; 7957 bool sfault = false; 7958 bool return_to_sp_process; 7959 bool return_to_handler; 7960 bool rettobase = false; 7961 bool exc_secure = false; 7962 bool return_to_secure; 7963 7964 /* If we're not in Handler mode then jumps to magic exception-exit 7965 * addresses don't have magic behaviour. However for the v8M 7966 * security extensions the magic secure-function-return has to 7967 * work in thread mode too, so to avoid doing an extra check in 7968 * the generated code we allow exception-exit magic to also cause the 7969 * internal exception and bring us here in thread mode. Correct code 7970 * will never try to do this (the following insn fetch will always 7971 * fault) so we the overhead of having taken an unnecessary exception 7972 * doesn't matter. 7973 */ 7974 if (!arm_v7m_is_handler_mode(env)) { 7975 return; 7976 } 7977 7978 /* In the spec pseudocode ExceptionReturn() is called directly 7979 * from BXWritePC() and gets the full target PC value including 7980 * bit zero. In QEMU's implementation we treat it as a normal 7981 * jump-to-register (which is then caught later on), and so split 7982 * the target value up between env->regs[15] and env->thumb in 7983 * gen_bx(). Reconstitute it. 7984 */ 7985 excret = env->regs[15]; 7986 if (env->thumb) { 7987 excret |= 1; 7988 } 7989 7990 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32 7991 " previous exception %d\n", 7992 excret, env->v7m.exception); 7993 7994 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) { 7995 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception " 7996 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", 7997 excret); 7998 } 7999 8000 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8001 /* EXC_RETURN.ES validation check (R_SMFL). We must do this before 8002 * we pick which FAULTMASK to clear. 8003 */ 8004 if (!env->v7m.secure && 8005 ((excret & R_V7M_EXCRET_ES_MASK) || 8006 !(excret & R_V7M_EXCRET_DCRS_MASK))) { 8007 sfault = 1; 8008 /* For all other purposes, treat ES as 0 (R_HXSR) */ 8009 excret &= ~R_V7M_EXCRET_ES_MASK; 8010 } 8011 exc_secure = excret & R_V7M_EXCRET_ES_MASK; 8012 } 8013 8014 if (env->v7m.exception != ARMV7M_EXCP_NMI) { 8015 /* Auto-clear FAULTMASK on return from other than NMI. 8016 * If the security extension is implemented then this only 8017 * happens if the raw execution priority is >= 0; the 8018 * value of the ES bit in the exception return value indicates 8019 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.) 8020 */ 8021 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8022 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) { 8023 env->v7m.faultmask[exc_secure] = 0; 8024 } 8025 } else { 8026 env->v7m.faultmask[M_REG_NS] = 0; 8027 } 8028 } 8029 8030 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception, 8031 exc_secure)) { 8032 case -1: 8033 /* attempt to exit an exception that isn't active */ 8034 ufault = true; 8035 break; 8036 case 0: 8037 /* still an irq active now */ 8038 break; 8039 case 1: 8040 /* we returned to base exception level, no nesting. 8041 * (In the pseudocode this is written using "NestedActivation != 1" 8042 * where we have 'rettobase == false'.) 8043 */ 8044 rettobase = true; 8045 break; 8046 default: 8047 g_assert_not_reached(); 8048 } 8049 8050 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK); 8051 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK; 8052 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) && 8053 (excret & R_V7M_EXCRET_S_MASK); 8054 8055 if (arm_feature(env, ARM_FEATURE_V8)) { 8056 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8057 /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP); 8058 * we choose to take the UsageFault. 8059 */ 8060 if ((excret & R_V7M_EXCRET_S_MASK) || 8061 (excret & R_V7M_EXCRET_ES_MASK) || 8062 !(excret & R_V7M_EXCRET_DCRS_MASK)) { 8063 ufault = true; 8064 } 8065 } 8066 if (excret & R_V7M_EXCRET_RES0_MASK) { 8067 ufault = true; 8068 } 8069 } else { 8070 /* For v7M we only recognize certain combinations of the low bits */ 8071 switch (excret & 0xf) { 8072 case 1: /* Return to Handler */ 8073 break; 8074 case 13: /* Return to Thread using Process stack */ 8075 case 9: /* Return to Thread using Main stack */ 8076 /* We only need to check NONBASETHRDENA for v7M, because in 8077 * v8M this bit does not exist (it is RES1). 8078 */ 8079 if (!rettobase && 8080 !(env->v7m.ccr[env->v7m.secure] & 8081 R_V7M_CCR_NONBASETHRDENA_MASK)) { 8082 ufault = true; 8083 } 8084 break; 8085 default: 8086 ufault = true; 8087 } 8088 } 8089 8090 /* 8091 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in 8092 * Handler mode (and will be until we write the new XPSR.Interrupt 8093 * field) this does not switch around the current stack pointer. 8094 * We must do this before we do any kind of tailchaining, including 8095 * for the derived exceptions on integrity check failures, or we will 8096 * give the guest an incorrect EXCRET.SPSEL value on exception entry. 8097 */ 8098 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure); 8099 8100 if (sfault) { 8101 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK; 8102 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8103 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8104 "stackframe: failed EXC_RETURN.ES validity check\n"); 8105 v7m_exception_taken(cpu, excret, true, false); 8106 return; 8107 } 8108 8109 if (ufault) { 8110 /* Bad exception return: instead of popping the exception 8111 * stack, directly take a usage fault on the current stack. 8112 */ 8113 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8114 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8115 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " 8116 "stackframe: failed exception return integrity check\n"); 8117 v7m_exception_taken(cpu, excret, true, false); 8118 return; 8119 } 8120 8121 /* 8122 * Tailchaining: if there is currently a pending exception that 8123 * is high enough priority to preempt execution at the level we're 8124 * about to return to, then just directly take that exception now, 8125 * avoiding an unstack-and-then-stack. Note that now we have 8126 * deactivated the previous exception by calling armv7m_nvic_complete_irq() 8127 * our current execution priority is already the execution priority we are 8128 * returning to -- none of the state we would unstack or set based on 8129 * the EXCRET value affects it. 8130 */ 8131 if (armv7m_nvic_can_take_pending_exception(env->nvic)) { 8132 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n"); 8133 v7m_exception_taken(cpu, excret, true, false); 8134 return; 8135 } 8136 8137 switch_v7m_security_state(env, return_to_secure); 8138 8139 { 8140 /* The stack pointer we should be reading the exception frame from 8141 * depends on bits in the magic exception return type value (and 8142 * for v8M isn't necessarily the stack pointer we will eventually 8143 * end up resuming execution with). Get a pointer to the location 8144 * in the CPU state struct where the SP we need is currently being 8145 * stored; we will use and modify it in place. 8146 * We use this limited C variable scope so we don't accidentally 8147 * use 'frame_sp_p' after we do something that makes it invalid. 8148 */ 8149 uint32_t *frame_sp_p = get_v7m_sp_ptr(env, 8150 return_to_secure, 8151 !return_to_handler, 8152 return_to_sp_process); 8153 uint32_t frameptr = *frame_sp_p; 8154 bool pop_ok = true; 8155 ARMMMUIdx mmu_idx; 8156 bool return_to_priv = return_to_handler || 8157 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK); 8158 8159 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure, 8160 return_to_priv); 8161 8162 if (!QEMU_IS_ALIGNED(frameptr, 8) && 8163 arm_feature(env, ARM_FEATURE_V8)) { 8164 qemu_log_mask(LOG_GUEST_ERROR, 8165 "M profile exception return with non-8-aligned SP " 8166 "for destination state is UNPREDICTABLE\n"); 8167 } 8168 8169 /* Do we need to pop callee-saved registers? */ 8170 if (return_to_secure && 8171 ((excret & R_V7M_EXCRET_ES_MASK) == 0 || 8172 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) { 8173 uint32_t expected_sig = 0xfefa125b; 8174 uint32_t actual_sig; 8175 8176 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx); 8177 8178 if (pop_ok && expected_sig != actual_sig) { 8179 /* Take a SecureFault on the current stack */ 8180 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK; 8181 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8182 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8183 "stackframe: failed exception return integrity " 8184 "signature check\n"); 8185 v7m_exception_taken(cpu, excret, true, false); 8186 return; 8187 } 8188 8189 pop_ok = pop_ok && 8190 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) && 8191 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) && 8192 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) && 8193 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) && 8194 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) && 8195 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) && 8196 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) && 8197 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx); 8198 8199 frameptr += 0x28; 8200 } 8201 8202 /* Pop registers */ 8203 pop_ok = pop_ok && 8204 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) && 8205 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) && 8206 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) && 8207 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) && 8208 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) && 8209 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) && 8210 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) && 8211 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx); 8212 8213 if (!pop_ok) { 8214 /* v7m_stack_read() pended a fault, so take it (as a tail 8215 * chained exception on the same stack frame) 8216 */ 8217 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n"); 8218 v7m_exception_taken(cpu, excret, true, false); 8219 return; 8220 } 8221 8222 /* Returning from an exception with a PC with bit 0 set is defined 8223 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified 8224 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore 8225 * the lsbit, and there are several RTOSes out there which incorrectly 8226 * assume the r15 in the stack frame should be a Thumb-style "lsbit 8227 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but 8228 * complain about the badly behaved guest. 8229 */ 8230 if (env->regs[15] & 1) { 8231 env->regs[15] &= ~1U; 8232 if (!arm_feature(env, ARM_FEATURE_V8)) { 8233 qemu_log_mask(LOG_GUEST_ERROR, 8234 "M profile return from interrupt with misaligned " 8235 "PC is UNPREDICTABLE on v7M\n"); 8236 } 8237 } 8238 8239 if (arm_feature(env, ARM_FEATURE_V8)) { 8240 /* For v8M we have to check whether the xPSR exception field 8241 * matches the EXCRET value for return to handler/thread 8242 * before we commit to changing the SP and xPSR. 8243 */ 8244 bool will_be_handler = (xpsr & XPSR_EXCP) != 0; 8245 if (return_to_handler != will_be_handler) { 8246 /* Take an INVPC UsageFault on the current stack. 8247 * By this point we will have switched to the security state 8248 * for the background state, so this UsageFault will target 8249 * that state. 8250 */ 8251 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8252 env->v7m.secure); 8253 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8254 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " 8255 "stackframe: failed exception return integrity " 8256 "check\n"); 8257 v7m_exception_taken(cpu, excret, true, false); 8258 return; 8259 } 8260 } 8261 8262 /* Commit to consuming the stack frame */ 8263 frameptr += 0x20; 8264 /* Undo stack alignment (the SPREALIGN bit indicates that the original 8265 * pre-exception SP was not 8-aligned and we added a padding word to 8266 * align it, so we undo this by ORing in the bit that increases it 8267 * from the current 8-aligned value to the 8-unaligned value. (Adding 4 8268 * would work too but a logical OR is how the pseudocode specifies it.) 8269 */ 8270 if (xpsr & XPSR_SPREALIGN) { 8271 frameptr |= 4; 8272 } 8273 *frame_sp_p = frameptr; 8274 } 8275 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */ 8276 xpsr_write(env, xpsr, ~XPSR_SPREALIGN); 8277 8278 /* The restored xPSR exception field will be zero if we're 8279 * resuming in Thread mode. If that doesn't match what the 8280 * exception return excret specified then this is a UsageFault. 8281 * v7M requires we make this check here; v8M did it earlier. 8282 */ 8283 if (return_to_handler != arm_v7m_is_handler_mode(env)) { 8284 /* Take an INVPC UsageFault by pushing the stack again; 8285 * we know we're v7M so this is never a Secure UsageFault. 8286 */ 8287 bool ignore_stackfaults; 8288 8289 assert(!arm_feature(env, ARM_FEATURE_V8)); 8290 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false); 8291 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8292 ignore_stackfaults = v7m_push_stack(cpu); 8293 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: " 8294 "failed exception return integrity check\n"); 8295 v7m_exception_taken(cpu, excret, false, ignore_stackfaults); 8296 return; 8297 } 8298 8299 /* Otherwise, we have a successful exception exit. */ 8300 arm_clear_exclusive(env); 8301 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n"); 8302 } 8303 8304 static bool do_v7m_function_return(ARMCPU *cpu) 8305 { 8306 /* v8M security extensions magic function return. 8307 * We may either: 8308 * (1) throw an exception (longjump) 8309 * (2) return true if we successfully handled the function return 8310 * (3) return false if we failed a consistency check and have 8311 * pended a UsageFault that needs to be taken now 8312 * 8313 * At this point the magic return value is split between env->regs[15] 8314 * and env->thumb. We don't bother to reconstitute it because we don't 8315 * need it (all values are handled the same way). 8316 */ 8317 CPUARMState *env = &cpu->env; 8318 uint32_t newpc, newpsr, newpsr_exc; 8319 8320 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n"); 8321 8322 { 8323 bool threadmode, spsel; 8324 TCGMemOpIdx oi; 8325 ARMMMUIdx mmu_idx; 8326 uint32_t *frame_sp_p; 8327 uint32_t frameptr; 8328 8329 /* Pull the return address and IPSR from the Secure stack */ 8330 threadmode = !arm_v7m_is_handler_mode(env); 8331 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK; 8332 8333 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel); 8334 frameptr = *frame_sp_p; 8335 8336 /* These loads may throw an exception (for MPU faults). We want to 8337 * do them as secure, so work out what MMU index that is. 8338 */ 8339 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true); 8340 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx)); 8341 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0); 8342 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0); 8343 8344 /* Consistency checks on new IPSR */ 8345 newpsr_exc = newpsr & XPSR_EXCP; 8346 if (!((env->v7m.exception == 0 && newpsr_exc == 0) || 8347 (env->v7m.exception == 1 && newpsr_exc != 0))) { 8348 /* Pend the fault and tell our caller to take it */ 8349 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8350 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8351 env->v7m.secure); 8352 qemu_log_mask(CPU_LOG_INT, 8353 "...taking INVPC UsageFault: " 8354 "IPSR consistency check failed\n"); 8355 return false; 8356 } 8357 8358 *frame_sp_p = frameptr + 8; 8359 } 8360 8361 /* This invalidates frame_sp_p */ 8362 switch_v7m_security_state(env, true); 8363 env->v7m.exception = newpsr_exc; 8364 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 8365 if (newpsr & XPSR_SFPA) { 8366 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK; 8367 } 8368 xpsr_write(env, 0, XPSR_IT); 8369 env->thumb = newpc & 1; 8370 env->regs[15] = newpc & ~1; 8371 8372 qemu_log_mask(CPU_LOG_INT, "...function return successful\n"); 8373 return true; 8374 } 8375 8376 static void arm_log_exception(int idx) 8377 { 8378 if (qemu_loglevel_mask(CPU_LOG_INT)) { 8379 const char *exc = NULL; 8380 static const char * const excnames[] = { 8381 [EXCP_UDEF] = "Undefined Instruction", 8382 [EXCP_SWI] = "SVC", 8383 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 8384 [EXCP_DATA_ABORT] = "Data Abort", 8385 [EXCP_IRQ] = "IRQ", 8386 [EXCP_FIQ] = "FIQ", 8387 [EXCP_BKPT] = "Breakpoint", 8388 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 8389 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 8390 [EXCP_HVC] = "Hypervisor Call", 8391 [EXCP_HYP_TRAP] = "Hypervisor Trap", 8392 [EXCP_SMC] = "Secure Monitor Call", 8393 [EXCP_VIRQ] = "Virtual IRQ", 8394 [EXCP_VFIQ] = "Virtual FIQ", 8395 [EXCP_SEMIHOST] = "Semihosting call", 8396 [EXCP_NOCP] = "v7M NOCP UsageFault", 8397 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 8398 [EXCP_STKOF] = "v8M STKOF UsageFault", 8399 }; 8400 8401 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 8402 exc = excnames[idx]; 8403 } 8404 if (!exc) { 8405 exc = "unknown"; 8406 } 8407 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc); 8408 } 8409 } 8410 8411 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, 8412 uint32_t addr, uint16_t *insn) 8413 { 8414 /* Load a 16-bit portion of a v7M instruction, returning true on success, 8415 * or false on failure (in which case we will have pended the appropriate 8416 * exception). 8417 * We need to do the instruction fetch's MPU and SAU checks 8418 * like this because there is no MMU index that would allow 8419 * doing the load with a single function call. Instead we must 8420 * first check that the security attributes permit the load 8421 * and that they don't mismatch on the two halves of the instruction, 8422 * and then we do the load as a secure load (ie using the security 8423 * attributes of the address, not the CPU, as architecturally required). 8424 */ 8425 CPUState *cs = CPU(cpu); 8426 CPUARMState *env = &cpu->env; 8427 V8M_SAttributes sattrs = {}; 8428 MemTxAttrs attrs = {}; 8429 ARMMMUFaultInfo fi = {}; 8430 MemTxResult txres; 8431 target_ulong page_size; 8432 hwaddr physaddr; 8433 int prot; 8434 8435 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs); 8436 if (!sattrs.nsc || sattrs.ns) { 8437 /* This must be the second half of the insn, and it straddles a 8438 * region boundary with the second half not being S&NSC. 8439 */ 8440 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 8441 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8442 qemu_log_mask(CPU_LOG_INT, 8443 "...really SecureFault with SFSR.INVEP\n"); 8444 return false; 8445 } 8446 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx, 8447 &physaddr, &attrs, &prot, &page_size, &fi, NULL)) { 8448 /* the MPU lookup failed */ 8449 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK; 8450 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure); 8451 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n"); 8452 return false; 8453 } 8454 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr, 8455 attrs, &txres); 8456 if (txres != MEMTX_OK) { 8457 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; 8458 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); 8459 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n"); 8460 return false; 8461 } 8462 return true; 8463 } 8464 8465 static bool v7m_handle_execute_nsc(ARMCPU *cpu) 8466 { 8467 /* Check whether this attempt to execute code in a Secure & NS-Callable 8468 * memory region is for an SG instruction; if so, then emulate the 8469 * effect of the SG instruction and return true. Otherwise pend 8470 * the correct kind of exception and return false. 8471 */ 8472 CPUARMState *env = &cpu->env; 8473 ARMMMUIdx mmu_idx; 8474 uint16_t insn; 8475 8476 /* We should never get here unless get_phys_addr_pmsav8() caused 8477 * an exception for NS executing in S&NSC memory. 8478 */ 8479 assert(!env->v7m.secure); 8480 assert(arm_feature(env, ARM_FEATURE_M_SECURITY)); 8481 8482 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */ 8483 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true); 8484 8485 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) { 8486 return false; 8487 } 8488 8489 if (!env->thumb) { 8490 goto gen_invep; 8491 } 8492 8493 if (insn != 0xe97f) { 8494 /* Not an SG instruction first half (we choose the IMPDEF 8495 * early-SG-check option). 8496 */ 8497 goto gen_invep; 8498 } 8499 8500 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) { 8501 return false; 8502 } 8503 8504 if (insn != 0xe97f) { 8505 /* Not an SG instruction second half (yes, both halves of the SG 8506 * insn have the same hex value) 8507 */ 8508 goto gen_invep; 8509 } 8510 8511 /* OK, we have confirmed that we really have an SG instruction. 8512 * We know we're NS in S memory so don't need to repeat those checks. 8513 */ 8514 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32 8515 ", executing it\n", env->regs[15]); 8516 env->regs[14] &= ~1; 8517 switch_v7m_security_state(env, true); 8518 xpsr_write(env, 0, XPSR_IT); 8519 env->regs[15] += 4; 8520 return true; 8521 8522 gen_invep: 8523 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 8524 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8525 qemu_log_mask(CPU_LOG_INT, 8526 "...really SecureFault with SFSR.INVEP\n"); 8527 return false; 8528 } 8529 8530 void arm_v7m_cpu_do_interrupt(CPUState *cs) 8531 { 8532 ARMCPU *cpu = ARM_CPU(cs); 8533 CPUARMState *env = &cpu->env; 8534 uint32_t lr; 8535 bool ignore_stackfaults; 8536 8537 arm_log_exception(cs->exception_index); 8538 8539 /* For exceptions we just mark as pending on the NVIC, and let that 8540 handle it. */ 8541 switch (cs->exception_index) { 8542 case EXCP_UDEF: 8543 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8544 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK; 8545 break; 8546 case EXCP_NOCP: 8547 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8548 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK; 8549 break; 8550 case EXCP_INVSTATE: 8551 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8552 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK; 8553 break; 8554 case EXCP_STKOF: 8555 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8556 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 8557 break; 8558 case EXCP_SWI: 8559 /* The PC already points to the next instruction. */ 8560 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure); 8561 break; 8562 case EXCP_PREFETCH_ABORT: 8563 case EXCP_DATA_ABORT: 8564 /* Note that for M profile we don't have a guest facing FSR, but 8565 * the env->exception.fsr will be populated by the code that 8566 * raises the fault, in the A profile short-descriptor format. 8567 */ 8568 switch (env->exception.fsr & 0xf) { 8569 case M_FAKE_FSR_NSC_EXEC: 8570 /* Exception generated when we try to execute code at an address 8571 * which is marked as Secure & Non-Secure Callable and the CPU 8572 * is in the Non-Secure state. The only instruction which can 8573 * be executed like this is SG (and that only if both halves of 8574 * the SG instruction have the same security attributes.) 8575 * Everything else must generate an INVEP SecureFault, so we 8576 * emulate the SG instruction here. 8577 */ 8578 if (v7m_handle_execute_nsc(cpu)) { 8579 return; 8580 } 8581 break; 8582 case M_FAKE_FSR_SFAULT: 8583 /* Various flavours of SecureFault for attempts to execute or 8584 * access data in the wrong security state. 8585 */ 8586 switch (cs->exception_index) { 8587 case EXCP_PREFETCH_ABORT: 8588 if (env->v7m.secure) { 8589 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK; 8590 qemu_log_mask(CPU_LOG_INT, 8591 "...really SecureFault with SFSR.INVTRAN\n"); 8592 } else { 8593 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 8594 qemu_log_mask(CPU_LOG_INT, 8595 "...really SecureFault with SFSR.INVEP\n"); 8596 } 8597 break; 8598 case EXCP_DATA_ABORT: 8599 /* This must be an NS access to S memory */ 8600 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK; 8601 qemu_log_mask(CPU_LOG_INT, 8602 "...really SecureFault with SFSR.AUVIOL\n"); 8603 break; 8604 } 8605 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8606 break; 8607 case 0x8: /* External Abort */ 8608 switch (cs->exception_index) { 8609 case EXCP_PREFETCH_ABORT: 8610 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; 8611 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n"); 8612 break; 8613 case EXCP_DATA_ABORT: 8614 env->v7m.cfsr[M_REG_NS] |= 8615 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK); 8616 env->v7m.bfar = env->exception.vaddress; 8617 qemu_log_mask(CPU_LOG_INT, 8618 "...with CFSR.PRECISERR and BFAR 0x%x\n", 8619 env->v7m.bfar); 8620 break; 8621 } 8622 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); 8623 break; 8624 default: 8625 /* All other FSR values are either MPU faults or "can't happen 8626 * for M profile" cases. 8627 */ 8628 switch (cs->exception_index) { 8629 case EXCP_PREFETCH_ABORT: 8630 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK; 8631 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n"); 8632 break; 8633 case EXCP_DATA_ABORT: 8634 env->v7m.cfsr[env->v7m.secure] |= 8635 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK); 8636 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress; 8637 qemu_log_mask(CPU_LOG_INT, 8638 "...with CFSR.DACCVIOL and MMFAR 0x%x\n", 8639 env->v7m.mmfar[env->v7m.secure]); 8640 break; 8641 } 8642 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, 8643 env->v7m.secure); 8644 break; 8645 } 8646 break; 8647 case EXCP_BKPT: 8648 if (semihosting_enabled()) { 8649 int nr; 8650 nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff; 8651 if (nr == 0xab) { 8652 env->regs[15] += 2; 8653 qemu_log_mask(CPU_LOG_INT, 8654 "...handling as semihosting call 0x%x\n", 8655 env->regs[0]); 8656 env->regs[0] = do_arm_semihosting(env); 8657 return; 8658 } 8659 } 8660 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false); 8661 break; 8662 case EXCP_IRQ: 8663 break; 8664 case EXCP_EXCEPTION_EXIT: 8665 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) { 8666 /* Must be v8M security extension function return */ 8667 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC); 8668 assert(arm_feature(env, ARM_FEATURE_M_SECURITY)); 8669 if (do_v7m_function_return(cpu)) { 8670 return; 8671 } 8672 } else { 8673 do_v7m_exception_exit(cpu); 8674 return; 8675 } 8676 break; 8677 default: 8678 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 8679 return; /* Never happens. Keep compiler happy. */ 8680 } 8681 8682 if (arm_feature(env, ARM_FEATURE_V8)) { 8683 lr = R_V7M_EXCRET_RES1_MASK | 8684 R_V7M_EXCRET_DCRS_MASK | 8685 R_V7M_EXCRET_FTYPE_MASK; 8686 /* The S bit indicates whether we should return to Secure 8687 * or NonSecure (ie our current state). 8688 * The ES bit indicates whether we're taking this exception 8689 * to Secure or NonSecure (ie our target state). We set it 8690 * later, in v7m_exception_taken(). 8691 * The SPSEL bit is also set in v7m_exception_taken() for v8M. 8692 * This corresponds to the ARM ARM pseudocode for v8M setting 8693 * some LR bits in PushStack() and some in ExceptionTaken(); 8694 * the distinction matters for the tailchain cases where we 8695 * can take an exception without pushing the stack. 8696 */ 8697 if (env->v7m.secure) { 8698 lr |= R_V7M_EXCRET_S_MASK; 8699 } 8700 } else { 8701 lr = R_V7M_EXCRET_RES1_MASK | 8702 R_V7M_EXCRET_S_MASK | 8703 R_V7M_EXCRET_DCRS_MASK | 8704 R_V7M_EXCRET_FTYPE_MASK | 8705 R_V7M_EXCRET_ES_MASK; 8706 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) { 8707 lr |= R_V7M_EXCRET_SPSEL_MASK; 8708 } 8709 } 8710 if (!arm_v7m_is_handler_mode(env)) { 8711 lr |= R_V7M_EXCRET_MODE_MASK; 8712 } 8713 8714 ignore_stackfaults = v7m_push_stack(cpu); 8715 v7m_exception_taken(cpu, lr, false, ignore_stackfaults); 8716 } 8717 8718 /* Function used to synchronize QEMU's AArch64 register set with AArch32 8719 * register set. This is necessary when switching between AArch32 and AArch64 8720 * execution state. 8721 */ 8722 void aarch64_sync_32_to_64(CPUARMState *env) 8723 { 8724 int i; 8725 uint32_t mode = env->uncached_cpsr & CPSR_M; 8726 8727 /* We can blanket copy R[0:7] to X[0:7] */ 8728 for (i = 0; i < 8; i++) { 8729 env->xregs[i] = env->regs[i]; 8730 } 8731 8732 /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 8733 * Otherwise, they come from the banked user regs. 8734 */ 8735 if (mode == ARM_CPU_MODE_FIQ) { 8736 for (i = 8; i < 13; i++) { 8737 env->xregs[i] = env->usr_regs[i - 8]; 8738 } 8739 } else { 8740 for (i = 8; i < 13; i++) { 8741 env->xregs[i] = env->regs[i]; 8742 } 8743 } 8744 8745 /* Registers x13-x23 are the various mode SP and FP registers. Registers 8746 * r13 and r14 are only copied if we are in that mode, otherwise we copy 8747 * from the mode banked register. 8748 */ 8749 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 8750 env->xregs[13] = env->regs[13]; 8751 env->xregs[14] = env->regs[14]; 8752 } else { 8753 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 8754 /* HYP is an exception in that it is copied from r14 */ 8755 if (mode == ARM_CPU_MODE_HYP) { 8756 env->xregs[14] = env->regs[14]; 8757 } else { 8758 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 8759 } 8760 } 8761 8762 if (mode == ARM_CPU_MODE_HYP) { 8763 env->xregs[15] = env->regs[13]; 8764 } else { 8765 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 8766 } 8767 8768 if (mode == ARM_CPU_MODE_IRQ) { 8769 env->xregs[16] = env->regs[14]; 8770 env->xregs[17] = env->regs[13]; 8771 } else { 8772 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 8773 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 8774 } 8775 8776 if (mode == ARM_CPU_MODE_SVC) { 8777 env->xregs[18] = env->regs[14]; 8778 env->xregs[19] = env->regs[13]; 8779 } else { 8780 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 8781 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 8782 } 8783 8784 if (mode == ARM_CPU_MODE_ABT) { 8785 env->xregs[20] = env->regs[14]; 8786 env->xregs[21] = env->regs[13]; 8787 } else { 8788 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 8789 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 8790 } 8791 8792 if (mode == ARM_CPU_MODE_UND) { 8793 env->xregs[22] = env->regs[14]; 8794 env->xregs[23] = env->regs[13]; 8795 } else { 8796 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 8797 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 8798 } 8799 8800 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 8801 * mode, then we can copy from r8-r14. Otherwise, we copy from the 8802 * FIQ bank for r8-r14. 8803 */ 8804 if (mode == ARM_CPU_MODE_FIQ) { 8805 for (i = 24; i < 31; i++) { 8806 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 8807 } 8808 } else { 8809 for (i = 24; i < 29; i++) { 8810 env->xregs[i] = env->fiq_regs[i - 24]; 8811 } 8812 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 8813 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 8814 } 8815 8816 env->pc = env->regs[15]; 8817 } 8818 8819 /* Function used to synchronize QEMU's AArch32 register set with AArch64 8820 * register set. This is necessary when switching between AArch32 and AArch64 8821 * execution state. 8822 */ 8823 void aarch64_sync_64_to_32(CPUARMState *env) 8824 { 8825 int i; 8826 uint32_t mode = env->uncached_cpsr & CPSR_M; 8827 8828 /* We can blanket copy X[0:7] to R[0:7] */ 8829 for (i = 0; i < 8; i++) { 8830 env->regs[i] = env->xregs[i]; 8831 } 8832 8833 /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 8834 * Otherwise, we copy x8-x12 into the banked user regs. 8835 */ 8836 if (mode == ARM_CPU_MODE_FIQ) { 8837 for (i = 8; i < 13; i++) { 8838 env->usr_regs[i - 8] = env->xregs[i]; 8839 } 8840 } else { 8841 for (i = 8; i < 13; i++) { 8842 env->regs[i] = env->xregs[i]; 8843 } 8844 } 8845 8846 /* Registers r13 & r14 depend on the current mode. 8847 * If we are in a given mode, we copy the corresponding x registers to r13 8848 * and r14. Otherwise, we copy the x register to the banked r13 and r14 8849 * for the mode. 8850 */ 8851 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 8852 env->regs[13] = env->xregs[13]; 8853 env->regs[14] = env->xregs[14]; 8854 } else { 8855 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 8856 8857 /* HYP is an exception in that it does not have its own banked r14 but 8858 * shares the USR r14 8859 */ 8860 if (mode == ARM_CPU_MODE_HYP) { 8861 env->regs[14] = env->xregs[14]; 8862 } else { 8863 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 8864 } 8865 } 8866 8867 if (mode == ARM_CPU_MODE_HYP) { 8868 env->regs[13] = env->xregs[15]; 8869 } else { 8870 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 8871 } 8872 8873 if (mode == ARM_CPU_MODE_IRQ) { 8874 env->regs[14] = env->xregs[16]; 8875 env->regs[13] = env->xregs[17]; 8876 } else { 8877 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 8878 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 8879 } 8880 8881 if (mode == ARM_CPU_MODE_SVC) { 8882 env->regs[14] = env->xregs[18]; 8883 env->regs[13] = env->xregs[19]; 8884 } else { 8885 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 8886 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 8887 } 8888 8889 if (mode == ARM_CPU_MODE_ABT) { 8890 env->regs[14] = env->xregs[20]; 8891 env->regs[13] = env->xregs[21]; 8892 } else { 8893 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 8894 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 8895 } 8896 8897 if (mode == ARM_CPU_MODE_UND) { 8898 env->regs[14] = env->xregs[22]; 8899 env->regs[13] = env->xregs[23]; 8900 } else { 8901 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 8902 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 8903 } 8904 8905 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 8906 * mode, then we can copy to r8-r14. Otherwise, we copy to the 8907 * FIQ bank for r8-r14. 8908 */ 8909 if (mode == ARM_CPU_MODE_FIQ) { 8910 for (i = 24; i < 31; i++) { 8911 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 8912 } 8913 } else { 8914 for (i = 24; i < 29; i++) { 8915 env->fiq_regs[i - 24] = env->xregs[i]; 8916 } 8917 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 8918 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 8919 } 8920 8921 env->regs[15] = env->pc; 8922 } 8923 8924 static void take_aarch32_exception(CPUARMState *env, int new_mode, 8925 uint32_t mask, uint32_t offset, 8926 uint32_t newpc) 8927 { 8928 /* Change the CPU state so as to actually take the exception. */ 8929 switch_mode(env, new_mode); 8930 /* 8931 * For exceptions taken to AArch32 we must clear the SS bit in both 8932 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 8933 */ 8934 env->uncached_cpsr &= ~PSTATE_SS; 8935 env->spsr = cpsr_read(env); 8936 /* Clear IT bits. */ 8937 env->condexec_bits = 0; 8938 /* Switch to the new mode, and to the correct instruction set. */ 8939 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 8940 /* Set new mode endianness */ 8941 env->uncached_cpsr &= ~CPSR_E; 8942 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) { 8943 env->uncached_cpsr |= CPSR_E; 8944 } 8945 /* J and IL must always be cleared for exception entry */ 8946 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 8947 env->daif |= mask; 8948 8949 if (new_mode == ARM_CPU_MODE_HYP) { 8950 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 8951 env->elr_el[2] = env->regs[15]; 8952 } else { 8953 /* 8954 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 8955 * and we should just guard the thumb mode on V4 8956 */ 8957 if (arm_feature(env, ARM_FEATURE_V4T)) { 8958 env->thumb = 8959 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 8960 } 8961 env->regs[14] = env->regs[15] + offset; 8962 } 8963 env->regs[15] = newpc; 8964 } 8965 8966 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 8967 { 8968 /* 8969 * Handle exception entry to Hyp mode; this is sufficiently 8970 * different to entry to other AArch32 modes that we handle it 8971 * separately here. 8972 * 8973 * The vector table entry used is always the 0x14 Hyp mode entry point, 8974 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp. 8975 * The offset applied to the preferred return address is always zero 8976 * (see DDI0487C.a section G1.12.3). 8977 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 8978 */ 8979 uint32_t addr, mask; 8980 ARMCPU *cpu = ARM_CPU(cs); 8981 CPUARMState *env = &cpu->env; 8982 8983 switch (cs->exception_index) { 8984 case EXCP_UDEF: 8985 addr = 0x04; 8986 break; 8987 case EXCP_SWI: 8988 addr = 0x14; 8989 break; 8990 case EXCP_BKPT: 8991 /* Fall through to prefetch abort. */ 8992 case EXCP_PREFETCH_ABORT: 8993 env->cp15.ifar_s = env->exception.vaddress; 8994 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 8995 (uint32_t)env->exception.vaddress); 8996 addr = 0x0c; 8997 break; 8998 case EXCP_DATA_ABORT: 8999 env->cp15.dfar_s = env->exception.vaddress; 9000 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 9001 (uint32_t)env->exception.vaddress); 9002 addr = 0x10; 9003 break; 9004 case EXCP_IRQ: 9005 addr = 0x18; 9006 break; 9007 case EXCP_FIQ: 9008 addr = 0x1c; 9009 break; 9010 case EXCP_HVC: 9011 addr = 0x08; 9012 break; 9013 case EXCP_HYP_TRAP: 9014 addr = 0x14; 9015 default: 9016 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9017 } 9018 9019 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 9020 if (!arm_feature(env, ARM_FEATURE_V8)) { 9021 /* 9022 * QEMU syndrome values are v8-style. v7 has the IL bit 9023 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 9024 * If this is a v7 CPU, squash the IL bit in those cases. 9025 */ 9026 if (cs->exception_index == EXCP_PREFETCH_ABORT || 9027 (cs->exception_index == EXCP_DATA_ABORT && 9028 !(env->exception.syndrome & ARM_EL_ISV)) || 9029 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 9030 env->exception.syndrome &= ~ARM_EL_IL; 9031 } 9032 } 9033 env->cp15.esr_el[2] = env->exception.syndrome; 9034 } 9035 9036 if (arm_current_el(env) != 2 && addr < 0x14) { 9037 addr = 0x14; 9038 } 9039 9040 mask = 0; 9041 if (!(env->cp15.scr_el3 & SCR_EA)) { 9042 mask |= CPSR_A; 9043 } 9044 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 9045 mask |= CPSR_I; 9046 } 9047 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 9048 mask |= CPSR_F; 9049 } 9050 9051 addr += env->cp15.hvbar; 9052 9053 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 9054 } 9055 9056 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 9057 { 9058 ARMCPU *cpu = ARM_CPU(cs); 9059 CPUARMState *env = &cpu->env; 9060 uint32_t addr; 9061 uint32_t mask; 9062 int new_mode; 9063 uint32_t offset; 9064 uint32_t moe; 9065 9066 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 9067 switch (syn_get_ec(env->exception.syndrome)) { 9068 case EC_BREAKPOINT: 9069 case EC_BREAKPOINT_SAME_EL: 9070 moe = 1; 9071 break; 9072 case EC_WATCHPOINT: 9073 case EC_WATCHPOINT_SAME_EL: 9074 moe = 10; 9075 break; 9076 case EC_AA32_BKPT: 9077 moe = 3; 9078 break; 9079 case EC_VECTORCATCH: 9080 moe = 5; 9081 break; 9082 default: 9083 moe = 0; 9084 break; 9085 } 9086 9087 if (moe) { 9088 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 9089 } 9090 9091 if (env->exception.target_el == 2) { 9092 arm_cpu_do_interrupt_aarch32_hyp(cs); 9093 return; 9094 } 9095 9096 switch (cs->exception_index) { 9097 case EXCP_UDEF: 9098 new_mode = ARM_CPU_MODE_UND; 9099 addr = 0x04; 9100 mask = CPSR_I; 9101 if (env->thumb) 9102 offset = 2; 9103 else 9104 offset = 4; 9105 break; 9106 case EXCP_SWI: 9107 new_mode = ARM_CPU_MODE_SVC; 9108 addr = 0x08; 9109 mask = CPSR_I; 9110 /* The PC already points to the next instruction. */ 9111 offset = 0; 9112 break; 9113 case EXCP_BKPT: 9114 /* Fall through to prefetch abort. */ 9115 case EXCP_PREFETCH_ABORT: 9116 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 9117 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 9118 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 9119 env->exception.fsr, (uint32_t)env->exception.vaddress); 9120 new_mode = ARM_CPU_MODE_ABT; 9121 addr = 0x0c; 9122 mask = CPSR_A | CPSR_I; 9123 offset = 4; 9124 break; 9125 case EXCP_DATA_ABORT: 9126 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 9127 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 9128 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 9129 env->exception.fsr, 9130 (uint32_t)env->exception.vaddress); 9131 new_mode = ARM_CPU_MODE_ABT; 9132 addr = 0x10; 9133 mask = CPSR_A | CPSR_I; 9134 offset = 8; 9135 break; 9136 case EXCP_IRQ: 9137 new_mode = ARM_CPU_MODE_IRQ; 9138 addr = 0x18; 9139 /* Disable IRQ and imprecise data aborts. */ 9140 mask = CPSR_A | CPSR_I; 9141 offset = 4; 9142 if (env->cp15.scr_el3 & SCR_IRQ) { 9143 /* IRQ routed to monitor mode */ 9144 new_mode = ARM_CPU_MODE_MON; 9145 mask |= CPSR_F; 9146 } 9147 break; 9148 case EXCP_FIQ: 9149 new_mode = ARM_CPU_MODE_FIQ; 9150 addr = 0x1c; 9151 /* Disable FIQ, IRQ and imprecise data aborts. */ 9152 mask = CPSR_A | CPSR_I | CPSR_F; 9153 if (env->cp15.scr_el3 & SCR_FIQ) { 9154 /* FIQ routed to monitor mode */ 9155 new_mode = ARM_CPU_MODE_MON; 9156 } 9157 offset = 4; 9158 break; 9159 case EXCP_VIRQ: 9160 new_mode = ARM_CPU_MODE_IRQ; 9161 addr = 0x18; 9162 /* Disable IRQ and imprecise data aborts. */ 9163 mask = CPSR_A | CPSR_I; 9164 offset = 4; 9165 break; 9166 case EXCP_VFIQ: 9167 new_mode = ARM_CPU_MODE_FIQ; 9168 addr = 0x1c; 9169 /* Disable FIQ, IRQ and imprecise data aborts. */ 9170 mask = CPSR_A | CPSR_I | CPSR_F; 9171 offset = 4; 9172 break; 9173 case EXCP_SMC: 9174 new_mode = ARM_CPU_MODE_MON; 9175 addr = 0x08; 9176 mask = CPSR_A | CPSR_I | CPSR_F; 9177 offset = 0; 9178 break; 9179 default: 9180 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9181 return; /* Never happens. Keep compiler happy. */ 9182 } 9183 9184 if (new_mode == ARM_CPU_MODE_MON) { 9185 addr += env->cp15.mvbar; 9186 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 9187 /* High vectors. When enabled, base address cannot be remapped. */ 9188 addr += 0xffff0000; 9189 } else { 9190 /* ARM v7 architectures provide a vector base address register to remap 9191 * the interrupt vector table. 9192 * This register is only followed in non-monitor mode, and is banked. 9193 * Note: only bits 31:5 are valid. 9194 */ 9195 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 9196 } 9197 9198 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 9199 env->cp15.scr_el3 &= ~SCR_NS; 9200 } 9201 9202 take_aarch32_exception(env, new_mode, mask, offset, addr); 9203 } 9204 9205 /* Handle exception entry to a target EL which is using AArch64 */ 9206 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 9207 { 9208 ARMCPU *cpu = ARM_CPU(cs); 9209 CPUARMState *env = &cpu->env; 9210 unsigned int new_el = env->exception.target_el; 9211 target_ulong addr = env->cp15.vbar_el[new_el]; 9212 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 9213 unsigned int cur_el = arm_current_el(env); 9214 9215 /* 9216 * Note that new_el can never be 0. If cur_el is 0, then 9217 * el0_a64 is is_a64(), else el0_a64 is ignored. 9218 */ 9219 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 9220 9221 if (cur_el < new_el) { 9222 /* Entry vector offset depends on whether the implemented EL 9223 * immediately lower than the target level is using AArch32 or AArch64 9224 */ 9225 bool is_aa64; 9226 9227 switch (new_el) { 9228 case 3: 9229 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 9230 break; 9231 case 2: 9232 is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0; 9233 break; 9234 case 1: 9235 is_aa64 = is_a64(env); 9236 break; 9237 default: 9238 g_assert_not_reached(); 9239 } 9240 9241 if (is_aa64) { 9242 addr += 0x400; 9243 } else { 9244 addr += 0x600; 9245 } 9246 } else if (pstate_read(env) & PSTATE_SP) { 9247 addr += 0x200; 9248 } 9249 9250 switch (cs->exception_index) { 9251 case EXCP_PREFETCH_ABORT: 9252 case EXCP_DATA_ABORT: 9253 env->cp15.far_el[new_el] = env->exception.vaddress; 9254 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 9255 env->cp15.far_el[new_el]); 9256 /* fall through */ 9257 case EXCP_BKPT: 9258 case EXCP_UDEF: 9259 case EXCP_SWI: 9260 case EXCP_HVC: 9261 case EXCP_HYP_TRAP: 9262 case EXCP_SMC: 9263 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) { 9264 /* 9265 * QEMU internal FP/SIMD syndromes from AArch32 include the 9266 * TA and coproc fields which are only exposed if the exception 9267 * is taken to AArch32 Hyp mode. Mask them out to get a valid 9268 * AArch64 format syndrome. 9269 */ 9270 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 9271 } 9272 env->cp15.esr_el[new_el] = env->exception.syndrome; 9273 break; 9274 case EXCP_IRQ: 9275 case EXCP_VIRQ: 9276 addr += 0x80; 9277 break; 9278 case EXCP_FIQ: 9279 case EXCP_VFIQ: 9280 addr += 0x100; 9281 break; 9282 case EXCP_SEMIHOST: 9283 qemu_log_mask(CPU_LOG_INT, 9284 "...handling as semihosting call 0x%" PRIx64 "\n", 9285 env->xregs[0]); 9286 env->xregs[0] = do_arm_semihosting(env); 9287 return; 9288 default: 9289 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9290 } 9291 9292 if (is_a64(env)) { 9293 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env); 9294 aarch64_save_sp(env, arm_current_el(env)); 9295 env->elr_el[new_el] = env->pc; 9296 } else { 9297 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env); 9298 env->elr_el[new_el] = env->regs[15]; 9299 9300 aarch64_sync_32_to_64(env); 9301 9302 env->condexec_bits = 0; 9303 } 9304 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 9305 env->elr_el[new_el]); 9306 9307 pstate_write(env, PSTATE_DAIF | new_mode); 9308 env->aarch64 = 1; 9309 aarch64_restore_sp(env, new_el); 9310 9311 env->pc = addr; 9312 9313 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 9314 new_el, env->pc, pstate_read(env)); 9315 } 9316 9317 static inline bool check_for_semihosting(CPUState *cs) 9318 { 9319 /* Check whether this exception is a semihosting call; if so 9320 * then handle it and return true; otherwise return false. 9321 */ 9322 ARMCPU *cpu = ARM_CPU(cs); 9323 CPUARMState *env = &cpu->env; 9324 9325 if (is_a64(env)) { 9326 if (cs->exception_index == EXCP_SEMIHOST) { 9327 /* This is always the 64-bit semihosting exception. 9328 * The "is this usermode" and "is semihosting enabled" 9329 * checks have been done at translate time. 9330 */ 9331 qemu_log_mask(CPU_LOG_INT, 9332 "...handling as semihosting call 0x%" PRIx64 "\n", 9333 env->xregs[0]); 9334 env->xregs[0] = do_arm_semihosting(env); 9335 return true; 9336 } 9337 return false; 9338 } else { 9339 uint32_t imm; 9340 9341 /* Only intercept calls from privileged modes, to provide some 9342 * semblance of security. 9343 */ 9344 if (cs->exception_index != EXCP_SEMIHOST && 9345 (!semihosting_enabled() || 9346 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) { 9347 return false; 9348 } 9349 9350 switch (cs->exception_index) { 9351 case EXCP_SEMIHOST: 9352 /* This is always a semihosting call; the "is this usermode" 9353 * and "is semihosting enabled" checks have been done at 9354 * translate time. 9355 */ 9356 break; 9357 case EXCP_SWI: 9358 /* Check for semihosting interrupt. */ 9359 if (env->thumb) { 9360 imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env)) 9361 & 0xff; 9362 if (imm == 0xab) { 9363 break; 9364 } 9365 } else { 9366 imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env)) 9367 & 0xffffff; 9368 if (imm == 0x123456) { 9369 break; 9370 } 9371 } 9372 return false; 9373 case EXCP_BKPT: 9374 /* See if this is a semihosting syscall. */ 9375 if (env->thumb) { 9376 imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) 9377 & 0xff; 9378 if (imm == 0xab) { 9379 env->regs[15] += 2; 9380 break; 9381 } 9382 } 9383 return false; 9384 default: 9385 return false; 9386 } 9387 9388 qemu_log_mask(CPU_LOG_INT, 9389 "...handling as semihosting call 0x%x\n", 9390 env->regs[0]); 9391 env->regs[0] = do_arm_semihosting(env); 9392 return true; 9393 } 9394 } 9395 9396 /* Handle a CPU exception for A and R profile CPUs. 9397 * Do any appropriate logging, handle PSCI calls, and then hand off 9398 * to the AArch64-entry or AArch32-entry function depending on the 9399 * target exception level's register width. 9400 */ 9401 void arm_cpu_do_interrupt(CPUState *cs) 9402 { 9403 ARMCPU *cpu = ARM_CPU(cs); 9404 CPUARMState *env = &cpu->env; 9405 unsigned int new_el = env->exception.target_el; 9406 9407 assert(!arm_feature(env, ARM_FEATURE_M)); 9408 9409 arm_log_exception(cs->exception_index); 9410 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 9411 new_el); 9412 if (qemu_loglevel_mask(CPU_LOG_INT) 9413 && !excp_is_internal(cs->exception_index)) { 9414 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 9415 syn_get_ec(env->exception.syndrome), 9416 env->exception.syndrome); 9417 } 9418 9419 if (arm_is_psci_call(cpu, cs->exception_index)) { 9420 arm_handle_psci_call(cpu); 9421 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 9422 return; 9423 } 9424 9425 /* Semihosting semantics depend on the register width of the 9426 * code that caused the exception, not the target exception level, 9427 * so must be handled here. 9428 */ 9429 if (check_for_semihosting(cs)) { 9430 return; 9431 } 9432 9433 /* Hooks may change global state so BQL should be held, also the 9434 * BQL needs to be held for any modification of 9435 * cs->interrupt_request. 9436 */ 9437 g_assert(qemu_mutex_iothread_locked()); 9438 9439 arm_call_pre_el_change_hook(cpu); 9440 9441 assert(!excp_is_internal(cs->exception_index)); 9442 if (arm_el_is_aa64(env, new_el)) { 9443 arm_cpu_do_interrupt_aarch64(cs); 9444 } else { 9445 arm_cpu_do_interrupt_aarch32(cs); 9446 } 9447 9448 arm_call_el_change_hook(cpu); 9449 9450 if (!kvm_enabled()) { 9451 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 9452 } 9453 } 9454 9455 /* Return the exception level which controls this address translation regime */ 9456 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx) 9457 { 9458 switch (mmu_idx) { 9459 case ARMMMUIdx_S2NS: 9460 case ARMMMUIdx_S1E2: 9461 return 2; 9462 case ARMMMUIdx_S1E3: 9463 return 3; 9464 case ARMMMUIdx_S1SE0: 9465 return arm_el_is_aa64(env, 3) ? 1 : 3; 9466 case ARMMMUIdx_S1SE1: 9467 case ARMMMUIdx_S1NSE0: 9468 case ARMMMUIdx_S1NSE1: 9469 case ARMMMUIdx_MPrivNegPri: 9470 case ARMMMUIdx_MUserNegPri: 9471 case ARMMMUIdx_MPriv: 9472 case ARMMMUIdx_MUser: 9473 case ARMMMUIdx_MSPrivNegPri: 9474 case ARMMMUIdx_MSUserNegPri: 9475 case ARMMMUIdx_MSPriv: 9476 case ARMMMUIdx_MSUser: 9477 return 1; 9478 default: 9479 g_assert_not_reached(); 9480 } 9481 } 9482 9483 /* Return the SCTLR value which controls this address translation regime */ 9484 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx) 9485 { 9486 return env->cp15.sctlr_el[regime_el(env, mmu_idx)]; 9487 } 9488 9489 /* Return true if the specified stage of address translation is disabled */ 9490 static inline bool regime_translation_disabled(CPUARMState *env, 9491 ARMMMUIdx mmu_idx) 9492 { 9493 if (arm_feature(env, ARM_FEATURE_M)) { 9494 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] & 9495 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 9496 case R_V7M_MPU_CTRL_ENABLE_MASK: 9497 /* Enabled, but not for HardFault and NMI */ 9498 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 9499 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 9500 /* Enabled for all cases */ 9501 return false; 9502 case 0: 9503 default: 9504 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 9505 * we warned about that in armv7m_nvic.c when the guest set it. 9506 */ 9507 return true; 9508 } 9509 } 9510 9511 if (mmu_idx == ARMMMUIdx_S2NS) { 9512 /* HCR.DC means HCR.VM behaves as 1 */ 9513 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0; 9514 } 9515 9516 if (env->cp15.hcr_el2 & HCR_TGE) { 9517 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */ 9518 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) { 9519 return true; 9520 } 9521 } 9522 9523 if ((env->cp15.hcr_el2 & HCR_DC) && 9524 (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) { 9525 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 9526 return true; 9527 } 9528 9529 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 9530 } 9531 9532 static inline bool regime_translation_big_endian(CPUARMState *env, 9533 ARMMMUIdx mmu_idx) 9534 { 9535 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 9536 } 9537 9538 /* Return the TCR controlling this translation regime */ 9539 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx) 9540 { 9541 if (mmu_idx == ARMMMUIdx_S2NS) { 9542 return &env->cp15.vtcr_el2; 9543 } 9544 return &env->cp15.tcr_el[regime_el(env, mmu_idx)]; 9545 } 9546 9547 /* Convert a possible stage1+2 MMU index into the appropriate 9548 * stage 1 MMU index 9549 */ 9550 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 9551 { 9552 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 9553 mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0); 9554 } 9555 return mmu_idx; 9556 } 9557 9558 /* Return the TTBR associated with this translation regime */ 9559 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, 9560 int ttbrn) 9561 { 9562 if (mmu_idx == ARMMMUIdx_S2NS) { 9563 return env->cp15.vttbr_el2; 9564 } 9565 if (ttbrn == 0) { 9566 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 9567 } else { 9568 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 9569 } 9570 } 9571 9572 /* Return true if the translation regime is using LPAE format page tables */ 9573 static inline bool regime_using_lpae_format(CPUARMState *env, 9574 ARMMMUIdx mmu_idx) 9575 { 9576 int el = regime_el(env, mmu_idx); 9577 if (el == 2 || arm_el_is_aa64(env, el)) { 9578 return true; 9579 } 9580 if (arm_feature(env, ARM_FEATURE_LPAE) 9581 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) { 9582 return true; 9583 } 9584 return false; 9585 } 9586 9587 /* Returns true if the stage 1 translation regime is using LPAE format page 9588 * tables. Used when raising alignment exceptions, whose FSR changes depending 9589 * on whether the long or short descriptor format is in use. */ 9590 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx) 9591 { 9592 mmu_idx = stage_1_mmu_idx(mmu_idx); 9593 9594 return regime_using_lpae_format(env, mmu_idx); 9595 } 9596 9597 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx) 9598 { 9599 switch (mmu_idx) { 9600 case ARMMMUIdx_S1SE0: 9601 case ARMMMUIdx_S1NSE0: 9602 case ARMMMUIdx_MUser: 9603 case ARMMMUIdx_MSUser: 9604 case ARMMMUIdx_MUserNegPri: 9605 case ARMMMUIdx_MSUserNegPri: 9606 return true; 9607 default: 9608 return false; 9609 case ARMMMUIdx_S12NSE0: 9610 case ARMMMUIdx_S12NSE1: 9611 g_assert_not_reached(); 9612 } 9613 } 9614 9615 /* Translate section/page access permissions to page 9616 * R/W protection flags 9617 * 9618 * @env: CPUARMState 9619 * @mmu_idx: MMU index indicating required translation regime 9620 * @ap: The 3-bit access permissions (AP[2:0]) 9621 * @domain_prot: The 2-bit domain access permissions 9622 */ 9623 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 9624 int ap, int domain_prot) 9625 { 9626 bool is_user = regime_is_user(env, mmu_idx); 9627 9628 if (domain_prot == 3) { 9629 return PAGE_READ | PAGE_WRITE; 9630 } 9631 9632 switch (ap) { 9633 case 0: 9634 if (arm_feature(env, ARM_FEATURE_V7)) { 9635 return 0; 9636 } 9637 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 9638 case SCTLR_S: 9639 return is_user ? 0 : PAGE_READ; 9640 case SCTLR_R: 9641 return PAGE_READ; 9642 default: 9643 return 0; 9644 } 9645 case 1: 9646 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 9647 case 2: 9648 if (is_user) { 9649 return PAGE_READ; 9650 } else { 9651 return PAGE_READ | PAGE_WRITE; 9652 } 9653 case 3: 9654 return PAGE_READ | PAGE_WRITE; 9655 case 4: /* Reserved. */ 9656 return 0; 9657 case 5: 9658 return is_user ? 0 : PAGE_READ; 9659 case 6: 9660 return PAGE_READ; 9661 case 7: 9662 if (!arm_feature(env, ARM_FEATURE_V6K)) { 9663 return 0; 9664 } 9665 return PAGE_READ; 9666 default: 9667 g_assert_not_reached(); 9668 } 9669 } 9670 9671 /* Translate section/page access permissions to page 9672 * R/W protection flags. 9673 * 9674 * @ap: The 2-bit simple AP (AP[2:1]) 9675 * @is_user: TRUE if accessing from PL0 9676 */ 9677 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 9678 { 9679 switch (ap) { 9680 case 0: 9681 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 9682 case 1: 9683 return PAGE_READ | PAGE_WRITE; 9684 case 2: 9685 return is_user ? 0 : PAGE_READ; 9686 case 3: 9687 return PAGE_READ; 9688 default: 9689 g_assert_not_reached(); 9690 } 9691 } 9692 9693 static inline int 9694 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 9695 { 9696 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 9697 } 9698 9699 /* Translate S2 section/page access permissions to protection flags 9700 * 9701 * @env: CPUARMState 9702 * @s2ap: The 2-bit stage2 access permissions (S2AP) 9703 * @xn: XN (execute-never) bit 9704 */ 9705 static int get_S2prot(CPUARMState *env, int s2ap, int xn) 9706 { 9707 int prot = 0; 9708 9709 if (s2ap & 1) { 9710 prot |= PAGE_READ; 9711 } 9712 if (s2ap & 2) { 9713 prot |= PAGE_WRITE; 9714 } 9715 if (!xn) { 9716 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 9717 prot |= PAGE_EXEC; 9718 } 9719 } 9720 return prot; 9721 } 9722 9723 /* Translate section/page access permissions to protection flags 9724 * 9725 * @env: CPUARMState 9726 * @mmu_idx: MMU index indicating required translation regime 9727 * @is_aa64: TRUE if AArch64 9728 * @ap: The 2-bit simple AP (AP[2:1]) 9729 * @ns: NS (non-secure) bit 9730 * @xn: XN (execute-never) bit 9731 * @pxn: PXN (privileged execute-never) bit 9732 */ 9733 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 9734 int ap, int ns, int xn, int pxn) 9735 { 9736 bool is_user = regime_is_user(env, mmu_idx); 9737 int prot_rw, user_rw; 9738 bool have_wxn; 9739 int wxn = 0; 9740 9741 assert(mmu_idx != ARMMMUIdx_S2NS); 9742 9743 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 9744 if (is_user) { 9745 prot_rw = user_rw; 9746 } else { 9747 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 9748 } 9749 9750 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 9751 return prot_rw; 9752 } 9753 9754 /* TODO have_wxn should be replaced with 9755 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 9756 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 9757 * compatible processors have EL2, which is required for [U]WXN. 9758 */ 9759 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 9760 9761 if (have_wxn) { 9762 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 9763 } 9764 9765 if (is_aa64) { 9766 switch (regime_el(env, mmu_idx)) { 9767 case 1: 9768 if (!is_user) { 9769 xn = pxn || (user_rw & PAGE_WRITE); 9770 } 9771 break; 9772 case 2: 9773 case 3: 9774 break; 9775 } 9776 } else if (arm_feature(env, ARM_FEATURE_V7)) { 9777 switch (regime_el(env, mmu_idx)) { 9778 case 1: 9779 case 3: 9780 if (is_user) { 9781 xn = xn || !(user_rw & PAGE_READ); 9782 } else { 9783 int uwxn = 0; 9784 if (have_wxn) { 9785 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 9786 } 9787 xn = xn || !(prot_rw & PAGE_READ) || pxn || 9788 (uwxn && (user_rw & PAGE_WRITE)); 9789 } 9790 break; 9791 case 2: 9792 break; 9793 } 9794 } else { 9795 xn = wxn = 0; 9796 } 9797 9798 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 9799 return prot_rw; 9800 } 9801 return prot_rw | PAGE_EXEC; 9802 } 9803 9804 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 9805 uint32_t *table, uint32_t address) 9806 { 9807 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 9808 TCR *tcr = regime_tcr(env, mmu_idx); 9809 9810 if (address & tcr->mask) { 9811 if (tcr->raw_tcr & TTBCR_PD1) { 9812 /* Translation table walk disabled for TTBR1 */ 9813 return false; 9814 } 9815 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 9816 } else { 9817 if (tcr->raw_tcr & TTBCR_PD0) { 9818 /* Translation table walk disabled for TTBR0 */ 9819 return false; 9820 } 9821 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask; 9822 } 9823 *table |= (address >> 18) & 0x3ffc; 9824 return true; 9825 } 9826 9827 /* Translate a S1 pagetable walk through S2 if needed. */ 9828 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx, 9829 hwaddr addr, MemTxAttrs txattrs, 9830 ARMMMUFaultInfo *fi) 9831 { 9832 if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) && 9833 !regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 9834 target_ulong s2size; 9835 hwaddr s2pa; 9836 int s2prot; 9837 int ret; 9838 ARMCacheAttrs cacheattrs = {}; 9839 ARMCacheAttrs *pcacheattrs = NULL; 9840 9841 if (env->cp15.hcr_el2 & HCR_PTW) { 9842 /* 9843 * PTW means we must fault if this S1 walk touches S2 Device 9844 * memory; otherwise we don't care about the attributes and can 9845 * save the S2 translation the effort of computing them. 9846 */ 9847 pcacheattrs = &cacheattrs; 9848 } 9849 9850 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa, 9851 &txattrs, &s2prot, &s2size, fi, pcacheattrs); 9852 if (ret) { 9853 assert(fi->type != ARMFault_None); 9854 fi->s2addr = addr; 9855 fi->stage2 = true; 9856 fi->s1ptw = true; 9857 return ~0; 9858 } 9859 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) { 9860 /* Access was to Device memory: generate Permission fault */ 9861 fi->type = ARMFault_Permission; 9862 fi->s2addr = addr; 9863 fi->stage2 = true; 9864 fi->s1ptw = true; 9865 return ~0; 9866 } 9867 addr = s2pa; 9868 } 9869 return addr; 9870 } 9871 9872 /* All loads done in the course of a page table walk go through here. */ 9873 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure, 9874 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 9875 { 9876 ARMCPU *cpu = ARM_CPU(cs); 9877 CPUARMState *env = &cpu->env; 9878 MemTxAttrs attrs = {}; 9879 MemTxResult result = MEMTX_OK; 9880 AddressSpace *as; 9881 uint32_t data; 9882 9883 attrs.secure = is_secure; 9884 as = arm_addressspace(cs, attrs); 9885 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 9886 if (fi->s1ptw) { 9887 return 0; 9888 } 9889 if (regime_translation_big_endian(env, mmu_idx)) { 9890 data = address_space_ldl_be(as, addr, attrs, &result); 9891 } else { 9892 data = address_space_ldl_le(as, addr, attrs, &result); 9893 } 9894 if (result == MEMTX_OK) { 9895 return data; 9896 } 9897 fi->type = ARMFault_SyncExternalOnWalk; 9898 fi->ea = arm_extabort_type(result); 9899 return 0; 9900 } 9901 9902 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, 9903 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 9904 { 9905 ARMCPU *cpu = ARM_CPU(cs); 9906 CPUARMState *env = &cpu->env; 9907 MemTxAttrs attrs = {}; 9908 MemTxResult result = MEMTX_OK; 9909 AddressSpace *as; 9910 uint64_t data; 9911 9912 attrs.secure = is_secure; 9913 as = arm_addressspace(cs, attrs); 9914 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 9915 if (fi->s1ptw) { 9916 return 0; 9917 } 9918 if (regime_translation_big_endian(env, mmu_idx)) { 9919 data = address_space_ldq_be(as, addr, attrs, &result); 9920 } else { 9921 data = address_space_ldq_le(as, addr, attrs, &result); 9922 } 9923 if (result == MEMTX_OK) { 9924 return data; 9925 } 9926 fi->type = ARMFault_SyncExternalOnWalk; 9927 fi->ea = arm_extabort_type(result); 9928 return 0; 9929 } 9930 9931 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address, 9932 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9933 hwaddr *phys_ptr, int *prot, 9934 target_ulong *page_size, 9935 ARMMMUFaultInfo *fi) 9936 { 9937 CPUState *cs = CPU(arm_env_get_cpu(env)); 9938 int level = 1; 9939 uint32_t table; 9940 uint32_t desc; 9941 int type; 9942 int ap; 9943 int domain = 0; 9944 int domain_prot; 9945 hwaddr phys_addr; 9946 uint32_t dacr; 9947 9948 /* Pagetable walk. */ 9949 /* Lookup l1 descriptor. */ 9950 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 9951 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 9952 fi->type = ARMFault_Translation; 9953 goto do_fault; 9954 } 9955 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9956 mmu_idx, fi); 9957 if (fi->type != ARMFault_None) { 9958 goto do_fault; 9959 } 9960 type = (desc & 3); 9961 domain = (desc >> 5) & 0x0f; 9962 if (regime_el(env, mmu_idx) == 1) { 9963 dacr = env->cp15.dacr_ns; 9964 } else { 9965 dacr = env->cp15.dacr_s; 9966 } 9967 domain_prot = (dacr >> (domain * 2)) & 3; 9968 if (type == 0) { 9969 /* Section translation fault. */ 9970 fi->type = ARMFault_Translation; 9971 goto do_fault; 9972 } 9973 if (type != 2) { 9974 level = 2; 9975 } 9976 if (domain_prot == 0 || domain_prot == 2) { 9977 fi->type = ARMFault_Domain; 9978 goto do_fault; 9979 } 9980 if (type == 2) { 9981 /* 1Mb section. */ 9982 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 9983 ap = (desc >> 10) & 3; 9984 *page_size = 1024 * 1024; 9985 } else { 9986 /* Lookup l2 entry. */ 9987 if (type == 1) { 9988 /* Coarse pagetable. */ 9989 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 9990 } else { 9991 /* Fine pagetable. */ 9992 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 9993 } 9994 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9995 mmu_idx, fi); 9996 if (fi->type != ARMFault_None) { 9997 goto do_fault; 9998 } 9999 switch (desc & 3) { 10000 case 0: /* Page translation fault. */ 10001 fi->type = ARMFault_Translation; 10002 goto do_fault; 10003 case 1: /* 64k page. */ 10004 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 10005 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 10006 *page_size = 0x10000; 10007 break; 10008 case 2: /* 4k page. */ 10009 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10010 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 10011 *page_size = 0x1000; 10012 break; 10013 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 10014 if (type == 1) { 10015 /* ARMv6/XScale extended small page format */ 10016 if (arm_feature(env, ARM_FEATURE_XSCALE) 10017 || arm_feature(env, ARM_FEATURE_V6)) { 10018 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10019 *page_size = 0x1000; 10020 } else { 10021 /* UNPREDICTABLE in ARMv5; we choose to take a 10022 * page translation fault. 10023 */ 10024 fi->type = ARMFault_Translation; 10025 goto do_fault; 10026 } 10027 } else { 10028 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 10029 *page_size = 0x400; 10030 } 10031 ap = (desc >> 4) & 3; 10032 break; 10033 default: 10034 /* Never happens, but compiler isn't smart enough to tell. */ 10035 abort(); 10036 } 10037 } 10038 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 10039 *prot |= *prot ? PAGE_EXEC : 0; 10040 if (!(*prot & (1 << access_type))) { 10041 /* Access permission fault. */ 10042 fi->type = ARMFault_Permission; 10043 goto do_fault; 10044 } 10045 *phys_ptr = phys_addr; 10046 return false; 10047 do_fault: 10048 fi->domain = domain; 10049 fi->level = level; 10050 return true; 10051 } 10052 10053 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, 10054 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10055 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 10056 target_ulong *page_size, ARMMMUFaultInfo *fi) 10057 { 10058 CPUState *cs = CPU(arm_env_get_cpu(env)); 10059 int level = 1; 10060 uint32_t table; 10061 uint32_t desc; 10062 uint32_t xn; 10063 uint32_t pxn = 0; 10064 int type; 10065 int ap; 10066 int domain = 0; 10067 int domain_prot; 10068 hwaddr phys_addr; 10069 uint32_t dacr; 10070 bool ns; 10071 10072 /* Pagetable walk. */ 10073 /* Lookup l1 descriptor. */ 10074 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 10075 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 10076 fi->type = ARMFault_Translation; 10077 goto do_fault; 10078 } 10079 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10080 mmu_idx, fi); 10081 if (fi->type != ARMFault_None) { 10082 goto do_fault; 10083 } 10084 type = (desc & 3); 10085 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) { 10086 /* Section translation fault, or attempt to use the encoding 10087 * which is Reserved on implementations without PXN. 10088 */ 10089 fi->type = ARMFault_Translation; 10090 goto do_fault; 10091 } 10092 if ((type == 1) || !(desc & (1 << 18))) { 10093 /* Page or Section. */ 10094 domain = (desc >> 5) & 0x0f; 10095 } 10096 if (regime_el(env, mmu_idx) == 1) { 10097 dacr = env->cp15.dacr_ns; 10098 } else { 10099 dacr = env->cp15.dacr_s; 10100 } 10101 if (type == 1) { 10102 level = 2; 10103 } 10104 domain_prot = (dacr >> (domain * 2)) & 3; 10105 if (domain_prot == 0 || domain_prot == 2) { 10106 /* Section or Page domain fault */ 10107 fi->type = ARMFault_Domain; 10108 goto do_fault; 10109 } 10110 if (type != 1) { 10111 if (desc & (1 << 18)) { 10112 /* Supersection. */ 10113 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 10114 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 10115 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 10116 *page_size = 0x1000000; 10117 } else { 10118 /* Section. */ 10119 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 10120 *page_size = 0x100000; 10121 } 10122 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 10123 xn = desc & (1 << 4); 10124 pxn = desc & 1; 10125 ns = extract32(desc, 19, 1); 10126 } else { 10127 if (arm_feature(env, ARM_FEATURE_PXN)) { 10128 pxn = (desc >> 2) & 1; 10129 } 10130 ns = extract32(desc, 3, 1); 10131 /* Lookup l2 entry. */ 10132 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 10133 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10134 mmu_idx, fi); 10135 if (fi->type != ARMFault_None) { 10136 goto do_fault; 10137 } 10138 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 10139 switch (desc & 3) { 10140 case 0: /* Page translation fault. */ 10141 fi->type = ARMFault_Translation; 10142 goto do_fault; 10143 case 1: /* 64k page. */ 10144 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 10145 xn = desc & (1 << 15); 10146 *page_size = 0x10000; 10147 break; 10148 case 2: case 3: /* 4k page. */ 10149 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10150 xn = desc & 1; 10151 *page_size = 0x1000; 10152 break; 10153 default: 10154 /* Never happens, but compiler isn't smart enough to tell. */ 10155 abort(); 10156 } 10157 } 10158 if (domain_prot == 3) { 10159 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10160 } else { 10161 if (pxn && !regime_is_user(env, mmu_idx)) { 10162 xn = 1; 10163 } 10164 if (xn && access_type == MMU_INST_FETCH) { 10165 fi->type = ARMFault_Permission; 10166 goto do_fault; 10167 } 10168 10169 if (arm_feature(env, ARM_FEATURE_V6K) && 10170 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 10171 /* The simplified model uses AP[0] as an access control bit. */ 10172 if ((ap & 1) == 0) { 10173 /* Access flag fault. */ 10174 fi->type = ARMFault_AccessFlag; 10175 goto do_fault; 10176 } 10177 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 10178 } else { 10179 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 10180 } 10181 if (*prot && !xn) { 10182 *prot |= PAGE_EXEC; 10183 } 10184 if (!(*prot & (1 << access_type))) { 10185 /* Access permission fault. */ 10186 fi->type = ARMFault_Permission; 10187 goto do_fault; 10188 } 10189 } 10190 if (ns) { 10191 /* The NS bit will (as required by the architecture) have no effect if 10192 * the CPU doesn't support TZ or this is a non-secure translation 10193 * regime, because the attribute will already be non-secure. 10194 */ 10195 attrs->secure = false; 10196 } 10197 *phys_ptr = phys_addr; 10198 return false; 10199 do_fault: 10200 fi->domain = domain; 10201 fi->level = level; 10202 return true; 10203 } 10204 10205 /* 10206 * check_s2_mmu_setup 10207 * @cpu: ARMCPU 10208 * @is_aa64: True if the translation regime is in AArch64 state 10209 * @startlevel: Suggested starting level 10210 * @inputsize: Bitsize of IPAs 10211 * @stride: Page-table stride (See the ARM ARM) 10212 * 10213 * Returns true if the suggested S2 translation parameters are OK and 10214 * false otherwise. 10215 */ 10216 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, 10217 int inputsize, int stride) 10218 { 10219 const int grainsize = stride + 3; 10220 int startsizecheck; 10221 10222 /* Negative levels are never allowed. */ 10223 if (level < 0) { 10224 return false; 10225 } 10226 10227 startsizecheck = inputsize - ((3 - level) * stride + grainsize); 10228 if (startsizecheck < 1 || startsizecheck > stride + 4) { 10229 return false; 10230 } 10231 10232 if (is_aa64) { 10233 CPUARMState *env = &cpu->env; 10234 unsigned int pamax = arm_pamax(cpu); 10235 10236 switch (stride) { 10237 case 13: /* 64KB Pages. */ 10238 if (level == 0 || (level == 1 && pamax <= 42)) { 10239 return false; 10240 } 10241 break; 10242 case 11: /* 16KB Pages. */ 10243 if (level == 0 || (level == 1 && pamax <= 40)) { 10244 return false; 10245 } 10246 break; 10247 case 9: /* 4KB Pages. */ 10248 if (level == 0 && pamax <= 42) { 10249 return false; 10250 } 10251 break; 10252 default: 10253 g_assert_not_reached(); 10254 } 10255 10256 /* Inputsize checks. */ 10257 if (inputsize > pamax && 10258 (arm_el_is_aa64(env, 1) || inputsize > 40)) { 10259 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */ 10260 return false; 10261 } 10262 } else { 10263 /* AArch32 only supports 4KB pages. Assert on that. */ 10264 assert(stride == 9); 10265 10266 if (level == 0) { 10267 return false; 10268 } 10269 } 10270 return true; 10271 } 10272 10273 /* Translate from the 4-bit stage 2 representation of 10274 * memory attributes (without cache-allocation hints) to 10275 * the 8-bit representation of the stage 1 MAIR registers 10276 * (which includes allocation hints). 10277 * 10278 * ref: shared/translation/attrs/S2AttrDecode() 10279 * .../S2ConvertAttrsHints() 10280 */ 10281 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs) 10282 { 10283 uint8_t hiattr = extract32(s2attrs, 2, 2); 10284 uint8_t loattr = extract32(s2attrs, 0, 2); 10285 uint8_t hihint = 0, lohint = 0; 10286 10287 if (hiattr != 0) { /* normal memory */ 10288 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */ 10289 hiattr = loattr = 1; /* non-cacheable */ 10290 } else { 10291 if (hiattr != 1) { /* Write-through or write-back */ 10292 hihint = 3; /* RW allocate */ 10293 } 10294 if (loattr != 1) { /* Write-through or write-back */ 10295 lohint = 3; /* RW allocate */ 10296 } 10297 } 10298 } 10299 10300 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 10301 } 10302 10303 ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va, 10304 ARMMMUIdx mmu_idx) 10305 { 10306 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10307 uint32_t el = regime_el(env, mmu_idx); 10308 bool tbi, tbid, epd, hpd, using16k, using64k; 10309 int select, tsz; 10310 10311 /* 10312 * Bit 55 is always between the two regions, and is canonical for 10313 * determining if address tagging is enabled. 10314 */ 10315 select = extract64(va, 55, 1); 10316 10317 if (el > 1) { 10318 tsz = extract32(tcr, 0, 6); 10319 using64k = extract32(tcr, 14, 1); 10320 using16k = extract32(tcr, 15, 1); 10321 if (mmu_idx == ARMMMUIdx_S2NS) { 10322 /* VTCR_EL2 */ 10323 tbi = tbid = hpd = false; 10324 } else { 10325 tbi = extract32(tcr, 20, 1); 10326 hpd = extract32(tcr, 24, 1); 10327 tbid = extract32(tcr, 29, 1); 10328 } 10329 epd = false; 10330 } else if (!select) { 10331 tsz = extract32(tcr, 0, 6); 10332 epd = extract32(tcr, 7, 1); 10333 using64k = extract32(tcr, 14, 1); 10334 using16k = extract32(tcr, 15, 1); 10335 tbi = extract64(tcr, 37, 1); 10336 hpd = extract64(tcr, 41, 1); 10337 tbid = extract64(tcr, 51, 1); 10338 } else { 10339 int tg = extract32(tcr, 30, 2); 10340 using16k = tg == 1; 10341 using64k = tg == 3; 10342 tsz = extract32(tcr, 16, 6); 10343 epd = extract32(tcr, 23, 1); 10344 tbi = extract64(tcr, 38, 1); 10345 hpd = extract64(tcr, 42, 1); 10346 tbid = extract64(tcr, 52, 1); 10347 } 10348 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */ 10349 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */ 10350 10351 return (ARMVAParameters) { 10352 .tsz = tsz, 10353 .select = select, 10354 .tbi = tbi, 10355 .tbid = tbid, 10356 .epd = epd, 10357 .hpd = hpd, 10358 .using16k = using16k, 10359 .using64k = using64k, 10360 }; 10361 } 10362 10363 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 10364 ARMMMUIdx mmu_idx, bool data) 10365 { 10366 ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx); 10367 10368 /* Present TBI as a composite with TBID. */ 10369 ret.tbi &= (data || !ret.tbid); 10370 return ret; 10371 } 10372 10373 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 10374 ARMMMUIdx mmu_idx) 10375 { 10376 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10377 uint32_t el = regime_el(env, mmu_idx); 10378 int select, tsz; 10379 bool epd, hpd; 10380 10381 if (mmu_idx == ARMMMUIdx_S2NS) { 10382 /* VTCR */ 10383 bool sext = extract32(tcr, 4, 1); 10384 bool sign = extract32(tcr, 3, 1); 10385 10386 /* 10387 * If the sign-extend bit is not the same as t0sz[3], the result 10388 * is unpredictable. Flag this as a guest error. 10389 */ 10390 if (sign != sext) { 10391 qemu_log_mask(LOG_GUEST_ERROR, 10392 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 10393 } 10394 tsz = sextract32(tcr, 0, 4) + 8; 10395 select = 0; 10396 hpd = false; 10397 epd = false; 10398 } else if (el == 2) { 10399 /* HTCR */ 10400 tsz = extract32(tcr, 0, 3); 10401 select = 0; 10402 hpd = extract64(tcr, 24, 1); 10403 epd = false; 10404 } else { 10405 int t0sz = extract32(tcr, 0, 3); 10406 int t1sz = extract32(tcr, 16, 3); 10407 10408 if (t1sz == 0) { 10409 select = va > (0xffffffffu >> t0sz); 10410 } else { 10411 /* Note that we will detect errors later. */ 10412 select = va >= ~(0xffffffffu >> t1sz); 10413 } 10414 if (!select) { 10415 tsz = t0sz; 10416 epd = extract32(tcr, 7, 1); 10417 hpd = extract64(tcr, 41, 1); 10418 } else { 10419 tsz = t1sz; 10420 epd = extract32(tcr, 23, 1); 10421 hpd = extract64(tcr, 42, 1); 10422 } 10423 /* For aarch32, hpd0 is not enabled without t2e as well. */ 10424 hpd &= extract32(tcr, 6, 1); 10425 } 10426 10427 return (ARMVAParameters) { 10428 .tsz = tsz, 10429 .select = select, 10430 .epd = epd, 10431 .hpd = hpd, 10432 }; 10433 } 10434 10435 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 10436 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10437 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 10438 target_ulong *page_size_ptr, 10439 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 10440 { 10441 ARMCPU *cpu = arm_env_get_cpu(env); 10442 CPUState *cs = CPU(cpu); 10443 /* Read an LPAE long-descriptor translation table. */ 10444 ARMFaultType fault_type = ARMFault_Translation; 10445 uint32_t level; 10446 ARMVAParameters param; 10447 uint64_t ttbr; 10448 hwaddr descaddr, indexmask, indexmask_grainsize; 10449 uint32_t tableattrs; 10450 target_ulong page_size, top_bits; 10451 uint32_t attrs; 10452 int32_t stride; 10453 int addrsize, inputsize; 10454 TCR *tcr = regime_tcr(env, mmu_idx); 10455 int ap, ns, xn, pxn; 10456 uint32_t el = regime_el(env, mmu_idx); 10457 bool ttbr1_valid; 10458 uint64_t descaddrmask; 10459 bool aarch64 = arm_el_is_aa64(env, el); 10460 10461 /* TODO: 10462 * This code does not handle the different format TCR for VTCR_EL2. 10463 * This code also does not support shareability levels. 10464 * Attribute and permission bit handling should also be checked when adding 10465 * support for those page table walks. 10466 */ 10467 if (aarch64) { 10468 param = aa64_va_parameters(env, address, mmu_idx, 10469 access_type != MMU_INST_FETCH); 10470 level = 0; 10471 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it 10472 * invalid. 10473 */ 10474 ttbr1_valid = (el < 2); 10475 addrsize = 64 - 8 * param.tbi; 10476 inputsize = 64 - param.tsz; 10477 } else { 10478 param = aa32_va_parameters(env, address, mmu_idx); 10479 level = 1; 10480 /* There is no TTBR1 for EL2 */ 10481 ttbr1_valid = (el != 2); 10482 addrsize = (mmu_idx == ARMMMUIdx_S2NS ? 40 : 32); 10483 inputsize = addrsize - param.tsz; 10484 } 10485 10486 /* 10487 * We determined the region when collecting the parameters, but we 10488 * have not yet validated that the address is valid for the region. 10489 * Extract the top bits and verify that they all match select. 10490 */ 10491 top_bits = sextract64(address, inputsize, addrsize - inputsize); 10492 if (-top_bits != param.select || (param.select && !ttbr1_valid)) { 10493 /* In the gap between the two regions, this is a Translation fault */ 10494 fault_type = ARMFault_Translation; 10495 goto do_fault; 10496 } 10497 10498 if (param.using64k) { 10499 stride = 13; 10500 } else if (param.using16k) { 10501 stride = 11; 10502 } else { 10503 stride = 9; 10504 } 10505 10506 /* Note that QEMU ignores shareability and cacheability attributes, 10507 * so we don't need to do anything with the SH, ORGN, IRGN fields 10508 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 10509 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 10510 * implement any ASID-like capability so we can ignore it (instead 10511 * we will always flush the TLB any time the ASID is changed). 10512 */ 10513 ttbr = regime_ttbr(env, mmu_idx, param.select); 10514 10515 /* Here we should have set up all the parameters for the translation: 10516 * inputsize, ttbr, epd, stride, tbi 10517 */ 10518 10519 if (param.epd) { 10520 /* Translation table walk disabled => Translation fault on TLB miss 10521 * Note: This is always 0 on 64-bit EL2 and EL3. 10522 */ 10523 goto do_fault; 10524 } 10525 10526 if (mmu_idx != ARMMMUIdx_S2NS) { 10527 /* The starting level depends on the virtual address size (which can 10528 * be up to 48 bits) and the translation granule size. It indicates 10529 * the number of strides (stride bits at a time) needed to 10530 * consume the bits of the input address. In the pseudocode this is: 10531 * level = 4 - RoundUp((inputsize - grainsize) / stride) 10532 * where their 'inputsize' is our 'inputsize', 'grainsize' is 10533 * our 'stride + 3' and 'stride' is our 'stride'. 10534 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 10535 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 10536 * = 4 - (inputsize - 4) / stride; 10537 */ 10538 level = 4 - (inputsize - 4) / stride; 10539 } else { 10540 /* For stage 2 translations the starting level is specified by the 10541 * VTCR_EL2.SL0 field (whose interpretation depends on the page size) 10542 */ 10543 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2); 10544 uint32_t startlevel; 10545 bool ok; 10546 10547 if (!aarch64 || stride == 9) { 10548 /* AArch32 or 4KB pages */ 10549 startlevel = 2 - sl0; 10550 } else { 10551 /* 16KB or 64KB pages */ 10552 startlevel = 3 - sl0; 10553 } 10554 10555 /* Check that the starting level is valid. */ 10556 ok = check_s2_mmu_setup(cpu, aarch64, startlevel, 10557 inputsize, stride); 10558 if (!ok) { 10559 fault_type = ARMFault_Translation; 10560 goto do_fault; 10561 } 10562 level = startlevel; 10563 } 10564 10565 indexmask_grainsize = (1ULL << (stride + 3)) - 1; 10566 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1; 10567 10568 /* Now we can extract the actual base address from the TTBR */ 10569 descaddr = extract64(ttbr, 0, 48); 10570 descaddr &= ~indexmask; 10571 10572 /* The address field in the descriptor goes up to bit 39 for ARMv7 10573 * but up to bit 47 for ARMv8, but we use the descaddrmask 10574 * up to bit 39 for AArch32, because we don't need other bits in that case 10575 * to construct next descriptor address (anyway they should be all zeroes). 10576 */ 10577 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) & 10578 ~indexmask_grainsize; 10579 10580 /* Secure accesses start with the page table in secure memory and 10581 * can be downgraded to non-secure at any step. Non-secure accesses 10582 * remain non-secure. We implement this by just ORing in the NSTable/NS 10583 * bits at each step. 10584 */ 10585 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4); 10586 for (;;) { 10587 uint64_t descriptor; 10588 bool nstable; 10589 10590 descaddr |= (address >> (stride * (4 - level))) & indexmask; 10591 descaddr &= ~7ULL; 10592 nstable = extract32(tableattrs, 4, 1); 10593 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi); 10594 if (fi->type != ARMFault_None) { 10595 goto do_fault; 10596 } 10597 10598 if (!(descriptor & 1) || 10599 (!(descriptor & 2) && (level == 3))) { 10600 /* Invalid, or the Reserved level 3 encoding */ 10601 goto do_fault; 10602 } 10603 descaddr = descriptor & descaddrmask; 10604 10605 if ((descriptor & 2) && (level < 3)) { 10606 /* Table entry. The top five bits are attributes which may 10607 * propagate down through lower levels of the table (and 10608 * which are all arranged so that 0 means "no effect", so 10609 * we can gather them up by ORing in the bits at each level). 10610 */ 10611 tableattrs |= extract64(descriptor, 59, 5); 10612 level++; 10613 indexmask = indexmask_grainsize; 10614 continue; 10615 } 10616 /* Block entry at level 1 or 2, or page entry at level 3. 10617 * These are basically the same thing, although the number 10618 * of bits we pull in from the vaddr varies. 10619 */ 10620 page_size = (1ULL << ((stride * (4 - level)) + 3)); 10621 descaddr |= (address & (page_size - 1)); 10622 /* Extract attributes from the descriptor */ 10623 attrs = extract64(descriptor, 2, 10) 10624 | (extract64(descriptor, 52, 12) << 10); 10625 10626 if (mmu_idx == ARMMMUIdx_S2NS) { 10627 /* Stage 2 table descriptors do not include any attribute fields */ 10628 break; 10629 } 10630 /* Merge in attributes from table descriptors */ 10631 attrs |= nstable << 3; /* NS */ 10632 if (param.hpd) { 10633 /* HPD disables all the table attributes except NSTable. */ 10634 break; 10635 } 10636 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */ 10637 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 10638 * means "force PL1 access only", which means forcing AP[1] to 0. 10639 */ 10640 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */ 10641 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */ 10642 break; 10643 } 10644 /* Here descaddr is the final physical address, and attributes 10645 * are all in attrs. 10646 */ 10647 fault_type = ARMFault_AccessFlag; 10648 if ((attrs & (1 << 8)) == 0) { 10649 /* Access flag */ 10650 goto do_fault; 10651 } 10652 10653 ap = extract32(attrs, 4, 2); 10654 xn = extract32(attrs, 12, 1); 10655 10656 if (mmu_idx == ARMMMUIdx_S2NS) { 10657 ns = true; 10658 *prot = get_S2prot(env, ap, xn); 10659 } else { 10660 ns = extract32(attrs, 3, 1); 10661 pxn = extract32(attrs, 11, 1); 10662 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 10663 } 10664 10665 fault_type = ARMFault_Permission; 10666 if (!(*prot & (1 << access_type))) { 10667 goto do_fault; 10668 } 10669 10670 if (ns) { 10671 /* The NS bit will (as required by the architecture) have no effect if 10672 * the CPU doesn't support TZ or this is a non-secure translation 10673 * regime, because the attribute will already be non-secure. 10674 */ 10675 txattrs->secure = false; 10676 } 10677 10678 if (cacheattrs != NULL) { 10679 if (mmu_idx == ARMMMUIdx_S2NS) { 10680 cacheattrs->attrs = convert_stage2_attrs(env, 10681 extract32(attrs, 0, 4)); 10682 } else { 10683 /* Index into MAIR registers for cache attributes */ 10684 uint8_t attrindx = extract32(attrs, 0, 3); 10685 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 10686 assert(attrindx <= 7); 10687 cacheattrs->attrs = extract64(mair, attrindx * 8, 8); 10688 } 10689 cacheattrs->shareability = extract32(attrs, 6, 2); 10690 } 10691 10692 *phys_ptr = descaddr; 10693 *page_size_ptr = page_size; 10694 return false; 10695 10696 do_fault: 10697 fi->type = fault_type; 10698 fi->level = level; 10699 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 10700 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS); 10701 return true; 10702 } 10703 10704 static inline void get_phys_addr_pmsav7_default(CPUARMState *env, 10705 ARMMMUIdx mmu_idx, 10706 int32_t address, int *prot) 10707 { 10708 if (!arm_feature(env, ARM_FEATURE_M)) { 10709 *prot = PAGE_READ | PAGE_WRITE; 10710 switch (address) { 10711 case 0xF0000000 ... 0xFFFFFFFF: 10712 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 10713 /* hivecs execing is ok */ 10714 *prot |= PAGE_EXEC; 10715 } 10716 break; 10717 case 0x00000000 ... 0x7FFFFFFF: 10718 *prot |= PAGE_EXEC; 10719 break; 10720 } 10721 } else { 10722 /* Default system address map for M profile cores. 10723 * The architecture specifies which regions are execute-never; 10724 * at the MPU level no other checks are defined. 10725 */ 10726 switch (address) { 10727 case 0x00000000 ... 0x1fffffff: /* ROM */ 10728 case 0x20000000 ... 0x3fffffff: /* SRAM */ 10729 case 0x60000000 ... 0x7fffffff: /* RAM */ 10730 case 0x80000000 ... 0x9fffffff: /* RAM */ 10731 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10732 break; 10733 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 10734 case 0xa0000000 ... 0xbfffffff: /* Device */ 10735 case 0xc0000000 ... 0xdfffffff: /* Device */ 10736 case 0xe0000000 ... 0xffffffff: /* System */ 10737 *prot = PAGE_READ | PAGE_WRITE; 10738 break; 10739 default: 10740 g_assert_not_reached(); 10741 } 10742 } 10743 } 10744 10745 static bool pmsav7_use_background_region(ARMCPU *cpu, 10746 ARMMMUIdx mmu_idx, bool is_user) 10747 { 10748 /* Return true if we should use the default memory map as a 10749 * "background" region if there are no hits against any MPU regions. 10750 */ 10751 CPUARMState *env = &cpu->env; 10752 10753 if (is_user) { 10754 return false; 10755 } 10756 10757 if (arm_feature(env, ARM_FEATURE_M)) { 10758 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] 10759 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 10760 } else { 10761 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 10762 } 10763 } 10764 10765 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address) 10766 { 10767 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 10768 return arm_feature(env, ARM_FEATURE_M) && 10769 extract32(address, 20, 12) == 0xe00; 10770 } 10771 10772 static inline bool m_is_system_region(CPUARMState *env, uint32_t address) 10773 { 10774 /* True if address is in the M profile system region 10775 * 0xe0000000 - 0xffffffff 10776 */ 10777 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 10778 } 10779 10780 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 10781 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10782 hwaddr *phys_ptr, int *prot, 10783 target_ulong *page_size, 10784 ARMMMUFaultInfo *fi) 10785 { 10786 ARMCPU *cpu = arm_env_get_cpu(env); 10787 int n; 10788 bool is_user = regime_is_user(env, mmu_idx); 10789 10790 *phys_ptr = address; 10791 *page_size = TARGET_PAGE_SIZE; 10792 *prot = 0; 10793 10794 if (regime_translation_disabled(env, mmu_idx) || 10795 m_is_ppb_region(env, address)) { 10796 /* MPU disabled or M profile PPB access: use default memory map. 10797 * The other case which uses the default memory map in the 10798 * v7M ARM ARM pseudocode is exception vector reads from the vector 10799 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 10800 * which always does a direct read using address_space_ldl(), rather 10801 * than going via this function, so we don't need to check that here. 10802 */ 10803 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10804 } else { /* MPU enabled */ 10805 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 10806 /* region search */ 10807 uint32_t base = env->pmsav7.drbar[n]; 10808 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 10809 uint32_t rmask; 10810 bool srdis = false; 10811 10812 if (!(env->pmsav7.drsr[n] & 0x1)) { 10813 continue; 10814 } 10815 10816 if (!rsize) { 10817 qemu_log_mask(LOG_GUEST_ERROR, 10818 "DRSR[%d]: Rsize field cannot be 0\n", n); 10819 continue; 10820 } 10821 rsize++; 10822 rmask = (1ull << rsize) - 1; 10823 10824 if (base & rmask) { 10825 qemu_log_mask(LOG_GUEST_ERROR, 10826 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 10827 "to DRSR region size, mask = 0x%" PRIx32 "\n", 10828 n, base, rmask); 10829 continue; 10830 } 10831 10832 if (address < base || address > base + rmask) { 10833 /* 10834 * Address not in this region. We must check whether the 10835 * region covers addresses in the same page as our address. 10836 * In that case we must not report a size that covers the 10837 * whole page for a subsequent hit against a different MPU 10838 * region or the background region, because it would result in 10839 * incorrect TLB hits for subsequent accesses to addresses that 10840 * are in this MPU region. 10841 */ 10842 if (ranges_overlap(base, rmask, 10843 address & TARGET_PAGE_MASK, 10844 TARGET_PAGE_SIZE)) { 10845 *page_size = 1; 10846 } 10847 continue; 10848 } 10849 10850 /* Region matched */ 10851 10852 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 10853 int i, snd; 10854 uint32_t srdis_mask; 10855 10856 rsize -= 3; /* sub region size (power of 2) */ 10857 snd = ((address - base) >> rsize) & 0x7; 10858 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 10859 10860 srdis_mask = srdis ? 0x3 : 0x0; 10861 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 10862 /* This will check in groups of 2, 4 and then 8, whether 10863 * the subregion bits are consistent. rsize is incremented 10864 * back up to give the region size, considering consistent 10865 * adjacent subregions as one region. Stop testing if rsize 10866 * is already big enough for an entire QEMU page. 10867 */ 10868 int snd_rounded = snd & ~(i - 1); 10869 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 10870 snd_rounded + 8, i); 10871 if (srdis_mask ^ srdis_multi) { 10872 break; 10873 } 10874 srdis_mask = (srdis_mask << i) | srdis_mask; 10875 rsize++; 10876 } 10877 } 10878 if (srdis) { 10879 continue; 10880 } 10881 if (rsize < TARGET_PAGE_BITS) { 10882 *page_size = 1 << rsize; 10883 } 10884 break; 10885 } 10886 10887 if (n == -1) { /* no hits */ 10888 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 10889 /* background fault */ 10890 fi->type = ARMFault_Background; 10891 return true; 10892 } 10893 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10894 } else { /* a MPU hit! */ 10895 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 10896 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 10897 10898 if (m_is_system_region(env, address)) { 10899 /* System space is always execute never */ 10900 xn = 1; 10901 } 10902 10903 if (is_user) { /* User mode AP bit decoding */ 10904 switch (ap) { 10905 case 0: 10906 case 1: 10907 case 5: 10908 break; /* no access */ 10909 case 3: 10910 *prot |= PAGE_WRITE; 10911 /* fall through */ 10912 case 2: 10913 case 6: 10914 *prot |= PAGE_READ | PAGE_EXEC; 10915 break; 10916 case 7: 10917 /* for v7M, same as 6; for R profile a reserved value */ 10918 if (arm_feature(env, ARM_FEATURE_M)) { 10919 *prot |= PAGE_READ | PAGE_EXEC; 10920 break; 10921 } 10922 /* fall through */ 10923 default: 10924 qemu_log_mask(LOG_GUEST_ERROR, 10925 "DRACR[%d]: Bad value for AP bits: 0x%" 10926 PRIx32 "\n", n, ap); 10927 } 10928 } else { /* Priv. mode AP bits decoding */ 10929 switch (ap) { 10930 case 0: 10931 break; /* no access */ 10932 case 1: 10933 case 2: 10934 case 3: 10935 *prot |= PAGE_WRITE; 10936 /* fall through */ 10937 case 5: 10938 case 6: 10939 *prot |= PAGE_READ | PAGE_EXEC; 10940 break; 10941 case 7: 10942 /* for v7M, same as 6; for R profile a reserved value */ 10943 if (arm_feature(env, ARM_FEATURE_M)) { 10944 *prot |= PAGE_READ | PAGE_EXEC; 10945 break; 10946 } 10947 /* fall through */ 10948 default: 10949 qemu_log_mask(LOG_GUEST_ERROR, 10950 "DRACR[%d]: Bad value for AP bits: 0x%" 10951 PRIx32 "\n", n, ap); 10952 } 10953 } 10954 10955 /* execute never */ 10956 if (xn) { 10957 *prot &= ~PAGE_EXEC; 10958 } 10959 } 10960 } 10961 10962 fi->type = ARMFault_Permission; 10963 fi->level = 1; 10964 return !(*prot & (1 << access_type)); 10965 } 10966 10967 static bool v8m_is_sau_exempt(CPUARMState *env, 10968 uint32_t address, MMUAccessType access_type) 10969 { 10970 /* The architecture specifies that certain address ranges are 10971 * exempt from v8M SAU/IDAU checks. 10972 */ 10973 return 10974 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 10975 (address >= 0xe0000000 && address <= 0xe0002fff) || 10976 (address >= 0xe000e000 && address <= 0xe000efff) || 10977 (address >= 0xe002e000 && address <= 0xe002efff) || 10978 (address >= 0xe0040000 && address <= 0xe0041fff) || 10979 (address >= 0xe00ff000 && address <= 0xe00fffff); 10980 } 10981 10982 static void v8m_security_lookup(CPUARMState *env, uint32_t address, 10983 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10984 V8M_SAttributes *sattrs) 10985 { 10986 /* Look up the security attributes for this address. Compare the 10987 * pseudocode SecurityCheck() function. 10988 * We assume the caller has zero-initialized *sattrs. 10989 */ 10990 ARMCPU *cpu = arm_env_get_cpu(env); 10991 int r; 10992 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 10993 int idau_region = IREGION_NOTVALID; 10994 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 10995 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 10996 10997 if (cpu->idau) { 10998 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 10999 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 11000 11001 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 11002 &idau_nsc); 11003 } 11004 11005 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 11006 /* 0xf0000000..0xffffffff is always S for insn fetches */ 11007 return; 11008 } 11009 11010 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 11011 sattrs->ns = !regime_is_secure(env, mmu_idx); 11012 return; 11013 } 11014 11015 if (idau_region != IREGION_NOTVALID) { 11016 sattrs->irvalid = true; 11017 sattrs->iregion = idau_region; 11018 } 11019 11020 switch (env->sau.ctrl & 3) { 11021 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 11022 break; 11023 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 11024 sattrs->ns = true; 11025 break; 11026 default: /* SAU.ENABLE == 1 */ 11027 for (r = 0; r < cpu->sau_sregion; r++) { 11028 if (env->sau.rlar[r] & 1) { 11029 uint32_t base = env->sau.rbar[r] & ~0x1f; 11030 uint32_t limit = env->sau.rlar[r] | 0x1f; 11031 11032 if (base <= address && limit >= address) { 11033 if (base > addr_page_base || limit < addr_page_limit) { 11034 sattrs->subpage = true; 11035 } 11036 if (sattrs->srvalid) { 11037 /* If we hit in more than one region then we must report 11038 * as Secure, not NS-Callable, with no valid region 11039 * number info. 11040 */ 11041 sattrs->ns = false; 11042 sattrs->nsc = false; 11043 sattrs->sregion = 0; 11044 sattrs->srvalid = false; 11045 break; 11046 } else { 11047 if (env->sau.rlar[r] & 2) { 11048 sattrs->nsc = true; 11049 } else { 11050 sattrs->ns = true; 11051 } 11052 sattrs->srvalid = true; 11053 sattrs->sregion = r; 11054 } 11055 } else { 11056 /* 11057 * Address not in this region. We must check whether the 11058 * region covers addresses in the same page as our address. 11059 * In that case we must not report a size that covers the 11060 * whole page for a subsequent hit against a different MPU 11061 * region or the background region, because it would result 11062 * in incorrect TLB hits for subsequent accesses to 11063 * addresses that are in this MPU region. 11064 */ 11065 if (limit >= base && 11066 ranges_overlap(base, limit - base + 1, 11067 addr_page_base, 11068 TARGET_PAGE_SIZE)) { 11069 sattrs->subpage = true; 11070 } 11071 } 11072 } 11073 } 11074 11075 /* The IDAU will override the SAU lookup results if it specifies 11076 * higher security than the SAU does. 11077 */ 11078 if (!idau_ns) { 11079 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 11080 sattrs->ns = false; 11081 sattrs->nsc = idau_nsc; 11082 } 11083 } 11084 break; 11085 } 11086 } 11087 11088 static bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 11089 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11090 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11091 int *prot, bool *is_subpage, 11092 ARMMMUFaultInfo *fi, uint32_t *mregion) 11093 { 11094 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check 11095 * that a full phys-to-virt translation does). 11096 * mregion is (if not NULL) set to the region number which matched, 11097 * or -1 if no region number is returned (MPU off, address did not 11098 * hit a region, address hit in multiple regions). 11099 * We set is_subpage to true if the region hit doesn't cover the 11100 * entire TARGET_PAGE the address is within. 11101 */ 11102 ARMCPU *cpu = arm_env_get_cpu(env); 11103 bool is_user = regime_is_user(env, mmu_idx); 11104 uint32_t secure = regime_is_secure(env, mmu_idx); 11105 int n; 11106 int matchregion = -1; 11107 bool hit = false; 11108 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 11109 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 11110 11111 *is_subpage = false; 11112 *phys_ptr = address; 11113 *prot = 0; 11114 if (mregion) { 11115 *mregion = -1; 11116 } 11117 11118 /* Unlike the ARM ARM pseudocode, we don't need to check whether this 11119 * was an exception vector read from the vector table (which is always 11120 * done using the default system address map), because those accesses 11121 * are done in arm_v7m_load_vector(), which always does a direct 11122 * read using address_space_ldl(), rather than going via this function. 11123 */ 11124 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */ 11125 hit = true; 11126 } else if (m_is_ppb_region(env, address)) { 11127 hit = true; 11128 } else if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 11129 hit = true; 11130 } else { 11131 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 11132 /* region search */ 11133 /* Note that the base address is bits [31:5] from the register 11134 * with bits [4:0] all zeroes, but the limit address is bits 11135 * [31:5] from the register with bits [4:0] all ones. 11136 */ 11137 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f; 11138 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f; 11139 11140 if (!(env->pmsav8.rlar[secure][n] & 0x1)) { 11141 /* Region disabled */ 11142 continue; 11143 } 11144 11145 if (address < base || address > limit) { 11146 /* 11147 * Address not in this region. We must check whether the 11148 * region covers addresses in the same page as our address. 11149 * In that case we must not report a size that covers the 11150 * whole page for a subsequent hit against a different MPU 11151 * region or the background region, because it would result in 11152 * incorrect TLB hits for subsequent accesses to addresses that 11153 * are in this MPU region. 11154 */ 11155 if (limit >= base && 11156 ranges_overlap(base, limit - base + 1, 11157 addr_page_base, 11158 TARGET_PAGE_SIZE)) { 11159 *is_subpage = true; 11160 } 11161 continue; 11162 } 11163 11164 if (base > addr_page_base || limit < addr_page_limit) { 11165 *is_subpage = true; 11166 } 11167 11168 if (hit) { 11169 /* Multiple regions match -- always a failure (unlike 11170 * PMSAv7 where highest-numbered-region wins) 11171 */ 11172 fi->type = ARMFault_Permission; 11173 fi->level = 1; 11174 return true; 11175 } 11176 11177 matchregion = n; 11178 hit = true; 11179 } 11180 } 11181 11182 if (!hit) { 11183 /* background fault */ 11184 fi->type = ARMFault_Background; 11185 return true; 11186 } 11187 11188 if (matchregion == -1) { 11189 /* hit using the background region */ 11190 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11191 } else { 11192 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2); 11193 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1); 11194 11195 if (m_is_system_region(env, address)) { 11196 /* System space is always execute never */ 11197 xn = 1; 11198 } 11199 11200 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 11201 if (*prot && !xn) { 11202 *prot |= PAGE_EXEC; 11203 } 11204 /* We don't need to look the attribute up in the MAIR0/MAIR1 11205 * registers because that only tells us about cacheability. 11206 */ 11207 if (mregion) { 11208 *mregion = matchregion; 11209 } 11210 } 11211 11212 fi->type = ARMFault_Permission; 11213 fi->level = 1; 11214 return !(*prot & (1 << access_type)); 11215 } 11216 11217 11218 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 11219 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11220 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11221 int *prot, target_ulong *page_size, 11222 ARMMMUFaultInfo *fi) 11223 { 11224 uint32_t secure = regime_is_secure(env, mmu_idx); 11225 V8M_SAttributes sattrs = {}; 11226 bool ret; 11227 bool mpu_is_subpage; 11228 11229 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11230 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs); 11231 if (access_type == MMU_INST_FETCH) { 11232 /* Instruction fetches always use the MMU bank and the 11233 * transaction attribute determined by the fetch address, 11234 * regardless of CPU state. This is painful for QEMU 11235 * to handle, because it would mean we need to encode 11236 * into the mmu_idx not just the (user, negpri) information 11237 * for the current security state but also that for the 11238 * other security state, which would balloon the number 11239 * of mmu_idx values needed alarmingly. 11240 * Fortunately we can avoid this because it's not actually 11241 * possible to arbitrarily execute code from memory with 11242 * the wrong security attribute: it will always generate 11243 * an exception of some kind or another, apart from the 11244 * special case of an NS CPU executing an SG instruction 11245 * in S&NSC memory. So we always just fail the translation 11246 * here and sort things out in the exception handler 11247 * (including possibly emulating an SG instruction). 11248 */ 11249 if (sattrs.ns != !secure) { 11250 if (sattrs.nsc) { 11251 fi->type = ARMFault_QEMU_NSCExec; 11252 } else { 11253 fi->type = ARMFault_QEMU_SFault; 11254 } 11255 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11256 *phys_ptr = address; 11257 *prot = 0; 11258 return true; 11259 } 11260 } else { 11261 /* For data accesses we always use the MMU bank indicated 11262 * by the current CPU state, but the security attributes 11263 * might downgrade a secure access to nonsecure. 11264 */ 11265 if (sattrs.ns) { 11266 txattrs->secure = false; 11267 } else if (!secure) { 11268 /* NS access to S memory must fault. 11269 * Architecturally we should first check whether the 11270 * MPU information for this address indicates that we 11271 * are doing an unaligned access to Device memory, which 11272 * should generate a UsageFault instead. QEMU does not 11273 * currently check for that kind of unaligned access though. 11274 * If we added it we would need to do so as a special case 11275 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 11276 */ 11277 fi->type = ARMFault_QEMU_SFault; 11278 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11279 *phys_ptr = address; 11280 *prot = 0; 11281 return true; 11282 } 11283 } 11284 } 11285 11286 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr, 11287 txattrs, prot, &mpu_is_subpage, fi, NULL); 11288 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE; 11289 return ret; 11290 } 11291 11292 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 11293 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11294 hwaddr *phys_ptr, int *prot, 11295 ARMMMUFaultInfo *fi) 11296 { 11297 int n; 11298 uint32_t mask; 11299 uint32_t base; 11300 bool is_user = regime_is_user(env, mmu_idx); 11301 11302 if (regime_translation_disabled(env, mmu_idx)) { 11303 /* MPU disabled. */ 11304 *phys_ptr = address; 11305 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11306 return false; 11307 } 11308 11309 *phys_ptr = address; 11310 for (n = 7; n >= 0; n--) { 11311 base = env->cp15.c6_region[n]; 11312 if ((base & 1) == 0) { 11313 continue; 11314 } 11315 mask = 1 << ((base >> 1) & 0x1f); 11316 /* Keep this shift separate from the above to avoid an 11317 (undefined) << 32. */ 11318 mask = (mask << 1) - 1; 11319 if (((base ^ address) & ~mask) == 0) { 11320 break; 11321 } 11322 } 11323 if (n < 0) { 11324 fi->type = ARMFault_Background; 11325 return true; 11326 } 11327 11328 if (access_type == MMU_INST_FETCH) { 11329 mask = env->cp15.pmsav5_insn_ap; 11330 } else { 11331 mask = env->cp15.pmsav5_data_ap; 11332 } 11333 mask = (mask >> (n * 4)) & 0xf; 11334 switch (mask) { 11335 case 0: 11336 fi->type = ARMFault_Permission; 11337 fi->level = 1; 11338 return true; 11339 case 1: 11340 if (is_user) { 11341 fi->type = ARMFault_Permission; 11342 fi->level = 1; 11343 return true; 11344 } 11345 *prot = PAGE_READ | PAGE_WRITE; 11346 break; 11347 case 2: 11348 *prot = PAGE_READ; 11349 if (!is_user) { 11350 *prot |= PAGE_WRITE; 11351 } 11352 break; 11353 case 3: 11354 *prot = PAGE_READ | PAGE_WRITE; 11355 break; 11356 case 5: 11357 if (is_user) { 11358 fi->type = ARMFault_Permission; 11359 fi->level = 1; 11360 return true; 11361 } 11362 *prot = PAGE_READ; 11363 break; 11364 case 6: 11365 *prot = PAGE_READ; 11366 break; 11367 default: 11368 /* Bad permission. */ 11369 fi->type = ARMFault_Permission; 11370 fi->level = 1; 11371 return true; 11372 } 11373 *prot |= PAGE_EXEC; 11374 return false; 11375 } 11376 11377 /* Combine either inner or outer cacheability attributes for normal 11378 * memory, according to table D4-42 and pseudocode procedure 11379 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 11380 * 11381 * NB: only stage 1 includes allocation hints (RW bits), leading to 11382 * some asymmetry. 11383 */ 11384 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 11385 { 11386 if (s1 == 4 || s2 == 4) { 11387 /* non-cacheable has precedence */ 11388 return 4; 11389 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 11390 /* stage 1 write-through takes precedence */ 11391 return s1; 11392 } else if (extract32(s2, 2, 2) == 2) { 11393 /* stage 2 write-through takes precedence, but the allocation hint 11394 * is still taken from stage 1 11395 */ 11396 return (2 << 2) | extract32(s1, 0, 2); 11397 } else { /* write-back */ 11398 return s1; 11399 } 11400 } 11401 11402 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 11403 * and CombineS1S2Desc() 11404 * 11405 * @s1: Attributes from stage 1 walk 11406 * @s2: Attributes from stage 2 walk 11407 */ 11408 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2) 11409 { 11410 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4); 11411 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4); 11412 ARMCacheAttrs ret; 11413 11414 /* Combine shareability attributes (table D4-43) */ 11415 if (s1.shareability == 2 || s2.shareability == 2) { 11416 /* if either are outer-shareable, the result is outer-shareable */ 11417 ret.shareability = 2; 11418 } else if (s1.shareability == 3 || s2.shareability == 3) { 11419 /* if either are inner-shareable, the result is inner-shareable */ 11420 ret.shareability = 3; 11421 } else { 11422 /* both non-shareable */ 11423 ret.shareability = 0; 11424 } 11425 11426 /* Combine memory type and cacheability attributes */ 11427 if (s1hi == 0 || s2hi == 0) { 11428 /* Device has precedence over normal */ 11429 if (s1lo == 0 || s2lo == 0) { 11430 /* nGnRnE has precedence over anything */ 11431 ret.attrs = 0; 11432 } else if (s1lo == 4 || s2lo == 4) { 11433 /* non-Reordering has precedence over Reordering */ 11434 ret.attrs = 4; /* nGnRE */ 11435 } else if (s1lo == 8 || s2lo == 8) { 11436 /* non-Gathering has precedence over Gathering */ 11437 ret.attrs = 8; /* nGRE */ 11438 } else { 11439 ret.attrs = 0xc; /* GRE */ 11440 } 11441 11442 /* Any location for which the resultant memory type is any 11443 * type of Device memory is always treated as Outer Shareable. 11444 */ 11445 ret.shareability = 2; 11446 } else { /* Normal memory */ 11447 /* Outer/inner cacheability combine independently */ 11448 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 11449 | combine_cacheattr_nibble(s1lo, s2lo); 11450 11451 if (ret.attrs == 0x44) { 11452 /* Any location for which the resultant memory type is Normal 11453 * Inner Non-cacheable, Outer Non-cacheable is always treated 11454 * as Outer Shareable. 11455 */ 11456 ret.shareability = 2; 11457 } 11458 } 11459 11460 return ret; 11461 } 11462 11463 11464 /* get_phys_addr - get the physical address for this virtual address 11465 * 11466 * Find the physical address corresponding to the given virtual address, 11467 * by doing a translation table walk on MMU based systems or using the 11468 * MPU state on MPU based systems. 11469 * 11470 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs, 11471 * prot and page_size may not be filled in, and the populated fsr value provides 11472 * information on why the translation aborted, in the format of a 11473 * DFSR/IFSR fault register, with the following caveats: 11474 * * we honour the short vs long DFSR format differences. 11475 * * the WnR bit is never set (the caller must do this). 11476 * * for PSMAv5 based systems we don't bother to return a full FSR format 11477 * value. 11478 * 11479 * @env: CPUARMState 11480 * @address: virtual address to get physical address for 11481 * @access_type: 0 for read, 1 for write, 2 for execute 11482 * @mmu_idx: MMU index indicating required translation regime 11483 * @phys_ptr: set to the physical address corresponding to the virtual address 11484 * @attrs: set to the memory transaction attributes to use 11485 * @prot: set to the permissions for the page containing phys_ptr 11486 * @page_size: set to the size of the page containing phys_ptr 11487 * @fi: set to fault info if the translation fails 11488 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes 11489 */ 11490 static bool get_phys_addr(CPUARMState *env, target_ulong address, 11491 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11492 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 11493 target_ulong *page_size, 11494 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 11495 { 11496 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 11497 /* Call ourselves recursively to do the stage 1 and then stage 2 11498 * translations. 11499 */ 11500 if (arm_feature(env, ARM_FEATURE_EL2)) { 11501 hwaddr ipa; 11502 int s2_prot; 11503 int ret; 11504 ARMCacheAttrs cacheattrs2 = {}; 11505 11506 ret = get_phys_addr(env, address, access_type, 11507 stage_1_mmu_idx(mmu_idx), &ipa, attrs, 11508 prot, page_size, fi, cacheattrs); 11509 11510 /* If S1 fails or S2 is disabled, return early. */ 11511 if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 11512 *phys_ptr = ipa; 11513 return ret; 11514 } 11515 11516 /* S1 is done. Now do S2 translation. */ 11517 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS, 11518 phys_ptr, attrs, &s2_prot, 11519 page_size, fi, 11520 cacheattrs != NULL ? &cacheattrs2 : NULL); 11521 fi->s2addr = ipa; 11522 /* Combine the S1 and S2 perms. */ 11523 *prot &= s2_prot; 11524 11525 /* Combine the S1 and S2 cache attributes, if needed */ 11526 if (!ret && cacheattrs != NULL) { 11527 if (env->cp15.hcr_el2 & HCR_DC) { 11528 /* 11529 * HCR.DC forces the first stage attributes to 11530 * Normal Non-Shareable, 11531 * Inner Write-Back Read-Allocate Write-Allocate, 11532 * Outer Write-Back Read-Allocate Write-Allocate. 11533 */ 11534 cacheattrs->attrs = 0xff; 11535 cacheattrs->shareability = 0; 11536 } 11537 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2); 11538 } 11539 11540 return ret; 11541 } else { 11542 /* 11543 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1. 11544 */ 11545 mmu_idx = stage_1_mmu_idx(mmu_idx); 11546 } 11547 } 11548 11549 /* The page table entries may downgrade secure to non-secure, but 11550 * cannot upgrade an non-secure translation regime's attributes 11551 * to secure. 11552 */ 11553 attrs->secure = regime_is_secure(env, mmu_idx); 11554 attrs->user = regime_is_user(env, mmu_idx); 11555 11556 /* Fast Context Switch Extension. This doesn't exist at all in v8. 11557 * In v7 and earlier it affects all stage 1 translations. 11558 */ 11559 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS 11560 && !arm_feature(env, ARM_FEATURE_V8)) { 11561 if (regime_el(env, mmu_idx) == 3) { 11562 address += env->cp15.fcseidr_s; 11563 } else { 11564 address += env->cp15.fcseidr_ns; 11565 } 11566 } 11567 11568 if (arm_feature(env, ARM_FEATURE_PMSA)) { 11569 bool ret; 11570 *page_size = TARGET_PAGE_SIZE; 11571 11572 if (arm_feature(env, ARM_FEATURE_V8)) { 11573 /* PMSAv8 */ 11574 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 11575 phys_ptr, attrs, prot, page_size, fi); 11576 } else if (arm_feature(env, ARM_FEATURE_V7)) { 11577 /* PMSAv7 */ 11578 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 11579 phys_ptr, prot, page_size, fi); 11580 } else { 11581 /* Pre-v7 MPU */ 11582 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 11583 phys_ptr, prot, fi); 11584 } 11585 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 11586 " mmu_idx %u -> %s (prot %c%c%c)\n", 11587 access_type == MMU_DATA_LOAD ? "reading" : 11588 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 11589 (uint32_t)address, mmu_idx, 11590 ret ? "Miss" : "Hit", 11591 *prot & PAGE_READ ? 'r' : '-', 11592 *prot & PAGE_WRITE ? 'w' : '-', 11593 *prot & PAGE_EXEC ? 'x' : '-'); 11594 11595 return ret; 11596 } 11597 11598 /* Definitely a real MMU, not an MPU */ 11599 11600 if (regime_translation_disabled(env, mmu_idx)) { 11601 /* MMU disabled. */ 11602 *phys_ptr = address; 11603 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11604 *page_size = TARGET_PAGE_SIZE; 11605 return 0; 11606 } 11607 11608 if (regime_using_lpae_format(env, mmu_idx)) { 11609 return get_phys_addr_lpae(env, address, access_type, mmu_idx, 11610 phys_ptr, attrs, prot, page_size, 11611 fi, cacheattrs); 11612 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) { 11613 return get_phys_addr_v6(env, address, access_type, mmu_idx, 11614 phys_ptr, attrs, prot, page_size, fi); 11615 } else { 11616 return get_phys_addr_v5(env, address, access_type, mmu_idx, 11617 phys_ptr, prot, page_size, fi); 11618 } 11619 } 11620 11621 /* Walk the page table and (if the mapping exists) add the page 11622 * to the TLB. Return false on success, or true on failure. Populate 11623 * fsr with ARM DFSR/IFSR fault register format value on failure. 11624 */ 11625 bool arm_tlb_fill(CPUState *cs, vaddr address, 11626 MMUAccessType access_type, int mmu_idx, 11627 ARMMMUFaultInfo *fi) 11628 { 11629 ARMCPU *cpu = ARM_CPU(cs); 11630 CPUARMState *env = &cpu->env; 11631 hwaddr phys_addr; 11632 target_ulong page_size; 11633 int prot; 11634 int ret; 11635 MemTxAttrs attrs = {}; 11636 11637 ret = get_phys_addr(env, address, access_type, 11638 core_to_arm_mmu_idx(env, mmu_idx), &phys_addr, 11639 &attrs, &prot, &page_size, fi, NULL); 11640 if (!ret) { 11641 /* 11642 * Map a single [sub]page. Regions smaller than our declared 11643 * target page size are handled specially, so for those we 11644 * pass in the exact addresses. 11645 */ 11646 if (page_size >= TARGET_PAGE_SIZE) { 11647 phys_addr &= TARGET_PAGE_MASK; 11648 address &= TARGET_PAGE_MASK; 11649 } 11650 tlb_set_page_with_attrs(cs, address, phys_addr, attrs, 11651 prot, mmu_idx, page_size); 11652 return 0; 11653 } 11654 11655 return ret; 11656 } 11657 11658 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 11659 MemTxAttrs *attrs) 11660 { 11661 ARMCPU *cpu = ARM_CPU(cs); 11662 CPUARMState *env = &cpu->env; 11663 hwaddr phys_addr; 11664 target_ulong page_size; 11665 int prot; 11666 bool ret; 11667 ARMMMUFaultInfo fi = {}; 11668 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 11669 11670 *attrs = (MemTxAttrs) {}; 11671 11672 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr, 11673 attrs, &prot, &page_size, &fi, NULL); 11674 11675 if (ret) { 11676 return -1; 11677 } 11678 return phys_addr; 11679 } 11680 11681 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) 11682 { 11683 uint32_t mask; 11684 unsigned el = arm_current_el(env); 11685 11686 /* First handle registers which unprivileged can read */ 11687 11688 switch (reg) { 11689 case 0 ... 7: /* xPSR sub-fields */ 11690 mask = 0; 11691 if ((reg & 1) && el) { 11692 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */ 11693 } 11694 if (!(reg & 4)) { 11695 mask |= XPSR_NZCV | XPSR_Q; /* APSR */ 11696 } 11697 /* EPSR reads as zero */ 11698 return xpsr_read(env) & mask; 11699 break; 11700 case 20: /* CONTROL */ 11701 return env->v7m.control[env->v7m.secure]; 11702 case 0x94: /* CONTROL_NS */ 11703 /* We have to handle this here because unprivileged Secure code 11704 * can read the NS CONTROL register. 11705 */ 11706 if (!env->v7m.secure) { 11707 return 0; 11708 } 11709 return env->v7m.control[M_REG_NS]; 11710 } 11711 11712 if (el == 0) { 11713 return 0; /* unprivileged reads others as zero */ 11714 } 11715 11716 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11717 switch (reg) { 11718 case 0x88: /* MSP_NS */ 11719 if (!env->v7m.secure) { 11720 return 0; 11721 } 11722 return env->v7m.other_ss_msp; 11723 case 0x89: /* PSP_NS */ 11724 if (!env->v7m.secure) { 11725 return 0; 11726 } 11727 return env->v7m.other_ss_psp; 11728 case 0x8a: /* MSPLIM_NS */ 11729 if (!env->v7m.secure) { 11730 return 0; 11731 } 11732 return env->v7m.msplim[M_REG_NS]; 11733 case 0x8b: /* PSPLIM_NS */ 11734 if (!env->v7m.secure) { 11735 return 0; 11736 } 11737 return env->v7m.psplim[M_REG_NS]; 11738 case 0x90: /* PRIMASK_NS */ 11739 if (!env->v7m.secure) { 11740 return 0; 11741 } 11742 return env->v7m.primask[M_REG_NS]; 11743 case 0x91: /* BASEPRI_NS */ 11744 if (!env->v7m.secure) { 11745 return 0; 11746 } 11747 return env->v7m.basepri[M_REG_NS]; 11748 case 0x93: /* FAULTMASK_NS */ 11749 if (!env->v7m.secure) { 11750 return 0; 11751 } 11752 return env->v7m.faultmask[M_REG_NS]; 11753 case 0x98: /* SP_NS */ 11754 { 11755 /* This gives the non-secure SP selected based on whether we're 11756 * currently in handler mode or not, using the NS CONTROL.SPSEL. 11757 */ 11758 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK; 11759 11760 if (!env->v7m.secure) { 11761 return 0; 11762 } 11763 if (!arm_v7m_is_handler_mode(env) && spsel) { 11764 return env->v7m.other_ss_psp; 11765 } else { 11766 return env->v7m.other_ss_msp; 11767 } 11768 } 11769 default: 11770 break; 11771 } 11772 } 11773 11774 switch (reg) { 11775 case 8: /* MSP */ 11776 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13]; 11777 case 9: /* PSP */ 11778 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp; 11779 case 10: /* MSPLIM */ 11780 if (!arm_feature(env, ARM_FEATURE_V8)) { 11781 goto bad_reg; 11782 } 11783 return env->v7m.msplim[env->v7m.secure]; 11784 case 11: /* PSPLIM */ 11785 if (!arm_feature(env, ARM_FEATURE_V8)) { 11786 goto bad_reg; 11787 } 11788 return env->v7m.psplim[env->v7m.secure]; 11789 case 16: /* PRIMASK */ 11790 return env->v7m.primask[env->v7m.secure]; 11791 case 17: /* BASEPRI */ 11792 case 18: /* BASEPRI_MAX */ 11793 return env->v7m.basepri[env->v7m.secure]; 11794 case 19: /* FAULTMASK */ 11795 return env->v7m.faultmask[env->v7m.secure]; 11796 default: 11797 bad_reg: 11798 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special" 11799 " register %d\n", reg); 11800 return 0; 11801 } 11802 } 11803 11804 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) 11805 { 11806 /* We're passed bits [11..0] of the instruction; extract 11807 * SYSm and the mask bits. 11808 * Invalid combinations of SYSm and mask are UNPREDICTABLE; 11809 * we choose to treat them as if the mask bits were valid. 11810 * NB that the pseudocode 'mask' variable is bits [11..10], 11811 * whereas ours is [11..8]. 11812 */ 11813 uint32_t mask = extract32(maskreg, 8, 4); 11814 uint32_t reg = extract32(maskreg, 0, 8); 11815 11816 if (arm_current_el(env) == 0 && reg > 7) { 11817 /* only xPSR sub-fields may be written by unprivileged */ 11818 return; 11819 } 11820 11821 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11822 switch (reg) { 11823 case 0x88: /* MSP_NS */ 11824 if (!env->v7m.secure) { 11825 return; 11826 } 11827 env->v7m.other_ss_msp = val; 11828 return; 11829 case 0x89: /* PSP_NS */ 11830 if (!env->v7m.secure) { 11831 return; 11832 } 11833 env->v7m.other_ss_psp = val; 11834 return; 11835 case 0x8a: /* MSPLIM_NS */ 11836 if (!env->v7m.secure) { 11837 return; 11838 } 11839 env->v7m.msplim[M_REG_NS] = val & ~7; 11840 return; 11841 case 0x8b: /* PSPLIM_NS */ 11842 if (!env->v7m.secure) { 11843 return; 11844 } 11845 env->v7m.psplim[M_REG_NS] = val & ~7; 11846 return; 11847 case 0x90: /* PRIMASK_NS */ 11848 if (!env->v7m.secure) { 11849 return; 11850 } 11851 env->v7m.primask[M_REG_NS] = val & 1; 11852 return; 11853 case 0x91: /* BASEPRI_NS */ 11854 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) { 11855 return; 11856 } 11857 env->v7m.basepri[M_REG_NS] = val & 0xff; 11858 return; 11859 case 0x93: /* FAULTMASK_NS */ 11860 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) { 11861 return; 11862 } 11863 env->v7m.faultmask[M_REG_NS] = val & 1; 11864 return; 11865 case 0x94: /* CONTROL_NS */ 11866 if (!env->v7m.secure) { 11867 return; 11868 } 11869 write_v7m_control_spsel_for_secstate(env, 11870 val & R_V7M_CONTROL_SPSEL_MASK, 11871 M_REG_NS); 11872 if (arm_feature(env, ARM_FEATURE_M_MAIN)) { 11873 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK; 11874 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK; 11875 } 11876 return; 11877 case 0x98: /* SP_NS */ 11878 { 11879 /* This gives the non-secure SP selected based on whether we're 11880 * currently in handler mode or not, using the NS CONTROL.SPSEL. 11881 */ 11882 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK; 11883 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel; 11884 uint32_t limit; 11885 11886 if (!env->v7m.secure) { 11887 return; 11888 } 11889 11890 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false]; 11891 11892 if (val < limit) { 11893 CPUState *cs = CPU(arm_env_get_cpu(env)); 11894 11895 cpu_restore_state(cs, GETPC(), true); 11896 raise_exception(env, EXCP_STKOF, 0, 1); 11897 } 11898 11899 if (is_psp) { 11900 env->v7m.other_ss_psp = val; 11901 } else { 11902 env->v7m.other_ss_msp = val; 11903 } 11904 return; 11905 } 11906 default: 11907 break; 11908 } 11909 } 11910 11911 switch (reg) { 11912 case 0 ... 7: /* xPSR sub-fields */ 11913 /* only APSR is actually writable */ 11914 if (!(reg & 4)) { 11915 uint32_t apsrmask = 0; 11916 11917 if (mask & 8) { 11918 apsrmask |= XPSR_NZCV | XPSR_Q; 11919 } 11920 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) { 11921 apsrmask |= XPSR_GE; 11922 } 11923 xpsr_write(env, val, apsrmask); 11924 } 11925 break; 11926 case 8: /* MSP */ 11927 if (v7m_using_psp(env)) { 11928 env->v7m.other_sp = val; 11929 } else { 11930 env->regs[13] = val; 11931 } 11932 break; 11933 case 9: /* PSP */ 11934 if (v7m_using_psp(env)) { 11935 env->regs[13] = val; 11936 } else { 11937 env->v7m.other_sp = val; 11938 } 11939 break; 11940 case 10: /* MSPLIM */ 11941 if (!arm_feature(env, ARM_FEATURE_V8)) { 11942 goto bad_reg; 11943 } 11944 env->v7m.msplim[env->v7m.secure] = val & ~7; 11945 break; 11946 case 11: /* PSPLIM */ 11947 if (!arm_feature(env, ARM_FEATURE_V8)) { 11948 goto bad_reg; 11949 } 11950 env->v7m.psplim[env->v7m.secure] = val & ~7; 11951 break; 11952 case 16: /* PRIMASK */ 11953 env->v7m.primask[env->v7m.secure] = val & 1; 11954 break; 11955 case 17: /* BASEPRI */ 11956 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 11957 goto bad_reg; 11958 } 11959 env->v7m.basepri[env->v7m.secure] = val & 0xff; 11960 break; 11961 case 18: /* BASEPRI_MAX */ 11962 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 11963 goto bad_reg; 11964 } 11965 val &= 0xff; 11966 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure] 11967 || env->v7m.basepri[env->v7m.secure] == 0)) { 11968 env->v7m.basepri[env->v7m.secure] = val; 11969 } 11970 break; 11971 case 19: /* FAULTMASK */ 11972 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 11973 goto bad_reg; 11974 } 11975 env->v7m.faultmask[env->v7m.secure] = val & 1; 11976 break; 11977 case 20: /* CONTROL */ 11978 /* Writing to the SPSEL bit only has an effect if we are in 11979 * thread mode; other bits can be updated by any privileged code. 11980 * write_v7m_control_spsel() deals with updating the SPSEL bit in 11981 * env->v7m.control, so we only need update the others. 11982 * For v7M, we must just ignore explicit writes to SPSEL in handler 11983 * mode; for v8M the write is permitted but will have no effect. 11984 */ 11985 if (arm_feature(env, ARM_FEATURE_V8) || 11986 !arm_v7m_is_handler_mode(env)) { 11987 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0); 11988 } 11989 if (arm_feature(env, ARM_FEATURE_M_MAIN)) { 11990 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK; 11991 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK; 11992 } 11993 break; 11994 default: 11995 bad_reg: 11996 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special" 11997 " register %d\n", reg); 11998 return; 11999 } 12000 } 12001 12002 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) 12003 { 12004 /* Implement the TT instruction. op is bits [7:6] of the insn. */ 12005 bool forceunpriv = op & 1; 12006 bool alt = op & 2; 12007 V8M_SAttributes sattrs = {}; 12008 uint32_t tt_resp; 12009 bool r, rw, nsr, nsrw, mrvalid; 12010 int prot; 12011 ARMMMUFaultInfo fi = {}; 12012 MemTxAttrs attrs = {}; 12013 hwaddr phys_addr; 12014 ARMMMUIdx mmu_idx; 12015 uint32_t mregion; 12016 bool targetpriv; 12017 bool targetsec = env->v7m.secure; 12018 bool is_subpage; 12019 12020 /* Work out what the security state and privilege level we're 12021 * interested in is... 12022 */ 12023 if (alt) { 12024 targetsec = !targetsec; 12025 } 12026 12027 if (forceunpriv) { 12028 targetpriv = false; 12029 } else { 12030 targetpriv = arm_v7m_is_handler_mode(env) || 12031 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK); 12032 } 12033 12034 /* ...and then figure out which MMU index this is */ 12035 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv); 12036 12037 /* We know that the MPU and SAU don't care about the access type 12038 * for our purposes beyond that we don't want to claim to be 12039 * an insn fetch, so we arbitrarily call this a read. 12040 */ 12041 12042 /* MPU region info only available for privileged or if 12043 * inspecting the other MPU state. 12044 */ 12045 if (arm_current_el(env) != 0 || alt) { 12046 /* We can ignore the return value as prot is always set */ 12047 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, 12048 &phys_addr, &attrs, &prot, &is_subpage, 12049 &fi, &mregion); 12050 if (mregion == -1) { 12051 mrvalid = false; 12052 mregion = 0; 12053 } else { 12054 mrvalid = true; 12055 } 12056 r = prot & PAGE_READ; 12057 rw = prot & PAGE_WRITE; 12058 } else { 12059 r = false; 12060 rw = false; 12061 mrvalid = false; 12062 mregion = 0; 12063 } 12064 12065 if (env->v7m.secure) { 12066 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs); 12067 nsr = sattrs.ns && r; 12068 nsrw = sattrs.ns && rw; 12069 } else { 12070 sattrs.ns = true; 12071 nsr = false; 12072 nsrw = false; 12073 } 12074 12075 tt_resp = (sattrs.iregion << 24) | 12076 (sattrs.irvalid << 23) | 12077 ((!sattrs.ns) << 22) | 12078 (nsrw << 21) | 12079 (nsr << 20) | 12080 (rw << 19) | 12081 (r << 18) | 12082 (sattrs.srvalid << 17) | 12083 (mrvalid << 16) | 12084 (sattrs.sregion << 8) | 12085 mregion; 12086 12087 return tt_resp; 12088 } 12089 12090 #endif 12091 12092 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in) 12093 { 12094 /* Implement DC ZVA, which zeroes a fixed-length block of memory. 12095 * Note that we do not implement the (architecturally mandated) 12096 * alignment fault for attempts to use this on Device memory 12097 * (which matches the usual QEMU behaviour of not implementing either 12098 * alignment faults or any memory attribute handling). 12099 */ 12100 12101 ARMCPU *cpu = arm_env_get_cpu(env); 12102 uint64_t blocklen = 4 << cpu->dcz_blocksize; 12103 uint64_t vaddr = vaddr_in & ~(blocklen - 1); 12104 12105 #ifndef CONFIG_USER_ONLY 12106 { 12107 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than 12108 * the block size so we might have to do more than one TLB lookup. 12109 * We know that in fact for any v8 CPU the page size is at least 4K 12110 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only 12111 * 1K as an artefact of legacy v5 subpage support being present in the 12112 * same QEMU executable. 12113 */ 12114 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE); 12115 void *hostaddr[maxidx]; 12116 int try, i; 12117 unsigned mmu_idx = cpu_mmu_index(env, false); 12118 TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); 12119 12120 for (try = 0; try < 2; try++) { 12121 12122 for (i = 0; i < maxidx; i++) { 12123 hostaddr[i] = tlb_vaddr_to_host(env, 12124 vaddr + TARGET_PAGE_SIZE * i, 12125 1, mmu_idx); 12126 if (!hostaddr[i]) { 12127 break; 12128 } 12129 } 12130 if (i == maxidx) { 12131 /* If it's all in the TLB it's fair game for just writing to; 12132 * we know we don't need to update dirty status, etc. 12133 */ 12134 for (i = 0; i < maxidx - 1; i++) { 12135 memset(hostaddr[i], 0, TARGET_PAGE_SIZE); 12136 } 12137 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE)); 12138 return; 12139 } 12140 /* OK, try a store and see if we can populate the tlb. This 12141 * might cause an exception if the memory isn't writable, 12142 * in which case we will longjmp out of here. We must for 12143 * this purpose use the actual register value passed to us 12144 * so that we get the fault address right. 12145 */ 12146 helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETPC()); 12147 /* Now we can populate the other TLB entries, if any */ 12148 for (i = 0; i < maxidx; i++) { 12149 uint64_t va = vaddr + TARGET_PAGE_SIZE * i; 12150 if (va != (vaddr_in & TARGET_PAGE_MASK)) { 12151 helper_ret_stb_mmu(env, va, 0, oi, GETPC()); 12152 } 12153 } 12154 } 12155 12156 /* Slow path (probably attempt to do this to an I/O device or 12157 * similar, or clearing of a block of code we have translations 12158 * cached for). Just do a series of byte writes as the architecture 12159 * demands. It's not worth trying to use a cpu_physical_memory_map(), 12160 * memset(), unmap() sequence here because: 12161 * + we'd need to account for the blocksize being larger than a page 12162 * + the direct-RAM access case is almost always going to be dealt 12163 * with in the fastpath code above, so there's no speed benefit 12164 * + we would have to deal with the map returning NULL because the 12165 * bounce buffer was in use 12166 */ 12167 for (i = 0; i < blocklen; i++) { 12168 helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETPC()); 12169 } 12170 } 12171 #else 12172 memset(g2h(vaddr), 0, blocklen); 12173 #endif 12174 } 12175 12176 /* Note that signed overflow is undefined in C. The following routines are 12177 careful to use unsigned types where modulo arithmetic is required. 12178 Failure to do so _will_ break on newer gcc. */ 12179 12180 /* Signed saturating arithmetic. */ 12181 12182 /* Perform 16-bit signed saturating addition. */ 12183 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 12184 { 12185 uint16_t res; 12186 12187 res = a + b; 12188 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 12189 if (a & 0x8000) 12190 res = 0x8000; 12191 else 12192 res = 0x7fff; 12193 } 12194 return res; 12195 } 12196 12197 /* Perform 8-bit signed saturating addition. */ 12198 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 12199 { 12200 uint8_t res; 12201 12202 res = a + b; 12203 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 12204 if (a & 0x80) 12205 res = 0x80; 12206 else 12207 res = 0x7f; 12208 } 12209 return res; 12210 } 12211 12212 /* Perform 16-bit signed saturating subtraction. */ 12213 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 12214 { 12215 uint16_t res; 12216 12217 res = a - b; 12218 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 12219 if (a & 0x8000) 12220 res = 0x8000; 12221 else 12222 res = 0x7fff; 12223 } 12224 return res; 12225 } 12226 12227 /* Perform 8-bit signed saturating subtraction. */ 12228 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 12229 { 12230 uint8_t res; 12231 12232 res = a - b; 12233 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 12234 if (a & 0x80) 12235 res = 0x80; 12236 else 12237 res = 0x7f; 12238 } 12239 return res; 12240 } 12241 12242 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 12243 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 12244 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 12245 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 12246 #define PFX q 12247 12248 #include "op_addsub.h" 12249 12250 /* Unsigned saturating arithmetic. */ 12251 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 12252 { 12253 uint16_t res; 12254 res = a + b; 12255 if (res < a) 12256 res = 0xffff; 12257 return res; 12258 } 12259 12260 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 12261 { 12262 if (a > b) 12263 return a - b; 12264 else 12265 return 0; 12266 } 12267 12268 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 12269 { 12270 uint8_t res; 12271 res = a + b; 12272 if (res < a) 12273 res = 0xff; 12274 return res; 12275 } 12276 12277 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 12278 { 12279 if (a > b) 12280 return a - b; 12281 else 12282 return 0; 12283 } 12284 12285 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 12286 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 12287 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 12288 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 12289 #define PFX uq 12290 12291 #include "op_addsub.h" 12292 12293 /* Signed modulo arithmetic. */ 12294 #define SARITH16(a, b, n, op) do { \ 12295 int32_t sum; \ 12296 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 12297 RESULT(sum, n, 16); \ 12298 if (sum >= 0) \ 12299 ge |= 3 << (n * 2); \ 12300 } while(0) 12301 12302 #define SARITH8(a, b, n, op) do { \ 12303 int32_t sum; \ 12304 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 12305 RESULT(sum, n, 8); \ 12306 if (sum >= 0) \ 12307 ge |= 1 << n; \ 12308 } while(0) 12309 12310 12311 #define ADD16(a, b, n) SARITH16(a, b, n, +) 12312 #define SUB16(a, b, n) SARITH16(a, b, n, -) 12313 #define ADD8(a, b, n) SARITH8(a, b, n, +) 12314 #define SUB8(a, b, n) SARITH8(a, b, n, -) 12315 #define PFX s 12316 #define ARITH_GE 12317 12318 #include "op_addsub.h" 12319 12320 /* Unsigned modulo arithmetic. */ 12321 #define ADD16(a, b, n) do { \ 12322 uint32_t sum; \ 12323 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 12324 RESULT(sum, n, 16); \ 12325 if ((sum >> 16) == 1) \ 12326 ge |= 3 << (n * 2); \ 12327 } while(0) 12328 12329 #define ADD8(a, b, n) do { \ 12330 uint32_t sum; \ 12331 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 12332 RESULT(sum, n, 8); \ 12333 if ((sum >> 8) == 1) \ 12334 ge |= 1 << n; \ 12335 } while(0) 12336 12337 #define SUB16(a, b, n) do { \ 12338 uint32_t sum; \ 12339 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 12340 RESULT(sum, n, 16); \ 12341 if ((sum >> 16) == 0) \ 12342 ge |= 3 << (n * 2); \ 12343 } while(0) 12344 12345 #define SUB8(a, b, n) do { \ 12346 uint32_t sum; \ 12347 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 12348 RESULT(sum, n, 8); \ 12349 if ((sum >> 8) == 0) \ 12350 ge |= 1 << n; \ 12351 } while(0) 12352 12353 #define PFX u 12354 #define ARITH_GE 12355 12356 #include "op_addsub.h" 12357 12358 /* Halved signed arithmetic. */ 12359 #define ADD16(a, b, n) \ 12360 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 12361 #define SUB16(a, b, n) \ 12362 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 12363 #define ADD8(a, b, n) \ 12364 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 12365 #define SUB8(a, b, n) \ 12366 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 12367 #define PFX sh 12368 12369 #include "op_addsub.h" 12370 12371 /* Halved unsigned arithmetic. */ 12372 #define ADD16(a, b, n) \ 12373 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 12374 #define SUB16(a, b, n) \ 12375 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 12376 #define ADD8(a, b, n) \ 12377 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 12378 #define SUB8(a, b, n) \ 12379 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 12380 #define PFX uh 12381 12382 #include "op_addsub.h" 12383 12384 static inline uint8_t do_usad(uint8_t a, uint8_t b) 12385 { 12386 if (a > b) 12387 return a - b; 12388 else 12389 return b - a; 12390 } 12391 12392 /* Unsigned sum of absolute byte differences. */ 12393 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 12394 { 12395 uint32_t sum; 12396 sum = do_usad(a, b); 12397 sum += do_usad(a >> 8, b >> 8); 12398 sum += do_usad(a >> 16, b >>16); 12399 sum += do_usad(a >> 24, b >> 24); 12400 return sum; 12401 } 12402 12403 /* For ARMv6 SEL instruction. */ 12404 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 12405 { 12406 uint32_t mask; 12407 12408 mask = 0; 12409 if (flags & 1) 12410 mask |= 0xff; 12411 if (flags & 2) 12412 mask |= 0xff00; 12413 if (flags & 4) 12414 mask |= 0xff0000; 12415 if (flags & 8) 12416 mask |= 0xff000000; 12417 return (a & mask) | (b & ~mask); 12418 } 12419 12420 /* VFP support. We follow the convention used for VFP instructions: 12421 Single precision routines have a "s" suffix, double precision a 12422 "d" suffix. */ 12423 12424 /* Convert host exception flags to vfp form. */ 12425 static inline int vfp_exceptbits_from_host(int host_bits) 12426 { 12427 int target_bits = 0; 12428 12429 if (host_bits & float_flag_invalid) 12430 target_bits |= 1; 12431 if (host_bits & float_flag_divbyzero) 12432 target_bits |= 2; 12433 if (host_bits & float_flag_overflow) 12434 target_bits |= 4; 12435 if (host_bits & (float_flag_underflow | float_flag_output_denormal)) 12436 target_bits |= 8; 12437 if (host_bits & float_flag_inexact) 12438 target_bits |= 0x10; 12439 if (host_bits & float_flag_input_denormal) 12440 target_bits |= 0x80; 12441 return target_bits; 12442 } 12443 12444 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env) 12445 { 12446 int i; 12447 uint32_t fpscr; 12448 12449 fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff) 12450 | (env->vfp.vec_len << 16) 12451 | (env->vfp.vec_stride << 20); 12452 12453 i = get_float_exception_flags(&env->vfp.fp_status); 12454 i |= get_float_exception_flags(&env->vfp.standard_fp_status); 12455 /* FZ16 does not generate an input denormal exception. */ 12456 i |= (get_float_exception_flags(&env->vfp.fp_status_f16) 12457 & ~float_flag_input_denormal); 12458 12459 fpscr |= vfp_exceptbits_from_host(i); 12460 return fpscr; 12461 } 12462 12463 uint32_t vfp_get_fpscr(CPUARMState *env) 12464 { 12465 return HELPER(vfp_get_fpscr)(env); 12466 } 12467 12468 /* Convert vfp exception flags to target form. */ 12469 static inline int vfp_exceptbits_to_host(int target_bits) 12470 { 12471 int host_bits = 0; 12472 12473 if (target_bits & 1) 12474 host_bits |= float_flag_invalid; 12475 if (target_bits & 2) 12476 host_bits |= float_flag_divbyzero; 12477 if (target_bits & 4) 12478 host_bits |= float_flag_overflow; 12479 if (target_bits & 8) 12480 host_bits |= float_flag_underflow; 12481 if (target_bits & 0x10) 12482 host_bits |= float_flag_inexact; 12483 if (target_bits & 0x80) 12484 host_bits |= float_flag_input_denormal; 12485 return host_bits; 12486 } 12487 12488 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val) 12489 { 12490 int i; 12491 uint32_t changed; 12492 12493 /* When ARMv8.2-FP16 is not supported, FZ16 is RES0. */ 12494 if (!cpu_isar_feature(aa64_fp16, arm_env_get_cpu(env))) { 12495 val &= ~FPCR_FZ16; 12496 } 12497 12498 changed = env->vfp.xregs[ARM_VFP_FPSCR]; 12499 env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff); 12500 env->vfp.vec_len = (val >> 16) & 7; 12501 env->vfp.vec_stride = (val >> 20) & 3; 12502 12503 changed ^= val; 12504 if (changed & (3 << 22)) { 12505 i = (val >> 22) & 3; 12506 switch (i) { 12507 case FPROUNDING_TIEEVEN: 12508 i = float_round_nearest_even; 12509 break; 12510 case FPROUNDING_POSINF: 12511 i = float_round_up; 12512 break; 12513 case FPROUNDING_NEGINF: 12514 i = float_round_down; 12515 break; 12516 case FPROUNDING_ZERO: 12517 i = float_round_to_zero; 12518 break; 12519 } 12520 set_float_rounding_mode(i, &env->vfp.fp_status); 12521 set_float_rounding_mode(i, &env->vfp.fp_status_f16); 12522 } 12523 if (changed & FPCR_FZ16) { 12524 bool ftz_enabled = val & FPCR_FZ16; 12525 set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16); 12526 set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16); 12527 } 12528 if (changed & FPCR_FZ) { 12529 bool ftz_enabled = val & FPCR_FZ; 12530 set_flush_to_zero(ftz_enabled, &env->vfp.fp_status); 12531 set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status); 12532 } 12533 if (changed & FPCR_DN) { 12534 bool dnan_enabled = val & FPCR_DN; 12535 set_default_nan_mode(dnan_enabled, &env->vfp.fp_status); 12536 set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16); 12537 } 12538 12539 /* The exception flags are ORed together when we read fpscr so we 12540 * only need to preserve the current state in one of our 12541 * float_status values. 12542 */ 12543 i = vfp_exceptbits_to_host(val); 12544 set_float_exception_flags(i, &env->vfp.fp_status); 12545 set_float_exception_flags(0, &env->vfp.fp_status_f16); 12546 set_float_exception_flags(0, &env->vfp.standard_fp_status); 12547 } 12548 12549 void vfp_set_fpscr(CPUARMState *env, uint32_t val) 12550 { 12551 HELPER(vfp_set_fpscr)(env, val); 12552 } 12553 12554 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p)) 12555 12556 #define VFP_BINOP(name) \ 12557 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \ 12558 { \ 12559 float_status *fpst = fpstp; \ 12560 return float32_ ## name(a, b, fpst); \ 12561 } \ 12562 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \ 12563 { \ 12564 float_status *fpst = fpstp; \ 12565 return float64_ ## name(a, b, fpst); \ 12566 } 12567 VFP_BINOP(add) 12568 VFP_BINOP(sub) 12569 VFP_BINOP(mul) 12570 VFP_BINOP(div) 12571 VFP_BINOP(min) 12572 VFP_BINOP(max) 12573 VFP_BINOP(minnum) 12574 VFP_BINOP(maxnum) 12575 #undef VFP_BINOP 12576 12577 float32 VFP_HELPER(neg, s)(float32 a) 12578 { 12579 return float32_chs(a); 12580 } 12581 12582 float64 VFP_HELPER(neg, d)(float64 a) 12583 { 12584 return float64_chs(a); 12585 } 12586 12587 float32 VFP_HELPER(abs, s)(float32 a) 12588 { 12589 return float32_abs(a); 12590 } 12591 12592 float64 VFP_HELPER(abs, d)(float64 a) 12593 { 12594 return float64_abs(a); 12595 } 12596 12597 float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env) 12598 { 12599 return float32_sqrt(a, &env->vfp.fp_status); 12600 } 12601 12602 float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env) 12603 { 12604 return float64_sqrt(a, &env->vfp.fp_status); 12605 } 12606 12607 /* XXX: check quiet/signaling case */ 12608 #define DO_VFP_cmp(p, type) \ 12609 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env) \ 12610 { \ 12611 uint32_t flags; \ 12612 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \ 12613 case 0: flags = 0x6; break; \ 12614 case -1: flags = 0x8; break; \ 12615 case 1: flags = 0x2; break; \ 12616 default: case 2: flags = 0x3; break; \ 12617 } \ 12618 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \ 12619 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \ 12620 } \ 12621 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \ 12622 { \ 12623 uint32_t flags; \ 12624 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \ 12625 case 0: flags = 0x6; break; \ 12626 case -1: flags = 0x8; break; \ 12627 case 1: flags = 0x2; break; \ 12628 default: case 2: flags = 0x3; break; \ 12629 } \ 12630 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \ 12631 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \ 12632 } 12633 DO_VFP_cmp(s, float32) 12634 DO_VFP_cmp(d, float64) 12635 #undef DO_VFP_cmp 12636 12637 /* Integer to float and float to integer conversions */ 12638 12639 #define CONV_ITOF(name, ftype, fsz, sign) \ 12640 ftype HELPER(name)(uint32_t x, void *fpstp) \ 12641 { \ 12642 float_status *fpst = fpstp; \ 12643 return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \ 12644 } 12645 12646 #define CONV_FTOI(name, ftype, fsz, sign, round) \ 12647 sign##int32_t HELPER(name)(ftype x, void *fpstp) \ 12648 { \ 12649 float_status *fpst = fpstp; \ 12650 if (float##fsz##_is_any_nan(x)) { \ 12651 float_raise(float_flag_invalid, fpst); \ 12652 return 0; \ 12653 } \ 12654 return float##fsz##_to_##sign##int32##round(x, fpst); \ 12655 } 12656 12657 #define FLOAT_CONVS(name, p, ftype, fsz, sign) \ 12658 CONV_ITOF(vfp_##name##to##p, ftype, fsz, sign) \ 12659 CONV_FTOI(vfp_to##name##p, ftype, fsz, sign, ) \ 12660 CONV_FTOI(vfp_to##name##z##p, ftype, fsz, sign, _round_to_zero) 12661 12662 FLOAT_CONVS(si, h, uint32_t, 16, ) 12663 FLOAT_CONVS(si, s, float32, 32, ) 12664 FLOAT_CONVS(si, d, float64, 64, ) 12665 FLOAT_CONVS(ui, h, uint32_t, 16, u) 12666 FLOAT_CONVS(ui, s, float32, 32, u) 12667 FLOAT_CONVS(ui, d, float64, 64, u) 12668 12669 #undef CONV_ITOF 12670 #undef CONV_FTOI 12671 #undef FLOAT_CONVS 12672 12673 /* floating point conversion */ 12674 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env) 12675 { 12676 return float32_to_float64(x, &env->vfp.fp_status); 12677 } 12678 12679 float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env) 12680 { 12681 return float64_to_float32(x, &env->vfp.fp_status); 12682 } 12683 12684 /* VFP3 fixed point conversion. */ 12685 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \ 12686 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t x, uint32_t shift, \ 12687 void *fpstp) \ 12688 { return itype##_to_##float##fsz##_scalbn(x, -shift, fpstp); } 12689 12690 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, ROUND, suff) \ 12691 uint##isz##_t HELPER(vfp_to##name##p##suff)(float##fsz x, uint32_t shift, \ 12692 void *fpst) \ 12693 { \ 12694 if (unlikely(float##fsz##_is_any_nan(x))) { \ 12695 float_raise(float_flag_invalid, fpst); \ 12696 return 0; \ 12697 } \ 12698 return float##fsz##_to_##itype##_scalbn(x, ROUND, shift, fpst); \ 12699 } 12700 12701 #define VFP_CONV_FIX(name, p, fsz, isz, itype) \ 12702 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \ 12703 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \ 12704 float_round_to_zero, _round_to_zero) \ 12705 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \ 12706 get_float_rounding_mode(fpst), ) 12707 12708 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype) \ 12709 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \ 12710 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \ 12711 get_float_rounding_mode(fpst), ) 12712 12713 VFP_CONV_FIX(sh, d, 64, 64, int16) 12714 VFP_CONV_FIX(sl, d, 64, 64, int32) 12715 VFP_CONV_FIX_A64(sq, d, 64, 64, int64) 12716 VFP_CONV_FIX(uh, d, 64, 64, uint16) 12717 VFP_CONV_FIX(ul, d, 64, 64, uint32) 12718 VFP_CONV_FIX_A64(uq, d, 64, 64, uint64) 12719 VFP_CONV_FIX(sh, s, 32, 32, int16) 12720 VFP_CONV_FIX(sl, s, 32, 32, int32) 12721 VFP_CONV_FIX_A64(sq, s, 32, 64, int64) 12722 VFP_CONV_FIX(uh, s, 32, 32, uint16) 12723 VFP_CONV_FIX(ul, s, 32, 32, uint32) 12724 VFP_CONV_FIX_A64(uq, s, 32, 64, uint64) 12725 12726 #undef VFP_CONV_FIX 12727 #undef VFP_CONV_FIX_FLOAT 12728 #undef VFP_CONV_FLOAT_FIX_ROUND 12729 #undef VFP_CONV_FIX_A64 12730 12731 uint32_t HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst) 12732 { 12733 return int32_to_float16_scalbn(x, -shift, fpst); 12734 } 12735 12736 uint32_t HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst) 12737 { 12738 return uint32_to_float16_scalbn(x, -shift, fpst); 12739 } 12740 12741 uint32_t HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst) 12742 { 12743 return int64_to_float16_scalbn(x, -shift, fpst); 12744 } 12745 12746 uint32_t HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst) 12747 { 12748 return uint64_to_float16_scalbn(x, -shift, fpst); 12749 } 12750 12751 uint32_t HELPER(vfp_toshh)(uint32_t x, uint32_t shift, void *fpst) 12752 { 12753 if (unlikely(float16_is_any_nan(x))) { 12754 float_raise(float_flag_invalid, fpst); 12755 return 0; 12756 } 12757 return float16_to_int16_scalbn(x, get_float_rounding_mode(fpst), 12758 shift, fpst); 12759 } 12760 12761 uint32_t HELPER(vfp_touhh)(uint32_t x, uint32_t shift, void *fpst) 12762 { 12763 if (unlikely(float16_is_any_nan(x))) { 12764 float_raise(float_flag_invalid, fpst); 12765 return 0; 12766 } 12767 return float16_to_uint16_scalbn(x, get_float_rounding_mode(fpst), 12768 shift, fpst); 12769 } 12770 12771 uint32_t HELPER(vfp_toslh)(uint32_t x, uint32_t shift, void *fpst) 12772 { 12773 if (unlikely(float16_is_any_nan(x))) { 12774 float_raise(float_flag_invalid, fpst); 12775 return 0; 12776 } 12777 return float16_to_int32_scalbn(x, get_float_rounding_mode(fpst), 12778 shift, fpst); 12779 } 12780 12781 uint32_t HELPER(vfp_toulh)(uint32_t x, uint32_t shift, void *fpst) 12782 { 12783 if (unlikely(float16_is_any_nan(x))) { 12784 float_raise(float_flag_invalid, fpst); 12785 return 0; 12786 } 12787 return float16_to_uint32_scalbn(x, get_float_rounding_mode(fpst), 12788 shift, fpst); 12789 } 12790 12791 uint64_t HELPER(vfp_tosqh)(uint32_t x, uint32_t shift, void *fpst) 12792 { 12793 if (unlikely(float16_is_any_nan(x))) { 12794 float_raise(float_flag_invalid, fpst); 12795 return 0; 12796 } 12797 return float16_to_int64_scalbn(x, get_float_rounding_mode(fpst), 12798 shift, fpst); 12799 } 12800 12801 uint64_t HELPER(vfp_touqh)(uint32_t x, uint32_t shift, void *fpst) 12802 { 12803 if (unlikely(float16_is_any_nan(x))) { 12804 float_raise(float_flag_invalid, fpst); 12805 return 0; 12806 } 12807 return float16_to_uint64_scalbn(x, get_float_rounding_mode(fpst), 12808 shift, fpst); 12809 } 12810 12811 /* Set the current fp rounding mode and return the old one. 12812 * The argument is a softfloat float_round_ value. 12813 */ 12814 uint32_t HELPER(set_rmode)(uint32_t rmode, void *fpstp) 12815 { 12816 float_status *fp_status = fpstp; 12817 12818 uint32_t prev_rmode = get_float_rounding_mode(fp_status); 12819 set_float_rounding_mode(rmode, fp_status); 12820 12821 return prev_rmode; 12822 } 12823 12824 /* Set the current fp rounding mode in the standard fp status and return 12825 * the old one. This is for NEON instructions that need to change the 12826 * rounding mode but wish to use the standard FPSCR values for everything 12827 * else. Always set the rounding mode back to the correct value after 12828 * modifying it. 12829 * The argument is a softfloat float_round_ value. 12830 */ 12831 uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env) 12832 { 12833 float_status *fp_status = &env->vfp.standard_fp_status; 12834 12835 uint32_t prev_rmode = get_float_rounding_mode(fp_status); 12836 set_float_rounding_mode(rmode, fp_status); 12837 12838 return prev_rmode; 12839 } 12840 12841 /* Half precision conversions. */ 12842 float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, void *fpstp, uint32_t ahp_mode) 12843 { 12844 /* Squash FZ16 to 0 for the duration of conversion. In this case, 12845 * it would affect flushing input denormals. 12846 */ 12847 float_status *fpst = fpstp; 12848 flag save = get_flush_inputs_to_zero(fpst); 12849 set_flush_inputs_to_zero(false, fpst); 12850 float32 r = float16_to_float32(a, !ahp_mode, fpst); 12851 set_flush_inputs_to_zero(save, fpst); 12852 return r; 12853 } 12854 12855 uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode) 12856 { 12857 /* Squash FZ16 to 0 for the duration of conversion. In this case, 12858 * it would affect flushing output denormals. 12859 */ 12860 float_status *fpst = fpstp; 12861 flag save = get_flush_to_zero(fpst); 12862 set_flush_to_zero(false, fpst); 12863 float16 r = float32_to_float16(a, !ahp_mode, fpst); 12864 set_flush_to_zero(save, fpst); 12865 return r; 12866 } 12867 12868 float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, void *fpstp, uint32_t ahp_mode) 12869 { 12870 /* Squash FZ16 to 0 for the duration of conversion. In this case, 12871 * it would affect flushing input denormals. 12872 */ 12873 float_status *fpst = fpstp; 12874 flag save = get_flush_inputs_to_zero(fpst); 12875 set_flush_inputs_to_zero(false, fpst); 12876 float64 r = float16_to_float64(a, !ahp_mode, fpst); 12877 set_flush_inputs_to_zero(save, fpst); 12878 return r; 12879 } 12880 12881 uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode) 12882 { 12883 /* Squash FZ16 to 0 for the duration of conversion. In this case, 12884 * it would affect flushing output denormals. 12885 */ 12886 float_status *fpst = fpstp; 12887 flag save = get_flush_to_zero(fpst); 12888 set_flush_to_zero(false, fpst); 12889 float16 r = float64_to_float16(a, !ahp_mode, fpst); 12890 set_flush_to_zero(save, fpst); 12891 return r; 12892 } 12893 12894 #define float32_two make_float32(0x40000000) 12895 #define float32_three make_float32(0x40400000) 12896 #define float32_one_point_five make_float32(0x3fc00000) 12897 12898 float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env) 12899 { 12900 float_status *s = &env->vfp.standard_fp_status; 12901 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) || 12902 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) { 12903 if (!(float32_is_zero(a) || float32_is_zero(b))) { 12904 float_raise(float_flag_input_denormal, s); 12905 } 12906 return float32_two; 12907 } 12908 return float32_sub(float32_two, float32_mul(a, b, s), s); 12909 } 12910 12911 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env) 12912 { 12913 float_status *s = &env->vfp.standard_fp_status; 12914 float32 product; 12915 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) || 12916 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) { 12917 if (!(float32_is_zero(a) || float32_is_zero(b))) { 12918 float_raise(float_flag_input_denormal, s); 12919 } 12920 return float32_one_point_five; 12921 } 12922 product = float32_mul(a, b, s); 12923 return float32_div(float32_sub(float32_three, product, s), float32_two, s); 12924 } 12925 12926 /* NEON helpers. */ 12927 12928 /* Constants 256 and 512 are used in some helpers; we avoid relying on 12929 * int->float conversions at run-time. */ 12930 #define float64_256 make_float64(0x4070000000000000LL) 12931 #define float64_512 make_float64(0x4080000000000000LL) 12932 #define float16_maxnorm make_float16(0x7bff) 12933 #define float32_maxnorm make_float32(0x7f7fffff) 12934 #define float64_maxnorm make_float64(0x7fefffffffffffffLL) 12935 12936 /* Reciprocal functions 12937 * 12938 * The algorithm that must be used to calculate the estimate 12939 * is specified by the ARM ARM, see FPRecipEstimate()/RecipEstimate 12940 */ 12941 12942 /* See RecipEstimate() 12943 * 12944 * input is a 9 bit fixed point number 12945 * input range 256 .. 511 for a number from 0.5 <= x < 1.0. 12946 * result range 256 .. 511 for a number from 1.0 to 511/256. 12947 */ 12948 12949 static int recip_estimate(int input) 12950 { 12951 int a, b, r; 12952 assert(256 <= input && input < 512); 12953 a = (input * 2) + 1; 12954 b = (1 << 19) / a; 12955 r = (b + 1) >> 1; 12956 assert(256 <= r && r < 512); 12957 return r; 12958 } 12959 12960 /* 12961 * Common wrapper to call recip_estimate 12962 * 12963 * The parameters are exponent and 64 bit fraction (without implicit 12964 * bit) where the binary point is nominally at bit 52. Returns a 12965 * float64 which can then be rounded to the appropriate size by the 12966 * callee. 12967 */ 12968 12969 static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac) 12970 { 12971 uint32_t scaled, estimate; 12972 uint64_t result_frac; 12973 int result_exp; 12974 12975 /* Handle sub-normals */ 12976 if (*exp == 0) { 12977 if (extract64(frac, 51, 1) == 0) { 12978 *exp = -1; 12979 frac <<= 2; 12980 } else { 12981 frac <<= 1; 12982 } 12983 } 12984 12985 /* scaled = UInt('1':fraction<51:44>) */ 12986 scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8)); 12987 estimate = recip_estimate(scaled); 12988 12989 result_exp = exp_off - *exp; 12990 result_frac = deposit64(0, 44, 8, estimate); 12991 if (result_exp == 0) { 12992 result_frac = deposit64(result_frac >> 1, 51, 1, 1); 12993 } else if (result_exp == -1) { 12994 result_frac = deposit64(result_frac >> 2, 50, 2, 1); 12995 result_exp = 0; 12996 } 12997 12998 *exp = result_exp; 12999 13000 return result_frac; 13001 } 13002 13003 static bool round_to_inf(float_status *fpst, bool sign_bit) 13004 { 13005 switch (fpst->float_rounding_mode) { 13006 case float_round_nearest_even: /* Round to Nearest */ 13007 return true; 13008 case float_round_up: /* Round to +Inf */ 13009 return !sign_bit; 13010 case float_round_down: /* Round to -Inf */ 13011 return sign_bit; 13012 case float_round_to_zero: /* Round to Zero */ 13013 return false; 13014 } 13015 13016 g_assert_not_reached(); 13017 } 13018 13019 uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp) 13020 { 13021 float_status *fpst = fpstp; 13022 float16 f16 = float16_squash_input_denormal(input, fpst); 13023 uint32_t f16_val = float16_val(f16); 13024 uint32_t f16_sign = float16_is_neg(f16); 13025 int f16_exp = extract32(f16_val, 10, 5); 13026 uint32_t f16_frac = extract32(f16_val, 0, 10); 13027 uint64_t f64_frac; 13028 13029 if (float16_is_any_nan(f16)) { 13030 float16 nan = f16; 13031 if (float16_is_signaling_nan(f16, fpst)) { 13032 float_raise(float_flag_invalid, fpst); 13033 nan = float16_silence_nan(f16, fpst); 13034 } 13035 if (fpst->default_nan_mode) { 13036 nan = float16_default_nan(fpst); 13037 } 13038 return nan; 13039 } else if (float16_is_infinity(f16)) { 13040 return float16_set_sign(float16_zero, float16_is_neg(f16)); 13041 } else if (float16_is_zero(f16)) { 13042 float_raise(float_flag_divbyzero, fpst); 13043 return float16_set_sign(float16_infinity, float16_is_neg(f16)); 13044 } else if (float16_abs(f16) < (1 << 8)) { 13045 /* Abs(value) < 2.0^-16 */ 13046 float_raise(float_flag_overflow | float_flag_inexact, fpst); 13047 if (round_to_inf(fpst, f16_sign)) { 13048 return float16_set_sign(float16_infinity, f16_sign); 13049 } else { 13050 return float16_set_sign(float16_maxnorm, f16_sign); 13051 } 13052 } else if (f16_exp >= 29 && fpst->flush_to_zero) { 13053 float_raise(float_flag_underflow, fpst); 13054 return float16_set_sign(float16_zero, float16_is_neg(f16)); 13055 } 13056 13057 f64_frac = call_recip_estimate(&f16_exp, 29, 13058 ((uint64_t) f16_frac) << (52 - 10)); 13059 13060 /* result = sign : result_exp<4:0> : fraction<51:42> */ 13061 f16_val = deposit32(0, 15, 1, f16_sign); 13062 f16_val = deposit32(f16_val, 10, 5, f16_exp); 13063 f16_val = deposit32(f16_val, 0, 10, extract64(f64_frac, 52 - 10, 10)); 13064 return make_float16(f16_val); 13065 } 13066 13067 float32 HELPER(recpe_f32)(float32 input, void *fpstp) 13068 { 13069 float_status *fpst = fpstp; 13070 float32 f32 = float32_squash_input_denormal(input, fpst); 13071 uint32_t f32_val = float32_val(f32); 13072 bool f32_sign = float32_is_neg(f32); 13073 int f32_exp = extract32(f32_val, 23, 8); 13074 uint32_t f32_frac = extract32(f32_val, 0, 23); 13075 uint64_t f64_frac; 13076 13077 if (float32_is_any_nan(f32)) { 13078 float32 nan = f32; 13079 if (float32_is_signaling_nan(f32, fpst)) { 13080 float_raise(float_flag_invalid, fpst); 13081 nan = float32_silence_nan(f32, fpst); 13082 } 13083 if (fpst->default_nan_mode) { 13084 nan = float32_default_nan(fpst); 13085 } 13086 return nan; 13087 } else if (float32_is_infinity(f32)) { 13088 return float32_set_sign(float32_zero, float32_is_neg(f32)); 13089 } else if (float32_is_zero(f32)) { 13090 float_raise(float_flag_divbyzero, fpst); 13091 return float32_set_sign(float32_infinity, float32_is_neg(f32)); 13092 } else if (float32_abs(f32) < (1ULL << 21)) { 13093 /* Abs(value) < 2.0^-128 */ 13094 float_raise(float_flag_overflow | float_flag_inexact, fpst); 13095 if (round_to_inf(fpst, f32_sign)) { 13096 return float32_set_sign(float32_infinity, f32_sign); 13097 } else { 13098 return float32_set_sign(float32_maxnorm, f32_sign); 13099 } 13100 } else if (f32_exp >= 253 && fpst->flush_to_zero) { 13101 float_raise(float_flag_underflow, fpst); 13102 return float32_set_sign(float32_zero, float32_is_neg(f32)); 13103 } 13104 13105 f64_frac = call_recip_estimate(&f32_exp, 253, 13106 ((uint64_t) f32_frac) << (52 - 23)); 13107 13108 /* result = sign : result_exp<7:0> : fraction<51:29> */ 13109 f32_val = deposit32(0, 31, 1, f32_sign); 13110 f32_val = deposit32(f32_val, 23, 8, f32_exp); 13111 f32_val = deposit32(f32_val, 0, 23, extract64(f64_frac, 52 - 23, 23)); 13112 return make_float32(f32_val); 13113 } 13114 13115 float64 HELPER(recpe_f64)(float64 input, void *fpstp) 13116 { 13117 float_status *fpst = fpstp; 13118 float64 f64 = float64_squash_input_denormal(input, fpst); 13119 uint64_t f64_val = float64_val(f64); 13120 bool f64_sign = float64_is_neg(f64); 13121 int f64_exp = extract64(f64_val, 52, 11); 13122 uint64_t f64_frac = extract64(f64_val, 0, 52); 13123 13124 /* Deal with any special cases */ 13125 if (float64_is_any_nan(f64)) { 13126 float64 nan = f64; 13127 if (float64_is_signaling_nan(f64, fpst)) { 13128 float_raise(float_flag_invalid, fpst); 13129 nan = float64_silence_nan(f64, fpst); 13130 } 13131 if (fpst->default_nan_mode) { 13132 nan = float64_default_nan(fpst); 13133 } 13134 return nan; 13135 } else if (float64_is_infinity(f64)) { 13136 return float64_set_sign(float64_zero, float64_is_neg(f64)); 13137 } else if (float64_is_zero(f64)) { 13138 float_raise(float_flag_divbyzero, fpst); 13139 return float64_set_sign(float64_infinity, float64_is_neg(f64)); 13140 } else if ((f64_val & ~(1ULL << 63)) < (1ULL << 50)) { 13141 /* Abs(value) < 2.0^-1024 */ 13142 float_raise(float_flag_overflow | float_flag_inexact, fpst); 13143 if (round_to_inf(fpst, f64_sign)) { 13144 return float64_set_sign(float64_infinity, f64_sign); 13145 } else { 13146 return float64_set_sign(float64_maxnorm, f64_sign); 13147 } 13148 } else if (f64_exp >= 2045 && fpst->flush_to_zero) { 13149 float_raise(float_flag_underflow, fpst); 13150 return float64_set_sign(float64_zero, float64_is_neg(f64)); 13151 } 13152 13153 f64_frac = call_recip_estimate(&f64_exp, 2045, f64_frac); 13154 13155 /* result = sign : result_exp<10:0> : fraction<51:0>; */ 13156 f64_val = deposit64(0, 63, 1, f64_sign); 13157 f64_val = deposit64(f64_val, 52, 11, f64_exp); 13158 f64_val = deposit64(f64_val, 0, 52, f64_frac); 13159 return make_float64(f64_val); 13160 } 13161 13162 /* The algorithm that must be used to calculate the estimate 13163 * is specified by the ARM ARM. 13164 */ 13165 13166 static int do_recip_sqrt_estimate(int a) 13167 { 13168 int b, estimate; 13169 13170 assert(128 <= a && a < 512); 13171 if (a < 256) { 13172 a = a * 2 + 1; 13173 } else { 13174 a = (a >> 1) << 1; 13175 a = (a + 1) * 2; 13176 } 13177 b = 512; 13178 while (a * (b + 1) * (b + 1) < (1 << 28)) { 13179 b += 1; 13180 } 13181 estimate = (b + 1) / 2; 13182 assert(256 <= estimate && estimate < 512); 13183 13184 return estimate; 13185 } 13186 13187 13188 static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac) 13189 { 13190 int estimate; 13191 uint32_t scaled; 13192 13193 if (*exp == 0) { 13194 while (extract64(frac, 51, 1) == 0) { 13195 frac = frac << 1; 13196 *exp -= 1; 13197 } 13198 frac = extract64(frac, 0, 51) << 1; 13199 } 13200 13201 if (*exp & 1) { 13202 /* scaled = UInt('01':fraction<51:45>) */ 13203 scaled = deposit32(1 << 7, 0, 7, extract64(frac, 45, 7)); 13204 } else { 13205 /* scaled = UInt('1':fraction<51:44>) */ 13206 scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8)); 13207 } 13208 estimate = do_recip_sqrt_estimate(scaled); 13209 13210 *exp = (exp_off - *exp) / 2; 13211 return extract64(estimate, 0, 8) << 44; 13212 } 13213 13214 uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp) 13215 { 13216 float_status *s = fpstp; 13217 float16 f16 = float16_squash_input_denormal(input, s); 13218 uint16_t val = float16_val(f16); 13219 bool f16_sign = float16_is_neg(f16); 13220 int f16_exp = extract32(val, 10, 5); 13221 uint16_t f16_frac = extract32(val, 0, 10); 13222 uint64_t f64_frac; 13223 13224 if (float16_is_any_nan(f16)) { 13225 float16 nan = f16; 13226 if (float16_is_signaling_nan(f16, s)) { 13227 float_raise(float_flag_invalid, s); 13228 nan = float16_silence_nan(f16, s); 13229 } 13230 if (s->default_nan_mode) { 13231 nan = float16_default_nan(s); 13232 } 13233 return nan; 13234 } else if (float16_is_zero(f16)) { 13235 float_raise(float_flag_divbyzero, s); 13236 return float16_set_sign(float16_infinity, f16_sign); 13237 } else if (f16_sign) { 13238 float_raise(float_flag_invalid, s); 13239 return float16_default_nan(s); 13240 } else if (float16_is_infinity(f16)) { 13241 return float16_zero; 13242 } 13243 13244 /* Scale and normalize to a double-precision value between 0.25 and 1.0, 13245 * preserving the parity of the exponent. */ 13246 13247 f64_frac = ((uint64_t) f16_frac) << (52 - 10); 13248 13249 f64_frac = recip_sqrt_estimate(&f16_exp, 44, f64_frac); 13250 13251 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(2) */ 13252 val = deposit32(0, 15, 1, f16_sign); 13253 val = deposit32(val, 10, 5, f16_exp); 13254 val = deposit32(val, 2, 8, extract64(f64_frac, 52 - 8, 8)); 13255 return make_float16(val); 13256 } 13257 13258 float32 HELPER(rsqrte_f32)(float32 input, void *fpstp) 13259 { 13260 float_status *s = fpstp; 13261 float32 f32 = float32_squash_input_denormal(input, s); 13262 uint32_t val = float32_val(f32); 13263 uint32_t f32_sign = float32_is_neg(f32); 13264 int f32_exp = extract32(val, 23, 8); 13265 uint32_t f32_frac = extract32(val, 0, 23); 13266 uint64_t f64_frac; 13267 13268 if (float32_is_any_nan(f32)) { 13269 float32 nan = f32; 13270 if (float32_is_signaling_nan(f32, s)) { 13271 float_raise(float_flag_invalid, s); 13272 nan = float32_silence_nan(f32, s); 13273 } 13274 if (s->default_nan_mode) { 13275 nan = float32_default_nan(s); 13276 } 13277 return nan; 13278 } else if (float32_is_zero(f32)) { 13279 float_raise(float_flag_divbyzero, s); 13280 return float32_set_sign(float32_infinity, float32_is_neg(f32)); 13281 } else if (float32_is_neg(f32)) { 13282 float_raise(float_flag_invalid, s); 13283 return float32_default_nan(s); 13284 } else if (float32_is_infinity(f32)) { 13285 return float32_zero; 13286 } 13287 13288 /* Scale and normalize to a double-precision value between 0.25 and 1.0, 13289 * preserving the parity of the exponent. */ 13290 13291 f64_frac = ((uint64_t) f32_frac) << 29; 13292 13293 f64_frac = recip_sqrt_estimate(&f32_exp, 380, f64_frac); 13294 13295 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(15) */ 13296 val = deposit32(0, 31, 1, f32_sign); 13297 val = deposit32(val, 23, 8, f32_exp); 13298 val = deposit32(val, 15, 8, extract64(f64_frac, 52 - 8, 8)); 13299 return make_float32(val); 13300 } 13301 13302 float64 HELPER(rsqrte_f64)(float64 input, void *fpstp) 13303 { 13304 float_status *s = fpstp; 13305 float64 f64 = float64_squash_input_denormal(input, s); 13306 uint64_t val = float64_val(f64); 13307 bool f64_sign = float64_is_neg(f64); 13308 int f64_exp = extract64(val, 52, 11); 13309 uint64_t f64_frac = extract64(val, 0, 52); 13310 13311 if (float64_is_any_nan(f64)) { 13312 float64 nan = f64; 13313 if (float64_is_signaling_nan(f64, s)) { 13314 float_raise(float_flag_invalid, s); 13315 nan = float64_silence_nan(f64, s); 13316 } 13317 if (s->default_nan_mode) { 13318 nan = float64_default_nan(s); 13319 } 13320 return nan; 13321 } else if (float64_is_zero(f64)) { 13322 float_raise(float_flag_divbyzero, s); 13323 return float64_set_sign(float64_infinity, float64_is_neg(f64)); 13324 } else if (float64_is_neg(f64)) { 13325 float_raise(float_flag_invalid, s); 13326 return float64_default_nan(s); 13327 } else if (float64_is_infinity(f64)) { 13328 return float64_zero; 13329 } 13330 13331 f64_frac = recip_sqrt_estimate(&f64_exp, 3068, f64_frac); 13332 13333 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(44) */ 13334 val = deposit64(0, 61, 1, f64_sign); 13335 val = deposit64(val, 52, 11, f64_exp); 13336 val = deposit64(val, 44, 8, extract64(f64_frac, 52 - 8, 8)); 13337 return make_float64(val); 13338 } 13339 13340 uint32_t HELPER(recpe_u32)(uint32_t a, void *fpstp) 13341 { 13342 /* float_status *s = fpstp; */ 13343 int input, estimate; 13344 13345 if ((a & 0x80000000) == 0) { 13346 return 0xffffffff; 13347 } 13348 13349 input = extract32(a, 23, 9); 13350 estimate = recip_estimate(input); 13351 13352 return deposit32(0, (32 - 9), 9, estimate); 13353 } 13354 13355 uint32_t HELPER(rsqrte_u32)(uint32_t a, void *fpstp) 13356 { 13357 int estimate; 13358 13359 if ((a & 0xc0000000) == 0) { 13360 return 0xffffffff; 13361 } 13362 13363 estimate = do_recip_sqrt_estimate(extract32(a, 23, 9)); 13364 13365 return deposit32(0, 23, 9, estimate); 13366 } 13367 13368 /* VFPv4 fused multiply-accumulate */ 13369 float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp) 13370 { 13371 float_status *fpst = fpstp; 13372 return float32_muladd(a, b, c, 0, fpst); 13373 } 13374 13375 float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp) 13376 { 13377 float_status *fpst = fpstp; 13378 return float64_muladd(a, b, c, 0, fpst); 13379 } 13380 13381 /* ARMv8 round to integral */ 13382 float32 HELPER(rints_exact)(float32 x, void *fp_status) 13383 { 13384 return float32_round_to_int(x, fp_status); 13385 } 13386 13387 float64 HELPER(rintd_exact)(float64 x, void *fp_status) 13388 { 13389 return float64_round_to_int(x, fp_status); 13390 } 13391 13392 float32 HELPER(rints)(float32 x, void *fp_status) 13393 { 13394 int old_flags = get_float_exception_flags(fp_status), new_flags; 13395 float32 ret; 13396 13397 ret = float32_round_to_int(x, fp_status); 13398 13399 /* Suppress any inexact exceptions the conversion produced */ 13400 if (!(old_flags & float_flag_inexact)) { 13401 new_flags = get_float_exception_flags(fp_status); 13402 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status); 13403 } 13404 13405 return ret; 13406 } 13407 13408 float64 HELPER(rintd)(float64 x, void *fp_status) 13409 { 13410 int old_flags = get_float_exception_flags(fp_status), new_flags; 13411 float64 ret; 13412 13413 ret = float64_round_to_int(x, fp_status); 13414 13415 new_flags = get_float_exception_flags(fp_status); 13416 13417 /* Suppress any inexact exceptions the conversion produced */ 13418 if (!(old_flags & float_flag_inexact)) { 13419 new_flags = get_float_exception_flags(fp_status); 13420 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status); 13421 } 13422 13423 return ret; 13424 } 13425 13426 /* Convert ARM rounding mode to softfloat */ 13427 int arm_rmode_to_sf(int rmode) 13428 { 13429 switch (rmode) { 13430 case FPROUNDING_TIEAWAY: 13431 rmode = float_round_ties_away; 13432 break; 13433 case FPROUNDING_ODD: 13434 /* FIXME: add support for TIEAWAY and ODD */ 13435 qemu_log_mask(LOG_UNIMP, "arm: unimplemented rounding mode: %d\n", 13436 rmode); 13437 /* fall through for now */ 13438 case FPROUNDING_TIEEVEN: 13439 default: 13440 rmode = float_round_nearest_even; 13441 break; 13442 case FPROUNDING_POSINF: 13443 rmode = float_round_up; 13444 break; 13445 case FPROUNDING_NEGINF: 13446 rmode = float_round_down; 13447 break; 13448 case FPROUNDING_ZERO: 13449 rmode = float_round_to_zero; 13450 break; 13451 } 13452 return rmode; 13453 } 13454 13455 /* CRC helpers. 13456 * The upper bytes of val (above the number specified by 'bytes') must have 13457 * been zeroed out by the caller. 13458 */ 13459 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 13460 { 13461 uint8_t buf[4]; 13462 13463 stl_le_p(buf, val); 13464 13465 /* zlib crc32 converts the accumulator and output to one's complement. */ 13466 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 13467 } 13468 13469 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 13470 { 13471 uint8_t buf[4]; 13472 13473 stl_le_p(buf, val); 13474 13475 /* Linux crc32c converts the output to one's complement. */ 13476 return crc32c(acc, buf, bytes) ^ 0xffffffff; 13477 } 13478 13479 /* Return the exception level to which FP-disabled exceptions should 13480 * be taken, or 0 if FP is enabled. 13481 */ 13482 int fp_exception_el(CPUARMState *env, int cur_el) 13483 { 13484 #ifndef CONFIG_USER_ONLY 13485 int fpen; 13486 13487 /* CPACR and the CPTR registers don't exist before v6, so FP is 13488 * always accessible 13489 */ 13490 if (!arm_feature(env, ARM_FEATURE_V6)) { 13491 return 0; 13492 } 13493 13494 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit: 13495 * 0, 2 : trap EL0 and EL1/PL1 accesses 13496 * 1 : trap only EL0 accesses 13497 * 3 : trap no accesses 13498 */ 13499 fpen = extract32(env->cp15.cpacr_el1, 20, 2); 13500 switch (fpen) { 13501 case 0: 13502 case 2: 13503 if (cur_el == 0 || cur_el == 1) { 13504 /* Trap to PL1, which might be EL1 or EL3 */ 13505 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) { 13506 return 3; 13507 } 13508 return 1; 13509 } 13510 if (cur_el == 3 && !is_a64(env)) { 13511 /* Secure PL1 running at EL3 */ 13512 return 3; 13513 } 13514 break; 13515 case 1: 13516 if (cur_el == 0) { 13517 return 1; 13518 } 13519 break; 13520 case 3: 13521 break; 13522 } 13523 13524 /* For the CPTR registers we don't need to guard with an ARM_FEATURE 13525 * check because zero bits in the registers mean "don't trap". 13526 */ 13527 13528 /* CPTR_EL2 : present in v7VE or v8 */ 13529 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1) 13530 && !arm_is_secure_below_el3(env)) { 13531 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */ 13532 return 2; 13533 } 13534 13535 /* CPTR_EL3 : present in v8 */ 13536 if (extract32(env->cp15.cptr_el[3], 10, 1)) { 13537 /* Trap all FP ops to EL3 */ 13538 return 3; 13539 } 13540 #endif 13541 return 0; 13542 } 13543 13544 ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env, 13545 bool secstate, bool priv) 13546 { 13547 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M; 13548 13549 if (priv) { 13550 mmu_idx |= ARM_MMU_IDX_M_PRIV; 13551 } 13552 13553 if (armv7m_nvic_neg_prio_requested(env->nvic, secstate)) { 13554 mmu_idx |= ARM_MMU_IDX_M_NEGPRI; 13555 } 13556 13557 if (secstate) { 13558 mmu_idx |= ARM_MMU_IDX_M_S; 13559 } 13560 13561 return mmu_idx; 13562 } 13563 13564 /* Return the MMU index for a v7M CPU in the specified security state */ 13565 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 13566 { 13567 bool priv = arm_current_el(env) != 0; 13568 13569 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv); 13570 } 13571 13572 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 13573 { 13574 int el; 13575 13576 if (arm_feature(env, ARM_FEATURE_M)) { 13577 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 13578 } 13579 13580 el = arm_current_el(env); 13581 if (el < 2 && arm_is_secure_below_el3(env)) { 13582 return ARMMMUIdx_S1SE0 + el; 13583 } else { 13584 return ARMMMUIdx_S12NSE0 + el; 13585 } 13586 } 13587 13588 int cpu_mmu_index(CPUARMState *env, bool ifetch) 13589 { 13590 return arm_to_core_mmu_idx(arm_mmu_idx(env)); 13591 } 13592 13593 #ifndef CONFIG_USER_ONLY 13594 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 13595 { 13596 return stage_1_mmu_idx(arm_mmu_idx(env)); 13597 } 13598 #endif 13599 13600 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 13601 target_ulong *cs_base, uint32_t *pflags) 13602 { 13603 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 13604 int current_el = arm_current_el(env); 13605 int fp_el = fp_exception_el(env, current_el); 13606 uint32_t flags = 0; 13607 13608 if (is_a64(env)) { 13609 ARMCPU *cpu = arm_env_get_cpu(env); 13610 13611 *pc = env->pc; 13612 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1); 13613 13614 #ifndef CONFIG_USER_ONLY 13615 /* 13616 * Get control bits for tagged addresses. Note that the 13617 * translator only uses this for instruction addresses. 13618 */ 13619 { 13620 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx); 13621 ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1); 13622 int tbii, tbid; 13623 13624 /* FIXME: ARMv8.1-VHE S2 translation regime. */ 13625 if (regime_el(env, stage1) < 2) { 13626 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1); 13627 tbid = (p1.tbi << 1) | p0.tbi; 13628 tbii = tbid & ~((p1.tbid << 1) | p0.tbid); 13629 } else { 13630 tbid = p0.tbi; 13631 tbii = tbid & !p0.tbid; 13632 } 13633 13634 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii); 13635 } 13636 #endif 13637 13638 if (cpu_isar_feature(aa64_sve, cpu)) { 13639 int sve_el = sve_exception_el(env, current_el); 13640 uint32_t zcr_len; 13641 13642 /* If SVE is disabled, but FP is enabled, 13643 * then the effective len is 0. 13644 */ 13645 if (sve_el != 0 && fp_el == 0) { 13646 zcr_len = 0; 13647 } else { 13648 zcr_len = sve_zcr_len_for_el(env, current_el); 13649 } 13650 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el); 13651 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len); 13652 } 13653 13654 if (cpu_isar_feature(aa64_pauth, cpu)) { 13655 /* 13656 * In order to save space in flags, we record only whether 13657 * pauth is "inactive", meaning all insns are implemented as 13658 * a nop, or "active" when some action must be performed. 13659 * The decision of which action to take is left to a helper. 13660 */ 13661 uint64_t sctlr; 13662 if (current_el == 0) { 13663 /* FIXME: ARMv8.1-VHE S2 translation regime. */ 13664 sctlr = env->cp15.sctlr_el[1]; 13665 } else { 13666 sctlr = env->cp15.sctlr_el[current_el]; 13667 } 13668 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) { 13669 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1); 13670 } 13671 } 13672 } else { 13673 *pc = env->regs[15]; 13674 flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb); 13675 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, env->vfp.vec_len); 13676 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, env->vfp.vec_stride); 13677 flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits); 13678 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, arm_sctlr_b(env)); 13679 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env)); 13680 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30) 13681 || arm_el_is_aa64(env, 1)) { 13682 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 13683 } 13684 flags = FIELD_DP32(flags, TBFLAG_A32, XSCALE_CPAR, env->cp15.c15_cpar); 13685 } 13686 13687 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, arm_to_core_mmu_idx(mmu_idx)); 13688 13689 /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 13690 * states defined in the ARM ARM for software singlestep: 13691 * SS_ACTIVE PSTATE.SS State 13692 * 0 x Inactive (the TB flag for SS is always 0) 13693 * 1 0 Active-pending 13694 * 1 1 Active-not-pending 13695 */ 13696 if (arm_singlestep_active(env)) { 13697 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1); 13698 if (is_a64(env)) { 13699 if (env->pstate & PSTATE_SS) { 13700 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 13701 } 13702 } else { 13703 if (env->uncached_cpsr & PSTATE_SS) { 13704 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 13705 } 13706 } 13707 } 13708 if (arm_cpu_data_is_big_endian(env)) { 13709 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 13710 } 13711 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el); 13712 13713 if (arm_v7m_is_handler_mode(env)) { 13714 flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1); 13715 } 13716 13717 /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is 13718 * suppressing them because the requested execution priority is less than 0. 13719 */ 13720 if (arm_feature(env, ARM_FEATURE_V8) && 13721 arm_feature(env, ARM_FEATURE_M) && 13722 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) && 13723 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) { 13724 flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1); 13725 } 13726 13727 *pflags = flags; 13728 *cs_base = 0; 13729 } 13730 13731 #ifdef TARGET_AARCH64 13732 /* 13733 * The manual says that when SVE is enabled and VQ is widened the 13734 * implementation is allowed to zero the previously inaccessible 13735 * portion of the registers. The corollary to that is that when 13736 * SVE is enabled and VQ is narrowed we are also allowed to zero 13737 * the now inaccessible portion of the registers. 13738 * 13739 * The intent of this is that no predicate bit beyond VQ is ever set. 13740 * Which means that some operations on predicate registers themselves 13741 * may operate on full uint64_t or even unrolled across the maximum 13742 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 13743 * may well be cheaper than conditionals to restrict the operation 13744 * to the relevant portion of a uint16_t[16]. 13745 */ 13746 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 13747 { 13748 int i, j; 13749 uint64_t pmask; 13750 13751 assert(vq >= 1 && vq <= ARM_MAX_VQ); 13752 assert(vq <= arm_env_get_cpu(env)->sve_max_vq); 13753 13754 /* Zap the high bits of the zregs. */ 13755 for (i = 0; i < 32; i++) { 13756 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 13757 } 13758 13759 /* Zap the high bits of the pregs and ffr. */ 13760 pmask = 0; 13761 if (vq & 3) { 13762 pmask = ~(-1ULL << (16 * (vq & 3))); 13763 } 13764 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 13765 for (i = 0; i < 17; ++i) { 13766 env->vfp.pregs[i].p[j] &= pmask; 13767 } 13768 pmask = 0; 13769 } 13770 } 13771 13772 /* 13773 * Notice a change in SVE vector size when changing EL. 13774 */ 13775 void aarch64_sve_change_el(CPUARMState *env, int old_el, 13776 int new_el, bool el0_a64) 13777 { 13778 ARMCPU *cpu = arm_env_get_cpu(env); 13779 int old_len, new_len; 13780 bool old_a64, new_a64; 13781 13782 /* Nothing to do if no SVE. */ 13783 if (!cpu_isar_feature(aa64_sve, cpu)) { 13784 return; 13785 } 13786 13787 /* Nothing to do if FP is disabled in either EL. */ 13788 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 13789 return; 13790 } 13791 13792 /* 13793 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 13794 * at ELx, or not available because the EL is in AArch32 state, then 13795 * for all purposes other than a direct read, the ZCR_ELx.LEN field 13796 * has an effective value of 0". 13797 * 13798 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 13799 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 13800 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 13801 * we already have the correct register contents when encountering the 13802 * vq0->vq0 transition between EL0->EL1. 13803 */ 13804 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 13805 old_len = (old_a64 && !sve_exception_el(env, old_el) 13806 ? sve_zcr_len_for_el(env, old_el) : 0); 13807 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 13808 new_len = (new_a64 && !sve_exception_el(env, new_el) 13809 ? sve_zcr_len_for_el(env, new_el) : 0); 13810 13811 /* When changing vector length, clear inaccessible state. */ 13812 if (new_len < old_len) { 13813 aarch64_sve_narrow_vq(env, new_len + 1); 13814 } 13815 } 13816 #endif 13817