1 #include "qemu/osdep.h" 2 #include "target/arm/idau.h" 3 #include "trace.h" 4 #include "cpu.h" 5 #include "internals.h" 6 #include "exec/gdbstub.h" 7 #include "exec/helper-proto.h" 8 #include "qemu/host-utils.h" 9 #include "sysemu/arch_init.h" 10 #include "sysemu/sysemu.h" 11 #include "qemu/bitops.h" 12 #include "qemu/crc32c.h" 13 #include "qemu/qemu-print.h" 14 #include "exec/exec-all.h" 15 #include "exec/cpu_ldst.h" 16 #include "arm_ldst.h" 17 #include <zlib.h> /* For crc32 */ 18 #include "exec/semihost.h" 19 #include "sysemu/cpus.h" 20 #include "sysemu/kvm.h" 21 #include "fpu/softfloat.h" 22 #include "qemu/range.h" 23 #include "qapi/qapi-commands-target.h" 24 25 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 26 27 #ifndef CONFIG_USER_ONLY 28 /* Cacheability and shareability attributes for a memory access */ 29 typedef struct ARMCacheAttrs { 30 unsigned int attrs:8; /* as in the MAIR register encoding */ 31 unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */ 32 } ARMCacheAttrs; 33 34 static bool get_phys_addr(CPUARMState *env, target_ulong address, 35 MMUAccessType access_type, ARMMMUIdx mmu_idx, 36 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 37 target_ulong *page_size, 38 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 39 40 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 41 MMUAccessType access_type, ARMMMUIdx mmu_idx, 42 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 43 target_ulong *page_size_ptr, 44 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 45 46 /* Security attributes for an address, as returned by v8m_security_lookup. */ 47 typedef struct V8M_SAttributes { 48 bool subpage; /* true if these attrs don't cover the whole TARGET_PAGE */ 49 bool ns; 50 bool nsc; 51 uint8_t sregion; 52 bool srvalid; 53 uint8_t iregion; 54 bool irvalid; 55 } V8M_SAttributes; 56 57 static void v8m_security_lookup(CPUARMState *env, uint32_t address, 58 MMUAccessType access_type, ARMMMUIdx mmu_idx, 59 V8M_SAttributes *sattrs); 60 #endif 61 62 static void switch_mode(CPUARMState *env, int mode); 63 64 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 65 { 66 int nregs; 67 68 /* VFP data registers are always little-endian. */ 69 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 70 if (reg < nregs) { 71 stq_le_p(buf, *aa32_vfp_dreg(env, reg)); 72 return 8; 73 } 74 if (arm_feature(env, ARM_FEATURE_NEON)) { 75 /* Aliases for Q regs. */ 76 nregs += 16; 77 if (reg < nregs) { 78 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 79 stq_le_p(buf, q[0]); 80 stq_le_p(buf + 8, q[1]); 81 return 16; 82 } 83 } 84 switch (reg - nregs) { 85 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4; 86 case 1: stl_p(buf, vfp_get_fpscr(env)); return 4; 87 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4; 88 } 89 return 0; 90 } 91 92 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 93 { 94 int nregs; 95 96 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 97 if (reg < nregs) { 98 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf); 99 return 8; 100 } 101 if (arm_feature(env, ARM_FEATURE_NEON)) { 102 nregs += 16; 103 if (reg < nregs) { 104 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 105 q[0] = ldq_le_p(buf); 106 q[1] = ldq_le_p(buf + 8); 107 return 16; 108 } 109 } 110 switch (reg - nregs) { 111 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4; 112 case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4; 113 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4; 114 } 115 return 0; 116 } 117 118 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 119 { 120 switch (reg) { 121 case 0 ... 31: 122 /* 128 bit FP register */ 123 { 124 uint64_t *q = aa64_vfp_qreg(env, reg); 125 stq_le_p(buf, q[0]); 126 stq_le_p(buf + 8, q[1]); 127 return 16; 128 } 129 case 32: 130 /* FPSR */ 131 stl_p(buf, vfp_get_fpsr(env)); 132 return 4; 133 case 33: 134 /* FPCR */ 135 stl_p(buf, vfp_get_fpcr(env)); 136 return 4; 137 default: 138 return 0; 139 } 140 } 141 142 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 143 { 144 switch (reg) { 145 case 0 ... 31: 146 /* 128 bit FP register */ 147 { 148 uint64_t *q = aa64_vfp_qreg(env, reg); 149 q[0] = ldq_le_p(buf); 150 q[1] = ldq_le_p(buf + 8); 151 return 16; 152 } 153 case 32: 154 /* FPSR */ 155 vfp_set_fpsr(env, ldl_p(buf)); 156 return 4; 157 case 33: 158 /* FPCR */ 159 vfp_set_fpcr(env, ldl_p(buf)); 160 return 4; 161 default: 162 return 0; 163 } 164 } 165 166 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 167 { 168 assert(ri->fieldoffset); 169 if (cpreg_field_is_64bit(ri)) { 170 return CPREG_FIELD64(env, ri); 171 } else { 172 return CPREG_FIELD32(env, ri); 173 } 174 } 175 176 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 177 uint64_t value) 178 { 179 assert(ri->fieldoffset); 180 if (cpreg_field_is_64bit(ri)) { 181 CPREG_FIELD64(env, ri) = value; 182 } else { 183 CPREG_FIELD32(env, ri) = value; 184 } 185 } 186 187 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 188 { 189 return (char *)env + ri->fieldoffset; 190 } 191 192 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 193 { 194 /* Raw read of a coprocessor register (as needed for migration, etc). */ 195 if (ri->type & ARM_CP_CONST) { 196 return ri->resetvalue; 197 } else if (ri->raw_readfn) { 198 return ri->raw_readfn(env, ri); 199 } else if (ri->readfn) { 200 return ri->readfn(env, ri); 201 } else { 202 return raw_read(env, ri); 203 } 204 } 205 206 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 207 uint64_t v) 208 { 209 /* Raw write of a coprocessor register (as needed for migration, etc). 210 * Note that constant registers are treated as write-ignored; the 211 * caller should check for success by whether a readback gives the 212 * value written. 213 */ 214 if (ri->type & ARM_CP_CONST) { 215 return; 216 } else if (ri->raw_writefn) { 217 ri->raw_writefn(env, ri, v); 218 } else if (ri->writefn) { 219 ri->writefn(env, ri, v); 220 } else { 221 raw_write(env, ri, v); 222 } 223 } 224 225 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg) 226 { 227 ARMCPU *cpu = arm_env_get_cpu(env); 228 const ARMCPRegInfo *ri; 229 uint32_t key; 230 231 key = cpu->dyn_xml.cpregs_keys[reg]; 232 ri = get_arm_cp_reginfo(cpu->cp_regs, key); 233 if (ri) { 234 if (cpreg_field_is_64bit(ri)) { 235 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri)); 236 } else { 237 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri)); 238 } 239 } 240 return 0; 241 } 242 243 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg) 244 { 245 return 0; 246 } 247 248 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 249 { 250 /* Return true if the regdef would cause an assertion if you called 251 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 252 * program bug for it not to have the NO_RAW flag). 253 * NB that returning false here doesn't necessarily mean that calling 254 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 255 * read/write access functions which are safe for raw use" from "has 256 * read/write access functions which have side effects but has forgotten 257 * to provide raw access functions". 258 * The tests here line up with the conditions in read/write_raw_cp_reg() 259 * and assertions in raw_read()/raw_write(). 260 */ 261 if ((ri->type & ARM_CP_CONST) || 262 ri->fieldoffset || 263 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 264 return false; 265 } 266 return true; 267 } 268 269 bool write_cpustate_to_list(ARMCPU *cpu) 270 { 271 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 272 int i; 273 bool ok = true; 274 275 for (i = 0; i < cpu->cpreg_array_len; i++) { 276 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 277 const ARMCPRegInfo *ri; 278 279 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 280 if (!ri) { 281 ok = false; 282 continue; 283 } 284 if (ri->type & ARM_CP_NO_RAW) { 285 continue; 286 } 287 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri); 288 } 289 return ok; 290 } 291 292 bool write_list_to_cpustate(ARMCPU *cpu) 293 { 294 int i; 295 bool ok = true; 296 297 for (i = 0; i < cpu->cpreg_array_len; i++) { 298 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 299 uint64_t v = cpu->cpreg_values[i]; 300 const ARMCPRegInfo *ri; 301 302 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 303 if (!ri) { 304 ok = false; 305 continue; 306 } 307 if (ri->type & ARM_CP_NO_RAW) { 308 continue; 309 } 310 /* Write value and confirm it reads back as written 311 * (to catch read-only registers and partially read-only 312 * registers where the incoming migration value doesn't match) 313 */ 314 write_raw_cp_reg(&cpu->env, ri, v); 315 if (read_raw_cp_reg(&cpu->env, ri) != v) { 316 ok = false; 317 } 318 } 319 return ok; 320 } 321 322 static void add_cpreg_to_list(gpointer key, gpointer opaque) 323 { 324 ARMCPU *cpu = opaque; 325 uint64_t regidx; 326 const ARMCPRegInfo *ri; 327 328 regidx = *(uint32_t *)key; 329 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 330 331 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 332 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 333 /* The value array need not be initialized at this point */ 334 cpu->cpreg_array_len++; 335 } 336 } 337 338 static void count_cpreg(gpointer key, gpointer opaque) 339 { 340 ARMCPU *cpu = opaque; 341 uint64_t regidx; 342 const ARMCPRegInfo *ri; 343 344 regidx = *(uint32_t *)key; 345 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 346 347 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 348 cpu->cpreg_array_len++; 349 } 350 } 351 352 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 353 { 354 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a); 355 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b); 356 357 if (aidx > bidx) { 358 return 1; 359 } 360 if (aidx < bidx) { 361 return -1; 362 } 363 return 0; 364 } 365 366 void init_cpreg_list(ARMCPU *cpu) 367 { 368 /* Initialise the cpreg_tuples[] array based on the cp_regs hash. 369 * Note that we require cpreg_tuples[] to be sorted by key ID. 370 */ 371 GList *keys; 372 int arraylen; 373 374 keys = g_hash_table_get_keys(cpu->cp_regs); 375 keys = g_list_sort(keys, cpreg_key_compare); 376 377 cpu->cpreg_array_len = 0; 378 379 g_list_foreach(keys, count_cpreg, cpu); 380 381 arraylen = cpu->cpreg_array_len; 382 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 383 cpu->cpreg_values = g_new(uint64_t, arraylen); 384 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 385 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 386 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 387 cpu->cpreg_array_len = 0; 388 389 g_list_foreach(keys, add_cpreg_to_list, cpu); 390 391 assert(cpu->cpreg_array_len == arraylen); 392 393 g_list_free(keys); 394 } 395 396 /* 397 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but 398 * they are accessible when EL3 is using AArch64 regardless of EL3.NS. 399 * 400 * access_el3_aa32ns: Used to check AArch32 register views. 401 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views. 402 */ 403 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 404 const ARMCPRegInfo *ri, 405 bool isread) 406 { 407 bool secure = arm_is_secure_below_el3(env); 408 409 assert(!arm_el_is_aa64(env, 3)); 410 if (secure) { 411 return CP_ACCESS_TRAP_UNCATEGORIZED; 412 } 413 return CP_ACCESS_OK; 414 } 415 416 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env, 417 const ARMCPRegInfo *ri, 418 bool isread) 419 { 420 if (!arm_el_is_aa64(env, 3)) { 421 return access_el3_aa32ns(env, ri, isread); 422 } 423 return CP_ACCESS_OK; 424 } 425 426 /* Some secure-only AArch32 registers trap to EL3 if used from 427 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 428 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 429 * We assume that the .access field is set to PL1_RW. 430 */ 431 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 432 const ARMCPRegInfo *ri, 433 bool isread) 434 { 435 if (arm_current_el(env) == 3) { 436 return CP_ACCESS_OK; 437 } 438 if (arm_is_secure_below_el3(env)) { 439 return CP_ACCESS_TRAP_EL3; 440 } 441 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 442 return CP_ACCESS_TRAP_UNCATEGORIZED; 443 } 444 445 /* Check for traps to "powerdown debug" registers, which are controlled 446 * by MDCR.TDOSA 447 */ 448 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, 449 bool isread) 450 { 451 int el = arm_current_el(env); 452 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) || 453 (env->cp15.mdcr_el2 & MDCR_TDE) || 454 (arm_hcr_el2_eff(env) & HCR_TGE); 455 456 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) { 457 return CP_ACCESS_TRAP_EL2; 458 } 459 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { 460 return CP_ACCESS_TRAP_EL3; 461 } 462 return CP_ACCESS_OK; 463 } 464 465 /* Check for traps to "debug ROM" registers, which are controlled 466 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. 467 */ 468 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, 469 bool isread) 470 { 471 int el = arm_current_el(env); 472 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) || 473 (env->cp15.mdcr_el2 & MDCR_TDE) || 474 (arm_hcr_el2_eff(env) & HCR_TGE); 475 476 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) { 477 return CP_ACCESS_TRAP_EL2; 478 } 479 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 480 return CP_ACCESS_TRAP_EL3; 481 } 482 return CP_ACCESS_OK; 483 } 484 485 /* Check for traps to general debug registers, which are controlled 486 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. 487 */ 488 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, 489 bool isread) 490 { 491 int el = arm_current_el(env); 492 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) || 493 (env->cp15.mdcr_el2 & MDCR_TDE) || 494 (arm_hcr_el2_eff(env) & HCR_TGE); 495 496 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) { 497 return CP_ACCESS_TRAP_EL2; 498 } 499 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 500 return CP_ACCESS_TRAP_EL3; 501 } 502 return CP_ACCESS_OK; 503 } 504 505 /* Check for traps to performance monitor registers, which are controlled 506 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 507 */ 508 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 509 bool isread) 510 { 511 int el = arm_current_el(env); 512 513 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 514 && !arm_is_secure_below_el3(env)) { 515 return CP_ACCESS_TRAP_EL2; 516 } 517 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 518 return CP_ACCESS_TRAP_EL3; 519 } 520 return CP_ACCESS_OK; 521 } 522 523 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 524 { 525 ARMCPU *cpu = arm_env_get_cpu(env); 526 527 raw_write(env, ri, value); 528 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 529 } 530 531 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 532 { 533 ARMCPU *cpu = arm_env_get_cpu(env); 534 535 if (raw_read(env, ri) != value) { 536 /* Unlike real hardware the qemu TLB uses virtual addresses, 537 * not modified virtual addresses, so this causes a TLB flush. 538 */ 539 tlb_flush(CPU(cpu)); 540 raw_write(env, ri, value); 541 } 542 } 543 544 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 545 uint64_t value) 546 { 547 ARMCPU *cpu = arm_env_get_cpu(env); 548 549 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 550 && !extended_addresses_enabled(env)) { 551 /* For VMSA (when not using the LPAE long descriptor page table 552 * format) this register includes the ASID, so do a TLB flush. 553 * For PMSA it is purely a process ID and no action is needed. 554 */ 555 tlb_flush(CPU(cpu)); 556 } 557 raw_write(env, ri, value); 558 } 559 560 /* IS variants of TLB operations must affect all cores */ 561 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 562 uint64_t value) 563 { 564 CPUState *cs = ENV_GET_CPU(env); 565 566 tlb_flush_all_cpus_synced(cs); 567 } 568 569 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 570 uint64_t value) 571 { 572 CPUState *cs = ENV_GET_CPU(env); 573 574 tlb_flush_all_cpus_synced(cs); 575 } 576 577 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 578 uint64_t value) 579 { 580 CPUState *cs = ENV_GET_CPU(env); 581 582 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 583 } 584 585 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 586 uint64_t value) 587 { 588 CPUState *cs = ENV_GET_CPU(env); 589 590 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 591 } 592 593 /* 594 * Non-IS variants of TLB operations are upgraded to 595 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to 596 * force broadcast of these operations. 597 */ 598 static bool tlb_force_broadcast(CPUARMState *env) 599 { 600 return (env->cp15.hcr_el2 & HCR_FB) && 601 arm_current_el(env) == 1 && arm_is_secure_below_el3(env); 602 } 603 604 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 605 uint64_t value) 606 { 607 /* Invalidate all (TLBIALL) */ 608 ARMCPU *cpu = arm_env_get_cpu(env); 609 610 if (tlb_force_broadcast(env)) { 611 tlbiall_is_write(env, NULL, value); 612 return; 613 } 614 615 tlb_flush(CPU(cpu)); 616 } 617 618 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 619 uint64_t value) 620 { 621 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 622 ARMCPU *cpu = arm_env_get_cpu(env); 623 624 if (tlb_force_broadcast(env)) { 625 tlbimva_is_write(env, NULL, value); 626 return; 627 } 628 629 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 630 } 631 632 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 633 uint64_t value) 634 { 635 /* Invalidate by ASID (TLBIASID) */ 636 ARMCPU *cpu = arm_env_get_cpu(env); 637 638 if (tlb_force_broadcast(env)) { 639 tlbiasid_is_write(env, NULL, value); 640 return; 641 } 642 643 tlb_flush(CPU(cpu)); 644 } 645 646 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 647 uint64_t value) 648 { 649 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 650 ARMCPU *cpu = arm_env_get_cpu(env); 651 652 if (tlb_force_broadcast(env)) { 653 tlbimvaa_is_write(env, NULL, value); 654 return; 655 } 656 657 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 658 } 659 660 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 661 uint64_t value) 662 { 663 CPUState *cs = ENV_GET_CPU(env); 664 665 tlb_flush_by_mmuidx(cs, 666 ARMMMUIdxBit_S12NSE1 | 667 ARMMMUIdxBit_S12NSE0 | 668 ARMMMUIdxBit_S2NS); 669 } 670 671 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 672 uint64_t value) 673 { 674 CPUState *cs = ENV_GET_CPU(env); 675 676 tlb_flush_by_mmuidx_all_cpus_synced(cs, 677 ARMMMUIdxBit_S12NSE1 | 678 ARMMMUIdxBit_S12NSE0 | 679 ARMMMUIdxBit_S2NS); 680 } 681 682 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri, 683 uint64_t value) 684 { 685 /* Invalidate by IPA. This has to invalidate any structures that 686 * contain only stage 2 translation information, but does not need 687 * to apply to structures that contain combined stage 1 and stage 2 688 * translation information. 689 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 690 */ 691 CPUState *cs = ENV_GET_CPU(env); 692 uint64_t pageaddr; 693 694 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 695 return; 696 } 697 698 pageaddr = sextract64(value << 12, 0, 40); 699 700 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 701 } 702 703 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 704 uint64_t value) 705 { 706 CPUState *cs = ENV_GET_CPU(env); 707 uint64_t pageaddr; 708 709 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 710 return; 711 } 712 713 pageaddr = sextract64(value << 12, 0, 40); 714 715 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 716 ARMMMUIdxBit_S2NS); 717 } 718 719 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 720 uint64_t value) 721 { 722 CPUState *cs = ENV_GET_CPU(env); 723 724 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 725 } 726 727 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 728 uint64_t value) 729 { 730 CPUState *cs = ENV_GET_CPU(env); 731 732 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 733 } 734 735 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 736 uint64_t value) 737 { 738 CPUState *cs = ENV_GET_CPU(env); 739 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 740 741 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 742 } 743 744 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 745 uint64_t value) 746 { 747 CPUState *cs = ENV_GET_CPU(env); 748 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 749 750 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 751 ARMMMUIdxBit_S1E2); 752 } 753 754 static const ARMCPRegInfo cp_reginfo[] = { 755 /* Define the secure and non-secure FCSE identifier CP registers 756 * separately because there is no secure bank in V8 (no _EL3). This allows 757 * the secure register to be properly reset and migrated. There is also no 758 * v8 EL1 version of the register so the non-secure instance stands alone. 759 */ 760 { .name = "FCSEIDR", 761 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 762 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 763 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 764 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 765 { .name = "FCSEIDR_S", 766 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 767 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 768 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 769 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 770 /* Define the secure and non-secure context identifier CP registers 771 * separately because there is no secure bank in V8 (no _EL3). This allows 772 * the secure register to be properly reset and migrated. In the 773 * non-secure case, the 32-bit register will have reset and migration 774 * disabled during registration as it is handled by the 64-bit instance. 775 */ 776 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 777 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 778 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 779 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 780 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 781 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 782 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 783 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 784 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 785 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 786 REGINFO_SENTINEL 787 }; 788 789 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 790 /* NB: Some of these registers exist in v8 but with more precise 791 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 792 */ 793 /* MMU Domain access control / MPU write buffer control */ 794 { .name = "DACR", 795 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 796 .access = PL1_RW, .resetvalue = 0, 797 .writefn = dacr_write, .raw_writefn = raw_write, 798 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 799 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 800 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 801 * For v6 and v5, these mappings are overly broad. 802 */ 803 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 804 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 805 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 806 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 807 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 808 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 809 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 810 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 811 /* Cache maintenance ops; some of this space may be overridden later. */ 812 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 813 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 814 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 815 REGINFO_SENTINEL 816 }; 817 818 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 819 /* Not all pre-v6 cores implemented this WFI, so this is slightly 820 * over-broad. 821 */ 822 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 823 .access = PL1_W, .type = ARM_CP_WFI }, 824 REGINFO_SENTINEL 825 }; 826 827 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 828 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 829 * is UNPREDICTABLE; we choose to NOP as most implementations do). 830 */ 831 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 832 .access = PL1_W, .type = ARM_CP_WFI }, 833 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice 834 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 835 * OMAPCP will override this space. 836 */ 837 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 838 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 839 .resetvalue = 0 }, 840 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 841 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 842 .resetvalue = 0 }, 843 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 844 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 845 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 846 .resetvalue = 0 }, 847 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 848 * implementing it as RAZ means the "debug architecture version" bits 849 * will read as a reserved value, which should cause Linux to not try 850 * to use the debug hardware. 851 */ 852 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 853 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 854 /* MMU TLB control. Note that the wildcarding means we cover not just 855 * the unified TLB ops but also the dside/iside/inner-shareable variants. 856 */ 857 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 858 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 859 .type = ARM_CP_NO_RAW }, 860 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 861 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 862 .type = ARM_CP_NO_RAW }, 863 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 864 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 865 .type = ARM_CP_NO_RAW }, 866 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 867 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 868 .type = ARM_CP_NO_RAW }, 869 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 870 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 871 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 872 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 873 REGINFO_SENTINEL 874 }; 875 876 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 877 uint64_t value) 878 { 879 uint32_t mask = 0; 880 881 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 882 if (!arm_feature(env, ARM_FEATURE_V8)) { 883 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 884 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 885 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 886 */ 887 if (arm_feature(env, ARM_FEATURE_VFP)) { 888 /* VFP coprocessor: cp10 & cp11 [23:20] */ 889 mask |= (1 << 31) | (1 << 30) | (0xf << 20); 890 891 if (!arm_feature(env, ARM_FEATURE_NEON)) { 892 /* ASEDIS [31] bit is RAO/WI */ 893 value |= (1 << 31); 894 } 895 896 /* VFPv3 and upwards with NEON implement 32 double precision 897 * registers (D0-D31). 898 */ 899 if (!arm_feature(env, ARM_FEATURE_NEON) || 900 !arm_feature(env, ARM_FEATURE_VFP3)) { 901 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 902 value |= (1 << 30); 903 } 904 } 905 value &= mask; 906 } 907 env->cp15.cpacr_el1 = value; 908 } 909 910 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 911 { 912 /* Call cpacr_write() so that we reset with the correct RAO bits set 913 * for our CPU features. 914 */ 915 cpacr_write(env, ri, 0); 916 } 917 918 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 919 bool isread) 920 { 921 if (arm_feature(env, ARM_FEATURE_V8)) { 922 /* Check if CPACR accesses are to be trapped to EL2 */ 923 if (arm_current_el(env) == 1 && 924 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) { 925 return CP_ACCESS_TRAP_EL2; 926 /* Check if CPACR accesses are to be trapped to EL3 */ 927 } else if (arm_current_el(env) < 3 && 928 (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 929 return CP_ACCESS_TRAP_EL3; 930 } 931 } 932 933 return CP_ACCESS_OK; 934 } 935 936 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 937 bool isread) 938 { 939 /* Check if CPTR accesses are set to trap to EL3 */ 940 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 941 return CP_ACCESS_TRAP_EL3; 942 } 943 944 return CP_ACCESS_OK; 945 } 946 947 static const ARMCPRegInfo v6_cp_reginfo[] = { 948 /* prefetch by MVA in v6, NOP in v7 */ 949 { .name = "MVA_prefetch", 950 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 951 .access = PL1_W, .type = ARM_CP_NOP }, 952 /* We need to break the TB after ISB to execute self-modifying code 953 * correctly and also to take any pending interrupts immediately. 954 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 955 */ 956 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 957 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 958 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 959 .access = PL0_W, .type = ARM_CP_NOP }, 960 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 961 .access = PL0_W, .type = ARM_CP_NOP }, 962 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 963 .access = PL1_RW, 964 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 965 offsetof(CPUARMState, cp15.ifar_ns) }, 966 .resetvalue = 0, }, 967 /* Watchpoint Fault Address Register : should actually only be present 968 * for 1136, 1176, 11MPCore. 969 */ 970 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 971 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 972 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 973 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 974 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 975 .resetfn = cpacr_reset, .writefn = cpacr_write }, 976 REGINFO_SENTINEL 977 }; 978 979 /* Definitions for the PMU registers */ 980 #define PMCRN_MASK 0xf800 981 #define PMCRN_SHIFT 11 982 #define PMCRLC 0x40 983 #define PMCRDP 0x10 984 #define PMCRD 0x8 985 #define PMCRC 0x4 986 #define PMCRP 0x2 987 #define PMCRE 0x1 988 989 #define PMXEVTYPER_P 0x80000000 990 #define PMXEVTYPER_U 0x40000000 991 #define PMXEVTYPER_NSK 0x20000000 992 #define PMXEVTYPER_NSU 0x10000000 993 #define PMXEVTYPER_NSH 0x08000000 994 #define PMXEVTYPER_M 0x04000000 995 #define PMXEVTYPER_MT 0x02000000 996 #define PMXEVTYPER_EVTCOUNT 0x0000ffff 997 #define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \ 998 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \ 999 PMXEVTYPER_M | PMXEVTYPER_MT | \ 1000 PMXEVTYPER_EVTCOUNT) 1001 1002 #define PMCCFILTR 0xf8000000 1003 #define PMCCFILTR_M PMXEVTYPER_M 1004 #define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M) 1005 1006 static inline uint32_t pmu_num_counters(CPUARMState *env) 1007 { 1008 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT; 1009 } 1010 1011 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */ 1012 static inline uint64_t pmu_counter_mask(CPUARMState *env) 1013 { 1014 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1); 1015 } 1016 1017 typedef struct pm_event { 1018 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 1019 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 1020 bool (*supported)(CPUARMState *); 1021 /* 1022 * Retrieve the current count of the underlying event. The programmed 1023 * counters hold a difference from the return value from this function 1024 */ 1025 uint64_t (*get_count)(CPUARMState *); 1026 /* 1027 * Return how many nanoseconds it will take (at a minimum) for count events 1028 * to occur. A negative value indicates the counter will never overflow, or 1029 * that the counter has otherwise arranged for the overflow bit to be set 1030 * and the PMU interrupt to be raised on overflow. 1031 */ 1032 int64_t (*ns_per_count)(uint64_t); 1033 } pm_event; 1034 1035 static bool event_always_supported(CPUARMState *env) 1036 { 1037 return true; 1038 } 1039 1040 static uint64_t swinc_get_count(CPUARMState *env) 1041 { 1042 /* 1043 * SW_INCR events are written directly to the pmevcntr's by writes to 1044 * PMSWINC, so there is no underlying count maintained by the PMU itself 1045 */ 1046 return 0; 1047 } 1048 1049 static int64_t swinc_ns_per(uint64_t ignored) 1050 { 1051 return -1; 1052 } 1053 1054 /* 1055 * Return the underlying cycle count for the PMU cycle counters. If we're in 1056 * usermode, simply return 0. 1057 */ 1058 static uint64_t cycles_get_count(CPUARMState *env) 1059 { 1060 #ifndef CONFIG_USER_ONLY 1061 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1062 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 1063 #else 1064 return cpu_get_host_ticks(); 1065 #endif 1066 } 1067 1068 #ifndef CONFIG_USER_ONLY 1069 static int64_t cycles_ns_per(uint64_t cycles) 1070 { 1071 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 1072 } 1073 1074 static bool instructions_supported(CPUARMState *env) 1075 { 1076 return use_icount == 1 /* Precise instruction counting */; 1077 } 1078 1079 static uint64_t instructions_get_count(CPUARMState *env) 1080 { 1081 return (uint64_t)cpu_get_icount_raw(); 1082 } 1083 1084 static int64_t instructions_ns_per(uint64_t icount) 1085 { 1086 return cpu_icount_to_ns((int64_t)icount); 1087 } 1088 #endif 1089 1090 static const pm_event pm_events[] = { 1091 { .number = 0x000, /* SW_INCR */ 1092 .supported = event_always_supported, 1093 .get_count = swinc_get_count, 1094 .ns_per_count = swinc_ns_per, 1095 }, 1096 #ifndef CONFIG_USER_ONLY 1097 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 1098 .supported = instructions_supported, 1099 .get_count = instructions_get_count, 1100 .ns_per_count = instructions_ns_per, 1101 }, 1102 { .number = 0x011, /* CPU_CYCLES, Cycle */ 1103 .supported = event_always_supported, 1104 .get_count = cycles_get_count, 1105 .ns_per_count = cycles_ns_per, 1106 } 1107 #endif 1108 }; 1109 1110 /* 1111 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1112 * events (i.e. the statistical profiling extension), this implementation 1113 * should first be updated to something sparse instead of the current 1114 * supported_event_map[] array. 1115 */ 1116 #define MAX_EVENT_ID 0x11 1117 #define UNSUPPORTED_EVENT UINT16_MAX 1118 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1119 1120 /* 1121 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 1122 * of ARM event numbers to indices in our pm_events array. 1123 * 1124 * Note: Events in the 0x40XX range are not currently supported. 1125 */ 1126 void pmu_init(ARMCPU *cpu) 1127 { 1128 unsigned int i; 1129 1130 /* 1131 * Empty supported_event_map and cpu->pmceid[01] before adding supported 1132 * events to them 1133 */ 1134 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1135 supported_event_map[i] = UNSUPPORTED_EVENT; 1136 } 1137 cpu->pmceid0 = 0; 1138 cpu->pmceid1 = 0; 1139 1140 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1141 const pm_event *cnt = &pm_events[i]; 1142 assert(cnt->number <= MAX_EVENT_ID); 1143 /* We do not currently support events in the 0x40xx range */ 1144 assert(cnt->number <= 0x3f); 1145 1146 if (cnt->supported(&cpu->env)) { 1147 supported_event_map[cnt->number] = i; 1148 uint64_t event_mask = 1ULL << (cnt->number & 0x1f); 1149 if (cnt->number & 0x20) { 1150 cpu->pmceid1 |= event_mask; 1151 } else { 1152 cpu->pmceid0 |= event_mask; 1153 } 1154 } 1155 } 1156 } 1157 1158 /* 1159 * Check at runtime whether a PMU event is supported for the current machine 1160 */ 1161 static bool event_supported(uint16_t number) 1162 { 1163 if (number > MAX_EVENT_ID) { 1164 return false; 1165 } 1166 return supported_event_map[number] != UNSUPPORTED_EVENT; 1167 } 1168 1169 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1170 bool isread) 1171 { 1172 /* Performance monitor registers user accessibility is controlled 1173 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1174 * trapping to EL2 or EL3 for other accesses. 1175 */ 1176 int el = arm_current_el(env); 1177 1178 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1179 return CP_ACCESS_TRAP; 1180 } 1181 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 1182 && !arm_is_secure_below_el3(env)) { 1183 return CP_ACCESS_TRAP_EL2; 1184 } 1185 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1186 return CP_ACCESS_TRAP_EL3; 1187 } 1188 1189 return CP_ACCESS_OK; 1190 } 1191 1192 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1193 const ARMCPRegInfo *ri, 1194 bool isread) 1195 { 1196 /* ER: event counter read trap control */ 1197 if (arm_feature(env, ARM_FEATURE_V8) 1198 && arm_current_el(env) == 0 1199 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1200 && isread) { 1201 return CP_ACCESS_OK; 1202 } 1203 1204 return pmreg_access(env, ri, isread); 1205 } 1206 1207 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1208 const ARMCPRegInfo *ri, 1209 bool isread) 1210 { 1211 /* SW: software increment write trap control */ 1212 if (arm_feature(env, ARM_FEATURE_V8) 1213 && arm_current_el(env) == 0 1214 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1215 && !isread) { 1216 return CP_ACCESS_OK; 1217 } 1218 1219 return pmreg_access(env, ri, isread); 1220 } 1221 1222 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1223 const ARMCPRegInfo *ri, 1224 bool isread) 1225 { 1226 /* ER: event counter read trap control */ 1227 if (arm_feature(env, ARM_FEATURE_V8) 1228 && arm_current_el(env) == 0 1229 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1230 return CP_ACCESS_OK; 1231 } 1232 1233 return pmreg_access(env, ri, isread); 1234 } 1235 1236 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1237 const ARMCPRegInfo *ri, 1238 bool isread) 1239 { 1240 /* CR: cycle counter read trap control */ 1241 if (arm_feature(env, ARM_FEATURE_V8) 1242 && arm_current_el(env) == 0 1243 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1244 && isread) { 1245 return CP_ACCESS_OK; 1246 } 1247 1248 return pmreg_access(env, ri, isread); 1249 } 1250 1251 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using 1252 * the current EL, security state, and register configuration. 1253 */ 1254 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1255 { 1256 uint64_t filter; 1257 bool e, p, u, nsk, nsu, nsh, m; 1258 bool enabled, prohibited, filtered; 1259 bool secure = arm_is_secure(env); 1260 int el = arm_current_el(env); 1261 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1262 1263 if (!arm_feature(env, ARM_FEATURE_PMU)) { 1264 return false; 1265 } 1266 1267 if (!arm_feature(env, ARM_FEATURE_EL2) || 1268 (counter < hpmn || counter == 31)) { 1269 e = env->cp15.c9_pmcr & PMCRE; 1270 } else { 1271 e = env->cp15.mdcr_el2 & MDCR_HPME; 1272 } 1273 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1274 1275 if (!secure) { 1276 if (el == 2 && (counter < hpmn || counter == 31)) { 1277 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD; 1278 } else { 1279 prohibited = false; 1280 } 1281 } else { 1282 prohibited = arm_feature(env, ARM_FEATURE_EL3) && 1283 (env->cp15.mdcr_el3 & MDCR_SPME); 1284 } 1285 1286 if (prohibited && counter == 31) { 1287 prohibited = env->cp15.c9_pmcr & PMCRDP; 1288 } 1289 1290 if (counter == 31) { 1291 filter = env->cp15.pmccfiltr_el0; 1292 } else { 1293 filter = env->cp15.c14_pmevtyper[counter]; 1294 } 1295 1296 p = filter & PMXEVTYPER_P; 1297 u = filter & PMXEVTYPER_U; 1298 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1299 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1300 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1301 m = arm_el_is_aa64(env, 1) && 1302 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1303 1304 if (el == 0) { 1305 filtered = secure ? u : u != nsu; 1306 } else if (el == 1) { 1307 filtered = secure ? p : p != nsk; 1308 } else if (el == 2) { 1309 filtered = !nsh; 1310 } else { /* EL3 */ 1311 filtered = m != p; 1312 } 1313 1314 if (counter != 31) { 1315 /* 1316 * If not checking PMCCNTR, ensure the counter is setup to an event we 1317 * support 1318 */ 1319 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1320 if (!event_supported(event)) { 1321 return false; 1322 } 1323 } 1324 1325 return enabled && !prohibited && !filtered; 1326 } 1327 1328 static void pmu_update_irq(CPUARMState *env) 1329 { 1330 ARMCPU *cpu = arm_env_get_cpu(env); 1331 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1332 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1333 } 1334 1335 /* 1336 * Ensure c15_ccnt is the guest-visible count so that operations such as 1337 * enabling/disabling the counter or filtering, modifying the count itself, 1338 * etc. can be done logically. This is essentially a no-op if the counter is 1339 * not enabled at the time of the call. 1340 */ 1341 static void pmccntr_op_start(CPUARMState *env) 1342 { 1343 uint64_t cycles = cycles_get_count(env); 1344 1345 if (pmu_counter_enabled(env, 31)) { 1346 uint64_t eff_cycles = cycles; 1347 if (env->cp15.c9_pmcr & PMCRD) { 1348 /* Increment once every 64 processor clock cycles */ 1349 eff_cycles /= 64; 1350 } 1351 1352 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1353 1354 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1355 1ull << 63 : 1ull << 31; 1356 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1357 env->cp15.c9_pmovsr |= (1 << 31); 1358 pmu_update_irq(env); 1359 } 1360 1361 env->cp15.c15_ccnt = new_pmccntr; 1362 } 1363 env->cp15.c15_ccnt_delta = cycles; 1364 } 1365 1366 /* 1367 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1368 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1369 * pmccntr_op_start. 1370 */ 1371 static void pmccntr_op_finish(CPUARMState *env) 1372 { 1373 if (pmu_counter_enabled(env, 31)) { 1374 #ifndef CONFIG_USER_ONLY 1375 /* Calculate when the counter will next overflow */ 1376 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1377 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1378 remaining_cycles = (uint32_t)remaining_cycles; 1379 } 1380 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1381 1382 if (overflow_in > 0) { 1383 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1384 overflow_in; 1385 ARMCPU *cpu = arm_env_get_cpu(env); 1386 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1387 } 1388 #endif 1389 1390 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1391 if (env->cp15.c9_pmcr & PMCRD) { 1392 /* Increment once every 64 processor clock cycles */ 1393 prev_cycles /= 64; 1394 } 1395 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1396 } 1397 } 1398 1399 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1400 { 1401 1402 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1403 uint64_t count = 0; 1404 if (event_supported(event)) { 1405 uint16_t event_idx = supported_event_map[event]; 1406 count = pm_events[event_idx].get_count(env); 1407 } 1408 1409 if (pmu_counter_enabled(env, counter)) { 1410 uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1411 1412 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) { 1413 env->cp15.c9_pmovsr |= (1 << counter); 1414 pmu_update_irq(env); 1415 } 1416 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1417 } 1418 env->cp15.c14_pmevcntr_delta[counter] = count; 1419 } 1420 1421 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1422 { 1423 if (pmu_counter_enabled(env, counter)) { 1424 #ifndef CONFIG_USER_ONLY 1425 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1426 uint16_t event_idx = supported_event_map[event]; 1427 uint64_t delta = UINT32_MAX - 1428 (uint32_t)env->cp15.c14_pmevcntr[counter] + 1; 1429 int64_t overflow_in = pm_events[event_idx].ns_per_count(delta); 1430 1431 if (overflow_in > 0) { 1432 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1433 overflow_in; 1434 ARMCPU *cpu = arm_env_get_cpu(env); 1435 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1436 } 1437 #endif 1438 1439 env->cp15.c14_pmevcntr_delta[counter] -= 1440 env->cp15.c14_pmevcntr[counter]; 1441 } 1442 } 1443 1444 void pmu_op_start(CPUARMState *env) 1445 { 1446 unsigned int i; 1447 pmccntr_op_start(env); 1448 for (i = 0; i < pmu_num_counters(env); i++) { 1449 pmevcntr_op_start(env, i); 1450 } 1451 } 1452 1453 void pmu_op_finish(CPUARMState *env) 1454 { 1455 unsigned int i; 1456 pmccntr_op_finish(env); 1457 for (i = 0; i < pmu_num_counters(env); i++) { 1458 pmevcntr_op_finish(env, i); 1459 } 1460 } 1461 1462 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1463 { 1464 pmu_op_start(&cpu->env); 1465 } 1466 1467 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1468 { 1469 pmu_op_finish(&cpu->env); 1470 } 1471 1472 void arm_pmu_timer_cb(void *opaque) 1473 { 1474 ARMCPU *cpu = opaque; 1475 1476 /* 1477 * Update all the counter values based on the current underlying counts, 1478 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1479 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1480 * counter may expire. 1481 */ 1482 pmu_op_start(&cpu->env); 1483 pmu_op_finish(&cpu->env); 1484 } 1485 1486 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1487 uint64_t value) 1488 { 1489 pmu_op_start(env); 1490 1491 if (value & PMCRC) { 1492 /* The counter has been reset */ 1493 env->cp15.c15_ccnt = 0; 1494 } 1495 1496 if (value & PMCRP) { 1497 unsigned int i; 1498 for (i = 0; i < pmu_num_counters(env); i++) { 1499 env->cp15.c14_pmevcntr[i] = 0; 1500 } 1501 } 1502 1503 /* only the DP, X, D and E bits are writable */ 1504 env->cp15.c9_pmcr &= ~0x39; 1505 env->cp15.c9_pmcr |= (value & 0x39); 1506 1507 pmu_op_finish(env); 1508 } 1509 1510 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1511 uint64_t value) 1512 { 1513 unsigned int i; 1514 for (i = 0; i < pmu_num_counters(env); i++) { 1515 /* Increment a counter's count iff: */ 1516 if ((value & (1 << i)) && /* counter's bit is set */ 1517 /* counter is enabled and not filtered */ 1518 pmu_counter_enabled(env, i) && 1519 /* counter is SW_INCR */ 1520 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1521 pmevcntr_op_start(env, i); 1522 1523 /* 1524 * Detect if this write causes an overflow since we can't predict 1525 * PMSWINC overflows like we can for other events 1526 */ 1527 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1528 1529 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) { 1530 env->cp15.c9_pmovsr |= (1 << i); 1531 pmu_update_irq(env); 1532 } 1533 1534 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1535 1536 pmevcntr_op_finish(env, i); 1537 } 1538 } 1539 } 1540 1541 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1542 { 1543 uint64_t ret; 1544 pmccntr_op_start(env); 1545 ret = env->cp15.c15_ccnt; 1546 pmccntr_op_finish(env); 1547 return ret; 1548 } 1549 1550 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1551 uint64_t value) 1552 { 1553 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1554 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1555 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1556 * accessed. 1557 */ 1558 env->cp15.c9_pmselr = value & 0x1f; 1559 } 1560 1561 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1562 uint64_t value) 1563 { 1564 pmccntr_op_start(env); 1565 env->cp15.c15_ccnt = value; 1566 pmccntr_op_finish(env); 1567 } 1568 1569 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1570 uint64_t value) 1571 { 1572 uint64_t cur_val = pmccntr_read(env, NULL); 1573 1574 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1575 } 1576 1577 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1578 uint64_t value) 1579 { 1580 pmccntr_op_start(env); 1581 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1582 pmccntr_op_finish(env); 1583 } 1584 1585 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1586 uint64_t value) 1587 { 1588 pmccntr_op_start(env); 1589 /* M is not accessible from AArch32 */ 1590 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1591 (value & PMCCFILTR); 1592 pmccntr_op_finish(env); 1593 } 1594 1595 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1596 { 1597 /* M is not visible in AArch32 */ 1598 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1599 } 1600 1601 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1602 uint64_t value) 1603 { 1604 value &= pmu_counter_mask(env); 1605 env->cp15.c9_pmcnten |= value; 1606 } 1607 1608 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1609 uint64_t value) 1610 { 1611 value &= pmu_counter_mask(env); 1612 env->cp15.c9_pmcnten &= ~value; 1613 } 1614 1615 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1616 uint64_t value) 1617 { 1618 value &= pmu_counter_mask(env); 1619 env->cp15.c9_pmovsr &= ~value; 1620 pmu_update_irq(env); 1621 } 1622 1623 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1624 uint64_t value) 1625 { 1626 value &= pmu_counter_mask(env); 1627 env->cp15.c9_pmovsr |= value; 1628 pmu_update_irq(env); 1629 } 1630 1631 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1632 uint64_t value, const uint8_t counter) 1633 { 1634 if (counter == 31) { 1635 pmccfiltr_write(env, ri, value); 1636 } else if (counter < pmu_num_counters(env)) { 1637 pmevcntr_op_start(env, counter); 1638 1639 /* 1640 * If this counter's event type is changing, store the current 1641 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1642 * pmevcntr_op_finish has the correct baseline when it converts back to 1643 * a delta. 1644 */ 1645 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1646 PMXEVTYPER_EVTCOUNT; 1647 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1648 if (old_event != new_event) { 1649 uint64_t count = 0; 1650 if (event_supported(new_event)) { 1651 uint16_t event_idx = supported_event_map[new_event]; 1652 count = pm_events[event_idx].get_count(env); 1653 } 1654 env->cp15.c14_pmevcntr_delta[counter] = count; 1655 } 1656 1657 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1658 pmevcntr_op_finish(env, counter); 1659 } 1660 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1661 * PMSELR value is equal to or greater than the number of implemented 1662 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1663 */ 1664 } 1665 1666 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1667 const uint8_t counter) 1668 { 1669 if (counter == 31) { 1670 return env->cp15.pmccfiltr_el0; 1671 } else if (counter < pmu_num_counters(env)) { 1672 return env->cp15.c14_pmevtyper[counter]; 1673 } else { 1674 /* 1675 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1676 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1677 */ 1678 return 0; 1679 } 1680 } 1681 1682 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1683 uint64_t value) 1684 { 1685 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1686 pmevtyper_write(env, ri, value, counter); 1687 } 1688 1689 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1690 uint64_t value) 1691 { 1692 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1693 env->cp15.c14_pmevtyper[counter] = value; 1694 1695 /* 1696 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1697 * pmu_op_finish calls when loading saved state for a migration. Because 1698 * we're potentially updating the type of event here, the value written to 1699 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a 1700 * different counter type. Therefore, we need to set this value to the 1701 * current count for the counter type we're writing so that pmu_op_finish 1702 * has the correct count for its calculation. 1703 */ 1704 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1705 if (event_supported(event)) { 1706 uint16_t event_idx = supported_event_map[event]; 1707 env->cp15.c14_pmevcntr_delta[counter] = 1708 pm_events[event_idx].get_count(env); 1709 } 1710 } 1711 1712 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1713 { 1714 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1715 return pmevtyper_read(env, ri, counter); 1716 } 1717 1718 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1719 uint64_t value) 1720 { 1721 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1722 } 1723 1724 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1725 { 1726 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1727 } 1728 1729 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1730 uint64_t value, uint8_t counter) 1731 { 1732 if (counter < pmu_num_counters(env)) { 1733 pmevcntr_op_start(env, counter); 1734 env->cp15.c14_pmevcntr[counter] = value; 1735 pmevcntr_op_finish(env, counter); 1736 } 1737 /* 1738 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1739 * are CONSTRAINED UNPREDICTABLE. 1740 */ 1741 } 1742 1743 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1744 uint8_t counter) 1745 { 1746 if (counter < pmu_num_counters(env)) { 1747 uint64_t ret; 1748 pmevcntr_op_start(env, counter); 1749 ret = env->cp15.c14_pmevcntr[counter]; 1750 pmevcntr_op_finish(env, counter); 1751 return ret; 1752 } else { 1753 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1754 * are CONSTRAINED UNPREDICTABLE. */ 1755 return 0; 1756 } 1757 } 1758 1759 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1760 uint64_t value) 1761 { 1762 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1763 pmevcntr_write(env, ri, value, counter); 1764 } 1765 1766 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1767 { 1768 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1769 return pmevcntr_read(env, ri, counter); 1770 } 1771 1772 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1773 uint64_t value) 1774 { 1775 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1776 assert(counter < pmu_num_counters(env)); 1777 env->cp15.c14_pmevcntr[counter] = value; 1778 pmevcntr_write(env, ri, value, counter); 1779 } 1780 1781 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1782 { 1783 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1784 assert(counter < pmu_num_counters(env)); 1785 return env->cp15.c14_pmevcntr[counter]; 1786 } 1787 1788 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1789 uint64_t value) 1790 { 1791 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1792 } 1793 1794 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1795 { 1796 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1797 } 1798 1799 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1800 uint64_t value) 1801 { 1802 if (arm_feature(env, ARM_FEATURE_V8)) { 1803 env->cp15.c9_pmuserenr = value & 0xf; 1804 } else { 1805 env->cp15.c9_pmuserenr = value & 1; 1806 } 1807 } 1808 1809 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1810 uint64_t value) 1811 { 1812 /* We have no event counters so only the C bit can be changed */ 1813 value &= pmu_counter_mask(env); 1814 env->cp15.c9_pminten |= value; 1815 pmu_update_irq(env); 1816 } 1817 1818 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1819 uint64_t value) 1820 { 1821 value &= pmu_counter_mask(env); 1822 env->cp15.c9_pminten &= ~value; 1823 pmu_update_irq(env); 1824 } 1825 1826 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1827 uint64_t value) 1828 { 1829 /* Note that even though the AArch64 view of this register has bits 1830 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1831 * architectural requirements for bits which are RES0 only in some 1832 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1833 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1834 */ 1835 raw_write(env, ri, value & ~0x1FULL); 1836 } 1837 1838 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1839 { 1840 /* Begin with base v8.0 state. */ 1841 uint32_t valid_mask = 0x3fff; 1842 ARMCPU *cpu = arm_env_get_cpu(env); 1843 1844 if (arm_el_is_aa64(env, 3)) { 1845 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */ 1846 valid_mask &= ~SCR_NET; 1847 } else { 1848 valid_mask &= ~(SCR_RW | SCR_ST); 1849 } 1850 1851 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1852 valid_mask &= ~SCR_HCE; 1853 1854 /* On ARMv7, SMD (or SCD as it is called in v7) is only 1855 * supported if EL2 exists. The bit is UNK/SBZP when 1856 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1857 * when EL2 is unavailable. 1858 * On ARMv8, this bit is always available. 1859 */ 1860 if (arm_feature(env, ARM_FEATURE_V7) && 1861 !arm_feature(env, ARM_FEATURE_V8)) { 1862 valid_mask &= ~SCR_SMD; 1863 } 1864 } 1865 if (cpu_isar_feature(aa64_lor, cpu)) { 1866 valid_mask |= SCR_TLOR; 1867 } 1868 if (cpu_isar_feature(aa64_pauth, cpu)) { 1869 valid_mask |= SCR_API | SCR_APK; 1870 } 1871 1872 /* Clear all-context RES0 bits. */ 1873 value &= valid_mask; 1874 raw_write(env, ri, value); 1875 } 1876 1877 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1878 { 1879 ARMCPU *cpu = arm_env_get_cpu(env); 1880 1881 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR 1882 * bank 1883 */ 1884 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1885 ri->secure & ARM_CP_SECSTATE_S); 1886 1887 return cpu->ccsidr[index]; 1888 } 1889 1890 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1891 uint64_t value) 1892 { 1893 raw_write(env, ri, value & 0xf); 1894 } 1895 1896 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1897 { 1898 CPUState *cs = ENV_GET_CPU(env); 1899 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 1900 uint64_t ret = 0; 1901 1902 if (hcr_el2 & HCR_IMO) { 1903 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1904 ret |= CPSR_I; 1905 } 1906 } else { 1907 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1908 ret |= CPSR_I; 1909 } 1910 } 1911 1912 if (hcr_el2 & HCR_FMO) { 1913 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1914 ret |= CPSR_F; 1915 } 1916 } else { 1917 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1918 ret |= CPSR_F; 1919 } 1920 } 1921 1922 /* External aborts are not possible in QEMU so A bit is always clear */ 1923 return ret; 1924 } 1925 1926 static const ARMCPRegInfo v7_cp_reginfo[] = { 1927 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 1928 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 1929 .access = PL1_W, .type = ARM_CP_NOP }, 1930 /* Performance monitors are implementation defined in v7, 1931 * but with an ARM recommended set of registers, which we 1932 * follow. 1933 * 1934 * Performance registers fall into three categories: 1935 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 1936 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 1937 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 1938 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 1939 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 1940 */ 1941 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 1942 .access = PL0_RW, .type = ARM_CP_ALIAS, 1943 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1944 .writefn = pmcntenset_write, 1945 .accessfn = pmreg_access, 1946 .raw_writefn = raw_write }, 1947 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, 1948 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 1949 .access = PL0_RW, .accessfn = pmreg_access, 1950 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 1951 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 1952 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 1953 .access = PL0_RW, 1954 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1955 .accessfn = pmreg_access, 1956 .writefn = pmcntenclr_write, 1957 .type = ARM_CP_ALIAS }, 1958 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 1959 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 1960 .access = PL0_RW, .accessfn = pmreg_access, 1961 .type = ARM_CP_ALIAS, 1962 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 1963 .writefn = pmcntenclr_write }, 1964 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 1965 .access = PL0_RW, .type = ARM_CP_IO, 1966 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 1967 .accessfn = pmreg_access, 1968 .writefn = pmovsr_write, 1969 .raw_writefn = raw_write }, 1970 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 1971 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 1972 .access = PL0_RW, .accessfn = pmreg_access, 1973 .type = ARM_CP_ALIAS | ARM_CP_IO, 1974 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 1975 .writefn = pmovsr_write, 1976 .raw_writefn = raw_write }, 1977 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 1978 .access = PL0_W, .accessfn = pmreg_access_swinc, 1979 .type = ARM_CP_NO_RAW | ARM_CP_IO, 1980 .writefn = pmswinc_write }, 1981 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 1982 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 1983 .access = PL0_W, .accessfn = pmreg_access_swinc, 1984 .type = ARM_CP_NO_RAW | ARM_CP_IO, 1985 .writefn = pmswinc_write }, 1986 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 1987 .access = PL0_RW, .type = ARM_CP_ALIAS, 1988 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 1989 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 1990 .raw_writefn = raw_write}, 1991 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 1992 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 1993 .access = PL0_RW, .accessfn = pmreg_access_selr, 1994 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 1995 .writefn = pmselr_write, .raw_writefn = raw_write, }, 1996 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 1997 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 1998 .readfn = pmccntr_read, .writefn = pmccntr_write32, 1999 .accessfn = pmreg_access_ccntr }, 2000 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 2001 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 2002 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 2003 .type = ARM_CP_IO, 2004 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 2005 .readfn = pmccntr_read, .writefn = pmccntr_write, 2006 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 2007 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 2008 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 2009 .access = PL0_RW, .accessfn = pmreg_access, 2010 .type = ARM_CP_ALIAS | ARM_CP_IO, 2011 .resetvalue = 0, }, 2012 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 2013 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 2014 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 2015 .access = PL0_RW, .accessfn = pmreg_access, 2016 .type = ARM_CP_IO, 2017 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 2018 .resetvalue = 0, }, 2019 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 2020 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2021 .accessfn = pmreg_access, 2022 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2023 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 2024 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 2025 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2026 .accessfn = pmreg_access, 2027 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2028 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 2029 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2030 .accessfn = pmreg_access_xevcntr, 2031 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2032 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 2033 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 2034 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2035 .accessfn = pmreg_access_xevcntr, 2036 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2037 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2038 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2039 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2040 .resetvalue = 0, 2041 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2042 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2043 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2044 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2045 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2046 .resetvalue = 0, 2047 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2048 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2049 .access = PL1_RW, .accessfn = access_tpm, 2050 .type = ARM_CP_ALIAS | ARM_CP_IO, 2051 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2052 .resetvalue = 0, 2053 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2054 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2055 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2056 .access = PL1_RW, .accessfn = access_tpm, 2057 .type = ARM_CP_IO, 2058 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2059 .writefn = pmintenset_write, .raw_writefn = raw_write, 2060 .resetvalue = 0x0 }, 2061 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2062 .access = PL1_RW, .accessfn = access_tpm, 2063 .type = ARM_CP_ALIAS | ARM_CP_IO, 2064 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2065 .writefn = pmintenclr_write, }, 2066 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2067 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2068 .access = PL1_RW, .accessfn = access_tpm, 2069 .type = ARM_CP_ALIAS | ARM_CP_IO, 2070 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2071 .writefn = pmintenclr_write }, 2072 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2073 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2074 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2075 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2076 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2077 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0, 2078 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2079 offsetof(CPUARMState, cp15.csselr_ns) } }, 2080 /* Auxiliary ID register: this actually has an IMPDEF value but for now 2081 * just RAZ for all cores: 2082 */ 2083 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2084 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2085 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 2086 /* Auxiliary fault status registers: these also are IMPDEF, and we 2087 * choose to RAZ/WI for all cores. 2088 */ 2089 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2090 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2091 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2092 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2093 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2094 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2095 /* MAIR can just read-as-written because we don't implement caches 2096 * and so don't need to care about memory attributes. 2097 */ 2098 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2099 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2100 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2101 .resetvalue = 0 }, 2102 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2103 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2104 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2105 .resetvalue = 0 }, 2106 /* For non-long-descriptor page tables these are PRRR and NMRR; 2107 * regardless they still act as reads-as-written for QEMU. 2108 */ 2109 /* MAIR0/1 are defined separately from their 64-bit counterpart which 2110 * allows them to assign the correct fieldoffset based on the endianness 2111 * handled in the field definitions. 2112 */ 2113 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2114 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW, 2115 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2116 offsetof(CPUARMState, cp15.mair0_ns) }, 2117 .resetfn = arm_cp_reset_ignore }, 2118 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2119 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW, 2120 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2121 offsetof(CPUARMState, cp15.mair1_ns) }, 2122 .resetfn = arm_cp_reset_ignore }, 2123 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2124 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2125 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2126 /* 32 bit ITLB invalidates */ 2127 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2128 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2129 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2130 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2131 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2132 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2133 /* 32 bit DTLB invalidates */ 2134 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2135 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2136 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2137 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2138 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2139 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2140 /* 32 bit TLB invalidates */ 2141 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2142 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2143 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2144 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2145 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2146 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2147 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2148 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 2149 REGINFO_SENTINEL 2150 }; 2151 2152 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2153 /* 32 bit TLB invalidates, Inner Shareable */ 2154 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2155 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write }, 2156 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2157 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 2158 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2159 .type = ARM_CP_NO_RAW, .access = PL1_W, 2160 .writefn = tlbiasid_is_write }, 2161 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2162 .type = ARM_CP_NO_RAW, .access = PL1_W, 2163 .writefn = tlbimvaa_is_write }, 2164 REGINFO_SENTINEL 2165 }; 2166 2167 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2168 /* PMOVSSET is not implemented in v7 before v7ve */ 2169 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2170 .access = PL0_RW, .accessfn = pmreg_access, 2171 .type = ARM_CP_ALIAS | ARM_CP_IO, 2172 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2173 .writefn = pmovsset_write, 2174 .raw_writefn = raw_write }, 2175 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2176 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2177 .access = PL0_RW, .accessfn = pmreg_access, 2178 .type = ARM_CP_ALIAS | ARM_CP_IO, 2179 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2180 .writefn = pmovsset_write, 2181 .raw_writefn = raw_write }, 2182 REGINFO_SENTINEL 2183 }; 2184 2185 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2186 uint64_t value) 2187 { 2188 value &= 1; 2189 env->teecr = value; 2190 } 2191 2192 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2193 bool isread) 2194 { 2195 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2196 return CP_ACCESS_TRAP; 2197 } 2198 return CP_ACCESS_OK; 2199 } 2200 2201 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2202 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2203 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2204 .resetvalue = 0, 2205 .writefn = teecr_write }, 2206 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2207 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2208 .accessfn = teehbr_access, .resetvalue = 0 }, 2209 REGINFO_SENTINEL 2210 }; 2211 2212 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2213 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2214 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2215 .access = PL0_RW, 2216 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2217 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2218 .access = PL0_RW, 2219 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2220 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2221 .resetfn = arm_cp_reset_ignore }, 2222 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2223 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2224 .access = PL0_R|PL1_W, 2225 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2226 .resetvalue = 0}, 2227 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2228 .access = PL0_R|PL1_W, 2229 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2230 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2231 .resetfn = arm_cp_reset_ignore }, 2232 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2233 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2234 .access = PL1_RW, 2235 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2236 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2237 .access = PL1_RW, 2238 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2239 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2240 .resetvalue = 0 }, 2241 REGINFO_SENTINEL 2242 }; 2243 2244 #ifndef CONFIG_USER_ONLY 2245 2246 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2247 bool isread) 2248 { 2249 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2250 * Writable only at the highest implemented exception level. 2251 */ 2252 int el = arm_current_el(env); 2253 2254 switch (el) { 2255 case 0: 2256 if (!extract32(env->cp15.c14_cntkctl, 0, 2)) { 2257 return CP_ACCESS_TRAP; 2258 } 2259 break; 2260 case 1: 2261 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2262 arm_is_secure_below_el3(env)) { 2263 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2264 return CP_ACCESS_TRAP_UNCATEGORIZED; 2265 } 2266 break; 2267 case 2: 2268 case 3: 2269 break; 2270 } 2271 2272 if (!isread && el < arm_highest_el(env)) { 2273 return CP_ACCESS_TRAP_UNCATEGORIZED; 2274 } 2275 2276 return CP_ACCESS_OK; 2277 } 2278 2279 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2280 bool isread) 2281 { 2282 unsigned int cur_el = arm_current_el(env); 2283 bool secure = arm_is_secure(env); 2284 2285 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */ 2286 if (cur_el == 0 && 2287 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2288 return CP_ACCESS_TRAP; 2289 } 2290 2291 if (arm_feature(env, ARM_FEATURE_EL2) && 2292 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2293 !extract32(env->cp15.cnthctl_el2, 0, 1)) { 2294 return CP_ACCESS_TRAP_EL2; 2295 } 2296 return CP_ACCESS_OK; 2297 } 2298 2299 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2300 bool isread) 2301 { 2302 unsigned int cur_el = arm_current_el(env); 2303 bool secure = arm_is_secure(env); 2304 2305 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if 2306 * EL0[PV]TEN is zero. 2307 */ 2308 if (cur_el == 0 && 2309 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2310 return CP_ACCESS_TRAP; 2311 } 2312 2313 if (arm_feature(env, ARM_FEATURE_EL2) && 2314 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2315 !extract32(env->cp15.cnthctl_el2, 1, 1)) { 2316 return CP_ACCESS_TRAP_EL2; 2317 } 2318 return CP_ACCESS_OK; 2319 } 2320 2321 static CPAccessResult gt_pct_access(CPUARMState *env, 2322 const ARMCPRegInfo *ri, 2323 bool isread) 2324 { 2325 return gt_counter_access(env, GTIMER_PHYS, isread); 2326 } 2327 2328 static CPAccessResult gt_vct_access(CPUARMState *env, 2329 const ARMCPRegInfo *ri, 2330 bool isread) 2331 { 2332 return gt_counter_access(env, GTIMER_VIRT, isread); 2333 } 2334 2335 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2336 bool isread) 2337 { 2338 return gt_timer_access(env, GTIMER_PHYS, isread); 2339 } 2340 2341 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2342 bool isread) 2343 { 2344 return gt_timer_access(env, GTIMER_VIRT, isread); 2345 } 2346 2347 static CPAccessResult gt_stimer_access(CPUARMState *env, 2348 const ARMCPRegInfo *ri, 2349 bool isread) 2350 { 2351 /* The AArch64 register view of the secure physical timer is 2352 * always accessible from EL3, and configurably accessible from 2353 * Secure EL1. 2354 */ 2355 switch (arm_current_el(env)) { 2356 case 1: 2357 if (!arm_is_secure(env)) { 2358 return CP_ACCESS_TRAP; 2359 } 2360 if (!(env->cp15.scr_el3 & SCR_ST)) { 2361 return CP_ACCESS_TRAP_EL3; 2362 } 2363 return CP_ACCESS_OK; 2364 case 0: 2365 case 2: 2366 return CP_ACCESS_TRAP; 2367 case 3: 2368 return CP_ACCESS_OK; 2369 default: 2370 g_assert_not_reached(); 2371 } 2372 } 2373 2374 static uint64_t gt_get_countervalue(CPUARMState *env) 2375 { 2376 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE; 2377 } 2378 2379 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2380 { 2381 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2382 2383 if (gt->ctl & 1) { 2384 /* Timer enabled: calculate and set current ISTATUS, irq, and 2385 * reset timer to when ISTATUS next has to change 2386 */ 2387 uint64_t offset = timeridx == GTIMER_VIRT ? 2388 cpu->env.cp15.cntvoff_el2 : 0; 2389 uint64_t count = gt_get_countervalue(&cpu->env); 2390 /* Note that this must be unsigned 64 bit arithmetic: */ 2391 int istatus = count - offset >= gt->cval; 2392 uint64_t nexttick; 2393 int irqstate; 2394 2395 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2396 2397 irqstate = (istatus && !(gt->ctl & 2)); 2398 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2399 2400 if (istatus) { 2401 /* Next transition is when count rolls back over to zero */ 2402 nexttick = UINT64_MAX; 2403 } else { 2404 /* Next transition is when we hit cval */ 2405 nexttick = gt->cval + offset; 2406 } 2407 /* Note that the desired next expiry time might be beyond the 2408 * signed-64-bit range of a QEMUTimer -- in this case we just 2409 * set the timer for as far in the future as possible. When the 2410 * timer expires we will reset the timer for any remaining period. 2411 */ 2412 if (nexttick > INT64_MAX / GTIMER_SCALE) { 2413 nexttick = INT64_MAX / GTIMER_SCALE; 2414 } 2415 timer_mod(cpu->gt_timer[timeridx], nexttick); 2416 trace_arm_gt_recalc(timeridx, irqstate, nexttick); 2417 } else { 2418 /* Timer disabled: ISTATUS and timer output always clear */ 2419 gt->ctl &= ~4; 2420 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0); 2421 timer_del(cpu->gt_timer[timeridx]); 2422 trace_arm_gt_recalc_disabled(timeridx); 2423 } 2424 } 2425 2426 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2427 int timeridx) 2428 { 2429 ARMCPU *cpu = arm_env_get_cpu(env); 2430 2431 timer_del(cpu->gt_timer[timeridx]); 2432 } 2433 2434 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2435 { 2436 return gt_get_countervalue(env); 2437 } 2438 2439 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2440 { 2441 return gt_get_countervalue(env) - env->cp15.cntvoff_el2; 2442 } 2443 2444 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2445 int timeridx, 2446 uint64_t value) 2447 { 2448 trace_arm_gt_cval_write(timeridx, value); 2449 env->cp15.c14_timer[timeridx].cval = value; 2450 gt_recalc_timer(arm_env_get_cpu(env), timeridx); 2451 } 2452 2453 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2454 int timeridx) 2455 { 2456 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2457 2458 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2459 (gt_get_countervalue(env) - offset)); 2460 } 2461 2462 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2463 int timeridx, 2464 uint64_t value) 2465 { 2466 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2467 2468 trace_arm_gt_tval_write(timeridx, value); 2469 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2470 sextract64(value, 0, 32); 2471 gt_recalc_timer(arm_env_get_cpu(env), timeridx); 2472 } 2473 2474 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2475 int timeridx, 2476 uint64_t value) 2477 { 2478 ARMCPU *cpu = arm_env_get_cpu(env); 2479 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2480 2481 trace_arm_gt_ctl_write(timeridx, value); 2482 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2483 if ((oldval ^ value) & 1) { 2484 /* Enable toggled */ 2485 gt_recalc_timer(cpu, timeridx); 2486 } else if ((oldval ^ value) & 2) { 2487 /* IMASK toggled: don't need to recalculate, 2488 * just set the interrupt line based on ISTATUS 2489 */ 2490 int irqstate = (oldval & 4) && !(value & 2); 2491 2492 trace_arm_gt_imask_toggle(timeridx, irqstate); 2493 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2494 } 2495 } 2496 2497 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2498 { 2499 gt_timer_reset(env, ri, GTIMER_PHYS); 2500 } 2501 2502 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2503 uint64_t value) 2504 { 2505 gt_cval_write(env, ri, GTIMER_PHYS, value); 2506 } 2507 2508 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2509 { 2510 return gt_tval_read(env, ri, GTIMER_PHYS); 2511 } 2512 2513 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2514 uint64_t value) 2515 { 2516 gt_tval_write(env, ri, GTIMER_PHYS, value); 2517 } 2518 2519 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2520 uint64_t value) 2521 { 2522 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2523 } 2524 2525 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2526 { 2527 gt_timer_reset(env, ri, GTIMER_VIRT); 2528 } 2529 2530 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2531 uint64_t value) 2532 { 2533 gt_cval_write(env, ri, GTIMER_VIRT, value); 2534 } 2535 2536 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2537 { 2538 return gt_tval_read(env, ri, GTIMER_VIRT); 2539 } 2540 2541 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2542 uint64_t value) 2543 { 2544 gt_tval_write(env, ri, GTIMER_VIRT, value); 2545 } 2546 2547 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2548 uint64_t value) 2549 { 2550 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2551 } 2552 2553 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2554 uint64_t value) 2555 { 2556 ARMCPU *cpu = arm_env_get_cpu(env); 2557 2558 trace_arm_gt_cntvoff_write(value); 2559 raw_write(env, ri, value); 2560 gt_recalc_timer(cpu, GTIMER_VIRT); 2561 } 2562 2563 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2564 { 2565 gt_timer_reset(env, ri, GTIMER_HYP); 2566 } 2567 2568 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2569 uint64_t value) 2570 { 2571 gt_cval_write(env, ri, GTIMER_HYP, value); 2572 } 2573 2574 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2575 { 2576 return gt_tval_read(env, ri, GTIMER_HYP); 2577 } 2578 2579 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2580 uint64_t value) 2581 { 2582 gt_tval_write(env, ri, GTIMER_HYP, value); 2583 } 2584 2585 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2586 uint64_t value) 2587 { 2588 gt_ctl_write(env, ri, GTIMER_HYP, value); 2589 } 2590 2591 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2592 { 2593 gt_timer_reset(env, ri, GTIMER_SEC); 2594 } 2595 2596 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2597 uint64_t value) 2598 { 2599 gt_cval_write(env, ri, GTIMER_SEC, value); 2600 } 2601 2602 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2603 { 2604 return gt_tval_read(env, ri, GTIMER_SEC); 2605 } 2606 2607 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2608 uint64_t value) 2609 { 2610 gt_tval_write(env, ri, GTIMER_SEC, value); 2611 } 2612 2613 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2614 uint64_t value) 2615 { 2616 gt_ctl_write(env, ri, GTIMER_SEC, value); 2617 } 2618 2619 void arm_gt_ptimer_cb(void *opaque) 2620 { 2621 ARMCPU *cpu = opaque; 2622 2623 gt_recalc_timer(cpu, GTIMER_PHYS); 2624 } 2625 2626 void arm_gt_vtimer_cb(void *opaque) 2627 { 2628 ARMCPU *cpu = opaque; 2629 2630 gt_recalc_timer(cpu, GTIMER_VIRT); 2631 } 2632 2633 void arm_gt_htimer_cb(void *opaque) 2634 { 2635 ARMCPU *cpu = opaque; 2636 2637 gt_recalc_timer(cpu, GTIMER_HYP); 2638 } 2639 2640 void arm_gt_stimer_cb(void *opaque) 2641 { 2642 ARMCPU *cpu = opaque; 2643 2644 gt_recalc_timer(cpu, GTIMER_SEC); 2645 } 2646 2647 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2648 /* Note that CNTFRQ is purely reads-as-written for the benefit 2649 * of software; writing it doesn't actually change the timer frequency. 2650 * Our reset value matches the fixed frequency we implement the timer at. 2651 */ 2652 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 2653 .type = ARM_CP_ALIAS, 2654 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2655 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 2656 }, 2657 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2658 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2659 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2660 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2661 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE, 2662 }, 2663 /* overall control: mostly access permissions */ 2664 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 2665 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 2666 .access = PL1_RW, 2667 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 2668 .resetvalue = 0, 2669 }, 2670 /* per-timer control */ 2671 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2672 .secure = ARM_CP_SECSTATE_NS, 2673 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2674 .accessfn = gt_ptimer_access, 2675 .fieldoffset = offsetoflow32(CPUARMState, 2676 cp15.c14_timer[GTIMER_PHYS].ctl), 2677 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2678 }, 2679 { .name = "CNTP_CTL_S", 2680 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2681 .secure = ARM_CP_SECSTATE_S, 2682 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2683 .accessfn = gt_ptimer_access, 2684 .fieldoffset = offsetoflow32(CPUARMState, 2685 cp15.c14_timer[GTIMER_SEC].ctl), 2686 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2687 }, 2688 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 2689 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 2690 .type = ARM_CP_IO, .access = PL0_RW, 2691 .accessfn = gt_ptimer_access, 2692 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 2693 .resetvalue = 0, 2694 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2695 }, 2696 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 2697 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2698 .accessfn = gt_vtimer_access, 2699 .fieldoffset = offsetoflow32(CPUARMState, 2700 cp15.c14_timer[GTIMER_VIRT].ctl), 2701 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2702 }, 2703 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 2704 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 2705 .type = ARM_CP_IO, .access = PL0_RW, 2706 .accessfn = gt_vtimer_access, 2707 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 2708 .resetvalue = 0, 2709 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2710 }, 2711 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 2712 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2713 .secure = ARM_CP_SECSTATE_NS, 2714 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2715 .accessfn = gt_ptimer_access, 2716 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2717 }, 2718 { .name = "CNTP_TVAL_S", 2719 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2720 .secure = ARM_CP_SECSTATE_S, 2721 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2722 .accessfn = gt_ptimer_access, 2723 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 2724 }, 2725 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2726 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 2727 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2728 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 2729 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2730 }, 2731 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 2732 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2733 .accessfn = gt_vtimer_access, 2734 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2735 }, 2736 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2737 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 2738 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 2739 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 2740 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2741 }, 2742 /* The counter itself */ 2743 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 2744 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2745 .accessfn = gt_pct_access, 2746 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 2747 }, 2748 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 2749 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 2750 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2751 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 2752 }, 2753 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 2754 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2755 .accessfn = gt_vct_access, 2756 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 2757 }, 2758 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2759 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2760 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2761 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 2762 }, 2763 /* Comparison value, indicating when the timer goes off */ 2764 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 2765 .secure = ARM_CP_SECSTATE_NS, 2766 .access = PL0_RW, 2767 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2768 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2769 .accessfn = gt_ptimer_access, 2770 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2771 }, 2772 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 2773 .secure = ARM_CP_SECSTATE_S, 2774 .access = PL0_RW, 2775 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2776 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2777 .accessfn = gt_ptimer_access, 2778 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2779 }, 2780 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2781 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 2782 .access = PL0_RW, 2783 .type = ARM_CP_IO, 2784 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2785 .resetvalue = 0, .accessfn = gt_ptimer_access, 2786 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2787 }, 2788 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 2789 .access = PL0_RW, 2790 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2791 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2792 .accessfn = gt_vtimer_access, 2793 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2794 }, 2795 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2796 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 2797 .access = PL0_RW, 2798 .type = ARM_CP_IO, 2799 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2800 .resetvalue = 0, .accessfn = gt_vtimer_access, 2801 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2802 }, 2803 /* Secure timer -- this is actually restricted to only EL3 2804 * and configurably Secure-EL1 via the accessfn. 2805 */ 2806 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 2807 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 2808 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 2809 .accessfn = gt_stimer_access, 2810 .readfn = gt_sec_tval_read, 2811 .writefn = gt_sec_tval_write, 2812 .resetfn = gt_sec_timer_reset, 2813 }, 2814 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 2815 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 2816 .type = ARM_CP_IO, .access = PL1_RW, 2817 .accessfn = gt_stimer_access, 2818 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 2819 .resetvalue = 0, 2820 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2821 }, 2822 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 2823 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 2824 .type = ARM_CP_IO, .access = PL1_RW, 2825 .accessfn = gt_stimer_access, 2826 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2827 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2828 }, 2829 REGINFO_SENTINEL 2830 }; 2831 2832 #else 2833 2834 /* In user-mode most of the generic timer registers are inaccessible 2835 * however modern kernels (4.12+) allow access to cntvct_el0 2836 */ 2837 2838 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2839 { 2840 /* Currently we have no support for QEMUTimer in linux-user so we 2841 * can't call gt_get_countervalue(env), instead we directly 2842 * call the lower level functions. 2843 */ 2844 return cpu_get_clock() / GTIMER_SCALE; 2845 } 2846 2847 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2848 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2849 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2850 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 2851 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2852 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE, 2853 }, 2854 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2855 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2856 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2857 .readfn = gt_virt_cnt_read, 2858 }, 2859 REGINFO_SENTINEL 2860 }; 2861 2862 #endif 2863 2864 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2865 { 2866 if (arm_feature(env, ARM_FEATURE_LPAE)) { 2867 raw_write(env, ri, value); 2868 } else if (arm_feature(env, ARM_FEATURE_V7)) { 2869 raw_write(env, ri, value & 0xfffff6ff); 2870 } else { 2871 raw_write(env, ri, value & 0xfffff1ff); 2872 } 2873 } 2874 2875 #ifndef CONFIG_USER_ONLY 2876 /* get_phys_addr() isn't present for user-mode-only targets */ 2877 2878 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 2879 bool isread) 2880 { 2881 if (ri->opc2 & 4) { 2882 /* The ATS12NSO* operations must trap to EL3 if executed in 2883 * Secure EL1 (which can only happen if EL3 is AArch64). 2884 * They are simply UNDEF if executed from NS EL1. 2885 * They function normally from EL2 or EL3. 2886 */ 2887 if (arm_current_el(env) == 1) { 2888 if (arm_is_secure_below_el3(env)) { 2889 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3; 2890 } 2891 return CP_ACCESS_TRAP_UNCATEGORIZED; 2892 } 2893 } 2894 return CP_ACCESS_OK; 2895 } 2896 2897 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 2898 MMUAccessType access_type, ARMMMUIdx mmu_idx) 2899 { 2900 hwaddr phys_addr; 2901 target_ulong page_size; 2902 int prot; 2903 bool ret; 2904 uint64_t par64; 2905 bool format64 = false; 2906 MemTxAttrs attrs = {}; 2907 ARMMMUFaultInfo fi = {}; 2908 ARMCacheAttrs cacheattrs = {}; 2909 2910 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs, 2911 &prot, &page_size, &fi, &cacheattrs); 2912 2913 if (is_a64(env)) { 2914 format64 = true; 2915 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 2916 /* 2917 * ATS1Cxx: 2918 * * TTBCR.EAE determines whether the result is returned using the 2919 * 32-bit or the 64-bit PAR format 2920 * * Instructions executed in Hyp mode always use the 64bit format 2921 * 2922 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 2923 * * The Non-secure TTBCR.EAE bit is set to 1 2924 * * The implementation includes EL2, and the value of HCR.VM is 1 2925 * 2926 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 2927 * 2928 * ATS1Hx always uses the 64bit format. 2929 */ 2930 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 2931 2932 if (arm_feature(env, ARM_FEATURE_EL2)) { 2933 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 2934 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 2935 } else { 2936 format64 |= arm_current_el(env) == 2; 2937 } 2938 } 2939 } 2940 2941 if (format64) { 2942 /* Create a 64-bit PAR */ 2943 par64 = (1 << 11); /* LPAE bit always set */ 2944 if (!ret) { 2945 par64 |= phys_addr & ~0xfffULL; 2946 if (!attrs.secure) { 2947 par64 |= (1 << 9); /* NS */ 2948 } 2949 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */ 2950 par64 |= cacheattrs.shareability << 7; /* SH */ 2951 } else { 2952 uint32_t fsr = arm_fi_to_lfsc(&fi); 2953 2954 par64 |= 1; /* F */ 2955 par64 |= (fsr & 0x3f) << 1; /* FS */ 2956 if (fi.stage2) { 2957 par64 |= (1 << 9); /* S */ 2958 } 2959 if (fi.s1ptw) { 2960 par64 |= (1 << 8); /* PTW */ 2961 } 2962 } 2963 } else { 2964 /* fsr is a DFSR/IFSR value for the short descriptor 2965 * translation table format (with WnR always clear). 2966 * Convert it to a 32-bit PAR. 2967 */ 2968 if (!ret) { 2969 /* We do not set any attribute bits in the PAR */ 2970 if (page_size == (1 << 24) 2971 && arm_feature(env, ARM_FEATURE_V7)) { 2972 par64 = (phys_addr & 0xff000000) | (1 << 1); 2973 } else { 2974 par64 = phys_addr & 0xfffff000; 2975 } 2976 if (!attrs.secure) { 2977 par64 |= (1 << 9); /* NS */ 2978 } 2979 } else { 2980 uint32_t fsr = arm_fi_to_sfsc(&fi); 2981 2982 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 2983 ((fsr & 0xf) << 1) | 1; 2984 } 2985 } 2986 return par64; 2987 } 2988 2989 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2990 { 2991 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 2992 uint64_t par64; 2993 ARMMMUIdx mmu_idx; 2994 int el = arm_current_el(env); 2995 bool secure = arm_is_secure_below_el3(env); 2996 2997 switch (ri->opc2 & 6) { 2998 case 0: 2999 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */ 3000 switch (el) { 3001 case 3: 3002 mmu_idx = ARMMMUIdx_S1E3; 3003 break; 3004 case 2: 3005 mmu_idx = ARMMMUIdx_S1NSE1; 3006 break; 3007 case 1: 3008 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 3009 break; 3010 default: 3011 g_assert_not_reached(); 3012 } 3013 break; 3014 case 2: 3015 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3016 switch (el) { 3017 case 3: 3018 mmu_idx = ARMMMUIdx_S1SE0; 3019 break; 3020 case 2: 3021 mmu_idx = ARMMMUIdx_S1NSE0; 3022 break; 3023 case 1: 3024 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 3025 break; 3026 default: 3027 g_assert_not_reached(); 3028 } 3029 break; 3030 case 4: 3031 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3032 mmu_idx = ARMMMUIdx_S12NSE1; 3033 break; 3034 case 6: 3035 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3036 mmu_idx = ARMMMUIdx_S12NSE0; 3037 break; 3038 default: 3039 g_assert_not_reached(); 3040 } 3041 3042 par64 = do_ats_write(env, value, access_type, mmu_idx); 3043 3044 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3045 } 3046 3047 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3048 uint64_t value) 3049 { 3050 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3051 uint64_t par64; 3052 3053 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2); 3054 3055 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3056 } 3057 3058 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3059 bool isread) 3060 { 3061 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) { 3062 return CP_ACCESS_TRAP; 3063 } 3064 return CP_ACCESS_OK; 3065 } 3066 3067 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3068 uint64_t value) 3069 { 3070 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3071 ARMMMUIdx mmu_idx; 3072 int secure = arm_is_secure_below_el3(env); 3073 3074 switch (ri->opc2 & 6) { 3075 case 0: 3076 switch (ri->opc1) { 3077 case 0: /* AT S1E1R, AT S1E1W */ 3078 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 3079 break; 3080 case 4: /* AT S1E2R, AT S1E2W */ 3081 mmu_idx = ARMMMUIdx_S1E2; 3082 break; 3083 case 6: /* AT S1E3R, AT S1E3W */ 3084 mmu_idx = ARMMMUIdx_S1E3; 3085 break; 3086 default: 3087 g_assert_not_reached(); 3088 } 3089 break; 3090 case 2: /* AT S1E0R, AT S1E0W */ 3091 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 3092 break; 3093 case 4: /* AT S12E1R, AT S12E1W */ 3094 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1; 3095 break; 3096 case 6: /* AT S12E0R, AT S12E0W */ 3097 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0; 3098 break; 3099 default: 3100 g_assert_not_reached(); 3101 } 3102 3103 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx); 3104 } 3105 #endif 3106 3107 static const ARMCPRegInfo vapa_cp_reginfo[] = { 3108 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 3109 .access = PL1_RW, .resetvalue = 0, 3110 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 3111 offsetoflow32(CPUARMState, cp15.par_ns) }, 3112 .writefn = par_write }, 3113 #ifndef CONFIG_USER_ONLY 3114 /* This underdecoding is safe because the reginfo is NO_RAW. */ 3115 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 3116 .access = PL1_W, .accessfn = ats_access, 3117 .writefn = ats_write, .type = ARM_CP_NO_RAW }, 3118 #endif 3119 REGINFO_SENTINEL 3120 }; 3121 3122 /* Return basic MPU access permission bits. */ 3123 static uint32_t simple_mpu_ap_bits(uint32_t val) 3124 { 3125 uint32_t ret; 3126 uint32_t mask; 3127 int i; 3128 ret = 0; 3129 mask = 3; 3130 for (i = 0; i < 16; i += 2) { 3131 ret |= (val >> i) & mask; 3132 mask <<= 2; 3133 } 3134 return ret; 3135 } 3136 3137 /* Pad basic MPU access permission bits to extended format. */ 3138 static uint32_t extended_mpu_ap_bits(uint32_t val) 3139 { 3140 uint32_t ret; 3141 uint32_t mask; 3142 int i; 3143 ret = 0; 3144 mask = 3; 3145 for (i = 0; i < 16; i += 2) { 3146 ret |= (val & mask) << i; 3147 mask <<= 2; 3148 } 3149 return ret; 3150 } 3151 3152 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3153 uint64_t value) 3154 { 3155 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3156 } 3157 3158 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3159 { 3160 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3161 } 3162 3163 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3164 uint64_t value) 3165 { 3166 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3167 } 3168 3169 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3170 { 3171 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3172 } 3173 3174 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3175 { 3176 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3177 3178 if (!u32p) { 3179 return 0; 3180 } 3181 3182 u32p += env->pmsav7.rnr[M_REG_NS]; 3183 return *u32p; 3184 } 3185 3186 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3187 uint64_t value) 3188 { 3189 ARMCPU *cpu = arm_env_get_cpu(env); 3190 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3191 3192 if (!u32p) { 3193 return; 3194 } 3195 3196 u32p += env->pmsav7.rnr[M_REG_NS]; 3197 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3198 *u32p = value; 3199 } 3200 3201 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3202 uint64_t value) 3203 { 3204 ARMCPU *cpu = arm_env_get_cpu(env); 3205 uint32_t nrgs = cpu->pmsav7_dregion; 3206 3207 if (value >= nrgs) { 3208 qemu_log_mask(LOG_GUEST_ERROR, 3209 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3210 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3211 return; 3212 } 3213 3214 raw_write(env, ri, value); 3215 } 3216 3217 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 3218 /* Reset for all these registers is handled in arm_cpu_reset(), 3219 * because the PMSAv7 is also used by M-profile CPUs, which do 3220 * not register cpregs but still need the state to be reset. 3221 */ 3222 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 3223 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3224 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 3225 .readfn = pmsav7_read, .writefn = pmsav7_write, 3226 .resetfn = arm_cp_reset_ignore }, 3227 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 3228 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3229 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 3230 .readfn = pmsav7_read, .writefn = pmsav7_write, 3231 .resetfn = arm_cp_reset_ignore }, 3232 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 3233 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3234 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 3235 .readfn = pmsav7_read, .writefn = pmsav7_write, 3236 .resetfn = arm_cp_reset_ignore }, 3237 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 3238 .access = PL1_RW, 3239 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 3240 .writefn = pmsav7_rgnr_write, 3241 .resetfn = arm_cp_reset_ignore }, 3242 REGINFO_SENTINEL 3243 }; 3244 3245 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 3246 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3247 .access = PL1_RW, .type = ARM_CP_ALIAS, 3248 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3249 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 3250 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3251 .access = PL1_RW, .type = ARM_CP_ALIAS, 3252 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3253 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 3254 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 3255 .access = PL1_RW, 3256 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3257 .resetvalue = 0, }, 3258 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 3259 .access = PL1_RW, 3260 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3261 .resetvalue = 0, }, 3262 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 3263 .access = PL1_RW, 3264 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 3265 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 3266 .access = PL1_RW, 3267 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 3268 /* Protection region base and size registers */ 3269 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 3270 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3271 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 3272 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 3273 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3274 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 3275 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 3276 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3277 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 3278 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 3279 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3280 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 3281 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 3282 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3283 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 3284 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 3285 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3286 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 3287 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 3288 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3289 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 3290 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 3291 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3292 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 3293 REGINFO_SENTINEL 3294 }; 3295 3296 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 3297 uint64_t value) 3298 { 3299 TCR *tcr = raw_ptr(env, ri); 3300 int maskshift = extract32(value, 0, 3); 3301 3302 if (!arm_feature(env, ARM_FEATURE_V8)) { 3303 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 3304 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 3305 * using Long-desciptor translation table format */ 3306 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 3307 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 3308 /* In an implementation that includes the Security Extensions 3309 * TTBCR has additional fields PD0 [4] and PD1 [5] for 3310 * Short-descriptor translation table format. 3311 */ 3312 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 3313 } else { 3314 value &= TTBCR_N; 3315 } 3316 } 3317 3318 /* Update the masks corresponding to the TCR bank being written 3319 * Note that we always calculate mask and base_mask, but 3320 * they are only used for short-descriptor tables (ie if EAE is 0); 3321 * for long-descriptor tables the TCR fields are used differently 3322 * and the mask and base_mask values are meaningless. 3323 */ 3324 tcr->raw_tcr = value; 3325 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift); 3326 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift); 3327 } 3328 3329 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3330 uint64_t value) 3331 { 3332 ARMCPU *cpu = arm_env_get_cpu(env); 3333 TCR *tcr = raw_ptr(env, ri); 3334 3335 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3336 /* With LPAE the TTBCR could result in a change of ASID 3337 * via the TTBCR.A1 bit, so do a TLB flush. 3338 */ 3339 tlb_flush(CPU(cpu)); 3340 } 3341 /* Preserve the high half of TCR_EL1, set via TTBCR2. */ 3342 value = deposit64(tcr->raw_tcr, 0, 32, value); 3343 vmsa_ttbcr_raw_write(env, ri, value); 3344 } 3345 3346 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3347 { 3348 TCR *tcr = raw_ptr(env, ri); 3349 3350 /* Reset both the TCR as well as the masks corresponding to the bank of 3351 * the TCR being reset. 3352 */ 3353 tcr->raw_tcr = 0; 3354 tcr->mask = 0; 3355 tcr->base_mask = 0xffffc000u; 3356 } 3357 3358 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3359 uint64_t value) 3360 { 3361 ARMCPU *cpu = arm_env_get_cpu(env); 3362 TCR *tcr = raw_ptr(env, ri); 3363 3364 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 3365 tlb_flush(CPU(cpu)); 3366 tcr->raw_tcr = value; 3367 } 3368 3369 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3370 uint64_t value) 3371 { 3372 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 3373 if (cpreg_field_is_64bit(ri) && 3374 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 3375 ARMCPU *cpu = arm_env_get_cpu(env); 3376 tlb_flush(CPU(cpu)); 3377 } 3378 raw_write(env, ri, value); 3379 } 3380 3381 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3382 uint64_t value) 3383 { 3384 ARMCPU *cpu = arm_env_get_cpu(env); 3385 CPUState *cs = CPU(cpu); 3386 3387 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */ 3388 if (raw_read(env, ri) != value) { 3389 tlb_flush_by_mmuidx(cs, 3390 ARMMMUIdxBit_S12NSE1 | 3391 ARMMMUIdxBit_S12NSE0 | 3392 ARMMMUIdxBit_S2NS); 3393 raw_write(env, ri, value); 3394 } 3395 } 3396 3397 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 3398 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3399 .access = PL1_RW, .type = ARM_CP_ALIAS, 3400 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 3401 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 3402 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3403 .access = PL1_RW, .resetvalue = 0, 3404 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 3405 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 3406 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 3407 .access = PL1_RW, .resetvalue = 0, 3408 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 3409 offsetof(CPUARMState, cp15.dfar_ns) } }, 3410 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 3411 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 3412 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 3413 .resetvalue = 0, }, 3414 REGINFO_SENTINEL 3415 }; 3416 3417 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 3418 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 3419 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 3420 .access = PL1_RW, 3421 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 3422 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 3423 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 3424 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3425 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3426 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 3427 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 3428 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 3429 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3430 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3431 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 3432 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 3433 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3434 .access = PL1_RW, .writefn = vmsa_tcr_el1_write, 3435 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write, 3436 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 3437 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3438 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 3439 .raw_writefn = vmsa_ttbcr_raw_write, 3440 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 3441 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 3442 REGINFO_SENTINEL 3443 }; 3444 3445 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing 3446 * qemu tlbs nor adjusting cached masks. 3447 */ 3448 static const ARMCPRegInfo ttbcr2_reginfo = { 3449 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 3450 .access = PL1_RW, .type = ARM_CP_ALIAS, 3451 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 3452 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) }, 3453 }; 3454 3455 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 3456 uint64_t value) 3457 { 3458 env->cp15.c15_ticonfig = value & 0xe7; 3459 /* The OS_TYPE bit in this register changes the reported CPUID! */ 3460 env->cp15.c0_cpuid = (value & (1 << 5)) ? 3461 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 3462 } 3463 3464 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 3465 uint64_t value) 3466 { 3467 env->cp15.c15_threadid = value & 0xffff; 3468 } 3469 3470 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 3471 uint64_t value) 3472 { 3473 /* Wait-for-interrupt (deprecated) */ 3474 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT); 3475 } 3476 3477 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 3478 uint64_t value) 3479 { 3480 /* On OMAP there are registers indicating the max/min index of dcache lines 3481 * containing a dirty line; cache flush operations have to reset these. 3482 */ 3483 env->cp15.c15_i_max = 0x000; 3484 env->cp15.c15_i_min = 0xff0; 3485 } 3486 3487 static const ARMCPRegInfo omap_cp_reginfo[] = { 3488 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 3489 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 3490 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 3491 .resetvalue = 0, }, 3492 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 3493 .access = PL1_RW, .type = ARM_CP_NOP }, 3494 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 3495 .access = PL1_RW, 3496 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 3497 .writefn = omap_ticonfig_write }, 3498 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 3499 .access = PL1_RW, 3500 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 3501 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 3502 .access = PL1_RW, .resetvalue = 0xff0, 3503 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 3504 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 3505 .access = PL1_RW, 3506 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 3507 .writefn = omap_threadid_write }, 3508 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 3509 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3510 .type = ARM_CP_NO_RAW, 3511 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 3512 /* TODO: Peripheral port remap register: 3513 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 3514 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 3515 * when MMU is off. 3516 */ 3517 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 3518 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 3519 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 3520 .writefn = omap_cachemaint_write }, 3521 { .name = "C9", .cp = 15, .crn = 9, 3522 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 3523 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 3524 REGINFO_SENTINEL 3525 }; 3526 3527 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3528 uint64_t value) 3529 { 3530 env->cp15.c15_cpar = value & 0x3fff; 3531 } 3532 3533 static const ARMCPRegInfo xscale_cp_reginfo[] = { 3534 { .name = "XSCALE_CPAR", 3535 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3536 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 3537 .writefn = xscale_cpar_write, }, 3538 { .name = "XSCALE_AUXCR", 3539 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 3540 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 3541 .resetvalue = 0, }, 3542 /* XScale specific cache-lockdown: since we have no cache we NOP these 3543 * and hope the guest does not really rely on cache behaviour. 3544 */ 3545 { .name = "XSCALE_LOCK_ICACHE_LINE", 3546 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 3547 .access = PL1_W, .type = ARM_CP_NOP }, 3548 { .name = "XSCALE_UNLOCK_ICACHE", 3549 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 3550 .access = PL1_W, .type = ARM_CP_NOP }, 3551 { .name = "XSCALE_DCACHE_LOCK", 3552 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 3553 .access = PL1_RW, .type = ARM_CP_NOP }, 3554 { .name = "XSCALE_UNLOCK_DCACHE", 3555 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 3556 .access = PL1_W, .type = ARM_CP_NOP }, 3557 REGINFO_SENTINEL 3558 }; 3559 3560 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 3561 /* RAZ/WI the whole crn=15 space, when we don't have a more specific 3562 * implementation of this implementation-defined space. 3563 * Ideally this should eventually disappear in favour of actually 3564 * implementing the correct behaviour for all cores. 3565 */ 3566 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 3567 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3568 .access = PL1_RW, 3569 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 3570 .resetvalue = 0 }, 3571 REGINFO_SENTINEL 3572 }; 3573 3574 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 3575 /* Cache status: RAZ because we have no cache so it's always clean */ 3576 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 3577 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3578 .resetvalue = 0 }, 3579 REGINFO_SENTINEL 3580 }; 3581 3582 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 3583 /* We never have a a block transfer operation in progress */ 3584 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 3585 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3586 .resetvalue = 0 }, 3587 /* The cache ops themselves: these all NOP for QEMU */ 3588 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 3589 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3590 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 3591 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3592 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 3593 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3594 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 3595 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3596 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 3597 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3598 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 3599 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3600 REGINFO_SENTINEL 3601 }; 3602 3603 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 3604 /* The cache test-and-clean instructions always return (1 << 30) 3605 * to indicate that there are no dirty cache lines. 3606 */ 3607 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 3608 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3609 .resetvalue = (1 << 30) }, 3610 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 3611 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3612 .resetvalue = (1 << 30) }, 3613 REGINFO_SENTINEL 3614 }; 3615 3616 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 3617 /* Ignore ReadBuffer accesses */ 3618 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 3619 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3620 .access = PL1_RW, .resetvalue = 0, 3621 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 3622 REGINFO_SENTINEL 3623 }; 3624 3625 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3626 { 3627 ARMCPU *cpu = arm_env_get_cpu(env); 3628 unsigned int cur_el = arm_current_el(env); 3629 bool secure = arm_is_secure(env); 3630 3631 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3632 return env->cp15.vpidr_el2; 3633 } 3634 return raw_read(env, ri); 3635 } 3636 3637 static uint64_t mpidr_read_val(CPUARMState *env) 3638 { 3639 ARMCPU *cpu = ARM_CPU(arm_env_get_cpu(env)); 3640 uint64_t mpidr = cpu->mp_affinity; 3641 3642 if (arm_feature(env, ARM_FEATURE_V7MP)) { 3643 mpidr |= (1U << 31); 3644 /* Cores which are uniprocessor (non-coherent) 3645 * but still implement the MP extensions set 3646 * bit 30. (For instance, Cortex-R5). 3647 */ 3648 if (cpu->mp_is_up) { 3649 mpidr |= (1u << 30); 3650 } 3651 } 3652 return mpidr; 3653 } 3654 3655 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3656 { 3657 unsigned int cur_el = arm_current_el(env); 3658 bool secure = arm_is_secure(env); 3659 3660 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3661 return env->cp15.vmpidr_el2; 3662 } 3663 return mpidr_read_val(env); 3664 } 3665 3666 static const ARMCPRegInfo lpae_cp_reginfo[] = { 3667 /* NOP AMAIR0/1 */ 3668 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 3669 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 3670 .access = PL1_RW, .type = ARM_CP_CONST, 3671 .resetvalue = 0 }, 3672 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 3673 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 3674 .access = PL1_RW, .type = ARM_CP_CONST, 3675 .resetvalue = 0 }, 3676 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 3677 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 3678 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 3679 offsetof(CPUARMState, cp15.par_ns)} }, 3680 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 3681 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3682 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3683 offsetof(CPUARMState, cp15.ttbr0_ns) }, 3684 .writefn = vmsa_ttbr_write, }, 3685 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 3686 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3687 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3688 offsetof(CPUARMState, cp15.ttbr1_ns) }, 3689 .writefn = vmsa_ttbr_write, }, 3690 REGINFO_SENTINEL 3691 }; 3692 3693 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3694 { 3695 return vfp_get_fpcr(env); 3696 } 3697 3698 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3699 uint64_t value) 3700 { 3701 vfp_set_fpcr(env, value); 3702 } 3703 3704 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3705 { 3706 return vfp_get_fpsr(env); 3707 } 3708 3709 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3710 uint64_t value) 3711 { 3712 vfp_set_fpsr(env, value); 3713 } 3714 3715 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 3716 bool isread) 3717 { 3718 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) { 3719 return CP_ACCESS_TRAP; 3720 } 3721 return CP_ACCESS_OK; 3722 } 3723 3724 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 3725 uint64_t value) 3726 { 3727 env->daif = value & PSTATE_DAIF; 3728 } 3729 3730 static CPAccessResult aa64_cacheop_access(CPUARMState *env, 3731 const ARMCPRegInfo *ri, 3732 bool isread) 3733 { 3734 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless 3735 * SCTLR_EL1.UCI is set. 3736 */ 3737 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) { 3738 return CP_ACCESS_TRAP; 3739 } 3740 return CP_ACCESS_OK; 3741 } 3742 3743 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 3744 * Page D4-1736 (DDI0487A.b) 3745 */ 3746 3747 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3748 uint64_t value) 3749 { 3750 CPUState *cs = ENV_GET_CPU(env); 3751 bool sec = arm_is_secure_below_el3(env); 3752 3753 if (sec) { 3754 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3755 ARMMMUIdxBit_S1SE1 | 3756 ARMMMUIdxBit_S1SE0); 3757 } else { 3758 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3759 ARMMMUIdxBit_S12NSE1 | 3760 ARMMMUIdxBit_S12NSE0); 3761 } 3762 } 3763 3764 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3765 uint64_t value) 3766 { 3767 CPUState *cs = ENV_GET_CPU(env); 3768 3769 if (tlb_force_broadcast(env)) { 3770 tlbi_aa64_vmalle1is_write(env, NULL, value); 3771 return; 3772 } 3773 3774 if (arm_is_secure_below_el3(env)) { 3775 tlb_flush_by_mmuidx(cs, 3776 ARMMMUIdxBit_S1SE1 | 3777 ARMMMUIdxBit_S1SE0); 3778 } else { 3779 tlb_flush_by_mmuidx(cs, 3780 ARMMMUIdxBit_S12NSE1 | 3781 ARMMMUIdxBit_S12NSE0); 3782 } 3783 } 3784 3785 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3786 uint64_t value) 3787 { 3788 /* Note that the 'ALL' scope must invalidate both stage 1 and 3789 * stage 2 translations, whereas most other scopes only invalidate 3790 * stage 1 translations. 3791 */ 3792 ARMCPU *cpu = arm_env_get_cpu(env); 3793 CPUState *cs = CPU(cpu); 3794 3795 if (arm_is_secure_below_el3(env)) { 3796 tlb_flush_by_mmuidx(cs, 3797 ARMMMUIdxBit_S1SE1 | 3798 ARMMMUIdxBit_S1SE0); 3799 } else { 3800 if (arm_feature(env, ARM_FEATURE_EL2)) { 3801 tlb_flush_by_mmuidx(cs, 3802 ARMMMUIdxBit_S12NSE1 | 3803 ARMMMUIdxBit_S12NSE0 | 3804 ARMMMUIdxBit_S2NS); 3805 } else { 3806 tlb_flush_by_mmuidx(cs, 3807 ARMMMUIdxBit_S12NSE1 | 3808 ARMMMUIdxBit_S12NSE0); 3809 } 3810 } 3811 } 3812 3813 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3814 uint64_t value) 3815 { 3816 ARMCPU *cpu = arm_env_get_cpu(env); 3817 CPUState *cs = CPU(cpu); 3818 3819 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 3820 } 3821 3822 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3823 uint64_t value) 3824 { 3825 ARMCPU *cpu = arm_env_get_cpu(env); 3826 CPUState *cs = CPU(cpu); 3827 3828 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3); 3829 } 3830 3831 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3832 uint64_t value) 3833 { 3834 /* Note that the 'ALL' scope must invalidate both stage 1 and 3835 * stage 2 translations, whereas most other scopes only invalidate 3836 * stage 1 translations. 3837 */ 3838 CPUState *cs = ENV_GET_CPU(env); 3839 bool sec = arm_is_secure_below_el3(env); 3840 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2); 3841 3842 if (sec) { 3843 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3844 ARMMMUIdxBit_S1SE1 | 3845 ARMMMUIdxBit_S1SE0); 3846 } else if (has_el2) { 3847 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3848 ARMMMUIdxBit_S12NSE1 | 3849 ARMMMUIdxBit_S12NSE0 | 3850 ARMMMUIdxBit_S2NS); 3851 } else { 3852 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3853 ARMMMUIdxBit_S12NSE1 | 3854 ARMMMUIdxBit_S12NSE0); 3855 } 3856 } 3857 3858 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3859 uint64_t value) 3860 { 3861 CPUState *cs = ENV_GET_CPU(env); 3862 3863 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 3864 } 3865 3866 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3867 uint64_t value) 3868 { 3869 CPUState *cs = ENV_GET_CPU(env); 3870 3871 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3); 3872 } 3873 3874 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3875 uint64_t value) 3876 { 3877 /* Invalidate by VA, EL2 3878 * Currently handles both VAE2 and VALE2, since we don't support 3879 * flush-last-level-only. 3880 */ 3881 ARMCPU *cpu = arm_env_get_cpu(env); 3882 CPUState *cs = CPU(cpu); 3883 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3884 3885 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 3886 } 3887 3888 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3889 uint64_t value) 3890 { 3891 /* Invalidate by VA, EL3 3892 * Currently handles both VAE3 and VALE3, since we don't support 3893 * flush-last-level-only. 3894 */ 3895 ARMCPU *cpu = arm_env_get_cpu(env); 3896 CPUState *cs = CPU(cpu); 3897 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3898 3899 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3); 3900 } 3901 3902 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3903 uint64_t value) 3904 { 3905 ARMCPU *cpu = arm_env_get_cpu(env); 3906 CPUState *cs = CPU(cpu); 3907 bool sec = arm_is_secure_below_el3(env); 3908 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3909 3910 if (sec) { 3911 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3912 ARMMMUIdxBit_S1SE1 | 3913 ARMMMUIdxBit_S1SE0); 3914 } else { 3915 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3916 ARMMMUIdxBit_S12NSE1 | 3917 ARMMMUIdxBit_S12NSE0); 3918 } 3919 } 3920 3921 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3922 uint64_t value) 3923 { 3924 /* Invalidate by VA, EL1&0 (AArch64 version). 3925 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 3926 * since we don't support flush-for-specific-ASID-only or 3927 * flush-last-level-only. 3928 */ 3929 ARMCPU *cpu = arm_env_get_cpu(env); 3930 CPUState *cs = CPU(cpu); 3931 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3932 3933 if (tlb_force_broadcast(env)) { 3934 tlbi_aa64_vae1is_write(env, NULL, value); 3935 return; 3936 } 3937 3938 if (arm_is_secure_below_el3(env)) { 3939 tlb_flush_page_by_mmuidx(cs, pageaddr, 3940 ARMMMUIdxBit_S1SE1 | 3941 ARMMMUIdxBit_S1SE0); 3942 } else { 3943 tlb_flush_page_by_mmuidx(cs, pageaddr, 3944 ARMMMUIdxBit_S12NSE1 | 3945 ARMMMUIdxBit_S12NSE0); 3946 } 3947 } 3948 3949 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3950 uint64_t value) 3951 { 3952 CPUState *cs = ENV_GET_CPU(env); 3953 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3954 3955 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3956 ARMMMUIdxBit_S1E2); 3957 } 3958 3959 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3960 uint64_t value) 3961 { 3962 CPUState *cs = ENV_GET_CPU(env); 3963 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3964 3965 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3966 ARMMMUIdxBit_S1E3); 3967 } 3968 3969 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3970 uint64_t value) 3971 { 3972 /* Invalidate by IPA. This has to invalidate any structures that 3973 * contain only stage 2 translation information, but does not need 3974 * to apply to structures that contain combined stage 1 and stage 2 3975 * translation information. 3976 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 3977 */ 3978 ARMCPU *cpu = arm_env_get_cpu(env); 3979 CPUState *cs = CPU(cpu); 3980 uint64_t pageaddr; 3981 3982 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 3983 return; 3984 } 3985 3986 pageaddr = sextract64(value << 12, 0, 48); 3987 3988 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 3989 } 3990 3991 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3992 uint64_t value) 3993 { 3994 CPUState *cs = ENV_GET_CPU(env); 3995 uint64_t pageaddr; 3996 3997 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 3998 return; 3999 } 4000 4001 pageaddr = sextract64(value << 12, 0, 48); 4002 4003 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4004 ARMMMUIdxBit_S2NS); 4005 } 4006 4007 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 4008 bool isread) 4009 { 4010 /* We don't implement EL2, so the only control on DC ZVA is the 4011 * bit in the SCTLR which can prohibit access for EL0. 4012 */ 4013 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 4014 return CP_ACCESS_TRAP; 4015 } 4016 return CP_ACCESS_OK; 4017 } 4018 4019 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 4020 { 4021 ARMCPU *cpu = arm_env_get_cpu(env); 4022 int dzp_bit = 1 << 4; 4023 4024 /* DZP indicates whether DC ZVA access is allowed */ 4025 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 4026 dzp_bit = 0; 4027 } 4028 return cpu->dcz_blocksize | dzp_bit; 4029 } 4030 4031 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 4032 bool isread) 4033 { 4034 if (!(env->pstate & PSTATE_SP)) { 4035 /* Access to SP_EL0 is undefined if it's being used as 4036 * the stack pointer. 4037 */ 4038 return CP_ACCESS_TRAP_UNCATEGORIZED; 4039 } 4040 return CP_ACCESS_OK; 4041 } 4042 4043 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 4044 { 4045 return env->pstate & PSTATE_SP; 4046 } 4047 4048 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 4049 { 4050 update_spsel(env, val); 4051 } 4052 4053 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4054 uint64_t value) 4055 { 4056 ARMCPU *cpu = arm_env_get_cpu(env); 4057 4058 if (raw_read(env, ri) == value) { 4059 /* Skip the TLB flush if nothing actually changed; Linux likes 4060 * to do a lot of pointless SCTLR writes. 4061 */ 4062 return; 4063 } 4064 4065 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 4066 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 4067 value &= ~SCTLR_M; 4068 } 4069 4070 raw_write(env, ri, value); 4071 /* ??? Lots of these bits are not implemented. */ 4072 /* This may enable/disable the MMU, so do a TLB flush. */ 4073 tlb_flush(CPU(cpu)); 4074 } 4075 4076 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri, 4077 bool isread) 4078 { 4079 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) { 4080 return CP_ACCESS_TRAP_FP_EL2; 4081 } 4082 if (env->cp15.cptr_el[3] & CPTR_TFP) { 4083 return CP_ACCESS_TRAP_FP_EL3; 4084 } 4085 return CP_ACCESS_OK; 4086 } 4087 4088 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4089 uint64_t value) 4090 { 4091 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK; 4092 } 4093 4094 static const ARMCPRegInfo v8_cp_reginfo[] = { 4095 /* Minimal set of EL0-visible registers. This will need to be expanded 4096 * significantly for system emulation of AArch64 CPUs. 4097 */ 4098 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 4099 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 4100 .access = PL0_RW, .type = ARM_CP_NZCV }, 4101 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 4102 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 4103 .type = ARM_CP_NO_RAW, 4104 .access = PL0_RW, .accessfn = aa64_daif_access, 4105 .fieldoffset = offsetof(CPUARMState, daif), 4106 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 4107 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 4108 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 4109 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4110 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 4111 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 4112 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 4113 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4114 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 4115 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 4116 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 4117 .access = PL0_R, .type = ARM_CP_NO_RAW, 4118 .readfn = aa64_dczid_read }, 4119 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 4120 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 4121 .access = PL0_W, .type = ARM_CP_DC_ZVA, 4122 #ifndef CONFIG_USER_ONLY 4123 /* Avoid overhead of an access check that always passes in user-mode */ 4124 .accessfn = aa64_zva_access, 4125 #endif 4126 }, 4127 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 4128 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 4129 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 4130 /* Cache ops: all NOPs since we don't emulate caches */ 4131 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 4132 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4133 .access = PL1_W, .type = ARM_CP_NOP }, 4134 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 4135 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4136 .access = PL1_W, .type = ARM_CP_NOP }, 4137 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 4138 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 4139 .access = PL0_W, .type = ARM_CP_NOP, 4140 .accessfn = aa64_cacheop_access }, 4141 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 4142 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4143 .access = PL1_W, .type = ARM_CP_NOP }, 4144 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 4145 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4146 .access = PL1_W, .type = ARM_CP_NOP }, 4147 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 4148 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 4149 .access = PL0_W, .type = ARM_CP_NOP, 4150 .accessfn = aa64_cacheop_access }, 4151 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 4152 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4153 .access = PL1_W, .type = ARM_CP_NOP }, 4154 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 4155 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 4156 .access = PL0_W, .type = ARM_CP_NOP, 4157 .accessfn = aa64_cacheop_access }, 4158 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 4159 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 4160 .access = PL0_W, .type = ARM_CP_NOP, 4161 .accessfn = aa64_cacheop_access }, 4162 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 4163 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4164 .access = PL1_W, .type = ARM_CP_NOP }, 4165 /* TLBI operations */ 4166 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 4167 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 4168 .access = PL1_W, .type = ARM_CP_NO_RAW, 4169 .writefn = tlbi_aa64_vmalle1is_write }, 4170 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 4171 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 4172 .access = PL1_W, .type = ARM_CP_NO_RAW, 4173 .writefn = tlbi_aa64_vae1is_write }, 4174 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 4175 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 4176 .access = PL1_W, .type = ARM_CP_NO_RAW, 4177 .writefn = tlbi_aa64_vmalle1is_write }, 4178 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 4179 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 4180 .access = PL1_W, .type = ARM_CP_NO_RAW, 4181 .writefn = tlbi_aa64_vae1is_write }, 4182 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 4183 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4184 .access = PL1_W, .type = ARM_CP_NO_RAW, 4185 .writefn = tlbi_aa64_vae1is_write }, 4186 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 4187 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4188 .access = PL1_W, .type = ARM_CP_NO_RAW, 4189 .writefn = tlbi_aa64_vae1is_write }, 4190 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 4191 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 4192 .access = PL1_W, .type = ARM_CP_NO_RAW, 4193 .writefn = tlbi_aa64_vmalle1_write }, 4194 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 4195 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 4196 .access = PL1_W, .type = ARM_CP_NO_RAW, 4197 .writefn = tlbi_aa64_vae1_write }, 4198 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 4199 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 4200 .access = PL1_W, .type = ARM_CP_NO_RAW, 4201 .writefn = tlbi_aa64_vmalle1_write }, 4202 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 4203 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 4204 .access = PL1_W, .type = ARM_CP_NO_RAW, 4205 .writefn = tlbi_aa64_vae1_write }, 4206 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 4207 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4208 .access = PL1_W, .type = ARM_CP_NO_RAW, 4209 .writefn = tlbi_aa64_vae1_write }, 4210 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 4211 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4212 .access = PL1_W, .type = ARM_CP_NO_RAW, 4213 .writefn = tlbi_aa64_vae1_write }, 4214 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 4215 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4216 .access = PL2_W, .type = ARM_CP_NO_RAW, 4217 .writefn = tlbi_aa64_ipas2e1is_write }, 4218 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 4219 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4220 .access = PL2_W, .type = ARM_CP_NO_RAW, 4221 .writefn = tlbi_aa64_ipas2e1is_write }, 4222 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 4223 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4224 .access = PL2_W, .type = ARM_CP_NO_RAW, 4225 .writefn = tlbi_aa64_alle1is_write }, 4226 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 4227 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 4228 .access = PL2_W, .type = ARM_CP_NO_RAW, 4229 .writefn = tlbi_aa64_alle1is_write }, 4230 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 4231 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4232 .access = PL2_W, .type = ARM_CP_NO_RAW, 4233 .writefn = tlbi_aa64_ipas2e1_write }, 4234 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 4235 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4236 .access = PL2_W, .type = ARM_CP_NO_RAW, 4237 .writefn = tlbi_aa64_ipas2e1_write }, 4238 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 4239 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4240 .access = PL2_W, .type = ARM_CP_NO_RAW, 4241 .writefn = tlbi_aa64_alle1_write }, 4242 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 4243 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 4244 .access = PL2_W, .type = ARM_CP_NO_RAW, 4245 .writefn = tlbi_aa64_alle1is_write }, 4246 #ifndef CONFIG_USER_ONLY 4247 /* 64 bit address translation operations */ 4248 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 4249 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 4250 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4251 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 4252 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 4253 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4254 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 4255 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 4256 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4257 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 4258 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 4259 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4260 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 4261 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 4262 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4263 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 4264 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 4265 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4266 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 4267 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 4268 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4269 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 4270 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 4271 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4272 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 4273 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 4274 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 4275 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4276 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 4277 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 4278 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4279 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 4280 .type = ARM_CP_ALIAS, 4281 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 4282 .access = PL1_RW, .resetvalue = 0, 4283 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 4284 .writefn = par_write }, 4285 #endif 4286 /* TLB invalidate last level of translation table walk */ 4287 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4288 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 4289 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4290 .type = ARM_CP_NO_RAW, .access = PL1_W, 4291 .writefn = tlbimvaa_is_write }, 4292 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4293 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 4294 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4295 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 4296 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4297 .type = ARM_CP_NO_RAW, .access = PL2_W, 4298 .writefn = tlbimva_hyp_write }, 4299 { .name = "TLBIMVALHIS", 4300 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4301 .type = ARM_CP_NO_RAW, .access = PL2_W, 4302 .writefn = tlbimva_hyp_is_write }, 4303 { .name = "TLBIIPAS2", 4304 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4305 .type = ARM_CP_NO_RAW, .access = PL2_W, 4306 .writefn = tlbiipas2_write }, 4307 { .name = "TLBIIPAS2IS", 4308 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4309 .type = ARM_CP_NO_RAW, .access = PL2_W, 4310 .writefn = tlbiipas2_is_write }, 4311 { .name = "TLBIIPAS2L", 4312 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4313 .type = ARM_CP_NO_RAW, .access = PL2_W, 4314 .writefn = tlbiipas2_write }, 4315 { .name = "TLBIIPAS2LIS", 4316 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4317 .type = ARM_CP_NO_RAW, .access = PL2_W, 4318 .writefn = tlbiipas2_is_write }, 4319 /* 32 bit cache operations */ 4320 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4321 .type = ARM_CP_NOP, .access = PL1_W }, 4322 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 4323 .type = ARM_CP_NOP, .access = PL1_W }, 4324 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4325 .type = ARM_CP_NOP, .access = PL1_W }, 4326 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 4327 .type = ARM_CP_NOP, .access = PL1_W }, 4328 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 4329 .type = ARM_CP_NOP, .access = PL1_W }, 4330 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 4331 .type = ARM_CP_NOP, .access = PL1_W }, 4332 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4333 .type = ARM_CP_NOP, .access = PL1_W }, 4334 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4335 .type = ARM_CP_NOP, .access = PL1_W }, 4336 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 4337 .type = ARM_CP_NOP, .access = PL1_W }, 4338 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4339 .type = ARM_CP_NOP, .access = PL1_W }, 4340 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 4341 .type = ARM_CP_NOP, .access = PL1_W }, 4342 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 4343 .type = ARM_CP_NOP, .access = PL1_W }, 4344 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4345 .type = ARM_CP_NOP, .access = PL1_W }, 4346 /* MMU Domain access control / MPU write buffer control */ 4347 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 4348 .access = PL1_RW, .resetvalue = 0, 4349 .writefn = dacr_write, .raw_writefn = raw_write, 4350 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 4351 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 4352 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 4353 .type = ARM_CP_ALIAS, 4354 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 4355 .access = PL1_RW, 4356 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 4357 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 4358 .type = ARM_CP_ALIAS, 4359 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 4360 .access = PL1_RW, 4361 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 4362 /* We rely on the access checks not allowing the guest to write to the 4363 * state field when SPSel indicates that it's being used as the stack 4364 * pointer. 4365 */ 4366 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 4367 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 4368 .access = PL1_RW, .accessfn = sp_el0_access, 4369 .type = ARM_CP_ALIAS, 4370 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 4371 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 4372 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 4373 .access = PL2_RW, .type = ARM_CP_ALIAS, 4374 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 4375 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 4376 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 4377 .type = ARM_CP_NO_RAW, 4378 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 4379 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 4380 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 4381 .type = ARM_CP_ALIAS, 4382 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]), 4383 .access = PL2_RW, .accessfn = fpexc32_access }, 4384 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 4385 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 4386 .access = PL2_RW, .resetvalue = 0, 4387 .writefn = dacr_write, .raw_writefn = raw_write, 4388 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 4389 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 4390 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 4391 .access = PL2_RW, .resetvalue = 0, 4392 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 4393 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 4394 .type = ARM_CP_ALIAS, 4395 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 4396 .access = PL2_RW, 4397 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 4398 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 4399 .type = ARM_CP_ALIAS, 4400 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 4401 .access = PL2_RW, 4402 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 4403 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 4404 .type = ARM_CP_ALIAS, 4405 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 4406 .access = PL2_RW, 4407 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 4408 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 4409 .type = ARM_CP_ALIAS, 4410 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 4411 .access = PL2_RW, 4412 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 4413 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 4414 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 4415 .resetvalue = 0, 4416 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 4417 { .name = "SDCR", .type = ARM_CP_ALIAS, 4418 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 4419 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4420 .writefn = sdcr_write, 4421 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 4422 REGINFO_SENTINEL 4423 }; 4424 4425 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */ 4426 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = { 4427 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4428 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4429 .access = PL2_RW, 4430 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore }, 4431 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH, 4432 .type = ARM_CP_NO_RAW, 4433 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4434 .access = PL2_RW, 4435 .type = ARM_CP_CONST, .resetvalue = 0 }, 4436 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 4437 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 4438 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4439 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4440 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4441 .access = PL2_RW, 4442 .type = ARM_CP_CONST, .resetvalue = 0 }, 4443 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4444 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4445 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4446 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4447 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4448 .access = PL2_RW, .type = ARM_CP_CONST, 4449 .resetvalue = 0 }, 4450 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4451 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4452 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4453 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4454 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4455 .access = PL2_RW, .type = ARM_CP_CONST, 4456 .resetvalue = 0 }, 4457 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4458 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4459 .access = PL2_RW, .type = ARM_CP_CONST, 4460 .resetvalue = 0 }, 4461 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4462 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4463 .access = PL2_RW, .type = ARM_CP_CONST, 4464 .resetvalue = 0 }, 4465 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4466 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4467 .access = PL2_RW, .type = ARM_CP_CONST, 4468 .resetvalue = 0 }, 4469 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4470 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4471 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4472 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH, 4473 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4474 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4475 .type = ARM_CP_CONST, .resetvalue = 0 }, 4476 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4477 .cp = 15, .opc1 = 6, .crm = 2, 4478 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4479 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 }, 4480 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4481 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4482 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4483 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4484 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4485 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4486 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4487 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4488 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4489 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4490 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4491 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4492 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4493 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4494 .resetvalue = 0 }, 4495 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4496 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4497 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4498 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4499 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4500 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4501 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4502 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4503 .resetvalue = 0 }, 4504 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4505 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4506 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4507 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4508 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4509 .resetvalue = 0 }, 4510 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4511 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4512 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4513 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4514 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4515 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4516 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4517 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4518 .access = PL2_RW, .accessfn = access_tda, 4519 .type = ARM_CP_CONST, .resetvalue = 0 }, 4520 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH, 4521 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4522 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4523 .type = ARM_CP_CONST, .resetvalue = 0 }, 4524 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4525 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4526 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4527 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4528 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4529 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4530 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4531 .type = ARM_CP_CONST, 4532 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4533 .access = PL2_RW, .resetvalue = 0 }, 4534 REGINFO_SENTINEL 4535 }; 4536 4537 /* Ditto, but for registers which exist in ARMv8 but not v7 */ 4538 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = { 4539 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4540 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4541 .access = PL2_RW, 4542 .type = ARM_CP_CONST, .resetvalue = 0 }, 4543 REGINFO_SENTINEL 4544 }; 4545 4546 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 4547 { 4548 ARMCPU *cpu = arm_env_get_cpu(env); 4549 uint64_t valid_mask = HCR_MASK; 4550 4551 if (arm_feature(env, ARM_FEATURE_EL3)) { 4552 valid_mask &= ~HCR_HCD; 4553 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 4554 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented. 4555 * However, if we're using the SMC PSCI conduit then QEMU is 4556 * effectively acting like EL3 firmware and so the guest at 4557 * EL2 should retain the ability to prevent EL1 from being 4558 * able to make SMC calls into the ersatz firmware, so in 4559 * that case HCR.TSC should be read/write. 4560 */ 4561 valid_mask &= ~HCR_TSC; 4562 } 4563 if (cpu_isar_feature(aa64_lor, cpu)) { 4564 valid_mask |= HCR_TLOR; 4565 } 4566 if (cpu_isar_feature(aa64_pauth, cpu)) { 4567 valid_mask |= HCR_API | HCR_APK; 4568 } 4569 4570 /* Clear RES0 bits. */ 4571 value &= valid_mask; 4572 4573 /* These bits change the MMU setup: 4574 * HCR_VM enables stage 2 translation 4575 * HCR_PTW forbids certain page-table setups 4576 * HCR_DC Disables stage1 and enables stage2 translation 4577 */ 4578 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) { 4579 tlb_flush(CPU(cpu)); 4580 } 4581 env->cp15.hcr_el2 = value; 4582 4583 /* 4584 * Updates to VI and VF require us to update the status of 4585 * virtual interrupts, which are the logical OR of these bits 4586 * and the state of the input lines from the GIC. (This requires 4587 * that we have the iothread lock, which is done by marking the 4588 * reginfo structs as ARM_CP_IO.) 4589 * Note that if a write to HCR pends a VIRQ or VFIQ it is never 4590 * possible for it to be taken immediately, because VIRQ and 4591 * VFIQ are masked unless running at EL0 or EL1, and HCR 4592 * can only be written at EL2. 4593 */ 4594 g_assert(qemu_mutex_iothread_locked()); 4595 arm_cpu_update_virq(cpu); 4596 arm_cpu_update_vfiq(cpu); 4597 } 4598 4599 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 4600 uint64_t value) 4601 { 4602 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 4603 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 4604 hcr_write(env, NULL, value); 4605 } 4606 4607 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 4608 uint64_t value) 4609 { 4610 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 4611 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 4612 hcr_write(env, NULL, value); 4613 } 4614 4615 /* 4616 * Return the effective value of HCR_EL2. 4617 * Bits that are not included here: 4618 * RW (read from SCR_EL3.RW as needed) 4619 */ 4620 uint64_t arm_hcr_el2_eff(CPUARMState *env) 4621 { 4622 uint64_t ret = env->cp15.hcr_el2; 4623 4624 if (arm_is_secure_below_el3(env)) { 4625 /* 4626 * "This register has no effect if EL2 is not enabled in the 4627 * current Security state". This is ARMv8.4-SecEL2 speak for 4628 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 4629 * 4630 * Prior to that, the language was "In an implementation that 4631 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 4632 * as if this field is 0 for all purposes other than a direct 4633 * read or write access of HCR_EL2". With lots of enumeration 4634 * on a per-field basis. In current QEMU, this is condition 4635 * is arm_is_secure_below_el3. 4636 * 4637 * Since the v8.4 language applies to the entire register, and 4638 * appears to be backward compatible, use that. 4639 */ 4640 ret = 0; 4641 } else if (ret & HCR_TGE) { 4642 /* These bits are up-to-date as of ARMv8.4. */ 4643 if (ret & HCR_E2H) { 4644 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 4645 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 4646 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 4647 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE); 4648 } else { 4649 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 4650 } 4651 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 4652 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 4653 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 4654 HCR_TLOR); 4655 } 4656 4657 return ret; 4658 } 4659 4660 static const ARMCPRegInfo el2_cp_reginfo[] = { 4661 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 4662 .type = ARM_CP_IO, 4663 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4664 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4665 .writefn = hcr_write }, 4666 { .name = "HCR", .state = ARM_CP_STATE_AA32, 4667 .type = ARM_CP_ALIAS | ARM_CP_IO, 4668 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4669 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4670 .writefn = hcr_writelow }, 4671 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 4672 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 4673 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4674 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 4675 .type = ARM_CP_ALIAS, 4676 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 4677 .access = PL2_RW, 4678 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 4679 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4680 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4681 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 4682 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4683 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4684 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 4685 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4686 .type = ARM_CP_ALIAS, 4687 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4688 .access = PL2_RW, 4689 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 4690 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 4691 .type = ARM_CP_ALIAS, 4692 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 4693 .access = PL2_RW, 4694 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 4695 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4696 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4697 .access = PL2_RW, .writefn = vbar_write, 4698 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 4699 .resetvalue = 0 }, 4700 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 4701 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 4702 .access = PL3_RW, .type = ARM_CP_ALIAS, 4703 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 4704 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4705 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4706 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 4707 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]) }, 4708 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4709 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4710 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 4711 .resetvalue = 0 }, 4712 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4713 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4714 .access = PL2_RW, .type = ARM_CP_ALIAS, 4715 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 4716 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4717 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4718 .access = PL2_RW, .type = ARM_CP_CONST, 4719 .resetvalue = 0 }, 4720 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 4721 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4722 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4723 .access = PL2_RW, .type = ARM_CP_CONST, 4724 .resetvalue = 0 }, 4725 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4726 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4727 .access = PL2_RW, .type = ARM_CP_CONST, 4728 .resetvalue = 0 }, 4729 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4730 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4731 .access = PL2_RW, .type = ARM_CP_CONST, 4732 .resetvalue = 0 }, 4733 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4734 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4735 .access = PL2_RW, 4736 /* no .writefn needed as this can't cause an ASID change; 4737 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4738 */ 4739 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 4740 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 4741 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4742 .type = ARM_CP_ALIAS, 4743 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4744 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4745 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 4746 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4747 .access = PL2_RW, 4748 /* no .writefn needed as this can't cause an ASID change; 4749 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4750 */ 4751 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4752 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4753 .cp = 15, .opc1 = 6, .crm = 2, 4754 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4755 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4756 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 4757 .writefn = vttbr_write }, 4758 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4759 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4760 .access = PL2_RW, .writefn = vttbr_write, 4761 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 4762 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4763 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4764 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 4765 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 4766 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4767 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4768 .access = PL2_RW, .resetvalue = 0, 4769 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 4770 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4771 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4772 .access = PL2_RW, .resetvalue = 0, 4773 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4774 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4775 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4776 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4777 { .name = "TLBIALLNSNH", 4778 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4779 .type = ARM_CP_NO_RAW, .access = PL2_W, 4780 .writefn = tlbiall_nsnh_write }, 4781 { .name = "TLBIALLNSNHIS", 4782 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4783 .type = ARM_CP_NO_RAW, .access = PL2_W, 4784 .writefn = tlbiall_nsnh_is_write }, 4785 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4786 .type = ARM_CP_NO_RAW, .access = PL2_W, 4787 .writefn = tlbiall_hyp_write }, 4788 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4789 .type = ARM_CP_NO_RAW, .access = PL2_W, 4790 .writefn = tlbiall_hyp_is_write }, 4791 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4792 .type = ARM_CP_NO_RAW, .access = PL2_W, 4793 .writefn = tlbimva_hyp_write }, 4794 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4795 .type = ARM_CP_NO_RAW, .access = PL2_W, 4796 .writefn = tlbimva_hyp_is_write }, 4797 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 4798 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4799 .type = ARM_CP_NO_RAW, .access = PL2_W, 4800 .writefn = tlbi_aa64_alle2_write }, 4801 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 4802 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4803 .type = ARM_CP_NO_RAW, .access = PL2_W, 4804 .writefn = tlbi_aa64_vae2_write }, 4805 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 4806 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4807 .access = PL2_W, .type = ARM_CP_NO_RAW, 4808 .writefn = tlbi_aa64_vae2_write }, 4809 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 4810 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4811 .access = PL2_W, .type = ARM_CP_NO_RAW, 4812 .writefn = tlbi_aa64_alle2is_write }, 4813 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 4814 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4815 .type = ARM_CP_NO_RAW, .access = PL2_W, 4816 .writefn = tlbi_aa64_vae2is_write }, 4817 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 4818 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4819 .access = PL2_W, .type = ARM_CP_NO_RAW, 4820 .writefn = tlbi_aa64_vae2is_write }, 4821 #ifndef CONFIG_USER_ONLY 4822 /* Unlike the other EL2-related AT operations, these must 4823 * UNDEF from EL3 if EL2 is not implemented, which is why we 4824 * define them here rather than with the rest of the AT ops. 4825 */ 4826 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 4827 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4828 .access = PL2_W, .accessfn = at_s1e2_access, 4829 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4830 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 4831 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4832 .access = PL2_W, .accessfn = at_s1e2_access, 4833 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4834 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 4835 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 4836 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 4837 * to behave as if SCR.NS was 1. 4838 */ 4839 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4840 .access = PL2_W, 4841 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4842 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4843 .access = PL2_W, 4844 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4845 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4846 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4847 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 4848 * reset values as IMPDEF. We choose to reset to 3 to comply with 4849 * both ARMv7 and ARMv8. 4850 */ 4851 .access = PL2_RW, .resetvalue = 3, 4852 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 4853 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4854 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4855 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 4856 .writefn = gt_cntvoff_write, 4857 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4858 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4859 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 4860 .writefn = gt_cntvoff_write, 4861 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4862 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4863 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4864 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4865 .type = ARM_CP_IO, .access = PL2_RW, 4866 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4867 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4868 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4869 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 4870 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4871 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4872 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4873 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 4874 .resetfn = gt_hyp_timer_reset, 4875 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 4876 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4877 .type = ARM_CP_IO, 4878 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4879 .access = PL2_RW, 4880 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 4881 .resetvalue = 0, 4882 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 4883 #endif 4884 /* The only field of MDCR_EL2 that has a defined architectural reset value 4885 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we 4886 * don't implement any PMU event counters, so using zero as a reset 4887 * value for MDCR_EL2 is okay 4888 */ 4889 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4890 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4891 .access = PL2_RW, .resetvalue = 0, 4892 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), }, 4893 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 4894 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4895 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4896 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4897 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 4898 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4899 .access = PL2_RW, 4900 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4901 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4902 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4903 .access = PL2_RW, 4904 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 4905 REGINFO_SENTINEL 4906 }; 4907 4908 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 4909 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4910 .type = ARM_CP_ALIAS | ARM_CP_IO, 4911 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4912 .access = PL2_RW, 4913 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 4914 .writefn = hcr_writehigh }, 4915 REGINFO_SENTINEL 4916 }; 4917 4918 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 4919 bool isread) 4920 { 4921 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 4922 * At Secure EL1 it traps to EL3. 4923 */ 4924 if (arm_current_el(env) == 3) { 4925 return CP_ACCESS_OK; 4926 } 4927 if (arm_is_secure_below_el3(env)) { 4928 return CP_ACCESS_TRAP_EL3; 4929 } 4930 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 4931 if (isread) { 4932 return CP_ACCESS_OK; 4933 } 4934 return CP_ACCESS_TRAP_UNCATEGORIZED; 4935 } 4936 4937 static const ARMCPRegInfo el3_cp_reginfo[] = { 4938 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 4939 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 4940 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 4941 .resetvalue = 0, .writefn = scr_write }, 4942 { .name = "SCR", .type = ARM_CP_ALIAS, 4943 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 4944 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4945 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 4946 .writefn = scr_write }, 4947 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 4948 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 4949 .access = PL3_RW, .resetvalue = 0, 4950 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 4951 { .name = "SDER", 4952 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 4953 .access = PL3_RW, .resetvalue = 0, 4954 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 4955 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 4956 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4957 .writefn = vbar_write, .resetvalue = 0, 4958 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 4959 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 4960 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 4961 .access = PL3_RW, .resetvalue = 0, 4962 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 4963 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 4964 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 4965 .access = PL3_RW, 4966 /* no .writefn needed as this can't cause an ASID change; 4967 * we must provide a .raw_writefn and .resetfn because we handle 4968 * reset and migration for the AArch32 TTBCR(S), which might be 4969 * using mask and base_mask. 4970 */ 4971 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write, 4972 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 4973 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 4974 .type = ARM_CP_ALIAS, 4975 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 4976 .access = PL3_RW, 4977 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 4978 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 4979 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 4980 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 4981 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 4982 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 4983 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 4984 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 4985 .type = ARM_CP_ALIAS, 4986 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 4987 .access = PL3_RW, 4988 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 4989 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 4990 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 4991 .access = PL3_RW, .writefn = vbar_write, 4992 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 4993 .resetvalue = 0 }, 4994 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 4995 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 4996 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 4997 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 4998 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 4999 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 5000 .access = PL3_RW, .resetvalue = 0, 5001 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 5002 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 5003 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 5004 .access = PL3_RW, .type = ARM_CP_CONST, 5005 .resetvalue = 0 }, 5006 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 5007 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 5008 .access = PL3_RW, .type = ARM_CP_CONST, 5009 .resetvalue = 0 }, 5010 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 5011 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 5012 .access = PL3_RW, .type = ARM_CP_CONST, 5013 .resetvalue = 0 }, 5014 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 5015 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 5016 .access = PL3_W, .type = ARM_CP_NO_RAW, 5017 .writefn = tlbi_aa64_alle3is_write }, 5018 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 5019 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 5020 .access = PL3_W, .type = ARM_CP_NO_RAW, 5021 .writefn = tlbi_aa64_vae3is_write }, 5022 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 5023 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 5024 .access = PL3_W, .type = ARM_CP_NO_RAW, 5025 .writefn = tlbi_aa64_vae3is_write }, 5026 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 5027 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 5028 .access = PL3_W, .type = ARM_CP_NO_RAW, 5029 .writefn = tlbi_aa64_alle3_write }, 5030 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 5031 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 5032 .access = PL3_W, .type = ARM_CP_NO_RAW, 5033 .writefn = tlbi_aa64_vae3_write }, 5034 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 5035 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 5036 .access = PL3_W, .type = ARM_CP_NO_RAW, 5037 .writefn = tlbi_aa64_vae3_write }, 5038 REGINFO_SENTINEL 5039 }; 5040 5041 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 5042 bool isread) 5043 { 5044 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64, 5045 * but the AArch32 CTR has its own reginfo struct) 5046 */ 5047 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 5048 return CP_ACCESS_TRAP; 5049 } 5050 return CP_ACCESS_OK; 5051 } 5052 5053 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, 5054 uint64_t value) 5055 { 5056 /* Writes to OSLAR_EL1 may update the OS lock status, which can be 5057 * read via a bit in OSLSR_EL1. 5058 */ 5059 int oslock; 5060 5061 if (ri->state == ARM_CP_STATE_AA32) { 5062 oslock = (value == 0xC5ACCE55); 5063 } else { 5064 oslock = value & 1; 5065 } 5066 5067 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock); 5068 } 5069 5070 static const ARMCPRegInfo debug_cp_reginfo[] = { 5071 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped 5072 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; 5073 * unlike DBGDRAR it is never accessible from EL0. 5074 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64 5075 * accessor. 5076 */ 5077 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, 5078 .access = PL0_R, .accessfn = access_tdra, 5079 .type = ARM_CP_CONST, .resetvalue = 0 }, 5080 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, 5081 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 5082 .access = PL1_R, .accessfn = access_tdra, 5083 .type = ARM_CP_CONST, .resetvalue = 0 }, 5084 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 5085 .access = PL0_R, .accessfn = access_tdra, 5086 .type = ARM_CP_CONST, .resetvalue = 0 }, 5087 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ 5088 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, 5089 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5090 .access = PL1_RW, .accessfn = access_tda, 5091 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), 5092 .resetvalue = 0 }, 5093 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1. 5094 * We don't implement the configurable EL0 access. 5095 */ 5096 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH, 5097 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5098 .type = ARM_CP_ALIAS, 5099 .access = PL1_R, .accessfn = access_tda, 5100 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, 5101 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, 5102 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, 5103 .access = PL1_W, .type = ARM_CP_NO_RAW, 5104 .accessfn = access_tdosa, 5105 .writefn = oslar_write }, 5106 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, 5107 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, 5108 .access = PL1_R, .resetvalue = 10, 5109 .accessfn = access_tdosa, 5110 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, 5111 /* Dummy OSDLR_EL1: 32-bit Linux will read this */ 5112 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, 5113 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, 5114 .access = PL1_RW, .accessfn = access_tdosa, 5115 .type = ARM_CP_NOP }, 5116 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't 5117 * implement vector catch debug events yet. 5118 */ 5119 { .name = "DBGVCR", 5120 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 5121 .access = PL1_RW, .accessfn = access_tda, 5122 .type = ARM_CP_NOP }, 5123 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor 5124 * to save and restore a 32-bit guest's DBGVCR) 5125 */ 5126 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64, 5127 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0, 5128 .access = PL2_RW, .accessfn = access_tda, 5129 .type = ARM_CP_NOP }, 5130 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications 5131 * Channel but Linux may try to access this register. The 32-bit 5132 * alias is DBGDCCINT. 5133 */ 5134 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH, 5135 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5136 .access = PL1_RW, .accessfn = access_tda, 5137 .type = ARM_CP_NOP }, 5138 REGINFO_SENTINEL 5139 }; 5140 5141 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = { 5142 /* 64 bit access versions of the (dummy) debug registers */ 5143 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0, 5144 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5145 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0, 5146 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5147 REGINFO_SENTINEL 5148 }; 5149 5150 /* Return the exception level to which exceptions should be taken 5151 * via SVEAccessTrap. If an exception should be routed through 5152 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should 5153 * take care of raising that exception. 5154 * C.f. the ARM pseudocode function CheckSVEEnabled. 5155 */ 5156 int sve_exception_el(CPUARMState *env, int el) 5157 { 5158 #ifndef CONFIG_USER_ONLY 5159 if (el <= 1) { 5160 bool disabled = false; 5161 5162 /* The CPACR.ZEN controls traps to EL1: 5163 * 0, 2 : trap EL0 and EL1 accesses 5164 * 1 : trap only EL0 accesses 5165 * 3 : trap no accesses 5166 */ 5167 if (!extract32(env->cp15.cpacr_el1, 16, 1)) { 5168 disabled = true; 5169 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) { 5170 disabled = el == 0; 5171 } 5172 if (disabled) { 5173 /* route_to_el2 */ 5174 return (arm_feature(env, ARM_FEATURE_EL2) 5175 && (arm_hcr_el2_eff(env) & HCR_TGE) ? 2 : 1); 5176 } 5177 5178 /* Check CPACR.FPEN. */ 5179 if (!extract32(env->cp15.cpacr_el1, 20, 1)) { 5180 disabled = true; 5181 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) { 5182 disabled = el == 0; 5183 } 5184 if (disabled) { 5185 return 0; 5186 } 5187 } 5188 5189 /* CPTR_EL2. Since TZ and TFP are positive, 5190 * they will be zero when EL2 is not present. 5191 */ 5192 if (el <= 2 && !arm_is_secure_below_el3(env)) { 5193 if (env->cp15.cptr_el[2] & CPTR_TZ) { 5194 return 2; 5195 } 5196 if (env->cp15.cptr_el[2] & CPTR_TFP) { 5197 return 0; 5198 } 5199 } 5200 5201 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 5202 if (arm_feature(env, ARM_FEATURE_EL3) 5203 && !(env->cp15.cptr_el[3] & CPTR_EZ)) { 5204 return 3; 5205 } 5206 #endif 5207 return 0; 5208 } 5209 5210 /* 5211 * Given that SVE is enabled, return the vector length for EL. 5212 */ 5213 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) 5214 { 5215 ARMCPU *cpu = arm_env_get_cpu(env); 5216 uint32_t zcr_len = cpu->sve_max_vq - 1; 5217 5218 if (el <= 1) { 5219 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]); 5220 } 5221 if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) { 5222 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]); 5223 } 5224 if (el < 3 && arm_feature(env, ARM_FEATURE_EL3)) { 5225 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); 5226 } 5227 return zcr_len; 5228 } 5229 5230 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5231 uint64_t value) 5232 { 5233 int cur_el = arm_current_el(env); 5234 int old_len = sve_zcr_len_for_el(env, cur_el); 5235 int new_len; 5236 5237 /* Bits other than [3:0] are RAZ/WI. */ 5238 raw_write(env, ri, value & 0xf); 5239 5240 /* 5241 * Because we arrived here, we know both FP and SVE are enabled; 5242 * otherwise we would have trapped access to the ZCR_ELn register. 5243 */ 5244 new_len = sve_zcr_len_for_el(env, cur_el); 5245 if (new_len < old_len) { 5246 aarch64_sve_narrow_vq(env, new_len + 1); 5247 } 5248 } 5249 5250 static const ARMCPRegInfo zcr_el1_reginfo = { 5251 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 5252 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 5253 .access = PL1_RW, .type = ARM_CP_SVE, 5254 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 5255 .writefn = zcr_write, .raw_writefn = raw_write 5256 }; 5257 5258 static const ARMCPRegInfo zcr_el2_reginfo = { 5259 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5260 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5261 .access = PL2_RW, .type = ARM_CP_SVE, 5262 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 5263 .writefn = zcr_write, .raw_writefn = raw_write 5264 }; 5265 5266 static const ARMCPRegInfo zcr_no_el2_reginfo = { 5267 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5268 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5269 .access = PL2_RW, .type = ARM_CP_SVE, 5270 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore 5271 }; 5272 5273 static const ARMCPRegInfo zcr_el3_reginfo = { 5274 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 5275 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 5276 .access = PL3_RW, .type = ARM_CP_SVE, 5277 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 5278 .writefn = zcr_write, .raw_writefn = raw_write 5279 }; 5280 5281 void hw_watchpoint_update(ARMCPU *cpu, int n) 5282 { 5283 CPUARMState *env = &cpu->env; 5284 vaddr len = 0; 5285 vaddr wvr = env->cp15.dbgwvr[n]; 5286 uint64_t wcr = env->cp15.dbgwcr[n]; 5287 int mask; 5288 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 5289 5290 if (env->cpu_watchpoint[n]) { 5291 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); 5292 env->cpu_watchpoint[n] = NULL; 5293 } 5294 5295 if (!extract64(wcr, 0, 1)) { 5296 /* E bit clear : watchpoint disabled */ 5297 return; 5298 } 5299 5300 switch (extract64(wcr, 3, 2)) { 5301 case 0: 5302 /* LSC 00 is reserved and must behave as if the wp is disabled */ 5303 return; 5304 case 1: 5305 flags |= BP_MEM_READ; 5306 break; 5307 case 2: 5308 flags |= BP_MEM_WRITE; 5309 break; 5310 case 3: 5311 flags |= BP_MEM_ACCESS; 5312 break; 5313 } 5314 5315 /* Attempts to use both MASK and BAS fields simultaneously are 5316 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, 5317 * thus generating a watchpoint for every byte in the masked region. 5318 */ 5319 mask = extract64(wcr, 24, 4); 5320 if (mask == 1 || mask == 2) { 5321 /* Reserved values of MASK; we must act as if the mask value was 5322 * some non-reserved value, or as if the watchpoint were disabled. 5323 * We choose the latter. 5324 */ 5325 return; 5326 } else if (mask) { 5327 /* Watchpoint covers an aligned area up to 2GB in size */ 5328 len = 1ULL << mask; 5329 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE 5330 * whether the watchpoint fires when the unmasked bits match; we opt 5331 * to generate the exceptions. 5332 */ 5333 wvr &= ~(len - 1); 5334 } else { 5335 /* Watchpoint covers bytes defined by the byte address select bits */ 5336 int bas = extract64(wcr, 5, 8); 5337 int basstart; 5338 5339 if (bas == 0) { 5340 /* This must act as if the watchpoint is disabled */ 5341 return; 5342 } 5343 5344 if (extract64(wvr, 2, 1)) { 5345 /* Deprecated case of an only 4-aligned address. BAS[7:4] are 5346 * ignored, and BAS[3:0] define which bytes to watch. 5347 */ 5348 bas &= 0xf; 5349 } 5350 /* The BAS bits are supposed to be programmed to indicate a contiguous 5351 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether 5352 * we fire for each byte in the word/doubleword addressed by the WVR. 5353 * We choose to ignore any non-zero bits after the first range of 1s. 5354 */ 5355 basstart = ctz32(bas); 5356 len = cto32(bas >> basstart); 5357 wvr += basstart; 5358 } 5359 5360 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, 5361 &env->cpu_watchpoint[n]); 5362 } 5363 5364 void hw_watchpoint_update_all(ARMCPU *cpu) 5365 { 5366 int i; 5367 CPUARMState *env = &cpu->env; 5368 5369 /* Completely clear out existing QEMU watchpoints and our array, to 5370 * avoid possible stale entries following migration load. 5371 */ 5372 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); 5373 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); 5374 5375 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { 5376 hw_watchpoint_update(cpu, i); 5377 } 5378 } 5379 5380 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5381 uint64_t value) 5382 { 5383 ARMCPU *cpu = arm_env_get_cpu(env); 5384 int i = ri->crm; 5385 5386 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the 5387 * register reads and behaves as if values written are sign extended. 5388 * Bits [1:0] are RES0. 5389 */ 5390 value = sextract64(value, 0, 49) & ~3ULL; 5391 5392 raw_write(env, ri, value); 5393 hw_watchpoint_update(cpu, i); 5394 } 5395 5396 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5397 uint64_t value) 5398 { 5399 ARMCPU *cpu = arm_env_get_cpu(env); 5400 int i = ri->crm; 5401 5402 raw_write(env, ri, value); 5403 hw_watchpoint_update(cpu, i); 5404 } 5405 5406 void hw_breakpoint_update(ARMCPU *cpu, int n) 5407 { 5408 CPUARMState *env = &cpu->env; 5409 uint64_t bvr = env->cp15.dbgbvr[n]; 5410 uint64_t bcr = env->cp15.dbgbcr[n]; 5411 vaddr addr; 5412 int bt; 5413 int flags = BP_CPU; 5414 5415 if (env->cpu_breakpoint[n]) { 5416 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); 5417 env->cpu_breakpoint[n] = NULL; 5418 } 5419 5420 if (!extract64(bcr, 0, 1)) { 5421 /* E bit clear : watchpoint disabled */ 5422 return; 5423 } 5424 5425 bt = extract64(bcr, 20, 4); 5426 5427 switch (bt) { 5428 case 4: /* unlinked address mismatch (reserved if AArch64) */ 5429 case 5: /* linked address mismatch (reserved if AArch64) */ 5430 qemu_log_mask(LOG_UNIMP, 5431 "arm: address mismatch breakpoint types not implemented\n"); 5432 return; 5433 case 0: /* unlinked address match */ 5434 case 1: /* linked address match */ 5435 { 5436 /* Bits [63:49] are hardwired to the value of bit [48]; that is, 5437 * we behave as if the register was sign extended. Bits [1:0] are 5438 * RES0. The BAS field is used to allow setting breakpoints on 16 5439 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether 5440 * a bp will fire if the addresses covered by the bp and the addresses 5441 * covered by the insn overlap but the insn doesn't start at the 5442 * start of the bp address range. We choose to require the insn and 5443 * the bp to have the same address. The constraints on writing to 5444 * BAS enforced in dbgbcr_write mean we have only four cases: 5445 * 0b0000 => no breakpoint 5446 * 0b0011 => breakpoint on addr 5447 * 0b1100 => breakpoint on addr + 2 5448 * 0b1111 => breakpoint on addr 5449 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). 5450 */ 5451 int bas = extract64(bcr, 5, 4); 5452 addr = sextract64(bvr, 0, 49) & ~3ULL; 5453 if (bas == 0) { 5454 return; 5455 } 5456 if (bas == 0xc) { 5457 addr += 2; 5458 } 5459 break; 5460 } 5461 case 2: /* unlinked context ID match */ 5462 case 8: /* unlinked VMID match (reserved if no EL2) */ 5463 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ 5464 qemu_log_mask(LOG_UNIMP, 5465 "arm: unlinked context breakpoint types not implemented\n"); 5466 return; 5467 case 9: /* linked VMID match (reserved if no EL2) */ 5468 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 5469 case 3: /* linked context ID match */ 5470 default: 5471 /* We must generate no events for Linked context matches (unless 5472 * they are linked to by some other bp/wp, which is handled in 5473 * updates for the linking bp/wp). We choose to also generate no events 5474 * for reserved values. 5475 */ 5476 return; 5477 } 5478 5479 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); 5480 } 5481 5482 void hw_breakpoint_update_all(ARMCPU *cpu) 5483 { 5484 int i; 5485 CPUARMState *env = &cpu->env; 5486 5487 /* Completely clear out existing QEMU breakpoints and our array, to 5488 * avoid possible stale entries following migration load. 5489 */ 5490 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); 5491 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); 5492 5493 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { 5494 hw_breakpoint_update(cpu, i); 5495 } 5496 } 5497 5498 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5499 uint64_t value) 5500 { 5501 ARMCPU *cpu = arm_env_get_cpu(env); 5502 int i = ri->crm; 5503 5504 raw_write(env, ri, value); 5505 hw_breakpoint_update(cpu, i); 5506 } 5507 5508 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5509 uint64_t value) 5510 { 5511 ARMCPU *cpu = arm_env_get_cpu(env); 5512 int i = ri->crm; 5513 5514 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only 5515 * copy of BAS[0]. 5516 */ 5517 value = deposit64(value, 6, 1, extract64(value, 5, 1)); 5518 value = deposit64(value, 8, 1, extract64(value, 7, 1)); 5519 5520 raw_write(env, ri, value); 5521 hw_breakpoint_update(cpu, i); 5522 } 5523 5524 static void define_debug_regs(ARMCPU *cpu) 5525 { 5526 /* Define v7 and v8 architectural debug registers. 5527 * These are just dummy implementations for now. 5528 */ 5529 int i; 5530 int wrps, brps, ctx_cmps; 5531 ARMCPRegInfo dbgdidr = { 5532 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 5533 .access = PL0_R, .accessfn = access_tda, 5534 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, 5535 }; 5536 5537 /* Note that all these register fields hold "number of Xs minus 1". */ 5538 brps = extract32(cpu->dbgdidr, 24, 4); 5539 wrps = extract32(cpu->dbgdidr, 28, 4); 5540 ctx_cmps = extract32(cpu->dbgdidr, 20, 4); 5541 5542 assert(ctx_cmps <= brps); 5543 5544 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties 5545 * of the debug registers such as number of breakpoints; 5546 * check that if they both exist then they agree. 5547 */ 5548 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 5549 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps); 5550 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps); 5551 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps); 5552 } 5553 5554 define_one_arm_cp_reg(cpu, &dbgdidr); 5555 define_arm_cp_regs(cpu, debug_cp_reginfo); 5556 5557 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { 5558 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); 5559 } 5560 5561 for (i = 0; i < brps + 1; i++) { 5562 ARMCPRegInfo dbgregs[] = { 5563 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH, 5564 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, 5565 .access = PL1_RW, .accessfn = access_tda, 5566 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), 5567 .writefn = dbgbvr_write, .raw_writefn = raw_write 5568 }, 5569 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH, 5570 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, 5571 .access = PL1_RW, .accessfn = access_tda, 5572 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), 5573 .writefn = dbgbcr_write, .raw_writefn = raw_write 5574 }, 5575 REGINFO_SENTINEL 5576 }; 5577 define_arm_cp_regs(cpu, dbgregs); 5578 } 5579 5580 for (i = 0; i < wrps + 1; i++) { 5581 ARMCPRegInfo dbgregs[] = { 5582 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH, 5583 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, 5584 .access = PL1_RW, .accessfn = access_tda, 5585 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), 5586 .writefn = dbgwvr_write, .raw_writefn = raw_write 5587 }, 5588 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH, 5589 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, 5590 .access = PL1_RW, .accessfn = access_tda, 5591 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), 5592 .writefn = dbgwcr_write, .raw_writefn = raw_write 5593 }, 5594 REGINFO_SENTINEL 5595 }; 5596 define_arm_cp_regs(cpu, dbgregs); 5597 } 5598 } 5599 5600 /* We don't know until after realize whether there's a GICv3 5601 * attached, and that is what registers the gicv3 sysregs. 5602 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 5603 * at runtime. 5604 */ 5605 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 5606 { 5607 ARMCPU *cpu = arm_env_get_cpu(env); 5608 uint64_t pfr1 = cpu->id_pfr1; 5609 5610 if (env->gicv3state) { 5611 pfr1 |= 1 << 28; 5612 } 5613 return pfr1; 5614 } 5615 5616 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 5617 { 5618 ARMCPU *cpu = arm_env_get_cpu(env); 5619 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 5620 5621 if (env->gicv3state) { 5622 pfr0 |= 1 << 24; 5623 } 5624 return pfr0; 5625 } 5626 5627 /* Shared logic between LORID and the rest of the LOR* registers. 5628 * Secure state has already been delt with. 5629 */ 5630 static CPAccessResult access_lor_ns(CPUARMState *env) 5631 { 5632 int el = arm_current_el(env); 5633 5634 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 5635 return CP_ACCESS_TRAP_EL2; 5636 } 5637 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 5638 return CP_ACCESS_TRAP_EL3; 5639 } 5640 return CP_ACCESS_OK; 5641 } 5642 5643 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri, 5644 bool isread) 5645 { 5646 if (arm_is_secure_below_el3(env)) { 5647 /* Access ok in secure mode. */ 5648 return CP_ACCESS_OK; 5649 } 5650 return access_lor_ns(env); 5651 } 5652 5653 static CPAccessResult access_lor_other(CPUARMState *env, 5654 const ARMCPRegInfo *ri, bool isread) 5655 { 5656 if (arm_is_secure_below_el3(env)) { 5657 /* Access denied in secure mode. */ 5658 return CP_ACCESS_TRAP; 5659 } 5660 return access_lor_ns(env); 5661 } 5662 5663 #ifdef TARGET_AARCH64 5664 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 5665 bool isread) 5666 { 5667 int el = arm_current_el(env); 5668 5669 if (el < 2 && 5670 arm_feature(env, ARM_FEATURE_EL2) && 5671 !(arm_hcr_el2_eff(env) & HCR_APK)) { 5672 return CP_ACCESS_TRAP_EL2; 5673 } 5674 if (el < 3 && 5675 arm_feature(env, ARM_FEATURE_EL3) && 5676 !(env->cp15.scr_el3 & SCR_APK)) { 5677 return CP_ACCESS_TRAP_EL3; 5678 } 5679 return CP_ACCESS_OK; 5680 } 5681 5682 static const ARMCPRegInfo pauth_reginfo[] = { 5683 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5684 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 5685 .access = PL1_RW, .accessfn = access_pauth, 5686 .fieldoffset = offsetof(CPUARMState, apda_key.lo) }, 5687 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5688 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 5689 .access = PL1_RW, .accessfn = access_pauth, 5690 .fieldoffset = offsetof(CPUARMState, apda_key.hi) }, 5691 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5692 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 5693 .access = PL1_RW, .accessfn = access_pauth, 5694 .fieldoffset = offsetof(CPUARMState, apdb_key.lo) }, 5695 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5696 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 5697 .access = PL1_RW, .accessfn = access_pauth, 5698 .fieldoffset = offsetof(CPUARMState, apdb_key.hi) }, 5699 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5700 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 5701 .access = PL1_RW, .accessfn = access_pauth, 5702 .fieldoffset = offsetof(CPUARMState, apga_key.lo) }, 5703 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5704 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 5705 .access = PL1_RW, .accessfn = access_pauth, 5706 .fieldoffset = offsetof(CPUARMState, apga_key.hi) }, 5707 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5708 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 5709 .access = PL1_RW, .accessfn = access_pauth, 5710 .fieldoffset = offsetof(CPUARMState, apia_key.lo) }, 5711 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5712 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 5713 .access = PL1_RW, .accessfn = access_pauth, 5714 .fieldoffset = offsetof(CPUARMState, apia_key.hi) }, 5715 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5716 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 5717 .access = PL1_RW, .accessfn = access_pauth, 5718 .fieldoffset = offsetof(CPUARMState, apib_key.lo) }, 5719 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5720 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 5721 .access = PL1_RW, .accessfn = access_pauth, 5722 .fieldoffset = offsetof(CPUARMState, apib_key.hi) }, 5723 REGINFO_SENTINEL 5724 }; 5725 #endif 5726 5727 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri, 5728 bool isread) 5729 { 5730 int el = arm_current_el(env); 5731 5732 if (el == 0) { 5733 uint64_t sctlr = arm_sctlr(env, el); 5734 if (!(sctlr & SCTLR_EnRCTX)) { 5735 return CP_ACCESS_TRAP; 5736 } 5737 } else if (el == 1) { 5738 uint64_t hcr = arm_hcr_el2_eff(env); 5739 if (hcr & HCR_NV) { 5740 return CP_ACCESS_TRAP_EL2; 5741 } 5742 } 5743 return CP_ACCESS_OK; 5744 } 5745 5746 static const ARMCPRegInfo predinv_reginfo[] = { 5747 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64, 5748 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4, 5749 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5750 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64, 5751 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5, 5752 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5753 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64, 5754 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7, 5755 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5756 /* 5757 * Note the AArch32 opcodes have a different OPC1. 5758 */ 5759 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32, 5760 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4, 5761 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5762 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32, 5763 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5, 5764 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5765 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32, 5766 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7, 5767 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 5768 REGINFO_SENTINEL 5769 }; 5770 5771 void register_cp_regs_for_features(ARMCPU *cpu) 5772 { 5773 /* Register all the coprocessor registers based on feature bits */ 5774 CPUARMState *env = &cpu->env; 5775 if (arm_feature(env, ARM_FEATURE_M)) { 5776 /* M profile has no coprocessor registers */ 5777 return; 5778 } 5779 5780 define_arm_cp_regs(cpu, cp_reginfo); 5781 if (!arm_feature(env, ARM_FEATURE_V8)) { 5782 /* Must go early as it is full of wildcards that may be 5783 * overridden by later definitions. 5784 */ 5785 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 5786 } 5787 5788 if (arm_feature(env, ARM_FEATURE_V6)) { 5789 /* The ID registers all have impdef reset values */ 5790 ARMCPRegInfo v6_idregs[] = { 5791 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 5792 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5793 .access = PL1_R, .type = ARM_CP_CONST, 5794 .resetvalue = cpu->id_pfr0 }, 5795 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know 5796 * the value of the GIC field until after we define these regs. 5797 */ 5798 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 5799 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 5800 .access = PL1_R, .type = ARM_CP_NO_RAW, 5801 .readfn = id_pfr1_read, 5802 .writefn = arm_cp_write_ignore }, 5803 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 5804 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 5805 .access = PL1_R, .type = ARM_CP_CONST, 5806 .resetvalue = cpu->id_dfr0 }, 5807 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 5808 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 5809 .access = PL1_R, .type = ARM_CP_CONST, 5810 .resetvalue = cpu->id_afr0 }, 5811 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 5812 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 5813 .access = PL1_R, .type = ARM_CP_CONST, 5814 .resetvalue = cpu->id_mmfr0 }, 5815 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 5816 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 5817 .access = PL1_R, .type = ARM_CP_CONST, 5818 .resetvalue = cpu->id_mmfr1 }, 5819 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 5820 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 5821 .access = PL1_R, .type = ARM_CP_CONST, 5822 .resetvalue = cpu->id_mmfr2 }, 5823 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 5824 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 5825 .access = PL1_R, .type = ARM_CP_CONST, 5826 .resetvalue = cpu->id_mmfr3 }, 5827 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 5828 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5829 .access = PL1_R, .type = ARM_CP_CONST, 5830 .resetvalue = cpu->isar.id_isar0 }, 5831 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 5832 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 5833 .access = PL1_R, .type = ARM_CP_CONST, 5834 .resetvalue = cpu->isar.id_isar1 }, 5835 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 5836 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5837 .access = PL1_R, .type = ARM_CP_CONST, 5838 .resetvalue = cpu->isar.id_isar2 }, 5839 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 5840 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 5841 .access = PL1_R, .type = ARM_CP_CONST, 5842 .resetvalue = cpu->isar.id_isar3 }, 5843 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 5844 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 5845 .access = PL1_R, .type = ARM_CP_CONST, 5846 .resetvalue = cpu->isar.id_isar4 }, 5847 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 5848 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 5849 .access = PL1_R, .type = ARM_CP_CONST, 5850 .resetvalue = cpu->isar.id_isar5 }, 5851 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 5852 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 5853 .access = PL1_R, .type = ARM_CP_CONST, 5854 .resetvalue = cpu->id_mmfr4 }, 5855 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 5856 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 5857 .access = PL1_R, .type = ARM_CP_CONST, 5858 .resetvalue = cpu->isar.id_isar6 }, 5859 REGINFO_SENTINEL 5860 }; 5861 define_arm_cp_regs(cpu, v6_idregs); 5862 define_arm_cp_regs(cpu, v6_cp_reginfo); 5863 } else { 5864 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 5865 } 5866 if (arm_feature(env, ARM_FEATURE_V6K)) { 5867 define_arm_cp_regs(cpu, v6k_cp_reginfo); 5868 } 5869 if (arm_feature(env, ARM_FEATURE_V7MP) && 5870 !arm_feature(env, ARM_FEATURE_PMSA)) { 5871 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 5872 } 5873 if (arm_feature(env, ARM_FEATURE_V7VE)) { 5874 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 5875 } 5876 if (arm_feature(env, ARM_FEATURE_V7)) { 5877 /* v7 performance monitor control register: same implementor 5878 * field as main ID register, and we implement four counters in 5879 * addition to the cycle count register. 5880 */ 5881 unsigned int i, pmcrn = 4; 5882 ARMCPRegInfo pmcr = { 5883 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 5884 .access = PL0_RW, 5885 .type = ARM_CP_IO | ARM_CP_ALIAS, 5886 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 5887 .accessfn = pmreg_access, .writefn = pmcr_write, 5888 .raw_writefn = raw_write, 5889 }; 5890 ARMCPRegInfo pmcr64 = { 5891 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 5892 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 5893 .access = PL0_RW, .accessfn = pmreg_access, 5894 .type = ARM_CP_IO, 5895 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 5896 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT), 5897 .writefn = pmcr_write, .raw_writefn = raw_write, 5898 }; 5899 define_one_arm_cp_reg(cpu, &pmcr); 5900 define_one_arm_cp_reg(cpu, &pmcr64); 5901 for (i = 0; i < pmcrn; i++) { 5902 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 5903 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 5904 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 5905 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 5906 ARMCPRegInfo pmev_regs[] = { 5907 { .name = pmevcntr_name, .cp = 15, .crn = 14, 5908 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 5909 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 5910 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 5911 .accessfn = pmreg_access }, 5912 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 5913 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)), 5914 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 5915 .type = ARM_CP_IO, 5916 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 5917 .raw_readfn = pmevcntr_rawread, 5918 .raw_writefn = pmevcntr_rawwrite }, 5919 { .name = pmevtyper_name, .cp = 15, .crn = 14, 5920 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 5921 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 5922 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 5923 .accessfn = pmreg_access }, 5924 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 5925 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)), 5926 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 5927 .type = ARM_CP_IO, 5928 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 5929 .raw_writefn = pmevtyper_rawwrite }, 5930 REGINFO_SENTINEL 5931 }; 5932 define_arm_cp_regs(cpu, pmev_regs); 5933 g_free(pmevcntr_name); 5934 g_free(pmevcntr_el0_name); 5935 g_free(pmevtyper_name); 5936 g_free(pmevtyper_el0_name); 5937 } 5938 ARMCPRegInfo clidr = { 5939 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 5940 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 5941 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr 5942 }; 5943 define_one_arm_cp_reg(cpu, &clidr); 5944 define_arm_cp_regs(cpu, v7_cp_reginfo); 5945 define_debug_regs(cpu); 5946 } else { 5947 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 5948 } 5949 if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 && 5950 FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) { 5951 ARMCPRegInfo v81_pmu_regs[] = { 5952 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 5953 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 5954 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5955 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 5956 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 5957 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 5958 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5959 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 5960 REGINFO_SENTINEL 5961 }; 5962 define_arm_cp_regs(cpu, v81_pmu_regs); 5963 } 5964 if (arm_feature(env, ARM_FEATURE_V8)) { 5965 /* AArch64 ID registers, which all have impdef reset values. 5966 * Note that within the ID register ranges the unused slots 5967 * must all RAZ, not UNDEF; future architecture versions may 5968 * define new registers here. 5969 */ 5970 ARMCPRegInfo v8_idregs[] = { 5971 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't 5972 * know the right value for the GIC field until after we 5973 * define these regs. 5974 */ 5975 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 5976 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 5977 .access = PL1_R, .type = ARM_CP_NO_RAW, 5978 .readfn = id_aa64pfr0_read, 5979 .writefn = arm_cp_write_ignore }, 5980 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 5981 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 5982 .access = PL1_R, .type = ARM_CP_CONST, 5983 .resetvalue = cpu->isar.id_aa64pfr1}, 5984 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5985 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 5986 .access = PL1_R, .type = ARM_CP_CONST, 5987 .resetvalue = 0 }, 5988 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5989 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 5990 .access = PL1_R, .type = ARM_CP_CONST, 5991 .resetvalue = 0 }, 5992 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 5993 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 5994 .access = PL1_R, .type = ARM_CP_CONST, 5995 /* At present, only SVEver == 0 is defined anyway. */ 5996 .resetvalue = 0 }, 5997 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5998 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 5999 .access = PL1_R, .type = ARM_CP_CONST, 6000 .resetvalue = 0 }, 6001 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6002 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 6003 .access = PL1_R, .type = ARM_CP_CONST, 6004 .resetvalue = 0 }, 6005 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6006 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 6007 .access = PL1_R, .type = ARM_CP_CONST, 6008 .resetvalue = 0 }, 6009 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 6010 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 6011 .access = PL1_R, .type = ARM_CP_CONST, 6012 .resetvalue = cpu->id_aa64dfr0 }, 6013 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 6014 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 6015 .access = PL1_R, .type = ARM_CP_CONST, 6016 .resetvalue = cpu->id_aa64dfr1 }, 6017 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6018 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 6019 .access = PL1_R, .type = ARM_CP_CONST, 6020 .resetvalue = 0 }, 6021 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6022 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 6023 .access = PL1_R, .type = ARM_CP_CONST, 6024 .resetvalue = 0 }, 6025 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 6026 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 6027 .access = PL1_R, .type = ARM_CP_CONST, 6028 .resetvalue = cpu->id_aa64afr0 }, 6029 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 6030 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 6031 .access = PL1_R, .type = ARM_CP_CONST, 6032 .resetvalue = cpu->id_aa64afr1 }, 6033 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6034 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 6035 .access = PL1_R, .type = ARM_CP_CONST, 6036 .resetvalue = 0 }, 6037 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6038 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 6039 .access = PL1_R, .type = ARM_CP_CONST, 6040 .resetvalue = 0 }, 6041 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 6042 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 6043 .access = PL1_R, .type = ARM_CP_CONST, 6044 .resetvalue = cpu->isar.id_aa64isar0 }, 6045 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 6046 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 6047 .access = PL1_R, .type = ARM_CP_CONST, 6048 .resetvalue = cpu->isar.id_aa64isar1 }, 6049 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6050 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 6051 .access = PL1_R, .type = ARM_CP_CONST, 6052 .resetvalue = 0 }, 6053 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6054 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 6055 .access = PL1_R, .type = ARM_CP_CONST, 6056 .resetvalue = 0 }, 6057 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6058 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 6059 .access = PL1_R, .type = ARM_CP_CONST, 6060 .resetvalue = 0 }, 6061 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6062 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 6063 .access = PL1_R, .type = ARM_CP_CONST, 6064 .resetvalue = 0 }, 6065 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6066 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 6067 .access = PL1_R, .type = ARM_CP_CONST, 6068 .resetvalue = 0 }, 6069 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6070 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 6071 .access = PL1_R, .type = ARM_CP_CONST, 6072 .resetvalue = 0 }, 6073 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 6074 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 6075 .access = PL1_R, .type = ARM_CP_CONST, 6076 .resetvalue = cpu->isar.id_aa64mmfr0 }, 6077 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 6078 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 6079 .access = PL1_R, .type = ARM_CP_CONST, 6080 .resetvalue = cpu->isar.id_aa64mmfr1 }, 6081 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6082 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 6083 .access = PL1_R, .type = ARM_CP_CONST, 6084 .resetvalue = 0 }, 6085 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6086 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 6087 .access = PL1_R, .type = ARM_CP_CONST, 6088 .resetvalue = 0 }, 6089 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6090 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 6091 .access = PL1_R, .type = ARM_CP_CONST, 6092 .resetvalue = 0 }, 6093 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6094 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 6095 .access = PL1_R, .type = ARM_CP_CONST, 6096 .resetvalue = 0 }, 6097 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6098 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 6099 .access = PL1_R, .type = ARM_CP_CONST, 6100 .resetvalue = 0 }, 6101 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6102 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 6103 .access = PL1_R, .type = ARM_CP_CONST, 6104 .resetvalue = 0 }, 6105 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 6106 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 6107 .access = PL1_R, .type = ARM_CP_CONST, 6108 .resetvalue = cpu->isar.mvfr0 }, 6109 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 6110 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 6111 .access = PL1_R, .type = ARM_CP_CONST, 6112 .resetvalue = cpu->isar.mvfr1 }, 6113 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 6114 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 6115 .access = PL1_R, .type = ARM_CP_CONST, 6116 .resetvalue = cpu->isar.mvfr2 }, 6117 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6118 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 6119 .access = PL1_R, .type = ARM_CP_CONST, 6120 .resetvalue = 0 }, 6121 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6122 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 6123 .access = PL1_R, .type = ARM_CP_CONST, 6124 .resetvalue = 0 }, 6125 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6126 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 6127 .access = PL1_R, .type = ARM_CP_CONST, 6128 .resetvalue = 0 }, 6129 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6130 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 6131 .access = PL1_R, .type = ARM_CP_CONST, 6132 .resetvalue = 0 }, 6133 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6134 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 6135 .access = PL1_R, .type = ARM_CP_CONST, 6136 .resetvalue = 0 }, 6137 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 6138 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 6139 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6140 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 6141 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 6142 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 6143 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6144 .resetvalue = cpu->pmceid0 }, 6145 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 6146 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 6147 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6148 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 6149 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 6150 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 6151 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6152 .resetvalue = cpu->pmceid1 }, 6153 REGINFO_SENTINEL 6154 }; 6155 #ifdef CONFIG_USER_ONLY 6156 ARMCPRegUserSpaceInfo v8_user_idregs[] = { 6157 { .name = "ID_AA64PFR0_EL1", 6158 .exported_bits = 0x000f000f00ff0000, 6159 .fixed_bits = 0x0000000000000011 }, 6160 { .name = "ID_AA64PFR1_EL1", 6161 .exported_bits = 0x00000000000000f0 }, 6162 { .name = "ID_AA64PFR*_EL1_RESERVED", 6163 .is_glob = true }, 6164 { .name = "ID_AA64ZFR0_EL1" }, 6165 { .name = "ID_AA64MMFR0_EL1", 6166 .fixed_bits = 0x00000000ff000000 }, 6167 { .name = "ID_AA64MMFR1_EL1" }, 6168 { .name = "ID_AA64MMFR*_EL1_RESERVED", 6169 .is_glob = true }, 6170 { .name = "ID_AA64DFR0_EL1", 6171 .fixed_bits = 0x0000000000000006 }, 6172 { .name = "ID_AA64DFR1_EL1" }, 6173 { .name = "ID_AA64DFR*_EL1_RESERVED", 6174 .is_glob = true }, 6175 { .name = "ID_AA64AFR*", 6176 .is_glob = true }, 6177 { .name = "ID_AA64ISAR0_EL1", 6178 .exported_bits = 0x00fffffff0fffff0 }, 6179 { .name = "ID_AA64ISAR1_EL1", 6180 .exported_bits = 0x000000f0ffffffff }, 6181 { .name = "ID_AA64ISAR*_EL1_RESERVED", 6182 .is_glob = true }, 6183 REGUSERINFO_SENTINEL 6184 }; 6185 modify_arm_cp_regs(v8_idregs, v8_user_idregs); 6186 #endif 6187 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ 6188 if (!arm_feature(env, ARM_FEATURE_EL3) && 6189 !arm_feature(env, ARM_FEATURE_EL2)) { 6190 ARMCPRegInfo rvbar = { 6191 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64, 6192 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 6193 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar 6194 }; 6195 define_one_arm_cp_reg(cpu, &rvbar); 6196 } 6197 define_arm_cp_regs(cpu, v8_idregs); 6198 define_arm_cp_regs(cpu, v8_cp_reginfo); 6199 } 6200 if (arm_feature(env, ARM_FEATURE_EL2)) { 6201 uint64_t vmpidr_def = mpidr_read_val(env); 6202 ARMCPRegInfo vpidr_regs[] = { 6203 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 6204 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6205 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6206 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS, 6207 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 6208 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 6209 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6210 .access = PL2_RW, .resetvalue = cpu->midr, 6211 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6212 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 6213 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6214 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6215 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS, 6216 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 6217 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 6218 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6219 .access = PL2_RW, 6220 .resetvalue = vmpidr_def, 6221 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 6222 REGINFO_SENTINEL 6223 }; 6224 define_arm_cp_regs(cpu, vpidr_regs); 6225 define_arm_cp_regs(cpu, el2_cp_reginfo); 6226 if (arm_feature(env, ARM_FEATURE_V8)) { 6227 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 6228 } 6229 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */ 6230 if (!arm_feature(env, ARM_FEATURE_EL3)) { 6231 ARMCPRegInfo rvbar = { 6232 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 6233 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 6234 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar 6235 }; 6236 define_one_arm_cp_reg(cpu, &rvbar); 6237 } 6238 } else { 6239 /* If EL2 is missing but higher ELs are enabled, we need to 6240 * register the no_el2 reginfos. 6241 */ 6242 if (arm_feature(env, ARM_FEATURE_EL3)) { 6243 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value 6244 * of MIDR_EL1 and MPIDR_EL1. 6245 */ 6246 ARMCPRegInfo vpidr_regs[] = { 6247 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6248 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6249 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6250 .type = ARM_CP_CONST, .resetvalue = cpu->midr, 6251 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6252 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6253 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6254 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6255 .type = ARM_CP_NO_RAW, 6256 .writefn = arm_cp_write_ignore, .readfn = mpidr_read }, 6257 REGINFO_SENTINEL 6258 }; 6259 define_arm_cp_regs(cpu, vpidr_regs); 6260 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo); 6261 if (arm_feature(env, ARM_FEATURE_V8)) { 6262 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo); 6263 } 6264 } 6265 } 6266 if (arm_feature(env, ARM_FEATURE_EL3)) { 6267 define_arm_cp_regs(cpu, el3_cp_reginfo); 6268 ARMCPRegInfo el3_regs[] = { 6269 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 6270 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 6271 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar }, 6272 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 6273 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 6274 .access = PL3_RW, 6275 .raw_writefn = raw_write, .writefn = sctlr_write, 6276 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 6277 .resetvalue = cpu->reset_sctlr }, 6278 REGINFO_SENTINEL 6279 }; 6280 6281 define_arm_cp_regs(cpu, el3_regs); 6282 } 6283 /* The behaviour of NSACR is sufficiently various that we don't 6284 * try to describe it in a single reginfo: 6285 * if EL3 is 64 bit, then trap to EL3 from S EL1, 6286 * reads as constant 0xc00 from NS EL1 and NS EL2 6287 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 6288 * if v7 without EL3, register doesn't exist 6289 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 6290 */ 6291 if (arm_feature(env, ARM_FEATURE_EL3)) { 6292 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6293 ARMCPRegInfo nsacr = { 6294 .name = "NSACR", .type = ARM_CP_CONST, 6295 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6296 .access = PL1_RW, .accessfn = nsacr_access, 6297 .resetvalue = 0xc00 6298 }; 6299 define_one_arm_cp_reg(cpu, &nsacr); 6300 } else { 6301 ARMCPRegInfo nsacr = { 6302 .name = "NSACR", 6303 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6304 .access = PL3_RW | PL1_R, 6305 .resetvalue = 0, 6306 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 6307 }; 6308 define_one_arm_cp_reg(cpu, &nsacr); 6309 } 6310 } else { 6311 if (arm_feature(env, ARM_FEATURE_V8)) { 6312 ARMCPRegInfo nsacr = { 6313 .name = "NSACR", .type = ARM_CP_CONST, 6314 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6315 .access = PL1_R, 6316 .resetvalue = 0xc00 6317 }; 6318 define_one_arm_cp_reg(cpu, &nsacr); 6319 } 6320 } 6321 6322 if (arm_feature(env, ARM_FEATURE_PMSA)) { 6323 if (arm_feature(env, ARM_FEATURE_V6)) { 6324 /* PMSAv6 not implemented */ 6325 assert(arm_feature(env, ARM_FEATURE_V7)); 6326 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6327 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 6328 } else { 6329 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 6330 } 6331 } else { 6332 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6333 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 6334 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */ 6335 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) { 6336 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 6337 } 6338 } 6339 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 6340 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 6341 } 6342 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 6343 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 6344 } 6345 if (arm_feature(env, ARM_FEATURE_VAPA)) { 6346 define_arm_cp_regs(cpu, vapa_cp_reginfo); 6347 } 6348 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 6349 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 6350 } 6351 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 6352 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 6353 } 6354 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 6355 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 6356 } 6357 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 6358 define_arm_cp_regs(cpu, omap_cp_reginfo); 6359 } 6360 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 6361 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 6362 } 6363 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6364 define_arm_cp_regs(cpu, xscale_cp_reginfo); 6365 } 6366 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 6367 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 6368 } 6369 if (arm_feature(env, ARM_FEATURE_LPAE)) { 6370 define_arm_cp_regs(cpu, lpae_cp_reginfo); 6371 } 6372 /* Slightly awkwardly, the OMAP and StrongARM cores need all of 6373 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 6374 * be read-only (ie write causes UNDEF exception). 6375 */ 6376 { 6377 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 6378 /* Pre-v8 MIDR space. 6379 * Note that the MIDR isn't a simple constant register because 6380 * of the TI925 behaviour where writes to another register can 6381 * cause the MIDR value to change. 6382 * 6383 * Unimplemented registers in the c15 0 0 0 space default to 6384 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 6385 * and friends override accordingly. 6386 */ 6387 { .name = "MIDR", 6388 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 6389 .access = PL1_R, .resetvalue = cpu->midr, 6390 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 6391 .readfn = midr_read, 6392 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6393 .type = ARM_CP_OVERRIDE }, 6394 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 6395 { .name = "DUMMY", 6396 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 6397 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6398 { .name = "DUMMY", 6399 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 6400 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6401 { .name = "DUMMY", 6402 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 6403 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6404 { .name = "DUMMY", 6405 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 6406 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6407 { .name = "DUMMY", 6408 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 6409 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6410 REGINFO_SENTINEL 6411 }; 6412 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 6413 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 6414 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 6415 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 6416 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6417 .readfn = midr_read }, 6418 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */ 6419 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6420 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6421 .access = PL1_R, .resetvalue = cpu->midr }, 6422 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6423 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 6424 .access = PL1_R, .resetvalue = cpu->midr }, 6425 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 6426 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 6427 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 6428 REGINFO_SENTINEL 6429 }; 6430 ARMCPRegInfo id_cp_reginfo[] = { 6431 /* These are common to v8 and pre-v8 */ 6432 { .name = "CTR", 6433 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 6434 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6435 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 6436 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 6437 .access = PL0_R, .accessfn = ctr_el0_access, 6438 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6439 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 6440 { .name = "TCMTR", 6441 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 6442 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6443 REGINFO_SENTINEL 6444 }; 6445 /* TLBTR is specific to VMSA */ 6446 ARMCPRegInfo id_tlbtr_reginfo = { 6447 .name = "TLBTR", 6448 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 6449 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0, 6450 }; 6451 /* MPUIR is specific to PMSA V6+ */ 6452 ARMCPRegInfo id_mpuir_reginfo = { 6453 .name = "MPUIR", 6454 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6455 .access = PL1_R, .type = ARM_CP_CONST, 6456 .resetvalue = cpu->pmsav7_dregion << 8 6457 }; 6458 ARMCPRegInfo crn0_wi_reginfo = { 6459 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 6460 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 6461 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 6462 }; 6463 #ifdef CONFIG_USER_ONLY 6464 ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = { 6465 { .name = "MIDR_EL1", 6466 .exported_bits = 0x00000000ffffffff }, 6467 { .name = "REVIDR_EL1" }, 6468 REGUSERINFO_SENTINEL 6469 }; 6470 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo); 6471 #endif 6472 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 6473 arm_feature(env, ARM_FEATURE_STRONGARM)) { 6474 ARMCPRegInfo *r; 6475 /* Register the blanket "writes ignored" value first to cover the 6476 * whole space. Then update the specific ID registers to allow write 6477 * access, so that they ignore writes rather than causing them to 6478 * UNDEF. 6479 */ 6480 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 6481 for (r = id_pre_v8_midr_cp_reginfo; 6482 r->type != ARM_CP_SENTINEL; r++) { 6483 r->access = PL1_RW; 6484 } 6485 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) { 6486 r->access = PL1_RW; 6487 } 6488 id_mpuir_reginfo.access = PL1_RW; 6489 id_tlbtr_reginfo.access = PL1_RW; 6490 } 6491 if (arm_feature(env, ARM_FEATURE_V8)) { 6492 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 6493 } else { 6494 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 6495 } 6496 define_arm_cp_regs(cpu, id_cp_reginfo); 6497 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 6498 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 6499 } else if (arm_feature(env, ARM_FEATURE_V7)) { 6500 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 6501 } 6502 } 6503 6504 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 6505 ARMCPRegInfo mpidr_cp_reginfo[] = { 6506 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH, 6507 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 6508 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 6509 REGINFO_SENTINEL 6510 }; 6511 #ifdef CONFIG_USER_ONLY 6512 ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = { 6513 { .name = "MPIDR_EL1", 6514 .fixed_bits = 0x0000000080000000 }, 6515 REGUSERINFO_SENTINEL 6516 }; 6517 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo); 6518 #endif 6519 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 6520 } 6521 6522 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 6523 ARMCPRegInfo auxcr_reginfo[] = { 6524 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 6525 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 6526 .access = PL1_RW, .type = ARM_CP_CONST, 6527 .resetvalue = cpu->reset_auxcr }, 6528 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 6529 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 6530 .access = PL2_RW, .type = ARM_CP_CONST, 6531 .resetvalue = 0 }, 6532 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 6533 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 6534 .access = PL3_RW, .type = ARM_CP_CONST, 6535 .resetvalue = 0 }, 6536 REGINFO_SENTINEL 6537 }; 6538 define_arm_cp_regs(cpu, auxcr_reginfo); 6539 if (arm_feature(env, ARM_FEATURE_V8)) { 6540 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */ 6541 ARMCPRegInfo hactlr2_reginfo = { 6542 .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 6543 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 6544 .access = PL2_RW, .type = ARM_CP_CONST, 6545 .resetvalue = 0 6546 }; 6547 define_one_arm_cp_reg(cpu, &hactlr2_reginfo); 6548 } 6549 } 6550 6551 if (arm_feature(env, ARM_FEATURE_CBAR)) { 6552 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6553 /* 32 bit view is [31:18] 0...0 [43:32]. */ 6554 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 6555 | extract64(cpu->reset_cbar, 32, 12); 6556 ARMCPRegInfo cbar_reginfo[] = { 6557 { .name = "CBAR", 6558 .type = ARM_CP_CONST, 6559 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6560 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 6561 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 6562 .type = ARM_CP_CONST, 6563 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 6564 .access = PL1_R, .resetvalue = cbar32 }, 6565 REGINFO_SENTINEL 6566 }; 6567 /* We don't implement a r/w 64 bit CBAR currently */ 6568 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 6569 define_arm_cp_regs(cpu, cbar_reginfo); 6570 } else { 6571 ARMCPRegInfo cbar = { 6572 .name = "CBAR", 6573 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6574 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar, 6575 .fieldoffset = offsetof(CPUARMState, 6576 cp15.c15_config_base_address) 6577 }; 6578 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 6579 cbar.access = PL1_R; 6580 cbar.fieldoffset = 0; 6581 cbar.type = ARM_CP_CONST; 6582 } 6583 define_one_arm_cp_reg(cpu, &cbar); 6584 } 6585 } 6586 6587 if (arm_feature(env, ARM_FEATURE_VBAR)) { 6588 ARMCPRegInfo vbar_cp_reginfo[] = { 6589 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 6590 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 6591 .access = PL1_RW, .writefn = vbar_write, 6592 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 6593 offsetof(CPUARMState, cp15.vbar_ns) }, 6594 .resetvalue = 0 }, 6595 REGINFO_SENTINEL 6596 }; 6597 define_arm_cp_regs(cpu, vbar_cp_reginfo); 6598 } 6599 6600 /* Generic registers whose values depend on the implementation */ 6601 { 6602 ARMCPRegInfo sctlr = { 6603 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 6604 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 6605 .access = PL1_RW, 6606 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 6607 offsetof(CPUARMState, cp15.sctlr_ns) }, 6608 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 6609 .raw_writefn = raw_write, 6610 }; 6611 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6612 /* Normally we would always end the TB on an SCTLR write, but Linux 6613 * arch/arm/mach-pxa/sleep.S expects two instructions following 6614 * an MMU enable to execute from cache. Imitate this behaviour. 6615 */ 6616 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 6617 } 6618 define_one_arm_cp_reg(cpu, &sctlr); 6619 } 6620 6621 if (cpu_isar_feature(aa64_lor, cpu)) { 6622 /* 6623 * A trivial implementation of ARMv8.1-LOR leaves all of these 6624 * registers fixed at 0, which indicates that there are zero 6625 * supported Limited Ordering regions. 6626 */ 6627 static const ARMCPRegInfo lor_reginfo[] = { 6628 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 6629 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 6630 .access = PL1_RW, .accessfn = access_lor_other, 6631 .type = ARM_CP_CONST, .resetvalue = 0 }, 6632 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 6633 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 6634 .access = PL1_RW, .accessfn = access_lor_other, 6635 .type = ARM_CP_CONST, .resetvalue = 0 }, 6636 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 6637 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 6638 .access = PL1_RW, .accessfn = access_lor_other, 6639 .type = ARM_CP_CONST, .resetvalue = 0 }, 6640 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 6641 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 6642 .access = PL1_RW, .accessfn = access_lor_other, 6643 .type = ARM_CP_CONST, .resetvalue = 0 }, 6644 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 6645 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 6646 .access = PL1_R, .accessfn = access_lorid, 6647 .type = ARM_CP_CONST, .resetvalue = 0 }, 6648 REGINFO_SENTINEL 6649 }; 6650 define_arm_cp_regs(cpu, lor_reginfo); 6651 } 6652 6653 if (cpu_isar_feature(aa64_sve, cpu)) { 6654 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo); 6655 if (arm_feature(env, ARM_FEATURE_EL2)) { 6656 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo); 6657 } else { 6658 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo); 6659 } 6660 if (arm_feature(env, ARM_FEATURE_EL3)) { 6661 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo); 6662 } 6663 } 6664 6665 #ifdef TARGET_AARCH64 6666 if (cpu_isar_feature(aa64_pauth, cpu)) { 6667 define_arm_cp_regs(cpu, pauth_reginfo); 6668 } 6669 #endif 6670 6671 /* 6672 * While all v8.0 cpus support aarch64, QEMU does have configurations 6673 * that do not set ID_AA64ISAR1, e.g. user-only qemu-arm -cpu max, 6674 * which will set ID_ISAR6. 6675 */ 6676 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) 6677 ? cpu_isar_feature(aa64_predinv, cpu) 6678 : cpu_isar_feature(aa32_predinv, cpu)) { 6679 define_arm_cp_regs(cpu, predinv_reginfo); 6680 } 6681 } 6682 6683 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) 6684 { 6685 CPUState *cs = CPU(cpu); 6686 CPUARMState *env = &cpu->env; 6687 6688 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6689 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg, 6690 aarch64_fpu_gdb_set_reg, 6691 34, "aarch64-fpu.xml", 0); 6692 } else if (arm_feature(env, ARM_FEATURE_NEON)) { 6693 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6694 51, "arm-neon.xml", 0); 6695 } else if (arm_feature(env, ARM_FEATURE_VFP3)) { 6696 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6697 35, "arm-vfp3.xml", 0); 6698 } else if (arm_feature(env, ARM_FEATURE_VFP)) { 6699 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6700 19, "arm-vfp.xml", 0); 6701 } 6702 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg, 6703 arm_gen_dynamic_xml(cs), 6704 "system-registers.xml", 0); 6705 } 6706 6707 /* Sort alphabetically by type name, except for "any". */ 6708 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b) 6709 { 6710 ObjectClass *class_a = (ObjectClass *)a; 6711 ObjectClass *class_b = (ObjectClass *)b; 6712 const char *name_a, *name_b; 6713 6714 name_a = object_class_get_name(class_a); 6715 name_b = object_class_get_name(class_b); 6716 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) { 6717 return 1; 6718 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) { 6719 return -1; 6720 } else { 6721 return strcmp(name_a, name_b); 6722 } 6723 } 6724 6725 static void arm_cpu_list_entry(gpointer data, gpointer user_data) 6726 { 6727 ObjectClass *oc = data; 6728 const char *typename; 6729 char *name; 6730 6731 typename = object_class_get_name(oc); 6732 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6733 qemu_printf(" %s\n", name); 6734 g_free(name); 6735 } 6736 6737 void arm_cpu_list(void) 6738 { 6739 GSList *list; 6740 6741 list = object_class_get_list(TYPE_ARM_CPU, false); 6742 list = g_slist_sort(list, arm_cpu_list_compare); 6743 qemu_printf("Available CPUs:\n"); 6744 g_slist_foreach(list, arm_cpu_list_entry, NULL); 6745 g_slist_free(list); 6746 } 6747 6748 static void arm_cpu_add_definition(gpointer data, gpointer user_data) 6749 { 6750 ObjectClass *oc = data; 6751 CpuDefinitionInfoList **cpu_list = user_data; 6752 CpuDefinitionInfoList *entry; 6753 CpuDefinitionInfo *info; 6754 const char *typename; 6755 6756 typename = object_class_get_name(oc); 6757 info = g_malloc0(sizeof(*info)); 6758 info->name = g_strndup(typename, 6759 strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6760 info->q_typename = g_strdup(typename); 6761 6762 entry = g_malloc0(sizeof(*entry)); 6763 entry->value = info; 6764 entry->next = *cpu_list; 6765 *cpu_list = entry; 6766 } 6767 6768 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp) 6769 { 6770 CpuDefinitionInfoList *cpu_list = NULL; 6771 GSList *list; 6772 6773 list = object_class_get_list(TYPE_ARM_CPU, false); 6774 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list); 6775 g_slist_free(list); 6776 6777 return cpu_list; 6778 } 6779 6780 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 6781 void *opaque, int state, int secstate, 6782 int crm, int opc1, int opc2, 6783 const char *name) 6784 { 6785 /* Private utility function for define_one_arm_cp_reg_with_opaque(): 6786 * add a single reginfo struct to the hash table. 6787 */ 6788 uint32_t *key = g_new(uint32_t, 1); 6789 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo)); 6790 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0; 6791 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0; 6792 6793 r2->name = g_strdup(name); 6794 /* Reset the secure state to the specific incoming state. This is 6795 * necessary as the register may have been defined with both states. 6796 */ 6797 r2->secure = secstate; 6798 6799 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6800 /* Register is banked (using both entries in array). 6801 * Overwriting fieldoffset as the array is only used to define 6802 * banked registers but later only fieldoffset is used. 6803 */ 6804 r2->fieldoffset = r->bank_fieldoffsets[ns]; 6805 } 6806 6807 if (state == ARM_CP_STATE_AA32) { 6808 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6809 /* If the register is banked then we don't need to migrate or 6810 * reset the 32-bit instance in certain cases: 6811 * 6812 * 1) If the register has both 32-bit and 64-bit instances then we 6813 * can count on the 64-bit instance taking care of the 6814 * non-secure bank. 6815 * 2) If ARMv8 is enabled then we can count on a 64-bit version 6816 * taking care of the secure bank. This requires that separate 6817 * 32 and 64-bit definitions are provided. 6818 */ 6819 if ((r->state == ARM_CP_STATE_BOTH && ns) || 6820 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) { 6821 r2->type |= ARM_CP_ALIAS; 6822 } 6823 } else if ((secstate != r->secure) && !ns) { 6824 /* The register is not banked so we only want to allow migration of 6825 * the non-secure instance. 6826 */ 6827 r2->type |= ARM_CP_ALIAS; 6828 } 6829 6830 if (r->state == ARM_CP_STATE_BOTH) { 6831 /* We assume it is a cp15 register if the .cp field is left unset. 6832 */ 6833 if (r2->cp == 0) { 6834 r2->cp = 15; 6835 } 6836 6837 #ifdef HOST_WORDS_BIGENDIAN 6838 if (r2->fieldoffset) { 6839 r2->fieldoffset += sizeof(uint32_t); 6840 } 6841 #endif 6842 } 6843 } 6844 if (state == ARM_CP_STATE_AA64) { 6845 /* To allow abbreviation of ARMCPRegInfo 6846 * definitions, we treat cp == 0 as equivalent to 6847 * the value for "standard guest-visible sysreg". 6848 * STATE_BOTH definitions are also always "standard 6849 * sysreg" in their AArch64 view (the .cp value may 6850 * be non-zero for the benefit of the AArch32 view). 6851 */ 6852 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) { 6853 r2->cp = CP_REG_ARM64_SYSREG_CP; 6854 } 6855 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm, 6856 r2->opc0, opc1, opc2); 6857 } else { 6858 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2); 6859 } 6860 if (opaque) { 6861 r2->opaque = opaque; 6862 } 6863 /* reginfo passed to helpers is correct for the actual access, 6864 * and is never ARM_CP_STATE_BOTH: 6865 */ 6866 r2->state = state; 6867 /* Make sure reginfo passed to helpers for wildcarded regs 6868 * has the correct crm/opc1/opc2 for this reg, not CP_ANY: 6869 */ 6870 r2->crm = crm; 6871 r2->opc1 = opc1; 6872 r2->opc2 = opc2; 6873 /* By convention, for wildcarded registers only the first 6874 * entry is used for migration; the others are marked as 6875 * ALIAS so we don't try to transfer the register 6876 * multiple times. Special registers (ie NOP/WFI) are 6877 * never migratable and not even raw-accessible. 6878 */ 6879 if ((r->type & ARM_CP_SPECIAL)) { 6880 r2->type |= ARM_CP_NO_RAW; 6881 } 6882 if (((r->crm == CP_ANY) && crm != 0) || 6883 ((r->opc1 == CP_ANY) && opc1 != 0) || 6884 ((r->opc2 == CP_ANY) && opc2 != 0)) { 6885 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 6886 } 6887 6888 /* Check that raw accesses are either forbidden or handled. Note that 6889 * we can't assert this earlier because the setup of fieldoffset for 6890 * banked registers has to be done first. 6891 */ 6892 if (!(r2->type & ARM_CP_NO_RAW)) { 6893 assert(!raw_accessors_invalid(r2)); 6894 } 6895 6896 /* Overriding of an existing definition must be explicitly 6897 * requested. 6898 */ 6899 if (!(r->type & ARM_CP_OVERRIDE)) { 6900 ARMCPRegInfo *oldreg; 6901 oldreg = g_hash_table_lookup(cpu->cp_regs, key); 6902 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) { 6903 fprintf(stderr, "Register redefined: cp=%d %d bit " 6904 "crn=%d crm=%d opc1=%d opc2=%d, " 6905 "was %s, now %s\n", r2->cp, 32 + 32 * is64, 6906 r2->crn, r2->crm, r2->opc1, r2->opc2, 6907 oldreg->name, r2->name); 6908 g_assert_not_reached(); 6909 } 6910 } 6911 g_hash_table_insert(cpu->cp_regs, key, r2); 6912 } 6913 6914 6915 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 6916 const ARMCPRegInfo *r, void *opaque) 6917 { 6918 /* Define implementations of coprocessor registers. 6919 * We store these in a hashtable because typically 6920 * there are less than 150 registers in a space which 6921 * is 16*16*16*8*8 = 262144 in size. 6922 * Wildcarding is supported for the crm, opc1 and opc2 fields. 6923 * If a register is defined twice then the second definition is 6924 * used, so this can be used to define some generic registers and 6925 * then override them with implementation specific variations. 6926 * At least one of the original and the second definition should 6927 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 6928 * against accidental use. 6929 * 6930 * The state field defines whether the register is to be 6931 * visible in the AArch32 or AArch64 execution state. If the 6932 * state is set to ARM_CP_STATE_BOTH then we synthesise a 6933 * reginfo structure for the AArch32 view, which sees the lower 6934 * 32 bits of the 64 bit register. 6935 * 6936 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 6937 * be wildcarded. AArch64 registers are always considered to be 64 6938 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 6939 * the register, if any. 6940 */ 6941 int crm, opc1, opc2, state; 6942 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 6943 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 6944 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 6945 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 6946 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 6947 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 6948 /* 64 bit registers have only CRm and Opc1 fields */ 6949 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 6950 /* op0 only exists in the AArch64 encodings */ 6951 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 6952 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 6953 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 6954 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1 6955 * encodes a minimum access level for the register. We roll this 6956 * runtime check into our general permission check code, so check 6957 * here that the reginfo's specified permissions are strict enough 6958 * to encompass the generic architectural permission check. 6959 */ 6960 if (r->state != ARM_CP_STATE_AA32) { 6961 int mask = 0; 6962 switch (r->opc1) { 6963 case 0: 6964 /* min_EL EL1, but some accessible to EL0 via kernel ABI */ 6965 mask = PL0U_R | PL1_RW; 6966 break; 6967 case 1: case 2: 6968 /* min_EL EL1 */ 6969 mask = PL1_RW; 6970 break; 6971 case 3: 6972 /* min_EL EL0 */ 6973 mask = PL0_RW; 6974 break; 6975 case 4: 6976 /* min_EL EL2 */ 6977 mask = PL2_RW; 6978 break; 6979 case 5: 6980 /* unallocated encoding, so not possible */ 6981 assert(false); 6982 break; 6983 case 6: 6984 /* min_EL EL3 */ 6985 mask = PL3_RW; 6986 break; 6987 case 7: 6988 /* min_EL EL1, secure mode only (we don't check the latter) */ 6989 mask = PL1_RW; 6990 break; 6991 default: 6992 /* broken reginfo with out-of-range opc1 */ 6993 assert(false); 6994 break; 6995 } 6996 /* assert our permissions are not too lax (stricter is fine) */ 6997 assert((r->access & ~mask) == 0); 6998 } 6999 7000 /* Check that the register definition has enough info to handle 7001 * reads and writes if they are permitted. 7002 */ 7003 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) { 7004 if (r->access & PL3_R) { 7005 assert((r->fieldoffset || 7006 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 7007 r->readfn); 7008 } 7009 if (r->access & PL3_W) { 7010 assert((r->fieldoffset || 7011 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 7012 r->writefn); 7013 } 7014 } 7015 /* Bad type field probably means missing sentinel at end of reg list */ 7016 assert(cptype_valid(r->type)); 7017 for (crm = crmmin; crm <= crmmax; crm++) { 7018 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 7019 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 7020 for (state = ARM_CP_STATE_AA32; 7021 state <= ARM_CP_STATE_AA64; state++) { 7022 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 7023 continue; 7024 } 7025 if (state == ARM_CP_STATE_AA32) { 7026 /* Under AArch32 CP registers can be common 7027 * (same for secure and non-secure world) or banked. 7028 */ 7029 char *name; 7030 7031 switch (r->secure) { 7032 case ARM_CP_SECSTATE_S: 7033 case ARM_CP_SECSTATE_NS: 7034 add_cpreg_to_hashtable(cpu, r, opaque, state, 7035 r->secure, crm, opc1, opc2, 7036 r->name); 7037 break; 7038 default: 7039 name = g_strdup_printf("%s_S", r->name); 7040 add_cpreg_to_hashtable(cpu, r, opaque, state, 7041 ARM_CP_SECSTATE_S, 7042 crm, opc1, opc2, name); 7043 g_free(name); 7044 add_cpreg_to_hashtable(cpu, r, opaque, state, 7045 ARM_CP_SECSTATE_NS, 7046 crm, opc1, opc2, r->name); 7047 break; 7048 } 7049 } else { 7050 /* AArch64 registers get mapped to non-secure instance 7051 * of AArch32 */ 7052 add_cpreg_to_hashtable(cpu, r, opaque, state, 7053 ARM_CP_SECSTATE_NS, 7054 crm, opc1, opc2, r->name); 7055 } 7056 } 7057 } 7058 } 7059 } 7060 } 7061 7062 void define_arm_cp_regs_with_opaque(ARMCPU *cpu, 7063 const ARMCPRegInfo *regs, void *opaque) 7064 { 7065 /* Define a whole list of registers */ 7066 const ARMCPRegInfo *r; 7067 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 7068 define_one_arm_cp_reg_with_opaque(cpu, r, opaque); 7069 } 7070 } 7071 7072 /* 7073 * Modify ARMCPRegInfo for access from userspace. 7074 * 7075 * This is a data driven modification directed by 7076 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as 7077 * user-space cannot alter any values and dynamic values pertaining to 7078 * execution state are hidden from user space view anyway. 7079 */ 7080 void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods) 7081 { 7082 const ARMCPRegUserSpaceInfo *m; 7083 ARMCPRegInfo *r; 7084 7085 for (m = mods; m->name; m++) { 7086 GPatternSpec *pat = NULL; 7087 if (m->is_glob) { 7088 pat = g_pattern_spec_new(m->name); 7089 } 7090 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 7091 if (pat && g_pattern_match_string(pat, r->name)) { 7092 r->type = ARM_CP_CONST; 7093 r->access = PL0U_R; 7094 r->resetvalue = 0; 7095 /* continue */ 7096 } else if (strcmp(r->name, m->name) == 0) { 7097 r->type = ARM_CP_CONST; 7098 r->access = PL0U_R; 7099 r->resetvalue &= m->exported_bits; 7100 r->resetvalue |= m->fixed_bits; 7101 break; 7102 } 7103 } 7104 if (pat) { 7105 g_pattern_spec_free(pat); 7106 } 7107 } 7108 } 7109 7110 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 7111 { 7112 return g_hash_table_lookup(cpregs, &encoded_cp); 7113 } 7114 7115 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 7116 uint64_t value) 7117 { 7118 /* Helper coprocessor write function for write-ignore registers */ 7119 } 7120 7121 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 7122 { 7123 /* Helper coprocessor write function for read-as-zero registers */ 7124 return 0; 7125 } 7126 7127 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 7128 { 7129 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 7130 } 7131 7132 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 7133 { 7134 /* Return true if it is not valid for us to switch to 7135 * this CPU mode (ie all the UNPREDICTABLE cases in 7136 * the ARM ARM CPSRWriteByInstr pseudocode). 7137 */ 7138 7139 /* Changes to or from Hyp via MSR and CPS are illegal. */ 7140 if (write_type == CPSRWriteByInstr && 7141 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 7142 mode == ARM_CPU_MODE_HYP)) { 7143 return 1; 7144 } 7145 7146 switch (mode) { 7147 case ARM_CPU_MODE_USR: 7148 return 0; 7149 case ARM_CPU_MODE_SYS: 7150 case ARM_CPU_MODE_SVC: 7151 case ARM_CPU_MODE_ABT: 7152 case ARM_CPU_MODE_UND: 7153 case ARM_CPU_MODE_IRQ: 7154 case ARM_CPU_MODE_FIQ: 7155 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7 7156 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 7157 */ 7158 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 7159 * and CPS are treated as illegal mode changes. 7160 */ 7161 if (write_type == CPSRWriteByInstr && 7162 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 7163 (arm_hcr_el2_eff(env) & HCR_TGE)) { 7164 return 1; 7165 } 7166 return 0; 7167 case ARM_CPU_MODE_HYP: 7168 return !arm_feature(env, ARM_FEATURE_EL2) 7169 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env); 7170 case ARM_CPU_MODE_MON: 7171 return arm_current_el(env) < 3; 7172 default: 7173 return 1; 7174 } 7175 } 7176 7177 uint32_t cpsr_read(CPUARMState *env) 7178 { 7179 int ZF; 7180 ZF = (env->ZF == 0); 7181 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 7182 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 7183 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 7184 | ((env->condexec_bits & 0xfc) << 8) 7185 | (env->GE << 16) | (env->daif & CPSR_AIF); 7186 } 7187 7188 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 7189 CPSRWriteType write_type) 7190 { 7191 uint32_t changed_daif; 7192 7193 if (mask & CPSR_NZCV) { 7194 env->ZF = (~val) & CPSR_Z; 7195 env->NF = val; 7196 env->CF = (val >> 29) & 1; 7197 env->VF = (val << 3) & 0x80000000; 7198 } 7199 if (mask & CPSR_Q) 7200 env->QF = ((val & CPSR_Q) != 0); 7201 if (mask & CPSR_T) 7202 env->thumb = ((val & CPSR_T) != 0); 7203 if (mask & CPSR_IT_0_1) { 7204 env->condexec_bits &= ~3; 7205 env->condexec_bits |= (val >> 25) & 3; 7206 } 7207 if (mask & CPSR_IT_2_7) { 7208 env->condexec_bits &= 3; 7209 env->condexec_bits |= (val >> 8) & 0xfc; 7210 } 7211 if (mask & CPSR_GE) { 7212 env->GE = (val >> 16) & 0xf; 7213 } 7214 7215 /* In a V7 implementation that includes the security extensions but does 7216 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 7217 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 7218 * bits respectively. 7219 * 7220 * In a V8 implementation, it is permitted for privileged software to 7221 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 7222 */ 7223 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 7224 arm_feature(env, ARM_FEATURE_EL3) && 7225 !arm_feature(env, ARM_FEATURE_EL2) && 7226 !arm_is_secure(env)) { 7227 7228 changed_daif = (env->daif ^ val) & mask; 7229 7230 if (changed_daif & CPSR_A) { 7231 /* Check to see if we are allowed to change the masking of async 7232 * abort exceptions from a non-secure state. 7233 */ 7234 if (!(env->cp15.scr_el3 & SCR_AW)) { 7235 qemu_log_mask(LOG_GUEST_ERROR, 7236 "Ignoring attempt to switch CPSR_A flag from " 7237 "non-secure world with SCR.AW bit clear\n"); 7238 mask &= ~CPSR_A; 7239 } 7240 } 7241 7242 if (changed_daif & CPSR_F) { 7243 /* Check to see if we are allowed to change the masking of FIQ 7244 * exceptions from a non-secure state. 7245 */ 7246 if (!(env->cp15.scr_el3 & SCR_FW)) { 7247 qemu_log_mask(LOG_GUEST_ERROR, 7248 "Ignoring attempt to switch CPSR_F flag from " 7249 "non-secure world with SCR.FW bit clear\n"); 7250 mask &= ~CPSR_F; 7251 } 7252 7253 /* Check whether non-maskable FIQ (NMFI) support is enabled. 7254 * If this bit is set software is not allowed to mask 7255 * FIQs, but is allowed to set CPSR_F to 0. 7256 */ 7257 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 7258 (val & CPSR_F)) { 7259 qemu_log_mask(LOG_GUEST_ERROR, 7260 "Ignoring attempt to enable CPSR_F flag " 7261 "(non-maskable FIQ [NMFI] support enabled)\n"); 7262 mask &= ~CPSR_F; 7263 } 7264 } 7265 } 7266 7267 env->daif &= ~(CPSR_AIF & mask); 7268 env->daif |= val & CPSR_AIF & mask; 7269 7270 if (write_type != CPSRWriteRaw && 7271 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 7272 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 7273 /* Note that we can only get here in USR mode if this is a 7274 * gdb stub write; for this case we follow the architectural 7275 * behaviour for guest writes in USR mode of ignoring an attempt 7276 * to switch mode. (Those are caught by translate.c for writes 7277 * triggered by guest instructions.) 7278 */ 7279 mask &= ~CPSR_M; 7280 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 7281 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in 7282 * v7, and has defined behaviour in v8: 7283 * + leave CPSR.M untouched 7284 * + allow changes to the other CPSR fields 7285 * + set PSTATE.IL 7286 * For user changes via the GDB stub, we don't set PSTATE.IL, 7287 * as this would be unnecessarily harsh for a user error. 7288 */ 7289 mask &= ~CPSR_M; 7290 if (write_type != CPSRWriteByGDBStub && 7291 arm_feature(env, ARM_FEATURE_V8)) { 7292 mask |= CPSR_IL; 7293 val |= CPSR_IL; 7294 } 7295 qemu_log_mask(LOG_GUEST_ERROR, 7296 "Illegal AArch32 mode switch attempt from %s to %s\n", 7297 aarch32_mode_name(env->uncached_cpsr), 7298 aarch32_mode_name(val)); 7299 } else { 7300 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 7301 write_type == CPSRWriteExceptionReturn ? 7302 "Exception return from AArch32" : 7303 "AArch32 mode switch from", 7304 aarch32_mode_name(env->uncached_cpsr), 7305 aarch32_mode_name(val), env->regs[15]); 7306 switch_mode(env, val & CPSR_M); 7307 } 7308 } 7309 mask &= ~CACHED_CPSR_BITS; 7310 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 7311 } 7312 7313 /* Sign/zero extend */ 7314 uint32_t HELPER(sxtb16)(uint32_t x) 7315 { 7316 uint32_t res; 7317 res = (uint16_t)(int8_t)x; 7318 res |= (uint32_t)(int8_t)(x >> 16) << 16; 7319 return res; 7320 } 7321 7322 uint32_t HELPER(uxtb16)(uint32_t x) 7323 { 7324 uint32_t res; 7325 res = (uint16_t)(uint8_t)x; 7326 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 7327 return res; 7328 } 7329 7330 int32_t HELPER(sdiv)(int32_t num, int32_t den) 7331 { 7332 if (den == 0) 7333 return 0; 7334 if (num == INT_MIN && den == -1) 7335 return INT_MIN; 7336 return num / den; 7337 } 7338 7339 uint32_t HELPER(udiv)(uint32_t num, uint32_t den) 7340 { 7341 if (den == 0) 7342 return 0; 7343 return num / den; 7344 } 7345 7346 uint32_t HELPER(rbit)(uint32_t x) 7347 { 7348 return revbit32(x); 7349 } 7350 7351 #ifdef CONFIG_USER_ONLY 7352 7353 /* These should probably raise undefined insn exceptions. */ 7354 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val) 7355 { 7356 ARMCPU *cpu = arm_env_get_cpu(env); 7357 7358 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg); 7359 } 7360 7361 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) 7362 { 7363 ARMCPU *cpu = arm_env_get_cpu(env); 7364 7365 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg); 7366 return 0; 7367 } 7368 7369 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest) 7370 { 7371 /* translate.c should never generate calls here in user-only mode */ 7372 g_assert_not_reached(); 7373 } 7374 7375 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest) 7376 { 7377 /* translate.c should never generate calls here in user-only mode */ 7378 g_assert_not_reached(); 7379 } 7380 7381 void HELPER(v7m_preserve_fp_state)(CPUARMState *env) 7382 { 7383 /* translate.c should never generate calls here in user-only mode */ 7384 g_assert_not_reached(); 7385 } 7386 7387 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr) 7388 { 7389 /* translate.c should never generate calls here in user-only mode */ 7390 g_assert_not_reached(); 7391 } 7392 7393 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr) 7394 { 7395 /* translate.c should never generate calls here in user-only mode */ 7396 g_assert_not_reached(); 7397 } 7398 7399 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) 7400 { 7401 /* The TT instructions can be used by unprivileged code, but in 7402 * user-only emulation we don't have the MPU. 7403 * Luckily since we know we are NonSecure unprivileged (and that in 7404 * turn means that the A flag wasn't specified), all the bits in the 7405 * register must be zero: 7406 * IREGION: 0 because IRVALID is 0 7407 * IRVALID: 0 because NS 7408 * S: 0 because NS 7409 * NSRW: 0 because NS 7410 * NSR: 0 because NS 7411 * RW: 0 because unpriv and A flag not set 7412 * R: 0 because unpriv and A flag not set 7413 * SRVALID: 0 because NS 7414 * MRVALID: 0 because unpriv and A flag not set 7415 * SREGION: 0 becaus SRVALID is 0 7416 * MREGION: 0 because MRVALID is 0 7417 */ 7418 return 0; 7419 } 7420 7421 static void switch_mode(CPUARMState *env, int mode) 7422 { 7423 ARMCPU *cpu = arm_env_get_cpu(env); 7424 7425 if (mode != ARM_CPU_MODE_USR) { 7426 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 7427 } 7428 } 7429 7430 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7431 uint32_t cur_el, bool secure) 7432 { 7433 return 1; 7434 } 7435 7436 void aarch64_sync_64_to_32(CPUARMState *env) 7437 { 7438 g_assert_not_reached(); 7439 } 7440 7441 #else 7442 7443 static void switch_mode(CPUARMState *env, int mode) 7444 { 7445 int old_mode; 7446 int i; 7447 7448 old_mode = env->uncached_cpsr & CPSR_M; 7449 if (mode == old_mode) 7450 return; 7451 7452 if (old_mode == ARM_CPU_MODE_FIQ) { 7453 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7454 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 7455 } else if (mode == ARM_CPU_MODE_FIQ) { 7456 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7457 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 7458 } 7459 7460 i = bank_number(old_mode); 7461 env->banked_r13[i] = env->regs[13]; 7462 env->banked_spsr[i] = env->spsr; 7463 7464 i = bank_number(mode); 7465 env->regs[13] = env->banked_r13[i]; 7466 env->spsr = env->banked_spsr[i]; 7467 7468 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 7469 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 7470 } 7471 7472 /* Physical Interrupt Target EL Lookup Table 7473 * 7474 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 7475 * 7476 * The below multi-dimensional table is used for looking up the target 7477 * exception level given numerous condition criteria. Specifically, the 7478 * target EL is based on SCR and HCR routing controls as well as the 7479 * currently executing EL and secure state. 7480 * 7481 * Dimensions: 7482 * target_el_table[2][2][2][2][2][4] 7483 * | | | | | +--- Current EL 7484 * | | | | +------ Non-secure(0)/Secure(1) 7485 * | | | +--------- HCR mask override 7486 * | | +------------ SCR exec state control 7487 * | +--------------- SCR mask override 7488 * +------------------ 32-bit(0)/64-bit(1) EL3 7489 * 7490 * The table values are as such: 7491 * 0-3 = EL0-EL3 7492 * -1 = Cannot occur 7493 * 7494 * The ARM ARM target EL table includes entries indicating that an "exception 7495 * is not taken". The two cases where this is applicable are: 7496 * 1) An exception is taken from EL3 but the SCR does not have the exception 7497 * routed to EL3. 7498 * 2) An exception is taken from EL2 but the HCR does not have the exception 7499 * routed to EL2. 7500 * In these two cases, the below table contain a target of EL1. This value is 7501 * returned as it is expected that the consumer of the table data will check 7502 * for "target EL >= current EL" to ensure the exception is not taken. 7503 * 7504 * SCR HCR 7505 * 64 EA AMO From 7506 * BIT IRQ IMO Non-secure Secure 7507 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 7508 */ 7509 static const int8_t target_el_table[2][2][2][2][2][4] = { 7510 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7511 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 7512 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7513 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 7514 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7515 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 7516 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7517 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 7518 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 7519 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},}, 7520 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },}, 7521 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},}, 7522 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7523 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 7524 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7525 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},}, 7526 }; 7527 7528 /* 7529 * Determine the target EL for physical exceptions 7530 */ 7531 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7532 uint32_t cur_el, bool secure) 7533 { 7534 CPUARMState *env = cs->env_ptr; 7535 bool rw; 7536 bool scr; 7537 bool hcr; 7538 int target_el; 7539 /* Is the highest EL AArch64? */ 7540 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 7541 uint64_t hcr_el2; 7542 7543 if (arm_feature(env, ARM_FEATURE_EL3)) { 7544 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 7545 } else { 7546 /* Either EL2 is the highest EL (and so the EL2 register width 7547 * is given by is64); or there is no EL2 or EL3, in which case 7548 * the value of 'rw' does not affect the table lookup anyway. 7549 */ 7550 rw = is64; 7551 } 7552 7553 hcr_el2 = arm_hcr_el2_eff(env); 7554 switch (excp_idx) { 7555 case EXCP_IRQ: 7556 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 7557 hcr = hcr_el2 & HCR_IMO; 7558 break; 7559 case EXCP_FIQ: 7560 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 7561 hcr = hcr_el2 & HCR_FMO; 7562 break; 7563 default: 7564 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 7565 hcr = hcr_el2 & HCR_AMO; 7566 break; 7567 }; 7568 7569 /* Perform a table-lookup for the target EL given the current state */ 7570 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 7571 7572 assert(target_el > 0); 7573 7574 return target_el; 7575 } 7576 7577 /* 7578 * Return true if the v7M CPACR permits access to the FPU for the specified 7579 * security state and privilege level. 7580 */ 7581 static bool v7m_cpacr_pass(CPUARMState *env, bool is_secure, bool is_priv) 7582 { 7583 switch (extract32(env->v7m.cpacr[is_secure], 20, 2)) { 7584 case 0: 7585 case 2: /* UNPREDICTABLE: we treat like 0 */ 7586 return false; 7587 case 1: 7588 return is_priv; 7589 case 3: 7590 return true; 7591 default: 7592 g_assert_not_reached(); 7593 } 7594 } 7595 7596 /* 7597 * What kind of stack write are we doing? This affects how exceptions 7598 * generated during the stacking are treated. 7599 */ 7600 typedef enum StackingMode { 7601 STACK_NORMAL, 7602 STACK_IGNFAULTS, 7603 STACK_LAZYFP, 7604 } StackingMode; 7605 7606 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value, 7607 ARMMMUIdx mmu_idx, StackingMode mode) 7608 { 7609 CPUState *cs = CPU(cpu); 7610 CPUARMState *env = &cpu->env; 7611 MemTxAttrs attrs = {}; 7612 MemTxResult txres; 7613 target_ulong page_size; 7614 hwaddr physaddr; 7615 int prot; 7616 ARMMMUFaultInfo fi = {}; 7617 bool secure = mmu_idx & ARM_MMU_IDX_M_S; 7618 int exc; 7619 bool exc_secure; 7620 7621 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr, 7622 &attrs, &prot, &page_size, &fi, NULL)) { 7623 /* MPU/SAU lookup failed */ 7624 if (fi.type == ARMFault_QEMU_SFault) { 7625 if (mode == STACK_LAZYFP) { 7626 qemu_log_mask(CPU_LOG_INT, 7627 "...SecureFault with SFSR.LSPERR " 7628 "during lazy stacking\n"); 7629 env->v7m.sfsr |= R_V7M_SFSR_LSPERR_MASK; 7630 } else { 7631 qemu_log_mask(CPU_LOG_INT, 7632 "...SecureFault with SFSR.AUVIOL " 7633 "during stacking\n"); 7634 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK; 7635 } 7636 env->v7m.sfsr |= R_V7M_SFSR_SFARVALID_MASK; 7637 env->v7m.sfar = addr; 7638 exc = ARMV7M_EXCP_SECURE; 7639 exc_secure = false; 7640 } else { 7641 if (mode == STACK_LAZYFP) { 7642 qemu_log_mask(CPU_LOG_INT, 7643 "...MemManageFault with CFSR.MLSPERR\n"); 7644 env->v7m.cfsr[secure] |= R_V7M_CFSR_MLSPERR_MASK; 7645 } else { 7646 qemu_log_mask(CPU_LOG_INT, 7647 "...MemManageFault with CFSR.MSTKERR\n"); 7648 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK; 7649 } 7650 exc = ARMV7M_EXCP_MEM; 7651 exc_secure = secure; 7652 } 7653 goto pend_fault; 7654 } 7655 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value, 7656 attrs, &txres); 7657 if (txres != MEMTX_OK) { 7658 /* BusFault trying to write the data */ 7659 if (mode == STACK_LAZYFP) { 7660 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.LSPERR\n"); 7661 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_LSPERR_MASK; 7662 } else { 7663 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n"); 7664 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK; 7665 } 7666 exc = ARMV7M_EXCP_BUS; 7667 exc_secure = false; 7668 goto pend_fault; 7669 } 7670 return true; 7671 7672 pend_fault: 7673 /* By pending the exception at this point we are making 7674 * the IMPDEF choice "overridden exceptions pended" (see the 7675 * MergeExcInfo() pseudocode). The other choice would be to not 7676 * pend them now and then make a choice about which to throw away 7677 * later if we have two derived exceptions. 7678 * The only case when we must not pend the exception but instead 7679 * throw it away is if we are doing the push of the callee registers 7680 * and we've already generated a derived exception (this is indicated 7681 * by the caller passing STACK_IGNFAULTS). Even in this case we will 7682 * still update the fault status registers. 7683 */ 7684 switch (mode) { 7685 case STACK_NORMAL: 7686 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure); 7687 break; 7688 case STACK_LAZYFP: 7689 armv7m_nvic_set_pending_lazyfp(env->nvic, exc, exc_secure); 7690 break; 7691 case STACK_IGNFAULTS: 7692 break; 7693 } 7694 return false; 7695 } 7696 7697 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr, 7698 ARMMMUIdx mmu_idx) 7699 { 7700 CPUState *cs = CPU(cpu); 7701 CPUARMState *env = &cpu->env; 7702 MemTxAttrs attrs = {}; 7703 MemTxResult txres; 7704 target_ulong page_size; 7705 hwaddr physaddr; 7706 int prot; 7707 ARMMMUFaultInfo fi = {}; 7708 bool secure = mmu_idx & ARM_MMU_IDX_M_S; 7709 int exc; 7710 bool exc_secure; 7711 uint32_t value; 7712 7713 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr, 7714 &attrs, &prot, &page_size, &fi, NULL)) { 7715 /* MPU/SAU lookup failed */ 7716 if (fi.type == ARMFault_QEMU_SFault) { 7717 qemu_log_mask(CPU_LOG_INT, 7718 "...SecureFault with SFSR.AUVIOL during unstack\n"); 7719 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK; 7720 env->v7m.sfar = addr; 7721 exc = ARMV7M_EXCP_SECURE; 7722 exc_secure = false; 7723 } else { 7724 qemu_log_mask(CPU_LOG_INT, 7725 "...MemManageFault with CFSR.MUNSTKERR\n"); 7726 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK; 7727 exc = ARMV7M_EXCP_MEM; 7728 exc_secure = secure; 7729 } 7730 goto pend_fault; 7731 } 7732 7733 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr, 7734 attrs, &txres); 7735 if (txres != MEMTX_OK) { 7736 /* BusFault trying to read the data */ 7737 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n"); 7738 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK; 7739 exc = ARMV7M_EXCP_BUS; 7740 exc_secure = false; 7741 goto pend_fault; 7742 } 7743 7744 *dest = value; 7745 return true; 7746 7747 pend_fault: 7748 /* By pending the exception at this point we are making 7749 * the IMPDEF choice "overridden exceptions pended" (see the 7750 * MergeExcInfo() pseudocode). The other choice would be to not 7751 * pend them now and then make a choice about which to throw away 7752 * later if we have two derived exceptions. 7753 */ 7754 armv7m_nvic_set_pending(env->nvic, exc, exc_secure); 7755 return false; 7756 } 7757 7758 void HELPER(v7m_preserve_fp_state)(CPUARMState *env) 7759 { 7760 /* 7761 * Preserve FP state (because LSPACT was set and we are about 7762 * to execute an FP instruction). This corresponds to the 7763 * PreserveFPState() pseudocode. 7764 * We may throw an exception if the stacking fails. 7765 */ 7766 ARMCPU *cpu = arm_env_get_cpu(env); 7767 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 7768 bool negpri = !(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_HFRDY_MASK); 7769 bool is_priv = !(env->v7m.fpccr[is_secure] & R_V7M_FPCCR_USER_MASK); 7770 bool splimviol = env->v7m.fpccr[is_secure] & R_V7M_FPCCR_SPLIMVIOL_MASK; 7771 uint32_t fpcar = env->v7m.fpcar[is_secure]; 7772 bool stacked_ok = true; 7773 bool ts = is_secure && (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK); 7774 bool take_exception; 7775 7776 /* Take the iothread lock as we are going to touch the NVIC */ 7777 qemu_mutex_lock_iothread(); 7778 7779 /* Check the background context had access to the FPU */ 7780 if (!v7m_cpacr_pass(env, is_secure, is_priv)) { 7781 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, is_secure); 7782 env->v7m.cfsr[is_secure] |= R_V7M_CFSR_NOCP_MASK; 7783 stacked_ok = false; 7784 } else if (!is_secure && !extract32(env->v7m.nsacr, 10, 1)) { 7785 armv7m_nvic_set_pending_lazyfp(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S); 7786 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK; 7787 stacked_ok = false; 7788 } 7789 7790 if (!splimviol && stacked_ok) { 7791 /* We only stack if the stack limit wasn't violated */ 7792 int i; 7793 ARMMMUIdx mmu_idx; 7794 7795 mmu_idx = arm_v7m_mmu_idx_all(env, is_secure, is_priv, negpri); 7796 for (i = 0; i < (ts ? 32 : 16); i += 2) { 7797 uint64_t dn = *aa32_vfp_dreg(env, i / 2); 7798 uint32_t faddr = fpcar + 4 * i; 7799 uint32_t slo = extract64(dn, 0, 32); 7800 uint32_t shi = extract64(dn, 32, 32); 7801 7802 if (i >= 16) { 7803 faddr += 8; /* skip the slot for the FPSCR */ 7804 } 7805 stacked_ok = stacked_ok && 7806 v7m_stack_write(cpu, faddr, slo, mmu_idx, STACK_LAZYFP) && 7807 v7m_stack_write(cpu, faddr + 4, shi, mmu_idx, STACK_LAZYFP); 7808 } 7809 7810 stacked_ok = stacked_ok && 7811 v7m_stack_write(cpu, fpcar + 0x40, 7812 vfp_get_fpscr(env), mmu_idx, STACK_LAZYFP); 7813 } 7814 7815 /* 7816 * We definitely pended an exception, but it's possible that it 7817 * might not be able to be taken now. If its priority permits us 7818 * to take it now, then we must not update the LSPACT or FP regs, 7819 * but instead jump out to take the exception immediately. 7820 * If it's just pending and won't be taken until the current 7821 * handler exits, then we do update LSPACT and the FP regs. 7822 */ 7823 take_exception = !stacked_ok && 7824 armv7m_nvic_can_take_pending_exception(env->nvic); 7825 7826 qemu_mutex_unlock_iothread(); 7827 7828 if (take_exception) { 7829 raise_exception_ra(env, EXCP_LAZYFP, 0, 1, GETPC()); 7830 } 7831 7832 env->v7m.fpccr[is_secure] &= ~R_V7M_FPCCR_LSPACT_MASK; 7833 7834 if (ts) { 7835 /* Clear s0 to s31 and the FPSCR */ 7836 int i; 7837 7838 for (i = 0; i < 32; i += 2) { 7839 *aa32_vfp_dreg(env, i / 2) = 0; 7840 } 7841 vfp_set_fpscr(env, 0); 7842 } 7843 /* 7844 * Otherwise s0 to s15 and FPSCR are UNKNOWN; we choose to leave them 7845 * unchanged. 7846 */ 7847 } 7848 7849 /* Write to v7M CONTROL.SPSEL bit for the specified security bank. 7850 * This may change the current stack pointer between Main and Process 7851 * stack pointers if it is done for the CONTROL register for the current 7852 * security state. 7853 */ 7854 static void write_v7m_control_spsel_for_secstate(CPUARMState *env, 7855 bool new_spsel, 7856 bool secstate) 7857 { 7858 bool old_is_psp = v7m_using_psp(env); 7859 7860 env->v7m.control[secstate] = 7861 deposit32(env->v7m.control[secstate], 7862 R_V7M_CONTROL_SPSEL_SHIFT, 7863 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel); 7864 7865 if (secstate == env->v7m.secure) { 7866 bool new_is_psp = v7m_using_psp(env); 7867 uint32_t tmp; 7868 7869 if (old_is_psp != new_is_psp) { 7870 tmp = env->v7m.other_sp; 7871 env->v7m.other_sp = env->regs[13]; 7872 env->regs[13] = tmp; 7873 } 7874 } 7875 } 7876 7877 /* Write to v7M CONTROL.SPSEL bit. This may change the current 7878 * stack pointer between Main and Process stack pointers. 7879 */ 7880 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel) 7881 { 7882 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure); 7883 } 7884 7885 void write_v7m_exception(CPUARMState *env, uint32_t new_exc) 7886 { 7887 /* Write a new value to v7m.exception, thus transitioning into or out 7888 * of Handler mode; this may result in a change of active stack pointer. 7889 */ 7890 bool new_is_psp, old_is_psp = v7m_using_psp(env); 7891 uint32_t tmp; 7892 7893 env->v7m.exception = new_exc; 7894 7895 new_is_psp = v7m_using_psp(env); 7896 7897 if (old_is_psp != new_is_psp) { 7898 tmp = env->v7m.other_sp; 7899 env->v7m.other_sp = env->regs[13]; 7900 env->regs[13] = tmp; 7901 } 7902 } 7903 7904 /* Switch M profile security state between NS and S */ 7905 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate) 7906 { 7907 uint32_t new_ss_msp, new_ss_psp; 7908 7909 if (env->v7m.secure == new_secstate) { 7910 return; 7911 } 7912 7913 /* All the banked state is accessed by looking at env->v7m.secure 7914 * except for the stack pointer; rearrange the SP appropriately. 7915 */ 7916 new_ss_msp = env->v7m.other_ss_msp; 7917 new_ss_psp = env->v7m.other_ss_psp; 7918 7919 if (v7m_using_psp(env)) { 7920 env->v7m.other_ss_psp = env->regs[13]; 7921 env->v7m.other_ss_msp = env->v7m.other_sp; 7922 } else { 7923 env->v7m.other_ss_msp = env->regs[13]; 7924 env->v7m.other_ss_psp = env->v7m.other_sp; 7925 } 7926 7927 env->v7m.secure = new_secstate; 7928 7929 if (v7m_using_psp(env)) { 7930 env->regs[13] = new_ss_psp; 7931 env->v7m.other_sp = new_ss_msp; 7932 } else { 7933 env->regs[13] = new_ss_msp; 7934 env->v7m.other_sp = new_ss_psp; 7935 } 7936 } 7937 7938 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest) 7939 { 7940 /* Handle v7M BXNS: 7941 * - if the return value is a magic value, do exception return (like BX) 7942 * - otherwise bit 0 of the return value is the target security state 7943 */ 7944 uint32_t min_magic; 7945 7946 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7947 /* Covers FNC_RETURN and EXC_RETURN magic */ 7948 min_magic = FNC_RETURN_MIN_MAGIC; 7949 } else { 7950 /* EXC_RETURN magic only */ 7951 min_magic = EXC_RETURN_MIN_MAGIC; 7952 } 7953 7954 if (dest >= min_magic) { 7955 /* This is an exception return magic value; put it where 7956 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT. 7957 * Note that if we ever add gen_ss_advance() singlestep support to 7958 * M profile this should count as an "instruction execution complete" 7959 * event (compare gen_bx_excret_final_code()). 7960 */ 7961 env->regs[15] = dest & ~1; 7962 env->thumb = dest & 1; 7963 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT); 7964 /* notreached */ 7965 } 7966 7967 /* translate.c should have made BXNS UNDEF unless we're secure */ 7968 assert(env->v7m.secure); 7969 7970 if (!(dest & 1)) { 7971 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 7972 } 7973 switch_v7m_security_state(env, dest & 1); 7974 env->thumb = 1; 7975 env->regs[15] = dest & ~1; 7976 } 7977 7978 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest) 7979 { 7980 /* Handle v7M BLXNS: 7981 * - bit 0 of the destination address is the target security state 7982 */ 7983 7984 /* At this point regs[15] is the address just after the BLXNS */ 7985 uint32_t nextinst = env->regs[15] | 1; 7986 uint32_t sp = env->regs[13] - 8; 7987 uint32_t saved_psr; 7988 7989 /* translate.c will have made BLXNS UNDEF unless we're secure */ 7990 assert(env->v7m.secure); 7991 7992 if (dest & 1) { 7993 /* target is Secure, so this is just a normal BLX, 7994 * except that the low bit doesn't indicate Thumb/not. 7995 */ 7996 env->regs[14] = nextinst; 7997 env->thumb = 1; 7998 env->regs[15] = dest & ~1; 7999 return; 8000 } 8001 8002 /* Target is non-secure: first push a stack frame */ 8003 if (!QEMU_IS_ALIGNED(sp, 8)) { 8004 qemu_log_mask(LOG_GUEST_ERROR, 8005 "BLXNS with misaligned SP is UNPREDICTABLE\n"); 8006 } 8007 8008 if (sp < v7m_sp_limit(env)) { 8009 raise_exception(env, EXCP_STKOF, 0, 1); 8010 } 8011 8012 saved_psr = env->v7m.exception; 8013 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) { 8014 saved_psr |= XPSR_SFPA; 8015 } 8016 8017 /* Note that these stores can throw exceptions on MPU faults */ 8018 cpu_stl_data(env, sp, nextinst); 8019 cpu_stl_data(env, sp + 4, saved_psr); 8020 8021 env->regs[13] = sp; 8022 env->regs[14] = 0xfeffffff; 8023 if (arm_v7m_is_handler_mode(env)) { 8024 /* Write a dummy value to IPSR, to avoid leaking the current secure 8025 * exception number to non-secure code. This is guaranteed not 8026 * to cause write_v7m_exception() to actually change stacks. 8027 */ 8028 write_v7m_exception(env, 1); 8029 } 8030 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 8031 switch_v7m_security_state(env, 0); 8032 env->thumb = 1; 8033 env->regs[15] = dest; 8034 } 8035 8036 static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode, 8037 bool spsel) 8038 { 8039 /* Return a pointer to the location where we currently store the 8040 * stack pointer for the requested security state and thread mode. 8041 * This pointer will become invalid if the CPU state is updated 8042 * such that the stack pointers are switched around (eg changing 8043 * the SPSEL control bit). 8044 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode(). 8045 * Unlike that pseudocode, we require the caller to pass us in the 8046 * SPSEL control bit value; this is because we also use this 8047 * function in handling of pushing of the callee-saves registers 8048 * part of the v8M stack frame (pseudocode PushCalleeStack()), 8049 * and in the tailchain codepath the SPSEL bit comes from the exception 8050 * return magic LR value from the previous exception. The pseudocode 8051 * opencodes the stack-selection in PushCalleeStack(), but we prefer 8052 * to make this utility function generic enough to do the job. 8053 */ 8054 bool want_psp = threadmode && spsel; 8055 8056 if (secure == env->v7m.secure) { 8057 if (want_psp == v7m_using_psp(env)) { 8058 return &env->regs[13]; 8059 } else { 8060 return &env->v7m.other_sp; 8061 } 8062 } else { 8063 if (want_psp) { 8064 return &env->v7m.other_ss_psp; 8065 } else { 8066 return &env->v7m.other_ss_msp; 8067 } 8068 } 8069 } 8070 8071 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure, 8072 uint32_t *pvec) 8073 { 8074 CPUState *cs = CPU(cpu); 8075 CPUARMState *env = &cpu->env; 8076 MemTxResult result; 8077 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4; 8078 uint32_t vector_entry; 8079 MemTxAttrs attrs = {}; 8080 ARMMMUIdx mmu_idx; 8081 bool exc_secure; 8082 8083 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true); 8084 8085 /* We don't do a get_phys_addr() here because the rules for vector 8086 * loads are special: they always use the default memory map, and 8087 * the default memory map permits reads from all addresses. 8088 * Since there's no easy way to pass through to pmsav8_mpu_lookup() 8089 * that we want this special case which would always say "yes", 8090 * we just do the SAU lookup here followed by a direct physical load. 8091 */ 8092 attrs.secure = targets_secure; 8093 attrs.user = false; 8094 8095 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8096 V8M_SAttributes sattrs = {}; 8097 8098 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs); 8099 if (sattrs.ns) { 8100 attrs.secure = false; 8101 } else if (!targets_secure) { 8102 /* NS access to S memory */ 8103 goto load_fail; 8104 } 8105 } 8106 8107 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr, 8108 attrs, &result); 8109 if (result != MEMTX_OK) { 8110 goto load_fail; 8111 } 8112 *pvec = vector_entry; 8113 return true; 8114 8115 load_fail: 8116 /* All vector table fetch fails are reported as HardFault, with 8117 * HFSR.VECTTBL and .FORCED set. (FORCED is set because 8118 * technically the underlying exception is a MemManage or BusFault 8119 * that is escalated to HardFault.) This is a terminal exception, 8120 * so we will either take the HardFault immediately or else enter 8121 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()). 8122 */ 8123 exc_secure = targets_secure || 8124 !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK); 8125 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK; 8126 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure); 8127 return false; 8128 } 8129 8130 static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr) 8131 { 8132 /* 8133 * Return the integrity signature value for the callee-saves 8134 * stack frame section. @lr is the exception return payload/LR value 8135 * whose FType bit forms bit 0 of the signature if FP is present. 8136 */ 8137 uint32_t sig = 0xfefa125a; 8138 8139 if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) { 8140 sig |= 1; 8141 } 8142 return sig; 8143 } 8144 8145 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain, 8146 bool ignore_faults) 8147 { 8148 /* For v8M, push the callee-saves register part of the stack frame. 8149 * Compare the v8M pseudocode PushCalleeStack(). 8150 * In the tailchaining case this may not be the current stack. 8151 */ 8152 CPUARMState *env = &cpu->env; 8153 uint32_t *frame_sp_p; 8154 uint32_t frameptr; 8155 ARMMMUIdx mmu_idx; 8156 bool stacked_ok; 8157 uint32_t limit; 8158 bool want_psp; 8159 uint32_t sig; 8160 StackingMode smode = ignore_faults ? STACK_IGNFAULTS : STACK_NORMAL; 8161 8162 if (dotailchain) { 8163 bool mode = lr & R_V7M_EXCRET_MODE_MASK; 8164 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) || 8165 !mode; 8166 8167 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv); 8168 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode, 8169 lr & R_V7M_EXCRET_SPSEL_MASK); 8170 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK); 8171 if (want_psp) { 8172 limit = env->v7m.psplim[M_REG_S]; 8173 } else { 8174 limit = env->v7m.msplim[M_REG_S]; 8175 } 8176 } else { 8177 mmu_idx = arm_mmu_idx(env); 8178 frame_sp_p = &env->regs[13]; 8179 limit = v7m_sp_limit(env); 8180 } 8181 8182 frameptr = *frame_sp_p - 0x28; 8183 if (frameptr < limit) { 8184 /* 8185 * Stack limit failure: set SP to the limit value, and generate 8186 * STKOF UsageFault. Stack pushes below the limit must not be 8187 * performed. It is IMPDEF whether pushes above the limit are 8188 * performed; we choose not to. 8189 */ 8190 qemu_log_mask(CPU_LOG_INT, 8191 "...STKOF during callee-saves register stacking\n"); 8192 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 8193 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8194 env->v7m.secure); 8195 *frame_sp_p = limit; 8196 return true; 8197 } 8198 8199 /* Write as much of the stack frame as we can. A write failure may 8200 * cause us to pend a derived exception. 8201 */ 8202 sig = v7m_integrity_sig(env, lr); 8203 stacked_ok = 8204 v7m_stack_write(cpu, frameptr, sig, mmu_idx, smode) && 8205 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, smode) && 8206 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, smode) && 8207 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, smode) && 8208 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, smode) && 8209 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, smode) && 8210 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, smode) && 8211 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, smode) && 8212 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, smode); 8213 8214 /* Update SP regardless of whether any of the stack accesses failed. */ 8215 *frame_sp_p = frameptr; 8216 8217 return !stacked_ok; 8218 } 8219 8220 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain, 8221 bool ignore_stackfaults) 8222 { 8223 /* Do the "take the exception" parts of exception entry, 8224 * but not the pushing of state to the stack. This is 8225 * similar to the pseudocode ExceptionTaken() function. 8226 */ 8227 CPUARMState *env = &cpu->env; 8228 uint32_t addr; 8229 bool targets_secure; 8230 int exc; 8231 bool push_failed = false; 8232 8233 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure); 8234 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n", 8235 targets_secure ? "secure" : "nonsecure", exc); 8236 8237 if (dotailchain) { 8238 /* Sanitize LR FType and PREFIX bits */ 8239 if (!arm_feature(env, ARM_FEATURE_VFP)) { 8240 lr |= R_V7M_EXCRET_FTYPE_MASK; 8241 } 8242 lr = deposit32(lr, 24, 8, 0xff); 8243 } 8244 8245 if (arm_feature(env, ARM_FEATURE_V8)) { 8246 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 8247 (lr & R_V7M_EXCRET_S_MASK)) { 8248 /* The background code (the owner of the registers in the 8249 * exception frame) is Secure. This means it may either already 8250 * have or now needs to push callee-saves registers. 8251 */ 8252 if (targets_secure) { 8253 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) { 8254 /* We took an exception from Secure to NonSecure 8255 * (which means the callee-saved registers got stacked) 8256 * and are now tailchaining to a Secure exception. 8257 * Clear DCRS so eventual return from this Secure 8258 * exception unstacks the callee-saved registers. 8259 */ 8260 lr &= ~R_V7M_EXCRET_DCRS_MASK; 8261 } 8262 } else { 8263 /* We're going to a non-secure exception; push the 8264 * callee-saves registers to the stack now, if they're 8265 * not already saved. 8266 */ 8267 if (lr & R_V7M_EXCRET_DCRS_MASK && 8268 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) { 8269 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain, 8270 ignore_stackfaults); 8271 } 8272 lr |= R_V7M_EXCRET_DCRS_MASK; 8273 } 8274 } 8275 8276 lr &= ~R_V7M_EXCRET_ES_MASK; 8277 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8278 lr |= R_V7M_EXCRET_ES_MASK; 8279 } 8280 lr &= ~R_V7M_EXCRET_SPSEL_MASK; 8281 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) { 8282 lr |= R_V7M_EXCRET_SPSEL_MASK; 8283 } 8284 8285 /* Clear registers if necessary to prevent non-secure exception 8286 * code being able to see register values from secure code. 8287 * Where register values become architecturally UNKNOWN we leave 8288 * them with their previous values. 8289 */ 8290 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8291 if (!targets_secure) { 8292 /* Always clear the caller-saved registers (they have been 8293 * pushed to the stack earlier in v7m_push_stack()). 8294 * Clear callee-saved registers if the background code is 8295 * Secure (in which case these regs were saved in 8296 * v7m_push_callee_stack()). 8297 */ 8298 int i; 8299 8300 for (i = 0; i < 13; i++) { 8301 /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */ 8302 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) { 8303 env->regs[i] = 0; 8304 } 8305 } 8306 /* Clear EAPSR */ 8307 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT); 8308 } 8309 } 8310 } 8311 8312 if (push_failed && !ignore_stackfaults) { 8313 /* Derived exception on callee-saves register stacking: 8314 * we might now want to take a different exception which 8315 * targets a different security state, so try again from the top. 8316 */ 8317 qemu_log_mask(CPU_LOG_INT, 8318 "...derived exception on callee-saves register stacking"); 8319 v7m_exception_taken(cpu, lr, true, true); 8320 return; 8321 } 8322 8323 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) { 8324 /* Vector load failed: derived exception */ 8325 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load"); 8326 v7m_exception_taken(cpu, lr, true, true); 8327 return; 8328 } 8329 8330 /* Now we've done everything that might cause a derived exception 8331 * we can go ahead and activate whichever exception we're going to 8332 * take (which might now be the derived exception). 8333 */ 8334 armv7m_nvic_acknowledge_irq(env->nvic); 8335 8336 /* Switch to target security state -- must do this before writing SPSEL */ 8337 switch_v7m_security_state(env, targets_secure); 8338 write_v7m_control_spsel(env, 0); 8339 arm_clear_exclusive(env); 8340 /* Clear SFPA and FPCA (has no effect if no FPU) */ 8341 env->v7m.control[M_REG_S] &= 8342 ~(R_V7M_CONTROL_FPCA_MASK | R_V7M_CONTROL_SFPA_MASK); 8343 /* Clear IT bits */ 8344 env->condexec_bits = 0; 8345 env->regs[14] = lr; 8346 env->regs[15] = addr & 0xfffffffe; 8347 env->thumb = addr & 1; 8348 } 8349 8350 static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr, 8351 bool apply_splim) 8352 { 8353 /* 8354 * Like the pseudocode UpdateFPCCR: save state in FPCAR and FPCCR 8355 * that we will need later in order to do lazy FP reg stacking. 8356 */ 8357 bool is_secure = env->v7m.secure; 8358 void *nvic = env->nvic; 8359 /* 8360 * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits 8361 * are banked and we want to update the bit in the bank for the 8362 * current security state; and in one case we want to specifically 8363 * update the NS banked version of a bit even if we are secure. 8364 */ 8365 uint32_t *fpccr_s = &env->v7m.fpccr[M_REG_S]; 8366 uint32_t *fpccr_ns = &env->v7m.fpccr[M_REG_NS]; 8367 uint32_t *fpccr = &env->v7m.fpccr[is_secure]; 8368 bool hfrdy, bfrdy, mmrdy, ns_ufrdy, s_ufrdy, sfrdy, monrdy; 8369 8370 env->v7m.fpcar[is_secure] = frameptr & ~0x7; 8371 8372 if (apply_splim && arm_feature(env, ARM_FEATURE_V8)) { 8373 bool splimviol; 8374 uint32_t splim = v7m_sp_limit(env); 8375 bool ign = armv7m_nvic_neg_prio_requested(nvic, is_secure) && 8376 (env->v7m.ccr[is_secure] & R_V7M_CCR_STKOFHFNMIGN_MASK); 8377 8378 splimviol = !ign && frameptr < splim; 8379 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, SPLIMVIOL, splimviol); 8380 } 8381 8382 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, LSPACT, 1); 8383 8384 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, S, is_secure); 8385 8386 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, USER, arm_current_el(env) == 0); 8387 8388 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, THREAD, 8389 !arm_v7m_is_handler_mode(env)); 8390 8391 hfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_HARD, false); 8392 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, HFRDY, hfrdy); 8393 8394 bfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_BUS, false); 8395 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, BFRDY, bfrdy); 8396 8397 mmrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_MEM, is_secure); 8398 *fpccr = FIELD_DP32(*fpccr, V7M_FPCCR, MMRDY, mmrdy); 8399 8400 ns_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, false); 8401 *fpccr_ns = FIELD_DP32(*fpccr_ns, V7M_FPCCR, UFRDY, ns_ufrdy); 8402 8403 monrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_DEBUG, false); 8404 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, MONRDY, monrdy); 8405 8406 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8407 s_ufrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_USAGE, true); 8408 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, UFRDY, s_ufrdy); 8409 8410 sfrdy = armv7m_nvic_get_ready_status(nvic, ARMV7M_EXCP_SECURE, false); 8411 *fpccr_s = FIELD_DP32(*fpccr_s, V7M_FPCCR, SFRDY, sfrdy); 8412 } 8413 } 8414 8415 void HELPER(v7m_vlstm)(CPUARMState *env, uint32_t fptr) 8416 { 8417 /* fptr is the value of Rn, the frame pointer we store the FP regs to */ 8418 bool s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 8419 bool lspact = env->v7m.fpccr[s] & R_V7M_FPCCR_LSPACT_MASK; 8420 8421 assert(env->v7m.secure); 8422 8423 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) { 8424 return; 8425 } 8426 8427 /* Check access to the coprocessor is permitted */ 8428 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) { 8429 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC()); 8430 } 8431 8432 if (lspact) { 8433 /* LSPACT should not be active when there is active FP state */ 8434 raise_exception_ra(env, EXCP_LSERR, 0, 1, GETPC()); 8435 } 8436 8437 if (fptr & 7) { 8438 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC()); 8439 } 8440 8441 /* 8442 * Note that we do not use v7m_stack_write() here, because the 8443 * accesses should not set the FSR bits for stacking errors if they 8444 * fail. (In pseudocode terms, they are AccType_NORMAL, not AccType_STACK 8445 * or AccType_LAZYFP). Faults in cpu_stl_data() will throw exceptions 8446 * and longjmp out. 8447 */ 8448 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) { 8449 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK; 8450 int i; 8451 8452 for (i = 0; i < (ts ? 32 : 16); i += 2) { 8453 uint64_t dn = *aa32_vfp_dreg(env, i / 2); 8454 uint32_t faddr = fptr + 4 * i; 8455 uint32_t slo = extract64(dn, 0, 32); 8456 uint32_t shi = extract64(dn, 32, 32); 8457 8458 if (i >= 16) { 8459 faddr += 8; /* skip the slot for the FPSCR */ 8460 } 8461 cpu_stl_data(env, faddr, slo); 8462 cpu_stl_data(env, faddr + 4, shi); 8463 } 8464 cpu_stl_data(env, fptr + 0x40, vfp_get_fpscr(env)); 8465 8466 /* 8467 * If TS is 0 then s0 to s15 and FPSCR are UNKNOWN; we choose to 8468 * leave them unchanged, matching our choice in v7m_preserve_fp_state. 8469 */ 8470 if (ts) { 8471 for (i = 0; i < 32; i += 2) { 8472 *aa32_vfp_dreg(env, i / 2) = 0; 8473 } 8474 vfp_set_fpscr(env, 0); 8475 } 8476 } else { 8477 v7m_update_fpccr(env, fptr, false); 8478 } 8479 8480 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK; 8481 } 8482 8483 void HELPER(v7m_vlldm)(CPUARMState *env, uint32_t fptr) 8484 { 8485 /* fptr is the value of Rn, the frame pointer we load the FP regs from */ 8486 assert(env->v7m.secure); 8487 8488 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) { 8489 return; 8490 } 8491 8492 /* Check access to the coprocessor is permitted */ 8493 if (!v7m_cpacr_pass(env, true, arm_current_el(env) != 0)) { 8494 raise_exception_ra(env, EXCP_NOCP, 0, 1, GETPC()); 8495 } 8496 8497 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) { 8498 /* State in FP is still valid */ 8499 env->v7m.fpccr[M_REG_S] &= ~R_V7M_FPCCR_LSPACT_MASK; 8500 } else { 8501 bool ts = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK; 8502 int i; 8503 uint32_t fpscr; 8504 8505 if (fptr & 7) { 8506 raise_exception_ra(env, EXCP_UNALIGNED, 0, 1, GETPC()); 8507 } 8508 8509 for (i = 0; i < (ts ? 32 : 16); i += 2) { 8510 uint32_t slo, shi; 8511 uint64_t dn; 8512 uint32_t faddr = fptr + 4 * i; 8513 8514 if (i >= 16) { 8515 faddr += 8; /* skip the slot for the FPSCR */ 8516 } 8517 8518 slo = cpu_ldl_data(env, faddr); 8519 shi = cpu_ldl_data(env, faddr + 4); 8520 8521 dn = (uint64_t) shi << 32 | slo; 8522 *aa32_vfp_dreg(env, i / 2) = dn; 8523 } 8524 fpscr = cpu_ldl_data(env, fptr + 0x40); 8525 vfp_set_fpscr(env, fpscr); 8526 } 8527 8528 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK; 8529 } 8530 8531 static bool v7m_push_stack(ARMCPU *cpu) 8532 { 8533 /* Do the "set up stack frame" part of exception entry, 8534 * similar to pseudocode PushStack(). 8535 * Return true if we generate a derived exception (and so 8536 * should ignore further stack faults trying to process 8537 * that derived exception.) 8538 */ 8539 bool stacked_ok = true, limitviol = false; 8540 CPUARMState *env = &cpu->env; 8541 uint32_t xpsr = xpsr_read(env); 8542 uint32_t frameptr = env->regs[13]; 8543 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 8544 uint32_t framesize; 8545 bool nsacr_cp10 = extract32(env->v7m.nsacr, 10, 1); 8546 8547 if ((env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) && 8548 (env->v7m.secure || nsacr_cp10)) { 8549 if (env->v7m.secure && 8550 env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK) { 8551 framesize = 0xa8; 8552 } else { 8553 framesize = 0x68; 8554 } 8555 } else { 8556 framesize = 0x20; 8557 } 8558 8559 /* Align stack pointer if the guest wants that */ 8560 if ((frameptr & 4) && 8561 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) { 8562 frameptr -= 4; 8563 xpsr |= XPSR_SPREALIGN; 8564 } 8565 8566 xpsr &= ~XPSR_SFPA; 8567 if (env->v7m.secure && 8568 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)) { 8569 xpsr |= XPSR_SFPA; 8570 } 8571 8572 frameptr -= framesize; 8573 8574 if (arm_feature(env, ARM_FEATURE_V8)) { 8575 uint32_t limit = v7m_sp_limit(env); 8576 8577 if (frameptr < limit) { 8578 /* 8579 * Stack limit failure: set SP to the limit value, and generate 8580 * STKOF UsageFault. Stack pushes below the limit must not be 8581 * performed. It is IMPDEF whether pushes above the limit are 8582 * performed; we choose not to. 8583 */ 8584 qemu_log_mask(CPU_LOG_INT, 8585 "...STKOF during stacking\n"); 8586 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 8587 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8588 env->v7m.secure); 8589 env->regs[13] = limit; 8590 /* 8591 * We won't try to perform any further memory accesses but 8592 * we must continue through the following code to check for 8593 * permission faults during FPU state preservation, and we 8594 * must update FPCCR if lazy stacking is enabled. 8595 */ 8596 limitviol = true; 8597 stacked_ok = false; 8598 } 8599 } 8600 8601 /* Write as much of the stack frame as we can. If we fail a stack 8602 * write this will result in a derived exception being pended 8603 * (which may be taken in preference to the one we started with 8604 * if it has higher priority). 8605 */ 8606 stacked_ok = stacked_ok && 8607 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, STACK_NORMAL) && 8608 v7m_stack_write(cpu, frameptr + 4, env->regs[1], 8609 mmu_idx, STACK_NORMAL) && 8610 v7m_stack_write(cpu, frameptr + 8, env->regs[2], 8611 mmu_idx, STACK_NORMAL) && 8612 v7m_stack_write(cpu, frameptr + 12, env->regs[3], 8613 mmu_idx, STACK_NORMAL) && 8614 v7m_stack_write(cpu, frameptr + 16, env->regs[12], 8615 mmu_idx, STACK_NORMAL) && 8616 v7m_stack_write(cpu, frameptr + 20, env->regs[14], 8617 mmu_idx, STACK_NORMAL) && 8618 v7m_stack_write(cpu, frameptr + 24, env->regs[15], 8619 mmu_idx, STACK_NORMAL) && 8620 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, STACK_NORMAL); 8621 8622 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) { 8623 /* FPU is active, try to save its registers */ 8624 bool fpccr_s = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 8625 bool lspact = env->v7m.fpccr[fpccr_s] & R_V7M_FPCCR_LSPACT_MASK; 8626 8627 if (lspact && arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8628 qemu_log_mask(CPU_LOG_INT, 8629 "...SecureFault because LSPACT and FPCA both set\n"); 8630 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; 8631 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8632 } else if (!env->v7m.secure && !nsacr_cp10) { 8633 qemu_log_mask(CPU_LOG_INT, 8634 "...Secure UsageFault with CFSR.NOCP because " 8635 "NSACR.CP10 prevents stacking FP regs\n"); 8636 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, M_REG_S); 8637 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK; 8638 } else { 8639 if (!(env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPEN_MASK)) { 8640 /* Lazy stacking disabled, save registers now */ 8641 int i; 8642 bool cpacr_pass = v7m_cpacr_pass(env, env->v7m.secure, 8643 arm_current_el(env) != 0); 8644 8645 if (stacked_ok && !cpacr_pass) { 8646 /* 8647 * Take UsageFault if CPACR forbids access. The pseudocode 8648 * here does a full CheckCPEnabled() but we know the NSACR 8649 * check can never fail as we have already handled that. 8650 */ 8651 qemu_log_mask(CPU_LOG_INT, 8652 "...UsageFault with CFSR.NOCP because " 8653 "CPACR.CP10 prevents stacking FP regs\n"); 8654 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8655 env->v7m.secure); 8656 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK; 8657 stacked_ok = false; 8658 } 8659 8660 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) { 8661 uint64_t dn = *aa32_vfp_dreg(env, i / 2); 8662 uint32_t faddr = frameptr + 0x20 + 4 * i; 8663 uint32_t slo = extract64(dn, 0, 32); 8664 uint32_t shi = extract64(dn, 32, 32); 8665 8666 if (i >= 16) { 8667 faddr += 8; /* skip the slot for the FPSCR */ 8668 } 8669 stacked_ok = stacked_ok && 8670 v7m_stack_write(cpu, faddr, slo, 8671 mmu_idx, STACK_NORMAL) && 8672 v7m_stack_write(cpu, faddr + 4, shi, 8673 mmu_idx, STACK_NORMAL); 8674 } 8675 stacked_ok = stacked_ok && 8676 v7m_stack_write(cpu, frameptr + 0x60, 8677 vfp_get_fpscr(env), mmu_idx, STACK_NORMAL); 8678 if (cpacr_pass) { 8679 for (i = 0; i < ((framesize == 0xa8) ? 32 : 16); i += 2) { 8680 *aa32_vfp_dreg(env, i / 2) = 0; 8681 } 8682 vfp_set_fpscr(env, 0); 8683 } 8684 } else { 8685 /* Lazy stacking enabled, save necessary info to stack later */ 8686 v7m_update_fpccr(env, frameptr + 0x20, true); 8687 } 8688 } 8689 } 8690 8691 /* 8692 * If we broke a stack limit then SP was already updated earlier; 8693 * otherwise we update SP regardless of whether any of the stack 8694 * accesses failed or we took some other kind of fault. 8695 */ 8696 if (!limitviol) { 8697 env->regs[13] = frameptr; 8698 } 8699 8700 return !stacked_ok; 8701 } 8702 8703 static void do_v7m_exception_exit(ARMCPU *cpu) 8704 { 8705 CPUARMState *env = &cpu->env; 8706 uint32_t excret; 8707 uint32_t xpsr; 8708 bool ufault = false; 8709 bool sfault = false; 8710 bool return_to_sp_process; 8711 bool return_to_handler; 8712 bool rettobase = false; 8713 bool exc_secure = false; 8714 bool return_to_secure; 8715 bool ftype; 8716 bool restore_s16_s31; 8717 8718 /* If we're not in Handler mode then jumps to magic exception-exit 8719 * addresses don't have magic behaviour. However for the v8M 8720 * security extensions the magic secure-function-return has to 8721 * work in thread mode too, so to avoid doing an extra check in 8722 * the generated code we allow exception-exit magic to also cause the 8723 * internal exception and bring us here in thread mode. Correct code 8724 * will never try to do this (the following insn fetch will always 8725 * fault) so we the overhead of having taken an unnecessary exception 8726 * doesn't matter. 8727 */ 8728 if (!arm_v7m_is_handler_mode(env)) { 8729 return; 8730 } 8731 8732 /* In the spec pseudocode ExceptionReturn() is called directly 8733 * from BXWritePC() and gets the full target PC value including 8734 * bit zero. In QEMU's implementation we treat it as a normal 8735 * jump-to-register (which is then caught later on), and so split 8736 * the target value up between env->regs[15] and env->thumb in 8737 * gen_bx(). Reconstitute it. 8738 */ 8739 excret = env->regs[15]; 8740 if (env->thumb) { 8741 excret |= 1; 8742 } 8743 8744 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32 8745 " previous exception %d\n", 8746 excret, env->v7m.exception); 8747 8748 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) { 8749 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception " 8750 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", 8751 excret); 8752 } 8753 8754 ftype = excret & R_V7M_EXCRET_FTYPE_MASK; 8755 8756 if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) { 8757 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception " 8758 "exit PC value 0x%" PRIx32 " is UNPREDICTABLE " 8759 "if FPU not present\n", 8760 excret); 8761 ftype = true; 8762 } 8763 8764 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8765 /* EXC_RETURN.ES validation check (R_SMFL). We must do this before 8766 * we pick which FAULTMASK to clear. 8767 */ 8768 if (!env->v7m.secure && 8769 ((excret & R_V7M_EXCRET_ES_MASK) || 8770 !(excret & R_V7M_EXCRET_DCRS_MASK))) { 8771 sfault = 1; 8772 /* For all other purposes, treat ES as 0 (R_HXSR) */ 8773 excret &= ~R_V7M_EXCRET_ES_MASK; 8774 } 8775 exc_secure = excret & R_V7M_EXCRET_ES_MASK; 8776 } 8777 8778 if (env->v7m.exception != ARMV7M_EXCP_NMI) { 8779 /* Auto-clear FAULTMASK on return from other than NMI. 8780 * If the security extension is implemented then this only 8781 * happens if the raw execution priority is >= 0; the 8782 * value of the ES bit in the exception return value indicates 8783 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.) 8784 */ 8785 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8786 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) { 8787 env->v7m.faultmask[exc_secure] = 0; 8788 } 8789 } else { 8790 env->v7m.faultmask[M_REG_NS] = 0; 8791 } 8792 } 8793 8794 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception, 8795 exc_secure)) { 8796 case -1: 8797 /* attempt to exit an exception that isn't active */ 8798 ufault = true; 8799 break; 8800 case 0: 8801 /* still an irq active now */ 8802 break; 8803 case 1: 8804 /* we returned to base exception level, no nesting. 8805 * (In the pseudocode this is written using "NestedActivation != 1" 8806 * where we have 'rettobase == false'.) 8807 */ 8808 rettobase = true; 8809 break; 8810 default: 8811 g_assert_not_reached(); 8812 } 8813 8814 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK); 8815 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK; 8816 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) && 8817 (excret & R_V7M_EXCRET_S_MASK); 8818 8819 if (arm_feature(env, ARM_FEATURE_V8)) { 8820 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8821 /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP); 8822 * we choose to take the UsageFault. 8823 */ 8824 if ((excret & R_V7M_EXCRET_S_MASK) || 8825 (excret & R_V7M_EXCRET_ES_MASK) || 8826 !(excret & R_V7M_EXCRET_DCRS_MASK)) { 8827 ufault = true; 8828 } 8829 } 8830 if (excret & R_V7M_EXCRET_RES0_MASK) { 8831 ufault = true; 8832 } 8833 } else { 8834 /* For v7M we only recognize certain combinations of the low bits */ 8835 switch (excret & 0xf) { 8836 case 1: /* Return to Handler */ 8837 break; 8838 case 13: /* Return to Thread using Process stack */ 8839 case 9: /* Return to Thread using Main stack */ 8840 /* We only need to check NONBASETHRDENA for v7M, because in 8841 * v8M this bit does not exist (it is RES1). 8842 */ 8843 if (!rettobase && 8844 !(env->v7m.ccr[env->v7m.secure] & 8845 R_V7M_CCR_NONBASETHRDENA_MASK)) { 8846 ufault = true; 8847 } 8848 break; 8849 default: 8850 ufault = true; 8851 } 8852 } 8853 8854 /* 8855 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in 8856 * Handler mode (and will be until we write the new XPSR.Interrupt 8857 * field) this does not switch around the current stack pointer. 8858 * We must do this before we do any kind of tailchaining, including 8859 * for the derived exceptions on integrity check failures, or we will 8860 * give the guest an incorrect EXCRET.SPSEL value on exception entry. 8861 */ 8862 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure); 8863 8864 /* 8865 * Clear scratch FP values left in caller saved registers; this 8866 * must happen before any kind of tail chaining. 8867 */ 8868 if ((env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_CLRONRET_MASK) && 8869 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) { 8870 if (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK) { 8871 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; 8872 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8873 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8874 "stackframe: error during lazy state deactivation\n"); 8875 v7m_exception_taken(cpu, excret, true, false); 8876 return; 8877 } else { 8878 /* Clear s0..s15 and FPSCR */ 8879 int i; 8880 8881 for (i = 0; i < 16; i += 2) { 8882 *aa32_vfp_dreg(env, i / 2) = 0; 8883 } 8884 vfp_set_fpscr(env, 0); 8885 } 8886 } 8887 8888 if (sfault) { 8889 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK; 8890 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8891 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8892 "stackframe: failed EXC_RETURN.ES validity check\n"); 8893 v7m_exception_taken(cpu, excret, true, false); 8894 return; 8895 } 8896 8897 if (ufault) { 8898 /* Bad exception return: instead of popping the exception 8899 * stack, directly take a usage fault on the current stack. 8900 */ 8901 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8902 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8903 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " 8904 "stackframe: failed exception return integrity check\n"); 8905 v7m_exception_taken(cpu, excret, true, false); 8906 return; 8907 } 8908 8909 /* 8910 * Tailchaining: if there is currently a pending exception that 8911 * is high enough priority to preempt execution at the level we're 8912 * about to return to, then just directly take that exception now, 8913 * avoiding an unstack-and-then-stack. Note that now we have 8914 * deactivated the previous exception by calling armv7m_nvic_complete_irq() 8915 * our current execution priority is already the execution priority we are 8916 * returning to -- none of the state we would unstack or set based on 8917 * the EXCRET value affects it. 8918 */ 8919 if (armv7m_nvic_can_take_pending_exception(env->nvic)) { 8920 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n"); 8921 v7m_exception_taken(cpu, excret, true, false); 8922 return; 8923 } 8924 8925 switch_v7m_security_state(env, return_to_secure); 8926 8927 { 8928 /* The stack pointer we should be reading the exception frame from 8929 * depends on bits in the magic exception return type value (and 8930 * for v8M isn't necessarily the stack pointer we will eventually 8931 * end up resuming execution with). Get a pointer to the location 8932 * in the CPU state struct where the SP we need is currently being 8933 * stored; we will use and modify it in place. 8934 * We use this limited C variable scope so we don't accidentally 8935 * use 'frame_sp_p' after we do something that makes it invalid. 8936 */ 8937 uint32_t *frame_sp_p = get_v7m_sp_ptr(env, 8938 return_to_secure, 8939 !return_to_handler, 8940 return_to_sp_process); 8941 uint32_t frameptr = *frame_sp_p; 8942 bool pop_ok = true; 8943 ARMMMUIdx mmu_idx; 8944 bool return_to_priv = return_to_handler || 8945 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK); 8946 8947 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure, 8948 return_to_priv); 8949 8950 if (!QEMU_IS_ALIGNED(frameptr, 8) && 8951 arm_feature(env, ARM_FEATURE_V8)) { 8952 qemu_log_mask(LOG_GUEST_ERROR, 8953 "M profile exception return with non-8-aligned SP " 8954 "for destination state is UNPREDICTABLE\n"); 8955 } 8956 8957 /* Do we need to pop callee-saved registers? */ 8958 if (return_to_secure && 8959 ((excret & R_V7M_EXCRET_ES_MASK) == 0 || 8960 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) { 8961 uint32_t actual_sig; 8962 8963 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx); 8964 8965 if (pop_ok && v7m_integrity_sig(env, excret) != actual_sig) { 8966 /* Take a SecureFault on the current stack */ 8967 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK; 8968 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8969 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8970 "stackframe: failed exception return integrity " 8971 "signature check\n"); 8972 v7m_exception_taken(cpu, excret, true, false); 8973 return; 8974 } 8975 8976 pop_ok = pop_ok && 8977 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) && 8978 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) && 8979 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) && 8980 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) && 8981 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) && 8982 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) && 8983 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) && 8984 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx); 8985 8986 frameptr += 0x28; 8987 } 8988 8989 /* Pop registers */ 8990 pop_ok = pop_ok && 8991 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) && 8992 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) && 8993 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) && 8994 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) && 8995 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) && 8996 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) && 8997 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) && 8998 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx); 8999 9000 if (!pop_ok) { 9001 /* v7m_stack_read() pended a fault, so take it (as a tail 9002 * chained exception on the same stack frame) 9003 */ 9004 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n"); 9005 v7m_exception_taken(cpu, excret, true, false); 9006 return; 9007 } 9008 9009 /* Returning from an exception with a PC with bit 0 set is defined 9010 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified 9011 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore 9012 * the lsbit, and there are several RTOSes out there which incorrectly 9013 * assume the r15 in the stack frame should be a Thumb-style "lsbit 9014 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but 9015 * complain about the badly behaved guest. 9016 */ 9017 if (env->regs[15] & 1) { 9018 env->regs[15] &= ~1U; 9019 if (!arm_feature(env, ARM_FEATURE_V8)) { 9020 qemu_log_mask(LOG_GUEST_ERROR, 9021 "M profile return from interrupt with misaligned " 9022 "PC is UNPREDICTABLE on v7M\n"); 9023 } 9024 } 9025 9026 if (arm_feature(env, ARM_FEATURE_V8)) { 9027 /* For v8M we have to check whether the xPSR exception field 9028 * matches the EXCRET value for return to handler/thread 9029 * before we commit to changing the SP and xPSR. 9030 */ 9031 bool will_be_handler = (xpsr & XPSR_EXCP) != 0; 9032 if (return_to_handler != will_be_handler) { 9033 /* Take an INVPC UsageFault on the current stack. 9034 * By this point we will have switched to the security state 9035 * for the background state, so this UsageFault will target 9036 * that state. 9037 */ 9038 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 9039 env->v7m.secure); 9040 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 9041 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " 9042 "stackframe: failed exception return integrity " 9043 "check\n"); 9044 v7m_exception_taken(cpu, excret, true, false); 9045 return; 9046 } 9047 } 9048 9049 if (!ftype) { 9050 /* FP present and we need to handle it */ 9051 if (!return_to_secure && 9052 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_LSPACT_MASK)) { 9053 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 9054 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; 9055 qemu_log_mask(CPU_LOG_INT, 9056 "...taking SecureFault on existing stackframe: " 9057 "Secure LSPACT set but exception return is " 9058 "not to secure state\n"); 9059 v7m_exception_taken(cpu, excret, true, false); 9060 return; 9061 } 9062 9063 restore_s16_s31 = return_to_secure && 9064 (env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_TS_MASK); 9065 9066 if (env->v7m.fpccr[return_to_secure] & R_V7M_FPCCR_LSPACT_MASK) { 9067 /* State in FPU is still valid, just clear LSPACT */ 9068 env->v7m.fpccr[return_to_secure] &= ~R_V7M_FPCCR_LSPACT_MASK; 9069 } else { 9070 int i; 9071 uint32_t fpscr; 9072 bool cpacr_pass, nsacr_pass; 9073 9074 cpacr_pass = v7m_cpacr_pass(env, return_to_secure, 9075 return_to_priv); 9076 nsacr_pass = return_to_secure || 9077 extract32(env->v7m.nsacr, 10, 1); 9078 9079 if (!cpacr_pass) { 9080 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 9081 return_to_secure); 9082 env->v7m.cfsr[return_to_secure] |= R_V7M_CFSR_NOCP_MASK; 9083 qemu_log_mask(CPU_LOG_INT, 9084 "...taking UsageFault on existing " 9085 "stackframe: CPACR.CP10 prevents unstacking " 9086 "FP regs\n"); 9087 v7m_exception_taken(cpu, excret, true, false); 9088 return; 9089 } else if (!nsacr_pass) { 9090 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true); 9091 env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_INVPC_MASK; 9092 qemu_log_mask(CPU_LOG_INT, 9093 "...taking Secure UsageFault on existing " 9094 "stackframe: NSACR.CP10 prevents unstacking " 9095 "FP regs\n"); 9096 v7m_exception_taken(cpu, excret, true, false); 9097 return; 9098 } 9099 9100 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) { 9101 uint32_t slo, shi; 9102 uint64_t dn; 9103 uint32_t faddr = frameptr + 0x20 + 4 * i; 9104 9105 if (i >= 16) { 9106 faddr += 8; /* Skip the slot for the FPSCR */ 9107 } 9108 9109 pop_ok = pop_ok && 9110 v7m_stack_read(cpu, &slo, faddr, mmu_idx) && 9111 v7m_stack_read(cpu, &shi, faddr + 4, mmu_idx); 9112 9113 if (!pop_ok) { 9114 break; 9115 } 9116 9117 dn = (uint64_t)shi << 32 | slo; 9118 *aa32_vfp_dreg(env, i / 2) = dn; 9119 } 9120 pop_ok = pop_ok && 9121 v7m_stack_read(cpu, &fpscr, frameptr + 0x60, mmu_idx); 9122 if (pop_ok) { 9123 vfp_set_fpscr(env, fpscr); 9124 } 9125 if (!pop_ok) { 9126 /* 9127 * These regs are 0 if security extension present; 9128 * otherwise merely UNKNOWN. We zero always. 9129 */ 9130 for (i = 0; i < (restore_s16_s31 ? 32 : 16); i += 2) { 9131 *aa32_vfp_dreg(env, i / 2) = 0; 9132 } 9133 vfp_set_fpscr(env, 0); 9134 } 9135 } 9136 } 9137 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S], 9138 V7M_CONTROL, FPCA, !ftype); 9139 9140 /* Commit to consuming the stack frame */ 9141 frameptr += 0x20; 9142 if (!ftype) { 9143 frameptr += 0x48; 9144 if (restore_s16_s31) { 9145 frameptr += 0x40; 9146 } 9147 } 9148 /* Undo stack alignment (the SPREALIGN bit indicates that the original 9149 * pre-exception SP was not 8-aligned and we added a padding word to 9150 * align it, so we undo this by ORing in the bit that increases it 9151 * from the current 8-aligned value to the 8-unaligned value. (Adding 4 9152 * would work too but a logical OR is how the pseudocode specifies it.) 9153 */ 9154 if (xpsr & XPSR_SPREALIGN) { 9155 frameptr |= 4; 9156 } 9157 *frame_sp_p = frameptr; 9158 } 9159 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */ 9160 xpsr_write(env, xpsr, ~(XPSR_SPREALIGN | XPSR_SFPA)); 9161 9162 if (env->v7m.secure) { 9163 bool sfpa = xpsr & XPSR_SFPA; 9164 9165 env->v7m.control[M_REG_S] = FIELD_DP32(env->v7m.control[M_REG_S], 9166 V7M_CONTROL, SFPA, sfpa); 9167 } 9168 9169 /* The restored xPSR exception field will be zero if we're 9170 * resuming in Thread mode. If that doesn't match what the 9171 * exception return excret specified then this is a UsageFault. 9172 * v7M requires we make this check here; v8M did it earlier. 9173 */ 9174 if (return_to_handler != arm_v7m_is_handler_mode(env)) { 9175 /* Take an INVPC UsageFault by pushing the stack again; 9176 * we know we're v7M so this is never a Secure UsageFault. 9177 */ 9178 bool ignore_stackfaults; 9179 9180 assert(!arm_feature(env, ARM_FEATURE_V8)); 9181 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false); 9182 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 9183 ignore_stackfaults = v7m_push_stack(cpu); 9184 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: " 9185 "failed exception return integrity check\n"); 9186 v7m_exception_taken(cpu, excret, false, ignore_stackfaults); 9187 return; 9188 } 9189 9190 /* Otherwise, we have a successful exception exit. */ 9191 arm_clear_exclusive(env); 9192 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n"); 9193 } 9194 9195 static bool do_v7m_function_return(ARMCPU *cpu) 9196 { 9197 /* v8M security extensions magic function return. 9198 * We may either: 9199 * (1) throw an exception (longjump) 9200 * (2) return true if we successfully handled the function return 9201 * (3) return false if we failed a consistency check and have 9202 * pended a UsageFault that needs to be taken now 9203 * 9204 * At this point the magic return value is split between env->regs[15] 9205 * and env->thumb. We don't bother to reconstitute it because we don't 9206 * need it (all values are handled the same way). 9207 */ 9208 CPUARMState *env = &cpu->env; 9209 uint32_t newpc, newpsr, newpsr_exc; 9210 9211 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n"); 9212 9213 { 9214 bool threadmode, spsel; 9215 TCGMemOpIdx oi; 9216 ARMMMUIdx mmu_idx; 9217 uint32_t *frame_sp_p; 9218 uint32_t frameptr; 9219 9220 /* Pull the return address and IPSR from the Secure stack */ 9221 threadmode = !arm_v7m_is_handler_mode(env); 9222 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK; 9223 9224 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel); 9225 frameptr = *frame_sp_p; 9226 9227 /* These loads may throw an exception (for MPU faults). We want to 9228 * do them as secure, so work out what MMU index that is. 9229 */ 9230 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true); 9231 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx)); 9232 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0); 9233 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0); 9234 9235 /* Consistency checks on new IPSR */ 9236 newpsr_exc = newpsr & XPSR_EXCP; 9237 if (!((env->v7m.exception == 0 && newpsr_exc == 0) || 9238 (env->v7m.exception == 1 && newpsr_exc != 0))) { 9239 /* Pend the fault and tell our caller to take it */ 9240 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 9241 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 9242 env->v7m.secure); 9243 qemu_log_mask(CPU_LOG_INT, 9244 "...taking INVPC UsageFault: " 9245 "IPSR consistency check failed\n"); 9246 return false; 9247 } 9248 9249 *frame_sp_p = frameptr + 8; 9250 } 9251 9252 /* This invalidates frame_sp_p */ 9253 switch_v7m_security_state(env, true); 9254 env->v7m.exception = newpsr_exc; 9255 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 9256 if (newpsr & XPSR_SFPA) { 9257 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK; 9258 } 9259 xpsr_write(env, 0, XPSR_IT); 9260 env->thumb = newpc & 1; 9261 env->regs[15] = newpc & ~1; 9262 9263 qemu_log_mask(CPU_LOG_INT, "...function return successful\n"); 9264 return true; 9265 } 9266 9267 static void arm_log_exception(int idx) 9268 { 9269 if (qemu_loglevel_mask(CPU_LOG_INT)) { 9270 const char *exc = NULL; 9271 static const char * const excnames[] = { 9272 [EXCP_UDEF] = "Undefined Instruction", 9273 [EXCP_SWI] = "SVC", 9274 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 9275 [EXCP_DATA_ABORT] = "Data Abort", 9276 [EXCP_IRQ] = "IRQ", 9277 [EXCP_FIQ] = "FIQ", 9278 [EXCP_BKPT] = "Breakpoint", 9279 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 9280 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 9281 [EXCP_HVC] = "Hypervisor Call", 9282 [EXCP_HYP_TRAP] = "Hypervisor Trap", 9283 [EXCP_SMC] = "Secure Monitor Call", 9284 [EXCP_VIRQ] = "Virtual IRQ", 9285 [EXCP_VFIQ] = "Virtual FIQ", 9286 [EXCP_SEMIHOST] = "Semihosting call", 9287 [EXCP_NOCP] = "v7M NOCP UsageFault", 9288 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 9289 [EXCP_STKOF] = "v8M STKOF UsageFault", 9290 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking", 9291 [EXCP_LSERR] = "v8M LSERR UsageFault", 9292 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault", 9293 }; 9294 9295 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 9296 exc = excnames[idx]; 9297 } 9298 if (!exc) { 9299 exc = "unknown"; 9300 } 9301 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc); 9302 } 9303 } 9304 9305 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, 9306 uint32_t addr, uint16_t *insn) 9307 { 9308 /* Load a 16-bit portion of a v7M instruction, returning true on success, 9309 * or false on failure (in which case we will have pended the appropriate 9310 * exception). 9311 * We need to do the instruction fetch's MPU and SAU checks 9312 * like this because there is no MMU index that would allow 9313 * doing the load with a single function call. Instead we must 9314 * first check that the security attributes permit the load 9315 * and that they don't mismatch on the two halves of the instruction, 9316 * and then we do the load as a secure load (ie using the security 9317 * attributes of the address, not the CPU, as architecturally required). 9318 */ 9319 CPUState *cs = CPU(cpu); 9320 CPUARMState *env = &cpu->env; 9321 V8M_SAttributes sattrs = {}; 9322 MemTxAttrs attrs = {}; 9323 ARMMMUFaultInfo fi = {}; 9324 MemTxResult txres; 9325 target_ulong page_size; 9326 hwaddr physaddr; 9327 int prot; 9328 9329 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs); 9330 if (!sattrs.nsc || sattrs.ns) { 9331 /* This must be the second half of the insn, and it straddles a 9332 * region boundary with the second half not being S&NSC. 9333 */ 9334 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 9335 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 9336 qemu_log_mask(CPU_LOG_INT, 9337 "...really SecureFault with SFSR.INVEP\n"); 9338 return false; 9339 } 9340 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx, 9341 &physaddr, &attrs, &prot, &page_size, &fi, NULL)) { 9342 /* the MPU lookup failed */ 9343 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK; 9344 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure); 9345 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n"); 9346 return false; 9347 } 9348 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr, 9349 attrs, &txres); 9350 if (txres != MEMTX_OK) { 9351 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; 9352 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); 9353 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n"); 9354 return false; 9355 } 9356 return true; 9357 } 9358 9359 static bool v7m_handle_execute_nsc(ARMCPU *cpu) 9360 { 9361 /* Check whether this attempt to execute code in a Secure & NS-Callable 9362 * memory region is for an SG instruction; if so, then emulate the 9363 * effect of the SG instruction and return true. Otherwise pend 9364 * the correct kind of exception and return false. 9365 */ 9366 CPUARMState *env = &cpu->env; 9367 ARMMMUIdx mmu_idx; 9368 uint16_t insn; 9369 9370 /* We should never get here unless get_phys_addr_pmsav8() caused 9371 * an exception for NS executing in S&NSC memory. 9372 */ 9373 assert(!env->v7m.secure); 9374 assert(arm_feature(env, ARM_FEATURE_M_SECURITY)); 9375 9376 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */ 9377 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true); 9378 9379 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) { 9380 return false; 9381 } 9382 9383 if (!env->thumb) { 9384 goto gen_invep; 9385 } 9386 9387 if (insn != 0xe97f) { 9388 /* Not an SG instruction first half (we choose the IMPDEF 9389 * early-SG-check option). 9390 */ 9391 goto gen_invep; 9392 } 9393 9394 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) { 9395 return false; 9396 } 9397 9398 if (insn != 0xe97f) { 9399 /* Not an SG instruction second half (yes, both halves of the SG 9400 * insn have the same hex value) 9401 */ 9402 goto gen_invep; 9403 } 9404 9405 /* OK, we have confirmed that we really have an SG instruction. 9406 * We know we're NS in S memory so don't need to repeat those checks. 9407 */ 9408 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32 9409 ", executing it\n", env->regs[15]); 9410 env->regs[14] &= ~1; 9411 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 9412 switch_v7m_security_state(env, true); 9413 xpsr_write(env, 0, XPSR_IT); 9414 env->regs[15] += 4; 9415 return true; 9416 9417 gen_invep: 9418 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 9419 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 9420 qemu_log_mask(CPU_LOG_INT, 9421 "...really SecureFault with SFSR.INVEP\n"); 9422 return false; 9423 } 9424 9425 void arm_v7m_cpu_do_interrupt(CPUState *cs) 9426 { 9427 ARMCPU *cpu = ARM_CPU(cs); 9428 CPUARMState *env = &cpu->env; 9429 uint32_t lr; 9430 bool ignore_stackfaults; 9431 9432 arm_log_exception(cs->exception_index); 9433 9434 /* For exceptions we just mark as pending on the NVIC, and let that 9435 handle it. */ 9436 switch (cs->exception_index) { 9437 case EXCP_UDEF: 9438 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 9439 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK; 9440 break; 9441 case EXCP_NOCP: 9442 { 9443 /* 9444 * NOCP might be directed to something other than the current 9445 * security state if this fault is because of NSACR; we indicate 9446 * the target security state using exception.target_el. 9447 */ 9448 int target_secstate; 9449 9450 if (env->exception.target_el == 3) { 9451 target_secstate = M_REG_S; 9452 } else { 9453 target_secstate = env->v7m.secure; 9454 } 9455 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, target_secstate); 9456 env->v7m.cfsr[target_secstate] |= R_V7M_CFSR_NOCP_MASK; 9457 break; 9458 } 9459 case EXCP_INVSTATE: 9460 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 9461 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK; 9462 break; 9463 case EXCP_STKOF: 9464 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 9465 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 9466 break; 9467 case EXCP_LSERR: 9468 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 9469 env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; 9470 break; 9471 case EXCP_UNALIGNED: 9472 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 9473 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK; 9474 break; 9475 case EXCP_SWI: 9476 /* The PC already points to the next instruction. */ 9477 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure); 9478 break; 9479 case EXCP_PREFETCH_ABORT: 9480 case EXCP_DATA_ABORT: 9481 /* Note that for M profile we don't have a guest facing FSR, but 9482 * the env->exception.fsr will be populated by the code that 9483 * raises the fault, in the A profile short-descriptor format. 9484 */ 9485 switch (env->exception.fsr & 0xf) { 9486 case M_FAKE_FSR_NSC_EXEC: 9487 /* Exception generated when we try to execute code at an address 9488 * which is marked as Secure & Non-Secure Callable and the CPU 9489 * is in the Non-Secure state. The only instruction which can 9490 * be executed like this is SG (and that only if both halves of 9491 * the SG instruction have the same security attributes.) 9492 * Everything else must generate an INVEP SecureFault, so we 9493 * emulate the SG instruction here. 9494 */ 9495 if (v7m_handle_execute_nsc(cpu)) { 9496 return; 9497 } 9498 break; 9499 case M_FAKE_FSR_SFAULT: 9500 /* Various flavours of SecureFault for attempts to execute or 9501 * access data in the wrong security state. 9502 */ 9503 switch (cs->exception_index) { 9504 case EXCP_PREFETCH_ABORT: 9505 if (env->v7m.secure) { 9506 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK; 9507 qemu_log_mask(CPU_LOG_INT, 9508 "...really SecureFault with SFSR.INVTRAN\n"); 9509 } else { 9510 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 9511 qemu_log_mask(CPU_LOG_INT, 9512 "...really SecureFault with SFSR.INVEP\n"); 9513 } 9514 break; 9515 case EXCP_DATA_ABORT: 9516 /* This must be an NS access to S memory */ 9517 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK; 9518 qemu_log_mask(CPU_LOG_INT, 9519 "...really SecureFault with SFSR.AUVIOL\n"); 9520 break; 9521 } 9522 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 9523 break; 9524 case 0x8: /* External Abort */ 9525 switch (cs->exception_index) { 9526 case EXCP_PREFETCH_ABORT: 9527 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; 9528 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n"); 9529 break; 9530 case EXCP_DATA_ABORT: 9531 env->v7m.cfsr[M_REG_NS] |= 9532 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK); 9533 env->v7m.bfar = env->exception.vaddress; 9534 qemu_log_mask(CPU_LOG_INT, 9535 "...with CFSR.PRECISERR and BFAR 0x%x\n", 9536 env->v7m.bfar); 9537 break; 9538 } 9539 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); 9540 break; 9541 default: 9542 /* All other FSR values are either MPU faults or "can't happen 9543 * for M profile" cases. 9544 */ 9545 switch (cs->exception_index) { 9546 case EXCP_PREFETCH_ABORT: 9547 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK; 9548 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n"); 9549 break; 9550 case EXCP_DATA_ABORT: 9551 env->v7m.cfsr[env->v7m.secure] |= 9552 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK); 9553 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress; 9554 qemu_log_mask(CPU_LOG_INT, 9555 "...with CFSR.DACCVIOL and MMFAR 0x%x\n", 9556 env->v7m.mmfar[env->v7m.secure]); 9557 break; 9558 } 9559 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, 9560 env->v7m.secure); 9561 break; 9562 } 9563 break; 9564 case EXCP_BKPT: 9565 if (semihosting_enabled()) { 9566 int nr; 9567 nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff; 9568 if (nr == 0xab) { 9569 env->regs[15] += 2; 9570 qemu_log_mask(CPU_LOG_INT, 9571 "...handling as semihosting call 0x%x\n", 9572 env->regs[0]); 9573 env->regs[0] = do_arm_semihosting(env); 9574 return; 9575 } 9576 } 9577 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false); 9578 break; 9579 case EXCP_IRQ: 9580 break; 9581 case EXCP_EXCEPTION_EXIT: 9582 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) { 9583 /* Must be v8M security extension function return */ 9584 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC); 9585 assert(arm_feature(env, ARM_FEATURE_M_SECURITY)); 9586 if (do_v7m_function_return(cpu)) { 9587 return; 9588 } 9589 } else { 9590 do_v7m_exception_exit(cpu); 9591 return; 9592 } 9593 break; 9594 case EXCP_LAZYFP: 9595 /* 9596 * We already pended the specific exception in the NVIC in the 9597 * v7m_preserve_fp_state() helper function. 9598 */ 9599 break; 9600 default: 9601 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9602 return; /* Never happens. Keep compiler happy. */ 9603 } 9604 9605 if (arm_feature(env, ARM_FEATURE_V8)) { 9606 lr = R_V7M_EXCRET_RES1_MASK | 9607 R_V7M_EXCRET_DCRS_MASK; 9608 /* The S bit indicates whether we should return to Secure 9609 * or NonSecure (ie our current state). 9610 * The ES bit indicates whether we're taking this exception 9611 * to Secure or NonSecure (ie our target state). We set it 9612 * later, in v7m_exception_taken(). 9613 * The SPSEL bit is also set in v7m_exception_taken() for v8M. 9614 * This corresponds to the ARM ARM pseudocode for v8M setting 9615 * some LR bits in PushStack() and some in ExceptionTaken(); 9616 * the distinction matters for the tailchain cases where we 9617 * can take an exception without pushing the stack. 9618 */ 9619 if (env->v7m.secure) { 9620 lr |= R_V7M_EXCRET_S_MASK; 9621 } 9622 if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) { 9623 lr |= R_V7M_EXCRET_FTYPE_MASK; 9624 } 9625 } else { 9626 lr = R_V7M_EXCRET_RES1_MASK | 9627 R_V7M_EXCRET_S_MASK | 9628 R_V7M_EXCRET_DCRS_MASK | 9629 R_V7M_EXCRET_FTYPE_MASK | 9630 R_V7M_EXCRET_ES_MASK; 9631 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) { 9632 lr |= R_V7M_EXCRET_SPSEL_MASK; 9633 } 9634 } 9635 if (!arm_v7m_is_handler_mode(env)) { 9636 lr |= R_V7M_EXCRET_MODE_MASK; 9637 } 9638 9639 ignore_stackfaults = v7m_push_stack(cpu); 9640 v7m_exception_taken(cpu, lr, false, ignore_stackfaults); 9641 } 9642 9643 /* Function used to synchronize QEMU's AArch64 register set with AArch32 9644 * register set. This is necessary when switching between AArch32 and AArch64 9645 * execution state. 9646 */ 9647 void aarch64_sync_32_to_64(CPUARMState *env) 9648 { 9649 int i; 9650 uint32_t mode = env->uncached_cpsr & CPSR_M; 9651 9652 /* We can blanket copy R[0:7] to X[0:7] */ 9653 for (i = 0; i < 8; i++) { 9654 env->xregs[i] = env->regs[i]; 9655 } 9656 9657 /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 9658 * Otherwise, they come from the banked user regs. 9659 */ 9660 if (mode == ARM_CPU_MODE_FIQ) { 9661 for (i = 8; i < 13; i++) { 9662 env->xregs[i] = env->usr_regs[i - 8]; 9663 } 9664 } else { 9665 for (i = 8; i < 13; i++) { 9666 env->xregs[i] = env->regs[i]; 9667 } 9668 } 9669 9670 /* Registers x13-x23 are the various mode SP and FP registers. Registers 9671 * r13 and r14 are only copied if we are in that mode, otherwise we copy 9672 * from the mode banked register. 9673 */ 9674 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 9675 env->xregs[13] = env->regs[13]; 9676 env->xregs[14] = env->regs[14]; 9677 } else { 9678 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 9679 /* HYP is an exception in that it is copied from r14 */ 9680 if (mode == ARM_CPU_MODE_HYP) { 9681 env->xregs[14] = env->regs[14]; 9682 } else { 9683 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 9684 } 9685 } 9686 9687 if (mode == ARM_CPU_MODE_HYP) { 9688 env->xregs[15] = env->regs[13]; 9689 } else { 9690 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 9691 } 9692 9693 if (mode == ARM_CPU_MODE_IRQ) { 9694 env->xregs[16] = env->regs[14]; 9695 env->xregs[17] = env->regs[13]; 9696 } else { 9697 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 9698 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 9699 } 9700 9701 if (mode == ARM_CPU_MODE_SVC) { 9702 env->xregs[18] = env->regs[14]; 9703 env->xregs[19] = env->regs[13]; 9704 } else { 9705 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 9706 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 9707 } 9708 9709 if (mode == ARM_CPU_MODE_ABT) { 9710 env->xregs[20] = env->regs[14]; 9711 env->xregs[21] = env->regs[13]; 9712 } else { 9713 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 9714 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 9715 } 9716 9717 if (mode == ARM_CPU_MODE_UND) { 9718 env->xregs[22] = env->regs[14]; 9719 env->xregs[23] = env->regs[13]; 9720 } else { 9721 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 9722 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 9723 } 9724 9725 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 9726 * mode, then we can copy from r8-r14. Otherwise, we copy from the 9727 * FIQ bank for r8-r14. 9728 */ 9729 if (mode == ARM_CPU_MODE_FIQ) { 9730 for (i = 24; i < 31; i++) { 9731 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 9732 } 9733 } else { 9734 for (i = 24; i < 29; i++) { 9735 env->xregs[i] = env->fiq_regs[i - 24]; 9736 } 9737 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 9738 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 9739 } 9740 9741 env->pc = env->regs[15]; 9742 } 9743 9744 /* Function used to synchronize QEMU's AArch32 register set with AArch64 9745 * register set. This is necessary when switching between AArch32 and AArch64 9746 * execution state. 9747 */ 9748 void aarch64_sync_64_to_32(CPUARMState *env) 9749 { 9750 int i; 9751 uint32_t mode = env->uncached_cpsr & CPSR_M; 9752 9753 /* We can blanket copy X[0:7] to R[0:7] */ 9754 for (i = 0; i < 8; i++) { 9755 env->regs[i] = env->xregs[i]; 9756 } 9757 9758 /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 9759 * Otherwise, we copy x8-x12 into the banked user regs. 9760 */ 9761 if (mode == ARM_CPU_MODE_FIQ) { 9762 for (i = 8; i < 13; i++) { 9763 env->usr_regs[i - 8] = env->xregs[i]; 9764 } 9765 } else { 9766 for (i = 8; i < 13; i++) { 9767 env->regs[i] = env->xregs[i]; 9768 } 9769 } 9770 9771 /* Registers r13 & r14 depend on the current mode. 9772 * If we are in a given mode, we copy the corresponding x registers to r13 9773 * and r14. Otherwise, we copy the x register to the banked r13 and r14 9774 * for the mode. 9775 */ 9776 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 9777 env->regs[13] = env->xregs[13]; 9778 env->regs[14] = env->xregs[14]; 9779 } else { 9780 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 9781 9782 /* HYP is an exception in that it does not have its own banked r14 but 9783 * shares the USR r14 9784 */ 9785 if (mode == ARM_CPU_MODE_HYP) { 9786 env->regs[14] = env->xregs[14]; 9787 } else { 9788 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 9789 } 9790 } 9791 9792 if (mode == ARM_CPU_MODE_HYP) { 9793 env->regs[13] = env->xregs[15]; 9794 } else { 9795 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 9796 } 9797 9798 if (mode == ARM_CPU_MODE_IRQ) { 9799 env->regs[14] = env->xregs[16]; 9800 env->regs[13] = env->xregs[17]; 9801 } else { 9802 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 9803 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 9804 } 9805 9806 if (mode == ARM_CPU_MODE_SVC) { 9807 env->regs[14] = env->xregs[18]; 9808 env->regs[13] = env->xregs[19]; 9809 } else { 9810 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 9811 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 9812 } 9813 9814 if (mode == ARM_CPU_MODE_ABT) { 9815 env->regs[14] = env->xregs[20]; 9816 env->regs[13] = env->xregs[21]; 9817 } else { 9818 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 9819 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 9820 } 9821 9822 if (mode == ARM_CPU_MODE_UND) { 9823 env->regs[14] = env->xregs[22]; 9824 env->regs[13] = env->xregs[23]; 9825 } else { 9826 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 9827 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 9828 } 9829 9830 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 9831 * mode, then we can copy to r8-r14. Otherwise, we copy to the 9832 * FIQ bank for r8-r14. 9833 */ 9834 if (mode == ARM_CPU_MODE_FIQ) { 9835 for (i = 24; i < 31; i++) { 9836 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 9837 } 9838 } else { 9839 for (i = 24; i < 29; i++) { 9840 env->fiq_regs[i - 24] = env->xregs[i]; 9841 } 9842 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 9843 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 9844 } 9845 9846 env->regs[15] = env->pc; 9847 } 9848 9849 static void take_aarch32_exception(CPUARMState *env, int new_mode, 9850 uint32_t mask, uint32_t offset, 9851 uint32_t newpc) 9852 { 9853 /* Change the CPU state so as to actually take the exception. */ 9854 switch_mode(env, new_mode); 9855 /* 9856 * For exceptions taken to AArch32 we must clear the SS bit in both 9857 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 9858 */ 9859 env->uncached_cpsr &= ~PSTATE_SS; 9860 env->spsr = cpsr_read(env); 9861 /* Clear IT bits. */ 9862 env->condexec_bits = 0; 9863 /* Switch to the new mode, and to the correct instruction set. */ 9864 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 9865 /* Set new mode endianness */ 9866 env->uncached_cpsr &= ~CPSR_E; 9867 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) { 9868 env->uncached_cpsr |= CPSR_E; 9869 } 9870 /* J and IL must always be cleared for exception entry */ 9871 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 9872 env->daif |= mask; 9873 9874 if (new_mode == ARM_CPU_MODE_HYP) { 9875 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 9876 env->elr_el[2] = env->regs[15]; 9877 } else { 9878 /* 9879 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 9880 * and we should just guard the thumb mode on V4 9881 */ 9882 if (arm_feature(env, ARM_FEATURE_V4T)) { 9883 env->thumb = 9884 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 9885 } 9886 env->regs[14] = env->regs[15] + offset; 9887 } 9888 env->regs[15] = newpc; 9889 } 9890 9891 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 9892 { 9893 /* 9894 * Handle exception entry to Hyp mode; this is sufficiently 9895 * different to entry to other AArch32 modes that we handle it 9896 * separately here. 9897 * 9898 * The vector table entry used is always the 0x14 Hyp mode entry point, 9899 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp. 9900 * The offset applied to the preferred return address is always zero 9901 * (see DDI0487C.a section G1.12.3). 9902 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 9903 */ 9904 uint32_t addr, mask; 9905 ARMCPU *cpu = ARM_CPU(cs); 9906 CPUARMState *env = &cpu->env; 9907 9908 switch (cs->exception_index) { 9909 case EXCP_UDEF: 9910 addr = 0x04; 9911 break; 9912 case EXCP_SWI: 9913 addr = 0x14; 9914 break; 9915 case EXCP_BKPT: 9916 /* Fall through to prefetch abort. */ 9917 case EXCP_PREFETCH_ABORT: 9918 env->cp15.ifar_s = env->exception.vaddress; 9919 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 9920 (uint32_t)env->exception.vaddress); 9921 addr = 0x0c; 9922 break; 9923 case EXCP_DATA_ABORT: 9924 env->cp15.dfar_s = env->exception.vaddress; 9925 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 9926 (uint32_t)env->exception.vaddress); 9927 addr = 0x10; 9928 break; 9929 case EXCP_IRQ: 9930 addr = 0x18; 9931 break; 9932 case EXCP_FIQ: 9933 addr = 0x1c; 9934 break; 9935 case EXCP_HVC: 9936 addr = 0x08; 9937 break; 9938 case EXCP_HYP_TRAP: 9939 addr = 0x14; 9940 default: 9941 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9942 } 9943 9944 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 9945 if (!arm_feature(env, ARM_FEATURE_V8)) { 9946 /* 9947 * QEMU syndrome values are v8-style. v7 has the IL bit 9948 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 9949 * If this is a v7 CPU, squash the IL bit in those cases. 9950 */ 9951 if (cs->exception_index == EXCP_PREFETCH_ABORT || 9952 (cs->exception_index == EXCP_DATA_ABORT && 9953 !(env->exception.syndrome & ARM_EL_ISV)) || 9954 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 9955 env->exception.syndrome &= ~ARM_EL_IL; 9956 } 9957 } 9958 env->cp15.esr_el[2] = env->exception.syndrome; 9959 } 9960 9961 if (arm_current_el(env) != 2 && addr < 0x14) { 9962 addr = 0x14; 9963 } 9964 9965 mask = 0; 9966 if (!(env->cp15.scr_el3 & SCR_EA)) { 9967 mask |= CPSR_A; 9968 } 9969 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 9970 mask |= CPSR_I; 9971 } 9972 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 9973 mask |= CPSR_F; 9974 } 9975 9976 addr += env->cp15.hvbar; 9977 9978 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 9979 } 9980 9981 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 9982 { 9983 ARMCPU *cpu = ARM_CPU(cs); 9984 CPUARMState *env = &cpu->env; 9985 uint32_t addr; 9986 uint32_t mask; 9987 int new_mode; 9988 uint32_t offset; 9989 uint32_t moe; 9990 9991 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 9992 switch (syn_get_ec(env->exception.syndrome)) { 9993 case EC_BREAKPOINT: 9994 case EC_BREAKPOINT_SAME_EL: 9995 moe = 1; 9996 break; 9997 case EC_WATCHPOINT: 9998 case EC_WATCHPOINT_SAME_EL: 9999 moe = 10; 10000 break; 10001 case EC_AA32_BKPT: 10002 moe = 3; 10003 break; 10004 case EC_VECTORCATCH: 10005 moe = 5; 10006 break; 10007 default: 10008 moe = 0; 10009 break; 10010 } 10011 10012 if (moe) { 10013 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 10014 } 10015 10016 if (env->exception.target_el == 2) { 10017 arm_cpu_do_interrupt_aarch32_hyp(cs); 10018 return; 10019 } 10020 10021 switch (cs->exception_index) { 10022 case EXCP_UDEF: 10023 new_mode = ARM_CPU_MODE_UND; 10024 addr = 0x04; 10025 mask = CPSR_I; 10026 if (env->thumb) 10027 offset = 2; 10028 else 10029 offset = 4; 10030 break; 10031 case EXCP_SWI: 10032 new_mode = ARM_CPU_MODE_SVC; 10033 addr = 0x08; 10034 mask = CPSR_I; 10035 /* The PC already points to the next instruction. */ 10036 offset = 0; 10037 break; 10038 case EXCP_BKPT: 10039 /* Fall through to prefetch abort. */ 10040 case EXCP_PREFETCH_ABORT: 10041 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 10042 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 10043 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 10044 env->exception.fsr, (uint32_t)env->exception.vaddress); 10045 new_mode = ARM_CPU_MODE_ABT; 10046 addr = 0x0c; 10047 mask = CPSR_A | CPSR_I; 10048 offset = 4; 10049 break; 10050 case EXCP_DATA_ABORT: 10051 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 10052 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 10053 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 10054 env->exception.fsr, 10055 (uint32_t)env->exception.vaddress); 10056 new_mode = ARM_CPU_MODE_ABT; 10057 addr = 0x10; 10058 mask = CPSR_A | CPSR_I; 10059 offset = 8; 10060 break; 10061 case EXCP_IRQ: 10062 new_mode = ARM_CPU_MODE_IRQ; 10063 addr = 0x18; 10064 /* Disable IRQ and imprecise data aborts. */ 10065 mask = CPSR_A | CPSR_I; 10066 offset = 4; 10067 if (env->cp15.scr_el3 & SCR_IRQ) { 10068 /* IRQ routed to monitor mode */ 10069 new_mode = ARM_CPU_MODE_MON; 10070 mask |= CPSR_F; 10071 } 10072 break; 10073 case EXCP_FIQ: 10074 new_mode = ARM_CPU_MODE_FIQ; 10075 addr = 0x1c; 10076 /* Disable FIQ, IRQ and imprecise data aborts. */ 10077 mask = CPSR_A | CPSR_I | CPSR_F; 10078 if (env->cp15.scr_el3 & SCR_FIQ) { 10079 /* FIQ routed to monitor mode */ 10080 new_mode = ARM_CPU_MODE_MON; 10081 } 10082 offset = 4; 10083 break; 10084 case EXCP_VIRQ: 10085 new_mode = ARM_CPU_MODE_IRQ; 10086 addr = 0x18; 10087 /* Disable IRQ and imprecise data aborts. */ 10088 mask = CPSR_A | CPSR_I; 10089 offset = 4; 10090 break; 10091 case EXCP_VFIQ: 10092 new_mode = ARM_CPU_MODE_FIQ; 10093 addr = 0x1c; 10094 /* Disable FIQ, IRQ and imprecise data aborts. */ 10095 mask = CPSR_A | CPSR_I | CPSR_F; 10096 offset = 4; 10097 break; 10098 case EXCP_SMC: 10099 new_mode = ARM_CPU_MODE_MON; 10100 addr = 0x08; 10101 mask = CPSR_A | CPSR_I | CPSR_F; 10102 offset = 0; 10103 break; 10104 default: 10105 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 10106 return; /* Never happens. Keep compiler happy. */ 10107 } 10108 10109 if (new_mode == ARM_CPU_MODE_MON) { 10110 addr += env->cp15.mvbar; 10111 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 10112 /* High vectors. When enabled, base address cannot be remapped. */ 10113 addr += 0xffff0000; 10114 } else { 10115 /* ARM v7 architectures provide a vector base address register to remap 10116 * the interrupt vector table. 10117 * This register is only followed in non-monitor mode, and is banked. 10118 * Note: only bits 31:5 are valid. 10119 */ 10120 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 10121 } 10122 10123 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 10124 env->cp15.scr_el3 &= ~SCR_NS; 10125 } 10126 10127 take_aarch32_exception(env, new_mode, mask, offset, addr); 10128 } 10129 10130 /* Handle exception entry to a target EL which is using AArch64 */ 10131 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 10132 { 10133 ARMCPU *cpu = ARM_CPU(cs); 10134 CPUARMState *env = &cpu->env; 10135 unsigned int new_el = env->exception.target_el; 10136 target_ulong addr = env->cp15.vbar_el[new_el]; 10137 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 10138 unsigned int cur_el = arm_current_el(env); 10139 10140 /* 10141 * Note that new_el can never be 0. If cur_el is 0, then 10142 * el0_a64 is is_a64(), else el0_a64 is ignored. 10143 */ 10144 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 10145 10146 if (cur_el < new_el) { 10147 /* Entry vector offset depends on whether the implemented EL 10148 * immediately lower than the target level is using AArch32 or AArch64 10149 */ 10150 bool is_aa64; 10151 10152 switch (new_el) { 10153 case 3: 10154 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 10155 break; 10156 case 2: 10157 is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0; 10158 break; 10159 case 1: 10160 is_aa64 = is_a64(env); 10161 break; 10162 default: 10163 g_assert_not_reached(); 10164 } 10165 10166 if (is_aa64) { 10167 addr += 0x400; 10168 } else { 10169 addr += 0x600; 10170 } 10171 } else if (pstate_read(env) & PSTATE_SP) { 10172 addr += 0x200; 10173 } 10174 10175 switch (cs->exception_index) { 10176 case EXCP_PREFETCH_ABORT: 10177 case EXCP_DATA_ABORT: 10178 env->cp15.far_el[new_el] = env->exception.vaddress; 10179 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 10180 env->cp15.far_el[new_el]); 10181 /* fall through */ 10182 case EXCP_BKPT: 10183 case EXCP_UDEF: 10184 case EXCP_SWI: 10185 case EXCP_HVC: 10186 case EXCP_HYP_TRAP: 10187 case EXCP_SMC: 10188 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) { 10189 /* 10190 * QEMU internal FP/SIMD syndromes from AArch32 include the 10191 * TA and coproc fields which are only exposed if the exception 10192 * is taken to AArch32 Hyp mode. Mask them out to get a valid 10193 * AArch64 format syndrome. 10194 */ 10195 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 10196 } 10197 env->cp15.esr_el[new_el] = env->exception.syndrome; 10198 break; 10199 case EXCP_IRQ: 10200 case EXCP_VIRQ: 10201 addr += 0x80; 10202 break; 10203 case EXCP_FIQ: 10204 case EXCP_VFIQ: 10205 addr += 0x100; 10206 break; 10207 case EXCP_SEMIHOST: 10208 qemu_log_mask(CPU_LOG_INT, 10209 "...handling as semihosting call 0x%" PRIx64 "\n", 10210 env->xregs[0]); 10211 env->xregs[0] = do_arm_semihosting(env); 10212 return; 10213 default: 10214 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 10215 } 10216 10217 if (is_a64(env)) { 10218 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env); 10219 aarch64_save_sp(env, arm_current_el(env)); 10220 env->elr_el[new_el] = env->pc; 10221 } else { 10222 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env); 10223 env->elr_el[new_el] = env->regs[15]; 10224 10225 aarch64_sync_32_to_64(env); 10226 10227 env->condexec_bits = 0; 10228 } 10229 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 10230 env->elr_el[new_el]); 10231 10232 pstate_write(env, PSTATE_DAIF | new_mode); 10233 env->aarch64 = 1; 10234 aarch64_restore_sp(env, new_el); 10235 10236 env->pc = addr; 10237 10238 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 10239 new_el, env->pc, pstate_read(env)); 10240 } 10241 10242 static inline bool check_for_semihosting(CPUState *cs) 10243 { 10244 /* Check whether this exception is a semihosting call; if so 10245 * then handle it and return true; otherwise return false. 10246 */ 10247 ARMCPU *cpu = ARM_CPU(cs); 10248 CPUARMState *env = &cpu->env; 10249 10250 if (is_a64(env)) { 10251 if (cs->exception_index == EXCP_SEMIHOST) { 10252 /* This is always the 64-bit semihosting exception. 10253 * The "is this usermode" and "is semihosting enabled" 10254 * checks have been done at translate time. 10255 */ 10256 qemu_log_mask(CPU_LOG_INT, 10257 "...handling as semihosting call 0x%" PRIx64 "\n", 10258 env->xregs[0]); 10259 env->xregs[0] = do_arm_semihosting(env); 10260 return true; 10261 } 10262 return false; 10263 } else { 10264 uint32_t imm; 10265 10266 /* Only intercept calls from privileged modes, to provide some 10267 * semblance of security. 10268 */ 10269 if (cs->exception_index != EXCP_SEMIHOST && 10270 (!semihosting_enabled() || 10271 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) { 10272 return false; 10273 } 10274 10275 switch (cs->exception_index) { 10276 case EXCP_SEMIHOST: 10277 /* This is always a semihosting call; the "is this usermode" 10278 * and "is semihosting enabled" checks have been done at 10279 * translate time. 10280 */ 10281 break; 10282 case EXCP_SWI: 10283 /* Check for semihosting interrupt. */ 10284 if (env->thumb) { 10285 imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env)) 10286 & 0xff; 10287 if (imm == 0xab) { 10288 break; 10289 } 10290 } else { 10291 imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env)) 10292 & 0xffffff; 10293 if (imm == 0x123456) { 10294 break; 10295 } 10296 } 10297 return false; 10298 case EXCP_BKPT: 10299 /* See if this is a semihosting syscall. */ 10300 if (env->thumb) { 10301 imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) 10302 & 0xff; 10303 if (imm == 0xab) { 10304 env->regs[15] += 2; 10305 break; 10306 } 10307 } 10308 return false; 10309 default: 10310 return false; 10311 } 10312 10313 qemu_log_mask(CPU_LOG_INT, 10314 "...handling as semihosting call 0x%x\n", 10315 env->regs[0]); 10316 env->regs[0] = do_arm_semihosting(env); 10317 return true; 10318 } 10319 } 10320 10321 /* Handle a CPU exception for A and R profile CPUs. 10322 * Do any appropriate logging, handle PSCI calls, and then hand off 10323 * to the AArch64-entry or AArch32-entry function depending on the 10324 * target exception level's register width. 10325 */ 10326 void arm_cpu_do_interrupt(CPUState *cs) 10327 { 10328 ARMCPU *cpu = ARM_CPU(cs); 10329 CPUARMState *env = &cpu->env; 10330 unsigned int new_el = env->exception.target_el; 10331 10332 assert(!arm_feature(env, ARM_FEATURE_M)); 10333 10334 arm_log_exception(cs->exception_index); 10335 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 10336 new_el); 10337 if (qemu_loglevel_mask(CPU_LOG_INT) 10338 && !excp_is_internal(cs->exception_index)) { 10339 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 10340 syn_get_ec(env->exception.syndrome), 10341 env->exception.syndrome); 10342 } 10343 10344 if (arm_is_psci_call(cpu, cs->exception_index)) { 10345 arm_handle_psci_call(cpu); 10346 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 10347 return; 10348 } 10349 10350 /* Semihosting semantics depend on the register width of the 10351 * code that caused the exception, not the target exception level, 10352 * so must be handled here. 10353 */ 10354 if (check_for_semihosting(cs)) { 10355 return; 10356 } 10357 10358 /* Hooks may change global state so BQL should be held, also the 10359 * BQL needs to be held for any modification of 10360 * cs->interrupt_request. 10361 */ 10362 g_assert(qemu_mutex_iothread_locked()); 10363 10364 arm_call_pre_el_change_hook(cpu); 10365 10366 assert(!excp_is_internal(cs->exception_index)); 10367 if (arm_el_is_aa64(env, new_el)) { 10368 arm_cpu_do_interrupt_aarch64(cs); 10369 } else { 10370 arm_cpu_do_interrupt_aarch32(cs); 10371 } 10372 10373 arm_call_el_change_hook(cpu); 10374 10375 if (!kvm_enabled()) { 10376 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 10377 } 10378 } 10379 #endif /* !CONFIG_USER_ONLY */ 10380 10381 /* Return the exception level which controls this address translation regime */ 10382 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx) 10383 { 10384 switch (mmu_idx) { 10385 case ARMMMUIdx_S2NS: 10386 case ARMMMUIdx_S1E2: 10387 return 2; 10388 case ARMMMUIdx_S1E3: 10389 return 3; 10390 case ARMMMUIdx_S1SE0: 10391 return arm_el_is_aa64(env, 3) ? 1 : 3; 10392 case ARMMMUIdx_S1SE1: 10393 case ARMMMUIdx_S1NSE0: 10394 case ARMMMUIdx_S1NSE1: 10395 case ARMMMUIdx_MPrivNegPri: 10396 case ARMMMUIdx_MUserNegPri: 10397 case ARMMMUIdx_MPriv: 10398 case ARMMMUIdx_MUser: 10399 case ARMMMUIdx_MSPrivNegPri: 10400 case ARMMMUIdx_MSUserNegPri: 10401 case ARMMMUIdx_MSPriv: 10402 case ARMMMUIdx_MSUser: 10403 return 1; 10404 default: 10405 g_assert_not_reached(); 10406 } 10407 } 10408 10409 #ifndef CONFIG_USER_ONLY 10410 10411 /* Return the SCTLR value which controls this address translation regime */ 10412 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx) 10413 { 10414 return env->cp15.sctlr_el[regime_el(env, mmu_idx)]; 10415 } 10416 10417 /* Return true if the specified stage of address translation is disabled */ 10418 static inline bool regime_translation_disabled(CPUARMState *env, 10419 ARMMMUIdx mmu_idx) 10420 { 10421 if (arm_feature(env, ARM_FEATURE_M)) { 10422 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] & 10423 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 10424 case R_V7M_MPU_CTRL_ENABLE_MASK: 10425 /* Enabled, but not for HardFault and NMI */ 10426 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 10427 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 10428 /* Enabled for all cases */ 10429 return false; 10430 case 0: 10431 default: 10432 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 10433 * we warned about that in armv7m_nvic.c when the guest set it. 10434 */ 10435 return true; 10436 } 10437 } 10438 10439 if (mmu_idx == ARMMMUIdx_S2NS) { 10440 /* HCR.DC means HCR.VM behaves as 1 */ 10441 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0; 10442 } 10443 10444 if (env->cp15.hcr_el2 & HCR_TGE) { 10445 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */ 10446 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) { 10447 return true; 10448 } 10449 } 10450 10451 if ((env->cp15.hcr_el2 & HCR_DC) && 10452 (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) { 10453 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 10454 return true; 10455 } 10456 10457 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 10458 } 10459 10460 static inline bool regime_translation_big_endian(CPUARMState *env, 10461 ARMMMUIdx mmu_idx) 10462 { 10463 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 10464 } 10465 10466 /* Return the TTBR associated with this translation regime */ 10467 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, 10468 int ttbrn) 10469 { 10470 if (mmu_idx == ARMMMUIdx_S2NS) { 10471 return env->cp15.vttbr_el2; 10472 } 10473 if (ttbrn == 0) { 10474 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 10475 } else { 10476 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 10477 } 10478 } 10479 10480 #endif /* !CONFIG_USER_ONLY */ 10481 10482 /* Return the TCR controlling this translation regime */ 10483 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx) 10484 { 10485 if (mmu_idx == ARMMMUIdx_S2NS) { 10486 return &env->cp15.vtcr_el2; 10487 } 10488 return &env->cp15.tcr_el[regime_el(env, mmu_idx)]; 10489 } 10490 10491 /* Convert a possible stage1+2 MMU index into the appropriate 10492 * stage 1 MMU index 10493 */ 10494 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 10495 { 10496 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 10497 mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0); 10498 } 10499 return mmu_idx; 10500 } 10501 10502 /* Return true if the translation regime is using LPAE format page tables */ 10503 static inline bool regime_using_lpae_format(CPUARMState *env, 10504 ARMMMUIdx mmu_idx) 10505 { 10506 int el = regime_el(env, mmu_idx); 10507 if (el == 2 || arm_el_is_aa64(env, el)) { 10508 return true; 10509 } 10510 if (arm_feature(env, ARM_FEATURE_LPAE) 10511 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) { 10512 return true; 10513 } 10514 return false; 10515 } 10516 10517 /* Returns true if the stage 1 translation regime is using LPAE format page 10518 * tables. Used when raising alignment exceptions, whose FSR changes depending 10519 * on whether the long or short descriptor format is in use. */ 10520 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx) 10521 { 10522 mmu_idx = stage_1_mmu_idx(mmu_idx); 10523 10524 return regime_using_lpae_format(env, mmu_idx); 10525 } 10526 10527 #ifndef CONFIG_USER_ONLY 10528 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx) 10529 { 10530 switch (mmu_idx) { 10531 case ARMMMUIdx_S1SE0: 10532 case ARMMMUIdx_S1NSE0: 10533 case ARMMMUIdx_MUser: 10534 case ARMMMUIdx_MSUser: 10535 case ARMMMUIdx_MUserNegPri: 10536 case ARMMMUIdx_MSUserNegPri: 10537 return true; 10538 default: 10539 return false; 10540 case ARMMMUIdx_S12NSE0: 10541 case ARMMMUIdx_S12NSE1: 10542 g_assert_not_reached(); 10543 } 10544 } 10545 10546 /* Translate section/page access permissions to page 10547 * R/W protection flags 10548 * 10549 * @env: CPUARMState 10550 * @mmu_idx: MMU index indicating required translation regime 10551 * @ap: The 3-bit access permissions (AP[2:0]) 10552 * @domain_prot: The 2-bit domain access permissions 10553 */ 10554 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 10555 int ap, int domain_prot) 10556 { 10557 bool is_user = regime_is_user(env, mmu_idx); 10558 10559 if (domain_prot == 3) { 10560 return PAGE_READ | PAGE_WRITE; 10561 } 10562 10563 switch (ap) { 10564 case 0: 10565 if (arm_feature(env, ARM_FEATURE_V7)) { 10566 return 0; 10567 } 10568 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 10569 case SCTLR_S: 10570 return is_user ? 0 : PAGE_READ; 10571 case SCTLR_R: 10572 return PAGE_READ; 10573 default: 10574 return 0; 10575 } 10576 case 1: 10577 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 10578 case 2: 10579 if (is_user) { 10580 return PAGE_READ; 10581 } else { 10582 return PAGE_READ | PAGE_WRITE; 10583 } 10584 case 3: 10585 return PAGE_READ | PAGE_WRITE; 10586 case 4: /* Reserved. */ 10587 return 0; 10588 case 5: 10589 return is_user ? 0 : PAGE_READ; 10590 case 6: 10591 return PAGE_READ; 10592 case 7: 10593 if (!arm_feature(env, ARM_FEATURE_V6K)) { 10594 return 0; 10595 } 10596 return PAGE_READ; 10597 default: 10598 g_assert_not_reached(); 10599 } 10600 } 10601 10602 /* Translate section/page access permissions to page 10603 * R/W protection flags. 10604 * 10605 * @ap: The 2-bit simple AP (AP[2:1]) 10606 * @is_user: TRUE if accessing from PL0 10607 */ 10608 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 10609 { 10610 switch (ap) { 10611 case 0: 10612 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 10613 case 1: 10614 return PAGE_READ | PAGE_WRITE; 10615 case 2: 10616 return is_user ? 0 : PAGE_READ; 10617 case 3: 10618 return PAGE_READ; 10619 default: 10620 g_assert_not_reached(); 10621 } 10622 } 10623 10624 static inline int 10625 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 10626 { 10627 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 10628 } 10629 10630 /* Translate S2 section/page access permissions to protection flags 10631 * 10632 * @env: CPUARMState 10633 * @s2ap: The 2-bit stage2 access permissions (S2AP) 10634 * @xn: XN (execute-never) bit 10635 */ 10636 static int get_S2prot(CPUARMState *env, int s2ap, int xn) 10637 { 10638 int prot = 0; 10639 10640 if (s2ap & 1) { 10641 prot |= PAGE_READ; 10642 } 10643 if (s2ap & 2) { 10644 prot |= PAGE_WRITE; 10645 } 10646 if (!xn) { 10647 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 10648 prot |= PAGE_EXEC; 10649 } 10650 } 10651 return prot; 10652 } 10653 10654 /* Translate section/page access permissions to protection flags 10655 * 10656 * @env: CPUARMState 10657 * @mmu_idx: MMU index indicating required translation regime 10658 * @is_aa64: TRUE if AArch64 10659 * @ap: The 2-bit simple AP (AP[2:1]) 10660 * @ns: NS (non-secure) bit 10661 * @xn: XN (execute-never) bit 10662 * @pxn: PXN (privileged execute-never) bit 10663 */ 10664 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 10665 int ap, int ns, int xn, int pxn) 10666 { 10667 bool is_user = regime_is_user(env, mmu_idx); 10668 int prot_rw, user_rw; 10669 bool have_wxn; 10670 int wxn = 0; 10671 10672 assert(mmu_idx != ARMMMUIdx_S2NS); 10673 10674 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 10675 if (is_user) { 10676 prot_rw = user_rw; 10677 } else { 10678 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 10679 } 10680 10681 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 10682 return prot_rw; 10683 } 10684 10685 /* TODO have_wxn should be replaced with 10686 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 10687 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 10688 * compatible processors have EL2, which is required for [U]WXN. 10689 */ 10690 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 10691 10692 if (have_wxn) { 10693 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 10694 } 10695 10696 if (is_aa64) { 10697 switch (regime_el(env, mmu_idx)) { 10698 case 1: 10699 if (!is_user) { 10700 xn = pxn || (user_rw & PAGE_WRITE); 10701 } 10702 break; 10703 case 2: 10704 case 3: 10705 break; 10706 } 10707 } else if (arm_feature(env, ARM_FEATURE_V7)) { 10708 switch (regime_el(env, mmu_idx)) { 10709 case 1: 10710 case 3: 10711 if (is_user) { 10712 xn = xn || !(user_rw & PAGE_READ); 10713 } else { 10714 int uwxn = 0; 10715 if (have_wxn) { 10716 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 10717 } 10718 xn = xn || !(prot_rw & PAGE_READ) || pxn || 10719 (uwxn && (user_rw & PAGE_WRITE)); 10720 } 10721 break; 10722 case 2: 10723 break; 10724 } 10725 } else { 10726 xn = wxn = 0; 10727 } 10728 10729 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 10730 return prot_rw; 10731 } 10732 return prot_rw | PAGE_EXEC; 10733 } 10734 10735 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 10736 uint32_t *table, uint32_t address) 10737 { 10738 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 10739 TCR *tcr = regime_tcr(env, mmu_idx); 10740 10741 if (address & tcr->mask) { 10742 if (tcr->raw_tcr & TTBCR_PD1) { 10743 /* Translation table walk disabled for TTBR1 */ 10744 return false; 10745 } 10746 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 10747 } else { 10748 if (tcr->raw_tcr & TTBCR_PD0) { 10749 /* Translation table walk disabled for TTBR0 */ 10750 return false; 10751 } 10752 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask; 10753 } 10754 *table |= (address >> 18) & 0x3ffc; 10755 return true; 10756 } 10757 10758 /* Translate a S1 pagetable walk through S2 if needed. */ 10759 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx, 10760 hwaddr addr, MemTxAttrs txattrs, 10761 ARMMMUFaultInfo *fi) 10762 { 10763 if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) && 10764 !regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 10765 target_ulong s2size; 10766 hwaddr s2pa; 10767 int s2prot; 10768 int ret; 10769 ARMCacheAttrs cacheattrs = {}; 10770 ARMCacheAttrs *pcacheattrs = NULL; 10771 10772 if (env->cp15.hcr_el2 & HCR_PTW) { 10773 /* 10774 * PTW means we must fault if this S1 walk touches S2 Device 10775 * memory; otherwise we don't care about the attributes and can 10776 * save the S2 translation the effort of computing them. 10777 */ 10778 pcacheattrs = &cacheattrs; 10779 } 10780 10781 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa, 10782 &txattrs, &s2prot, &s2size, fi, pcacheattrs); 10783 if (ret) { 10784 assert(fi->type != ARMFault_None); 10785 fi->s2addr = addr; 10786 fi->stage2 = true; 10787 fi->s1ptw = true; 10788 return ~0; 10789 } 10790 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) { 10791 /* Access was to Device memory: generate Permission fault */ 10792 fi->type = ARMFault_Permission; 10793 fi->s2addr = addr; 10794 fi->stage2 = true; 10795 fi->s1ptw = true; 10796 return ~0; 10797 } 10798 addr = s2pa; 10799 } 10800 return addr; 10801 } 10802 10803 /* All loads done in the course of a page table walk go through here. */ 10804 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure, 10805 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 10806 { 10807 ARMCPU *cpu = ARM_CPU(cs); 10808 CPUARMState *env = &cpu->env; 10809 MemTxAttrs attrs = {}; 10810 MemTxResult result = MEMTX_OK; 10811 AddressSpace *as; 10812 uint32_t data; 10813 10814 attrs.secure = is_secure; 10815 as = arm_addressspace(cs, attrs); 10816 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 10817 if (fi->s1ptw) { 10818 return 0; 10819 } 10820 if (regime_translation_big_endian(env, mmu_idx)) { 10821 data = address_space_ldl_be(as, addr, attrs, &result); 10822 } else { 10823 data = address_space_ldl_le(as, addr, attrs, &result); 10824 } 10825 if (result == MEMTX_OK) { 10826 return data; 10827 } 10828 fi->type = ARMFault_SyncExternalOnWalk; 10829 fi->ea = arm_extabort_type(result); 10830 return 0; 10831 } 10832 10833 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, 10834 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 10835 { 10836 ARMCPU *cpu = ARM_CPU(cs); 10837 CPUARMState *env = &cpu->env; 10838 MemTxAttrs attrs = {}; 10839 MemTxResult result = MEMTX_OK; 10840 AddressSpace *as; 10841 uint64_t data; 10842 10843 attrs.secure = is_secure; 10844 as = arm_addressspace(cs, attrs); 10845 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 10846 if (fi->s1ptw) { 10847 return 0; 10848 } 10849 if (regime_translation_big_endian(env, mmu_idx)) { 10850 data = address_space_ldq_be(as, addr, attrs, &result); 10851 } else { 10852 data = address_space_ldq_le(as, addr, attrs, &result); 10853 } 10854 if (result == MEMTX_OK) { 10855 return data; 10856 } 10857 fi->type = ARMFault_SyncExternalOnWalk; 10858 fi->ea = arm_extabort_type(result); 10859 return 0; 10860 } 10861 10862 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address, 10863 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10864 hwaddr *phys_ptr, int *prot, 10865 target_ulong *page_size, 10866 ARMMMUFaultInfo *fi) 10867 { 10868 CPUState *cs = CPU(arm_env_get_cpu(env)); 10869 int level = 1; 10870 uint32_t table; 10871 uint32_t desc; 10872 int type; 10873 int ap; 10874 int domain = 0; 10875 int domain_prot; 10876 hwaddr phys_addr; 10877 uint32_t dacr; 10878 10879 /* Pagetable walk. */ 10880 /* Lookup l1 descriptor. */ 10881 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 10882 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 10883 fi->type = ARMFault_Translation; 10884 goto do_fault; 10885 } 10886 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10887 mmu_idx, fi); 10888 if (fi->type != ARMFault_None) { 10889 goto do_fault; 10890 } 10891 type = (desc & 3); 10892 domain = (desc >> 5) & 0x0f; 10893 if (regime_el(env, mmu_idx) == 1) { 10894 dacr = env->cp15.dacr_ns; 10895 } else { 10896 dacr = env->cp15.dacr_s; 10897 } 10898 domain_prot = (dacr >> (domain * 2)) & 3; 10899 if (type == 0) { 10900 /* Section translation fault. */ 10901 fi->type = ARMFault_Translation; 10902 goto do_fault; 10903 } 10904 if (type != 2) { 10905 level = 2; 10906 } 10907 if (domain_prot == 0 || domain_prot == 2) { 10908 fi->type = ARMFault_Domain; 10909 goto do_fault; 10910 } 10911 if (type == 2) { 10912 /* 1Mb section. */ 10913 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 10914 ap = (desc >> 10) & 3; 10915 *page_size = 1024 * 1024; 10916 } else { 10917 /* Lookup l2 entry. */ 10918 if (type == 1) { 10919 /* Coarse pagetable. */ 10920 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 10921 } else { 10922 /* Fine pagetable. */ 10923 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 10924 } 10925 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10926 mmu_idx, fi); 10927 if (fi->type != ARMFault_None) { 10928 goto do_fault; 10929 } 10930 switch (desc & 3) { 10931 case 0: /* Page translation fault. */ 10932 fi->type = ARMFault_Translation; 10933 goto do_fault; 10934 case 1: /* 64k page. */ 10935 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 10936 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 10937 *page_size = 0x10000; 10938 break; 10939 case 2: /* 4k page. */ 10940 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10941 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 10942 *page_size = 0x1000; 10943 break; 10944 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 10945 if (type == 1) { 10946 /* ARMv6/XScale extended small page format */ 10947 if (arm_feature(env, ARM_FEATURE_XSCALE) 10948 || arm_feature(env, ARM_FEATURE_V6)) { 10949 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10950 *page_size = 0x1000; 10951 } else { 10952 /* UNPREDICTABLE in ARMv5; we choose to take a 10953 * page translation fault. 10954 */ 10955 fi->type = ARMFault_Translation; 10956 goto do_fault; 10957 } 10958 } else { 10959 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 10960 *page_size = 0x400; 10961 } 10962 ap = (desc >> 4) & 3; 10963 break; 10964 default: 10965 /* Never happens, but compiler isn't smart enough to tell. */ 10966 abort(); 10967 } 10968 } 10969 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 10970 *prot |= *prot ? PAGE_EXEC : 0; 10971 if (!(*prot & (1 << access_type))) { 10972 /* Access permission fault. */ 10973 fi->type = ARMFault_Permission; 10974 goto do_fault; 10975 } 10976 *phys_ptr = phys_addr; 10977 return false; 10978 do_fault: 10979 fi->domain = domain; 10980 fi->level = level; 10981 return true; 10982 } 10983 10984 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, 10985 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10986 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 10987 target_ulong *page_size, ARMMMUFaultInfo *fi) 10988 { 10989 CPUState *cs = CPU(arm_env_get_cpu(env)); 10990 int level = 1; 10991 uint32_t table; 10992 uint32_t desc; 10993 uint32_t xn; 10994 uint32_t pxn = 0; 10995 int type; 10996 int ap; 10997 int domain = 0; 10998 int domain_prot; 10999 hwaddr phys_addr; 11000 uint32_t dacr; 11001 bool ns; 11002 11003 /* Pagetable walk. */ 11004 /* Lookup l1 descriptor. */ 11005 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 11006 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 11007 fi->type = ARMFault_Translation; 11008 goto do_fault; 11009 } 11010 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 11011 mmu_idx, fi); 11012 if (fi->type != ARMFault_None) { 11013 goto do_fault; 11014 } 11015 type = (desc & 3); 11016 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) { 11017 /* Section translation fault, or attempt to use the encoding 11018 * which is Reserved on implementations without PXN. 11019 */ 11020 fi->type = ARMFault_Translation; 11021 goto do_fault; 11022 } 11023 if ((type == 1) || !(desc & (1 << 18))) { 11024 /* Page or Section. */ 11025 domain = (desc >> 5) & 0x0f; 11026 } 11027 if (regime_el(env, mmu_idx) == 1) { 11028 dacr = env->cp15.dacr_ns; 11029 } else { 11030 dacr = env->cp15.dacr_s; 11031 } 11032 if (type == 1) { 11033 level = 2; 11034 } 11035 domain_prot = (dacr >> (domain * 2)) & 3; 11036 if (domain_prot == 0 || domain_prot == 2) { 11037 /* Section or Page domain fault */ 11038 fi->type = ARMFault_Domain; 11039 goto do_fault; 11040 } 11041 if (type != 1) { 11042 if (desc & (1 << 18)) { 11043 /* Supersection. */ 11044 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 11045 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 11046 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 11047 *page_size = 0x1000000; 11048 } else { 11049 /* Section. */ 11050 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 11051 *page_size = 0x100000; 11052 } 11053 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 11054 xn = desc & (1 << 4); 11055 pxn = desc & 1; 11056 ns = extract32(desc, 19, 1); 11057 } else { 11058 if (arm_feature(env, ARM_FEATURE_PXN)) { 11059 pxn = (desc >> 2) & 1; 11060 } 11061 ns = extract32(desc, 3, 1); 11062 /* Lookup l2 entry. */ 11063 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 11064 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 11065 mmu_idx, fi); 11066 if (fi->type != ARMFault_None) { 11067 goto do_fault; 11068 } 11069 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 11070 switch (desc & 3) { 11071 case 0: /* Page translation fault. */ 11072 fi->type = ARMFault_Translation; 11073 goto do_fault; 11074 case 1: /* 64k page. */ 11075 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 11076 xn = desc & (1 << 15); 11077 *page_size = 0x10000; 11078 break; 11079 case 2: case 3: /* 4k page. */ 11080 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 11081 xn = desc & 1; 11082 *page_size = 0x1000; 11083 break; 11084 default: 11085 /* Never happens, but compiler isn't smart enough to tell. */ 11086 abort(); 11087 } 11088 } 11089 if (domain_prot == 3) { 11090 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11091 } else { 11092 if (pxn && !regime_is_user(env, mmu_idx)) { 11093 xn = 1; 11094 } 11095 if (xn && access_type == MMU_INST_FETCH) { 11096 fi->type = ARMFault_Permission; 11097 goto do_fault; 11098 } 11099 11100 if (arm_feature(env, ARM_FEATURE_V6K) && 11101 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 11102 /* The simplified model uses AP[0] as an access control bit. */ 11103 if ((ap & 1) == 0) { 11104 /* Access flag fault. */ 11105 fi->type = ARMFault_AccessFlag; 11106 goto do_fault; 11107 } 11108 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 11109 } else { 11110 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 11111 } 11112 if (*prot && !xn) { 11113 *prot |= PAGE_EXEC; 11114 } 11115 if (!(*prot & (1 << access_type))) { 11116 /* Access permission fault. */ 11117 fi->type = ARMFault_Permission; 11118 goto do_fault; 11119 } 11120 } 11121 if (ns) { 11122 /* The NS bit will (as required by the architecture) have no effect if 11123 * the CPU doesn't support TZ or this is a non-secure translation 11124 * regime, because the attribute will already be non-secure. 11125 */ 11126 attrs->secure = false; 11127 } 11128 *phys_ptr = phys_addr; 11129 return false; 11130 do_fault: 11131 fi->domain = domain; 11132 fi->level = level; 11133 return true; 11134 } 11135 11136 /* 11137 * check_s2_mmu_setup 11138 * @cpu: ARMCPU 11139 * @is_aa64: True if the translation regime is in AArch64 state 11140 * @startlevel: Suggested starting level 11141 * @inputsize: Bitsize of IPAs 11142 * @stride: Page-table stride (See the ARM ARM) 11143 * 11144 * Returns true if the suggested S2 translation parameters are OK and 11145 * false otherwise. 11146 */ 11147 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, 11148 int inputsize, int stride) 11149 { 11150 const int grainsize = stride + 3; 11151 int startsizecheck; 11152 11153 /* Negative levels are never allowed. */ 11154 if (level < 0) { 11155 return false; 11156 } 11157 11158 startsizecheck = inputsize - ((3 - level) * stride + grainsize); 11159 if (startsizecheck < 1 || startsizecheck > stride + 4) { 11160 return false; 11161 } 11162 11163 if (is_aa64) { 11164 CPUARMState *env = &cpu->env; 11165 unsigned int pamax = arm_pamax(cpu); 11166 11167 switch (stride) { 11168 case 13: /* 64KB Pages. */ 11169 if (level == 0 || (level == 1 && pamax <= 42)) { 11170 return false; 11171 } 11172 break; 11173 case 11: /* 16KB Pages. */ 11174 if (level == 0 || (level == 1 && pamax <= 40)) { 11175 return false; 11176 } 11177 break; 11178 case 9: /* 4KB Pages. */ 11179 if (level == 0 && pamax <= 42) { 11180 return false; 11181 } 11182 break; 11183 default: 11184 g_assert_not_reached(); 11185 } 11186 11187 /* Inputsize checks. */ 11188 if (inputsize > pamax && 11189 (arm_el_is_aa64(env, 1) || inputsize > 40)) { 11190 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */ 11191 return false; 11192 } 11193 } else { 11194 /* AArch32 only supports 4KB pages. Assert on that. */ 11195 assert(stride == 9); 11196 11197 if (level == 0) { 11198 return false; 11199 } 11200 } 11201 return true; 11202 } 11203 11204 /* Translate from the 4-bit stage 2 representation of 11205 * memory attributes (without cache-allocation hints) to 11206 * the 8-bit representation of the stage 1 MAIR registers 11207 * (which includes allocation hints). 11208 * 11209 * ref: shared/translation/attrs/S2AttrDecode() 11210 * .../S2ConvertAttrsHints() 11211 */ 11212 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs) 11213 { 11214 uint8_t hiattr = extract32(s2attrs, 2, 2); 11215 uint8_t loattr = extract32(s2attrs, 0, 2); 11216 uint8_t hihint = 0, lohint = 0; 11217 11218 if (hiattr != 0) { /* normal memory */ 11219 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */ 11220 hiattr = loattr = 1; /* non-cacheable */ 11221 } else { 11222 if (hiattr != 1) { /* Write-through or write-back */ 11223 hihint = 3; /* RW allocate */ 11224 } 11225 if (loattr != 1) { /* Write-through or write-back */ 11226 lohint = 3; /* RW allocate */ 11227 } 11228 } 11229 } 11230 11231 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 11232 } 11233 #endif /* !CONFIG_USER_ONLY */ 11234 11235 ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va, 11236 ARMMMUIdx mmu_idx) 11237 { 11238 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 11239 uint32_t el = regime_el(env, mmu_idx); 11240 bool tbi, tbid, epd, hpd, using16k, using64k; 11241 int select, tsz; 11242 11243 /* 11244 * Bit 55 is always between the two regions, and is canonical for 11245 * determining if address tagging is enabled. 11246 */ 11247 select = extract64(va, 55, 1); 11248 11249 if (el > 1) { 11250 tsz = extract32(tcr, 0, 6); 11251 using64k = extract32(tcr, 14, 1); 11252 using16k = extract32(tcr, 15, 1); 11253 if (mmu_idx == ARMMMUIdx_S2NS) { 11254 /* VTCR_EL2 */ 11255 tbi = tbid = hpd = false; 11256 } else { 11257 tbi = extract32(tcr, 20, 1); 11258 hpd = extract32(tcr, 24, 1); 11259 tbid = extract32(tcr, 29, 1); 11260 } 11261 epd = false; 11262 } else if (!select) { 11263 tsz = extract32(tcr, 0, 6); 11264 epd = extract32(tcr, 7, 1); 11265 using64k = extract32(tcr, 14, 1); 11266 using16k = extract32(tcr, 15, 1); 11267 tbi = extract64(tcr, 37, 1); 11268 hpd = extract64(tcr, 41, 1); 11269 tbid = extract64(tcr, 51, 1); 11270 } else { 11271 int tg = extract32(tcr, 30, 2); 11272 using16k = tg == 1; 11273 using64k = tg == 3; 11274 tsz = extract32(tcr, 16, 6); 11275 epd = extract32(tcr, 23, 1); 11276 tbi = extract64(tcr, 38, 1); 11277 hpd = extract64(tcr, 42, 1); 11278 tbid = extract64(tcr, 52, 1); 11279 } 11280 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */ 11281 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */ 11282 11283 return (ARMVAParameters) { 11284 .tsz = tsz, 11285 .select = select, 11286 .tbi = tbi, 11287 .tbid = tbid, 11288 .epd = epd, 11289 .hpd = hpd, 11290 .using16k = using16k, 11291 .using64k = using64k, 11292 }; 11293 } 11294 11295 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 11296 ARMMMUIdx mmu_idx, bool data) 11297 { 11298 ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx); 11299 11300 /* Present TBI as a composite with TBID. */ 11301 ret.tbi &= (data || !ret.tbid); 11302 return ret; 11303 } 11304 11305 #ifndef CONFIG_USER_ONLY 11306 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 11307 ARMMMUIdx mmu_idx) 11308 { 11309 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 11310 uint32_t el = regime_el(env, mmu_idx); 11311 int select, tsz; 11312 bool epd, hpd; 11313 11314 if (mmu_idx == ARMMMUIdx_S2NS) { 11315 /* VTCR */ 11316 bool sext = extract32(tcr, 4, 1); 11317 bool sign = extract32(tcr, 3, 1); 11318 11319 /* 11320 * If the sign-extend bit is not the same as t0sz[3], the result 11321 * is unpredictable. Flag this as a guest error. 11322 */ 11323 if (sign != sext) { 11324 qemu_log_mask(LOG_GUEST_ERROR, 11325 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 11326 } 11327 tsz = sextract32(tcr, 0, 4) + 8; 11328 select = 0; 11329 hpd = false; 11330 epd = false; 11331 } else if (el == 2) { 11332 /* HTCR */ 11333 tsz = extract32(tcr, 0, 3); 11334 select = 0; 11335 hpd = extract64(tcr, 24, 1); 11336 epd = false; 11337 } else { 11338 int t0sz = extract32(tcr, 0, 3); 11339 int t1sz = extract32(tcr, 16, 3); 11340 11341 if (t1sz == 0) { 11342 select = va > (0xffffffffu >> t0sz); 11343 } else { 11344 /* Note that we will detect errors later. */ 11345 select = va >= ~(0xffffffffu >> t1sz); 11346 } 11347 if (!select) { 11348 tsz = t0sz; 11349 epd = extract32(tcr, 7, 1); 11350 hpd = extract64(tcr, 41, 1); 11351 } else { 11352 tsz = t1sz; 11353 epd = extract32(tcr, 23, 1); 11354 hpd = extract64(tcr, 42, 1); 11355 } 11356 /* For aarch32, hpd0 is not enabled without t2e as well. */ 11357 hpd &= extract32(tcr, 6, 1); 11358 } 11359 11360 return (ARMVAParameters) { 11361 .tsz = tsz, 11362 .select = select, 11363 .epd = epd, 11364 .hpd = hpd, 11365 }; 11366 } 11367 11368 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 11369 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11370 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 11371 target_ulong *page_size_ptr, 11372 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 11373 { 11374 ARMCPU *cpu = arm_env_get_cpu(env); 11375 CPUState *cs = CPU(cpu); 11376 /* Read an LPAE long-descriptor translation table. */ 11377 ARMFaultType fault_type = ARMFault_Translation; 11378 uint32_t level; 11379 ARMVAParameters param; 11380 uint64_t ttbr; 11381 hwaddr descaddr, indexmask, indexmask_grainsize; 11382 uint32_t tableattrs; 11383 target_ulong page_size; 11384 uint32_t attrs; 11385 int32_t stride; 11386 int addrsize, inputsize; 11387 TCR *tcr = regime_tcr(env, mmu_idx); 11388 int ap, ns, xn, pxn; 11389 uint32_t el = regime_el(env, mmu_idx); 11390 bool ttbr1_valid; 11391 uint64_t descaddrmask; 11392 bool aarch64 = arm_el_is_aa64(env, el); 11393 bool guarded = false; 11394 11395 /* TODO: 11396 * This code does not handle the different format TCR for VTCR_EL2. 11397 * This code also does not support shareability levels. 11398 * Attribute and permission bit handling should also be checked when adding 11399 * support for those page table walks. 11400 */ 11401 if (aarch64) { 11402 param = aa64_va_parameters(env, address, mmu_idx, 11403 access_type != MMU_INST_FETCH); 11404 level = 0; 11405 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it 11406 * invalid. 11407 */ 11408 ttbr1_valid = (el < 2); 11409 addrsize = 64 - 8 * param.tbi; 11410 inputsize = 64 - param.tsz; 11411 } else { 11412 param = aa32_va_parameters(env, address, mmu_idx); 11413 level = 1; 11414 /* There is no TTBR1 for EL2 */ 11415 ttbr1_valid = (el != 2); 11416 addrsize = (mmu_idx == ARMMMUIdx_S2NS ? 40 : 32); 11417 inputsize = addrsize - param.tsz; 11418 } 11419 11420 /* 11421 * We determined the region when collecting the parameters, but we 11422 * have not yet validated that the address is valid for the region. 11423 * Extract the top bits and verify that they all match select. 11424 * 11425 * For aa32, if inputsize == addrsize, then we have selected the 11426 * region by exclusion in aa32_va_parameters and there is no more 11427 * validation to do here. 11428 */ 11429 if (inputsize < addrsize) { 11430 target_ulong top_bits = sextract64(address, inputsize, 11431 addrsize - inputsize); 11432 if (-top_bits != param.select || (param.select && !ttbr1_valid)) { 11433 /* The gap between the two regions is a Translation fault */ 11434 fault_type = ARMFault_Translation; 11435 goto do_fault; 11436 } 11437 } 11438 11439 if (param.using64k) { 11440 stride = 13; 11441 } else if (param.using16k) { 11442 stride = 11; 11443 } else { 11444 stride = 9; 11445 } 11446 11447 /* Note that QEMU ignores shareability and cacheability attributes, 11448 * so we don't need to do anything with the SH, ORGN, IRGN fields 11449 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 11450 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 11451 * implement any ASID-like capability so we can ignore it (instead 11452 * we will always flush the TLB any time the ASID is changed). 11453 */ 11454 ttbr = regime_ttbr(env, mmu_idx, param.select); 11455 11456 /* Here we should have set up all the parameters for the translation: 11457 * inputsize, ttbr, epd, stride, tbi 11458 */ 11459 11460 if (param.epd) { 11461 /* Translation table walk disabled => Translation fault on TLB miss 11462 * Note: This is always 0 on 64-bit EL2 and EL3. 11463 */ 11464 goto do_fault; 11465 } 11466 11467 if (mmu_idx != ARMMMUIdx_S2NS) { 11468 /* The starting level depends on the virtual address size (which can 11469 * be up to 48 bits) and the translation granule size. It indicates 11470 * the number of strides (stride bits at a time) needed to 11471 * consume the bits of the input address. In the pseudocode this is: 11472 * level = 4 - RoundUp((inputsize - grainsize) / stride) 11473 * where their 'inputsize' is our 'inputsize', 'grainsize' is 11474 * our 'stride + 3' and 'stride' is our 'stride'. 11475 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 11476 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 11477 * = 4 - (inputsize - 4) / stride; 11478 */ 11479 level = 4 - (inputsize - 4) / stride; 11480 } else { 11481 /* For stage 2 translations the starting level is specified by the 11482 * VTCR_EL2.SL0 field (whose interpretation depends on the page size) 11483 */ 11484 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2); 11485 uint32_t startlevel; 11486 bool ok; 11487 11488 if (!aarch64 || stride == 9) { 11489 /* AArch32 or 4KB pages */ 11490 startlevel = 2 - sl0; 11491 } else { 11492 /* 16KB or 64KB pages */ 11493 startlevel = 3 - sl0; 11494 } 11495 11496 /* Check that the starting level is valid. */ 11497 ok = check_s2_mmu_setup(cpu, aarch64, startlevel, 11498 inputsize, stride); 11499 if (!ok) { 11500 fault_type = ARMFault_Translation; 11501 goto do_fault; 11502 } 11503 level = startlevel; 11504 } 11505 11506 indexmask_grainsize = (1ULL << (stride + 3)) - 1; 11507 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1; 11508 11509 /* Now we can extract the actual base address from the TTBR */ 11510 descaddr = extract64(ttbr, 0, 48); 11511 descaddr &= ~indexmask; 11512 11513 /* The address field in the descriptor goes up to bit 39 for ARMv7 11514 * but up to bit 47 for ARMv8, but we use the descaddrmask 11515 * up to bit 39 for AArch32, because we don't need other bits in that case 11516 * to construct next descriptor address (anyway they should be all zeroes). 11517 */ 11518 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) & 11519 ~indexmask_grainsize; 11520 11521 /* Secure accesses start with the page table in secure memory and 11522 * can be downgraded to non-secure at any step. Non-secure accesses 11523 * remain non-secure. We implement this by just ORing in the NSTable/NS 11524 * bits at each step. 11525 */ 11526 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4); 11527 for (;;) { 11528 uint64_t descriptor; 11529 bool nstable; 11530 11531 descaddr |= (address >> (stride * (4 - level))) & indexmask; 11532 descaddr &= ~7ULL; 11533 nstable = extract32(tableattrs, 4, 1); 11534 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi); 11535 if (fi->type != ARMFault_None) { 11536 goto do_fault; 11537 } 11538 11539 if (!(descriptor & 1) || 11540 (!(descriptor & 2) && (level == 3))) { 11541 /* Invalid, or the Reserved level 3 encoding */ 11542 goto do_fault; 11543 } 11544 descaddr = descriptor & descaddrmask; 11545 11546 if ((descriptor & 2) && (level < 3)) { 11547 /* Table entry. The top five bits are attributes which may 11548 * propagate down through lower levels of the table (and 11549 * which are all arranged so that 0 means "no effect", so 11550 * we can gather them up by ORing in the bits at each level). 11551 */ 11552 tableattrs |= extract64(descriptor, 59, 5); 11553 level++; 11554 indexmask = indexmask_grainsize; 11555 continue; 11556 } 11557 /* Block entry at level 1 or 2, or page entry at level 3. 11558 * These are basically the same thing, although the number 11559 * of bits we pull in from the vaddr varies. 11560 */ 11561 page_size = (1ULL << ((stride * (4 - level)) + 3)); 11562 descaddr |= (address & (page_size - 1)); 11563 /* Extract attributes from the descriptor */ 11564 attrs = extract64(descriptor, 2, 10) 11565 | (extract64(descriptor, 52, 12) << 10); 11566 11567 if (mmu_idx == ARMMMUIdx_S2NS) { 11568 /* Stage 2 table descriptors do not include any attribute fields */ 11569 break; 11570 } 11571 /* Merge in attributes from table descriptors */ 11572 attrs |= nstable << 3; /* NS */ 11573 guarded = extract64(descriptor, 50, 1); /* GP */ 11574 if (param.hpd) { 11575 /* HPD disables all the table attributes except NSTable. */ 11576 break; 11577 } 11578 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */ 11579 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 11580 * means "force PL1 access only", which means forcing AP[1] to 0. 11581 */ 11582 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */ 11583 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */ 11584 break; 11585 } 11586 /* Here descaddr is the final physical address, and attributes 11587 * are all in attrs. 11588 */ 11589 fault_type = ARMFault_AccessFlag; 11590 if ((attrs & (1 << 8)) == 0) { 11591 /* Access flag */ 11592 goto do_fault; 11593 } 11594 11595 ap = extract32(attrs, 4, 2); 11596 xn = extract32(attrs, 12, 1); 11597 11598 if (mmu_idx == ARMMMUIdx_S2NS) { 11599 ns = true; 11600 *prot = get_S2prot(env, ap, xn); 11601 } else { 11602 ns = extract32(attrs, 3, 1); 11603 pxn = extract32(attrs, 11, 1); 11604 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 11605 } 11606 11607 fault_type = ARMFault_Permission; 11608 if (!(*prot & (1 << access_type))) { 11609 goto do_fault; 11610 } 11611 11612 if (ns) { 11613 /* The NS bit will (as required by the architecture) have no effect if 11614 * the CPU doesn't support TZ or this is a non-secure translation 11615 * regime, because the attribute will already be non-secure. 11616 */ 11617 txattrs->secure = false; 11618 } 11619 /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB. */ 11620 if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) { 11621 txattrs->target_tlb_bit0 = true; 11622 } 11623 11624 if (cacheattrs != NULL) { 11625 if (mmu_idx == ARMMMUIdx_S2NS) { 11626 cacheattrs->attrs = convert_stage2_attrs(env, 11627 extract32(attrs, 0, 4)); 11628 } else { 11629 /* Index into MAIR registers for cache attributes */ 11630 uint8_t attrindx = extract32(attrs, 0, 3); 11631 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 11632 assert(attrindx <= 7); 11633 cacheattrs->attrs = extract64(mair, attrindx * 8, 8); 11634 } 11635 cacheattrs->shareability = extract32(attrs, 6, 2); 11636 } 11637 11638 *phys_ptr = descaddr; 11639 *page_size_ptr = page_size; 11640 return false; 11641 11642 do_fault: 11643 fi->type = fault_type; 11644 fi->level = level; 11645 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 11646 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS); 11647 return true; 11648 } 11649 11650 static inline void get_phys_addr_pmsav7_default(CPUARMState *env, 11651 ARMMMUIdx mmu_idx, 11652 int32_t address, int *prot) 11653 { 11654 if (!arm_feature(env, ARM_FEATURE_M)) { 11655 *prot = PAGE_READ | PAGE_WRITE; 11656 switch (address) { 11657 case 0xF0000000 ... 0xFFFFFFFF: 11658 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 11659 /* hivecs execing is ok */ 11660 *prot |= PAGE_EXEC; 11661 } 11662 break; 11663 case 0x00000000 ... 0x7FFFFFFF: 11664 *prot |= PAGE_EXEC; 11665 break; 11666 } 11667 } else { 11668 /* Default system address map for M profile cores. 11669 * The architecture specifies which regions are execute-never; 11670 * at the MPU level no other checks are defined. 11671 */ 11672 switch (address) { 11673 case 0x00000000 ... 0x1fffffff: /* ROM */ 11674 case 0x20000000 ... 0x3fffffff: /* SRAM */ 11675 case 0x60000000 ... 0x7fffffff: /* RAM */ 11676 case 0x80000000 ... 0x9fffffff: /* RAM */ 11677 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11678 break; 11679 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 11680 case 0xa0000000 ... 0xbfffffff: /* Device */ 11681 case 0xc0000000 ... 0xdfffffff: /* Device */ 11682 case 0xe0000000 ... 0xffffffff: /* System */ 11683 *prot = PAGE_READ | PAGE_WRITE; 11684 break; 11685 default: 11686 g_assert_not_reached(); 11687 } 11688 } 11689 } 11690 11691 static bool pmsav7_use_background_region(ARMCPU *cpu, 11692 ARMMMUIdx mmu_idx, bool is_user) 11693 { 11694 /* Return true if we should use the default memory map as a 11695 * "background" region if there are no hits against any MPU regions. 11696 */ 11697 CPUARMState *env = &cpu->env; 11698 11699 if (is_user) { 11700 return false; 11701 } 11702 11703 if (arm_feature(env, ARM_FEATURE_M)) { 11704 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] 11705 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 11706 } else { 11707 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 11708 } 11709 } 11710 11711 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address) 11712 { 11713 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 11714 return arm_feature(env, ARM_FEATURE_M) && 11715 extract32(address, 20, 12) == 0xe00; 11716 } 11717 11718 static inline bool m_is_system_region(CPUARMState *env, uint32_t address) 11719 { 11720 /* True if address is in the M profile system region 11721 * 0xe0000000 - 0xffffffff 11722 */ 11723 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 11724 } 11725 11726 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 11727 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11728 hwaddr *phys_ptr, int *prot, 11729 target_ulong *page_size, 11730 ARMMMUFaultInfo *fi) 11731 { 11732 ARMCPU *cpu = arm_env_get_cpu(env); 11733 int n; 11734 bool is_user = regime_is_user(env, mmu_idx); 11735 11736 *phys_ptr = address; 11737 *page_size = TARGET_PAGE_SIZE; 11738 *prot = 0; 11739 11740 if (regime_translation_disabled(env, mmu_idx) || 11741 m_is_ppb_region(env, address)) { 11742 /* MPU disabled or M profile PPB access: use default memory map. 11743 * The other case which uses the default memory map in the 11744 * v7M ARM ARM pseudocode is exception vector reads from the vector 11745 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 11746 * which always does a direct read using address_space_ldl(), rather 11747 * than going via this function, so we don't need to check that here. 11748 */ 11749 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11750 } else { /* MPU enabled */ 11751 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 11752 /* region search */ 11753 uint32_t base = env->pmsav7.drbar[n]; 11754 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 11755 uint32_t rmask; 11756 bool srdis = false; 11757 11758 if (!(env->pmsav7.drsr[n] & 0x1)) { 11759 continue; 11760 } 11761 11762 if (!rsize) { 11763 qemu_log_mask(LOG_GUEST_ERROR, 11764 "DRSR[%d]: Rsize field cannot be 0\n", n); 11765 continue; 11766 } 11767 rsize++; 11768 rmask = (1ull << rsize) - 1; 11769 11770 if (base & rmask) { 11771 qemu_log_mask(LOG_GUEST_ERROR, 11772 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 11773 "to DRSR region size, mask = 0x%" PRIx32 "\n", 11774 n, base, rmask); 11775 continue; 11776 } 11777 11778 if (address < base || address > base + rmask) { 11779 /* 11780 * Address not in this region. We must check whether the 11781 * region covers addresses in the same page as our address. 11782 * In that case we must not report a size that covers the 11783 * whole page for a subsequent hit against a different MPU 11784 * region or the background region, because it would result in 11785 * incorrect TLB hits for subsequent accesses to addresses that 11786 * are in this MPU region. 11787 */ 11788 if (ranges_overlap(base, rmask, 11789 address & TARGET_PAGE_MASK, 11790 TARGET_PAGE_SIZE)) { 11791 *page_size = 1; 11792 } 11793 continue; 11794 } 11795 11796 /* Region matched */ 11797 11798 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 11799 int i, snd; 11800 uint32_t srdis_mask; 11801 11802 rsize -= 3; /* sub region size (power of 2) */ 11803 snd = ((address - base) >> rsize) & 0x7; 11804 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 11805 11806 srdis_mask = srdis ? 0x3 : 0x0; 11807 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 11808 /* This will check in groups of 2, 4 and then 8, whether 11809 * the subregion bits are consistent. rsize is incremented 11810 * back up to give the region size, considering consistent 11811 * adjacent subregions as one region. Stop testing if rsize 11812 * is already big enough for an entire QEMU page. 11813 */ 11814 int snd_rounded = snd & ~(i - 1); 11815 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 11816 snd_rounded + 8, i); 11817 if (srdis_mask ^ srdis_multi) { 11818 break; 11819 } 11820 srdis_mask = (srdis_mask << i) | srdis_mask; 11821 rsize++; 11822 } 11823 } 11824 if (srdis) { 11825 continue; 11826 } 11827 if (rsize < TARGET_PAGE_BITS) { 11828 *page_size = 1 << rsize; 11829 } 11830 break; 11831 } 11832 11833 if (n == -1) { /* no hits */ 11834 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 11835 /* background fault */ 11836 fi->type = ARMFault_Background; 11837 return true; 11838 } 11839 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11840 } else { /* a MPU hit! */ 11841 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 11842 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 11843 11844 if (m_is_system_region(env, address)) { 11845 /* System space is always execute never */ 11846 xn = 1; 11847 } 11848 11849 if (is_user) { /* User mode AP bit decoding */ 11850 switch (ap) { 11851 case 0: 11852 case 1: 11853 case 5: 11854 break; /* no access */ 11855 case 3: 11856 *prot |= PAGE_WRITE; 11857 /* fall through */ 11858 case 2: 11859 case 6: 11860 *prot |= PAGE_READ | PAGE_EXEC; 11861 break; 11862 case 7: 11863 /* for v7M, same as 6; for R profile a reserved value */ 11864 if (arm_feature(env, ARM_FEATURE_M)) { 11865 *prot |= PAGE_READ | PAGE_EXEC; 11866 break; 11867 } 11868 /* fall through */ 11869 default: 11870 qemu_log_mask(LOG_GUEST_ERROR, 11871 "DRACR[%d]: Bad value for AP bits: 0x%" 11872 PRIx32 "\n", n, ap); 11873 } 11874 } else { /* Priv. mode AP bits decoding */ 11875 switch (ap) { 11876 case 0: 11877 break; /* no access */ 11878 case 1: 11879 case 2: 11880 case 3: 11881 *prot |= PAGE_WRITE; 11882 /* fall through */ 11883 case 5: 11884 case 6: 11885 *prot |= PAGE_READ | PAGE_EXEC; 11886 break; 11887 case 7: 11888 /* for v7M, same as 6; for R profile a reserved value */ 11889 if (arm_feature(env, ARM_FEATURE_M)) { 11890 *prot |= PAGE_READ | PAGE_EXEC; 11891 break; 11892 } 11893 /* fall through */ 11894 default: 11895 qemu_log_mask(LOG_GUEST_ERROR, 11896 "DRACR[%d]: Bad value for AP bits: 0x%" 11897 PRIx32 "\n", n, ap); 11898 } 11899 } 11900 11901 /* execute never */ 11902 if (xn) { 11903 *prot &= ~PAGE_EXEC; 11904 } 11905 } 11906 } 11907 11908 fi->type = ARMFault_Permission; 11909 fi->level = 1; 11910 return !(*prot & (1 << access_type)); 11911 } 11912 11913 static bool v8m_is_sau_exempt(CPUARMState *env, 11914 uint32_t address, MMUAccessType access_type) 11915 { 11916 /* The architecture specifies that certain address ranges are 11917 * exempt from v8M SAU/IDAU checks. 11918 */ 11919 return 11920 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 11921 (address >= 0xe0000000 && address <= 0xe0002fff) || 11922 (address >= 0xe000e000 && address <= 0xe000efff) || 11923 (address >= 0xe002e000 && address <= 0xe002efff) || 11924 (address >= 0xe0040000 && address <= 0xe0041fff) || 11925 (address >= 0xe00ff000 && address <= 0xe00fffff); 11926 } 11927 11928 static void v8m_security_lookup(CPUARMState *env, uint32_t address, 11929 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11930 V8M_SAttributes *sattrs) 11931 { 11932 /* Look up the security attributes for this address. Compare the 11933 * pseudocode SecurityCheck() function. 11934 * We assume the caller has zero-initialized *sattrs. 11935 */ 11936 ARMCPU *cpu = arm_env_get_cpu(env); 11937 int r; 11938 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 11939 int idau_region = IREGION_NOTVALID; 11940 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 11941 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 11942 11943 if (cpu->idau) { 11944 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 11945 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 11946 11947 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 11948 &idau_nsc); 11949 } 11950 11951 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 11952 /* 0xf0000000..0xffffffff is always S for insn fetches */ 11953 return; 11954 } 11955 11956 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 11957 sattrs->ns = !regime_is_secure(env, mmu_idx); 11958 return; 11959 } 11960 11961 if (idau_region != IREGION_NOTVALID) { 11962 sattrs->irvalid = true; 11963 sattrs->iregion = idau_region; 11964 } 11965 11966 switch (env->sau.ctrl & 3) { 11967 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 11968 break; 11969 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 11970 sattrs->ns = true; 11971 break; 11972 default: /* SAU.ENABLE == 1 */ 11973 for (r = 0; r < cpu->sau_sregion; r++) { 11974 if (env->sau.rlar[r] & 1) { 11975 uint32_t base = env->sau.rbar[r] & ~0x1f; 11976 uint32_t limit = env->sau.rlar[r] | 0x1f; 11977 11978 if (base <= address && limit >= address) { 11979 if (base > addr_page_base || limit < addr_page_limit) { 11980 sattrs->subpage = true; 11981 } 11982 if (sattrs->srvalid) { 11983 /* If we hit in more than one region then we must report 11984 * as Secure, not NS-Callable, with no valid region 11985 * number info. 11986 */ 11987 sattrs->ns = false; 11988 sattrs->nsc = false; 11989 sattrs->sregion = 0; 11990 sattrs->srvalid = false; 11991 break; 11992 } else { 11993 if (env->sau.rlar[r] & 2) { 11994 sattrs->nsc = true; 11995 } else { 11996 sattrs->ns = true; 11997 } 11998 sattrs->srvalid = true; 11999 sattrs->sregion = r; 12000 } 12001 } else { 12002 /* 12003 * Address not in this region. We must check whether the 12004 * region covers addresses in the same page as our address. 12005 * In that case we must not report a size that covers the 12006 * whole page for a subsequent hit against a different MPU 12007 * region or the background region, because it would result 12008 * in incorrect TLB hits for subsequent accesses to 12009 * addresses that are in this MPU region. 12010 */ 12011 if (limit >= base && 12012 ranges_overlap(base, limit - base + 1, 12013 addr_page_base, 12014 TARGET_PAGE_SIZE)) { 12015 sattrs->subpage = true; 12016 } 12017 } 12018 } 12019 } 12020 break; 12021 } 12022 12023 /* 12024 * The IDAU will override the SAU lookup results if it specifies 12025 * higher security than the SAU does. 12026 */ 12027 if (!idau_ns) { 12028 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 12029 sattrs->ns = false; 12030 sattrs->nsc = idau_nsc; 12031 } 12032 } 12033 } 12034 12035 static bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 12036 MMUAccessType access_type, ARMMMUIdx mmu_idx, 12037 hwaddr *phys_ptr, MemTxAttrs *txattrs, 12038 int *prot, bool *is_subpage, 12039 ARMMMUFaultInfo *fi, uint32_t *mregion) 12040 { 12041 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check 12042 * that a full phys-to-virt translation does). 12043 * mregion is (if not NULL) set to the region number which matched, 12044 * or -1 if no region number is returned (MPU off, address did not 12045 * hit a region, address hit in multiple regions). 12046 * We set is_subpage to true if the region hit doesn't cover the 12047 * entire TARGET_PAGE the address is within. 12048 */ 12049 ARMCPU *cpu = arm_env_get_cpu(env); 12050 bool is_user = regime_is_user(env, mmu_idx); 12051 uint32_t secure = regime_is_secure(env, mmu_idx); 12052 int n; 12053 int matchregion = -1; 12054 bool hit = false; 12055 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 12056 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 12057 12058 *is_subpage = false; 12059 *phys_ptr = address; 12060 *prot = 0; 12061 if (mregion) { 12062 *mregion = -1; 12063 } 12064 12065 /* Unlike the ARM ARM pseudocode, we don't need to check whether this 12066 * was an exception vector read from the vector table (which is always 12067 * done using the default system address map), because those accesses 12068 * are done in arm_v7m_load_vector(), which always does a direct 12069 * read using address_space_ldl(), rather than going via this function. 12070 */ 12071 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */ 12072 hit = true; 12073 } else if (m_is_ppb_region(env, address)) { 12074 hit = true; 12075 } else { 12076 if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 12077 hit = true; 12078 } 12079 12080 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 12081 /* region search */ 12082 /* Note that the base address is bits [31:5] from the register 12083 * with bits [4:0] all zeroes, but the limit address is bits 12084 * [31:5] from the register with bits [4:0] all ones. 12085 */ 12086 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f; 12087 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f; 12088 12089 if (!(env->pmsav8.rlar[secure][n] & 0x1)) { 12090 /* Region disabled */ 12091 continue; 12092 } 12093 12094 if (address < base || address > limit) { 12095 /* 12096 * Address not in this region. We must check whether the 12097 * region covers addresses in the same page as our address. 12098 * In that case we must not report a size that covers the 12099 * whole page for a subsequent hit against a different MPU 12100 * region or the background region, because it would result in 12101 * incorrect TLB hits for subsequent accesses to addresses that 12102 * are in this MPU region. 12103 */ 12104 if (limit >= base && 12105 ranges_overlap(base, limit - base + 1, 12106 addr_page_base, 12107 TARGET_PAGE_SIZE)) { 12108 *is_subpage = true; 12109 } 12110 continue; 12111 } 12112 12113 if (base > addr_page_base || limit < addr_page_limit) { 12114 *is_subpage = true; 12115 } 12116 12117 if (matchregion != -1) { 12118 /* Multiple regions match -- always a failure (unlike 12119 * PMSAv7 where highest-numbered-region wins) 12120 */ 12121 fi->type = ARMFault_Permission; 12122 fi->level = 1; 12123 return true; 12124 } 12125 12126 matchregion = n; 12127 hit = true; 12128 } 12129 } 12130 12131 if (!hit) { 12132 /* background fault */ 12133 fi->type = ARMFault_Background; 12134 return true; 12135 } 12136 12137 if (matchregion == -1) { 12138 /* hit using the background region */ 12139 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 12140 } else { 12141 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2); 12142 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1); 12143 12144 if (m_is_system_region(env, address)) { 12145 /* System space is always execute never */ 12146 xn = 1; 12147 } 12148 12149 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 12150 if (*prot && !xn) { 12151 *prot |= PAGE_EXEC; 12152 } 12153 /* We don't need to look the attribute up in the MAIR0/MAIR1 12154 * registers because that only tells us about cacheability. 12155 */ 12156 if (mregion) { 12157 *mregion = matchregion; 12158 } 12159 } 12160 12161 fi->type = ARMFault_Permission; 12162 fi->level = 1; 12163 return !(*prot & (1 << access_type)); 12164 } 12165 12166 12167 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 12168 MMUAccessType access_type, ARMMMUIdx mmu_idx, 12169 hwaddr *phys_ptr, MemTxAttrs *txattrs, 12170 int *prot, target_ulong *page_size, 12171 ARMMMUFaultInfo *fi) 12172 { 12173 uint32_t secure = regime_is_secure(env, mmu_idx); 12174 V8M_SAttributes sattrs = {}; 12175 bool ret; 12176 bool mpu_is_subpage; 12177 12178 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 12179 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs); 12180 if (access_type == MMU_INST_FETCH) { 12181 /* Instruction fetches always use the MMU bank and the 12182 * transaction attribute determined by the fetch address, 12183 * regardless of CPU state. This is painful for QEMU 12184 * to handle, because it would mean we need to encode 12185 * into the mmu_idx not just the (user, negpri) information 12186 * for the current security state but also that for the 12187 * other security state, which would balloon the number 12188 * of mmu_idx values needed alarmingly. 12189 * Fortunately we can avoid this because it's not actually 12190 * possible to arbitrarily execute code from memory with 12191 * the wrong security attribute: it will always generate 12192 * an exception of some kind or another, apart from the 12193 * special case of an NS CPU executing an SG instruction 12194 * in S&NSC memory. So we always just fail the translation 12195 * here and sort things out in the exception handler 12196 * (including possibly emulating an SG instruction). 12197 */ 12198 if (sattrs.ns != !secure) { 12199 if (sattrs.nsc) { 12200 fi->type = ARMFault_QEMU_NSCExec; 12201 } else { 12202 fi->type = ARMFault_QEMU_SFault; 12203 } 12204 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 12205 *phys_ptr = address; 12206 *prot = 0; 12207 return true; 12208 } 12209 } else { 12210 /* For data accesses we always use the MMU bank indicated 12211 * by the current CPU state, but the security attributes 12212 * might downgrade a secure access to nonsecure. 12213 */ 12214 if (sattrs.ns) { 12215 txattrs->secure = false; 12216 } else if (!secure) { 12217 /* NS access to S memory must fault. 12218 * Architecturally we should first check whether the 12219 * MPU information for this address indicates that we 12220 * are doing an unaligned access to Device memory, which 12221 * should generate a UsageFault instead. QEMU does not 12222 * currently check for that kind of unaligned access though. 12223 * If we added it we would need to do so as a special case 12224 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 12225 */ 12226 fi->type = ARMFault_QEMU_SFault; 12227 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 12228 *phys_ptr = address; 12229 *prot = 0; 12230 return true; 12231 } 12232 } 12233 } 12234 12235 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr, 12236 txattrs, prot, &mpu_is_subpage, fi, NULL); 12237 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE; 12238 return ret; 12239 } 12240 12241 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 12242 MMUAccessType access_type, ARMMMUIdx mmu_idx, 12243 hwaddr *phys_ptr, int *prot, 12244 ARMMMUFaultInfo *fi) 12245 { 12246 int n; 12247 uint32_t mask; 12248 uint32_t base; 12249 bool is_user = regime_is_user(env, mmu_idx); 12250 12251 if (regime_translation_disabled(env, mmu_idx)) { 12252 /* MPU disabled. */ 12253 *phys_ptr = address; 12254 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 12255 return false; 12256 } 12257 12258 *phys_ptr = address; 12259 for (n = 7; n >= 0; n--) { 12260 base = env->cp15.c6_region[n]; 12261 if ((base & 1) == 0) { 12262 continue; 12263 } 12264 mask = 1 << ((base >> 1) & 0x1f); 12265 /* Keep this shift separate from the above to avoid an 12266 (undefined) << 32. */ 12267 mask = (mask << 1) - 1; 12268 if (((base ^ address) & ~mask) == 0) { 12269 break; 12270 } 12271 } 12272 if (n < 0) { 12273 fi->type = ARMFault_Background; 12274 return true; 12275 } 12276 12277 if (access_type == MMU_INST_FETCH) { 12278 mask = env->cp15.pmsav5_insn_ap; 12279 } else { 12280 mask = env->cp15.pmsav5_data_ap; 12281 } 12282 mask = (mask >> (n * 4)) & 0xf; 12283 switch (mask) { 12284 case 0: 12285 fi->type = ARMFault_Permission; 12286 fi->level = 1; 12287 return true; 12288 case 1: 12289 if (is_user) { 12290 fi->type = ARMFault_Permission; 12291 fi->level = 1; 12292 return true; 12293 } 12294 *prot = PAGE_READ | PAGE_WRITE; 12295 break; 12296 case 2: 12297 *prot = PAGE_READ; 12298 if (!is_user) { 12299 *prot |= PAGE_WRITE; 12300 } 12301 break; 12302 case 3: 12303 *prot = PAGE_READ | PAGE_WRITE; 12304 break; 12305 case 5: 12306 if (is_user) { 12307 fi->type = ARMFault_Permission; 12308 fi->level = 1; 12309 return true; 12310 } 12311 *prot = PAGE_READ; 12312 break; 12313 case 6: 12314 *prot = PAGE_READ; 12315 break; 12316 default: 12317 /* Bad permission. */ 12318 fi->type = ARMFault_Permission; 12319 fi->level = 1; 12320 return true; 12321 } 12322 *prot |= PAGE_EXEC; 12323 return false; 12324 } 12325 12326 /* Combine either inner or outer cacheability attributes for normal 12327 * memory, according to table D4-42 and pseudocode procedure 12328 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 12329 * 12330 * NB: only stage 1 includes allocation hints (RW bits), leading to 12331 * some asymmetry. 12332 */ 12333 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 12334 { 12335 if (s1 == 4 || s2 == 4) { 12336 /* non-cacheable has precedence */ 12337 return 4; 12338 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 12339 /* stage 1 write-through takes precedence */ 12340 return s1; 12341 } else if (extract32(s2, 2, 2) == 2) { 12342 /* stage 2 write-through takes precedence, but the allocation hint 12343 * is still taken from stage 1 12344 */ 12345 return (2 << 2) | extract32(s1, 0, 2); 12346 } else { /* write-back */ 12347 return s1; 12348 } 12349 } 12350 12351 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 12352 * and CombineS1S2Desc() 12353 * 12354 * @s1: Attributes from stage 1 walk 12355 * @s2: Attributes from stage 2 walk 12356 */ 12357 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2) 12358 { 12359 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4); 12360 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4); 12361 ARMCacheAttrs ret; 12362 12363 /* Combine shareability attributes (table D4-43) */ 12364 if (s1.shareability == 2 || s2.shareability == 2) { 12365 /* if either are outer-shareable, the result is outer-shareable */ 12366 ret.shareability = 2; 12367 } else if (s1.shareability == 3 || s2.shareability == 3) { 12368 /* if either are inner-shareable, the result is inner-shareable */ 12369 ret.shareability = 3; 12370 } else { 12371 /* both non-shareable */ 12372 ret.shareability = 0; 12373 } 12374 12375 /* Combine memory type and cacheability attributes */ 12376 if (s1hi == 0 || s2hi == 0) { 12377 /* Device has precedence over normal */ 12378 if (s1lo == 0 || s2lo == 0) { 12379 /* nGnRnE has precedence over anything */ 12380 ret.attrs = 0; 12381 } else if (s1lo == 4 || s2lo == 4) { 12382 /* non-Reordering has precedence over Reordering */ 12383 ret.attrs = 4; /* nGnRE */ 12384 } else if (s1lo == 8 || s2lo == 8) { 12385 /* non-Gathering has precedence over Gathering */ 12386 ret.attrs = 8; /* nGRE */ 12387 } else { 12388 ret.attrs = 0xc; /* GRE */ 12389 } 12390 12391 /* Any location for which the resultant memory type is any 12392 * type of Device memory is always treated as Outer Shareable. 12393 */ 12394 ret.shareability = 2; 12395 } else { /* Normal memory */ 12396 /* Outer/inner cacheability combine independently */ 12397 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 12398 | combine_cacheattr_nibble(s1lo, s2lo); 12399 12400 if (ret.attrs == 0x44) { 12401 /* Any location for which the resultant memory type is Normal 12402 * Inner Non-cacheable, Outer Non-cacheable is always treated 12403 * as Outer Shareable. 12404 */ 12405 ret.shareability = 2; 12406 } 12407 } 12408 12409 return ret; 12410 } 12411 12412 12413 /* get_phys_addr - get the physical address for this virtual address 12414 * 12415 * Find the physical address corresponding to the given virtual address, 12416 * by doing a translation table walk on MMU based systems or using the 12417 * MPU state on MPU based systems. 12418 * 12419 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs, 12420 * prot and page_size may not be filled in, and the populated fsr value provides 12421 * information on why the translation aborted, in the format of a 12422 * DFSR/IFSR fault register, with the following caveats: 12423 * * we honour the short vs long DFSR format differences. 12424 * * the WnR bit is never set (the caller must do this). 12425 * * for PSMAv5 based systems we don't bother to return a full FSR format 12426 * value. 12427 * 12428 * @env: CPUARMState 12429 * @address: virtual address to get physical address for 12430 * @access_type: 0 for read, 1 for write, 2 for execute 12431 * @mmu_idx: MMU index indicating required translation regime 12432 * @phys_ptr: set to the physical address corresponding to the virtual address 12433 * @attrs: set to the memory transaction attributes to use 12434 * @prot: set to the permissions for the page containing phys_ptr 12435 * @page_size: set to the size of the page containing phys_ptr 12436 * @fi: set to fault info if the translation fails 12437 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes 12438 */ 12439 static bool get_phys_addr(CPUARMState *env, target_ulong address, 12440 MMUAccessType access_type, ARMMMUIdx mmu_idx, 12441 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 12442 target_ulong *page_size, 12443 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 12444 { 12445 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 12446 /* Call ourselves recursively to do the stage 1 and then stage 2 12447 * translations. 12448 */ 12449 if (arm_feature(env, ARM_FEATURE_EL2)) { 12450 hwaddr ipa; 12451 int s2_prot; 12452 int ret; 12453 ARMCacheAttrs cacheattrs2 = {}; 12454 12455 ret = get_phys_addr(env, address, access_type, 12456 stage_1_mmu_idx(mmu_idx), &ipa, attrs, 12457 prot, page_size, fi, cacheattrs); 12458 12459 /* If S1 fails or S2 is disabled, return early. */ 12460 if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 12461 *phys_ptr = ipa; 12462 return ret; 12463 } 12464 12465 /* S1 is done. Now do S2 translation. */ 12466 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS, 12467 phys_ptr, attrs, &s2_prot, 12468 page_size, fi, 12469 cacheattrs != NULL ? &cacheattrs2 : NULL); 12470 fi->s2addr = ipa; 12471 /* Combine the S1 and S2 perms. */ 12472 *prot &= s2_prot; 12473 12474 /* Combine the S1 and S2 cache attributes, if needed */ 12475 if (!ret && cacheattrs != NULL) { 12476 if (env->cp15.hcr_el2 & HCR_DC) { 12477 /* 12478 * HCR.DC forces the first stage attributes to 12479 * Normal Non-Shareable, 12480 * Inner Write-Back Read-Allocate Write-Allocate, 12481 * Outer Write-Back Read-Allocate Write-Allocate. 12482 */ 12483 cacheattrs->attrs = 0xff; 12484 cacheattrs->shareability = 0; 12485 } 12486 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2); 12487 } 12488 12489 return ret; 12490 } else { 12491 /* 12492 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1. 12493 */ 12494 mmu_idx = stage_1_mmu_idx(mmu_idx); 12495 } 12496 } 12497 12498 /* The page table entries may downgrade secure to non-secure, but 12499 * cannot upgrade an non-secure translation regime's attributes 12500 * to secure. 12501 */ 12502 attrs->secure = regime_is_secure(env, mmu_idx); 12503 attrs->user = regime_is_user(env, mmu_idx); 12504 12505 /* Fast Context Switch Extension. This doesn't exist at all in v8. 12506 * In v7 and earlier it affects all stage 1 translations. 12507 */ 12508 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS 12509 && !arm_feature(env, ARM_FEATURE_V8)) { 12510 if (regime_el(env, mmu_idx) == 3) { 12511 address += env->cp15.fcseidr_s; 12512 } else { 12513 address += env->cp15.fcseidr_ns; 12514 } 12515 } 12516 12517 if (arm_feature(env, ARM_FEATURE_PMSA)) { 12518 bool ret; 12519 *page_size = TARGET_PAGE_SIZE; 12520 12521 if (arm_feature(env, ARM_FEATURE_V8)) { 12522 /* PMSAv8 */ 12523 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 12524 phys_ptr, attrs, prot, page_size, fi); 12525 } else if (arm_feature(env, ARM_FEATURE_V7)) { 12526 /* PMSAv7 */ 12527 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 12528 phys_ptr, prot, page_size, fi); 12529 } else { 12530 /* Pre-v7 MPU */ 12531 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 12532 phys_ptr, prot, fi); 12533 } 12534 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 12535 " mmu_idx %u -> %s (prot %c%c%c)\n", 12536 access_type == MMU_DATA_LOAD ? "reading" : 12537 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 12538 (uint32_t)address, mmu_idx, 12539 ret ? "Miss" : "Hit", 12540 *prot & PAGE_READ ? 'r' : '-', 12541 *prot & PAGE_WRITE ? 'w' : '-', 12542 *prot & PAGE_EXEC ? 'x' : '-'); 12543 12544 return ret; 12545 } 12546 12547 /* Definitely a real MMU, not an MPU */ 12548 12549 if (regime_translation_disabled(env, mmu_idx)) { 12550 /* MMU disabled. */ 12551 *phys_ptr = address; 12552 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 12553 *page_size = TARGET_PAGE_SIZE; 12554 return 0; 12555 } 12556 12557 if (regime_using_lpae_format(env, mmu_idx)) { 12558 return get_phys_addr_lpae(env, address, access_type, mmu_idx, 12559 phys_ptr, attrs, prot, page_size, 12560 fi, cacheattrs); 12561 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) { 12562 return get_phys_addr_v6(env, address, access_type, mmu_idx, 12563 phys_ptr, attrs, prot, page_size, fi); 12564 } else { 12565 return get_phys_addr_v5(env, address, access_type, mmu_idx, 12566 phys_ptr, prot, page_size, fi); 12567 } 12568 } 12569 12570 /* Walk the page table and (if the mapping exists) add the page 12571 * to the TLB. Return false on success, or true on failure. Populate 12572 * fsr with ARM DFSR/IFSR fault register format value on failure. 12573 */ 12574 bool arm_tlb_fill(CPUState *cs, vaddr address, 12575 MMUAccessType access_type, int mmu_idx, 12576 ARMMMUFaultInfo *fi) 12577 { 12578 ARMCPU *cpu = ARM_CPU(cs); 12579 CPUARMState *env = &cpu->env; 12580 hwaddr phys_addr; 12581 target_ulong page_size; 12582 int prot; 12583 int ret; 12584 MemTxAttrs attrs = {}; 12585 12586 ret = get_phys_addr(env, address, access_type, 12587 core_to_arm_mmu_idx(env, mmu_idx), &phys_addr, 12588 &attrs, &prot, &page_size, fi, NULL); 12589 if (!ret) { 12590 /* 12591 * Map a single [sub]page. Regions smaller than our declared 12592 * target page size are handled specially, so for those we 12593 * pass in the exact addresses. 12594 */ 12595 if (page_size >= TARGET_PAGE_SIZE) { 12596 phys_addr &= TARGET_PAGE_MASK; 12597 address &= TARGET_PAGE_MASK; 12598 } 12599 tlb_set_page_with_attrs(cs, address, phys_addr, attrs, 12600 prot, mmu_idx, page_size); 12601 return 0; 12602 } 12603 12604 return ret; 12605 } 12606 12607 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 12608 MemTxAttrs *attrs) 12609 { 12610 ARMCPU *cpu = ARM_CPU(cs); 12611 CPUARMState *env = &cpu->env; 12612 hwaddr phys_addr; 12613 target_ulong page_size; 12614 int prot; 12615 bool ret; 12616 ARMMMUFaultInfo fi = {}; 12617 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 12618 12619 *attrs = (MemTxAttrs) {}; 12620 12621 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr, 12622 attrs, &prot, &page_size, &fi, NULL); 12623 12624 if (ret) { 12625 return -1; 12626 } 12627 return phys_addr; 12628 } 12629 12630 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) 12631 { 12632 uint32_t mask; 12633 unsigned el = arm_current_el(env); 12634 12635 /* First handle registers which unprivileged can read */ 12636 12637 switch (reg) { 12638 case 0 ... 7: /* xPSR sub-fields */ 12639 mask = 0; 12640 if ((reg & 1) && el) { 12641 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */ 12642 } 12643 if (!(reg & 4)) { 12644 mask |= XPSR_NZCV | XPSR_Q; /* APSR */ 12645 } 12646 /* EPSR reads as zero */ 12647 return xpsr_read(env) & mask; 12648 break; 12649 case 20: /* CONTROL */ 12650 { 12651 uint32_t value = env->v7m.control[env->v7m.secure]; 12652 if (!env->v7m.secure) { 12653 /* SFPA is RAZ/WI from NS; FPCA is stored in the M_REG_S bank */ 12654 value |= env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK; 12655 } 12656 return value; 12657 } 12658 case 0x94: /* CONTROL_NS */ 12659 /* We have to handle this here because unprivileged Secure code 12660 * can read the NS CONTROL register. 12661 */ 12662 if (!env->v7m.secure) { 12663 return 0; 12664 } 12665 return env->v7m.control[M_REG_NS] | 12666 (env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK); 12667 } 12668 12669 if (el == 0) { 12670 return 0; /* unprivileged reads others as zero */ 12671 } 12672 12673 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 12674 switch (reg) { 12675 case 0x88: /* MSP_NS */ 12676 if (!env->v7m.secure) { 12677 return 0; 12678 } 12679 return env->v7m.other_ss_msp; 12680 case 0x89: /* PSP_NS */ 12681 if (!env->v7m.secure) { 12682 return 0; 12683 } 12684 return env->v7m.other_ss_psp; 12685 case 0x8a: /* MSPLIM_NS */ 12686 if (!env->v7m.secure) { 12687 return 0; 12688 } 12689 return env->v7m.msplim[M_REG_NS]; 12690 case 0x8b: /* PSPLIM_NS */ 12691 if (!env->v7m.secure) { 12692 return 0; 12693 } 12694 return env->v7m.psplim[M_REG_NS]; 12695 case 0x90: /* PRIMASK_NS */ 12696 if (!env->v7m.secure) { 12697 return 0; 12698 } 12699 return env->v7m.primask[M_REG_NS]; 12700 case 0x91: /* BASEPRI_NS */ 12701 if (!env->v7m.secure) { 12702 return 0; 12703 } 12704 return env->v7m.basepri[M_REG_NS]; 12705 case 0x93: /* FAULTMASK_NS */ 12706 if (!env->v7m.secure) { 12707 return 0; 12708 } 12709 return env->v7m.faultmask[M_REG_NS]; 12710 case 0x98: /* SP_NS */ 12711 { 12712 /* This gives the non-secure SP selected based on whether we're 12713 * currently in handler mode or not, using the NS CONTROL.SPSEL. 12714 */ 12715 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK; 12716 12717 if (!env->v7m.secure) { 12718 return 0; 12719 } 12720 if (!arm_v7m_is_handler_mode(env) && spsel) { 12721 return env->v7m.other_ss_psp; 12722 } else { 12723 return env->v7m.other_ss_msp; 12724 } 12725 } 12726 default: 12727 break; 12728 } 12729 } 12730 12731 switch (reg) { 12732 case 8: /* MSP */ 12733 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13]; 12734 case 9: /* PSP */ 12735 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp; 12736 case 10: /* MSPLIM */ 12737 if (!arm_feature(env, ARM_FEATURE_V8)) { 12738 goto bad_reg; 12739 } 12740 return env->v7m.msplim[env->v7m.secure]; 12741 case 11: /* PSPLIM */ 12742 if (!arm_feature(env, ARM_FEATURE_V8)) { 12743 goto bad_reg; 12744 } 12745 return env->v7m.psplim[env->v7m.secure]; 12746 case 16: /* PRIMASK */ 12747 return env->v7m.primask[env->v7m.secure]; 12748 case 17: /* BASEPRI */ 12749 case 18: /* BASEPRI_MAX */ 12750 return env->v7m.basepri[env->v7m.secure]; 12751 case 19: /* FAULTMASK */ 12752 return env->v7m.faultmask[env->v7m.secure]; 12753 default: 12754 bad_reg: 12755 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special" 12756 " register %d\n", reg); 12757 return 0; 12758 } 12759 } 12760 12761 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) 12762 { 12763 /* We're passed bits [11..0] of the instruction; extract 12764 * SYSm and the mask bits. 12765 * Invalid combinations of SYSm and mask are UNPREDICTABLE; 12766 * we choose to treat them as if the mask bits were valid. 12767 * NB that the pseudocode 'mask' variable is bits [11..10], 12768 * whereas ours is [11..8]. 12769 */ 12770 uint32_t mask = extract32(maskreg, 8, 4); 12771 uint32_t reg = extract32(maskreg, 0, 8); 12772 int cur_el = arm_current_el(env); 12773 12774 if (cur_el == 0 && reg > 7 && reg != 20) { 12775 /* 12776 * only xPSR sub-fields and CONTROL.SFPA may be written by 12777 * unprivileged code 12778 */ 12779 return; 12780 } 12781 12782 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 12783 switch (reg) { 12784 case 0x88: /* MSP_NS */ 12785 if (!env->v7m.secure) { 12786 return; 12787 } 12788 env->v7m.other_ss_msp = val; 12789 return; 12790 case 0x89: /* PSP_NS */ 12791 if (!env->v7m.secure) { 12792 return; 12793 } 12794 env->v7m.other_ss_psp = val; 12795 return; 12796 case 0x8a: /* MSPLIM_NS */ 12797 if (!env->v7m.secure) { 12798 return; 12799 } 12800 env->v7m.msplim[M_REG_NS] = val & ~7; 12801 return; 12802 case 0x8b: /* PSPLIM_NS */ 12803 if (!env->v7m.secure) { 12804 return; 12805 } 12806 env->v7m.psplim[M_REG_NS] = val & ~7; 12807 return; 12808 case 0x90: /* PRIMASK_NS */ 12809 if (!env->v7m.secure) { 12810 return; 12811 } 12812 env->v7m.primask[M_REG_NS] = val & 1; 12813 return; 12814 case 0x91: /* BASEPRI_NS */ 12815 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) { 12816 return; 12817 } 12818 env->v7m.basepri[M_REG_NS] = val & 0xff; 12819 return; 12820 case 0x93: /* FAULTMASK_NS */ 12821 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) { 12822 return; 12823 } 12824 env->v7m.faultmask[M_REG_NS] = val & 1; 12825 return; 12826 case 0x94: /* CONTROL_NS */ 12827 if (!env->v7m.secure) { 12828 return; 12829 } 12830 write_v7m_control_spsel_for_secstate(env, 12831 val & R_V7M_CONTROL_SPSEL_MASK, 12832 M_REG_NS); 12833 if (arm_feature(env, ARM_FEATURE_M_MAIN)) { 12834 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK; 12835 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK; 12836 } 12837 /* 12838 * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0, 12839 * RES0 if the FPU is not present, and is stored in the S bank 12840 */ 12841 if (arm_feature(env, ARM_FEATURE_VFP) && 12842 extract32(env->v7m.nsacr, 10, 1)) { 12843 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK; 12844 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK; 12845 } 12846 return; 12847 case 0x98: /* SP_NS */ 12848 { 12849 /* This gives the non-secure SP selected based on whether we're 12850 * currently in handler mode or not, using the NS CONTROL.SPSEL. 12851 */ 12852 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK; 12853 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel; 12854 uint32_t limit; 12855 12856 if (!env->v7m.secure) { 12857 return; 12858 } 12859 12860 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false]; 12861 12862 if (val < limit) { 12863 CPUState *cs = CPU(arm_env_get_cpu(env)); 12864 12865 cpu_restore_state(cs, GETPC(), true); 12866 raise_exception(env, EXCP_STKOF, 0, 1); 12867 } 12868 12869 if (is_psp) { 12870 env->v7m.other_ss_psp = val; 12871 } else { 12872 env->v7m.other_ss_msp = val; 12873 } 12874 return; 12875 } 12876 default: 12877 break; 12878 } 12879 } 12880 12881 switch (reg) { 12882 case 0 ... 7: /* xPSR sub-fields */ 12883 /* only APSR is actually writable */ 12884 if (!(reg & 4)) { 12885 uint32_t apsrmask = 0; 12886 12887 if (mask & 8) { 12888 apsrmask |= XPSR_NZCV | XPSR_Q; 12889 } 12890 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) { 12891 apsrmask |= XPSR_GE; 12892 } 12893 xpsr_write(env, val, apsrmask); 12894 } 12895 break; 12896 case 8: /* MSP */ 12897 if (v7m_using_psp(env)) { 12898 env->v7m.other_sp = val; 12899 } else { 12900 env->regs[13] = val; 12901 } 12902 break; 12903 case 9: /* PSP */ 12904 if (v7m_using_psp(env)) { 12905 env->regs[13] = val; 12906 } else { 12907 env->v7m.other_sp = val; 12908 } 12909 break; 12910 case 10: /* MSPLIM */ 12911 if (!arm_feature(env, ARM_FEATURE_V8)) { 12912 goto bad_reg; 12913 } 12914 env->v7m.msplim[env->v7m.secure] = val & ~7; 12915 break; 12916 case 11: /* PSPLIM */ 12917 if (!arm_feature(env, ARM_FEATURE_V8)) { 12918 goto bad_reg; 12919 } 12920 env->v7m.psplim[env->v7m.secure] = val & ~7; 12921 break; 12922 case 16: /* PRIMASK */ 12923 env->v7m.primask[env->v7m.secure] = val & 1; 12924 break; 12925 case 17: /* BASEPRI */ 12926 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12927 goto bad_reg; 12928 } 12929 env->v7m.basepri[env->v7m.secure] = val & 0xff; 12930 break; 12931 case 18: /* BASEPRI_MAX */ 12932 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12933 goto bad_reg; 12934 } 12935 val &= 0xff; 12936 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure] 12937 || env->v7m.basepri[env->v7m.secure] == 0)) { 12938 env->v7m.basepri[env->v7m.secure] = val; 12939 } 12940 break; 12941 case 19: /* FAULTMASK */ 12942 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12943 goto bad_reg; 12944 } 12945 env->v7m.faultmask[env->v7m.secure] = val & 1; 12946 break; 12947 case 20: /* CONTROL */ 12948 /* 12949 * Writing to the SPSEL bit only has an effect if we are in 12950 * thread mode; other bits can be updated by any privileged code. 12951 * write_v7m_control_spsel() deals with updating the SPSEL bit in 12952 * env->v7m.control, so we only need update the others. 12953 * For v7M, we must just ignore explicit writes to SPSEL in handler 12954 * mode; for v8M the write is permitted but will have no effect. 12955 * All these bits are writes-ignored from non-privileged code, 12956 * except for SFPA. 12957 */ 12958 if (cur_el > 0 && (arm_feature(env, ARM_FEATURE_V8) || 12959 !arm_v7m_is_handler_mode(env))) { 12960 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0); 12961 } 12962 if (cur_el > 0 && arm_feature(env, ARM_FEATURE_M_MAIN)) { 12963 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK; 12964 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK; 12965 } 12966 if (arm_feature(env, ARM_FEATURE_VFP)) { 12967 /* 12968 * SFPA is RAZ/WI from NS or if no FPU. 12969 * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present. 12970 * Both are stored in the S bank. 12971 */ 12972 if (env->v7m.secure) { 12973 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 12974 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_SFPA_MASK; 12975 } 12976 if (cur_el > 0 && 12977 (env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_SECURITY) || 12978 extract32(env->v7m.nsacr, 10, 1))) { 12979 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK; 12980 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK; 12981 } 12982 } 12983 break; 12984 default: 12985 bad_reg: 12986 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special" 12987 " register %d\n", reg); 12988 return; 12989 } 12990 } 12991 12992 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) 12993 { 12994 /* Implement the TT instruction. op is bits [7:6] of the insn. */ 12995 bool forceunpriv = op & 1; 12996 bool alt = op & 2; 12997 V8M_SAttributes sattrs = {}; 12998 uint32_t tt_resp; 12999 bool r, rw, nsr, nsrw, mrvalid; 13000 int prot; 13001 ARMMMUFaultInfo fi = {}; 13002 MemTxAttrs attrs = {}; 13003 hwaddr phys_addr; 13004 ARMMMUIdx mmu_idx; 13005 uint32_t mregion; 13006 bool targetpriv; 13007 bool targetsec = env->v7m.secure; 13008 bool is_subpage; 13009 13010 /* Work out what the security state and privilege level we're 13011 * interested in is... 13012 */ 13013 if (alt) { 13014 targetsec = !targetsec; 13015 } 13016 13017 if (forceunpriv) { 13018 targetpriv = false; 13019 } else { 13020 targetpriv = arm_v7m_is_handler_mode(env) || 13021 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK); 13022 } 13023 13024 /* ...and then figure out which MMU index this is */ 13025 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv); 13026 13027 /* We know that the MPU and SAU don't care about the access type 13028 * for our purposes beyond that we don't want to claim to be 13029 * an insn fetch, so we arbitrarily call this a read. 13030 */ 13031 13032 /* MPU region info only available for privileged or if 13033 * inspecting the other MPU state. 13034 */ 13035 if (arm_current_el(env) != 0 || alt) { 13036 /* We can ignore the return value as prot is always set */ 13037 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, 13038 &phys_addr, &attrs, &prot, &is_subpage, 13039 &fi, &mregion); 13040 if (mregion == -1) { 13041 mrvalid = false; 13042 mregion = 0; 13043 } else { 13044 mrvalid = true; 13045 } 13046 r = prot & PAGE_READ; 13047 rw = prot & PAGE_WRITE; 13048 } else { 13049 r = false; 13050 rw = false; 13051 mrvalid = false; 13052 mregion = 0; 13053 } 13054 13055 if (env->v7m.secure) { 13056 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs); 13057 nsr = sattrs.ns && r; 13058 nsrw = sattrs.ns && rw; 13059 } else { 13060 sattrs.ns = true; 13061 nsr = false; 13062 nsrw = false; 13063 } 13064 13065 tt_resp = (sattrs.iregion << 24) | 13066 (sattrs.irvalid << 23) | 13067 ((!sattrs.ns) << 22) | 13068 (nsrw << 21) | 13069 (nsr << 20) | 13070 (rw << 19) | 13071 (r << 18) | 13072 (sattrs.srvalid << 17) | 13073 (mrvalid << 16) | 13074 (sattrs.sregion << 8) | 13075 mregion; 13076 13077 return tt_resp; 13078 } 13079 13080 #endif 13081 13082 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in) 13083 { 13084 /* Implement DC ZVA, which zeroes a fixed-length block of memory. 13085 * Note that we do not implement the (architecturally mandated) 13086 * alignment fault for attempts to use this on Device memory 13087 * (which matches the usual QEMU behaviour of not implementing either 13088 * alignment faults or any memory attribute handling). 13089 */ 13090 13091 ARMCPU *cpu = arm_env_get_cpu(env); 13092 uint64_t blocklen = 4 << cpu->dcz_blocksize; 13093 uint64_t vaddr = vaddr_in & ~(blocklen - 1); 13094 13095 #ifndef CONFIG_USER_ONLY 13096 { 13097 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than 13098 * the block size so we might have to do more than one TLB lookup. 13099 * We know that in fact for any v8 CPU the page size is at least 4K 13100 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only 13101 * 1K as an artefact of legacy v5 subpage support being present in the 13102 * same QEMU executable. 13103 */ 13104 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE); 13105 void *hostaddr[maxidx]; 13106 int try, i; 13107 unsigned mmu_idx = cpu_mmu_index(env, false); 13108 TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); 13109 13110 for (try = 0; try < 2; try++) { 13111 13112 for (i = 0; i < maxidx; i++) { 13113 hostaddr[i] = tlb_vaddr_to_host(env, 13114 vaddr + TARGET_PAGE_SIZE * i, 13115 1, mmu_idx); 13116 if (!hostaddr[i]) { 13117 break; 13118 } 13119 } 13120 if (i == maxidx) { 13121 /* If it's all in the TLB it's fair game for just writing to; 13122 * we know we don't need to update dirty status, etc. 13123 */ 13124 for (i = 0; i < maxidx - 1; i++) { 13125 memset(hostaddr[i], 0, TARGET_PAGE_SIZE); 13126 } 13127 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE)); 13128 return; 13129 } 13130 /* OK, try a store and see if we can populate the tlb. This 13131 * might cause an exception if the memory isn't writable, 13132 * in which case we will longjmp out of here. We must for 13133 * this purpose use the actual register value passed to us 13134 * so that we get the fault address right. 13135 */ 13136 helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETPC()); 13137 /* Now we can populate the other TLB entries, if any */ 13138 for (i = 0; i < maxidx; i++) { 13139 uint64_t va = vaddr + TARGET_PAGE_SIZE * i; 13140 if (va != (vaddr_in & TARGET_PAGE_MASK)) { 13141 helper_ret_stb_mmu(env, va, 0, oi, GETPC()); 13142 } 13143 } 13144 } 13145 13146 /* Slow path (probably attempt to do this to an I/O device or 13147 * similar, or clearing of a block of code we have translations 13148 * cached for). Just do a series of byte writes as the architecture 13149 * demands. It's not worth trying to use a cpu_physical_memory_map(), 13150 * memset(), unmap() sequence here because: 13151 * + we'd need to account for the blocksize being larger than a page 13152 * + the direct-RAM access case is almost always going to be dealt 13153 * with in the fastpath code above, so there's no speed benefit 13154 * + we would have to deal with the map returning NULL because the 13155 * bounce buffer was in use 13156 */ 13157 for (i = 0; i < blocklen; i++) { 13158 helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETPC()); 13159 } 13160 } 13161 #else 13162 memset(g2h(vaddr), 0, blocklen); 13163 #endif 13164 } 13165 13166 /* Note that signed overflow is undefined in C. The following routines are 13167 careful to use unsigned types where modulo arithmetic is required. 13168 Failure to do so _will_ break on newer gcc. */ 13169 13170 /* Signed saturating arithmetic. */ 13171 13172 /* Perform 16-bit signed saturating addition. */ 13173 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 13174 { 13175 uint16_t res; 13176 13177 res = a + b; 13178 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 13179 if (a & 0x8000) 13180 res = 0x8000; 13181 else 13182 res = 0x7fff; 13183 } 13184 return res; 13185 } 13186 13187 /* Perform 8-bit signed saturating addition. */ 13188 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 13189 { 13190 uint8_t res; 13191 13192 res = a + b; 13193 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 13194 if (a & 0x80) 13195 res = 0x80; 13196 else 13197 res = 0x7f; 13198 } 13199 return res; 13200 } 13201 13202 /* Perform 16-bit signed saturating subtraction. */ 13203 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 13204 { 13205 uint16_t res; 13206 13207 res = a - b; 13208 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 13209 if (a & 0x8000) 13210 res = 0x8000; 13211 else 13212 res = 0x7fff; 13213 } 13214 return res; 13215 } 13216 13217 /* Perform 8-bit signed saturating subtraction. */ 13218 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 13219 { 13220 uint8_t res; 13221 13222 res = a - b; 13223 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 13224 if (a & 0x80) 13225 res = 0x80; 13226 else 13227 res = 0x7f; 13228 } 13229 return res; 13230 } 13231 13232 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 13233 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 13234 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 13235 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 13236 #define PFX q 13237 13238 #include "op_addsub.h" 13239 13240 /* Unsigned saturating arithmetic. */ 13241 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 13242 { 13243 uint16_t res; 13244 res = a + b; 13245 if (res < a) 13246 res = 0xffff; 13247 return res; 13248 } 13249 13250 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 13251 { 13252 if (a > b) 13253 return a - b; 13254 else 13255 return 0; 13256 } 13257 13258 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 13259 { 13260 uint8_t res; 13261 res = a + b; 13262 if (res < a) 13263 res = 0xff; 13264 return res; 13265 } 13266 13267 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 13268 { 13269 if (a > b) 13270 return a - b; 13271 else 13272 return 0; 13273 } 13274 13275 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 13276 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 13277 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 13278 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 13279 #define PFX uq 13280 13281 #include "op_addsub.h" 13282 13283 /* Signed modulo arithmetic. */ 13284 #define SARITH16(a, b, n, op) do { \ 13285 int32_t sum; \ 13286 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 13287 RESULT(sum, n, 16); \ 13288 if (sum >= 0) \ 13289 ge |= 3 << (n * 2); \ 13290 } while(0) 13291 13292 #define SARITH8(a, b, n, op) do { \ 13293 int32_t sum; \ 13294 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 13295 RESULT(sum, n, 8); \ 13296 if (sum >= 0) \ 13297 ge |= 1 << n; \ 13298 } while(0) 13299 13300 13301 #define ADD16(a, b, n) SARITH16(a, b, n, +) 13302 #define SUB16(a, b, n) SARITH16(a, b, n, -) 13303 #define ADD8(a, b, n) SARITH8(a, b, n, +) 13304 #define SUB8(a, b, n) SARITH8(a, b, n, -) 13305 #define PFX s 13306 #define ARITH_GE 13307 13308 #include "op_addsub.h" 13309 13310 /* Unsigned modulo arithmetic. */ 13311 #define ADD16(a, b, n) do { \ 13312 uint32_t sum; \ 13313 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 13314 RESULT(sum, n, 16); \ 13315 if ((sum >> 16) == 1) \ 13316 ge |= 3 << (n * 2); \ 13317 } while(0) 13318 13319 #define ADD8(a, b, n) do { \ 13320 uint32_t sum; \ 13321 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 13322 RESULT(sum, n, 8); \ 13323 if ((sum >> 8) == 1) \ 13324 ge |= 1 << n; \ 13325 } while(0) 13326 13327 #define SUB16(a, b, n) do { \ 13328 uint32_t sum; \ 13329 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 13330 RESULT(sum, n, 16); \ 13331 if ((sum >> 16) == 0) \ 13332 ge |= 3 << (n * 2); \ 13333 } while(0) 13334 13335 #define SUB8(a, b, n) do { \ 13336 uint32_t sum; \ 13337 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 13338 RESULT(sum, n, 8); \ 13339 if ((sum >> 8) == 0) \ 13340 ge |= 1 << n; \ 13341 } while(0) 13342 13343 #define PFX u 13344 #define ARITH_GE 13345 13346 #include "op_addsub.h" 13347 13348 /* Halved signed arithmetic. */ 13349 #define ADD16(a, b, n) \ 13350 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 13351 #define SUB16(a, b, n) \ 13352 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 13353 #define ADD8(a, b, n) \ 13354 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 13355 #define SUB8(a, b, n) \ 13356 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 13357 #define PFX sh 13358 13359 #include "op_addsub.h" 13360 13361 /* Halved unsigned arithmetic. */ 13362 #define ADD16(a, b, n) \ 13363 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 13364 #define SUB16(a, b, n) \ 13365 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 13366 #define ADD8(a, b, n) \ 13367 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 13368 #define SUB8(a, b, n) \ 13369 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 13370 #define PFX uh 13371 13372 #include "op_addsub.h" 13373 13374 static inline uint8_t do_usad(uint8_t a, uint8_t b) 13375 { 13376 if (a > b) 13377 return a - b; 13378 else 13379 return b - a; 13380 } 13381 13382 /* Unsigned sum of absolute byte differences. */ 13383 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 13384 { 13385 uint32_t sum; 13386 sum = do_usad(a, b); 13387 sum += do_usad(a >> 8, b >> 8); 13388 sum += do_usad(a >> 16, b >>16); 13389 sum += do_usad(a >> 24, b >> 24); 13390 return sum; 13391 } 13392 13393 /* For ARMv6 SEL instruction. */ 13394 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 13395 { 13396 uint32_t mask; 13397 13398 mask = 0; 13399 if (flags & 1) 13400 mask |= 0xff; 13401 if (flags & 2) 13402 mask |= 0xff00; 13403 if (flags & 4) 13404 mask |= 0xff0000; 13405 if (flags & 8) 13406 mask |= 0xff000000; 13407 return (a & mask) | (b & ~mask); 13408 } 13409 13410 /* CRC helpers. 13411 * The upper bytes of val (above the number specified by 'bytes') must have 13412 * been zeroed out by the caller. 13413 */ 13414 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 13415 { 13416 uint8_t buf[4]; 13417 13418 stl_le_p(buf, val); 13419 13420 /* zlib crc32 converts the accumulator and output to one's complement. */ 13421 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 13422 } 13423 13424 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 13425 { 13426 uint8_t buf[4]; 13427 13428 stl_le_p(buf, val); 13429 13430 /* Linux crc32c converts the output to one's complement. */ 13431 return crc32c(acc, buf, bytes) ^ 0xffffffff; 13432 } 13433 13434 /* Return the exception level to which FP-disabled exceptions should 13435 * be taken, or 0 if FP is enabled. 13436 */ 13437 int fp_exception_el(CPUARMState *env, int cur_el) 13438 { 13439 #ifndef CONFIG_USER_ONLY 13440 int fpen; 13441 13442 /* CPACR and the CPTR registers don't exist before v6, so FP is 13443 * always accessible 13444 */ 13445 if (!arm_feature(env, ARM_FEATURE_V6)) { 13446 return 0; 13447 } 13448 13449 if (arm_feature(env, ARM_FEATURE_M)) { 13450 /* CPACR can cause a NOCP UsageFault taken to current security state */ 13451 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) { 13452 return 1; 13453 } 13454 13455 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) { 13456 if (!extract32(env->v7m.nsacr, 10, 1)) { 13457 /* FP insns cause a NOCP UsageFault taken to Secure */ 13458 return 3; 13459 } 13460 } 13461 13462 return 0; 13463 } 13464 13465 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit: 13466 * 0, 2 : trap EL0 and EL1/PL1 accesses 13467 * 1 : trap only EL0 accesses 13468 * 3 : trap no accesses 13469 */ 13470 fpen = extract32(env->cp15.cpacr_el1, 20, 2); 13471 switch (fpen) { 13472 case 0: 13473 case 2: 13474 if (cur_el == 0 || cur_el == 1) { 13475 /* Trap to PL1, which might be EL1 or EL3 */ 13476 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) { 13477 return 3; 13478 } 13479 return 1; 13480 } 13481 if (cur_el == 3 && !is_a64(env)) { 13482 /* Secure PL1 running at EL3 */ 13483 return 3; 13484 } 13485 break; 13486 case 1: 13487 if (cur_el == 0) { 13488 return 1; 13489 } 13490 break; 13491 case 3: 13492 break; 13493 } 13494 13495 /* For the CPTR registers we don't need to guard with an ARM_FEATURE 13496 * check because zero bits in the registers mean "don't trap". 13497 */ 13498 13499 /* CPTR_EL2 : present in v7VE or v8 */ 13500 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1) 13501 && !arm_is_secure_below_el3(env)) { 13502 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */ 13503 return 2; 13504 } 13505 13506 /* CPTR_EL3 : present in v8 */ 13507 if (extract32(env->cp15.cptr_el[3], 10, 1)) { 13508 /* Trap all FP ops to EL3 */ 13509 return 3; 13510 } 13511 #endif 13512 return 0; 13513 } 13514 13515 ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env, 13516 bool secstate, bool priv, bool negpri) 13517 { 13518 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M; 13519 13520 if (priv) { 13521 mmu_idx |= ARM_MMU_IDX_M_PRIV; 13522 } 13523 13524 if (negpri) { 13525 mmu_idx |= ARM_MMU_IDX_M_NEGPRI; 13526 } 13527 13528 if (secstate) { 13529 mmu_idx |= ARM_MMU_IDX_M_S; 13530 } 13531 13532 return mmu_idx; 13533 } 13534 13535 ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env, 13536 bool secstate, bool priv) 13537 { 13538 bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate); 13539 13540 return arm_v7m_mmu_idx_all(env, secstate, priv, negpri); 13541 } 13542 13543 /* Return the MMU index for a v7M CPU in the specified security state */ 13544 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 13545 { 13546 bool priv = arm_current_el(env) != 0; 13547 13548 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv); 13549 } 13550 13551 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 13552 { 13553 int el; 13554 13555 if (arm_feature(env, ARM_FEATURE_M)) { 13556 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 13557 } 13558 13559 el = arm_current_el(env); 13560 if (el < 2 && arm_is_secure_below_el3(env)) { 13561 return ARMMMUIdx_S1SE0 + el; 13562 } else { 13563 return ARMMMUIdx_S12NSE0 + el; 13564 } 13565 } 13566 13567 int cpu_mmu_index(CPUARMState *env, bool ifetch) 13568 { 13569 return arm_to_core_mmu_idx(arm_mmu_idx(env)); 13570 } 13571 13572 #ifndef CONFIG_USER_ONLY 13573 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 13574 { 13575 return stage_1_mmu_idx(arm_mmu_idx(env)); 13576 } 13577 #endif 13578 13579 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 13580 target_ulong *cs_base, uint32_t *pflags) 13581 { 13582 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 13583 int current_el = arm_current_el(env); 13584 int fp_el = fp_exception_el(env, current_el); 13585 uint32_t flags = 0; 13586 13587 if (is_a64(env)) { 13588 ARMCPU *cpu = arm_env_get_cpu(env); 13589 uint64_t sctlr; 13590 13591 *pc = env->pc; 13592 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1); 13593 13594 /* Get control bits for tagged addresses. */ 13595 { 13596 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx); 13597 ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1); 13598 int tbii, tbid; 13599 13600 /* FIXME: ARMv8.1-VHE S2 translation regime. */ 13601 if (regime_el(env, stage1) < 2) { 13602 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1); 13603 tbid = (p1.tbi << 1) | p0.tbi; 13604 tbii = tbid & ~((p1.tbid << 1) | p0.tbid); 13605 } else { 13606 tbid = p0.tbi; 13607 tbii = tbid & !p0.tbid; 13608 } 13609 13610 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii); 13611 flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid); 13612 } 13613 13614 if (cpu_isar_feature(aa64_sve, cpu)) { 13615 int sve_el = sve_exception_el(env, current_el); 13616 uint32_t zcr_len; 13617 13618 /* If SVE is disabled, but FP is enabled, 13619 * then the effective len is 0. 13620 */ 13621 if (sve_el != 0 && fp_el == 0) { 13622 zcr_len = 0; 13623 } else { 13624 zcr_len = sve_zcr_len_for_el(env, current_el); 13625 } 13626 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el); 13627 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len); 13628 } 13629 13630 sctlr = arm_sctlr(env, current_el); 13631 13632 if (cpu_isar_feature(aa64_pauth, cpu)) { 13633 /* 13634 * In order to save space in flags, we record only whether 13635 * pauth is "inactive", meaning all insns are implemented as 13636 * a nop, or "active" when some action must be performed. 13637 * The decision of which action to take is left to a helper. 13638 */ 13639 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) { 13640 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1); 13641 } 13642 } 13643 13644 if (cpu_isar_feature(aa64_bti, cpu)) { 13645 /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */ 13646 if (sctlr & (current_el == 0 ? SCTLR_BT0 : SCTLR_BT1)) { 13647 flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1); 13648 } 13649 flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype); 13650 } 13651 } else { 13652 *pc = env->regs[15]; 13653 flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb); 13654 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, env->vfp.vec_len); 13655 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, env->vfp.vec_stride); 13656 flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits); 13657 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, arm_sctlr_b(env)); 13658 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env)); 13659 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30) 13660 || arm_el_is_aa64(env, 1) || arm_feature(env, ARM_FEATURE_M)) { 13661 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 13662 } 13663 /* Note that XSCALE_CPAR shares bits with VECSTRIDE */ 13664 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 13665 flags = FIELD_DP32(flags, TBFLAG_A32, 13666 XSCALE_CPAR, env->cp15.c15_cpar); 13667 } 13668 } 13669 13670 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, arm_to_core_mmu_idx(mmu_idx)); 13671 13672 /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 13673 * states defined in the ARM ARM for software singlestep: 13674 * SS_ACTIVE PSTATE.SS State 13675 * 0 x Inactive (the TB flag for SS is always 0) 13676 * 1 0 Active-pending 13677 * 1 1 Active-not-pending 13678 */ 13679 if (arm_singlestep_active(env)) { 13680 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1); 13681 if (is_a64(env)) { 13682 if (env->pstate & PSTATE_SS) { 13683 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 13684 } 13685 } else { 13686 if (env->uncached_cpsr & PSTATE_SS) { 13687 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 13688 } 13689 } 13690 } 13691 if (arm_cpu_data_is_big_endian(env)) { 13692 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 13693 } 13694 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el); 13695 13696 if (arm_v7m_is_handler_mode(env)) { 13697 flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1); 13698 } 13699 13700 /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is 13701 * suppressing them because the requested execution priority is less than 0. 13702 */ 13703 if (arm_feature(env, ARM_FEATURE_V8) && 13704 arm_feature(env, ARM_FEATURE_M) && 13705 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) && 13706 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) { 13707 flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1); 13708 } 13709 13710 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 13711 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) != env->v7m.secure) { 13712 flags = FIELD_DP32(flags, TBFLAG_A32, FPCCR_S_WRONG, 1); 13713 } 13714 13715 if (arm_feature(env, ARM_FEATURE_M) && 13716 (env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) && 13717 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) || 13718 (env->v7m.secure && 13719 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) { 13720 /* 13721 * ASPEN is set, but FPCA/SFPA indicate that there is no active 13722 * FP context; we must create a new FP context before executing 13723 * any FP insn. 13724 */ 13725 flags = FIELD_DP32(flags, TBFLAG_A32, NEW_FP_CTXT_NEEDED, 1); 13726 } 13727 13728 if (arm_feature(env, ARM_FEATURE_M)) { 13729 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 13730 13731 if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) { 13732 flags = FIELD_DP32(flags, TBFLAG_A32, LSPACT, 1); 13733 } 13734 } 13735 13736 *pflags = flags; 13737 *cs_base = 0; 13738 } 13739 13740 #ifdef TARGET_AARCH64 13741 /* 13742 * The manual says that when SVE is enabled and VQ is widened the 13743 * implementation is allowed to zero the previously inaccessible 13744 * portion of the registers. The corollary to that is that when 13745 * SVE is enabled and VQ is narrowed we are also allowed to zero 13746 * the now inaccessible portion of the registers. 13747 * 13748 * The intent of this is that no predicate bit beyond VQ is ever set. 13749 * Which means that some operations on predicate registers themselves 13750 * may operate on full uint64_t or even unrolled across the maximum 13751 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 13752 * may well be cheaper than conditionals to restrict the operation 13753 * to the relevant portion of a uint16_t[16]. 13754 */ 13755 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 13756 { 13757 int i, j; 13758 uint64_t pmask; 13759 13760 assert(vq >= 1 && vq <= ARM_MAX_VQ); 13761 assert(vq <= arm_env_get_cpu(env)->sve_max_vq); 13762 13763 /* Zap the high bits of the zregs. */ 13764 for (i = 0; i < 32; i++) { 13765 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 13766 } 13767 13768 /* Zap the high bits of the pregs and ffr. */ 13769 pmask = 0; 13770 if (vq & 3) { 13771 pmask = ~(-1ULL << (16 * (vq & 3))); 13772 } 13773 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 13774 for (i = 0; i < 17; ++i) { 13775 env->vfp.pregs[i].p[j] &= pmask; 13776 } 13777 pmask = 0; 13778 } 13779 } 13780 13781 /* 13782 * Notice a change in SVE vector size when changing EL. 13783 */ 13784 void aarch64_sve_change_el(CPUARMState *env, int old_el, 13785 int new_el, bool el0_a64) 13786 { 13787 ARMCPU *cpu = arm_env_get_cpu(env); 13788 int old_len, new_len; 13789 bool old_a64, new_a64; 13790 13791 /* Nothing to do if no SVE. */ 13792 if (!cpu_isar_feature(aa64_sve, cpu)) { 13793 return; 13794 } 13795 13796 /* Nothing to do if FP is disabled in either EL. */ 13797 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 13798 return; 13799 } 13800 13801 /* 13802 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 13803 * at ELx, or not available because the EL is in AArch32 state, then 13804 * for all purposes other than a direct read, the ZCR_ELx.LEN field 13805 * has an effective value of 0". 13806 * 13807 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 13808 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 13809 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 13810 * we already have the correct register contents when encountering the 13811 * vq0->vq0 transition between EL0->EL1. 13812 */ 13813 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 13814 old_len = (old_a64 && !sve_exception_el(env, old_el) 13815 ? sve_zcr_len_for_el(env, old_el) : 0); 13816 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 13817 new_len = (new_a64 && !sve_exception_el(env, new_el) 13818 ? sve_zcr_len_for_el(env, new_el) : 0); 13819 13820 /* When changing vector length, clear inaccessible state. */ 13821 if (new_len < old_len) { 13822 aarch64_sve_narrow_vq(env, new_len + 1); 13823 } 13824 } 13825 #endif 13826