1 /* 2 * ARM generic helpers. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qemu/units.h" 11 #include "target/arm/idau.h" 12 #include "trace.h" 13 #include "cpu.h" 14 #include "internals.h" 15 #include "exec/gdbstub.h" 16 #include "exec/helper-proto.h" 17 #include "qemu/host-utils.h" 18 #include "qemu/main-loop.h" 19 #include "qemu/bitops.h" 20 #include "qemu/crc32c.h" 21 #include "qemu/qemu-print.h" 22 #include "exec/exec-all.h" 23 #include <zlib.h> /* For crc32 */ 24 #include "hw/irq.h" 25 #include "hw/semihosting/semihost.h" 26 #include "sysemu/cpus.h" 27 #include "sysemu/kvm.h" 28 #include "qemu/range.h" 29 #include "qapi/qapi-commands-machine-target.h" 30 #include "qapi/error.h" 31 #include "qemu/guest-random.h" 32 #ifdef CONFIG_TCG 33 #include "arm_ldst.h" 34 #include "exec/cpu_ldst.h" 35 #endif 36 37 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 38 39 #ifndef CONFIG_USER_ONLY 40 41 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 42 MMUAccessType access_type, ARMMMUIdx mmu_idx, 43 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 44 target_ulong *page_size_ptr, 45 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 46 #endif 47 48 static void switch_mode(CPUARMState *env, int mode); 49 50 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 51 { 52 int nregs; 53 54 /* VFP data registers are always little-endian. */ 55 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 56 if (reg < nregs) { 57 stq_le_p(buf, *aa32_vfp_dreg(env, reg)); 58 return 8; 59 } 60 if (arm_feature(env, ARM_FEATURE_NEON)) { 61 /* Aliases for Q regs. */ 62 nregs += 16; 63 if (reg < nregs) { 64 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 65 stq_le_p(buf, q[0]); 66 stq_le_p(buf + 8, q[1]); 67 return 16; 68 } 69 } 70 switch (reg - nregs) { 71 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4; 72 case 1: stl_p(buf, vfp_get_fpscr(env)); return 4; 73 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4; 74 } 75 return 0; 76 } 77 78 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 79 { 80 int nregs; 81 82 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 83 if (reg < nregs) { 84 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf); 85 return 8; 86 } 87 if (arm_feature(env, ARM_FEATURE_NEON)) { 88 nregs += 16; 89 if (reg < nregs) { 90 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 91 q[0] = ldq_le_p(buf); 92 q[1] = ldq_le_p(buf + 8); 93 return 16; 94 } 95 } 96 switch (reg - nregs) { 97 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4; 98 case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4; 99 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4; 100 } 101 return 0; 102 } 103 104 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 105 { 106 switch (reg) { 107 case 0 ... 31: 108 /* 128 bit FP register */ 109 { 110 uint64_t *q = aa64_vfp_qreg(env, reg); 111 stq_le_p(buf, q[0]); 112 stq_le_p(buf + 8, q[1]); 113 return 16; 114 } 115 case 32: 116 /* FPSR */ 117 stl_p(buf, vfp_get_fpsr(env)); 118 return 4; 119 case 33: 120 /* FPCR */ 121 stl_p(buf, vfp_get_fpcr(env)); 122 return 4; 123 default: 124 return 0; 125 } 126 } 127 128 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 129 { 130 switch (reg) { 131 case 0 ... 31: 132 /* 128 bit FP register */ 133 { 134 uint64_t *q = aa64_vfp_qreg(env, reg); 135 q[0] = ldq_le_p(buf); 136 q[1] = ldq_le_p(buf + 8); 137 return 16; 138 } 139 case 32: 140 /* FPSR */ 141 vfp_set_fpsr(env, ldl_p(buf)); 142 return 4; 143 case 33: 144 /* FPCR */ 145 vfp_set_fpcr(env, ldl_p(buf)); 146 return 4; 147 default: 148 return 0; 149 } 150 } 151 152 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 153 { 154 assert(ri->fieldoffset); 155 if (cpreg_field_is_64bit(ri)) { 156 return CPREG_FIELD64(env, ri); 157 } else { 158 return CPREG_FIELD32(env, ri); 159 } 160 } 161 162 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 163 uint64_t value) 164 { 165 assert(ri->fieldoffset); 166 if (cpreg_field_is_64bit(ri)) { 167 CPREG_FIELD64(env, ri) = value; 168 } else { 169 CPREG_FIELD32(env, ri) = value; 170 } 171 } 172 173 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 174 { 175 return (char *)env + ri->fieldoffset; 176 } 177 178 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 179 { 180 /* Raw read of a coprocessor register (as needed for migration, etc). */ 181 if (ri->type & ARM_CP_CONST) { 182 return ri->resetvalue; 183 } else if (ri->raw_readfn) { 184 return ri->raw_readfn(env, ri); 185 } else if (ri->readfn) { 186 return ri->readfn(env, ri); 187 } else { 188 return raw_read(env, ri); 189 } 190 } 191 192 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 193 uint64_t v) 194 { 195 /* Raw write of a coprocessor register (as needed for migration, etc). 196 * Note that constant registers are treated as write-ignored; the 197 * caller should check for success by whether a readback gives the 198 * value written. 199 */ 200 if (ri->type & ARM_CP_CONST) { 201 return; 202 } else if (ri->raw_writefn) { 203 ri->raw_writefn(env, ri, v); 204 } else if (ri->writefn) { 205 ri->writefn(env, ri, v); 206 } else { 207 raw_write(env, ri, v); 208 } 209 } 210 211 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg) 212 { 213 ARMCPU *cpu = env_archcpu(env); 214 const ARMCPRegInfo *ri; 215 uint32_t key; 216 217 key = cpu->dyn_xml.cpregs_keys[reg]; 218 ri = get_arm_cp_reginfo(cpu->cp_regs, key); 219 if (ri) { 220 if (cpreg_field_is_64bit(ri)) { 221 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri)); 222 } else { 223 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri)); 224 } 225 } 226 return 0; 227 } 228 229 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg) 230 { 231 return 0; 232 } 233 234 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 235 { 236 /* Return true if the regdef would cause an assertion if you called 237 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 238 * program bug for it not to have the NO_RAW flag). 239 * NB that returning false here doesn't necessarily mean that calling 240 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 241 * read/write access functions which are safe for raw use" from "has 242 * read/write access functions which have side effects but has forgotten 243 * to provide raw access functions". 244 * The tests here line up with the conditions in read/write_raw_cp_reg() 245 * and assertions in raw_read()/raw_write(). 246 */ 247 if ((ri->type & ARM_CP_CONST) || 248 ri->fieldoffset || 249 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 250 return false; 251 } 252 return true; 253 } 254 255 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync) 256 { 257 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 258 int i; 259 bool ok = true; 260 261 for (i = 0; i < cpu->cpreg_array_len; i++) { 262 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 263 const ARMCPRegInfo *ri; 264 uint64_t newval; 265 266 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 267 if (!ri) { 268 ok = false; 269 continue; 270 } 271 if (ri->type & ARM_CP_NO_RAW) { 272 continue; 273 } 274 275 newval = read_raw_cp_reg(&cpu->env, ri); 276 if (kvm_sync) { 277 /* 278 * Only sync if the previous list->cpustate sync succeeded. 279 * Rather than tracking the success/failure state for every 280 * item in the list, we just recheck "does the raw write we must 281 * have made in write_list_to_cpustate() read back OK" here. 282 */ 283 uint64_t oldval = cpu->cpreg_values[i]; 284 285 if (oldval == newval) { 286 continue; 287 } 288 289 write_raw_cp_reg(&cpu->env, ri, oldval); 290 if (read_raw_cp_reg(&cpu->env, ri) != oldval) { 291 continue; 292 } 293 294 write_raw_cp_reg(&cpu->env, ri, newval); 295 } 296 cpu->cpreg_values[i] = newval; 297 } 298 return ok; 299 } 300 301 bool write_list_to_cpustate(ARMCPU *cpu) 302 { 303 int i; 304 bool ok = true; 305 306 for (i = 0; i < cpu->cpreg_array_len; i++) { 307 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 308 uint64_t v = cpu->cpreg_values[i]; 309 const ARMCPRegInfo *ri; 310 311 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 312 if (!ri) { 313 ok = false; 314 continue; 315 } 316 if (ri->type & ARM_CP_NO_RAW) { 317 continue; 318 } 319 /* Write value and confirm it reads back as written 320 * (to catch read-only registers and partially read-only 321 * registers where the incoming migration value doesn't match) 322 */ 323 write_raw_cp_reg(&cpu->env, ri, v); 324 if (read_raw_cp_reg(&cpu->env, ri) != v) { 325 ok = false; 326 } 327 } 328 return ok; 329 } 330 331 static void add_cpreg_to_list(gpointer key, gpointer opaque) 332 { 333 ARMCPU *cpu = opaque; 334 uint64_t regidx; 335 const ARMCPRegInfo *ri; 336 337 regidx = *(uint32_t *)key; 338 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 339 340 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 341 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 342 /* The value array need not be initialized at this point */ 343 cpu->cpreg_array_len++; 344 } 345 } 346 347 static void count_cpreg(gpointer key, gpointer opaque) 348 { 349 ARMCPU *cpu = opaque; 350 uint64_t regidx; 351 const ARMCPRegInfo *ri; 352 353 regidx = *(uint32_t *)key; 354 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 355 356 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 357 cpu->cpreg_array_len++; 358 } 359 } 360 361 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 362 { 363 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a); 364 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b); 365 366 if (aidx > bidx) { 367 return 1; 368 } 369 if (aidx < bidx) { 370 return -1; 371 } 372 return 0; 373 } 374 375 void init_cpreg_list(ARMCPU *cpu) 376 { 377 /* Initialise the cpreg_tuples[] array based on the cp_regs hash. 378 * Note that we require cpreg_tuples[] to be sorted by key ID. 379 */ 380 GList *keys; 381 int arraylen; 382 383 keys = g_hash_table_get_keys(cpu->cp_regs); 384 keys = g_list_sort(keys, cpreg_key_compare); 385 386 cpu->cpreg_array_len = 0; 387 388 g_list_foreach(keys, count_cpreg, cpu); 389 390 arraylen = cpu->cpreg_array_len; 391 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 392 cpu->cpreg_values = g_new(uint64_t, arraylen); 393 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 394 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 395 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 396 cpu->cpreg_array_len = 0; 397 398 g_list_foreach(keys, add_cpreg_to_list, cpu); 399 400 assert(cpu->cpreg_array_len == arraylen); 401 402 g_list_free(keys); 403 } 404 405 /* 406 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but 407 * they are accessible when EL3 is using AArch64 regardless of EL3.NS. 408 * 409 * access_el3_aa32ns: Used to check AArch32 register views. 410 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views. 411 */ 412 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 413 const ARMCPRegInfo *ri, 414 bool isread) 415 { 416 bool secure = arm_is_secure_below_el3(env); 417 418 assert(!arm_el_is_aa64(env, 3)); 419 if (secure) { 420 return CP_ACCESS_TRAP_UNCATEGORIZED; 421 } 422 return CP_ACCESS_OK; 423 } 424 425 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env, 426 const ARMCPRegInfo *ri, 427 bool isread) 428 { 429 if (!arm_el_is_aa64(env, 3)) { 430 return access_el3_aa32ns(env, ri, isread); 431 } 432 return CP_ACCESS_OK; 433 } 434 435 /* Some secure-only AArch32 registers trap to EL3 if used from 436 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 437 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 438 * We assume that the .access field is set to PL1_RW. 439 */ 440 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 441 const ARMCPRegInfo *ri, 442 bool isread) 443 { 444 if (arm_current_el(env) == 3) { 445 return CP_ACCESS_OK; 446 } 447 if (arm_is_secure_below_el3(env)) { 448 return CP_ACCESS_TRAP_EL3; 449 } 450 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 451 return CP_ACCESS_TRAP_UNCATEGORIZED; 452 } 453 454 /* Check for traps to "powerdown debug" registers, which are controlled 455 * by MDCR.TDOSA 456 */ 457 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, 458 bool isread) 459 { 460 int el = arm_current_el(env); 461 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) || 462 (env->cp15.mdcr_el2 & MDCR_TDE) || 463 (arm_hcr_el2_eff(env) & HCR_TGE); 464 465 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) { 466 return CP_ACCESS_TRAP_EL2; 467 } 468 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { 469 return CP_ACCESS_TRAP_EL3; 470 } 471 return CP_ACCESS_OK; 472 } 473 474 /* Check for traps to "debug ROM" registers, which are controlled 475 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. 476 */ 477 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, 478 bool isread) 479 { 480 int el = arm_current_el(env); 481 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) || 482 (env->cp15.mdcr_el2 & MDCR_TDE) || 483 (arm_hcr_el2_eff(env) & HCR_TGE); 484 485 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) { 486 return CP_ACCESS_TRAP_EL2; 487 } 488 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 489 return CP_ACCESS_TRAP_EL3; 490 } 491 return CP_ACCESS_OK; 492 } 493 494 /* Check for traps to general debug registers, which are controlled 495 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. 496 */ 497 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, 498 bool isread) 499 { 500 int el = arm_current_el(env); 501 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) || 502 (env->cp15.mdcr_el2 & MDCR_TDE) || 503 (arm_hcr_el2_eff(env) & HCR_TGE); 504 505 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) { 506 return CP_ACCESS_TRAP_EL2; 507 } 508 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 509 return CP_ACCESS_TRAP_EL3; 510 } 511 return CP_ACCESS_OK; 512 } 513 514 /* Check for traps to performance monitor registers, which are controlled 515 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 516 */ 517 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 518 bool isread) 519 { 520 int el = arm_current_el(env); 521 522 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 523 && !arm_is_secure_below_el3(env)) { 524 return CP_ACCESS_TRAP_EL2; 525 } 526 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 527 return CP_ACCESS_TRAP_EL3; 528 } 529 return CP_ACCESS_OK; 530 } 531 532 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 533 { 534 ARMCPU *cpu = env_archcpu(env); 535 536 raw_write(env, ri, value); 537 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 538 } 539 540 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 541 { 542 ARMCPU *cpu = env_archcpu(env); 543 544 if (raw_read(env, ri) != value) { 545 /* Unlike real hardware the qemu TLB uses virtual addresses, 546 * not modified virtual addresses, so this causes a TLB flush. 547 */ 548 tlb_flush(CPU(cpu)); 549 raw_write(env, ri, value); 550 } 551 } 552 553 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 554 uint64_t value) 555 { 556 ARMCPU *cpu = env_archcpu(env); 557 558 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 559 && !extended_addresses_enabled(env)) { 560 /* For VMSA (when not using the LPAE long descriptor page table 561 * format) this register includes the ASID, so do a TLB flush. 562 * For PMSA it is purely a process ID and no action is needed. 563 */ 564 tlb_flush(CPU(cpu)); 565 } 566 raw_write(env, ri, value); 567 } 568 569 /* IS variants of TLB operations must affect all cores */ 570 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 571 uint64_t value) 572 { 573 CPUState *cs = env_cpu(env); 574 575 tlb_flush_all_cpus_synced(cs); 576 } 577 578 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 579 uint64_t value) 580 { 581 CPUState *cs = env_cpu(env); 582 583 tlb_flush_all_cpus_synced(cs); 584 } 585 586 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 587 uint64_t value) 588 { 589 CPUState *cs = env_cpu(env); 590 591 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 592 } 593 594 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 595 uint64_t value) 596 { 597 CPUState *cs = env_cpu(env); 598 599 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 600 } 601 602 /* 603 * Non-IS variants of TLB operations are upgraded to 604 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to 605 * force broadcast of these operations. 606 */ 607 static bool tlb_force_broadcast(CPUARMState *env) 608 { 609 return (env->cp15.hcr_el2 & HCR_FB) && 610 arm_current_el(env) == 1 && arm_is_secure_below_el3(env); 611 } 612 613 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 614 uint64_t value) 615 { 616 /* Invalidate all (TLBIALL) */ 617 CPUState *cs = env_cpu(env); 618 619 if (tlb_force_broadcast(env)) { 620 tlb_flush_all_cpus_synced(cs); 621 } else { 622 tlb_flush(cs); 623 } 624 } 625 626 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 627 uint64_t value) 628 { 629 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 630 CPUState *cs = env_cpu(env); 631 632 value &= TARGET_PAGE_MASK; 633 if (tlb_force_broadcast(env)) { 634 tlb_flush_page_all_cpus_synced(cs, value); 635 } else { 636 tlb_flush_page(cs, value); 637 } 638 } 639 640 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 641 uint64_t value) 642 { 643 /* Invalidate by ASID (TLBIASID) */ 644 CPUState *cs = env_cpu(env); 645 646 if (tlb_force_broadcast(env)) { 647 tlb_flush_all_cpus_synced(cs); 648 } else { 649 tlb_flush(cs); 650 } 651 } 652 653 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 654 uint64_t value) 655 { 656 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 657 CPUState *cs = env_cpu(env); 658 659 value &= TARGET_PAGE_MASK; 660 if (tlb_force_broadcast(env)) { 661 tlb_flush_page_all_cpus_synced(cs, value); 662 } else { 663 tlb_flush_page(cs, value); 664 } 665 } 666 667 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 668 uint64_t value) 669 { 670 CPUState *cs = env_cpu(env); 671 672 tlb_flush_by_mmuidx(cs, 673 ARMMMUIdxBit_E10_1 | 674 ARMMMUIdxBit_E10_0 | 675 ARMMMUIdxBit_Stage2); 676 } 677 678 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 679 uint64_t value) 680 { 681 CPUState *cs = env_cpu(env); 682 683 tlb_flush_by_mmuidx_all_cpus_synced(cs, 684 ARMMMUIdxBit_E10_1 | 685 ARMMMUIdxBit_E10_0 | 686 ARMMMUIdxBit_Stage2); 687 } 688 689 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri, 690 uint64_t value) 691 { 692 /* Invalidate by IPA. This has to invalidate any structures that 693 * contain only stage 2 translation information, but does not need 694 * to apply to structures that contain combined stage 1 and stage 2 695 * translation information. 696 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 697 */ 698 CPUState *cs = env_cpu(env); 699 uint64_t pageaddr; 700 701 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 702 return; 703 } 704 705 pageaddr = sextract64(value << 12, 0, 40); 706 707 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2); 708 } 709 710 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 711 uint64_t value) 712 { 713 CPUState *cs = env_cpu(env); 714 uint64_t pageaddr; 715 716 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 717 return; 718 } 719 720 pageaddr = sextract64(value << 12, 0, 40); 721 722 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 723 ARMMMUIdxBit_Stage2); 724 } 725 726 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 727 uint64_t value) 728 { 729 CPUState *cs = env_cpu(env); 730 731 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2); 732 } 733 734 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 735 uint64_t value) 736 { 737 CPUState *cs = env_cpu(env); 738 739 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E2); 740 } 741 742 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 743 uint64_t value) 744 { 745 CPUState *cs = env_cpu(env); 746 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 747 748 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E2); 749 } 750 751 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 752 uint64_t value) 753 { 754 CPUState *cs = env_cpu(env); 755 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 756 757 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 758 ARMMMUIdxBit_E2); 759 } 760 761 static const ARMCPRegInfo cp_reginfo[] = { 762 /* Define the secure and non-secure FCSE identifier CP registers 763 * separately because there is no secure bank in V8 (no _EL3). This allows 764 * the secure register to be properly reset and migrated. There is also no 765 * v8 EL1 version of the register so the non-secure instance stands alone. 766 */ 767 { .name = "FCSEIDR", 768 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 769 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 770 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 771 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 772 { .name = "FCSEIDR_S", 773 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 774 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 775 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 776 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 777 /* Define the secure and non-secure context identifier CP registers 778 * separately because there is no secure bank in V8 (no _EL3). This allows 779 * the secure register to be properly reset and migrated. In the 780 * non-secure case, the 32-bit register will have reset and migration 781 * disabled during registration as it is handled by the 64-bit instance. 782 */ 783 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 784 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 785 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 786 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 787 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 788 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 789 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 790 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 791 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 792 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 793 REGINFO_SENTINEL 794 }; 795 796 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 797 /* NB: Some of these registers exist in v8 but with more precise 798 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 799 */ 800 /* MMU Domain access control / MPU write buffer control */ 801 { .name = "DACR", 802 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 803 .access = PL1_RW, .resetvalue = 0, 804 .writefn = dacr_write, .raw_writefn = raw_write, 805 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 806 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 807 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 808 * For v6 and v5, these mappings are overly broad. 809 */ 810 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 811 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 812 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 813 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 814 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 815 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 816 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 817 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 818 /* Cache maintenance ops; some of this space may be overridden later. */ 819 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 820 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 821 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 822 REGINFO_SENTINEL 823 }; 824 825 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 826 /* Not all pre-v6 cores implemented this WFI, so this is slightly 827 * over-broad. 828 */ 829 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 830 .access = PL1_W, .type = ARM_CP_WFI }, 831 REGINFO_SENTINEL 832 }; 833 834 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 835 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 836 * is UNPREDICTABLE; we choose to NOP as most implementations do). 837 */ 838 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 839 .access = PL1_W, .type = ARM_CP_WFI }, 840 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice 841 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 842 * OMAPCP will override this space. 843 */ 844 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 845 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 846 .resetvalue = 0 }, 847 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 848 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 849 .resetvalue = 0 }, 850 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 851 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 852 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 853 .resetvalue = 0 }, 854 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 855 * implementing it as RAZ means the "debug architecture version" bits 856 * will read as a reserved value, which should cause Linux to not try 857 * to use the debug hardware. 858 */ 859 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 860 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 861 /* MMU TLB control. Note that the wildcarding means we cover not just 862 * the unified TLB ops but also the dside/iside/inner-shareable variants. 863 */ 864 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 865 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 866 .type = ARM_CP_NO_RAW }, 867 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 868 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 869 .type = ARM_CP_NO_RAW }, 870 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 871 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 872 .type = ARM_CP_NO_RAW }, 873 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 874 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 875 .type = ARM_CP_NO_RAW }, 876 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 877 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 878 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 879 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 880 REGINFO_SENTINEL 881 }; 882 883 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 884 uint64_t value) 885 { 886 uint32_t mask = 0; 887 888 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 889 if (!arm_feature(env, ARM_FEATURE_V8)) { 890 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 891 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 892 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 893 */ 894 if (arm_feature(env, ARM_FEATURE_VFP)) { 895 /* VFP coprocessor: cp10 & cp11 [23:20] */ 896 mask |= (1 << 31) | (1 << 30) | (0xf << 20); 897 898 if (!arm_feature(env, ARM_FEATURE_NEON)) { 899 /* ASEDIS [31] bit is RAO/WI */ 900 value |= (1 << 31); 901 } 902 903 /* VFPv3 and upwards with NEON implement 32 double precision 904 * registers (D0-D31). 905 */ 906 if (!arm_feature(env, ARM_FEATURE_NEON) || 907 !arm_feature(env, ARM_FEATURE_VFP3)) { 908 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 909 value |= (1 << 30); 910 } 911 } 912 value &= mask; 913 } 914 915 /* 916 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 917 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 918 */ 919 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 920 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 921 value &= ~(0xf << 20); 922 value |= env->cp15.cpacr_el1 & (0xf << 20); 923 } 924 925 env->cp15.cpacr_el1 = value; 926 } 927 928 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri) 929 { 930 /* 931 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 932 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 933 */ 934 uint64_t value = env->cp15.cpacr_el1; 935 936 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 937 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 938 value &= ~(0xf << 20); 939 } 940 return value; 941 } 942 943 944 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 945 { 946 /* Call cpacr_write() so that we reset with the correct RAO bits set 947 * for our CPU features. 948 */ 949 cpacr_write(env, ri, 0); 950 } 951 952 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 953 bool isread) 954 { 955 if (arm_feature(env, ARM_FEATURE_V8)) { 956 /* Check if CPACR accesses are to be trapped to EL2 */ 957 if (arm_current_el(env) == 1 && 958 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) { 959 return CP_ACCESS_TRAP_EL2; 960 /* Check if CPACR accesses are to be trapped to EL3 */ 961 } else if (arm_current_el(env) < 3 && 962 (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 963 return CP_ACCESS_TRAP_EL3; 964 } 965 } 966 967 return CP_ACCESS_OK; 968 } 969 970 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 971 bool isread) 972 { 973 /* Check if CPTR accesses are set to trap to EL3 */ 974 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 975 return CP_ACCESS_TRAP_EL3; 976 } 977 978 return CP_ACCESS_OK; 979 } 980 981 static const ARMCPRegInfo v6_cp_reginfo[] = { 982 /* prefetch by MVA in v6, NOP in v7 */ 983 { .name = "MVA_prefetch", 984 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 985 .access = PL1_W, .type = ARM_CP_NOP }, 986 /* We need to break the TB after ISB to execute self-modifying code 987 * correctly and also to take any pending interrupts immediately. 988 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 989 */ 990 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 991 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 992 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 993 .access = PL0_W, .type = ARM_CP_NOP }, 994 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 995 .access = PL0_W, .type = ARM_CP_NOP }, 996 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 997 .access = PL1_RW, 998 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 999 offsetof(CPUARMState, cp15.ifar_ns) }, 1000 .resetvalue = 0, }, 1001 /* Watchpoint Fault Address Register : should actually only be present 1002 * for 1136, 1176, 11MPCore. 1003 */ 1004 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 1005 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 1006 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 1007 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 1008 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 1009 .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read }, 1010 REGINFO_SENTINEL 1011 }; 1012 1013 /* Definitions for the PMU registers */ 1014 #define PMCRN_MASK 0xf800 1015 #define PMCRN_SHIFT 11 1016 #define PMCRLC 0x40 1017 #define PMCRDP 0x10 1018 #define PMCRD 0x8 1019 #define PMCRC 0x4 1020 #define PMCRP 0x2 1021 #define PMCRE 0x1 1022 1023 #define PMXEVTYPER_P 0x80000000 1024 #define PMXEVTYPER_U 0x40000000 1025 #define PMXEVTYPER_NSK 0x20000000 1026 #define PMXEVTYPER_NSU 0x10000000 1027 #define PMXEVTYPER_NSH 0x08000000 1028 #define PMXEVTYPER_M 0x04000000 1029 #define PMXEVTYPER_MT 0x02000000 1030 #define PMXEVTYPER_EVTCOUNT 0x0000ffff 1031 #define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \ 1032 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \ 1033 PMXEVTYPER_M | PMXEVTYPER_MT | \ 1034 PMXEVTYPER_EVTCOUNT) 1035 1036 #define PMCCFILTR 0xf8000000 1037 #define PMCCFILTR_M PMXEVTYPER_M 1038 #define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M) 1039 1040 static inline uint32_t pmu_num_counters(CPUARMState *env) 1041 { 1042 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT; 1043 } 1044 1045 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */ 1046 static inline uint64_t pmu_counter_mask(CPUARMState *env) 1047 { 1048 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1); 1049 } 1050 1051 typedef struct pm_event { 1052 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 1053 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 1054 bool (*supported)(CPUARMState *); 1055 /* 1056 * Retrieve the current count of the underlying event. The programmed 1057 * counters hold a difference from the return value from this function 1058 */ 1059 uint64_t (*get_count)(CPUARMState *); 1060 /* 1061 * Return how many nanoseconds it will take (at a minimum) for count events 1062 * to occur. A negative value indicates the counter will never overflow, or 1063 * that the counter has otherwise arranged for the overflow bit to be set 1064 * and the PMU interrupt to be raised on overflow. 1065 */ 1066 int64_t (*ns_per_count)(uint64_t); 1067 } pm_event; 1068 1069 static bool event_always_supported(CPUARMState *env) 1070 { 1071 return true; 1072 } 1073 1074 static uint64_t swinc_get_count(CPUARMState *env) 1075 { 1076 /* 1077 * SW_INCR events are written directly to the pmevcntr's by writes to 1078 * PMSWINC, so there is no underlying count maintained by the PMU itself 1079 */ 1080 return 0; 1081 } 1082 1083 static int64_t swinc_ns_per(uint64_t ignored) 1084 { 1085 return -1; 1086 } 1087 1088 /* 1089 * Return the underlying cycle count for the PMU cycle counters. If we're in 1090 * usermode, simply return 0. 1091 */ 1092 static uint64_t cycles_get_count(CPUARMState *env) 1093 { 1094 #ifndef CONFIG_USER_ONLY 1095 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1096 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 1097 #else 1098 return cpu_get_host_ticks(); 1099 #endif 1100 } 1101 1102 #ifndef CONFIG_USER_ONLY 1103 static int64_t cycles_ns_per(uint64_t cycles) 1104 { 1105 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 1106 } 1107 1108 static bool instructions_supported(CPUARMState *env) 1109 { 1110 return use_icount == 1 /* Precise instruction counting */; 1111 } 1112 1113 static uint64_t instructions_get_count(CPUARMState *env) 1114 { 1115 return (uint64_t)cpu_get_icount_raw(); 1116 } 1117 1118 static int64_t instructions_ns_per(uint64_t icount) 1119 { 1120 return cpu_icount_to_ns((int64_t)icount); 1121 } 1122 #endif 1123 1124 static const pm_event pm_events[] = { 1125 { .number = 0x000, /* SW_INCR */ 1126 .supported = event_always_supported, 1127 .get_count = swinc_get_count, 1128 .ns_per_count = swinc_ns_per, 1129 }, 1130 #ifndef CONFIG_USER_ONLY 1131 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 1132 .supported = instructions_supported, 1133 .get_count = instructions_get_count, 1134 .ns_per_count = instructions_ns_per, 1135 }, 1136 { .number = 0x011, /* CPU_CYCLES, Cycle */ 1137 .supported = event_always_supported, 1138 .get_count = cycles_get_count, 1139 .ns_per_count = cycles_ns_per, 1140 } 1141 #endif 1142 }; 1143 1144 /* 1145 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1146 * events (i.e. the statistical profiling extension), this implementation 1147 * should first be updated to something sparse instead of the current 1148 * supported_event_map[] array. 1149 */ 1150 #define MAX_EVENT_ID 0x11 1151 #define UNSUPPORTED_EVENT UINT16_MAX 1152 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1153 1154 /* 1155 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 1156 * of ARM event numbers to indices in our pm_events array. 1157 * 1158 * Note: Events in the 0x40XX range are not currently supported. 1159 */ 1160 void pmu_init(ARMCPU *cpu) 1161 { 1162 unsigned int i; 1163 1164 /* 1165 * Empty supported_event_map and cpu->pmceid[01] before adding supported 1166 * events to them 1167 */ 1168 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1169 supported_event_map[i] = UNSUPPORTED_EVENT; 1170 } 1171 cpu->pmceid0 = 0; 1172 cpu->pmceid1 = 0; 1173 1174 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1175 const pm_event *cnt = &pm_events[i]; 1176 assert(cnt->number <= MAX_EVENT_ID); 1177 /* We do not currently support events in the 0x40xx range */ 1178 assert(cnt->number <= 0x3f); 1179 1180 if (cnt->supported(&cpu->env)) { 1181 supported_event_map[cnt->number] = i; 1182 uint64_t event_mask = 1ULL << (cnt->number & 0x1f); 1183 if (cnt->number & 0x20) { 1184 cpu->pmceid1 |= event_mask; 1185 } else { 1186 cpu->pmceid0 |= event_mask; 1187 } 1188 } 1189 } 1190 } 1191 1192 /* 1193 * Check at runtime whether a PMU event is supported for the current machine 1194 */ 1195 static bool event_supported(uint16_t number) 1196 { 1197 if (number > MAX_EVENT_ID) { 1198 return false; 1199 } 1200 return supported_event_map[number] != UNSUPPORTED_EVENT; 1201 } 1202 1203 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1204 bool isread) 1205 { 1206 /* Performance monitor registers user accessibility is controlled 1207 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1208 * trapping to EL2 or EL3 for other accesses. 1209 */ 1210 int el = arm_current_el(env); 1211 1212 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1213 return CP_ACCESS_TRAP; 1214 } 1215 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 1216 && !arm_is_secure_below_el3(env)) { 1217 return CP_ACCESS_TRAP_EL2; 1218 } 1219 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1220 return CP_ACCESS_TRAP_EL3; 1221 } 1222 1223 return CP_ACCESS_OK; 1224 } 1225 1226 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1227 const ARMCPRegInfo *ri, 1228 bool isread) 1229 { 1230 /* ER: event counter read trap control */ 1231 if (arm_feature(env, ARM_FEATURE_V8) 1232 && arm_current_el(env) == 0 1233 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1234 && isread) { 1235 return CP_ACCESS_OK; 1236 } 1237 1238 return pmreg_access(env, ri, isread); 1239 } 1240 1241 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1242 const ARMCPRegInfo *ri, 1243 bool isread) 1244 { 1245 /* SW: software increment write trap control */ 1246 if (arm_feature(env, ARM_FEATURE_V8) 1247 && arm_current_el(env) == 0 1248 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1249 && !isread) { 1250 return CP_ACCESS_OK; 1251 } 1252 1253 return pmreg_access(env, ri, isread); 1254 } 1255 1256 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1257 const ARMCPRegInfo *ri, 1258 bool isread) 1259 { 1260 /* ER: event counter read trap control */ 1261 if (arm_feature(env, ARM_FEATURE_V8) 1262 && arm_current_el(env) == 0 1263 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1264 return CP_ACCESS_OK; 1265 } 1266 1267 return pmreg_access(env, ri, isread); 1268 } 1269 1270 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1271 const ARMCPRegInfo *ri, 1272 bool isread) 1273 { 1274 /* CR: cycle counter read trap control */ 1275 if (arm_feature(env, ARM_FEATURE_V8) 1276 && arm_current_el(env) == 0 1277 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1278 && isread) { 1279 return CP_ACCESS_OK; 1280 } 1281 1282 return pmreg_access(env, ri, isread); 1283 } 1284 1285 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using 1286 * the current EL, security state, and register configuration. 1287 */ 1288 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1289 { 1290 uint64_t filter; 1291 bool e, p, u, nsk, nsu, nsh, m; 1292 bool enabled, prohibited, filtered; 1293 bool secure = arm_is_secure(env); 1294 int el = arm_current_el(env); 1295 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1296 1297 if (!arm_feature(env, ARM_FEATURE_PMU)) { 1298 return false; 1299 } 1300 1301 if (!arm_feature(env, ARM_FEATURE_EL2) || 1302 (counter < hpmn || counter == 31)) { 1303 e = env->cp15.c9_pmcr & PMCRE; 1304 } else { 1305 e = env->cp15.mdcr_el2 & MDCR_HPME; 1306 } 1307 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1308 1309 if (!secure) { 1310 if (el == 2 && (counter < hpmn || counter == 31)) { 1311 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD; 1312 } else { 1313 prohibited = false; 1314 } 1315 } else { 1316 prohibited = arm_feature(env, ARM_FEATURE_EL3) && 1317 (env->cp15.mdcr_el3 & MDCR_SPME); 1318 } 1319 1320 if (prohibited && counter == 31) { 1321 prohibited = env->cp15.c9_pmcr & PMCRDP; 1322 } 1323 1324 if (counter == 31) { 1325 filter = env->cp15.pmccfiltr_el0; 1326 } else { 1327 filter = env->cp15.c14_pmevtyper[counter]; 1328 } 1329 1330 p = filter & PMXEVTYPER_P; 1331 u = filter & PMXEVTYPER_U; 1332 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1333 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1334 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1335 m = arm_el_is_aa64(env, 1) && 1336 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1337 1338 if (el == 0) { 1339 filtered = secure ? u : u != nsu; 1340 } else if (el == 1) { 1341 filtered = secure ? p : p != nsk; 1342 } else if (el == 2) { 1343 filtered = !nsh; 1344 } else { /* EL3 */ 1345 filtered = m != p; 1346 } 1347 1348 if (counter != 31) { 1349 /* 1350 * If not checking PMCCNTR, ensure the counter is setup to an event we 1351 * support 1352 */ 1353 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1354 if (!event_supported(event)) { 1355 return false; 1356 } 1357 } 1358 1359 return enabled && !prohibited && !filtered; 1360 } 1361 1362 static void pmu_update_irq(CPUARMState *env) 1363 { 1364 ARMCPU *cpu = env_archcpu(env); 1365 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1366 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1367 } 1368 1369 /* 1370 * Ensure c15_ccnt is the guest-visible count so that operations such as 1371 * enabling/disabling the counter or filtering, modifying the count itself, 1372 * etc. can be done logically. This is essentially a no-op if the counter is 1373 * not enabled at the time of the call. 1374 */ 1375 static void pmccntr_op_start(CPUARMState *env) 1376 { 1377 uint64_t cycles = cycles_get_count(env); 1378 1379 if (pmu_counter_enabled(env, 31)) { 1380 uint64_t eff_cycles = cycles; 1381 if (env->cp15.c9_pmcr & PMCRD) { 1382 /* Increment once every 64 processor clock cycles */ 1383 eff_cycles /= 64; 1384 } 1385 1386 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1387 1388 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1389 1ull << 63 : 1ull << 31; 1390 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1391 env->cp15.c9_pmovsr |= (1 << 31); 1392 pmu_update_irq(env); 1393 } 1394 1395 env->cp15.c15_ccnt = new_pmccntr; 1396 } 1397 env->cp15.c15_ccnt_delta = cycles; 1398 } 1399 1400 /* 1401 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1402 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1403 * pmccntr_op_start. 1404 */ 1405 static void pmccntr_op_finish(CPUARMState *env) 1406 { 1407 if (pmu_counter_enabled(env, 31)) { 1408 #ifndef CONFIG_USER_ONLY 1409 /* Calculate when the counter will next overflow */ 1410 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1411 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1412 remaining_cycles = (uint32_t)remaining_cycles; 1413 } 1414 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1415 1416 if (overflow_in > 0) { 1417 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1418 overflow_in; 1419 ARMCPU *cpu = env_archcpu(env); 1420 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1421 } 1422 #endif 1423 1424 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1425 if (env->cp15.c9_pmcr & PMCRD) { 1426 /* Increment once every 64 processor clock cycles */ 1427 prev_cycles /= 64; 1428 } 1429 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1430 } 1431 } 1432 1433 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1434 { 1435 1436 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1437 uint64_t count = 0; 1438 if (event_supported(event)) { 1439 uint16_t event_idx = supported_event_map[event]; 1440 count = pm_events[event_idx].get_count(env); 1441 } 1442 1443 if (pmu_counter_enabled(env, counter)) { 1444 uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1445 1446 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) { 1447 env->cp15.c9_pmovsr |= (1 << counter); 1448 pmu_update_irq(env); 1449 } 1450 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1451 } 1452 env->cp15.c14_pmevcntr_delta[counter] = count; 1453 } 1454 1455 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1456 { 1457 if (pmu_counter_enabled(env, counter)) { 1458 #ifndef CONFIG_USER_ONLY 1459 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1460 uint16_t event_idx = supported_event_map[event]; 1461 uint64_t delta = UINT32_MAX - 1462 (uint32_t)env->cp15.c14_pmevcntr[counter] + 1; 1463 int64_t overflow_in = pm_events[event_idx].ns_per_count(delta); 1464 1465 if (overflow_in > 0) { 1466 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1467 overflow_in; 1468 ARMCPU *cpu = env_archcpu(env); 1469 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1470 } 1471 #endif 1472 1473 env->cp15.c14_pmevcntr_delta[counter] -= 1474 env->cp15.c14_pmevcntr[counter]; 1475 } 1476 } 1477 1478 void pmu_op_start(CPUARMState *env) 1479 { 1480 unsigned int i; 1481 pmccntr_op_start(env); 1482 for (i = 0; i < pmu_num_counters(env); i++) { 1483 pmevcntr_op_start(env, i); 1484 } 1485 } 1486 1487 void pmu_op_finish(CPUARMState *env) 1488 { 1489 unsigned int i; 1490 pmccntr_op_finish(env); 1491 for (i = 0; i < pmu_num_counters(env); i++) { 1492 pmevcntr_op_finish(env, i); 1493 } 1494 } 1495 1496 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1497 { 1498 pmu_op_start(&cpu->env); 1499 } 1500 1501 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1502 { 1503 pmu_op_finish(&cpu->env); 1504 } 1505 1506 void arm_pmu_timer_cb(void *opaque) 1507 { 1508 ARMCPU *cpu = opaque; 1509 1510 /* 1511 * Update all the counter values based on the current underlying counts, 1512 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1513 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1514 * counter may expire. 1515 */ 1516 pmu_op_start(&cpu->env); 1517 pmu_op_finish(&cpu->env); 1518 } 1519 1520 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1521 uint64_t value) 1522 { 1523 pmu_op_start(env); 1524 1525 if (value & PMCRC) { 1526 /* The counter has been reset */ 1527 env->cp15.c15_ccnt = 0; 1528 } 1529 1530 if (value & PMCRP) { 1531 unsigned int i; 1532 for (i = 0; i < pmu_num_counters(env); i++) { 1533 env->cp15.c14_pmevcntr[i] = 0; 1534 } 1535 } 1536 1537 /* only the DP, X, D and E bits are writable */ 1538 env->cp15.c9_pmcr &= ~0x39; 1539 env->cp15.c9_pmcr |= (value & 0x39); 1540 1541 pmu_op_finish(env); 1542 } 1543 1544 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1545 uint64_t value) 1546 { 1547 unsigned int i; 1548 for (i = 0; i < pmu_num_counters(env); i++) { 1549 /* Increment a counter's count iff: */ 1550 if ((value & (1 << i)) && /* counter's bit is set */ 1551 /* counter is enabled and not filtered */ 1552 pmu_counter_enabled(env, i) && 1553 /* counter is SW_INCR */ 1554 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1555 pmevcntr_op_start(env, i); 1556 1557 /* 1558 * Detect if this write causes an overflow since we can't predict 1559 * PMSWINC overflows like we can for other events 1560 */ 1561 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1562 1563 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) { 1564 env->cp15.c9_pmovsr |= (1 << i); 1565 pmu_update_irq(env); 1566 } 1567 1568 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1569 1570 pmevcntr_op_finish(env, i); 1571 } 1572 } 1573 } 1574 1575 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1576 { 1577 uint64_t ret; 1578 pmccntr_op_start(env); 1579 ret = env->cp15.c15_ccnt; 1580 pmccntr_op_finish(env); 1581 return ret; 1582 } 1583 1584 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1585 uint64_t value) 1586 { 1587 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1588 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1589 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1590 * accessed. 1591 */ 1592 env->cp15.c9_pmselr = value & 0x1f; 1593 } 1594 1595 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1596 uint64_t value) 1597 { 1598 pmccntr_op_start(env); 1599 env->cp15.c15_ccnt = value; 1600 pmccntr_op_finish(env); 1601 } 1602 1603 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1604 uint64_t value) 1605 { 1606 uint64_t cur_val = pmccntr_read(env, NULL); 1607 1608 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1609 } 1610 1611 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1612 uint64_t value) 1613 { 1614 pmccntr_op_start(env); 1615 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1616 pmccntr_op_finish(env); 1617 } 1618 1619 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1620 uint64_t value) 1621 { 1622 pmccntr_op_start(env); 1623 /* M is not accessible from AArch32 */ 1624 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1625 (value & PMCCFILTR); 1626 pmccntr_op_finish(env); 1627 } 1628 1629 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1630 { 1631 /* M is not visible in AArch32 */ 1632 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1633 } 1634 1635 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1636 uint64_t value) 1637 { 1638 value &= pmu_counter_mask(env); 1639 env->cp15.c9_pmcnten |= value; 1640 } 1641 1642 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1643 uint64_t value) 1644 { 1645 value &= pmu_counter_mask(env); 1646 env->cp15.c9_pmcnten &= ~value; 1647 } 1648 1649 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1650 uint64_t value) 1651 { 1652 value &= pmu_counter_mask(env); 1653 env->cp15.c9_pmovsr &= ~value; 1654 pmu_update_irq(env); 1655 } 1656 1657 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1658 uint64_t value) 1659 { 1660 value &= pmu_counter_mask(env); 1661 env->cp15.c9_pmovsr |= value; 1662 pmu_update_irq(env); 1663 } 1664 1665 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1666 uint64_t value, const uint8_t counter) 1667 { 1668 if (counter == 31) { 1669 pmccfiltr_write(env, ri, value); 1670 } else if (counter < pmu_num_counters(env)) { 1671 pmevcntr_op_start(env, counter); 1672 1673 /* 1674 * If this counter's event type is changing, store the current 1675 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1676 * pmevcntr_op_finish has the correct baseline when it converts back to 1677 * a delta. 1678 */ 1679 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1680 PMXEVTYPER_EVTCOUNT; 1681 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1682 if (old_event != new_event) { 1683 uint64_t count = 0; 1684 if (event_supported(new_event)) { 1685 uint16_t event_idx = supported_event_map[new_event]; 1686 count = pm_events[event_idx].get_count(env); 1687 } 1688 env->cp15.c14_pmevcntr_delta[counter] = count; 1689 } 1690 1691 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1692 pmevcntr_op_finish(env, counter); 1693 } 1694 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1695 * PMSELR value is equal to or greater than the number of implemented 1696 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1697 */ 1698 } 1699 1700 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1701 const uint8_t counter) 1702 { 1703 if (counter == 31) { 1704 return env->cp15.pmccfiltr_el0; 1705 } else if (counter < pmu_num_counters(env)) { 1706 return env->cp15.c14_pmevtyper[counter]; 1707 } else { 1708 /* 1709 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1710 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1711 */ 1712 return 0; 1713 } 1714 } 1715 1716 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1717 uint64_t value) 1718 { 1719 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1720 pmevtyper_write(env, ri, value, counter); 1721 } 1722 1723 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1724 uint64_t value) 1725 { 1726 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1727 env->cp15.c14_pmevtyper[counter] = value; 1728 1729 /* 1730 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1731 * pmu_op_finish calls when loading saved state for a migration. Because 1732 * we're potentially updating the type of event here, the value written to 1733 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a 1734 * different counter type. Therefore, we need to set this value to the 1735 * current count for the counter type we're writing so that pmu_op_finish 1736 * has the correct count for its calculation. 1737 */ 1738 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1739 if (event_supported(event)) { 1740 uint16_t event_idx = supported_event_map[event]; 1741 env->cp15.c14_pmevcntr_delta[counter] = 1742 pm_events[event_idx].get_count(env); 1743 } 1744 } 1745 1746 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1747 { 1748 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1749 return pmevtyper_read(env, ri, counter); 1750 } 1751 1752 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1753 uint64_t value) 1754 { 1755 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1756 } 1757 1758 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1759 { 1760 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1761 } 1762 1763 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1764 uint64_t value, uint8_t counter) 1765 { 1766 if (counter < pmu_num_counters(env)) { 1767 pmevcntr_op_start(env, counter); 1768 env->cp15.c14_pmevcntr[counter] = value; 1769 pmevcntr_op_finish(env, counter); 1770 } 1771 /* 1772 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1773 * are CONSTRAINED UNPREDICTABLE. 1774 */ 1775 } 1776 1777 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1778 uint8_t counter) 1779 { 1780 if (counter < pmu_num_counters(env)) { 1781 uint64_t ret; 1782 pmevcntr_op_start(env, counter); 1783 ret = env->cp15.c14_pmevcntr[counter]; 1784 pmevcntr_op_finish(env, counter); 1785 return ret; 1786 } else { 1787 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1788 * are CONSTRAINED UNPREDICTABLE. */ 1789 return 0; 1790 } 1791 } 1792 1793 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1794 uint64_t value) 1795 { 1796 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1797 pmevcntr_write(env, ri, value, counter); 1798 } 1799 1800 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1801 { 1802 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1803 return pmevcntr_read(env, ri, counter); 1804 } 1805 1806 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1807 uint64_t value) 1808 { 1809 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1810 assert(counter < pmu_num_counters(env)); 1811 env->cp15.c14_pmevcntr[counter] = value; 1812 pmevcntr_write(env, ri, value, counter); 1813 } 1814 1815 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1816 { 1817 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1818 assert(counter < pmu_num_counters(env)); 1819 return env->cp15.c14_pmevcntr[counter]; 1820 } 1821 1822 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1823 uint64_t value) 1824 { 1825 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1826 } 1827 1828 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1829 { 1830 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1831 } 1832 1833 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1834 uint64_t value) 1835 { 1836 if (arm_feature(env, ARM_FEATURE_V8)) { 1837 env->cp15.c9_pmuserenr = value & 0xf; 1838 } else { 1839 env->cp15.c9_pmuserenr = value & 1; 1840 } 1841 } 1842 1843 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1844 uint64_t value) 1845 { 1846 /* We have no event counters so only the C bit can be changed */ 1847 value &= pmu_counter_mask(env); 1848 env->cp15.c9_pminten |= value; 1849 pmu_update_irq(env); 1850 } 1851 1852 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1853 uint64_t value) 1854 { 1855 value &= pmu_counter_mask(env); 1856 env->cp15.c9_pminten &= ~value; 1857 pmu_update_irq(env); 1858 } 1859 1860 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1861 uint64_t value) 1862 { 1863 /* Note that even though the AArch64 view of this register has bits 1864 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1865 * architectural requirements for bits which are RES0 only in some 1866 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1867 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1868 */ 1869 raw_write(env, ri, value & ~0x1FULL); 1870 } 1871 1872 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1873 { 1874 /* Begin with base v8.0 state. */ 1875 uint32_t valid_mask = 0x3fff; 1876 ARMCPU *cpu = env_archcpu(env); 1877 1878 if (arm_el_is_aa64(env, 3)) { 1879 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */ 1880 valid_mask &= ~SCR_NET; 1881 } else { 1882 valid_mask &= ~(SCR_RW | SCR_ST); 1883 } 1884 1885 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1886 valid_mask &= ~SCR_HCE; 1887 1888 /* On ARMv7, SMD (or SCD as it is called in v7) is only 1889 * supported if EL2 exists. The bit is UNK/SBZP when 1890 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1891 * when EL2 is unavailable. 1892 * On ARMv8, this bit is always available. 1893 */ 1894 if (arm_feature(env, ARM_FEATURE_V7) && 1895 !arm_feature(env, ARM_FEATURE_V8)) { 1896 valid_mask &= ~SCR_SMD; 1897 } 1898 } 1899 if (cpu_isar_feature(aa64_lor, cpu)) { 1900 valid_mask |= SCR_TLOR; 1901 } 1902 if (cpu_isar_feature(aa64_pauth, cpu)) { 1903 valid_mask |= SCR_API | SCR_APK; 1904 } 1905 1906 /* Clear all-context RES0 bits. */ 1907 value &= valid_mask; 1908 raw_write(env, ri, value); 1909 } 1910 1911 static CPAccessResult access_aa64_tid2(CPUARMState *env, 1912 const ARMCPRegInfo *ri, 1913 bool isread) 1914 { 1915 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID2)) { 1916 return CP_ACCESS_TRAP_EL2; 1917 } 1918 1919 return CP_ACCESS_OK; 1920 } 1921 1922 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1923 { 1924 ARMCPU *cpu = env_archcpu(env); 1925 1926 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR 1927 * bank 1928 */ 1929 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1930 ri->secure & ARM_CP_SECSTATE_S); 1931 1932 return cpu->ccsidr[index]; 1933 } 1934 1935 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1936 uint64_t value) 1937 { 1938 raw_write(env, ri, value & 0xf); 1939 } 1940 1941 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1942 { 1943 CPUState *cs = env_cpu(env); 1944 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 1945 uint64_t ret = 0; 1946 bool allow_virt = (arm_current_el(env) == 1 && 1947 (!arm_is_secure_below_el3(env) || 1948 (env->cp15.scr_el3 & SCR_EEL2))); 1949 1950 if (allow_virt && (hcr_el2 & HCR_IMO)) { 1951 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1952 ret |= CPSR_I; 1953 } 1954 } else { 1955 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1956 ret |= CPSR_I; 1957 } 1958 } 1959 1960 if (allow_virt && (hcr_el2 & HCR_FMO)) { 1961 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1962 ret |= CPSR_F; 1963 } 1964 } else { 1965 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1966 ret |= CPSR_F; 1967 } 1968 } 1969 1970 /* External aborts are not possible in QEMU so A bit is always clear */ 1971 return ret; 1972 } 1973 1974 static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 1975 bool isread) 1976 { 1977 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) { 1978 return CP_ACCESS_TRAP_EL2; 1979 } 1980 1981 return CP_ACCESS_OK; 1982 } 1983 1984 static CPAccessResult access_aa32_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 1985 bool isread) 1986 { 1987 if (arm_feature(env, ARM_FEATURE_V8)) { 1988 return access_aa64_tid1(env, ri, isread); 1989 } 1990 1991 return CP_ACCESS_OK; 1992 } 1993 1994 static const ARMCPRegInfo v7_cp_reginfo[] = { 1995 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 1996 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 1997 .access = PL1_W, .type = ARM_CP_NOP }, 1998 /* Performance monitors are implementation defined in v7, 1999 * but with an ARM recommended set of registers, which we 2000 * follow. 2001 * 2002 * Performance registers fall into three categories: 2003 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 2004 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 2005 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 2006 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 2007 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 2008 */ 2009 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 2010 .access = PL0_RW, .type = ARM_CP_ALIAS, 2011 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 2012 .writefn = pmcntenset_write, 2013 .accessfn = pmreg_access, 2014 .raw_writefn = raw_write }, 2015 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, 2016 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 2017 .access = PL0_RW, .accessfn = pmreg_access, 2018 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 2019 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 2020 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 2021 .access = PL0_RW, 2022 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 2023 .accessfn = pmreg_access, 2024 .writefn = pmcntenclr_write, 2025 .type = ARM_CP_ALIAS }, 2026 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 2027 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 2028 .access = PL0_RW, .accessfn = pmreg_access, 2029 .type = ARM_CP_ALIAS, 2030 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 2031 .writefn = pmcntenclr_write }, 2032 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 2033 .access = PL0_RW, .type = ARM_CP_IO, 2034 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2035 .accessfn = pmreg_access, 2036 .writefn = pmovsr_write, 2037 .raw_writefn = raw_write }, 2038 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 2039 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 2040 .access = PL0_RW, .accessfn = pmreg_access, 2041 .type = ARM_CP_ALIAS | ARM_CP_IO, 2042 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2043 .writefn = pmovsr_write, 2044 .raw_writefn = raw_write }, 2045 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 2046 .access = PL0_W, .accessfn = pmreg_access_swinc, 2047 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2048 .writefn = pmswinc_write }, 2049 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 2050 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 2051 .access = PL0_W, .accessfn = pmreg_access_swinc, 2052 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2053 .writefn = pmswinc_write }, 2054 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 2055 .access = PL0_RW, .type = ARM_CP_ALIAS, 2056 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 2057 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 2058 .raw_writefn = raw_write}, 2059 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 2060 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 2061 .access = PL0_RW, .accessfn = pmreg_access_selr, 2062 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 2063 .writefn = pmselr_write, .raw_writefn = raw_write, }, 2064 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 2065 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 2066 .readfn = pmccntr_read, .writefn = pmccntr_write32, 2067 .accessfn = pmreg_access_ccntr }, 2068 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 2069 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 2070 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 2071 .type = ARM_CP_IO, 2072 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 2073 .readfn = pmccntr_read, .writefn = pmccntr_write, 2074 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 2075 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 2076 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 2077 .access = PL0_RW, .accessfn = pmreg_access, 2078 .type = ARM_CP_ALIAS | ARM_CP_IO, 2079 .resetvalue = 0, }, 2080 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 2081 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 2082 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 2083 .access = PL0_RW, .accessfn = pmreg_access, 2084 .type = ARM_CP_IO, 2085 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 2086 .resetvalue = 0, }, 2087 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 2088 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2089 .accessfn = pmreg_access, 2090 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2091 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 2092 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 2093 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2094 .accessfn = pmreg_access, 2095 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2096 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 2097 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2098 .accessfn = pmreg_access_xevcntr, 2099 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2100 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 2101 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 2102 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2103 .accessfn = pmreg_access_xevcntr, 2104 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2105 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2106 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2107 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2108 .resetvalue = 0, 2109 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2110 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2111 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2112 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2113 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2114 .resetvalue = 0, 2115 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2116 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2117 .access = PL1_RW, .accessfn = access_tpm, 2118 .type = ARM_CP_ALIAS | ARM_CP_IO, 2119 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2120 .resetvalue = 0, 2121 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2122 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2123 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2124 .access = PL1_RW, .accessfn = access_tpm, 2125 .type = ARM_CP_IO, 2126 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2127 .writefn = pmintenset_write, .raw_writefn = raw_write, 2128 .resetvalue = 0x0 }, 2129 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2130 .access = PL1_RW, .accessfn = access_tpm, 2131 .type = ARM_CP_ALIAS | ARM_CP_IO, 2132 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2133 .writefn = pmintenclr_write, }, 2134 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2135 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2136 .access = PL1_RW, .accessfn = access_tpm, 2137 .type = ARM_CP_ALIAS | ARM_CP_IO, 2138 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2139 .writefn = pmintenclr_write }, 2140 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2141 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2142 .access = PL1_R, 2143 .accessfn = access_aa64_tid2, 2144 .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2145 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2146 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2147 .access = PL1_RW, 2148 .accessfn = access_aa64_tid2, 2149 .writefn = csselr_write, .resetvalue = 0, 2150 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2151 offsetof(CPUARMState, cp15.csselr_ns) } }, 2152 /* Auxiliary ID register: this actually has an IMPDEF value but for now 2153 * just RAZ for all cores: 2154 */ 2155 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2156 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2157 .access = PL1_R, .type = ARM_CP_CONST, 2158 .accessfn = access_aa64_tid1, 2159 .resetvalue = 0 }, 2160 /* Auxiliary fault status registers: these also are IMPDEF, and we 2161 * choose to RAZ/WI for all cores. 2162 */ 2163 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2164 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2165 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2166 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2167 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2168 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2169 /* MAIR can just read-as-written because we don't implement caches 2170 * and so don't need to care about memory attributes. 2171 */ 2172 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2173 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2174 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2175 .resetvalue = 0 }, 2176 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2177 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2178 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2179 .resetvalue = 0 }, 2180 /* For non-long-descriptor page tables these are PRRR and NMRR; 2181 * regardless they still act as reads-as-written for QEMU. 2182 */ 2183 /* MAIR0/1 are defined separately from their 64-bit counterpart which 2184 * allows them to assign the correct fieldoffset based on the endianness 2185 * handled in the field definitions. 2186 */ 2187 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2188 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW, 2189 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2190 offsetof(CPUARMState, cp15.mair0_ns) }, 2191 .resetfn = arm_cp_reset_ignore }, 2192 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2193 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW, 2194 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2195 offsetof(CPUARMState, cp15.mair1_ns) }, 2196 .resetfn = arm_cp_reset_ignore }, 2197 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2198 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2199 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2200 /* 32 bit ITLB invalidates */ 2201 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2202 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2203 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2204 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2205 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2206 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2207 /* 32 bit DTLB invalidates */ 2208 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2209 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2210 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2211 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2212 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2213 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2214 /* 32 bit TLB invalidates */ 2215 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2216 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2217 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2218 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2219 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2220 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2221 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2222 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 2223 REGINFO_SENTINEL 2224 }; 2225 2226 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2227 /* 32 bit TLB invalidates, Inner Shareable */ 2228 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2229 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write }, 2230 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2231 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 2232 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2233 .type = ARM_CP_NO_RAW, .access = PL1_W, 2234 .writefn = tlbiasid_is_write }, 2235 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2236 .type = ARM_CP_NO_RAW, .access = PL1_W, 2237 .writefn = tlbimvaa_is_write }, 2238 REGINFO_SENTINEL 2239 }; 2240 2241 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2242 /* PMOVSSET is not implemented in v7 before v7ve */ 2243 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2244 .access = PL0_RW, .accessfn = pmreg_access, 2245 .type = ARM_CP_ALIAS | ARM_CP_IO, 2246 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2247 .writefn = pmovsset_write, 2248 .raw_writefn = raw_write }, 2249 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2250 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2251 .access = PL0_RW, .accessfn = pmreg_access, 2252 .type = ARM_CP_ALIAS | ARM_CP_IO, 2253 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2254 .writefn = pmovsset_write, 2255 .raw_writefn = raw_write }, 2256 REGINFO_SENTINEL 2257 }; 2258 2259 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2260 uint64_t value) 2261 { 2262 value &= 1; 2263 env->teecr = value; 2264 } 2265 2266 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2267 bool isread) 2268 { 2269 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2270 return CP_ACCESS_TRAP; 2271 } 2272 return CP_ACCESS_OK; 2273 } 2274 2275 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2276 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2277 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2278 .resetvalue = 0, 2279 .writefn = teecr_write }, 2280 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2281 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2282 .accessfn = teehbr_access, .resetvalue = 0 }, 2283 REGINFO_SENTINEL 2284 }; 2285 2286 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2287 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2288 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2289 .access = PL0_RW, 2290 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2291 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2292 .access = PL0_RW, 2293 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2294 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2295 .resetfn = arm_cp_reset_ignore }, 2296 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2297 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2298 .access = PL0_R|PL1_W, 2299 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2300 .resetvalue = 0}, 2301 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2302 .access = PL0_R|PL1_W, 2303 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2304 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2305 .resetfn = arm_cp_reset_ignore }, 2306 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2307 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2308 .access = PL1_RW, 2309 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2310 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2311 .access = PL1_RW, 2312 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2313 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2314 .resetvalue = 0 }, 2315 REGINFO_SENTINEL 2316 }; 2317 2318 #ifndef CONFIG_USER_ONLY 2319 2320 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2321 bool isread) 2322 { 2323 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2324 * Writable only at the highest implemented exception level. 2325 */ 2326 int el = arm_current_el(env); 2327 uint64_t hcr; 2328 uint32_t cntkctl; 2329 2330 switch (el) { 2331 case 0: 2332 hcr = arm_hcr_el2_eff(env); 2333 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2334 cntkctl = env->cp15.cnthctl_el2; 2335 } else { 2336 cntkctl = env->cp15.c14_cntkctl; 2337 } 2338 if (!extract32(cntkctl, 0, 2)) { 2339 return CP_ACCESS_TRAP; 2340 } 2341 break; 2342 case 1: 2343 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2344 arm_is_secure_below_el3(env)) { 2345 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2346 return CP_ACCESS_TRAP_UNCATEGORIZED; 2347 } 2348 break; 2349 case 2: 2350 case 3: 2351 break; 2352 } 2353 2354 if (!isread && el < arm_highest_el(env)) { 2355 return CP_ACCESS_TRAP_UNCATEGORIZED; 2356 } 2357 2358 return CP_ACCESS_OK; 2359 } 2360 2361 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2362 bool isread) 2363 { 2364 unsigned int cur_el = arm_current_el(env); 2365 bool secure = arm_is_secure(env); 2366 uint64_t hcr = arm_hcr_el2_eff(env); 2367 2368 switch (cur_el) { 2369 case 0: 2370 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]CTEN. */ 2371 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2372 return (extract32(env->cp15.cnthctl_el2, timeridx, 1) 2373 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2374 } 2375 2376 /* CNT[PV]CT: not visible from PL0 if EL0[PV]CTEN is zero */ 2377 if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2378 return CP_ACCESS_TRAP; 2379 } 2380 2381 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PCTEN. */ 2382 if (hcr & HCR_E2H) { 2383 if (timeridx == GTIMER_PHYS && 2384 !extract32(env->cp15.cnthctl_el2, 10, 1)) { 2385 return CP_ACCESS_TRAP_EL2; 2386 } 2387 } else { 2388 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ 2389 if (arm_feature(env, ARM_FEATURE_EL2) && 2390 timeridx == GTIMER_PHYS && !secure && 2391 !extract32(env->cp15.cnthctl_el2, 1, 1)) { 2392 return CP_ACCESS_TRAP_EL2; 2393 } 2394 } 2395 break; 2396 2397 case 1: 2398 /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */ 2399 if (arm_feature(env, ARM_FEATURE_EL2) && 2400 timeridx == GTIMER_PHYS && !secure && 2401 (hcr & HCR_E2H 2402 ? !extract32(env->cp15.cnthctl_el2, 10, 1) 2403 : !extract32(env->cp15.cnthctl_el2, 0, 1))) { 2404 return CP_ACCESS_TRAP_EL2; 2405 } 2406 break; 2407 } 2408 return CP_ACCESS_OK; 2409 } 2410 2411 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2412 bool isread) 2413 { 2414 unsigned int cur_el = arm_current_el(env); 2415 bool secure = arm_is_secure(env); 2416 uint64_t hcr = arm_hcr_el2_eff(env); 2417 2418 switch (cur_el) { 2419 case 0: 2420 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2421 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]TEN. */ 2422 return (extract32(env->cp15.cnthctl_el2, 9 - timeridx, 1) 2423 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2424 } 2425 2426 /* 2427 * CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from 2428 * EL0 if EL0[PV]TEN is zero. 2429 */ 2430 if (!extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2431 return CP_ACCESS_TRAP; 2432 } 2433 /* fall through */ 2434 2435 case 1: 2436 if (arm_feature(env, ARM_FEATURE_EL2) && 2437 timeridx == GTIMER_PHYS && !secure) { 2438 if (hcr & HCR_E2H) { 2439 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */ 2440 if (!extract32(env->cp15.cnthctl_el2, 11, 1)) { 2441 return CP_ACCESS_TRAP_EL2; 2442 } 2443 } else { 2444 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ 2445 if (!extract32(env->cp15.cnthctl_el2, 1, 1)) { 2446 return CP_ACCESS_TRAP_EL2; 2447 } 2448 } 2449 } 2450 break; 2451 } 2452 return CP_ACCESS_OK; 2453 } 2454 2455 static CPAccessResult gt_pct_access(CPUARMState *env, 2456 const ARMCPRegInfo *ri, 2457 bool isread) 2458 { 2459 return gt_counter_access(env, GTIMER_PHYS, isread); 2460 } 2461 2462 static CPAccessResult gt_vct_access(CPUARMState *env, 2463 const ARMCPRegInfo *ri, 2464 bool isread) 2465 { 2466 return gt_counter_access(env, GTIMER_VIRT, isread); 2467 } 2468 2469 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2470 bool isread) 2471 { 2472 return gt_timer_access(env, GTIMER_PHYS, isread); 2473 } 2474 2475 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2476 bool isread) 2477 { 2478 return gt_timer_access(env, GTIMER_VIRT, isread); 2479 } 2480 2481 static CPAccessResult gt_stimer_access(CPUARMState *env, 2482 const ARMCPRegInfo *ri, 2483 bool isread) 2484 { 2485 /* The AArch64 register view of the secure physical timer is 2486 * always accessible from EL3, and configurably accessible from 2487 * Secure EL1. 2488 */ 2489 switch (arm_current_el(env)) { 2490 case 1: 2491 if (!arm_is_secure(env)) { 2492 return CP_ACCESS_TRAP; 2493 } 2494 if (!(env->cp15.scr_el3 & SCR_ST)) { 2495 return CP_ACCESS_TRAP_EL3; 2496 } 2497 return CP_ACCESS_OK; 2498 case 0: 2499 case 2: 2500 return CP_ACCESS_TRAP; 2501 case 3: 2502 return CP_ACCESS_OK; 2503 default: 2504 g_assert_not_reached(); 2505 } 2506 } 2507 2508 static uint64_t gt_get_countervalue(CPUARMState *env) 2509 { 2510 ARMCPU *cpu = env_archcpu(env); 2511 2512 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu); 2513 } 2514 2515 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2516 { 2517 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2518 2519 if (gt->ctl & 1) { 2520 /* Timer enabled: calculate and set current ISTATUS, irq, and 2521 * reset timer to when ISTATUS next has to change 2522 */ 2523 uint64_t offset = timeridx == GTIMER_VIRT ? 2524 cpu->env.cp15.cntvoff_el2 : 0; 2525 uint64_t count = gt_get_countervalue(&cpu->env); 2526 /* Note that this must be unsigned 64 bit arithmetic: */ 2527 int istatus = count - offset >= gt->cval; 2528 uint64_t nexttick; 2529 int irqstate; 2530 2531 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2532 2533 irqstate = (istatus && !(gt->ctl & 2)); 2534 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2535 2536 if (istatus) { 2537 /* Next transition is when count rolls back over to zero */ 2538 nexttick = UINT64_MAX; 2539 } else { 2540 /* Next transition is when we hit cval */ 2541 nexttick = gt->cval + offset; 2542 } 2543 /* Note that the desired next expiry time might be beyond the 2544 * signed-64-bit range of a QEMUTimer -- in this case we just 2545 * set the timer for as far in the future as possible. When the 2546 * timer expires we will reset the timer for any remaining period. 2547 */ 2548 if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { 2549 timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX); 2550 } else { 2551 timer_mod(cpu->gt_timer[timeridx], nexttick); 2552 } 2553 trace_arm_gt_recalc(timeridx, irqstate, nexttick); 2554 } else { 2555 /* Timer disabled: ISTATUS and timer output always clear */ 2556 gt->ctl &= ~4; 2557 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0); 2558 timer_del(cpu->gt_timer[timeridx]); 2559 trace_arm_gt_recalc_disabled(timeridx); 2560 } 2561 } 2562 2563 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2564 int timeridx) 2565 { 2566 ARMCPU *cpu = env_archcpu(env); 2567 2568 timer_del(cpu->gt_timer[timeridx]); 2569 } 2570 2571 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2572 { 2573 return gt_get_countervalue(env); 2574 } 2575 2576 static uint64_t gt_virt_cnt_offset(CPUARMState *env) 2577 { 2578 uint64_t hcr; 2579 2580 switch (arm_current_el(env)) { 2581 case 2: 2582 hcr = arm_hcr_el2_eff(env); 2583 if (hcr & HCR_E2H) { 2584 return 0; 2585 } 2586 break; 2587 case 0: 2588 hcr = arm_hcr_el2_eff(env); 2589 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2590 return 0; 2591 } 2592 break; 2593 } 2594 2595 return env->cp15.cntvoff_el2; 2596 } 2597 2598 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2599 { 2600 return gt_get_countervalue(env) - gt_virt_cnt_offset(env); 2601 } 2602 2603 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2604 int timeridx, 2605 uint64_t value) 2606 { 2607 trace_arm_gt_cval_write(timeridx, value); 2608 env->cp15.c14_timer[timeridx].cval = value; 2609 gt_recalc_timer(env_archcpu(env), timeridx); 2610 } 2611 2612 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2613 int timeridx) 2614 { 2615 uint64_t offset = 0; 2616 2617 switch (timeridx) { 2618 case GTIMER_VIRT: 2619 case GTIMER_HYPVIRT: 2620 offset = gt_virt_cnt_offset(env); 2621 break; 2622 } 2623 2624 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2625 (gt_get_countervalue(env) - offset)); 2626 } 2627 2628 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2629 int timeridx, 2630 uint64_t value) 2631 { 2632 uint64_t offset = 0; 2633 2634 switch (timeridx) { 2635 case GTIMER_VIRT: 2636 case GTIMER_HYPVIRT: 2637 offset = gt_virt_cnt_offset(env); 2638 break; 2639 } 2640 2641 trace_arm_gt_tval_write(timeridx, value); 2642 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2643 sextract64(value, 0, 32); 2644 gt_recalc_timer(env_archcpu(env), timeridx); 2645 } 2646 2647 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2648 int timeridx, 2649 uint64_t value) 2650 { 2651 ARMCPU *cpu = env_archcpu(env); 2652 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2653 2654 trace_arm_gt_ctl_write(timeridx, value); 2655 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2656 if ((oldval ^ value) & 1) { 2657 /* Enable toggled */ 2658 gt_recalc_timer(cpu, timeridx); 2659 } else if ((oldval ^ value) & 2) { 2660 /* IMASK toggled: don't need to recalculate, 2661 * just set the interrupt line based on ISTATUS 2662 */ 2663 int irqstate = (oldval & 4) && !(value & 2); 2664 2665 trace_arm_gt_imask_toggle(timeridx, irqstate); 2666 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2667 } 2668 } 2669 2670 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2671 { 2672 gt_timer_reset(env, ri, GTIMER_PHYS); 2673 } 2674 2675 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2676 uint64_t value) 2677 { 2678 gt_cval_write(env, ri, GTIMER_PHYS, value); 2679 } 2680 2681 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2682 { 2683 return gt_tval_read(env, ri, GTIMER_PHYS); 2684 } 2685 2686 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2687 uint64_t value) 2688 { 2689 gt_tval_write(env, ri, GTIMER_PHYS, value); 2690 } 2691 2692 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2693 uint64_t value) 2694 { 2695 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2696 } 2697 2698 static int gt_phys_redir_timeridx(CPUARMState *env) 2699 { 2700 switch (arm_mmu_idx(env)) { 2701 case ARMMMUIdx_E20_0: 2702 case ARMMMUIdx_E20_2: 2703 return GTIMER_HYP; 2704 default: 2705 return GTIMER_PHYS; 2706 } 2707 } 2708 2709 static int gt_virt_redir_timeridx(CPUARMState *env) 2710 { 2711 switch (arm_mmu_idx(env)) { 2712 case ARMMMUIdx_E20_0: 2713 case ARMMMUIdx_E20_2: 2714 return GTIMER_HYPVIRT; 2715 default: 2716 return GTIMER_VIRT; 2717 } 2718 } 2719 2720 static uint64_t gt_phys_redir_cval_read(CPUARMState *env, 2721 const ARMCPRegInfo *ri) 2722 { 2723 int timeridx = gt_phys_redir_timeridx(env); 2724 return env->cp15.c14_timer[timeridx].cval; 2725 } 2726 2727 static void gt_phys_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2728 uint64_t value) 2729 { 2730 int timeridx = gt_phys_redir_timeridx(env); 2731 gt_cval_write(env, ri, timeridx, value); 2732 } 2733 2734 static uint64_t gt_phys_redir_tval_read(CPUARMState *env, 2735 const ARMCPRegInfo *ri) 2736 { 2737 int timeridx = gt_phys_redir_timeridx(env); 2738 return gt_tval_read(env, ri, timeridx); 2739 } 2740 2741 static void gt_phys_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2742 uint64_t value) 2743 { 2744 int timeridx = gt_phys_redir_timeridx(env); 2745 gt_tval_write(env, ri, timeridx, value); 2746 } 2747 2748 static uint64_t gt_phys_redir_ctl_read(CPUARMState *env, 2749 const ARMCPRegInfo *ri) 2750 { 2751 int timeridx = gt_phys_redir_timeridx(env); 2752 return env->cp15.c14_timer[timeridx].ctl; 2753 } 2754 2755 static void gt_phys_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2756 uint64_t value) 2757 { 2758 int timeridx = gt_phys_redir_timeridx(env); 2759 gt_ctl_write(env, ri, timeridx, value); 2760 } 2761 2762 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2763 { 2764 gt_timer_reset(env, ri, GTIMER_VIRT); 2765 } 2766 2767 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2768 uint64_t value) 2769 { 2770 gt_cval_write(env, ri, GTIMER_VIRT, value); 2771 } 2772 2773 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2774 { 2775 return gt_tval_read(env, ri, GTIMER_VIRT); 2776 } 2777 2778 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2779 uint64_t value) 2780 { 2781 gt_tval_write(env, ri, GTIMER_VIRT, value); 2782 } 2783 2784 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2785 uint64_t value) 2786 { 2787 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2788 } 2789 2790 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2791 uint64_t value) 2792 { 2793 ARMCPU *cpu = env_archcpu(env); 2794 2795 trace_arm_gt_cntvoff_write(value); 2796 raw_write(env, ri, value); 2797 gt_recalc_timer(cpu, GTIMER_VIRT); 2798 } 2799 2800 static uint64_t gt_virt_redir_cval_read(CPUARMState *env, 2801 const ARMCPRegInfo *ri) 2802 { 2803 int timeridx = gt_virt_redir_timeridx(env); 2804 return env->cp15.c14_timer[timeridx].cval; 2805 } 2806 2807 static void gt_virt_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2808 uint64_t value) 2809 { 2810 int timeridx = gt_virt_redir_timeridx(env); 2811 gt_cval_write(env, ri, timeridx, value); 2812 } 2813 2814 static uint64_t gt_virt_redir_tval_read(CPUARMState *env, 2815 const ARMCPRegInfo *ri) 2816 { 2817 int timeridx = gt_virt_redir_timeridx(env); 2818 return gt_tval_read(env, ri, timeridx); 2819 } 2820 2821 static void gt_virt_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2822 uint64_t value) 2823 { 2824 int timeridx = gt_virt_redir_timeridx(env); 2825 gt_tval_write(env, ri, timeridx, value); 2826 } 2827 2828 static uint64_t gt_virt_redir_ctl_read(CPUARMState *env, 2829 const ARMCPRegInfo *ri) 2830 { 2831 int timeridx = gt_virt_redir_timeridx(env); 2832 return env->cp15.c14_timer[timeridx].ctl; 2833 } 2834 2835 static void gt_virt_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2836 uint64_t value) 2837 { 2838 int timeridx = gt_virt_redir_timeridx(env); 2839 gt_ctl_write(env, ri, timeridx, value); 2840 } 2841 2842 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2843 { 2844 gt_timer_reset(env, ri, GTIMER_HYP); 2845 } 2846 2847 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2848 uint64_t value) 2849 { 2850 gt_cval_write(env, ri, GTIMER_HYP, value); 2851 } 2852 2853 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2854 { 2855 return gt_tval_read(env, ri, GTIMER_HYP); 2856 } 2857 2858 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2859 uint64_t value) 2860 { 2861 gt_tval_write(env, ri, GTIMER_HYP, value); 2862 } 2863 2864 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2865 uint64_t value) 2866 { 2867 gt_ctl_write(env, ri, GTIMER_HYP, value); 2868 } 2869 2870 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2871 { 2872 gt_timer_reset(env, ri, GTIMER_SEC); 2873 } 2874 2875 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2876 uint64_t value) 2877 { 2878 gt_cval_write(env, ri, GTIMER_SEC, value); 2879 } 2880 2881 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2882 { 2883 return gt_tval_read(env, ri, GTIMER_SEC); 2884 } 2885 2886 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2887 uint64_t value) 2888 { 2889 gt_tval_write(env, ri, GTIMER_SEC, value); 2890 } 2891 2892 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2893 uint64_t value) 2894 { 2895 gt_ctl_write(env, ri, GTIMER_SEC, value); 2896 } 2897 2898 static void gt_hv_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2899 { 2900 gt_timer_reset(env, ri, GTIMER_HYPVIRT); 2901 } 2902 2903 static void gt_hv_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2904 uint64_t value) 2905 { 2906 gt_cval_write(env, ri, GTIMER_HYPVIRT, value); 2907 } 2908 2909 static uint64_t gt_hv_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2910 { 2911 return gt_tval_read(env, ri, GTIMER_HYPVIRT); 2912 } 2913 2914 static void gt_hv_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2915 uint64_t value) 2916 { 2917 gt_tval_write(env, ri, GTIMER_HYPVIRT, value); 2918 } 2919 2920 static void gt_hv_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2921 uint64_t value) 2922 { 2923 gt_ctl_write(env, ri, GTIMER_HYPVIRT, value); 2924 } 2925 2926 void arm_gt_ptimer_cb(void *opaque) 2927 { 2928 ARMCPU *cpu = opaque; 2929 2930 gt_recalc_timer(cpu, GTIMER_PHYS); 2931 } 2932 2933 void arm_gt_vtimer_cb(void *opaque) 2934 { 2935 ARMCPU *cpu = opaque; 2936 2937 gt_recalc_timer(cpu, GTIMER_VIRT); 2938 } 2939 2940 void arm_gt_htimer_cb(void *opaque) 2941 { 2942 ARMCPU *cpu = opaque; 2943 2944 gt_recalc_timer(cpu, GTIMER_HYP); 2945 } 2946 2947 void arm_gt_stimer_cb(void *opaque) 2948 { 2949 ARMCPU *cpu = opaque; 2950 2951 gt_recalc_timer(cpu, GTIMER_SEC); 2952 } 2953 2954 void arm_gt_hvtimer_cb(void *opaque) 2955 { 2956 ARMCPU *cpu = opaque; 2957 2958 gt_recalc_timer(cpu, GTIMER_HYPVIRT); 2959 } 2960 2961 static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque) 2962 { 2963 ARMCPU *cpu = env_archcpu(env); 2964 2965 cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz; 2966 } 2967 2968 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2969 /* Note that CNTFRQ is purely reads-as-written for the benefit 2970 * of software; writing it doesn't actually change the timer frequency. 2971 * Our reset value matches the fixed frequency we implement the timer at. 2972 */ 2973 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 2974 .type = ARM_CP_ALIAS, 2975 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2976 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 2977 }, 2978 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2979 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2980 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2981 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2982 .resetfn = arm_gt_cntfrq_reset, 2983 }, 2984 /* overall control: mostly access permissions */ 2985 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 2986 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 2987 .access = PL1_RW, 2988 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 2989 .resetvalue = 0, 2990 }, 2991 /* per-timer control */ 2992 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2993 .secure = ARM_CP_SECSTATE_NS, 2994 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2995 .accessfn = gt_ptimer_access, 2996 .fieldoffset = offsetoflow32(CPUARMState, 2997 cp15.c14_timer[GTIMER_PHYS].ctl), 2998 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 2999 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3000 }, 3001 { .name = "CNTP_CTL_S", 3002 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 3003 .secure = ARM_CP_SECSTATE_S, 3004 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3005 .accessfn = gt_ptimer_access, 3006 .fieldoffset = offsetoflow32(CPUARMState, 3007 cp15.c14_timer[GTIMER_SEC].ctl), 3008 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3009 }, 3010 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 3011 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 3012 .type = ARM_CP_IO, .access = PL0_RW, 3013 .accessfn = gt_ptimer_access, 3014 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 3015 .resetvalue = 0, 3016 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3017 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3018 }, 3019 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 3020 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3021 .accessfn = gt_vtimer_access, 3022 .fieldoffset = offsetoflow32(CPUARMState, 3023 cp15.c14_timer[GTIMER_VIRT].ctl), 3024 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3025 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3026 }, 3027 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 3028 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 3029 .type = ARM_CP_IO, .access = PL0_RW, 3030 .accessfn = gt_vtimer_access, 3031 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 3032 .resetvalue = 0, 3033 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3034 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3035 }, 3036 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 3037 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3038 .secure = ARM_CP_SECSTATE_NS, 3039 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3040 .accessfn = gt_ptimer_access, 3041 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3042 }, 3043 { .name = "CNTP_TVAL_S", 3044 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3045 .secure = ARM_CP_SECSTATE_S, 3046 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3047 .accessfn = gt_ptimer_access, 3048 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 3049 }, 3050 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3051 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 3052 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3053 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 3054 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3055 }, 3056 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 3057 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3058 .accessfn = gt_vtimer_access, 3059 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3060 }, 3061 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3062 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 3063 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3064 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 3065 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3066 }, 3067 /* The counter itself */ 3068 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 3069 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3070 .accessfn = gt_pct_access, 3071 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 3072 }, 3073 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 3074 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 3075 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3076 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 3077 }, 3078 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 3079 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3080 .accessfn = gt_vct_access, 3081 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 3082 }, 3083 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3084 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3085 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3086 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 3087 }, 3088 /* Comparison value, indicating when the timer goes off */ 3089 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 3090 .secure = ARM_CP_SECSTATE_NS, 3091 .access = PL0_RW, 3092 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3093 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3094 .accessfn = gt_ptimer_access, 3095 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3096 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3097 }, 3098 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 3099 .secure = ARM_CP_SECSTATE_S, 3100 .access = PL0_RW, 3101 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3102 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3103 .accessfn = gt_ptimer_access, 3104 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3105 }, 3106 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3107 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 3108 .access = PL0_RW, 3109 .type = ARM_CP_IO, 3110 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3111 .resetvalue = 0, .accessfn = gt_ptimer_access, 3112 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3113 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3114 }, 3115 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 3116 .access = PL0_RW, 3117 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3118 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3119 .accessfn = gt_vtimer_access, 3120 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3121 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3122 }, 3123 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3124 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 3125 .access = PL0_RW, 3126 .type = ARM_CP_IO, 3127 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3128 .resetvalue = 0, .accessfn = gt_vtimer_access, 3129 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3130 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3131 }, 3132 /* Secure timer -- this is actually restricted to only EL3 3133 * and configurably Secure-EL1 via the accessfn. 3134 */ 3135 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 3136 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 3137 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 3138 .accessfn = gt_stimer_access, 3139 .readfn = gt_sec_tval_read, 3140 .writefn = gt_sec_tval_write, 3141 .resetfn = gt_sec_timer_reset, 3142 }, 3143 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 3144 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 3145 .type = ARM_CP_IO, .access = PL1_RW, 3146 .accessfn = gt_stimer_access, 3147 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 3148 .resetvalue = 0, 3149 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3150 }, 3151 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 3152 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 3153 .type = ARM_CP_IO, .access = PL1_RW, 3154 .accessfn = gt_stimer_access, 3155 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3156 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3157 }, 3158 REGINFO_SENTINEL 3159 }; 3160 3161 static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri, 3162 bool isread) 3163 { 3164 if (!(arm_hcr_el2_eff(env) & HCR_E2H)) { 3165 return CP_ACCESS_TRAP; 3166 } 3167 return CP_ACCESS_OK; 3168 } 3169 3170 #else 3171 3172 /* In user-mode most of the generic timer registers are inaccessible 3173 * however modern kernels (4.12+) allow access to cntvct_el0 3174 */ 3175 3176 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 3177 { 3178 ARMCPU *cpu = env_archcpu(env); 3179 3180 /* Currently we have no support for QEMUTimer in linux-user so we 3181 * can't call gt_get_countervalue(env), instead we directly 3182 * call the lower level functions. 3183 */ 3184 return cpu_get_clock() / gt_cntfrq_period_ns(cpu); 3185 } 3186 3187 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 3188 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 3189 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 3190 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 3191 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 3192 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE, 3193 }, 3194 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3195 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3196 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3197 .readfn = gt_virt_cnt_read, 3198 }, 3199 REGINFO_SENTINEL 3200 }; 3201 3202 #endif 3203 3204 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3205 { 3206 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3207 raw_write(env, ri, value); 3208 } else if (arm_feature(env, ARM_FEATURE_V7)) { 3209 raw_write(env, ri, value & 0xfffff6ff); 3210 } else { 3211 raw_write(env, ri, value & 0xfffff1ff); 3212 } 3213 } 3214 3215 #ifndef CONFIG_USER_ONLY 3216 /* get_phys_addr() isn't present for user-mode-only targets */ 3217 3218 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 3219 bool isread) 3220 { 3221 if (ri->opc2 & 4) { 3222 /* The ATS12NSO* operations must trap to EL3 if executed in 3223 * Secure EL1 (which can only happen if EL3 is AArch64). 3224 * They are simply UNDEF if executed from NS EL1. 3225 * They function normally from EL2 or EL3. 3226 */ 3227 if (arm_current_el(env) == 1) { 3228 if (arm_is_secure_below_el3(env)) { 3229 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3; 3230 } 3231 return CP_ACCESS_TRAP_UNCATEGORIZED; 3232 } 3233 } 3234 return CP_ACCESS_OK; 3235 } 3236 3237 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 3238 MMUAccessType access_type, ARMMMUIdx mmu_idx) 3239 { 3240 hwaddr phys_addr; 3241 target_ulong page_size; 3242 int prot; 3243 bool ret; 3244 uint64_t par64; 3245 bool format64 = false; 3246 MemTxAttrs attrs = {}; 3247 ARMMMUFaultInfo fi = {}; 3248 ARMCacheAttrs cacheattrs = {}; 3249 3250 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs, 3251 &prot, &page_size, &fi, &cacheattrs); 3252 3253 if (ret) { 3254 /* 3255 * Some kinds of translation fault must cause exceptions rather 3256 * than being reported in the PAR. 3257 */ 3258 int current_el = arm_current_el(env); 3259 int target_el; 3260 uint32_t syn, fsr, fsc; 3261 bool take_exc = false; 3262 3263 if (fi.s1ptw && current_el == 1 && !arm_is_secure(env) 3264 && (mmu_idx == ARMMMUIdx_Stage1_E1 || 3265 mmu_idx == ARMMMUIdx_Stage1_E0)) { 3266 /* 3267 * Synchronous stage 2 fault on an access made as part of the 3268 * translation table walk for AT S1E0* or AT S1E1* insn 3269 * executed from NS EL1. If this is a synchronous external abort 3270 * and SCR_EL3.EA == 1, then we take a synchronous external abort 3271 * to EL3. Otherwise the fault is taken as an exception to EL2, 3272 * and HPFAR_EL2 holds the faulting IPA. 3273 */ 3274 if (fi.type == ARMFault_SyncExternalOnWalk && 3275 (env->cp15.scr_el3 & SCR_EA)) { 3276 target_el = 3; 3277 } else { 3278 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4; 3279 target_el = 2; 3280 } 3281 take_exc = true; 3282 } else if (fi.type == ARMFault_SyncExternalOnWalk) { 3283 /* 3284 * Synchronous external aborts during a translation table walk 3285 * are taken as Data Abort exceptions. 3286 */ 3287 if (fi.stage2) { 3288 if (current_el == 3) { 3289 target_el = 3; 3290 } else { 3291 target_el = 2; 3292 } 3293 } else { 3294 target_el = exception_target_el(env); 3295 } 3296 take_exc = true; 3297 } 3298 3299 if (take_exc) { 3300 /* Construct FSR and FSC using same logic as arm_deliver_fault() */ 3301 if (target_el == 2 || arm_el_is_aa64(env, target_el) || 3302 arm_s1_regime_using_lpae_format(env, mmu_idx)) { 3303 fsr = arm_fi_to_lfsc(&fi); 3304 fsc = extract32(fsr, 0, 6); 3305 } else { 3306 fsr = arm_fi_to_sfsc(&fi); 3307 fsc = 0x3f; 3308 } 3309 /* 3310 * Report exception with ESR indicating a fault due to a 3311 * translation table walk for a cache maintenance instruction. 3312 */ 3313 syn = syn_data_abort_no_iss(current_el == target_el, 3314 fi.ea, 1, fi.s1ptw, 1, fsc); 3315 env->exception.vaddress = value; 3316 env->exception.fsr = fsr; 3317 raise_exception(env, EXCP_DATA_ABORT, syn, target_el); 3318 } 3319 } 3320 3321 if (is_a64(env)) { 3322 format64 = true; 3323 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 3324 /* 3325 * ATS1Cxx: 3326 * * TTBCR.EAE determines whether the result is returned using the 3327 * 32-bit or the 64-bit PAR format 3328 * * Instructions executed in Hyp mode always use the 64bit format 3329 * 3330 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 3331 * * The Non-secure TTBCR.EAE bit is set to 1 3332 * * The implementation includes EL2, and the value of HCR.VM is 1 3333 * 3334 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 3335 * 3336 * ATS1Hx always uses the 64bit format. 3337 */ 3338 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 3339 3340 if (arm_feature(env, ARM_FEATURE_EL2)) { 3341 if (mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_E10_1) { 3342 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 3343 } else { 3344 format64 |= arm_current_el(env) == 2; 3345 } 3346 } 3347 } 3348 3349 if (format64) { 3350 /* Create a 64-bit PAR */ 3351 par64 = (1 << 11); /* LPAE bit always set */ 3352 if (!ret) { 3353 par64 |= phys_addr & ~0xfffULL; 3354 if (!attrs.secure) { 3355 par64 |= (1 << 9); /* NS */ 3356 } 3357 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */ 3358 par64 |= cacheattrs.shareability << 7; /* SH */ 3359 } else { 3360 uint32_t fsr = arm_fi_to_lfsc(&fi); 3361 3362 par64 |= 1; /* F */ 3363 par64 |= (fsr & 0x3f) << 1; /* FS */ 3364 if (fi.stage2) { 3365 par64 |= (1 << 9); /* S */ 3366 } 3367 if (fi.s1ptw) { 3368 par64 |= (1 << 8); /* PTW */ 3369 } 3370 } 3371 } else { 3372 /* fsr is a DFSR/IFSR value for the short descriptor 3373 * translation table format (with WnR always clear). 3374 * Convert it to a 32-bit PAR. 3375 */ 3376 if (!ret) { 3377 /* We do not set any attribute bits in the PAR */ 3378 if (page_size == (1 << 24) 3379 && arm_feature(env, ARM_FEATURE_V7)) { 3380 par64 = (phys_addr & 0xff000000) | (1 << 1); 3381 } else { 3382 par64 = phys_addr & 0xfffff000; 3383 } 3384 if (!attrs.secure) { 3385 par64 |= (1 << 9); /* NS */ 3386 } 3387 } else { 3388 uint32_t fsr = arm_fi_to_sfsc(&fi); 3389 3390 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 3391 ((fsr & 0xf) << 1) | 1; 3392 } 3393 } 3394 return par64; 3395 } 3396 3397 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3398 { 3399 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3400 uint64_t par64; 3401 ARMMMUIdx mmu_idx; 3402 int el = arm_current_el(env); 3403 bool secure = arm_is_secure_below_el3(env); 3404 3405 switch (ri->opc2 & 6) { 3406 case 0: 3407 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */ 3408 switch (el) { 3409 case 3: 3410 mmu_idx = ARMMMUIdx_SE3; 3411 break; 3412 case 2: 3413 mmu_idx = ARMMMUIdx_Stage1_E1; 3414 break; 3415 case 1: 3416 mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_Stage1_E1; 3417 break; 3418 default: 3419 g_assert_not_reached(); 3420 } 3421 break; 3422 case 2: 3423 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3424 switch (el) { 3425 case 3: 3426 mmu_idx = ARMMMUIdx_SE10_0; 3427 break; 3428 case 2: 3429 mmu_idx = ARMMMUIdx_Stage1_E0; 3430 break; 3431 case 1: 3432 mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_Stage1_E0; 3433 break; 3434 default: 3435 g_assert_not_reached(); 3436 } 3437 break; 3438 case 4: 3439 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3440 mmu_idx = ARMMMUIdx_E10_1; 3441 break; 3442 case 6: 3443 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3444 mmu_idx = ARMMMUIdx_E10_0; 3445 break; 3446 default: 3447 g_assert_not_reached(); 3448 } 3449 3450 par64 = do_ats_write(env, value, access_type, mmu_idx); 3451 3452 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3453 } 3454 3455 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3456 uint64_t value) 3457 { 3458 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3459 uint64_t par64; 3460 3461 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2); 3462 3463 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3464 } 3465 3466 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3467 bool isread) 3468 { 3469 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) { 3470 return CP_ACCESS_TRAP; 3471 } 3472 return CP_ACCESS_OK; 3473 } 3474 3475 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3476 uint64_t value) 3477 { 3478 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3479 ARMMMUIdx mmu_idx; 3480 int secure = arm_is_secure_below_el3(env); 3481 3482 switch (ri->opc2 & 6) { 3483 case 0: 3484 switch (ri->opc1) { 3485 case 0: /* AT S1E1R, AT S1E1W */ 3486 mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_Stage1_E1; 3487 break; 3488 case 4: /* AT S1E2R, AT S1E2W */ 3489 mmu_idx = ARMMMUIdx_E2; 3490 break; 3491 case 6: /* AT S1E3R, AT S1E3W */ 3492 mmu_idx = ARMMMUIdx_SE3; 3493 break; 3494 default: 3495 g_assert_not_reached(); 3496 } 3497 break; 3498 case 2: /* AT S1E0R, AT S1E0W */ 3499 mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_Stage1_E0; 3500 break; 3501 case 4: /* AT S12E1R, AT S12E1W */ 3502 mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1; 3503 break; 3504 case 6: /* AT S12E0R, AT S12E0W */ 3505 mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_E10_0; 3506 break; 3507 default: 3508 g_assert_not_reached(); 3509 } 3510 3511 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx); 3512 } 3513 #endif 3514 3515 static const ARMCPRegInfo vapa_cp_reginfo[] = { 3516 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 3517 .access = PL1_RW, .resetvalue = 0, 3518 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 3519 offsetoflow32(CPUARMState, cp15.par_ns) }, 3520 .writefn = par_write }, 3521 #ifndef CONFIG_USER_ONLY 3522 /* This underdecoding is safe because the reginfo is NO_RAW. */ 3523 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 3524 .access = PL1_W, .accessfn = ats_access, 3525 .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 3526 #endif 3527 REGINFO_SENTINEL 3528 }; 3529 3530 /* Return basic MPU access permission bits. */ 3531 static uint32_t simple_mpu_ap_bits(uint32_t val) 3532 { 3533 uint32_t ret; 3534 uint32_t mask; 3535 int i; 3536 ret = 0; 3537 mask = 3; 3538 for (i = 0; i < 16; i += 2) { 3539 ret |= (val >> i) & mask; 3540 mask <<= 2; 3541 } 3542 return ret; 3543 } 3544 3545 /* Pad basic MPU access permission bits to extended format. */ 3546 static uint32_t extended_mpu_ap_bits(uint32_t val) 3547 { 3548 uint32_t ret; 3549 uint32_t mask; 3550 int i; 3551 ret = 0; 3552 mask = 3; 3553 for (i = 0; i < 16; i += 2) { 3554 ret |= (val & mask) << i; 3555 mask <<= 2; 3556 } 3557 return ret; 3558 } 3559 3560 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3561 uint64_t value) 3562 { 3563 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3564 } 3565 3566 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3567 { 3568 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3569 } 3570 3571 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3572 uint64_t value) 3573 { 3574 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3575 } 3576 3577 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3578 { 3579 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3580 } 3581 3582 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3583 { 3584 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3585 3586 if (!u32p) { 3587 return 0; 3588 } 3589 3590 u32p += env->pmsav7.rnr[M_REG_NS]; 3591 return *u32p; 3592 } 3593 3594 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3595 uint64_t value) 3596 { 3597 ARMCPU *cpu = env_archcpu(env); 3598 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3599 3600 if (!u32p) { 3601 return; 3602 } 3603 3604 u32p += env->pmsav7.rnr[M_REG_NS]; 3605 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3606 *u32p = value; 3607 } 3608 3609 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3610 uint64_t value) 3611 { 3612 ARMCPU *cpu = env_archcpu(env); 3613 uint32_t nrgs = cpu->pmsav7_dregion; 3614 3615 if (value >= nrgs) { 3616 qemu_log_mask(LOG_GUEST_ERROR, 3617 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3618 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3619 return; 3620 } 3621 3622 raw_write(env, ri, value); 3623 } 3624 3625 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 3626 /* Reset for all these registers is handled in arm_cpu_reset(), 3627 * because the PMSAv7 is also used by M-profile CPUs, which do 3628 * not register cpregs but still need the state to be reset. 3629 */ 3630 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 3631 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3632 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 3633 .readfn = pmsav7_read, .writefn = pmsav7_write, 3634 .resetfn = arm_cp_reset_ignore }, 3635 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 3636 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3637 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 3638 .readfn = pmsav7_read, .writefn = pmsav7_write, 3639 .resetfn = arm_cp_reset_ignore }, 3640 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 3641 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3642 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 3643 .readfn = pmsav7_read, .writefn = pmsav7_write, 3644 .resetfn = arm_cp_reset_ignore }, 3645 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 3646 .access = PL1_RW, 3647 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 3648 .writefn = pmsav7_rgnr_write, 3649 .resetfn = arm_cp_reset_ignore }, 3650 REGINFO_SENTINEL 3651 }; 3652 3653 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 3654 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3655 .access = PL1_RW, .type = ARM_CP_ALIAS, 3656 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3657 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 3658 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3659 .access = PL1_RW, .type = ARM_CP_ALIAS, 3660 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3661 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 3662 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 3663 .access = PL1_RW, 3664 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3665 .resetvalue = 0, }, 3666 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 3667 .access = PL1_RW, 3668 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3669 .resetvalue = 0, }, 3670 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 3671 .access = PL1_RW, 3672 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 3673 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 3674 .access = PL1_RW, 3675 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 3676 /* Protection region base and size registers */ 3677 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 3678 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3679 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 3680 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 3681 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3682 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 3683 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 3684 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3685 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 3686 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 3687 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3688 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 3689 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 3690 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3691 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 3692 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 3693 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3694 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 3695 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 3696 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3697 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 3698 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 3699 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3700 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 3701 REGINFO_SENTINEL 3702 }; 3703 3704 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 3705 uint64_t value) 3706 { 3707 TCR *tcr = raw_ptr(env, ri); 3708 int maskshift = extract32(value, 0, 3); 3709 3710 if (!arm_feature(env, ARM_FEATURE_V8)) { 3711 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 3712 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 3713 * using Long-desciptor translation table format */ 3714 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 3715 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 3716 /* In an implementation that includes the Security Extensions 3717 * TTBCR has additional fields PD0 [4] and PD1 [5] for 3718 * Short-descriptor translation table format. 3719 */ 3720 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 3721 } else { 3722 value &= TTBCR_N; 3723 } 3724 } 3725 3726 /* Update the masks corresponding to the TCR bank being written 3727 * Note that we always calculate mask and base_mask, but 3728 * they are only used for short-descriptor tables (ie if EAE is 0); 3729 * for long-descriptor tables the TCR fields are used differently 3730 * and the mask and base_mask values are meaningless. 3731 */ 3732 tcr->raw_tcr = value; 3733 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift); 3734 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift); 3735 } 3736 3737 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3738 uint64_t value) 3739 { 3740 ARMCPU *cpu = env_archcpu(env); 3741 TCR *tcr = raw_ptr(env, ri); 3742 3743 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3744 /* With LPAE the TTBCR could result in a change of ASID 3745 * via the TTBCR.A1 bit, so do a TLB flush. 3746 */ 3747 tlb_flush(CPU(cpu)); 3748 } 3749 /* Preserve the high half of TCR_EL1, set via TTBCR2. */ 3750 value = deposit64(tcr->raw_tcr, 0, 32, value); 3751 vmsa_ttbcr_raw_write(env, ri, value); 3752 } 3753 3754 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3755 { 3756 TCR *tcr = raw_ptr(env, ri); 3757 3758 /* Reset both the TCR as well as the masks corresponding to the bank of 3759 * the TCR being reset. 3760 */ 3761 tcr->raw_tcr = 0; 3762 tcr->mask = 0; 3763 tcr->base_mask = 0xffffc000u; 3764 } 3765 3766 static void vmsa_tcr_el12_write(CPUARMState *env, const ARMCPRegInfo *ri, 3767 uint64_t value) 3768 { 3769 ARMCPU *cpu = env_archcpu(env); 3770 TCR *tcr = raw_ptr(env, ri); 3771 3772 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 3773 tlb_flush(CPU(cpu)); 3774 tcr->raw_tcr = value; 3775 } 3776 3777 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3778 uint64_t value) 3779 { 3780 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 3781 if (cpreg_field_is_64bit(ri) && 3782 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 3783 ARMCPU *cpu = env_archcpu(env); 3784 tlb_flush(CPU(cpu)); 3785 } 3786 raw_write(env, ri, value); 3787 } 3788 3789 static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3790 uint64_t value) 3791 { 3792 /* 3793 * If we are running with E2&0 regime, then an ASID is active. 3794 * Flush if that might be changing. Note we're not checking 3795 * TCR_EL2.A1 to know if this is really the TTBRx_EL2 that 3796 * holds the active ASID, only checking the field that might. 3797 */ 3798 if (extract64(raw_read(env, ri) ^ value, 48, 16) && 3799 (arm_hcr_el2_eff(env) & HCR_E2H)) { 3800 tlb_flush_by_mmuidx(env_cpu(env), 3801 ARMMMUIdxBit_E20_2 | ARMMMUIdxBit_E20_0); 3802 } 3803 raw_write(env, ri, value); 3804 } 3805 3806 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3807 uint64_t value) 3808 { 3809 ARMCPU *cpu = env_archcpu(env); 3810 CPUState *cs = CPU(cpu); 3811 3812 /* 3813 * A change in VMID to the stage2 page table (Stage2) invalidates 3814 * the combined stage 1&2 tlbs (EL10_1 and EL10_0). 3815 */ 3816 if (raw_read(env, ri) != value) { 3817 tlb_flush_by_mmuidx(cs, 3818 ARMMMUIdxBit_E10_1 | 3819 ARMMMUIdxBit_E10_0 | 3820 ARMMMUIdxBit_Stage2); 3821 raw_write(env, ri, value); 3822 } 3823 } 3824 3825 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 3826 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3827 .access = PL1_RW, .type = ARM_CP_ALIAS, 3828 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 3829 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 3830 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3831 .access = PL1_RW, .resetvalue = 0, 3832 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 3833 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 3834 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 3835 .access = PL1_RW, .resetvalue = 0, 3836 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 3837 offsetof(CPUARMState, cp15.dfar_ns) } }, 3838 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 3839 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 3840 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 3841 .resetvalue = 0, }, 3842 REGINFO_SENTINEL 3843 }; 3844 3845 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 3846 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 3847 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 3848 .access = PL1_RW, 3849 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 3850 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 3851 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 3852 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3853 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3854 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 3855 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 3856 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 3857 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3858 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3859 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 3860 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 3861 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3862 .access = PL1_RW, .writefn = vmsa_tcr_el12_write, 3863 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write, 3864 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 3865 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3866 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 3867 .raw_writefn = vmsa_ttbcr_raw_write, 3868 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 3869 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 3870 REGINFO_SENTINEL 3871 }; 3872 3873 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing 3874 * qemu tlbs nor adjusting cached masks. 3875 */ 3876 static const ARMCPRegInfo ttbcr2_reginfo = { 3877 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 3878 .access = PL1_RW, .type = ARM_CP_ALIAS, 3879 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 3880 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) }, 3881 }; 3882 3883 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 3884 uint64_t value) 3885 { 3886 env->cp15.c15_ticonfig = value & 0xe7; 3887 /* The OS_TYPE bit in this register changes the reported CPUID! */ 3888 env->cp15.c0_cpuid = (value & (1 << 5)) ? 3889 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 3890 } 3891 3892 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 3893 uint64_t value) 3894 { 3895 env->cp15.c15_threadid = value & 0xffff; 3896 } 3897 3898 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 3899 uint64_t value) 3900 { 3901 /* Wait-for-interrupt (deprecated) */ 3902 cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT); 3903 } 3904 3905 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 3906 uint64_t value) 3907 { 3908 /* On OMAP there are registers indicating the max/min index of dcache lines 3909 * containing a dirty line; cache flush operations have to reset these. 3910 */ 3911 env->cp15.c15_i_max = 0x000; 3912 env->cp15.c15_i_min = 0xff0; 3913 } 3914 3915 static const ARMCPRegInfo omap_cp_reginfo[] = { 3916 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 3917 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 3918 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 3919 .resetvalue = 0, }, 3920 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 3921 .access = PL1_RW, .type = ARM_CP_NOP }, 3922 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 3923 .access = PL1_RW, 3924 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 3925 .writefn = omap_ticonfig_write }, 3926 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 3927 .access = PL1_RW, 3928 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 3929 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 3930 .access = PL1_RW, .resetvalue = 0xff0, 3931 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 3932 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 3933 .access = PL1_RW, 3934 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 3935 .writefn = omap_threadid_write }, 3936 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 3937 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3938 .type = ARM_CP_NO_RAW, 3939 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 3940 /* TODO: Peripheral port remap register: 3941 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 3942 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 3943 * when MMU is off. 3944 */ 3945 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 3946 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 3947 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 3948 .writefn = omap_cachemaint_write }, 3949 { .name = "C9", .cp = 15, .crn = 9, 3950 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 3951 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 3952 REGINFO_SENTINEL 3953 }; 3954 3955 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3956 uint64_t value) 3957 { 3958 env->cp15.c15_cpar = value & 0x3fff; 3959 } 3960 3961 static const ARMCPRegInfo xscale_cp_reginfo[] = { 3962 { .name = "XSCALE_CPAR", 3963 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3964 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 3965 .writefn = xscale_cpar_write, }, 3966 { .name = "XSCALE_AUXCR", 3967 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 3968 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 3969 .resetvalue = 0, }, 3970 /* XScale specific cache-lockdown: since we have no cache we NOP these 3971 * and hope the guest does not really rely on cache behaviour. 3972 */ 3973 { .name = "XSCALE_LOCK_ICACHE_LINE", 3974 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 3975 .access = PL1_W, .type = ARM_CP_NOP }, 3976 { .name = "XSCALE_UNLOCK_ICACHE", 3977 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 3978 .access = PL1_W, .type = ARM_CP_NOP }, 3979 { .name = "XSCALE_DCACHE_LOCK", 3980 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 3981 .access = PL1_RW, .type = ARM_CP_NOP }, 3982 { .name = "XSCALE_UNLOCK_DCACHE", 3983 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 3984 .access = PL1_W, .type = ARM_CP_NOP }, 3985 REGINFO_SENTINEL 3986 }; 3987 3988 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 3989 /* RAZ/WI the whole crn=15 space, when we don't have a more specific 3990 * implementation of this implementation-defined space. 3991 * Ideally this should eventually disappear in favour of actually 3992 * implementing the correct behaviour for all cores. 3993 */ 3994 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 3995 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3996 .access = PL1_RW, 3997 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 3998 .resetvalue = 0 }, 3999 REGINFO_SENTINEL 4000 }; 4001 4002 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 4003 /* Cache status: RAZ because we have no cache so it's always clean */ 4004 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 4005 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4006 .resetvalue = 0 }, 4007 REGINFO_SENTINEL 4008 }; 4009 4010 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 4011 /* We never have a a block transfer operation in progress */ 4012 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 4013 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4014 .resetvalue = 0 }, 4015 /* The cache ops themselves: these all NOP for QEMU */ 4016 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 4017 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4018 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 4019 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4020 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 4021 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4022 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 4023 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4024 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 4025 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4026 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 4027 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4028 REGINFO_SENTINEL 4029 }; 4030 4031 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 4032 /* The cache test-and-clean instructions always return (1 << 30) 4033 * to indicate that there are no dirty cache lines. 4034 */ 4035 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 4036 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4037 .resetvalue = (1 << 30) }, 4038 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 4039 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4040 .resetvalue = (1 << 30) }, 4041 REGINFO_SENTINEL 4042 }; 4043 4044 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 4045 /* Ignore ReadBuffer accesses */ 4046 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 4047 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4048 .access = PL1_RW, .resetvalue = 0, 4049 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 4050 REGINFO_SENTINEL 4051 }; 4052 4053 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4054 { 4055 ARMCPU *cpu = env_archcpu(env); 4056 unsigned int cur_el = arm_current_el(env); 4057 bool secure = arm_is_secure(env); 4058 4059 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 4060 return env->cp15.vpidr_el2; 4061 } 4062 return raw_read(env, ri); 4063 } 4064 4065 static uint64_t mpidr_read_val(CPUARMState *env) 4066 { 4067 ARMCPU *cpu = env_archcpu(env); 4068 uint64_t mpidr = cpu->mp_affinity; 4069 4070 if (arm_feature(env, ARM_FEATURE_V7MP)) { 4071 mpidr |= (1U << 31); 4072 /* Cores which are uniprocessor (non-coherent) 4073 * but still implement the MP extensions set 4074 * bit 30. (For instance, Cortex-R5). 4075 */ 4076 if (cpu->mp_is_up) { 4077 mpidr |= (1u << 30); 4078 } 4079 } 4080 return mpidr; 4081 } 4082 4083 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4084 { 4085 unsigned int cur_el = arm_current_el(env); 4086 bool secure = arm_is_secure(env); 4087 4088 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 4089 return env->cp15.vmpidr_el2; 4090 } 4091 return mpidr_read_val(env); 4092 } 4093 4094 static const ARMCPRegInfo lpae_cp_reginfo[] = { 4095 /* NOP AMAIR0/1 */ 4096 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 4097 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 4098 .access = PL1_RW, .type = ARM_CP_CONST, 4099 .resetvalue = 0 }, 4100 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 4101 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 4102 .access = PL1_RW, .type = ARM_CP_CONST, 4103 .resetvalue = 0 }, 4104 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 4105 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 4106 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 4107 offsetof(CPUARMState, cp15.par_ns)} }, 4108 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 4109 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4110 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 4111 offsetof(CPUARMState, cp15.ttbr0_ns) }, 4112 .writefn = vmsa_ttbr_write, }, 4113 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 4114 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4115 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 4116 offsetof(CPUARMState, cp15.ttbr1_ns) }, 4117 .writefn = vmsa_ttbr_write, }, 4118 REGINFO_SENTINEL 4119 }; 4120 4121 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4122 { 4123 return vfp_get_fpcr(env); 4124 } 4125 4126 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4127 uint64_t value) 4128 { 4129 vfp_set_fpcr(env, value); 4130 } 4131 4132 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4133 { 4134 return vfp_get_fpsr(env); 4135 } 4136 4137 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4138 uint64_t value) 4139 { 4140 vfp_set_fpsr(env, value); 4141 } 4142 4143 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 4144 bool isread) 4145 { 4146 if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UMA)) { 4147 return CP_ACCESS_TRAP; 4148 } 4149 return CP_ACCESS_OK; 4150 } 4151 4152 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 4153 uint64_t value) 4154 { 4155 env->daif = value & PSTATE_DAIF; 4156 } 4157 4158 static CPAccessResult aa64_cacheop_access(CPUARMState *env, 4159 const ARMCPRegInfo *ri, 4160 bool isread) 4161 { 4162 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless 4163 * SCTLR_EL1.UCI is set. 4164 */ 4165 if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UCI)) { 4166 return CP_ACCESS_TRAP; 4167 } 4168 return CP_ACCESS_OK; 4169 } 4170 4171 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 4172 * Page D4-1736 (DDI0487A.b) 4173 */ 4174 4175 static int vae1_tlbmask(CPUARMState *env) 4176 { 4177 /* Since we exclude secure first, we may read HCR_EL2 directly. */ 4178 if (arm_is_secure_below_el3(env)) { 4179 return ARMMMUIdxBit_SE10_1 | ARMMMUIdxBit_SE10_0; 4180 } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE)) 4181 == (HCR_E2H | HCR_TGE)) { 4182 return ARMMMUIdxBit_E20_2 | ARMMMUIdxBit_E20_0; 4183 } else { 4184 return ARMMMUIdxBit_E10_1 | ARMMMUIdxBit_E10_0; 4185 } 4186 } 4187 4188 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4189 uint64_t value) 4190 { 4191 CPUState *cs = env_cpu(env); 4192 int mask = vae1_tlbmask(env); 4193 4194 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4195 } 4196 4197 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4198 uint64_t value) 4199 { 4200 CPUState *cs = env_cpu(env); 4201 int mask = vae1_tlbmask(env); 4202 4203 if (tlb_force_broadcast(env)) { 4204 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4205 } else { 4206 tlb_flush_by_mmuidx(cs, mask); 4207 } 4208 } 4209 4210 static int alle1_tlbmask(CPUARMState *env) 4211 { 4212 /* 4213 * Note that the 'ALL' scope must invalidate both stage 1 and 4214 * stage 2 translations, whereas most other scopes only invalidate 4215 * stage 1 translations. 4216 */ 4217 if (arm_is_secure_below_el3(env)) { 4218 return ARMMMUIdxBit_SE10_1 | ARMMMUIdxBit_SE10_0; 4219 } else if (arm_feature(env, ARM_FEATURE_EL2)) { 4220 return ARMMMUIdxBit_E10_1 | ARMMMUIdxBit_E10_0 | ARMMMUIdxBit_Stage2; 4221 } else { 4222 return ARMMMUIdxBit_E10_1 | ARMMMUIdxBit_E10_0; 4223 } 4224 } 4225 4226 static int e2_tlbmask(CPUARMState *env) 4227 { 4228 /* TODO: ARMv8.4-SecEL2 */ 4229 return ARMMMUIdxBit_E20_0 | ARMMMUIdxBit_E20_2 | ARMMMUIdxBit_E2; 4230 } 4231 4232 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4233 uint64_t value) 4234 { 4235 CPUState *cs = env_cpu(env); 4236 int mask = alle1_tlbmask(env); 4237 4238 tlb_flush_by_mmuidx(cs, mask); 4239 } 4240 4241 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4242 uint64_t value) 4243 { 4244 CPUState *cs = env_cpu(env); 4245 int mask = e2_tlbmask(env); 4246 4247 tlb_flush_by_mmuidx(cs, mask); 4248 } 4249 4250 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 4251 uint64_t value) 4252 { 4253 ARMCPU *cpu = env_archcpu(env); 4254 CPUState *cs = CPU(cpu); 4255 4256 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_SE3); 4257 } 4258 4259 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4260 uint64_t value) 4261 { 4262 CPUState *cs = env_cpu(env); 4263 int mask = alle1_tlbmask(env); 4264 4265 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4266 } 4267 4268 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4269 uint64_t value) 4270 { 4271 CPUState *cs = env_cpu(env); 4272 int mask = e2_tlbmask(env); 4273 4274 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4275 } 4276 4277 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4278 uint64_t value) 4279 { 4280 CPUState *cs = env_cpu(env); 4281 4282 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_SE3); 4283 } 4284 4285 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4286 uint64_t value) 4287 { 4288 /* Invalidate by VA, EL2 4289 * Currently handles both VAE2 and VALE2, since we don't support 4290 * flush-last-level-only. 4291 */ 4292 CPUState *cs = env_cpu(env); 4293 int mask = e2_tlbmask(env); 4294 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4295 4296 tlb_flush_page_by_mmuidx(cs, pageaddr, mask); 4297 } 4298 4299 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 4300 uint64_t value) 4301 { 4302 /* Invalidate by VA, EL3 4303 * Currently handles both VAE3 and VALE3, since we don't support 4304 * flush-last-level-only. 4305 */ 4306 ARMCPU *cpu = env_archcpu(env); 4307 CPUState *cs = CPU(cpu); 4308 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4309 4310 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_SE3); 4311 } 4312 4313 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4314 uint64_t value) 4315 { 4316 CPUState *cs = env_cpu(env); 4317 int mask = vae1_tlbmask(env); 4318 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4319 4320 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask); 4321 } 4322 4323 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4324 uint64_t value) 4325 { 4326 /* Invalidate by VA, EL1&0 (AArch64 version). 4327 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 4328 * since we don't support flush-for-specific-ASID-only or 4329 * flush-last-level-only. 4330 */ 4331 CPUState *cs = env_cpu(env); 4332 int mask = vae1_tlbmask(env); 4333 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4334 4335 if (tlb_force_broadcast(env)) { 4336 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask); 4337 } else { 4338 tlb_flush_page_by_mmuidx(cs, pageaddr, mask); 4339 } 4340 } 4341 4342 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4343 uint64_t value) 4344 { 4345 CPUState *cs = env_cpu(env); 4346 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4347 4348 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4349 ARMMMUIdxBit_E2); 4350 } 4351 4352 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4353 uint64_t value) 4354 { 4355 CPUState *cs = env_cpu(env); 4356 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4357 4358 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4359 ARMMMUIdxBit_SE3); 4360 } 4361 4362 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4363 uint64_t value) 4364 { 4365 /* Invalidate by IPA. This has to invalidate any structures that 4366 * contain only stage 2 translation information, but does not need 4367 * to apply to structures that contain combined stage 1 and stage 2 4368 * translation information. 4369 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 4370 */ 4371 ARMCPU *cpu = env_archcpu(env); 4372 CPUState *cs = CPU(cpu); 4373 uint64_t pageaddr; 4374 4375 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 4376 return; 4377 } 4378 4379 pageaddr = sextract64(value << 12, 0, 48); 4380 4381 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2); 4382 } 4383 4384 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4385 uint64_t value) 4386 { 4387 CPUState *cs = env_cpu(env); 4388 uint64_t pageaddr; 4389 4390 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 4391 return; 4392 } 4393 4394 pageaddr = sextract64(value << 12, 0, 48); 4395 4396 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4397 ARMMMUIdxBit_Stage2); 4398 } 4399 4400 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 4401 bool isread) 4402 { 4403 int cur_el = arm_current_el(env); 4404 4405 if (cur_el < 2) { 4406 uint64_t hcr = arm_hcr_el2_eff(env); 4407 4408 if (cur_el == 0) { 4409 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 4410 if (!(env->cp15.sctlr_el[2] & SCTLR_DZE)) { 4411 return CP_ACCESS_TRAP_EL2; 4412 } 4413 } else { 4414 if (!(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 4415 return CP_ACCESS_TRAP; 4416 } 4417 if (hcr & HCR_TDZ) { 4418 return CP_ACCESS_TRAP_EL2; 4419 } 4420 } 4421 } else if (hcr & HCR_TDZ) { 4422 return CP_ACCESS_TRAP_EL2; 4423 } 4424 } 4425 return CP_ACCESS_OK; 4426 } 4427 4428 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 4429 { 4430 ARMCPU *cpu = env_archcpu(env); 4431 int dzp_bit = 1 << 4; 4432 4433 /* DZP indicates whether DC ZVA access is allowed */ 4434 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 4435 dzp_bit = 0; 4436 } 4437 return cpu->dcz_blocksize | dzp_bit; 4438 } 4439 4440 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 4441 bool isread) 4442 { 4443 if (!(env->pstate & PSTATE_SP)) { 4444 /* Access to SP_EL0 is undefined if it's being used as 4445 * the stack pointer. 4446 */ 4447 return CP_ACCESS_TRAP_UNCATEGORIZED; 4448 } 4449 return CP_ACCESS_OK; 4450 } 4451 4452 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 4453 { 4454 return env->pstate & PSTATE_SP; 4455 } 4456 4457 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 4458 { 4459 update_spsel(env, val); 4460 } 4461 4462 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4463 uint64_t value) 4464 { 4465 ARMCPU *cpu = env_archcpu(env); 4466 4467 if (raw_read(env, ri) == value) { 4468 /* Skip the TLB flush if nothing actually changed; Linux likes 4469 * to do a lot of pointless SCTLR writes. 4470 */ 4471 return; 4472 } 4473 4474 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 4475 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 4476 value &= ~SCTLR_M; 4477 } 4478 4479 raw_write(env, ri, value); 4480 /* ??? Lots of these bits are not implemented. */ 4481 /* This may enable/disable the MMU, so do a TLB flush. */ 4482 tlb_flush(CPU(cpu)); 4483 4484 if (ri->type & ARM_CP_SUPPRESS_TB_END) { 4485 /* 4486 * Normally we would always end the TB on an SCTLR write; see the 4487 * comment in ARMCPRegInfo sctlr initialization below for why Xscale 4488 * is special. Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild 4489 * of hflags from the translator, so do it here. 4490 */ 4491 arm_rebuild_hflags(env); 4492 } 4493 } 4494 4495 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri, 4496 bool isread) 4497 { 4498 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) { 4499 return CP_ACCESS_TRAP_FP_EL2; 4500 } 4501 if (env->cp15.cptr_el[3] & CPTR_TFP) { 4502 return CP_ACCESS_TRAP_FP_EL3; 4503 } 4504 return CP_ACCESS_OK; 4505 } 4506 4507 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4508 uint64_t value) 4509 { 4510 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK; 4511 } 4512 4513 static const ARMCPRegInfo v8_cp_reginfo[] = { 4514 /* Minimal set of EL0-visible registers. This will need to be expanded 4515 * significantly for system emulation of AArch64 CPUs. 4516 */ 4517 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 4518 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 4519 .access = PL0_RW, .type = ARM_CP_NZCV }, 4520 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 4521 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 4522 .type = ARM_CP_NO_RAW, 4523 .access = PL0_RW, .accessfn = aa64_daif_access, 4524 .fieldoffset = offsetof(CPUARMState, daif), 4525 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 4526 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 4527 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 4528 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4529 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 4530 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 4531 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 4532 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4533 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 4534 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 4535 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 4536 .access = PL0_R, .type = ARM_CP_NO_RAW, 4537 .readfn = aa64_dczid_read }, 4538 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 4539 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 4540 .access = PL0_W, .type = ARM_CP_DC_ZVA, 4541 #ifndef CONFIG_USER_ONLY 4542 /* Avoid overhead of an access check that always passes in user-mode */ 4543 .accessfn = aa64_zva_access, 4544 #endif 4545 }, 4546 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 4547 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 4548 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 4549 /* Cache ops: all NOPs since we don't emulate caches */ 4550 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 4551 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4552 .access = PL1_W, .type = ARM_CP_NOP }, 4553 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 4554 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4555 .access = PL1_W, .type = ARM_CP_NOP }, 4556 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 4557 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 4558 .access = PL0_W, .type = ARM_CP_NOP, 4559 .accessfn = aa64_cacheop_access }, 4560 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 4561 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4562 .access = PL1_W, .type = ARM_CP_NOP }, 4563 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 4564 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4565 .access = PL1_W, .type = ARM_CP_NOP }, 4566 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 4567 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 4568 .access = PL0_W, .type = ARM_CP_NOP, 4569 .accessfn = aa64_cacheop_access }, 4570 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 4571 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4572 .access = PL1_W, .type = ARM_CP_NOP }, 4573 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 4574 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 4575 .access = PL0_W, .type = ARM_CP_NOP, 4576 .accessfn = aa64_cacheop_access }, 4577 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 4578 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 4579 .access = PL0_W, .type = ARM_CP_NOP, 4580 .accessfn = aa64_cacheop_access }, 4581 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 4582 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4583 .access = PL1_W, .type = ARM_CP_NOP }, 4584 /* TLBI operations */ 4585 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 4586 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 4587 .access = PL1_W, .type = ARM_CP_NO_RAW, 4588 .writefn = tlbi_aa64_vmalle1is_write }, 4589 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 4590 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 4591 .access = PL1_W, .type = ARM_CP_NO_RAW, 4592 .writefn = tlbi_aa64_vae1is_write }, 4593 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 4594 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 4595 .access = PL1_W, .type = ARM_CP_NO_RAW, 4596 .writefn = tlbi_aa64_vmalle1is_write }, 4597 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 4598 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 4599 .access = PL1_W, .type = ARM_CP_NO_RAW, 4600 .writefn = tlbi_aa64_vae1is_write }, 4601 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 4602 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4603 .access = PL1_W, .type = ARM_CP_NO_RAW, 4604 .writefn = tlbi_aa64_vae1is_write }, 4605 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 4606 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4607 .access = PL1_W, .type = ARM_CP_NO_RAW, 4608 .writefn = tlbi_aa64_vae1is_write }, 4609 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 4610 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 4611 .access = PL1_W, .type = ARM_CP_NO_RAW, 4612 .writefn = tlbi_aa64_vmalle1_write }, 4613 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 4614 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 4615 .access = PL1_W, .type = ARM_CP_NO_RAW, 4616 .writefn = tlbi_aa64_vae1_write }, 4617 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 4618 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 4619 .access = PL1_W, .type = ARM_CP_NO_RAW, 4620 .writefn = tlbi_aa64_vmalle1_write }, 4621 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 4622 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 4623 .access = PL1_W, .type = ARM_CP_NO_RAW, 4624 .writefn = tlbi_aa64_vae1_write }, 4625 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 4626 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4627 .access = PL1_W, .type = ARM_CP_NO_RAW, 4628 .writefn = tlbi_aa64_vae1_write }, 4629 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 4630 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4631 .access = PL1_W, .type = ARM_CP_NO_RAW, 4632 .writefn = tlbi_aa64_vae1_write }, 4633 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 4634 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4635 .access = PL2_W, .type = ARM_CP_NO_RAW, 4636 .writefn = tlbi_aa64_ipas2e1is_write }, 4637 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 4638 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4639 .access = PL2_W, .type = ARM_CP_NO_RAW, 4640 .writefn = tlbi_aa64_ipas2e1is_write }, 4641 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 4642 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4643 .access = PL2_W, .type = ARM_CP_NO_RAW, 4644 .writefn = tlbi_aa64_alle1is_write }, 4645 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 4646 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 4647 .access = PL2_W, .type = ARM_CP_NO_RAW, 4648 .writefn = tlbi_aa64_alle1is_write }, 4649 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 4650 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4651 .access = PL2_W, .type = ARM_CP_NO_RAW, 4652 .writefn = tlbi_aa64_ipas2e1_write }, 4653 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 4654 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4655 .access = PL2_W, .type = ARM_CP_NO_RAW, 4656 .writefn = tlbi_aa64_ipas2e1_write }, 4657 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 4658 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4659 .access = PL2_W, .type = ARM_CP_NO_RAW, 4660 .writefn = tlbi_aa64_alle1_write }, 4661 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 4662 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 4663 .access = PL2_W, .type = ARM_CP_NO_RAW, 4664 .writefn = tlbi_aa64_alle1is_write }, 4665 #ifndef CONFIG_USER_ONLY 4666 /* 64 bit address translation operations */ 4667 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 4668 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 4669 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4670 .writefn = ats_write64 }, 4671 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 4672 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 4673 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4674 .writefn = ats_write64 }, 4675 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 4676 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 4677 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4678 .writefn = ats_write64 }, 4679 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 4680 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 4681 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4682 .writefn = ats_write64 }, 4683 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 4684 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 4685 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4686 .writefn = ats_write64 }, 4687 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 4688 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 4689 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4690 .writefn = ats_write64 }, 4691 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 4692 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 4693 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4694 .writefn = ats_write64 }, 4695 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 4696 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 4697 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4698 .writefn = ats_write64 }, 4699 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 4700 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 4701 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 4702 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4703 .writefn = ats_write64 }, 4704 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 4705 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 4706 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4707 .writefn = ats_write64 }, 4708 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 4709 .type = ARM_CP_ALIAS, 4710 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 4711 .access = PL1_RW, .resetvalue = 0, 4712 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 4713 .writefn = par_write }, 4714 #endif 4715 /* TLB invalidate last level of translation table walk */ 4716 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4717 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 4718 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4719 .type = ARM_CP_NO_RAW, .access = PL1_W, 4720 .writefn = tlbimvaa_is_write }, 4721 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4722 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 4723 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4724 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 4725 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4726 .type = ARM_CP_NO_RAW, .access = PL2_W, 4727 .writefn = tlbimva_hyp_write }, 4728 { .name = "TLBIMVALHIS", 4729 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4730 .type = ARM_CP_NO_RAW, .access = PL2_W, 4731 .writefn = tlbimva_hyp_is_write }, 4732 { .name = "TLBIIPAS2", 4733 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4734 .type = ARM_CP_NO_RAW, .access = PL2_W, 4735 .writefn = tlbiipas2_write }, 4736 { .name = "TLBIIPAS2IS", 4737 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4738 .type = ARM_CP_NO_RAW, .access = PL2_W, 4739 .writefn = tlbiipas2_is_write }, 4740 { .name = "TLBIIPAS2L", 4741 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4742 .type = ARM_CP_NO_RAW, .access = PL2_W, 4743 .writefn = tlbiipas2_write }, 4744 { .name = "TLBIIPAS2LIS", 4745 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4746 .type = ARM_CP_NO_RAW, .access = PL2_W, 4747 .writefn = tlbiipas2_is_write }, 4748 /* 32 bit cache operations */ 4749 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4750 .type = ARM_CP_NOP, .access = PL1_W }, 4751 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 4752 .type = ARM_CP_NOP, .access = PL1_W }, 4753 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4754 .type = ARM_CP_NOP, .access = PL1_W }, 4755 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 4756 .type = ARM_CP_NOP, .access = PL1_W }, 4757 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 4758 .type = ARM_CP_NOP, .access = PL1_W }, 4759 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 4760 .type = ARM_CP_NOP, .access = PL1_W }, 4761 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4762 .type = ARM_CP_NOP, .access = PL1_W }, 4763 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4764 .type = ARM_CP_NOP, .access = PL1_W }, 4765 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 4766 .type = ARM_CP_NOP, .access = PL1_W }, 4767 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4768 .type = ARM_CP_NOP, .access = PL1_W }, 4769 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 4770 .type = ARM_CP_NOP, .access = PL1_W }, 4771 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 4772 .type = ARM_CP_NOP, .access = PL1_W }, 4773 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4774 .type = ARM_CP_NOP, .access = PL1_W }, 4775 /* MMU Domain access control / MPU write buffer control */ 4776 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 4777 .access = PL1_RW, .resetvalue = 0, 4778 .writefn = dacr_write, .raw_writefn = raw_write, 4779 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 4780 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 4781 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 4782 .type = ARM_CP_ALIAS, 4783 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 4784 .access = PL1_RW, 4785 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 4786 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 4787 .type = ARM_CP_ALIAS, 4788 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 4789 .access = PL1_RW, 4790 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 4791 /* We rely on the access checks not allowing the guest to write to the 4792 * state field when SPSel indicates that it's being used as the stack 4793 * pointer. 4794 */ 4795 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 4796 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 4797 .access = PL1_RW, .accessfn = sp_el0_access, 4798 .type = ARM_CP_ALIAS, 4799 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 4800 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 4801 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 4802 .access = PL2_RW, .type = ARM_CP_ALIAS, 4803 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 4804 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 4805 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 4806 .type = ARM_CP_NO_RAW, 4807 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 4808 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 4809 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 4810 .type = ARM_CP_ALIAS, 4811 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]), 4812 .access = PL2_RW, .accessfn = fpexc32_access }, 4813 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 4814 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 4815 .access = PL2_RW, .resetvalue = 0, 4816 .writefn = dacr_write, .raw_writefn = raw_write, 4817 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 4818 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 4819 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 4820 .access = PL2_RW, .resetvalue = 0, 4821 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 4822 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 4823 .type = ARM_CP_ALIAS, 4824 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 4825 .access = PL2_RW, 4826 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 4827 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 4828 .type = ARM_CP_ALIAS, 4829 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 4830 .access = PL2_RW, 4831 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 4832 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 4833 .type = ARM_CP_ALIAS, 4834 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 4835 .access = PL2_RW, 4836 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 4837 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 4838 .type = ARM_CP_ALIAS, 4839 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 4840 .access = PL2_RW, 4841 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 4842 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 4843 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 4844 .resetvalue = 0, 4845 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 4846 { .name = "SDCR", .type = ARM_CP_ALIAS, 4847 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 4848 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4849 .writefn = sdcr_write, 4850 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 4851 REGINFO_SENTINEL 4852 }; 4853 4854 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */ 4855 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = { 4856 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4857 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4858 .access = PL2_RW, 4859 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore }, 4860 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH, 4861 .type = ARM_CP_NO_RAW, 4862 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4863 .access = PL2_RW, 4864 .type = ARM_CP_CONST, .resetvalue = 0 }, 4865 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 4866 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 4867 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4868 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4869 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4870 .access = PL2_RW, 4871 .type = ARM_CP_CONST, .resetvalue = 0 }, 4872 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4873 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4874 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4875 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4876 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4877 .access = PL2_RW, .type = ARM_CP_CONST, 4878 .resetvalue = 0 }, 4879 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4880 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4881 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4882 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4883 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4884 .access = PL2_RW, .type = ARM_CP_CONST, 4885 .resetvalue = 0 }, 4886 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4887 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4888 .access = PL2_RW, .type = ARM_CP_CONST, 4889 .resetvalue = 0 }, 4890 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4891 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4892 .access = PL2_RW, .type = ARM_CP_CONST, 4893 .resetvalue = 0 }, 4894 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4895 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4896 .access = PL2_RW, .type = ARM_CP_CONST, 4897 .resetvalue = 0 }, 4898 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4899 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4900 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4901 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH, 4902 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4903 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4904 .type = ARM_CP_CONST, .resetvalue = 0 }, 4905 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4906 .cp = 15, .opc1 = 6, .crm = 2, 4907 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4908 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 }, 4909 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4910 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4911 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4912 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4913 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4914 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4915 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4916 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4917 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4918 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4919 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4920 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4921 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4922 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4923 .resetvalue = 0 }, 4924 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4925 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4926 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4927 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4928 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4929 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4930 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4931 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4932 .resetvalue = 0 }, 4933 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4934 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4935 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4936 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4937 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4938 .resetvalue = 0 }, 4939 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4940 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4941 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4942 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4943 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4944 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4945 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4946 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4947 .access = PL2_RW, .accessfn = access_tda, 4948 .type = ARM_CP_CONST, .resetvalue = 0 }, 4949 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH, 4950 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4951 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4952 .type = ARM_CP_CONST, .resetvalue = 0 }, 4953 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4954 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4955 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4956 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4957 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4958 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4959 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4960 .type = ARM_CP_CONST, 4961 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4962 .access = PL2_RW, .resetvalue = 0 }, 4963 REGINFO_SENTINEL 4964 }; 4965 4966 /* Ditto, but for registers which exist in ARMv8 but not v7 */ 4967 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = { 4968 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4969 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4970 .access = PL2_RW, 4971 .type = ARM_CP_CONST, .resetvalue = 0 }, 4972 REGINFO_SENTINEL 4973 }; 4974 4975 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 4976 { 4977 ARMCPU *cpu = env_archcpu(env); 4978 /* Begin with bits defined in base ARMv8.0. */ 4979 uint64_t valid_mask = MAKE_64BIT_MASK(0, 34); 4980 4981 if (arm_feature(env, ARM_FEATURE_EL3)) { 4982 valid_mask &= ~HCR_HCD; 4983 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 4984 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented. 4985 * However, if we're using the SMC PSCI conduit then QEMU is 4986 * effectively acting like EL3 firmware and so the guest at 4987 * EL2 should retain the ability to prevent EL1 from being 4988 * able to make SMC calls into the ersatz firmware, so in 4989 * that case HCR.TSC should be read/write. 4990 */ 4991 valid_mask &= ~HCR_TSC; 4992 } 4993 if (cpu_isar_feature(aa64_vh, cpu)) { 4994 valid_mask |= HCR_E2H; 4995 } 4996 if (cpu_isar_feature(aa64_lor, cpu)) { 4997 valid_mask |= HCR_TLOR; 4998 } 4999 if (cpu_isar_feature(aa64_pauth, cpu)) { 5000 valid_mask |= HCR_API | HCR_APK; 5001 } 5002 5003 /* Clear RES0 bits. */ 5004 value &= valid_mask; 5005 5006 /* These bits change the MMU setup: 5007 * HCR_VM enables stage 2 translation 5008 * HCR_PTW forbids certain page-table setups 5009 * HCR_DC Disables stage1 and enables stage2 translation 5010 */ 5011 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) { 5012 tlb_flush(CPU(cpu)); 5013 } 5014 env->cp15.hcr_el2 = value; 5015 5016 /* 5017 * Updates to VI and VF require us to update the status of 5018 * virtual interrupts, which are the logical OR of these bits 5019 * and the state of the input lines from the GIC. (This requires 5020 * that we have the iothread lock, which is done by marking the 5021 * reginfo structs as ARM_CP_IO.) 5022 * Note that if a write to HCR pends a VIRQ or VFIQ it is never 5023 * possible for it to be taken immediately, because VIRQ and 5024 * VFIQ are masked unless running at EL0 or EL1, and HCR 5025 * can only be written at EL2. 5026 */ 5027 g_assert(qemu_mutex_iothread_locked()); 5028 arm_cpu_update_virq(cpu); 5029 arm_cpu_update_vfiq(cpu); 5030 } 5031 5032 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 5033 uint64_t value) 5034 { 5035 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 5036 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 5037 hcr_write(env, NULL, value); 5038 } 5039 5040 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 5041 uint64_t value) 5042 { 5043 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 5044 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 5045 hcr_write(env, NULL, value); 5046 } 5047 5048 /* 5049 * Return the effective value of HCR_EL2. 5050 * Bits that are not included here: 5051 * RW (read from SCR_EL3.RW as needed) 5052 */ 5053 uint64_t arm_hcr_el2_eff(CPUARMState *env) 5054 { 5055 uint64_t ret = env->cp15.hcr_el2; 5056 5057 if (arm_is_secure_below_el3(env)) { 5058 /* 5059 * "This register has no effect if EL2 is not enabled in the 5060 * current Security state". This is ARMv8.4-SecEL2 speak for 5061 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 5062 * 5063 * Prior to that, the language was "In an implementation that 5064 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 5065 * as if this field is 0 for all purposes other than a direct 5066 * read or write access of HCR_EL2". With lots of enumeration 5067 * on a per-field basis. In current QEMU, this is condition 5068 * is arm_is_secure_below_el3. 5069 * 5070 * Since the v8.4 language applies to the entire register, and 5071 * appears to be backward compatible, use that. 5072 */ 5073 ret = 0; 5074 } else if (ret & HCR_TGE) { 5075 /* These bits are up-to-date as of ARMv8.4. */ 5076 if (ret & HCR_E2H) { 5077 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 5078 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 5079 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 5080 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE); 5081 } else { 5082 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 5083 } 5084 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 5085 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 5086 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 5087 HCR_TLOR); 5088 } 5089 5090 return ret; 5091 } 5092 5093 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 5094 uint64_t value) 5095 { 5096 /* 5097 * For A-profile AArch32 EL3, if NSACR.CP10 5098 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 5099 */ 5100 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 5101 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 5102 value &= ~(0x3 << 10); 5103 value |= env->cp15.cptr_el[2] & (0x3 << 10); 5104 } 5105 env->cp15.cptr_el[2] = value; 5106 } 5107 5108 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri) 5109 { 5110 /* 5111 * For A-profile AArch32 EL3, if NSACR.CP10 5112 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 5113 */ 5114 uint64_t value = env->cp15.cptr_el[2]; 5115 5116 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 5117 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 5118 value |= 0x3 << 10; 5119 } 5120 return value; 5121 } 5122 5123 static const ARMCPRegInfo el2_cp_reginfo[] = { 5124 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 5125 .type = ARM_CP_IO, 5126 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 5127 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 5128 .writefn = hcr_write }, 5129 { .name = "HCR", .state = ARM_CP_STATE_AA32, 5130 .type = ARM_CP_ALIAS | ARM_CP_IO, 5131 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 5132 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 5133 .writefn = hcr_writelow }, 5134 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 5135 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 5136 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5137 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 5138 .type = ARM_CP_ALIAS, 5139 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 5140 .access = PL2_RW, 5141 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 5142 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 5143 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 5144 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 5145 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 5146 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 5147 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 5148 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 5149 .type = ARM_CP_ALIAS, 5150 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 5151 .access = PL2_RW, 5152 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 5153 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 5154 .type = ARM_CP_ALIAS, 5155 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 5156 .access = PL2_RW, 5157 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 5158 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 5159 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 5160 .access = PL2_RW, .writefn = vbar_write, 5161 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 5162 .resetvalue = 0 }, 5163 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 5164 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 5165 .access = PL3_RW, .type = ARM_CP_ALIAS, 5166 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 5167 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 5168 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 5169 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 5170 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]), 5171 .readfn = cptr_el2_read, .writefn = cptr_el2_write }, 5172 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 5173 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 5174 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 5175 .resetvalue = 0 }, 5176 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 5177 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 5178 .access = PL2_RW, .type = ARM_CP_ALIAS, 5179 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 5180 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 5181 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 5182 .access = PL2_RW, .type = ARM_CP_CONST, 5183 .resetvalue = 0 }, 5184 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 5185 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 5186 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 5187 .access = PL2_RW, .type = ARM_CP_CONST, 5188 .resetvalue = 0 }, 5189 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 5190 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 5191 .access = PL2_RW, .type = ARM_CP_CONST, 5192 .resetvalue = 0 }, 5193 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 5194 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 5195 .access = PL2_RW, .type = ARM_CP_CONST, 5196 .resetvalue = 0 }, 5197 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 5198 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 5199 .access = PL2_RW, .writefn = vmsa_tcr_el12_write, 5200 /* no .raw_writefn or .resetfn needed as we never use mask/base_mask */ 5201 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 5202 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 5203 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 5204 .type = ARM_CP_ALIAS, 5205 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5206 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 5207 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 5208 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 5209 .access = PL2_RW, 5210 /* no .writefn needed as this can't cause an ASID change; 5211 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 5212 */ 5213 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 5214 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 5215 .cp = 15, .opc1 = 6, .crm = 2, 5216 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 5217 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5218 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 5219 .writefn = vttbr_write }, 5220 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 5221 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 5222 .access = PL2_RW, .writefn = vttbr_write, 5223 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 5224 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 5225 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 5226 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 5227 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 5228 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 5229 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 5230 .access = PL2_RW, .resetvalue = 0, 5231 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 5232 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 5233 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 5234 .access = PL2_RW, .resetvalue = 0, .writefn = vmsa_tcr_ttbr_el2_write, 5235 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 5236 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 5237 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 5238 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 5239 { .name = "TLBIALLNSNH", 5240 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 5241 .type = ARM_CP_NO_RAW, .access = PL2_W, 5242 .writefn = tlbiall_nsnh_write }, 5243 { .name = "TLBIALLNSNHIS", 5244 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 5245 .type = ARM_CP_NO_RAW, .access = PL2_W, 5246 .writefn = tlbiall_nsnh_is_write }, 5247 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 5248 .type = ARM_CP_NO_RAW, .access = PL2_W, 5249 .writefn = tlbiall_hyp_write }, 5250 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 5251 .type = ARM_CP_NO_RAW, .access = PL2_W, 5252 .writefn = tlbiall_hyp_is_write }, 5253 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 5254 .type = ARM_CP_NO_RAW, .access = PL2_W, 5255 .writefn = tlbimva_hyp_write }, 5256 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 5257 .type = ARM_CP_NO_RAW, .access = PL2_W, 5258 .writefn = tlbimva_hyp_is_write }, 5259 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 5260 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 5261 .type = ARM_CP_NO_RAW, .access = PL2_W, 5262 .writefn = tlbi_aa64_alle2_write }, 5263 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 5264 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 5265 .type = ARM_CP_NO_RAW, .access = PL2_W, 5266 .writefn = tlbi_aa64_vae2_write }, 5267 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 5268 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 5269 .access = PL2_W, .type = ARM_CP_NO_RAW, 5270 .writefn = tlbi_aa64_vae2_write }, 5271 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 5272 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 5273 .access = PL2_W, .type = ARM_CP_NO_RAW, 5274 .writefn = tlbi_aa64_alle2is_write }, 5275 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 5276 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 5277 .type = ARM_CP_NO_RAW, .access = PL2_W, 5278 .writefn = tlbi_aa64_vae2is_write }, 5279 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 5280 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 5281 .access = PL2_W, .type = ARM_CP_NO_RAW, 5282 .writefn = tlbi_aa64_vae2is_write }, 5283 #ifndef CONFIG_USER_ONLY 5284 /* Unlike the other EL2-related AT operations, these must 5285 * UNDEF from EL3 if EL2 is not implemented, which is why we 5286 * define them here rather than with the rest of the AT ops. 5287 */ 5288 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 5289 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 5290 .access = PL2_W, .accessfn = at_s1e2_access, 5291 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 }, 5292 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 5293 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 5294 .access = PL2_W, .accessfn = at_s1e2_access, 5295 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 }, 5296 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 5297 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 5298 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 5299 * to behave as if SCR.NS was 1. 5300 */ 5301 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 5302 .access = PL2_W, 5303 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 5304 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 5305 .access = PL2_W, 5306 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 5307 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 5308 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 5309 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 5310 * reset values as IMPDEF. We choose to reset to 3 to comply with 5311 * both ARMv7 and ARMv8. 5312 */ 5313 .access = PL2_RW, .resetvalue = 3, 5314 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 5315 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 5316 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 5317 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 5318 .writefn = gt_cntvoff_write, 5319 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 5320 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 5321 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 5322 .writefn = gt_cntvoff_write, 5323 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 5324 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 5325 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 5326 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 5327 .type = ARM_CP_IO, .access = PL2_RW, 5328 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 5329 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 5330 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 5331 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 5332 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 5333 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 5334 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 5335 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 5336 .resetfn = gt_hyp_timer_reset, 5337 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 5338 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 5339 .type = ARM_CP_IO, 5340 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 5341 .access = PL2_RW, 5342 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 5343 .resetvalue = 0, 5344 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 5345 #endif 5346 /* The only field of MDCR_EL2 that has a defined architectural reset value 5347 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we 5348 * don't implement any PMU event counters, so using zero as a reset 5349 * value for MDCR_EL2 is okay 5350 */ 5351 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 5352 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 5353 .access = PL2_RW, .resetvalue = 0, 5354 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), }, 5355 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 5356 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 5357 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5358 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 5359 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 5360 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 5361 .access = PL2_RW, 5362 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 5363 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 5364 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 5365 .access = PL2_RW, 5366 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 5367 REGINFO_SENTINEL 5368 }; 5369 5370 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 5371 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 5372 .type = ARM_CP_ALIAS | ARM_CP_IO, 5373 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 5374 .access = PL2_RW, 5375 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 5376 .writefn = hcr_writehigh }, 5377 REGINFO_SENTINEL 5378 }; 5379 5380 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 5381 bool isread) 5382 { 5383 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 5384 * At Secure EL1 it traps to EL3. 5385 */ 5386 if (arm_current_el(env) == 3) { 5387 return CP_ACCESS_OK; 5388 } 5389 if (arm_is_secure_below_el3(env)) { 5390 return CP_ACCESS_TRAP_EL3; 5391 } 5392 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 5393 if (isread) { 5394 return CP_ACCESS_OK; 5395 } 5396 return CP_ACCESS_TRAP_UNCATEGORIZED; 5397 } 5398 5399 static const ARMCPRegInfo el3_cp_reginfo[] = { 5400 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 5401 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 5402 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 5403 .resetvalue = 0, .writefn = scr_write }, 5404 { .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL, 5405 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 5406 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5407 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 5408 .writefn = scr_write }, 5409 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 5410 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 5411 .access = PL3_RW, .resetvalue = 0, 5412 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 5413 { .name = "SDER", 5414 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 5415 .access = PL3_RW, .resetvalue = 0, 5416 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 5417 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 5418 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5419 .writefn = vbar_write, .resetvalue = 0, 5420 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 5421 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 5422 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 5423 .access = PL3_RW, .resetvalue = 0, 5424 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 5425 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 5426 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 5427 .access = PL3_RW, 5428 /* no .writefn needed as this can't cause an ASID change; 5429 * we must provide a .raw_writefn and .resetfn because we handle 5430 * reset and migration for the AArch32 TTBCR(S), which might be 5431 * using mask and base_mask. 5432 */ 5433 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write, 5434 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 5435 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 5436 .type = ARM_CP_ALIAS, 5437 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 5438 .access = PL3_RW, 5439 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 5440 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 5441 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 5442 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 5443 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 5444 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 5445 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 5446 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 5447 .type = ARM_CP_ALIAS, 5448 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 5449 .access = PL3_RW, 5450 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 5451 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 5452 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 5453 .access = PL3_RW, .writefn = vbar_write, 5454 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 5455 .resetvalue = 0 }, 5456 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 5457 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 5458 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 5459 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 5460 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 5461 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 5462 .access = PL3_RW, .resetvalue = 0, 5463 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 5464 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 5465 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 5466 .access = PL3_RW, .type = ARM_CP_CONST, 5467 .resetvalue = 0 }, 5468 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 5469 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 5470 .access = PL3_RW, .type = ARM_CP_CONST, 5471 .resetvalue = 0 }, 5472 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 5473 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 5474 .access = PL3_RW, .type = ARM_CP_CONST, 5475 .resetvalue = 0 }, 5476 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 5477 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 5478 .access = PL3_W, .type = ARM_CP_NO_RAW, 5479 .writefn = tlbi_aa64_alle3is_write }, 5480 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 5481 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 5482 .access = PL3_W, .type = ARM_CP_NO_RAW, 5483 .writefn = tlbi_aa64_vae3is_write }, 5484 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 5485 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 5486 .access = PL3_W, .type = ARM_CP_NO_RAW, 5487 .writefn = tlbi_aa64_vae3is_write }, 5488 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 5489 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 5490 .access = PL3_W, .type = ARM_CP_NO_RAW, 5491 .writefn = tlbi_aa64_alle3_write }, 5492 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 5493 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 5494 .access = PL3_W, .type = ARM_CP_NO_RAW, 5495 .writefn = tlbi_aa64_vae3_write }, 5496 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 5497 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 5498 .access = PL3_W, .type = ARM_CP_NO_RAW, 5499 .writefn = tlbi_aa64_vae3_write }, 5500 REGINFO_SENTINEL 5501 }; 5502 5503 #ifndef CONFIG_USER_ONLY 5504 /* Test if system register redirection is to occur in the current state. */ 5505 static bool redirect_for_e2h(CPUARMState *env) 5506 { 5507 return arm_current_el(env) == 2 && (arm_hcr_el2_eff(env) & HCR_E2H); 5508 } 5509 5510 static uint64_t el2_e2h_read(CPUARMState *env, const ARMCPRegInfo *ri) 5511 { 5512 CPReadFn *readfn; 5513 5514 if (redirect_for_e2h(env)) { 5515 /* Switch to the saved EL2 version of the register. */ 5516 ri = ri->opaque; 5517 readfn = ri->readfn; 5518 } else { 5519 readfn = ri->orig_readfn; 5520 } 5521 if (readfn == NULL) { 5522 readfn = raw_read; 5523 } 5524 return readfn(env, ri); 5525 } 5526 5527 static void el2_e2h_write(CPUARMState *env, const ARMCPRegInfo *ri, 5528 uint64_t value) 5529 { 5530 CPWriteFn *writefn; 5531 5532 if (redirect_for_e2h(env)) { 5533 /* Switch to the saved EL2 version of the register. */ 5534 ri = ri->opaque; 5535 writefn = ri->writefn; 5536 } else { 5537 writefn = ri->orig_writefn; 5538 } 5539 if (writefn == NULL) { 5540 writefn = raw_write; 5541 } 5542 writefn(env, ri, value); 5543 } 5544 5545 static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu) 5546 { 5547 struct E2HAlias { 5548 uint32_t src_key, dst_key, new_key; 5549 const char *src_name, *dst_name, *new_name; 5550 bool (*feature)(const ARMISARegisters *id); 5551 }; 5552 5553 #define K(op0, op1, crn, crm, op2) \ 5554 ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2) 5555 5556 static const struct E2HAlias aliases[] = { 5557 { K(3, 0, 1, 0, 0), K(3, 4, 1, 0, 0), K(3, 5, 1, 0, 0), 5558 "SCTLR", "SCTLR_EL2", "SCTLR_EL12" }, 5559 { K(3, 0, 1, 0, 2), K(3, 4, 1, 1, 2), K(3, 5, 1, 0, 2), 5560 "CPACR", "CPTR_EL2", "CPACR_EL12" }, 5561 { K(3, 0, 2, 0, 0), K(3, 4, 2, 0, 0), K(3, 5, 2, 0, 0), 5562 "TTBR0_EL1", "TTBR0_EL2", "TTBR0_EL12" }, 5563 { K(3, 0, 2, 0, 1), K(3, 4, 2, 0, 1), K(3, 5, 2, 0, 1), 5564 "TTBR1_EL1", "TTBR1_EL2", "TTBR1_EL12" }, 5565 { K(3, 0, 2, 0, 2), K(3, 4, 2, 0, 2), K(3, 5, 2, 0, 2), 5566 "TCR_EL1", "TCR_EL2", "TCR_EL12" }, 5567 { K(3, 0, 4, 0, 0), K(3, 4, 4, 0, 0), K(3, 5, 4, 0, 0), 5568 "SPSR_EL1", "SPSR_EL2", "SPSR_EL12" }, 5569 { K(3, 0, 4, 0, 1), K(3, 4, 4, 0, 1), K(3, 5, 4, 0, 1), 5570 "ELR_EL1", "ELR_EL2", "ELR_EL12" }, 5571 { K(3, 0, 5, 1, 0), K(3, 4, 5, 1, 0), K(3, 5, 5, 1, 0), 5572 "AFSR0_EL1", "AFSR0_EL2", "AFSR0_EL12" }, 5573 { K(3, 0, 5, 1, 1), K(3, 4, 5, 1, 1), K(3, 5, 5, 1, 1), 5574 "AFSR1_EL1", "AFSR1_EL2", "AFSR1_EL12" }, 5575 { K(3, 0, 5, 2, 0), K(3, 4, 5, 2, 0), K(3, 5, 5, 2, 0), 5576 "ESR_EL1", "ESR_EL2", "ESR_EL12" }, 5577 { K(3, 0, 6, 0, 0), K(3, 4, 6, 0, 0), K(3, 5, 6, 0, 0), 5578 "FAR_EL1", "FAR_EL2", "FAR_EL12" }, 5579 { K(3, 0, 10, 2, 0), K(3, 4, 10, 2, 0), K(3, 5, 10, 2, 0), 5580 "MAIR_EL1", "MAIR_EL2", "MAIR_EL12" }, 5581 { K(3, 0, 10, 3, 0), K(3, 4, 10, 3, 0), K(3, 5, 10, 3, 0), 5582 "AMAIR0", "AMAIR_EL2", "AMAIR_EL12" }, 5583 { K(3, 0, 12, 0, 0), K(3, 4, 12, 0, 0), K(3, 5, 12, 0, 0), 5584 "VBAR", "VBAR_EL2", "VBAR_EL12" }, 5585 { K(3, 0, 13, 0, 1), K(3, 4, 13, 0, 1), K(3, 5, 13, 0, 1), 5586 "CONTEXTIDR_EL1", "CONTEXTIDR_EL2", "CONTEXTIDR_EL12" }, 5587 { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0), 5588 "CNTKCTL", "CNTHCTL_EL2", "CNTKCTL_EL12" }, 5589 5590 /* 5591 * Note that redirection of ZCR is mentioned in the description 5592 * of ZCR_EL2, and aliasing in the description of ZCR_EL1, but 5593 * not in the summary table. 5594 */ 5595 { K(3, 0, 1, 2, 0), K(3, 4, 1, 2, 0), K(3, 5, 1, 2, 0), 5596 "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve }, 5597 5598 /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */ 5599 /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */ 5600 }; 5601 #undef K 5602 5603 size_t i; 5604 5605 for (i = 0; i < ARRAY_SIZE(aliases); i++) { 5606 const struct E2HAlias *a = &aliases[i]; 5607 ARMCPRegInfo *src_reg, *dst_reg; 5608 5609 if (a->feature && !a->feature(&cpu->isar)) { 5610 continue; 5611 } 5612 5613 src_reg = g_hash_table_lookup(cpu->cp_regs, &a->src_key); 5614 dst_reg = g_hash_table_lookup(cpu->cp_regs, &a->dst_key); 5615 g_assert(src_reg != NULL); 5616 g_assert(dst_reg != NULL); 5617 5618 /* Cross-compare names to detect typos in the keys. */ 5619 g_assert(strcmp(src_reg->name, a->src_name) == 0); 5620 g_assert(strcmp(dst_reg->name, a->dst_name) == 0); 5621 5622 /* None of the core system registers use opaque; we will. */ 5623 g_assert(src_reg->opaque == NULL); 5624 5625 /* Create alias before redirection so we dup the right data. */ 5626 if (a->new_key) { 5627 ARMCPRegInfo *new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo)); 5628 uint32_t *new_key = g_memdup(&a->new_key, sizeof(uint32_t)); 5629 bool ok; 5630 5631 new_reg->name = a->new_name; 5632 new_reg->type |= ARM_CP_ALIAS; 5633 /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place. */ 5634 new_reg->access &= PL2_RW | PL3_RW; 5635 5636 ok = g_hash_table_insert(cpu->cp_regs, new_key, new_reg); 5637 g_assert(ok); 5638 } 5639 5640 src_reg->opaque = dst_reg; 5641 src_reg->orig_readfn = src_reg->readfn ?: raw_read; 5642 src_reg->orig_writefn = src_reg->writefn ?: raw_write; 5643 if (!src_reg->raw_readfn) { 5644 src_reg->raw_readfn = raw_read; 5645 } 5646 if (!src_reg->raw_writefn) { 5647 src_reg->raw_writefn = raw_write; 5648 } 5649 src_reg->readfn = el2_e2h_read; 5650 src_reg->writefn = el2_e2h_write; 5651 } 5652 } 5653 #endif 5654 5655 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 5656 bool isread) 5657 { 5658 int cur_el = arm_current_el(env); 5659 5660 if (cur_el < 2) { 5661 uint64_t hcr = arm_hcr_el2_eff(env); 5662 5663 if (cur_el == 0) { 5664 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 5665 if (!(env->cp15.sctlr_el[2] & SCTLR_UCT)) { 5666 return CP_ACCESS_TRAP_EL2; 5667 } 5668 } else { 5669 if (!(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 5670 return CP_ACCESS_TRAP; 5671 } 5672 if (hcr & HCR_TID2) { 5673 return CP_ACCESS_TRAP_EL2; 5674 } 5675 } 5676 } else if (hcr & HCR_TID2) { 5677 return CP_ACCESS_TRAP_EL2; 5678 } 5679 } 5680 5681 if (arm_current_el(env) < 2 && arm_hcr_el2_eff(env) & HCR_TID2) { 5682 return CP_ACCESS_TRAP_EL2; 5683 } 5684 5685 return CP_ACCESS_OK; 5686 } 5687 5688 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, 5689 uint64_t value) 5690 { 5691 /* Writes to OSLAR_EL1 may update the OS lock status, which can be 5692 * read via a bit in OSLSR_EL1. 5693 */ 5694 int oslock; 5695 5696 if (ri->state == ARM_CP_STATE_AA32) { 5697 oslock = (value == 0xC5ACCE55); 5698 } else { 5699 oslock = value & 1; 5700 } 5701 5702 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock); 5703 } 5704 5705 static const ARMCPRegInfo debug_cp_reginfo[] = { 5706 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped 5707 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; 5708 * unlike DBGDRAR it is never accessible from EL0. 5709 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64 5710 * accessor. 5711 */ 5712 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, 5713 .access = PL0_R, .accessfn = access_tdra, 5714 .type = ARM_CP_CONST, .resetvalue = 0 }, 5715 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, 5716 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 5717 .access = PL1_R, .accessfn = access_tdra, 5718 .type = ARM_CP_CONST, .resetvalue = 0 }, 5719 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 5720 .access = PL0_R, .accessfn = access_tdra, 5721 .type = ARM_CP_CONST, .resetvalue = 0 }, 5722 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ 5723 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, 5724 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5725 .access = PL1_RW, .accessfn = access_tda, 5726 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), 5727 .resetvalue = 0 }, 5728 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1. 5729 * We don't implement the configurable EL0 access. 5730 */ 5731 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH, 5732 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5733 .type = ARM_CP_ALIAS, 5734 .access = PL1_R, .accessfn = access_tda, 5735 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, 5736 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, 5737 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, 5738 .access = PL1_W, .type = ARM_CP_NO_RAW, 5739 .accessfn = access_tdosa, 5740 .writefn = oslar_write }, 5741 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, 5742 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, 5743 .access = PL1_R, .resetvalue = 10, 5744 .accessfn = access_tdosa, 5745 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, 5746 /* Dummy OSDLR_EL1: 32-bit Linux will read this */ 5747 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, 5748 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, 5749 .access = PL1_RW, .accessfn = access_tdosa, 5750 .type = ARM_CP_NOP }, 5751 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't 5752 * implement vector catch debug events yet. 5753 */ 5754 { .name = "DBGVCR", 5755 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 5756 .access = PL1_RW, .accessfn = access_tda, 5757 .type = ARM_CP_NOP }, 5758 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor 5759 * to save and restore a 32-bit guest's DBGVCR) 5760 */ 5761 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64, 5762 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0, 5763 .access = PL2_RW, .accessfn = access_tda, 5764 .type = ARM_CP_NOP }, 5765 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications 5766 * Channel but Linux may try to access this register. The 32-bit 5767 * alias is DBGDCCINT. 5768 */ 5769 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH, 5770 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5771 .access = PL1_RW, .accessfn = access_tda, 5772 .type = ARM_CP_NOP }, 5773 REGINFO_SENTINEL 5774 }; 5775 5776 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = { 5777 /* 64 bit access versions of the (dummy) debug registers */ 5778 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0, 5779 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5780 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0, 5781 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5782 REGINFO_SENTINEL 5783 }; 5784 5785 /* Return the exception level to which exceptions should be taken 5786 * via SVEAccessTrap. If an exception should be routed through 5787 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should 5788 * take care of raising that exception. 5789 * C.f. the ARM pseudocode function CheckSVEEnabled. 5790 */ 5791 int sve_exception_el(CPUARMState *env, int el) 5792 { 5793 #ifndef CONFIG_USER_ONLY 5794 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 5795 5796 if (el <= 1 && (hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 5797 bool disabled = false; 5798 5799 /* The CPACR.ZEN controls traps to EL1: 5800 * 0, 2 : trap EL0 and EL1 accesses 5801 * 1 : trap only EL0 accesses 5802 * 3 : trap no accesses 5803 */ 5804 if (!extract32(env->cp15.cpacr_el1, 16, 1)) { 5805 disabled = true; 5806 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) { 5807 disabled = el == 0; 5808 } 5809 if (disabled) { 5810 /* route_to_el2 */ 5811 return hcr_el2 & HCR_TGE ? 2 : 1; 5812 } 5813 5814 /* Check CPACR.FPEN. */ 5815 if (!extract32(env->cp15.cpacr_el1, 20, 1)) { 5816 disabled = true; 5817 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) { 5818 disabled = el == 0; 5819 } 5820 if (disabled) { 5821 return 0; 5822 } 5823 } 5824 5825 /* CPTR_EL2. Since TZ and TFP are positive, 5826 * they will be zero when EL2 is not present. 5827 */ 5828 if (el <= 2 && !arm_is_secure_below_el3(env)) { 5829 if (env->cp15.cptr_el[2] & CPTR_TZ) { 5830 return 2; 5831 } 5832 if (env->cp15.cptr_el[2] & CPTR_TFP) { 5833 return 0; 5834 } 5835 } 5836 5837 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 5838 if (arm_feature(env, ARM_FEATURE_EL3) 5839 && !(env->cp15.cptr_el[3] & CPTR_EZ)) { 5840 return 3; 5841 } 5842 #endif 5843 return 0; 5844 } 5845 5846 static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) 5847 { 5848 uint32_t end_len; 5849 5850 end_len = start_len &= 0xf; 5851 if (!test_bit(start_len, cpu->sve_vq_map)) { 5852 end_len = find_last_bit(cpu->sve_vq_map, start_len); 5853 assert(end_len < start_len); 5854 } 5855 return end_len; 5856 } 5857 5858 /* 5859 * Given that SVE is enabled, return the vector length for EL. 5860 */ 5861 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) 5862 { 5863 ARMCPU *cpu = env_archcpu(env); 5864 uint32_t zcr_len = cpu->sve_max_vq - 1; 5865 5866 if (el <= 1) { 5867 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]); 5868 } 5869 if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) { 5870 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]); 5871 } 5872 if (arm_feature(env, ARM_FEATURE_EL3)) { 5873 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); 5874 } 5875 5876 return sve_zcr_get_valid_len(cpu, zcr_len); 5877 } 5878 5879 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5880 uint64_t value) 5881 { 5882 int cur_el = arm_current_el(env); 5883 int old_len = sve_zcr_len_for_el(env, cur_el); 5884 int new_len; 5885 5886 /* Bits other than [3:0] are RAZ/WI. */ 5887 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16); 5888 raw_write(env, ri, value & 0xf); 5889 5890 /* 5891 * Because we arrived here, we know both FP and SVE are enabled; 5892 * otherwise we would have trapped access to the ZCR_ELn register. 5893 */ 5894 new_len = sve_zcr_len_for_el(env, cur_el); 5895 if (new_len < old_len) { 5896 aarch64_sve_narrow_vq(env, new_len + 1); 5897 } 5898 } 5899 5900 static const ARMCPRegInfo zcr_el1_reginfo = { 5901 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 5902 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 5903 .access = PL1_RW, .type = ARM_CP_SVE, 5904 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 5905 .writefn = zcr_write, .raw_writefn = raw_write 5906 }; 5907 5908 static const ARMCPRegInfo zcr_el2_reginfo = { 5909 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5910 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5911 .access = PL2_RW, .type = ARM_CP_SVE, 5912 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 5913 .writefn = zcr_write, .raw_writefn = raw_write 5914 }; 5915 5916 static const ARMCPRegInfo zcr_no_el2_reginfo = { 5917 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5918 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5919 .access = PL2_RW, .type = ARM_CP_SVE, 5920 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore 5921 }; 5922 5923 static const ARMCPRegInfo zcr_el3_reginfo = { 5924 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 5925 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 5926 .access = PL3_RW, .type = ARM_CP_SVE, 5927 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 5928 .writefn = zcr_write, .raw_writefn = raw_write 5929 }; 5930 5931 void hw_watchpoint_update(ARMCPU *cpu, int n) 5932 { 5933 CPUARMState *env = &cpu->env; 5934 vaddr len = 0; 5935 vaddr wvr = env->cp15.dbgwvr[n]; 5936 uint64_t wcr = env->cp15.dbgwcr[n]; 5937 int mask; 5938 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 5939 5940 if (env->cpu_watchpoint[n]) { 5941 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); 5942 env->cpu_watchpoint[n] = NULL; 5943 } 5944 5945 if (!extract64(wcr, 0, 1)) { 5946 /* E bit clear : watchpoint disabled */ 5947 return; 5948 } 5949 5950 switch (extract64(wcr, 3, 2)) { 5951 case 0: 5952 /* LSC 00 is reserved and must behave as if the wp is disabled */ 5953 return; 5954 case 1: 5955 flags |= BP_MEM_READ; 5956 break; 5957 case 2: 5958 flags |= BP_MEM_WRITE; 5959 break; 5960 case 3: 5961 flags |= BP_MEM_ACCESS; 5962 break; 5963 } 5964 5965 /* Attempts to use both MASK and BAS fields simultaneously are 5966 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, 5967 * thus generating a watchpoint for every byte in the masked region. 5968 */ 5969 mask = extract64(wcr, 24, 4); 5970 if (mask == 1 || mask == 2) { 5971 /* Reserved values of MASK; we must act as if the mask value was 5972 * some non-reserved value, or as if the watchpoint were disabled. 5973 * We choose the latter. 5974 */ 5975 return; 5976 } else if (mask) { 5977 /* Watchpoint covers an aligned area up to 2GB in size */ 5978 len = 1ULL << mask; 5979 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE 5980 * whether the watchpoint fires when the unmasked bits match; we opt 5981 * to generate the exceptions. 5982 */ 5983 wvr &= ~(len - 1); 5984 } else { 5985 /* Watchpoint covers bytes defined by the byte address select bits */ 5986 int bas = extract64(wcr, 5, 8); 5987 int basstart; 5988 5989 if (bas == 0) { 5990 /* This must act as if the watchpoint is disabled */ 5991 return; 5992 } 5993 5994 if (extract64(wvr, 2, 1)) { 5995 /* Deprecated case of an only 4-aligned address. BAS[7:4] are 5996 * ignored, and BAS[3:0] define which bytes to watch. 5997 */ 5998 bas &= 0xf; 5999 } 6000 /* The BAS bits are supposed to be programmed to indicate a contiguous 6001 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether 6002 * we fire for each byte in the word/doubleword addressed by the WVR. 6003 * We choose to ignore any non-zero bits after the first range of 1s. 6004 */ 6005 basstart = ctz32(bas); 6006 len = cto32(bas >> basstart); 6007 wvr += basstart; 6008 } 6009 6010 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, 6011 &env->cpu_watchpoint[n]); 6012 } 6013 6014 void hw_watchpoint_update_all(ARMCPU *cpu) 6015 { 6016 int i; 6017 CPUARMState *env = &cpu->env; 6018 6019 /* Completely clear out existing QEMU watchpoints and our array, to 6020 * avoid possible stale entries following migration load. 6021 */ 6022 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); 6023 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); 6024 6025 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { 6026 hw_watchpoint_update(cpu, i); 6027 } 6028 } 6029 6030 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6031 uint64_t value) 6032 { 6033 ARMCPU *cpu = env_archcpu(env); 6034 int i = ri->crm; 6035 6036 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the 6037 * register reads and behaves as if values written are sign extended. 6038 * Bits [1:0] are RES0. 6039 */ 6040 value = sextract64(value, 0, 49) & ~3ULL; 6041 6042 raw_write(env, ri, value); 6043 hw_watchpoint_update(cpu, i); 6044 } 6045 6046 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6047 uint64_t value) 6048 { 6049 ARMCPU *cpu = env_archcpu(env); 6050 int i = ri->crm; 6051 6052 raw_write(env, ri, value); 6053 hw_watchpoint_update(cpu, i); 6054 } 6055 6056 void hw_breakpoint_update(ARMCPU *cpu, int n) 6057 { 6058 CPUARMState *env = &cpu->env; 6059 uint64_t bvr = env->cp15.dbgbvr[n]; 6060 uint64_t bcr = env->cp15.dbgbcr[n]; 6061 vaddr addr; 6062 int bt; 6063 int flags = BP_CPU; 6064 6065 if (env->cpu_breakpoint[n]) { 6066 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); 6067 env->cpu_breakpoint[n] = NULL; 6068 } 6069 6070 if (!extract64(bcr, 0, 1)) { 6071 /* E bit clear : watchpoint disabled */ 6072 return; 6073 } 6074 6075 bt = extract64(bcr, 20, 4); 6076 6077 switch (bt) { 6078 case 4: /* unlinked address mismatch (reserved if AArch64) */ 6079 case 5: /* linked address mismatch (reserved if AArch64) */ 6080 qemu_log_mask(LOG_UNIMP, 6081 "arm: address mismatch breakpoint types not implemented\n"); 6082 return; 6083 case 0: /* unlinked address match */ 6084 case 1: /* linked address match */ 6085 { 6086 /* Bits [63:49] are hardwired to the value of bit [48]; that is, 6087 * we behave as if the register was sign extended. Bits [1:0] are 6088 * RES0. The BAS field is used to allow setting breakpoints on 16 6089 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether 6090 * a bp will fire if the addresses covered by the bp and the addresses 6091 * covered by the insn overlap but the insn doesn't start at the 6092 * start of the bp address range. We choose to require the insn and 6093 * the bp to have the same address. The constraints on writing to 6094 * BAS enforced in dbgbcr_write mean we have only four cases: 6095 * 0b0000 => no breakpoint 6096 * 0b0011 => breakpoint on addr 6097 * 0b1100 => breakpoint on addr + 2 6098 * 0b1111 => breakpoint on addr 6099 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). 6100 */ 6101 int bas = extract64(bcr, 5, 4); 6102 addr = sextract64(bvr, 0, 49) & ~3ULL; 6103 if (bas == 0) { 6104 return; 6105 } 6106 if (bas == 0xc) { 6107 addr += 2; 6108 } 6109 break; 6110 } 6111 case 2: /* unlinked context ID match */ 6112 case 8: /* unlinked VMID match (reserved if no EL2) */ 6113 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ 6114 qemu_log_mask(LOG_UNIMP, 6115 "arm: unlinked context breakpoint types not implemented\n"); 6116 return; 6117 case 9: /* linked VMID match (reserved if no EL2) */ 6118 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 6119 case 3: /* linked context ID match */ 6120 default: 6121 /* We must generate no events for Linked context matches (unless 6122 * they are linked to by some other bp/wp, which is handled in 6123 * updates for the linking bp/wp). We choose to also generate no events 6124 * for reserved values. 6125 */ 6126 return; 6127 } 6128 6129 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); 6130 } 6131 6132 void hw_breakpoint_update_all(ARMCPU *cpu) 6133 { 6134 int i; 6135 CPUARMState *env = &cpu->env; 6136 6137 /* Completely clear out existing QEMU breakpoints and our array, to 6138 * avoid possible stale entries following migration load. 6139 */ 6140 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); 6141 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); 6142 6143 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { 6144 hw_breakpoint_update(cpu, i); 6145 } 6146 } 6147 6148 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6149 uint64_t value) 6150 { 6151 ARMCPU *cpu = env_archcpu(env); 6152 int i = ri->crm; 6153 6154 raw_write(env, ri, value); 6155 hw_breakpoint_update(cpu, i); 6156 } 6157 6158 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6159 uint64_t value) 6160 { 6161 ARMCPU *cpu = env_archcpu(env); 6162 int i = ri->crm; 6163 6164 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only 6165 * copy of BAS[0]. 6166 */ 6167 value = deposit64(value, 6, 1, extract64(value, 5, 1)); 6168 value = deposit64(value, 8, 1, extract64(value, 7, 1)); 6169 6170 raw_write(env, ri, value); 6171 hw_breakpoint_update(cpu, i); 6172 } 6173 6174 static void define_debug_regs(ARMCPU *cpu) 6175 { 6176 /* Define v7 and v8 architectural debug registers. 6177 * These are just dummy implementations for now. 6178 */ 6179 int i; 6180 int wrps, brps, ctx_cmps; 6181 ARMCPRegInfo dbgdidr = { 6182 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 6183 .access = PL0_R, .accessfn = access_tda, 6184 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, 6185 }; 6186 6187 /* Note that all these register fields hold "number of Xs minus 1". */ 6188 brps = extract32(cpu->dbgdidr, 24, 4); 6189 wrps = extract32(cpu->dbgdidr, 28, 4); 6190 ctx_cmps = extract32(cpu->dbgdidr, 20, 4); 6191 6192 assert(ctx_cmps <= brps); 6193 6194 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties 6195 * of the debug registers such as number of breakpoints; 6196 * check that if they both exist then they agree. 6197 */ 6198 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 6199 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps); 6200 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps); 6201 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps); 6202 } 6203 6204 define_one_arm_cp_reg(cpu, &dbgdidr); 6205 define_arm_cp_regs(cpu, debug_cp_reginfo); 6206 6207 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { 6208 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); 6209 } 6210 6211 for (i = 0; i < brps + 1; i++) { 6212 ARMCPRegInfo dbgregs[] = { 6213 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH, 6214 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, 6215 .access = PL1_RW, .accessfn = access_tda, 6216 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), 6217 .writefn = dbgbvr_write, .raw_writefn = raw_write 6218 }, 6219 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH, 6220 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, 6221 .access = PL1_RW, .accessfn = access_tda, 6222 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), 6223 .writefn = dbgbcr_write, .raw_writefn = raw_write 6224 }, 6225 REGINFO_SENTINEL 6226 }; 6227 define_arm_cp_regs(cpu, dbgregs); 6228 } 6229 6230 for (i = 0; i < wrps + 1; i++) { 6231 ARMCPRegInfo dbgregs[] = { 6232 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH, 6233 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, 6234 .access = PL1_RW, .accessfn = access_tda, 6235 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), 6236 .writefn = dbgwvr_write, .raw_writefn = raw_write 6237 }, 6238 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH, 6239 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, 6240 .access = PL1_RW, .accessfn = access_tda, 6241 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), 6242 .writefn = dbgwcr_write, .raw_writefn = raw_write 6243 }, 6244 REGINFO_SENTINEL 6245 }; 6246 define_arm_cp_regs(cpu, dbgregs); 6247 } 6248 } 6249 6250 /* We don't know until after realize whether there's a GICv3 6251 * attached, and that is what registers the gicv3 sysregs. 6252 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 6253 * at runtime. 6254 */ 6255 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 6256 { 6257 ARMCPU *cpu = env_archcpu(env); 6258 uint64_t pfr1 = cpu->id_pfr1; 6259 6260 if (env->gicv3state) { 6261 pfr1 |= 1 << 28; 6262 } 6263 return pfr1; 6264 } 6265 6266 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 6267 { 6268 ARMCPU *cpu = env_archcpu(env); 6269 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 6270 6271 if (env->gicv3state) { 6272 pfr0 |= 1 << 24; 6273 } 6274 return pfr0; 6275 } 6276 6277 /* Shared logic between LORID and the rest of the LOR* registers. 6278 * Secure state has already been delt with. 6279 */ 6280 static CPAccessResult access_lor_ns(CPUARMState *env) 6281 { 6282 int el = arm_current_el(env); 6283 6284 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 6285 return CP_ACCESS_TRAP_EL2; 6286 } 6287 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 6288 return CP_ACCESS_TRAP_EL3; 6289 } 6290 return CP_ACCESS_OK; 6291 } 6292 6293 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri, 6294 bool isread) 6295 { 6296 if (arm_is_secure_below_el3(env)) { 6297 /* Access ok in secure mode. */ 6298 return CP_ACCESS_OK; 6299 } 6300 return access_lor_ns(env); 6301 } 6302 6303 static CPAccessResult access_lor_other(CPUARMState *env, 6304 const ARMCPRegInfo *ri, bool isread) 6305 { 6306 if (arm_is_secure_below_el3(env)) { 6307 /* Access denied in secure mode. */ 6308 return CP_ACCESS_TRAP; 6309 } 6310 return access_lor_ns(env); 6311 } 6312 6313 #ifdef TARGET_AARCH64 6314 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 6315 bool isread) 6316 { 6317 int el = arm_current_el(env); 6318 6319 if (el < 2 && 6320 arm_feature(env, ARM_FEATURE_EL2) && 6321 !(arm_hcr_el2_eff(env) & HCR_APK)) { 6322 return CP_ACCESS_TRAP_EL2; 6323 } 6324 if (el < 3 && 6325 arm_feature(env, ARM_FEATURE_EL3) && 6326 !(env->cp15.scr_el3 & SCR_APK)) { 6327 return CP_ACCESS_TRAP_EL3; 6328 } 6329 return CP_ACCESS_OK; 6330 } 6331 6332 static const ARMCPRegInfo pauth_reginfo[] = { 6333 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6334 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 6335 .access = PL1_RW, .accessfn = access_pauth, 6336 .fieldoffset = offsetof(CPUARMState, keys.apda.lo) }, 6337 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6338 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 6339 .access = PL1_RW, .accessfn = access_pauth, 6340 .fieldoffset = offsetof(CPUARMState, keys.apda.hi) }, 6341 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6342 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 6343 .access = PL1_RW, .accessfn = access_pauth, 6344 .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) }, 6345 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6346 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 6347 .access = PL1_RW, .accessfn = access_pauth, 6348 .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) }, 6349 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6350 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 6351 .access = PL1_RW, .accessfn = access_pauth, 6352 .fieldoffset = offsetof(CPUARMState, keys.apga.lo) }, 6353 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6354 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 6355 .access = PL1_RW, .accessfn = access_pauth, 6356 .fieldoffset = offsetof(CPUARMState, keys.apga.hi) }, 6357 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6358 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 6359 .access = PL1_RW, .accessfn = access_pauth, 6360 .fieldoffset = offsetof(CPUARMState, keys.apia.lo) }, 6361 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6362 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 6363 .access = PL1_RW, .accessfn = access_pauth, 6364 .fieldoffset = offsetof(CPUARMState, keys.apia.hi) }, 6365 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6366 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 6367 .access = PL1_RW, .accessfn = access_pauth, 6368 .fieldoffset = offsetof(CPUARMState, keys.apib.lo) }, 6369 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6370 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 6371 .access = PL1_RW, .accessfn = access_pauth, 6372 .fieldoffset = offsetof(CPUARMState, keys.apib.hi) }, 6373 REGINFO_SENTINEL 6374 }; 6375 6376 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 6377 { 6378 Error *err = NULL; 6379 uint64_t ret; 6380 6381 /* Success sets NZCV = 0000. */ 6382 env->NF = env->CF = env->VF = 0, env->ZF = 1; 6383 6384 if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) { 6385 /* 6386 * ??? Failed, for unknown reasons in the crypto subsystem. 6387 * The best we can do is log the reason and return the 6388 * timed-out indication to the guest. There is no reason 6389 * we know to expect this failure to be transitory, so the 6390 * guest may well hang retrying the operation. 6391 */ 6392 qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s", 6393 ri->name, error_get_pretty(err)); 6394 error_free(err); 6395 6396 env->ZF = 0; /* NZCF = 0100 */ 6397 return 0; 6398 } 6399 return ret; 6400 } 6401 6402 /* We do not support re-seeding, so the two registers operate the same. */ 6403 static const ARMCPRegInfo rndr_reginfo[] = { 6404 { .name = "RNDR", .state = ARM_CP_STATE_AA64, 6405 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 6406 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0, 6407 .access = PL0_R, .readfn = rndr_readfn }, 6408 { .name = "RNDRRS", .state = ARM_CP_STATE_AA64, 6409 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 6410 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1, 6411 .access = PL0_R, .readfn = rndr_readfn }, 6412 REGINFO_SENTINEL 6413 }; 6414 6415 #ifndef CONFIG_USER_ONLY 6416 static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque, 6417 uint64_t value) 6418 { 6419 ARMCPU *cpu = env_archcpu(env); 6420 /* CTR_EL0 System register -> DminLine, bits [19:16] */ 6421 uint64_t dline_size = 4 << ((cpu->ctr >> 16) & 0xF); 6422 uint64_t vaddr_in = (uint64_t) value; 6423 uint64_t vaddr = vaddr_in & ~(dline_size - 1); 6424 void *haddr; 6425 int mem_idx = cpu_mmu_index(env, false); 6426 6427 /* This won't be crossing page boundaries */ 6428 haddr = probe_read(env, vaddr, dline_size, mem_idx, GETPC()); 6429 if (haddr) { 6430 6431 ram_addr_t offset; 6432 MemoryRegion *mr; 6433 6434 /* RCU lock is already being held */ 6435 mr = memory_region_from_host(haddr, &offset); 6436 6437 if (mr) { 6438 memory_region_do_writeback(mr, offset, dline_size); 6439 } 6440 } 6441 } 6442 6443 static const ARMCPRegInfo dcpop_reg[] = { 6444 { .name = "DC_CVAP", .state = ARM_CP_STATE_AA64, 6445 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1, 6446 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 6447 .accessfn = aa64_cacheop_access, .writefn = dccvap_writefn }, 6448 REGINFO_SENTINEL 6449 }; 6450 6451 static const ARMCPRegInfo dcpodp_reg[] = { 6452 { .name = "DC_CVADP", .state = ARM_CP_STATE_AA64, 6453 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1, 6454 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 6455 .accessfn = aa64_cacheop_access, .writefn = dccvap_writefn }, 6456 REGINFO_SENTINEL 6457 }; 6458 #endif /*CONFIG_USER_ONLY*/ 6459 6460 #endif 6461 6462 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri, 6463 bool isread) 6464 { 6465 int el = arm_current_el(env); 6466 6467 if (el == 0) { 6468 uint64_t sctlr = arm_sctlr(env, el); 6469 if (!(sctlr & SCTLR_EnRCTX)) { 6470 return CP_ACCESS_TRAP; 6471 } 6472 } else if (el == 1) { 6473 uint64_t hcr = arm_hcr_el2_eff(env); 6474 if (hcr & HCR_NV) { 6475 return CP_ACCESS_TRAP_EL2; 6476 } 6477 } 6478 return CP_ACCESS_OK; 6479 } 6480 6481 static const ARMCPRegInfo predinv_reginfo[] = { 6482 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64, 6483 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4, 6484 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6485 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64, 6486 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5, 6487 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6488 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64, 6489 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7, 6490 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6491 /* 6492 * Note the AArch32 opcodes have a different OPC1. 6493 */ 6494 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32, 6495 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4, 6496 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6497 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32, 6498 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5, 6499 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6500 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32, 6501 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7, 6502 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6503 REGINFO_SENTINEL 6504 }; 6505 6506 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 6507 bool isread) 6508 { 6509 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) { 6510 return CP_ACCESS_TRAP_EL2; 6511 } 6512 6513 return CP_ACCESS_OK; 6514 } 6515 6516 static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 6517 bool isread) 6518 { 6519 if (arm_feature(env, ARM_FEATURE_V8)) { 6520 return access_aa64_tid3(env, ri, isread); 6521 } 6522 6523 return CP_ACCESS_OK; 6524 } 6525 6526 static CPAccessResult access_jazelle(CPUARMState *env, const ARMCPRegInfo *ri, 6527 bool isread) 6528 { 6529 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID0)) { 6530 return CP_ACCESS_TRAP_EL2; 6531 } 6532 6533 return CP_ACCESS_OK; 6534 } 6535 6536 static const ARMCPRegInfo jazelle_regs[] = { 6537 { .name = "JIDR", 6538 .cp = 14, .crn = 0, .crm = 0, .opc1 = 7, .opc2 = 0, 6539 .access = PL1_R, .accessfn = access_jazelle, 6540 .type = ARM_CP_CONST, .resetvalue = 0 }, 6541 { .name = "JOSCR", 6542 .cp = 14, .crn = 1, .crm = 0, .opc1 = 7, .opc2 = 0, 6543 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 6544 { .name = "JMCR", 6545 .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0, 6546 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 6547 REGINFO_SENTINEL 6548 }; 6549 6550 static const ARMCPRegInfo vhe_reginfo[] = { 6551 { .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64, 6552 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1, 6553 .access = PL2_RW, 6554 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2]) }, 6555 { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64, 6556 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1, 6557 .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write, 6558 .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) }, 6559 #ifndef CONFIG_USER_ONLY 6560 { .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64, 6561 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 2, 6562 .fieldoffset = 6563 offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].cval), 6564 .type = ARM_CP_IO, .access = PL2_RW, 6565 .writefn = gt_hv_cval_write, .raw_writefn = raw_write }, 6566 { .name = "CNTHV_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 6567 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 0, 6568 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 6569 .resetfn = gt_hv_timer_reset, 6570 .readfn = gt_hv_tval_read, .writefn = gt_hv_tval_write }, 6571 { .name = "CNTHV_CTL_EL2", .state = ARM_CP_STATE_BOTH, 6572 .type = ARM_CP_IO, 6573 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 1, 6574 .access = PL2_RW, 6575 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].ctl), 6576 .writefn = gt_hv_ctl_write, .raw_writefn = raw_write }, 6577 { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64, 6578 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1, 6579 .type = ARM_CP_IO | ARM_CP_ALIAS, 6580 .access = PL2_RW, .accessfn = e2h_access, 6581 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 6582 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write }, 6583 { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64, 6584 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1, 6585 .type = ARM_CP_IO | ARM_CP_ALIAS, 6586 .access = PL2_RW, .accessfn = e2h_access, 6587 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 6588 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write }, 6589 { .name = "CNTP_TVAL_EL02", .state = ARM_CP_STATE_AA64, 6590 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 0, 6591 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 6592 .access = PL2_RW, .accessfn = e2h_access, 6593 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write }, 6594 { .name = "CNTV_TVAL_EL02", .state = ARM_CP_STATE_AA64, 6595 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 0, 6596 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 6597 .access = PL2_RW, .accessfn = e2h_access, 6598 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write }, 6599 { .name = "CNTP_CVAL_EL02", .state = ARM_CP_STATE_AA64, 6600 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 2, 6601 .type = ARM_CP_IO | ARM_CP_ALIAS, 6602 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 6603 .access = PL2_RW, .accessfn = e2h_access, 6604 .writefn = gt_phys_cval_write, .raw_writefn = raw_write }, 6605 { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64, 6606 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2, 6607 .type = ARM_CP_IO | ARM_CP_ALIAS, 6608 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 6609 .access = PL2_RW, .accessfn = e2h_access, 6610 .writefn = gt_virt_cval_write, .raw_writefn = raw_write }, 6611 #endif 6612 REGINFO_SENTINEL 6613 }; 6614 6615 void register_cp_regs_for_features(ARMCPU *cpu) 6616 { 6617 /* Register all the coprocessor registers based on feature bits */ 6618 CPUARMState *env = &cpu->env; 6619 if (arm_feature(env, ARM_FEATURE_M)) { 6620 /* M profile has no coprocessor registers */ 6621 return; 6622 } 6623 6624 define_arm_cp_regs(cpu, cp_reginfo); 6625 if (!arm_feature(env, ARM_FEATURE_V8)) { 6626 /* Must go early as it is full of wildcards that may be 6627 * overridden by later definitions. 6628 */ 6629 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 6630 } 6631 6632 if (arm_feature(env, ARM_FEATURE_V6)) { 6633 /* The ID registers all have impdef reset values */ 6634 ARMCPRegInfo v6_idregs[] = { 6635 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 6636 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 6637 .access = PL1_R, .type = ARM_CP_CONST, 6638 .accessfn = access_aa32_tid3, 6639 .resetvalue = cpu->id_pfr0 }, 6640 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know 6641 * the value of the GIC field until after we define these regs. 6642 */ 6643 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 6644 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 6645 .access = PL1_R, .type = ARM_CP_NO_RAW, 6646 .accessfn = access_aa32_tid3, 6647 .readfn = id_pfr1_read, 6648 .writefn = arm_cp_write_ignore }, 6649 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 6650 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 6651 .access = PL1_R, .type = ARM_CP_CONST, 6652 .accessfn = access_aa32_tid3, 6653 .resetvalue = cpu->id_dfr0 }, 6654 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 6655 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 6656 .access = PL1_R, .type = ARM_CP_CONST, 6657 .accessfn = access_aa32_tid3, 6658 .resetvalue = cpu->id_afr0 }, 6659 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 6660 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 6661 .access = PL1_R, .type = ARM_CP_CONST, 6662 .accessfn = access_aa32_tid3, 6663 .resetvalue = cpu->id_mmfr0 }, 6664 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 6665 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 6666 .access = PL1_R, .type = ARM_CP_CONST, 6667 .accessfn = access_aa32_tid3, 6668 .resetvalue = cpu->id_mmfr1 }, 6669 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 6670 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 6671 .access = PL1_R, .type = ARM_CP_CONST, 6672 .accessfn = access_aa32_tid3, 6673 .resetvalue = cpu->id_mmfr2 }, 6674 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 6675 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 6676 .access = PL1_R, .type = ARM_CP_CONST, 6677 .accessfn = access_aa32_tid3, 6678 .resetvalue = cpu->id_mmfr3 }, 6679 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 6680 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 6681 .access = PL1_R, .type = ARM_CP_CONST, 6682 .accessfn = access_aa32_tid3, 6683 .resetvalue = cpu->isar.id_isar0 }, 6684 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 6685 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 6686 .access = PL1_R, .type = ARM_CP_CONST, 6687 .accessfn = access_aa32_tid3, 6688 .resetvalue = cpu->isar.id_isar1 }, 6689 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 6690 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 6691 .access = PL1_R, .type = ARM_CP_CONST, 6692 .accessfn = access_aa32_tid3, 6693 .resetvalue = cpu->isar.id_isar2 }, 6694 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 6695 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 6696 .access = PL1_R, .type = ARM_CP_CONST, 6697 .accessfn = access_aa32_tid3, 6698 .resetvalue = cpu->isar.id_isar3 }, 6699 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 6700 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 6701 .access = PL1_R, .type = ARM_CP_CONST, 6702 .accessfn = access_aa32_tid3, 6703 .resetvalue = cpu->isar.id_isar4 }, 6704 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 6705 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 6706 .access = PL1_R, .type = ARM_CP_CONST, 6707 .accessfn = access_aa32_tid3, 6708 .resetvalue = cpu->isar.id_isar5 }, 6709 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 6710 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 6711 .access = PL1_R, .type = ARM_CP_CONST, 6712 .accessfn = access_aa32_tid3, 6713 .resetvalue = cpu->id_mmfr4 }, 6714 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 6715 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 6716 .access = PL1_R, .type = ARM_CP_CONST, 6717 .accessfn = access_aa32_tid3, 6718 .resetvalue = cpu->isar.id_isar6 }, 6719 REGINFO_SENTINEL 6720 }; 6721 define_arm_cp_regs(cpu, v6_idregs); 6722 define_arm_cp_regs(cpu, v6_cp_reginfo); 6723 } else { 6724 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 6725 } 6726 if (arm_feature(env, ARM_FEATURE_V6K)) { 6727 define_arm_cp_regs(cpu, v6k_cp_reginfo); 6728 } 6729 if (arm_feature(env, ARM_FEATURE_V7MP) && 6730 !arm_feature(env, ARM_FEATURE_PMSA)) { 6731 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 6732 } 6733 if (arm_feature(env, ARM_FEATURE_V7VE)) { 6734 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 6735 } 6736 if (arm_feature(env, ARM_FEATURE_V7)) { 6737 /* v7 performance monitor control register: same implementor 6738 * field as main ID register, and we implement four counters in 6739 * addition to the cycle count register. 6740 */ 6741 unsigned int i, pmcrn = 4; 6742 ARMCPRegInfo pmcr = { 6743 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 6744 .access = PL0_RW, 6745 .type = ARM_CP_IO | ARM_CP_ALIAS, 6746 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 6747 .accessfn = pmreg_access, .writefn = pmcr_write, 6748 .raw_writefn = raw_write, 6749 }; 6750 ARMCPRegInfo pmcr64 = { 6751 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 6752 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 6753 .access = PL0_RW, .accessfn = pmreg_access, 6754 .type = ARM_CP_IO, 6755 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 6756 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT), 6757 .writefn = pmcr_write, .raw_writefn = raw_write, 6758 }; 6759 define_one_arm_cp_reg(cpu, &pmcr); 6760 define_one_arm_cp_reg(cpu, &pmcr64); 6761 for (i = 0; i < pmcrn; i++) { 6762 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 6763 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 6764 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 6765 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 6766 ARMCPRegInfo pmev_regs[] = { 6767 { .name = pmevcntr_name, .cp = 15, .crn = 14, 6768 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6769 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6770 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6771 .accessfn = pmreg_access }, 6772 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 6773 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)), 6774 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 6775 .type = ARM_CP_IO, 6776 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6777 .raw_readfn = pmevcntr_rawread, 6778 .raw_writefn = pmevcntr_rawwrite }, 6779 { .name = pmevtyper_name, .cp = 15, .crn = 14, 6780 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6781 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6782 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6783 .accessfn = pmreg_access }, 6784 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 6785 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)), 6786 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 6787 .type = ARM_CP_IO, 6788 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6789 .raw_writefn = pmevtyper_rawwrite }, 6790 REGINFO_SENTINEL 6791 }; 6792 define_arm_cp_regs(cpu, pmev_regs); 6793 g_free(pmevcntr_name); 6794 g_free(pmevcntr_el0_name); 6795 g_free(pmevtyper_name); 6796 g_free(pmevtyper_el0_name); 6797 } 6798 ARMCPRegInfo clidr = { 6799 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 6800 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 6801 .access = PL1_R, .type = ARM_CP_CONST, 6802 .accessfn = access_aa64_tid2, 6803 .resetvalue = cpu->clidr 6804 }; 6805 define_one_arm_cp_reg(cpu, &clidr); 6806 define_arm_cp_regs(cpu, v7_cp_reginfo); 6807 define_debug_regs(cpu); 6808 } else { 6809 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 6810 } 6811 if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 && 6812 FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) { 6813 ARMCPRegInfo v81_pmu_regs[] = { 6814 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 6815 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 6816 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6817 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 6818 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 6819 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 6820 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6821 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 6822 REGINFO_SENTINEL 6823 }; 6824 define_arm_cp_regs(cpu, v81_pmu_regs); 6825 } 6826 if (arm_feature(env, ARM_FEATURE_V8)) { 6827 /* AArch64 ID registers, which all have impdef reset values. 6828 * Note that within the ID register ranges the unused slots 6829 * must all RAZ, not UNDEF; future architecture versions may 6830 * define new registers here. 6831 */ 6832 ARMCPRegInfo v8_idregs[] = { 6833 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't 6834 * know the right value for the GIC field until after we 6835 * define these regs. 6836 */ 6837 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 6838 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 6839 .access = PL1_R, .type = ARM_CP_NO_RAW, 6840 .accessfn = access_aa64_tid3, 6841 .readfn = id_aa64pfr0_read, 6842 .writefn = arm_cp_write_ignore }, 6843 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 6844 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 6845 .access = PL1_R, .type = ARM_CP_CONST, 6846 .accessfn = access_aa64_tid3, 6847 .resetvalue = cpu->isar.id_aa64pfr1}, 6848 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6849 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 6850 .access = PL1_R, .type = ARM_CP_CONST, 6851 .accessfn = access_aa64_tid3, 6852 .resetvalue = 0 }, 6853 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6854 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 6855 .access = PL1_R, .type = ARM_CP_CONST, 6856 .accessfn = access_aa64_tid3, 6857 .resetvalue = 0 }, 6858 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 6859 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 6860 .access = PL1_R, .type = ARM_CP_CONST, 6861 .accessfn = access_aa64_tid3, 6862 /* At present, only SVEver == 0 is defined anyway. */ 6863 .resetvalue = 0 }, 6864 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6865 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 6866 .access = PL1_R, .type = ARM_CP_CONST, 6867 .accessfn = access_aa64_tid3, 6868 .resetvalue = 0 }, 6869 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6870 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 6871 .access = PL1_R, .type = ARM_CP_CONST, 6872 .accessfn = access_aa64_tid3, 6873 .resetvalue = 0 }, 6874 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6875 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 6876 .access = PL1_R, .type = ARM_CP_CONST, 6877 .accessfn = access_aa64_tid3, 6878 .resetvalue = 0 }, 6879 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 6880 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 6881 .access = PL1_R, .type = ARM_CP_CONST, 6882 .accessfn = access_aa64_tid3, 6883 .resetvalue = cpu->id_aa64dfr0 }, 6884 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 6885 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 6886 .access = PL1_R, .type = ARM_CP_CONST, 6887 .accessfn = access_aa64_tid3, 6888 .resetvalue = cpu->id_aa64dfr1 }, 6889 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6890 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 6891 .access = PL1_R, .type = ARM_CP_CONST, 6892 .accessfn = access_aa64_tid3, 6893 .resetvalue = 0 }, 6894 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6895 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 6896 .access = PL1_R, .type = ARM_CP_CONST, 6897 .accessfn = access_aa64_tid3, 6898 .resetvalue = 0 }, 6899 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 6900 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 6901 .access = PL1_R, .type = ARM_CP_CONST, 6902 .accessfn = access_aa64_tid3, 6903 .resetvalue = cpu->id_aa64afr0 }, 6904 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 6905 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 6906 .access = PL1_R, .type = ARM_CP_CONST, 6907 .accessfn = access_aa64_tid3, 6908 .resetvalue = cpu->id_aa64afr1 }, 6909 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6910 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 6911 .access = PL1_R, .type = ARM_CP_CONST, 6912 .accessfn = access_aa64_tid3, 6913 .resetvalue = 0 }, 6914 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6915 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 6916 .access = PL1_R, .type = ARM_CP_CONST, 6917 .accessfn = access_aa64_tid3, 6918 .resetvalue = 0 }, 6919 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 6920 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 6921 .access = PL1_R, .type = ARM_CP_CONST, 6922 .accessfn = access_aa64_tid3, 6923 .resetvalue = cpu->isar.id_aa64isar0 }, 6924 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 6925 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 6926 .access = PL1_R, .type = ARM_CP_CONST, 6927 .accessfn = access_aa64_tid3, 6928 .resetvalue = cpu->isar.id_aa64isar1 }, 6929 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6930 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 6931 .access = PL1_R, .type = ARM_CP_CONST, 6932 .accessfn = access_aa64_tid3, 6933 .resetvalue = 0 }, 6934 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6935 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 6936 .access = PL1_R, .type = ARM_CP_CONST, 6937 .accessfn = access_aa64_tid3, 6938 .resetvalue = 0 }, 6939 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6940 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 6941 .access = PL1_R, .type = ARM_CP_CONST, 6942 .accessfn = access_aa64_tid3, 6943 .resetvalue = 0 }, 6944 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6945 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 6946 .access = PL1_R, .type = ARM_CP_CONST, 6947 .accessfn = access_aa64_tid3, 6948 .resetvalue = 0 }, 6949 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6950 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 6951 .access = PL1_R, .type = ARM_CP_CONST, 6952 .accessfn = access_aa64_tid3, 6953 .resetvalue = 0 }, 6954 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6955 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 6956 .access = PL1_R, .type = ARM_CP_CONST, 6957 .accessfn = access_aa64_tid3, 6958 .resetvalue = 0 }, 6959 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 6960 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 6961 .access = PL1_R, .type = ARM_CP_CONST, 6962 .accessfn = access_aa64_tid3, 6963 .resetvalue = cpu->isar.id_aa64mmfr0 }, 6964 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 6965 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 6966 .access = PL1_R, .type = ARM_CP_CONST, 6967 .accessfn = access_aa64_tid3, 6968 .resetvalue = cpu->isar.id_aa64mmfr1 }, 6969 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6970 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 6971 .access = PL1_R, .type = ARM_CP_CONST, 6972 .accessfn = access_aa64_tid3, 6973 .resetvalue = 0 }, 6974 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6975 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 6976 .access = PL1_R, .type = ARM_CP_CONST, 6977 .accessfn = access_aa64_tid3, 6978 .resetvalue = 0 }, 6979 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6980 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 6981 .access = PL1_R, .type = ARM_CP_CONST, 6982 .accessfn = access_aa64_tid3, 6983 .resetvalue = 0 }, 6984 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6985 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 6986 .access = PL1_R, .type = ARM_CP_CONST, 6987 .accessfn = access_aa64_tid3, 6988 .resetvalue = 0 }, 6989 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6990 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 6991 .access = PL1_R, .type = ARM_CP_CONST, 6992 .accessfn = access_aa64_tid3, 6993 .resetvalue = 0 }, 6994 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6995 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 6996 .access = PL1_R, .type = ARM_CP_CONST, 6997 .accessfn = access_aa64_tid3, 6998 .resetvalue = 0 }, 6999 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 7000 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 7001 .access = PL1_R, .type = ARM_CP_CONST, 7002 .accessfn = access_aa64_tid3, 7003 .resetvalue = cpu->isar.mvfr0 }, 7004 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 7005 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 7006 .access = PL1_R, .type = ARM_CP_CONST, 7007 .accessfn = access_aa64_tid3, 7008 .resetvalue = cpu->isar.mvfr1 }, 7009 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 7010 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 7011 .access = PL1_R, .type = ARM_CP_CONST, 7012 .accessfn = access_aa64_tid3, 7013 .resetvalue = cpu->isar.mvfr2 }, 7014 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7015 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 7016 .access = PL1_R, .type = ARM_CP_CONST, 7017 .accessfn = access_aa64_tid3, 7018 .resetvalue = 0 }, 7019 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7020 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 7021 .access = PL1_R, .type = ARM_CP_CONST, 7022 .accessfn = access_aa64_tid3, 7023 .resetvalue = 0 }, 7024 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7025 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 7026 .access = PL1_R, .type = ARM_CP_CONST, 7027 .accessfn = access_aa64_tid3, 7028 .resetvalue = 0 }, 7029 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7030 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 7031 .access = PL1_R, .type = ARM_CP_CONST, 7032 .accessfn = access_aa64_tid3, 7033 .resetvalue = 0 }, 7034 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7035 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 7036 .access = PL1_R, .type = ARM_CP_CONST, 7037 .accessfn = access_aa64_tid3, 7038 .resetvalue = 0 }, 7039 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 7040 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 7041 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7042 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 7043 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 7044 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 7045 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7046 .resetvalue = cpu->pmceid0 }, 7047 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 7048 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 7049 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7050 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 7051 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 7052 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 7053 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7054 .resetvalue = cpu->pmceid1 }, 7055 REGINFO_SENTINEL 7056 }; 7057 #ifdef CONFIG_USER_ONLY 7058 ARMCPRegUserSpaceInfo v8_user_idregs[] = { 7059 { .name = "ID_AA64PFR0_EL1", 7060 .exported_bits = 0x000f000f00ff0000, 7061 .fixed_bits = 0x0000000000000011 }, 7062 { .name = "ID_AA64PFR1_EL1", 7063 .exported_bits = 0x00000000000000f0 }, 7064 { .name = "ID_AA64PFR*_EL1_RESERVED", 7065 .is_glob = true }, 7066 { .name = "ID_AA64ZFR0_EL1" }, 7067 { .name = "ID_AA64MMFR0_EL1", 7068 .fixed_bits = 0x00000000ff000000 }, 7069 { .name = "ID_AA64MMFR1_EL1" }, 7070 { .name = "ID_AA64MMFR*_EL1_RESERVED", 7071 .is_glob = true }, 7072 { .name = "ID_AA64DFR0_EL1", 7073 .fixed_bits = 0x0000000000000006 }, 7074 { .name = "ID_AA64DFR1_EL1" }, 7075 { .name = "ID_AA64DFR*_EL1_RESERVED", 7076 .is_glob = true }, 7077 { .name = "ID_AA64AFR*", 7078 .is_glob = true }, 7079 { .name = "ID_AA64ISAR0_EL1", 7080 .exported_bits = 0x00fffffff0fffff0 }, 7081 { .name = "ID_AA64ISAR1_EL1", 7082 .exported_bits = 0x000000f0ffffffff }, 7083 { .name = "ID_AA64ISAR*_EL1_RESERVED", 7084 .is_glob = true }, 7085 REGUSERINFO_SENTINEL 7086 }; 7087 modify_arm_cp_regs(v8_idregs, v8_user_idregs); 7088 #endif 7089 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ 7090 if (!arm_feature(env, ARM_FEATURE_EL3) && 7091 !arm_feature(env, ARM_FEATURE_EL2)) { 7092 ARMCPRegInfo rvbar = { 7093 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64, 7094 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 7095 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar 7096 }; 7097 define_one_arm_cp_reg(cpu, &rvbar); 7098 } 7099 define_arm_cp_regs(cpu, v8_idregs); 7100 define_arm_cp_regs(cpu, v8_cp_reginfo); 7101 } 7102 if (arm_feature(env, ARM_FEATURE_EL2)) { 7103 uint64_t vmpidr_def = mpidr_read_val(env); 7104 ARMCPRegInfo vpidr_regs[] = { 7105 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 7106 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 7107 .access = PL2_RW, .accessfn = access_el3_aa32ns, 7108 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS, 7109 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 7110 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 7111 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 7112 .access = PL2_RW, .resetvalue = cpu->midr, 7113 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 7114 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 7115 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 7116 .access = PL2_RW, .accessfn = access_el3_aa32ns, 7117 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS, 7118 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 7119 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 7120 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 7121 .access = PL2_RW, 7122 .resetvalue = vmpidr_def, 7123 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 7124 REGINFO_SENTINEL 7125 }; 7126 define_arm_cp_regs(cpu, vpidr_regs); 7127 define_arm_cp_regs(cpu, el2_cp_reginfo); 7128 if (arm_feature(env, ARM_FEATURE_V8)) { 7129 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 7130 } 7131 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */ 7132 if (!arm_feature(env, ARM_FEATURE_EL3)) { 7133 ARMCPRegInfo rvbar = { 7134 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 7135 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 7136 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar 7137 }; 7138 define_one_arm_cp_reg(cpu, &rvbar); 7139 } 7140 } else { 7141 /* If EL2 is missing but higher ELs are enabled, we need to 7142 * register the no_el2 reginfos. 7143 */ 7144 if (arm_feature(env, ARM_FEATURE_EL3)) { 7145 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value 7146 * of MIDR_EL1 and MPIDR_EL1. 7147 */ 7148 ARMCPRegInfo vpidr_regs[] = { 7149 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH, 7150 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 7151 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 7152 .type = ARM_CP_CONST, .resetvalue = cpu->midr, 7153 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 7154 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH, 7155 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 7156 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 7157 .type = ARM_CP_NO_RAW, 7158 .writefn = arm_cp_write_ignore, .readfn = mpidr_read }, 7159 REGINFO_SENTINEL 7160 }; 7161 define_arm_cp_regs(cpu, vpidr_regs); 7162 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo); 7163 if (arm_feature(env, ARM_FEATURE_V8)) { 7164 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo); 7165 } 7166 } 7167 } 7168 if (arm_feature(env, ARM_FEATURE_EL3)) { 7169 define_arm_cp_regs(cpu, el3_cp_reginfo); 7170 ARMCPRegInfo el3_regs[] = { 7171 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 7172 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 7173 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar }, 7174 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 7175 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 7176 .access = PL3_RW, 7177 .raw_writefn = raw_write, .writefn = sctlr_write, 7178 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 7179 .resetvalue = cpu->reset_sctlr }, 7180 REGINFO_SENTINEL 7181 }; 7182 7183 define_arm_cp_regs(cpu, el3_regs); 7184 } 7185 /* The behaviour of NSACR is sufficiently various that we don't 7186 * try to describe it in a single reginfo: 7187 * if EL3 is 64 bit, then trap to EL3 from S EL1, 7188 * reads as constant 0xc00 from NS EL1 and NS EL2 7189 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 7190 * if v7 without EL3, register doesn't exist 7191 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 7192 */ 7193 if (arm_feature(env, ARM_FEATURE_EL3)) { 7194 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 7195 ARMCPRegInfo nsacr = { 7196 .name = "NSACR", .type = ARM_CP_CONST, 7197 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 7198 .access = PL1_RW, .accessfn = nsacr_access, 7199 .resetvalue = 0xc00 7200 }; 7201 define_one_arm_cp_reg(cpu, &nsacr); 7202 } else { 7203 ARMCPRegInfo nsacr = { 7204 .name = "NSACR", 7205 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 7206 .access = PL3_RW | PL1_R, 7207 .resetvalue = 0, 7208 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 7209 }; 7210 define_one_arm_cp_reg(cpu, &nsacr); 7211 } 7212 } else { 7213 if (arm_feature(env, ARM_FEATURE_V8)) { 7214 ARMCPRegInfo nsacr = { 7215 .name = "NSACR", .type = ARM_CP_CONST, 7216 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 7217 .access = PL1_R, 7218 .resetvalue = 0xc00 7219 }; 7220 define_one_arm_cp_reg(cpu, &nsacr); 7221 } 7222 } 7223 7224 if (arm_feature(env, ARM_FEATURE_PMSA)) { 7225 if (arm_feature(env, ARM_FEATURE_V6)) { 7226 /* PMSAv6 not implemented */ 7227 assert(arm_feature(env, ARM_FEATURE_V7)); 7228 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 7229 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 7230 } else { 7231 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 7232 } 7233 } else { 7234 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 7235 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 7236 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */ 7237 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) { 7238 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 7239 } 7240 } 7241 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 7242 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 7243 } 7244 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 7245 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 7246 } 7247 if (arm_feature(env, ARM_FEATURE_VAPA)) { 7248 define_arm_cp_regs(cpu, vapa_cp_reginfo); 7249 } 7250 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 7251 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 7252 } 7253 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 7254 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 7255 } 7256 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 7257 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 7258 } 7259 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 7260 define_arm_cp_regs(cpu, omap_cp_reginfo); 7261 } 7262 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 7263 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 7264 } 7265 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 7266 define_arm_cp_regs(cpu, xscale_cp_reginfo); 7267 } 7268 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 7269 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 7270 } 7271 if (arm_feature(env, ARM_FEATURE_LPAE)) { 7272 define_arm_cp_regs(cpu, lpae_cp_reginfo); 7273 } 7274 if (cpu_isar_feature(jazelle, cpu)) { 7275 define_arm_cp_regs(cpu, jazelle_regs); 7276 } 7277 /* Slightly awkwardly, the OMAP and StrongARM cores need all of 7278 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 7279 * be read-only (ie write causes UNDEF exception). 7280 */ 7281 { 7282 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 7283 /* Pre-v8 MIDR space. 7284 * Note that the MIDR isn't a simple constant register because 7285 * of the TI925 behaviour where writes to another register can 7286 * cause the MIDR value to change. 7287 * 7288 * Unimplemented registers in the c15 0 0 0 space default to 7289 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 7290 * and friends override accordingly. 7291 */ 7292 { .name = "MIDR", 7293 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 7294 .access = PL1_R, .resetvalue = cpu->midr, 7295 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 7296 .readfn = midr_read, 7297 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 7298 .type = ARM_CP_OVERRIDE }, 7299 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 7300 { .name = "DUMMY", 7301 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 7302 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7303 { .name = "DUMMY", 7304 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 7305 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7306 { .name = "DUMMY", 7307 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 7308 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7309 { .name = "DUMMY", 7310 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 7311 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7312 { .name = "DUMMY", 7313 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 7314 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7315 REGINFO_SENTINEL 7316 }; 7317 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 7318 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 7319 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 7320 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 7321 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 7322 .readfn = midr_read }, 7323 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */ 7324 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 7325 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 7326 .access = PL1_R, .resetvalue = cpu->midr }, 7327 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 7328 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 7329 .access = PL1_R, .resetvalue = cpu->midr }, 7330 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 7331 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 7332 .access = PL1_R, 7333 .accessfn = access_aa64_tid1, 7334 .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 7335 REGINFO_SENTINEL 7336 }; 7337 ARMCPRegInfo id_cp_reginfo[] = { 7338 /* These are common to v8 and pre-v8 */ 7339 { .name = "CTR", 7340 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 7341 .access = PL1_R, .accessfn = ctr_el0_access, 7342 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 7343 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 7344 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 7345 .access = PL0_R, .accessfn = ctr_el0_access, 7346 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 7347 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 7348 { .name = "TCMTR", 7349 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 7350 .access = PL1_R, 7351 .accessfn = access_aa32_tid1, 7352 .type = ARM_CP_CONST, .resetvalue = 0 }, 7353 REGINFO_SENTINEL 7354 }; 7355 /* TLBTR is specific to VMSA */ 7356 ARMCPRegInfo id_tlbtr_reginfo = { 7357 .name = "TLBTR", 7358 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 7359 .access = PL1_R, 7360 .accessfn = access_aa32_tid1, 7361 .type = ARM_CP_CONST, .resetvalue = 0, 7362 }; 7363 /* MPUIR is specific to PMSA V6+ */ 7364 ARMCPRegInfo id_mpuir_reginfo = { 7365 .name = "MPUIR", 7366 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 7367 .access = PL1_R, .type = ARM_CP_CONST, 7368 .resetvalue = cpu->pmsav7_dregion << 8 7369 }; 7370 ARMCPRegInfo crn0_wi_reginfo = { 7371 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 7372 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 7373 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 7374 }; 7375 #ifdef CONFIG_USER_ONLY 7376 ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = { 7377 { .name = "MIDR_EL1", 7378 .exported_bits = 0x00000000ffffffff }, 7379 { .name = "REVIDR_EL1" }, 7380 REGUSERINFO_SENTINEL 7381 }; 7382 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo); 7383 #endif 7384 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 7385 arm_feature(env, ARM_FEATURE_STRONGARM)) { 7386 ARMCPRegInfo *r; 7387 /* Register the blanket "writes ignored" value first to cover the 7388 * whole space. Then update the specific ID registers to allow write 7389 * access, so that they ignore writes rather than causing them to 7390 * UNDEF. 7391 */ 7392 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 7393 for (r = id_pre_v8_midr_cp_reginfo; 7394 r->type != ARM_CP_SENTINEL; r++) { 7395 r->access = PL1_RW; 7396 } 7397 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) { 7398 r->access = PL1_RW; 7399 } 7400 id_mpuir_reginfo.access = PL1_RW; 7401 id_tlbtr_reginfo.access = PL1_RW; 7402 } 7403 if (arm_feature(env, ARM_FEATURE_V8)) { 7404 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 7405 } else { 7406 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 7407 } 7408 define_arm_cp_regs(cpu, id_cp_reginfo); 7409 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 7410 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 7411 } else if (arm_feature(env, ARM_FEATURE_V7)) { 7412 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 7413 } 7414 } 7415 7416 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 7417 ARMCPRegInfo mpidr_cp_reginfo[] = { 7418 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH, 7419 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 7420 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 7421 REGINFO_SENTINEL 7422 }; 7423 #ifdef CONFIG_USER_ONLY 7424 ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = { 7425 { .name = "MPIDR_EL1", 7426 .fixed_bits = 0x0000000080000000 }, 7427 REGUSERINFO_SENTINEL 7428 }; 7429 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo); 7430 #endif 7431 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 7432 } 7433 7434 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 7435 ARMCPRegInfo auxcr_reginfo[] = { 7436 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 7437 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 7438 .access = PL1_RW, .type = ARM_CP_CONST, 7439 .resetvalue = cpu->reset_auxcr }, 7440 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 7441 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 7442 .access = PL2_RW, .type = ARM_CP_CONST, 7443 .resetvalue = 0 }, 7444 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 7445 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 7446 .access = PL3_RW, .type = ARM_CP_CONST, 7447 .resetvalue = 0 }, 7448 REGINFO_SENTINEL 7449 }; 7450 define_arm_cp_regs(cpu, auxcr_reginfo); 7451 if (arm_feature(env, ARM_FEATURE_V8)) { 7452 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */ 7453 ARMCPRegInfo hactlr2_reginfo = { 7454 .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 7455 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 7456 .access = PL2_RW, .type = ARM_CP_CONST, 7457 .resetvalue = 0 7458 }; 7459 define_one_arm_cp_reg(cpu, &hactlr2_reginfo); 7460 } 7461 } 7462 7463 if (arm_feature(env, ARM_FEATURE_CBAR)) { 7464 /* 7465 * CBAR is IMPDEF, but common on Arm Cortex-A implementations. 7466 * There are two flavours: 7467 * (1) older 32-bit only cores have a simple 32-bit CBAR 7468 * (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a 7469 * 32-bit register visible to AArch32 at a different encoding 7470 * to the "flavour 1" register and with the bits rearranged to 7471 * be able to squash a 64-bit address into the 32-bit view. 7472 * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but 7473 * in future if we support AArch32-only configs of some of the 7474 * AArch64 cores we might need to add a specific feature flag 7475 * to indicate cores with "flavour 2" CBAR. 7476 */ 7477 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 7478 /* 32 bit view is [31:18] 0...0 [43:32]. */ 7479 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 7480 | extract64(cpu->reset_cbar, 32, 12); 7481 ARMCPRegInfo cbar_reginfo[] = { 7482 { .name = "CBAR", 7483 .type = ARM_CP_CONST, 7484 .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0, 7485 .access = PL1_R, .resetvalue = cbar32 }, 7486 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 7487 .type = ARM_CP_CONST, 7488 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 7489 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 7490 REGINFO_SENTINEL 7491 }; 7492 /* We don't implement a r/w 64 bit CBAR currently */ 7493 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 7494 define_arm_cp_regs(cpu, cbar_reginfo); 7495 } else { 7496 ARMCPRegInfo cbar = { 7497 .name = "CBAR", 7498 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 7499 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar, 7500 .fieldoffset = offsetof(CPUARMState, 7501 cp15.c15_config_base_address) 7502 }; 7503 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 7504 cbar.access = PL1_R; 7505 cbar.fieldoffset = 0; 7506 cbar.type = ARM_CP_CONST; 7507 } 7508 define_one_arm_cp_reg(cpu, &cbar); 7509 } 7510 } 7511 7512 if (arm_feature(env, ARM_FEATURE_VBAR)) { 7513 ARMCPRegInfo vbar_cp_reginfo[] = { 7514 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 7515 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 7516 .access = PL1_RW, .writefn = vbar_write, 7517 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 7518 offsetof(CPUARMState, cp15.vbar_ns) }, 7519 .resetvalue = 0 }, 7520 REGINFO_SENTINEL 7521 }; 7522 define_arm_cp_regs(cpu, vbar_cp_reginfo); 7523 } 7524 7525 /* Generic registers whose values depend on the implementation */ 7526 { 7527 ARMCPRegInfo sctlr = { 7528 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 7529 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 7530 .access = PL1_RW, 7531 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 7532 offsetof(CPUARMState, cp15.sctlr_ns) }, 7533 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 7534 .raw_writefn = raw_write, 7535 }; 7536 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 7537 /* Normally we would always end the TB on an SCTLR write, but Linux 7538 * arch/arm/mach-pxa/sleep.S expects two instructions following 7539 * an MMU enable to execute from cache. Imitate this behaviour. 7540 */ 7541 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 7542 } 7543 define_one_arm_cp_reg(cpu, &sctlr); 7544 } 7545 7546 if (cpu_isar_feature(aa64_lor, cpu)) { 7547 /* 7548 * A trivial implementation of ARMv8.1-LOR leaves all of these 7549 * registers fixed at 0, which indicates that there are zero 7550 * supported Limited Ordering regions. 7551 */ 7552 static const ARMCPRegInfo lor_reginfo[] = { 7553 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 7554 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 7555 .access = PL1_RW, .accessfn = access_lor_other, 7556 .type = ARM_CP_CONST, .resetvalue = 0 }, 7557 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 7558 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 7559 .access = PL1_RW, .accessfn = access_lor_other, 7560 .type = ARM_CP_CONST, .resetvalue = 0 }, 7561 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 7562 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 7563 .access = PL1_RW, .accessfn = access_lor_other, 7564 .type = ARM_CP_CONST, .resetvalue = 0 }, 7565 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 7566 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 7567 .access = PL1_RW, .accessfn = access_lor_other, 7568 .type = ARM_CP_CONST, .resetvalue = 0 }, 7569 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 7570 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 7571 .access = PL1_R, .accessfn = access_lorid, 7572 .type = ARM_CP_CONST, .resetvalue = 0 }, 7573 REGINFO_SENTINEL 7574 }; 7575 define_arm_cp_regs(cpu, lor_reginfo); 7576 } 7577 7578 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 7579 define_arm_cp_regs(cpu, vhe_reginfo); 7580 } 7581 7582 if (cpu_isar_feature(aa64_sve, cpu)) { 7583 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo); 7584 if (arm_feature(env, ARM_FEATURE_EL2)) { 7585 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo); 7586 } else { 7587 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo); 7588 } 7589 if (arm_feature(env, ARM_FEATURE_EL3)) { 7590 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo); 7591 } 7592 } 7593 7594 #ifdef TARGET_AARCH64 7595 if (cpu_isar_feature(aa64_pauth, cpu)) { 7596 define_arm_cp_regs(cpu, pauth_reginfo); 7597 } 7598 if (cpu_isar_feature(aa64_rndr, cpu)) { 7599 define_arm_cp_regs(cpu, rndr_reginfo); 7600 } 7601 #ifndef CONFIG_USER_ONLY 7602 /* Data Cache clean instructions up to PoP */ 7603 if (cpu_isar_feature(aa64_dcpop, cpu)) { 7604 define_one_arm_cp_reg(cpu, dcpop_reg); 7605 7606 if (cpu_isar_feature(aa64_dcpodp, cpu)) { 7607 define_one_arm_cp_reg(cpu, dcpodp_reg); 7608 } 7609 } 7610 #endif /*CONFIG_USER_ONLY*/ 7611 #endif 7612 7613 /* 7614 * While all v8.0 cpus support aarch64, QEMU does have configurations 7615 * that do not set ID_AA64ISAR1, e.g. user-only qemu-arm -cpu max, 7616 * which will set ID_ISAR6. 7617 */ 7618 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) 7619 ? cpu_isar_feature(aa64_predinv, cpu) 7620 : cpu_isar_feature(aa32_predinv, cpu)) { 7621 define_arm_cp_regs(cpu, predinv_reginfo); 7622 } 7623 7624 #ifndef CONFIG_USER_ONLY 7625 /* 7626 * Register redirections and aliases must be done last, 7627 * after the registers from the other extensions have been defined. 7628 */ 7629 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 7630 define_arm_vh_e2h_redirects_aliases(cpu); 7631 } 7632 #endif 7633 } 7634 7635 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) 7636 { 7637 CPUState *cs = CPU(cpu); 7638 CPUARMState *env = &cpu->env; 7639 7640 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 7641 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg, 7642 aarch64_fpu_gdb_set_reg, 7643 34, "aarch64-fpu.xml", 0); 7644 } else if (arm_feature(env, ARM_FEATURE_NEON)) { 7645 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 7646 51, "arm-neon.xml", 0); 7647 } else if (arm_feature(env, ARM_FEATURE_VFP3)) { 7648 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 7649 35, "arm-vfp3.xml", 0); 7650 } else if (arm_feature(env, ARM_FEATURE_VFP)) { 7651 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 7652 19, "arm-vfp.xml", 0); 7653 } 7654 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg, 7655 arm_gen_dynamic_xml(cs), 7656 "system-registers.xml", 0); 7657 } 7658 7659 /* Sort alphabetically by type name, except for "any". */ 7660 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b) 7661 { 7662 ObjectClass *class_a = (ObjectClass *)a; 7663 ObjectClass *class_b = (ObjectClass *)b; 7664 const char *name_a, *name_b; 7665 7666 name_a = object_class_get_name(class_a); 7667 name_b = object_class_get_name(class_b); 7668 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) { 7669 return 1; 7670 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) { 7671 return -1; 7672 } else { 7673 return strcmp(name_a, name_b); 7674 } 7675 } 7676 7677 static void arm_cpu_list_entry(gpointer data, gpointer user_data) 7678 { 7679 ObjectClass *oc = data; 7680 const char *typename; 7681 char *name; 7682 7683 typename = object_class_get_name(oc); 7684 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU)); 7685 qemu_printf(" %s\n", name); 7686 g_free(name); 7687 } 7688 7689 void arm_cpu_list(void) 7690 { 7691 GSList *list; 7692 7693 list = object_class_get_list(TYPE_ARM_CPU, false); 7694 list = g_slist_sort(list, arm_cpu_list_compare); 7695 qemu_printf("Available CPUs:\n"); 7696 g_slist_foreach(list, arm_cpu_list_entry, NULL); 7697 g_slist_free(list); 7698 } 7699 7700 static void arm_cpu_add_definition(gpointer data, gpointer user_data) 7701 { 7702 ObjectClass *oc = data; 7703 CpuDefinitionInfoList **cpu_list = user_data; 7704 CpuDefinitionInfoList *entry; 7705 CpuDefinitionInfo *info; 7706 const char *typename; 7707 7708 typename = object_class_get_name(oc); 7709 info = g_malloc0(sizeof(*info)); 7710 info->name = g_strndup(typename, 7711 strlen(typename) - strlen("-" TYPE_ARM_CPU)); 7712 info->q_typename = g_strdup(typename); 7713 7714 entry = g_malloc0(sizeof(*entry)); 7715 entry->value = info; 7716 entry->next = *cpu_list; 7717 *cpu_list = entry; 7718 } 7719 7720 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp) 7721 { 7722 CpuDefinitionInfoList *cpu_list = NULL; 7723 GSList *list; 7724 7725 list = object_class_get_list(TYPE_ARM_CPU, false); 7726 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list); 7727 g_slist_free(list); 7728 7729 return cpu_list; 7730 } 7731 7732 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 7733 void *opaque, int state, int secstate, 7734 int crm, int opc1, int opc2, 7735 const char *name) 7736 { 7737 /* Private utility function for define_one_arm_cp_reg_with_opaque(): 7738 * add a single reginfo struct to the hash table. 7739 */ 7740 uint32_t *key = g_new(uint32_t, 1); 7741 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo)); 7742 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0; 7743 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0; 7744 7745 r2->name = g_strdup(name); 7746 /* Reset the secure state to the specific incoming state. This is 7747 * necessary as the register may have been defined with both states. 7748 */ 7749 r2->secure = secstate; 7750 7751 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 7752 /* Register is banked (using both entries in array). 7753 * Overwriting fieldoffset as the array is only used to define 7754 * banked registers but later only fieldoffset is used. 7755 */ 7756 r2->fieldoffset = r->bank_fieldoffsets[ns]; 7757 } 7758 7759 if (state == ARM_CP_STATE_AA32) { 7760 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 7761 /* If the register is banked then we don't need to migrate or 7762 * reset the 32-bit instance in certain cases: 7763 * 7764 * 1) If the register has both 32-bit and 64-bit instances then we 7765 * can count on the 64-bit instance taking care of the 7766 * non-secure bank. 7767 * 2) If ARMv8 is enabled then we can count on a 64-bit version 7768 * taking care of the secure bank. This requires that separate 7769 * 32 and 64-bit definitions are provided. 7770 */ 7771 if ((r->state == ARM_CP_STATE_BOTH && ns) || 7772 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) { 7773 r2->type |= ARM_CP_ALIAS; 7774 } 7775 } else if ((secstate != r->secure) && !ns) { 7776 /* The register is not banked so we only want to allow migration of 7777 * the non-secure instance. 7778 */ 7779 r2->type |= ARM_CP_ALIAS; 7780 } 7781 7782 if (r->state == ARM_CP_STATE_BOTH) { 7783 /* We assume it is a cp15 register if the .cp field is left unset. 7784 */ 7785 if (r2->cp == 0) { 7786 r2->cp = 15; 7787 } 7788 7789 #ifdef HOST_WORDS_BIGENDIAN 7790 if (r2->fieldoffset) { 7791 r2->fieldoffset += sizeof(uint32_t); 7792 } 7793 #endif 7794 } 7795 } 7796 if (state == ARM_CP_STATE_AA64) { 7797 /* To allow abbreviation of ARMCPRegInfo 7798 * definitions, we treat cp == 0 as equivalent to 7799 * the value for "standard guest-visible sysreg". 7800 * STATE_BOTH definitions are also always "standard 7801 * sysreg" in their AArch64 view (the .cp value may 7802 * be non-zero for the benefit of the AArch32 view). 7803 */ 7804 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) { 7805 r2->cp = CP_REG_ARM64_SYSREG_CP; 7806 } 7807 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm, 7808 r2->opc0, opc1, opc2); 7809 } else { 7810 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2); 7811 } 7812 if (opaque) { 7813 r2->opaque = opaque; 7814 } 7815 /* reginfo passed to helpers is correct for the actual access, 7816 * and is never ARM_CP_STATE_BOTH: 7817 */ 7818 r2->state = state; 7819 /* Make sure reginfo passed to helpers for wildcarded regs 7820 * has the correct crm/opc1/opc2 for this reg, not CP_ANY: 7821 */ 7822 r2->crm = crm; 7823 r2->opc1 = opc1; 7824 r2->opc2 = opc2; 7825 /* By convention, for wildcarded registers only the first 7826 * entry is used for migration; the others are marked as 7827 * ALIAS so we don't try to transfer the register 7828 * multiple times. Special registers (ie NOP/WFI) are 7829 * never migratable and not even raw-accessible. 7830 */ 7831 if ((r->type & ARM_CP_SPECIAL)) { 7832 r2->type |= ARM_CP_NO_RAW; 7833 } 7834 if (((r->crm == CP_ANY) && crm != 0) || 7835 ((r->opc1 == CP_ANY) && opc1 != 0) || 7836 ((r->opc2 == CP_ANY) && opc2 != 0)) { 7837 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 7838 } 7839 7840 /* Check that raw accesses are either forbidden or handled. Note that 7841 * we can't assert this earlier because the setup of fieldoffset for 7842 * banked registers has to be done first. 7843 */ 7844 if (!(r2->type & ARM_CP_NO_RAW)) { 7845 assert(!raw_accessors_invalid(r2)); 7846 } 7847 7848 /* Overriding of an existing definition must be explicitly 7849 * requested. 7850 */ 7851 if (!(r->type & ARM_CP_OVERRIDE)) { 7852 ARMCPRegInfo *oldreg; 7853 oldreg = g_hash_table_lookup(cpu->cp_regs, key); 7854 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) { 7855 fprintf(stderr, "Register redefined: cp=%d %d bit " 7856 "crn=%d crm=%d opc1=%d opc2=%d, " 7857 "was %s, now %s\n", r2->cp, 32 + 32 * is64, 7858 r2->crn, r2->crm, r2->opc1, r2->opc2, 7859 oldreg->name, r2->name); 7860 g_assert_not_reached(); 7861 } 7862 } 7863 g_hash_table_insert(cpu->cp_regs, key, r2); 7864 } 7865 7866 7867 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 7868 const ARMCPRegInfo *r, void *opaque) 7869 { 7870 /* Define implementations of coprocessor registers. 7871 * We store these in a hashtable because typically 7872 * there are less than 150 registers in a space which 7873 * is 16*16*16*8*8 = 262144 in size. 7874 * Wildcarding is supported for the crm, opc1 and opc2 fields. 7875 * If a register is defined twice then the second definition is 7876 * used, so this can be used to define some generic registers and 7877 * then override them with implementation specific variations. 7878 * At least one of the original and the second definition should 7879 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 7880 * against accidental use. 7881 * 7882 * The state field defines whether the register is to be 7883 * visible in the AArch32 or AArch64 execution state. If the 7884 * state is set to ARM_CP_STATE_BOTH then we synthesise a 7885 * reginfo structure for the AArch32 view, which sees the lower 7886 * 32 bits of the 64 bit register. 7887 * 7888 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 7889 * be wildcarded. AArch64 registers are always considered to be 64 7890 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 7891 * the register, if any. 7892 */ 7893 int crm, opc1, opc2, state; 7894 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 7895 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 7896 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 7897 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 7898 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 7899 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 7900 /* 64 bit registers have only CRm and Opc1 fields */ 7901 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 7902 /* op0 only exists in the AArch64 encodings */ 7903 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 7904 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 7905 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 7906 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1 7907 * encodes a minimum access level for the register. We roll this 7908 * runtime check into our general permission check code, so check 7909 * here that the reginfo's specified permissions are strict enough 7910 * to encompass the generic architectural permission check. 7911 */ 7912 if (r->state != ARM_CP_STATE_AA32) { 7913 int mask = 0; 7914 switch (r->opc1) { 7915 case 0: 7916 /* min_EL EL1, but some accessible to EL0 via kernel ABI */ 7917 mask = PL0U_R | PL1_RW; 7918 break; 7919 case 1: case 2: 7920 /* min_EL EL1 */ 7921 mask = PL1_RW; 7922 break; 7923 case 3: 7924 /* min_EL EL0 */ 7925 mask = PL0_RW; 7926 break; 7927 case 4: 7928 case 5: 7929 /* min_EL EL2 */ 7930 mask = PL2_RW; 7931 break; 7932 case 6: 7933 /* min_EL EL3 */ 7934 mask = PL3_RW; 7935 break; 7936 case 7: 7937 /* min_EL EL1, secure mode only (we don't check the latter) */ 7938 mask = PL1_RW; 7939 break; 7940 default: 7941 /* broken reginfo with out-of-range opc1 */ 7942 assert(false); 7943 break; 7944 } 7945 /* assert our permissions are not too lax (stricter is fine) */ 7946 assert((r->access & ~mask) == 0); 7947 } 7948 7949 /* Check that the register definition has enough info to handle 7950 * reads and writes if they are permitted. 7951 */ 7952 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) { 7953 if (r->access & PL3_R) { 7954 assert((r->fieldoffset || 7955 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 7956 r->readfn); 7957 } 7958 if (r->access & PL3_W) { 7959 assert((r->fieldoffset || 7960 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 7961 r->writefn); 7962 } 7963 } 7964 /* Bad type field probably means missing sentinel at end of reg list */ 7965 assert(cptype_valid(r->type)); 7966 for (crm = crmmin; crm <= crmmax; crm++) { 7967 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 7968 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 7969 for (state = ARM_CP_STATE_AA32; 7970 state <= ARM_CP_STATE_AA64; state++) { 7971 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 7972 continue; 7973 } 7974 if (state == ARM_CP_STATE_AA32) { 7975 /* Under AArch32 CP registers can be common 7976 * (same for secure and non-secure world) or banked. 7977 */ 7978 char *name; 7979 7980 switch (r->secure) { 7981 case ARM_CP_SECSTATE_S: 7982 case ARM_CP_SECSTATE_NS: 7983 add_cpreg_to_hashtable(cpu, r, opaque, state, 7984 r->secure, crm, opc1, opc2, 7985 r->name); 7986 break; 7987 default: 7988 name = g_strdup_printf("%s_S", r->name); 7989 add_cpreg_to_hashtable(cpu, r, opaque, state, 7990 ARM_CP_SECSTATE_S, 7991 crm, opc1, opc2, name); 7992 g_free(name); 7993 add_cpreg_to_hashtable(cpu, r, opaque, state, 7994 ARM_CP_SECSTATE_NS, 7995 crm, opc1, opc2, r->name); 7996 break; 7997 } 7998 } else { 7999 /* AArch64 registers get mapped to non-secure instance 8000 * of AArch32 */ 8001 add_cpreg_to_hashtable(cpu, r, opaque, state, 8002 ARM_CP_SECSTATE_NS, 8003 crm, opc1, opc2, r->name); 8004 } 8005 } 8006 } 8007 } 8008 } 8009 } 8010 8011 void define_arm_cp_regs_with_opaque(ARMCPU *cpu, 8012 const ARMCPRegInfo *regs, void *opaque) 8013 { 8014 /* Define a whole list of registers */ 8015 const ARMCPRegInfo *r; 8016 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 8017 define_one_arm_cp_reg_with_opaque(cpu, r, opaque); 8018 } 8019 } 8020 8021 /* 8022 * Modify ARMCPRegInfo for access from userspace. 8023 * 8024 * This is a data driven modification directed by 8025 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as 8026 * user-space cannot alter any values and dynamic values pertaining to 8027 * execution state are hidden from user space view anyway. 8028 */ 8029 void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods) 8030 { 8031 const ARMCPRegUserSpaceInfo *m; 8032 ARMCPRegInfo *r; 8033 8034 for (m = mods; m->name; m++) { 8035 GPatternSpec *pat = NULL; 8036 if (m->is_glob) { 8037 pat = g_pattern_spec_new(m->name); 8038 } 8039 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 8040 if (pat && g_pattern_match_string(pat, r->name)) { 8041 r->type = ARM_CP_CONST; 8042 r->access = PL0U_R; 8043 r->resetvalue = 0; 8044 /* continue */ 8045 } else if (strcmp(r->name, m->name) == 0) { 8046 r->type = ARM_CP_CONST; 8047 r->access = PL0U_R; 8048 r->resetvalue &= m->exported_bits; 8049 r->resetvalue |= m->fixed_bits; 8050 break; 8051 } 8052 } 8053 if (pat) { 8054 g_pattern_spec_free(pat); 8055 } 8056 } 8057 } 8058 8059 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 8060 { 8061 return g_hash_table_lookup(cpregs, &encoded_cp); 8062 } 8063 8064 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 8065 uint64_t value) 8066 { 8067 /* Helper coprocessor write function for write-ignore registers */ 8068 } 8069 8070 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 8071 { 8072 /* Helper coprocessor write function for read-as-zero registers */ 8073 return 0; 8074 } 8075 8076 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 8077 { 8078 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 8079 } 8080 8081 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 8082 { 8083 /* Return true if it is not valid for us to switch to 8084 * this CPU mode (ie all the UNPREDICTABLE cases in 8085 * the ARM ARM CPSRWriteByInstr pseudocode). 8086 */ 8087 8088 /* Changes to or from Hyp via MSR and CPS are illegal. */ 8089 if (write_type == CPSRWriteByInstr && 8090 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 8091 mode == ARM_CPU_MODE_HYP)) { 8092 return 1; 8093 } 8094 8095 switch (mode) { 8096 case ARM_CPU_MODE_USR: 8097 return 0; 8098 case ARM_CPU_MODE_SYS: 8099 case ARM_CPU_MODE_SVC: 8100 case ARM_CPU_MODE_ABT: 8101 case ARM_CPU_MODE_UND: 8102 case ARM_CPU_MODE_IRQ: 8103 case ARM_CPU_MODE_FIQ: 8104 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7 8105 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 8106 */ 8107 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 8108 * and CPS are treated as illegal mode changes. 8109 */ 8110 if (write_type == CPSRWriteByInstr && 8111 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 8112 (arm_hcr_el2_eff(env) & HCR_TGE)) { 8113 return 1; 8114 } 8115 return 0; 8116 case ARM_CPU_MODE_HYP: 8117 return !arm_feature(env, ARM_FEATURE_EL2) 8118 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env); 8119 case ARM_CPU_MODE_MON: 8120 return arm_current_el(env) < 3; 8121 default: 8122 return 1; 8123 } 8124 } 8125 8126 uint32_t cpsr_read(CPUARMState *env) 8127 { 8128 int ZF; 8129 ZF = (env->ZF == 0); 8130 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 8131 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 8132 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 8133 | ((env->condexec_bits & 0xfc) << 8) 8134 | (env->GE << 16) | (env->daif & CPSR_AIF); 8135 } 8136 8137 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 8138 CPSRWriteType write_type) 8139 { 8140 uint32_t changed_daif; 8141 8142 if (mask & CPSR_NZCV) { 8143 env->ZF = (~val) & CPSR_Z; 8144 env->NF = val; 8145 env->CF = (val >> 29) & 1; 8146 env->VF = (val << 3) & 0x80000000; 8147 } 8148 if (mask & CPSR_Q) 8149 env->QF = ((val & CPSR_Q) != 0); 8150 if (mask & CPSR_T) 8151 env->thumb = ((val & CPSR_T) != 0); 8152 if (mask & CPSR_IT_0_1) { 8153 env->condexec_bits &= ~3; 8154 env->condexec_bits |= (val >> 25) & 3; 8155 } 8156 if (mask & CPSR_IT_2_7) { 8157 env->condexec_bits &= 3; 8158 env->condexec_bits |= (val >> 8) & 0xfc; 8159 } 8160 if (mask & CPSR_GE) { 8161 env->GE = (val >> 16) & 0xf; 8162 } 8163 8164 /* In a V7 implementation that includes the security extensions but does 8165 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 8166 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 8167 * bits respectively. 8168 * 8169 * In a V8 implementation, it is permitted for privileged software to 8170 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 8171 */ 8172 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 8173 arm_feature(env, ARM_FEATURE_EL3) && 8174 !arm_feature(env, ARM_FEATURE_EL2) && 8175 !arm_is_secure(env)) { 8176 8177 changed_daif = (env->daif ^ val) & mask; 8178 8179 if (changed_daif & CPSR_A) { 8180 /* Check to see if we are allowed to change the masking of async 8181 * abort exceptions from a non-secure state. 8182 */ 8183 if (!(env->cp15.scr_el3 & SCR_AW)) { 8184 qemu_log_mask(LOG_GUEST_ERROR, 8185 "Ignoring attempt to switch CPSR_A flag from " 8186 "non-secure world with SCR.AW bit clear\n"); 8187 mask &= ~CPSR_A; 8188 } 8189 } 8190 8191 if (changed_daif & CPSR_F) { 8192 /* Check to see if we are allowed to change the masking of FIQ 8193 * exceptions from a non-secure state. 8194 */ 8195 if (!(env->cp15.scr_el3 & SCR_FW)) { 8196 qemu_log_mask(LOG_GUEST_ERROR, 8197 "Ignoring attempt to switch CPSR_F flag from " 8198 "non-secure world with SCR.FW bit clear\n"); 8199 mask &= ~CPSR_F; 8200 } 8201 8202 /* Check whether non-maskable FIQ (NMFI) support is enabled. 8203 * If this bit is set software is not allowed to mask 8204 * FIQs, but is allowed to set CPSR_F to 0. 8205 */ 8206 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 8207 (val & CPSR_F)) { 8208 qemu_log_mask(LOG_GUEST_ERROR, 8209 "Ignoring attempt to enable CPSR_F flag " 8210 "(non-maskable FIQ [NMFI] support enabled)\n"); 8211 mask &= ~CPSR_F; 8212 } 8213 } 8214 } 8215 8216 env->daif &= ~(CPSR_AIF & mask); 8217 env->daif |= val & CPSR_AIF & mask; 8218 8219 if (write_type != CPSRWriteRaw && 8220 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 8221 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 8222 /* Note that we can only get here in USR mode if this is a 8223 * gdb stub write; for this case we follow the architectural 8224 * behaviour for guest writes in USR mode of ignoring an attempt 8225 * to switch mode. (Those are caught by translate.c for writes 8226 * triggered by guest instructions.) 8227 */ 8228 mask &= ~CPSR_M; 8229 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 8230 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in 8231 * v7, and has defined behaviour in v8: 8232 * + leave CPSR.M untouched 8233 * + allow changes to the other CPSR fields 8234 * + set PSTATE.IL 8235 * For user changes via the GDB stub, we don't set PSTATE.IL, 8236 * as this would be unnecessarily harsh for a user error. 8237 */ 8238 mask &= ~CPSR_M; 8239 if (write_type != CPSRWriteByGDBStub && 8240 arm_feature(env, ARM_FEATURE_V8)) { 8241 mask |= CPSR_IL; 8242 val |= CPSR_IL; 8243 } 8244 qemu_log_mask(LOG_GUEST_ERROR, 8245 "Illegal AArch32 mode switch attempt from %s to %s\n", 8246 aarch32_mode_name(env->uncached_cpsr), 8247 aarch32_mode_name(val)); 8248 } else { 8249 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 8250 write_type == CPSRWriteExceptionReturn ? 8251 "Exception return from AArch32" : 8252 "AArch32 mode switch from", 8253 aarch32_mode_name(env->uncached_cpsr), 8254 aarch32_mode_name(val), env->regs[15]); 8255 switch_mode(env, val & CPSR_M); 8256 } 8257 } 8258 mask &= ~CACHED_CPSR_BITS; 8259 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 8260 } 8261 8262 /* Sign/zero extend */ 8263 uint32_t HELPER(sxtb16)(uint32_t x) 8264 { 8265 uint32_t res; 8266 res = (uint16_t)(int8_t)x; 8267 res |= (uint32_t)(int8_t)(x >> 16) << 16; 8268 return res; 8269 } 8270 8271 uint32_t HELPER(uxtb16)(uint32_t x) 8272 { 8273 uint32_t res; 8274 res = (uint16_t)(uint8_t)x; 8275 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 8276 return res; 8277 } 8278 8279 int32_t HELPER(sdiv)(int32_t num, int32_t den) 8280 { 8281 if (den == 0) 8282 return 0; 8283 if (num == INT_MIN && den == -1) 8284 return INT_MIN; 8285 return num / den; 8286 } 8287 8288 uint32_t HELPER(udiv)(uint32_t num, uint32_t den) 8289 { 8290 if (den == 0) 8291 return 0; 8292 return num / den; 8293 } 8294 8295 uint32_t HELPER(rbit)(uint32_t x) 8296 { 8297 return revbit32(x); 8298 } 8299 8300 #ifdef CONFIG_USER_ONLY 8301 8302 static void switch_mode(CPUARMState *env, int mode) 8303 { 8304 ARMCPU *cpu = env_archcpu(env); 8305 8306 if (mode != ARM_CPU_MODE_USR) { 8307 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 8308 } 8309 } 8310 8311 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 8312 uint32_t cur_el, bool secure) 8313 { 8314 return 1; 8315 } 8316 8317 void aarch64_sync_64_to_32(CPUARMState *env) 8318 { 8319 g_assert_not_reached(); 8320 } 8321 8322 #else 8323 8324 static void switch_mode(CPUARMState *env, int mode) 8325 { 8326 int old_mode; 8327 int i; 8328 8329 old_mode = env->uncached_cpsr & CPSR_M; 8330 if (mode == old_mode) 8331 return; 8332 8333 if (old_mode == ARM_CPU_MODE_FIQ) { 8334 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 8335 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 8336 } else if (mode == ARM_CPU_MODE_FIQ) { 8337 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 8338 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 8339 } 8340 8341 i = bank_number(old_mode); 8342 env->banked_r13[i] = env->regs[13]; 8343 env->banked_spsr[i] = env->spsr; 8344 8345 i = bank_number(mode); 8346 env->regs[13] = env->banked_r13[i]; 8347 env->spsr = env->banked_spsr[i]; 8348 8349 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 8350 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 8351 } 8352 8353 /* Physical Interrupt Target EL Lookup Table 8354 * 8355 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 8356 * 8357 * The below multi-dimensional table is used for looking up the target 8358 * exception level given numerous condition criteria. Specifically, the 8359 * target EL is based on SCR and HCR routing controls as well as the 8360 * currently executing EL and secure state. 8361 * 8362 * Dimensions: 8363 * target_el_table[2][2][2][2][2][4] 8364 * | | | | | +--- Current EL 8365 * | | | | +------ Non-secure(0)/Secure(1) 8366 * | | | +--------- HCR mask override 8367 * | | +------------ SCR exec state control 8368 * | +--------------- SCR mask override 8369 * +------------------ 32-bit(0)/64-bit(1) EL3 8370 * 8371 * The table values are as such: 8372 * 0-3 = EL0-EL3 8373 * -1 = Cannot occur 8374 * 8375 * The ARM ARM target EL table includes entries indicating that an "exception 8376 * is not taken". The two cases where this is applicable are: 8377 * 1) An exception is taken from EL3 but the SCR does not have the exception 8378 * routed to EL3. 8379 * 2) An exception is taken from EL2 but the HCR does not have the exception 8380 * routed to EL2. 8381 * In these two cases, the below table contain a target of EL1. This value is 8382 * returned as it is expected that the consumer of the table data will check 8383 * for "target EL >= current EL" to ensure the exception is not taken. 8384 * 8385 * SCR HCR 8386 * 64 EA AMO From 8387 * BIT IRQ IMO Non-secure Secure 8388 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 8389 */ 8390 static const int8_t target_el_table[2][2][2][2][2][4] = { 8391 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 8392 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 8393 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 8394 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 8395 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 8396 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 8397 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 8398 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 8399 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 8400 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},}, 8401 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },}, 8402 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},}, 8403 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 8404 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 8405 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 8406 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},}, 8407 }; 8408 8409 /* 8410 * Determine the target EL for physical exceptions 8411 */ 8412 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 8413 uint32_t cur_el, bool secure) 8414 { 8415 CPUARMState *env = cs->env_ptr; 8416 bool rw; 8417 bool scr; 8418 bool hcr; 8419 int target_el; 8420 /* Is the highest EL AArch64? */ 8421 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 8422 uint64_t hcr_el2; 8423 8424 if (arm_feature(env, ARM_FEATURE_EL3)) { 8425 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 8426 } else { 8427 /* Either EL2 is the highest EL (and so the EL2 register width 8428 * is given by is64); or there is no EL2 or EL3, in which case 8429 * the value of 'rw' does not affect the table lookup anyway. 8430 */ 8431 rw = is64; 8432 } 8433 8434 hcr_el2 = arm_hcr_el2_eff(env); 8435 switch (excp_idx) { 8436 case EXCP_IRQ: 8437 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 8438 hcr = hcr_el2 & HCR_IMO; 8439 break; 8440 case EXCP_FIQ: 8441 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 8442 hcr = hcr_el2 & HCR_FMO; 8443 break; 8444 default: 8445 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 8446 hcr = hcr_el2 & HCR_AMO; 8447 break; 8448 }; 8449 8450 /* 8451 * For these purposes, TGE and AMO/IMO/FMO both force the 8452 * interrupt to EL2. Fold TGE into the bit extracted above. 8453 */ 8454 hcr |= (hcr_el2 & HCR_TGE) != 0; 8455 8456 /* Perform a table-lookup for the target EL given the current state */ 8457 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 8458 8459 assert(target_el > 0); 8460 8461 return target_el; 8462 } 8463 8464 void arm_log_exception(int idx) 8465 { 8466 if (qemu_loglevel_mask(CPU_LOG_INT)) { 8467 const char *exc = NULL; 8468 static const char * const excnames[] = { 8469 [EXCP_UDEF] = "Undefined Instruction", 8470 [EXCP_SWI] = "SVC", 8471 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 8472 [EXCP_DATA_ABORT] = "Data Abort", 8473 [EXCP_IRQ] = "IRQ", 8474 [EXCP_FIQ] = "FIQ", 8475 [EXCP_BKPT] = "Breakpoint", 8476 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 8477 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 8478 [EXCP_HVC] = "Hypervisor Call", 8479 [EXCP_HYP_TRAP] = "Hypervisor Trap", 8480 [EXCP_SMC] = "Secure Monitor Call", 8481 [EXCP_VIRQ] = "Virtual IRQ", 8482 [EXCP_VFIQ] = "Virtual FIQ", 8483 [EXCP_SEMIHOST] = "Semihosting call", 8484 [EXCP_NOCP] = "v7M NOCP UsageFault", 8485 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 8486 [EXCP_STKOF] = "v8M STKOF UsageFault", 8487 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking", 8488 [EXCP_LSERR] = "v8M LSERR UsageFault", 8489 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault", 8490 }; 8491 8492 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 8493 exc = excnames[idx]; 8494 } 8495 if (!exc) { 8496 exc = "unknown"; 8497 } 8498 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc); 8499 } 8500 } 8501 8502 /* 8503 * Function used to synchronize QEMU's AArch64 register set with AArch32 8504 * register set. This is necessary when switching between AArch32 and AArch64 8505 * execution state. 8506 */ 8507 void aarch64_sync_32_to_64(CPUARMState *env) 8508 { 8509 int i; 8510 uint32_t mode = env->uncached_cpsr & CPSR_M; 8511 8512 /* We can blanket copy R[0:7] to X[0:7] */ 8513 for (i = 0; i < 8; i++) { 8514 env->xregs[i] = env->regs[i]; 8515 } 8516 8517 /* 8518 * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 8519 * Otherwise, they come from the banked user regs. 8520 */ 8521 if (mode == ARM_CPU_MODE_FIQ) { 8522 for (i = 8; i < 13; i++) { 8523 env->xregs[i] = env->usr_regs[i - 8]; 8524 } 8525 } else { 8526 for (i = 8; i < 13; i++) { 8527 env->xregs[i] = env->regs[i]; 8528 } 8529 } 8530 8531 /* 8532 * Registers x13-x23 are the various mode SP and FP registers. Registers 8533 * r13 and r14 are only copied if we are in that mode, otherwise we copy 8534 * from the mode banked register. 8535 */ 8536 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 8537 env->xregs[13] = env->regs[13]; 8538 env->xregs[14] = env->regs[14]; 8539 } else { 8540 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 8541 /* HYP is an exception in that it is copied from r14 */ 8542 if (mode == ARM_CPU_MODE_HYP) { 8543 env->xregs[14] = env->regs[14]; 8544 } else { 8545 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 8546 } 8547 } 8548 8549 if (mode == ARM_CPU_MODE_HYP) { 8550 env->xregs[15] = env->regs[13]; 8551 } else { 8552 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 8553 } 8554 8555 if (mode == ARM_CPU_MODE_IRQ) { 8556 env->xregs[16] = env->regs[14]; 8557 env->xregs[17] = env->regs[13]; 8558 } else { 8559 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 8560 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 8561 } 8562 8563 if (mode == ARM_CPU_MODE_SVC) { 8564 env->xregs[18] = env->regs[14]; 8565 env->xregs[19] = env->regs[13]; 8566 } else { 8567 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 8568 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 8569 } 8570 8571 if (mode == ARM_CPU_MODE_ABT) { 8572 env->xregs[20] = env->regs[14]; 8573 env->xregs[21] = env->regs[13]; 8574 } else { 8575 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 8576 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 8577 } 8578 8579 if (mode == ARM_CPU_MODE_UND) { 8580 env->xregs[22] = env->regs[14]; 8581 env->xregs[23] = env->regs[13]; 8582 } else { 8583 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 8584 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 8585 } 8586 8587 /* 8588 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 8589 * mode, then we can copy from r8-r14. Otherwise, we copy from the 8590 * FIQ bank for r8-r14. 8591 */ 8592 if (mode == ARM_CPU_MODE_FIQ) { 8593 for (i = 24; i < 31; i++) { 8594 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 8595 } 8596 } else { 8597 for (i = 24; i < 29; i++) { 8598 env->xregs[i] = env->fiq_regs[i - 24]; 8599 } 8600 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 8601 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 8602 } 8603 8604 env->pc = env->regs[15]; 8605 } 8606 8607 /* 8608 * Function used to synchronize QEMU's AArch32 register set with AArch64 8609 * register set. This is necessary when switching between AArch32 and AArch64 8610 * execution state. 8611 */ 8612 void aarch64_sync_64_to_32(CPUARMState *env) 8613 { 8614 int i; 8615 uint32_t mode = env->uncached_cpsr & CPSR_M; 8616 8617 /* We can blanket copy X[0:7] to R[0:7] */ 8618 for (i = 0; i < 8; i++) { 8619 env->regs[i] = env->xregs[i]; 8620 } 8621 8622 /* 8623 * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 8624 * Otherwise, we copy x8-x12 into the banked user regs. 8625 */ 8626 if (mode == ARM_CPU_MODE_FIQ) { 8627 for (i = 8; i < 13; i++) { 8628 env->usr_regs[i - 8] = env->xregs[i]; 8629 } 8630 } else { 8631 for (i = 8; i < 13; i++) { 8632 env->regs[i] = env->xregs[i]; 8633 } 8634 } 8635 8636 /* 8637 * Registers r13 & r14 depend on the current mode. 8638 * If we are in a given mode, we copy the corresponding x registers to r13 8639 * and r14. Otherwise, we copy the x register to the banked r13 and r14 8640 * for the mode. 8641 */ 8642 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 8643 env->regs[13] = env->xregs[13]; 8644 env->regs[14] = env->xregs[14]; 8645 } else { 8646 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 8647 8648 /* 8649 * HYP is an exception in that it does not have its own banked r14 but 8650 * shares the USR r14 8651 */ 8652 if (mode == ARM_CPU_MODE_HYP) { 8653 env->regs[14] = env->xregs[14]; 8654 } else { 8655 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 8656 } 8657 } 8658 8659 if (mode == ARM_CPU_MODE_HYP) { 8660 env->regs[13] = env->xregs[15]; 8661 } else { 8662 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 8663 } 8664 8665 if (mode == ARM_CPU_MODE_IRQ) { 8666 env->regs[14] = env->xregs[16]; 8667 env->regs[13] = env->xregs[17]; 8668 } else { 8669 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 8670 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 8671 } 8672 8673 if (mode == ARM_CPU_MODE_SVC) { 8674 env->regs[14] = env->xregs[18]; 8675 env->regs[13] = env->xregs[19]; 8676 } else { 8677 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 8678 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 8679 } 8680 8681 if (mode == ARM_CPU_MODE_ABT) { 8682 env->regs[14] = env->xregs[20]; 8683 env->regs[13] = env->xregs[21]; 8684 } else { 8685 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 8686 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 8687 } 8688 8689 if (mode == ARM_CPU_MODE_UND) { 8690 env->regs[14] = env->xregs[22]; 8691 env->regs[13] = env->xregs[23]; 8692 } else { 8693 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 8694 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 8695 } 8696 8697 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 8698 * mode, then we can copy to r8-r14. Otherwise, we copy to the 8699 * FIQ bank for r8-r14. 8700 */ 8701 if (mode == ARM_CPU_MODE_FIQ) { 8702 for (i = 24; i < 31; i++) { 8703 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 8704 } 8705 } else { 8706 for (i = 24; i < 29; i++) { 8707 env->fiq_regs[i - 24] = env->xregs[i]; 8708 } 8709 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 8710 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 8711 } 8712 8713 env->regs[15] = env->pc; 8714 } 8715 8716 static void take_aarch32_exception(CPUARMState *env, int new_mode, 8717 uint32_t mask, uint32_t offset, 8718 uint32_t newpc) 8719 { 8720 /* Change the CPU state so as to actually take the exception. */ 8721 switch_mode(env, new_mode); 8722 /* 8723 * For exceptions taken to AArch32 we must clear the SS bit in both 8724 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 8725 */ 8726 env->uncached_cpsr &= ~PSTATE_SS; 8727 env->spsr = cpsr_read(env); 8728 /* Clear IT bits. */ 8729 env->condexec_bits = 0; 8730 /* Switch to the new mode, and to the correct instruction set. */ 8731 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 8732 /* Set new mode endianness */ 8733 env->uncached_cpsr &= ~CPSR_E; 8734 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) { 8735 env->uncached_cpsr |= CPSR_E; 8736 } 8737 /* J and IL must always be cleared for exception entry */ 8738 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 8739 env->daif |= mask; 8740 8741 if (new_mode == ARM_CPU_MODE_HYP) { 8742 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 8743 env->elr_el[2] = env->regs[15]; 8744 } else { 8745 /* 8746 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 8747 * and we should just guard the thumb mode on V4 8748 */ 8749 if (arm_feature(env, ARM_FEATURE_V4T)) { 8750 env->thumb = 8751 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 8752 } 8753 env->regs[14] = env->regs[15] + offset; 8754 } 8755 env->regs[15] = newpc; 8756 arm_rebuild_hflags(env); 8757 } 8758 8759 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 8760 { 8761 /* 8762 * Handle exception entry to Hyp mode; this is sufficiently 8763 * different to entry to other AArch32 modes that we handle it 8764 * separately here. 8765 * 8766 * The vector table entry used is always the 0x14 Hyp mode entry point, 8767 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp. 8768 * The offset applied to the preferred return address is always zero 8769 * (see DDI0487C.a section G1.12.3). 8770 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 8771 */ 8772 uint32_t addr, mask; 8773 ARMCPU *cpu = ARM_CPU(cs); 8774 CPUARMState *env = &cpu->env; 8775 8776 switch (cs->exception_index) { 8777 case EXCP_UDEF: 8778 addr = 0x04; 8779 break; 8780 case EXCP_SWI: 8781 addr = 0x14; 8782 break; 8783 case EXCP_BKPT: 8784 /* Fall through to prefetch abort. */ 8785 case EXCP_PREFETCH_ABORT: 8786 env->cp15.ifar_s = env->exception.vaddress; 8787 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 8788 (uint32_t)env->exception.vaddress); 8789 addr = 0x0c; 8790 break; 8791 case EXCP_DATA_ABORT: 8792 env->cp15.dfar_s = env->exception.vaddress; 8793 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 8794 (uint32_t)env->exception.vaddress); 8795 addr = 0x10; 8796 break; 8797 case EXCP_IRQ: 8798 addr = 0x18; 8799 break; 8800 case EXCP_FIQ: 8801 addr = 0x1c; 8802 break; 8803 case EXCP_HVC: 8804 addr = 0x08; 8805 break; 8806 case EXCP_HYP_TRAP: 8807 addr = 0x14; 8808 break; 8809 default: 8810 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 8811 } 8812 8813 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 8814 if (!arm_feature(env, ARM_FEATURE_V8)) { 8815 /* 8816 * QEMU syndrome values are v8-style. v7 has the IL bit 8817 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 8818 * If this is a v7 CPU, squash the IL bit in those cases. 8819 */ 8820 if (cs->exception_index == EXCP_PREFETCH_ABORT || 8821 (cs->exception_index == EXCP_DATA_ABORT && 8822 !(env->exception.syndrome & ARM_EL_ISV)) || 8823 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 8824 env->exception.syndrome &= ~ARM_EL_IL; 8825 } 8826 } 8827 env->cp15.esr_el[2] = env->exception.syndrome; 8828 } 8829 8830 if (arm_current_el(env) != 2 && addr < 0x14) { 8831 addr = 0x14; 8832 } 8833 8834 mask = 0; 8835 if (!(env->cp15.scr_el3 & SCR_EA)) { 8836 mask |= CPSR_A; 8837 } 8838 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 8839 mask |= CPSR_I; 8840 } 8841 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 8842 mask |= CPSR_F; 8843 } 8844 8845 addr += env->cp15.hvbar; 8846 8847 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 8848 } 8849 8850 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 8851 { 8852 ARMCPU *cpu = ARM_CPU(cs); 8853 CPUARMState *env = &cpu->env; 8854 uint32_t addr; 8855 uint32_t mask; 8856 int new_mode; 8857 uint32_t offset; 8858 uint32_t moe; 8859 8860 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 8861 switch (syn_get_ec(env->exception.syndrome)) { 8862 case EC_BREAKPOINT: 8863 case EC_BREAKPOINT_SAME_EL: 8864 moe = 1; 8865 break; 8866 case EC_WATCHPOINT: 8867 case EC_WATCHPOINT_SAME_EL: 8868 moe = 10; 8869 break; 8870 case EC_AA32_BKPT: 8871 moe = 3; 8872 break; 8873 case EC_VECTORCATCH: 8874 moe = 5; 8875 break; 8876 default: 8877 moe = 0; 8878 break; 8879 } 8880 8881 if (moe) { 8882 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 8883 } 8884 8885 if (env->exception.target_el == 2) { 8886 arm_cpu_do_interrupt_aarch32_hyp(cs); 8887 return; 8888 } 8889 8890 switch (cs->exception_index) { 8891 case EXCP_UDEF: 8892 new_mode = ARM_CPU_MODE_UND; 8893 addr = 0x04; 8894 mask = CPSR_I; 8895 if (env->thumb) 8896 offset = 2; 8897 else 8898 offset = 4; 8899 break; 8900 case EXCP_SWI: 8901 new_mode = ARM_CPU_MODE_SVC; 8902 addr = 0x08; 8903 mask = CPSR_I; 8904 /* The PC already points to the next instruction. */ 8905 offset = 0; 8906 break; 8907 case EXCP_BKPT: 8908 /* Fall through to prefetch abort. */ 8909 case EXCP_PREFETCH_ABORT: 8910 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 8911 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 8912 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 8913 env->exception.fsr, (uint32_t)env->exception.vaddress); 8914 new_mode = ARM_CPU_MODE_ABT; 8915 addr = 0x0c; 8916 mask = CPSR_A | CPSR_I; 8917 offset = 4; 8918 break; 8919 case EXCP_DATA_ABORT: 8920 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 8921 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 8922 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 8923 env->exception.fsr, 8924 (uint32_t)env->exception.vaddress); 8925 new_mode = ARM_CPU_MODE_ABT; 8926 addr = 0x10; 8927 mask = CPSR_A | CPSR_I; 8928 offset = 8; 8929 break; 8930 case EXCP_IRQ: 8931 new_mode = ARM_CPU_MODE_IRQ; 8932 addr = 0x18; 8933 /* Disable IRQ and imprecise data aborts. */ 8934 mask = CPSR_A | CPSR_I; 8935 offset = 4; 8936 if (env->cp15.scr_el3 & SCR_IRQ) { 8937 /* IRQ routed to monitor mode */ 8938 new_mode = ARM_CPU_MODE_MON; 8939 mask |= CPSR_F; 8940 } 8941 break; 8942 case EXCP_FIQ: 8943 new_mode = ARM_CPU_MODE_FIQ; 8944 addr = 0x1c; 8945 /* Disable FIQ, IRQ and imprecise data aborts. */ 8946 mask = CPSR_A | CPSR_I | CPSR_F; 8947 if (env->cp15.scr_el3 & SCR_FIQ) { 8948 /* FIQ routed to monitor mode */ 8949 new_mode = ARM_CPU_MODE_MON; 8950 } 8951 offset = 4; 8952 break; 8953 case EXCP_VIRQ: 8954 new_mode = ARM_CPU_MODE_IRQ; 8955 addr = 0x18; 8956 /* Disable IRQ and imprecise data aborts. */ 8957 mask = CPSR_A | CPSR_I; 8958 offset = 4; 8959 break; 8960 case EXCP_VFIQ: 8961 new_mode = ARM_CPU_MODE_FIQ; 8962 addr = 0x1c; 8963 /* Disable FIQ, IRQ and imprecise data aborts. */ 8964 mask = CPSR_A | CPSR_I | CPSR_F; 8965 offset = 4; 8966 break; 8967 case EXCP_SMC: 8968 new_mode = ARM_CPU_MODE_MON; 8969 addr = 0x08; 8970 mask = CPSR_A | CPSR_I | CPSR_F; 8971 offset = 0; 8972 break; 8973 default: 8974 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 8975 return; /* Never happens. Keep compiler happy. */ 8976 } 8977 8978 if (new_mode == ARM_CPU_MODE_MON) { 8979 addr += env->cp15.mvbar; 8980 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 8981 /* High vectors. When enabled, base address cannot be remapped. */ 8982 addr += 0xffff0000; 8983 } else { 8984 /* ARM v7 architectures provide a vector base address register to remap 8985 * the interrupt vector table. 8986 * This register is only followed in non-monitor mode, and is banked. 8987 * Note: only bits 31:5 are valid. 8988 */ 8989 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 8990 } 8991 8992 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 8993 env->cp15.scr_el3 &= ~SCR_NS; 8994 } 8995 8996 take_aarch32_exception(env, new_mode, mask, offset, addr); 8997 } 8998 8999 /* Handle exception entry to a target EL which is using AArch64 */ 9000 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 9001 { 9002 ARMCPU *cpu = ARM_CPU(cs); 9003 CPUARMState *env = &cpu->env; 9004 unsigned int new_el = env->exception.target_el; 9005 target_ulong addr = env->cp15.vbar_el[new_el]; 9006 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 9007 unsigned int cur_el = arm_current_el(env); 9008 9009 /* 9010 * Note that new_el can never be 0. If cur_el is 0, then 9011 * el0_a64 is is_a64(), else el0_a64 is ignored. 9012 */ 9013 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 9014 9015 if (cur_el < new_el) { 9016 /* Entry vector offset depends on whether the implemented EL 9017 * immediately lower than the target level is using AArch32 or AArch64 9018 */ 9019 bool is_aa64; 9020 uint64_t hcr; 9021 9022 switch (new_el) { 9023 case 3: 9024 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 9025 break; 9026 case 2: 9027 hcr = arm_hcr_el2_eff(env); 9028 if ((hcr & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 9029 is_aa64 = (hcr & HCR_RW) != 0; 9030 break; 9031 } 9032 /* fall through */ 9033 case 1: 9034 is_aa64 = is_a64(env); 9035 break; 9036 default: 9037 g_assert_not_reached(); 9038 } 9039 9040 if (is_aa64) { 9041 addr += 0x400; 9042 } else { 9043 addr += 0x600; 9044 } 9045 } else if (pstate_read(env) & PSTATE_SP) { 9046 addr += 0x200; 9047 } 9048 9049 switch (cs->exception_index) { 9050 case EXCP_PREFETCH_ABORT: 9051 case EXCP_DATA_ABORT: 9052 env->cp15.far_el[new_el] = env->exception.vaddress; 9053 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 9054 env->cp15.far_el[new_el]); 9055 /* fall through */ 9056 case EXCP_BKPT: 9057 case EXCP_UDEF: 9058 case EXCP_SWI: 9059 case EXCP_HVC: 9060 case EXCP_HYP_TRAP: 9061 case EXCP_SMC: 9062 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) { 9063 /* 9064 * QEMU internal FP/SIMD syndromes from AArch32 include the 9065 * TA and coproc fields which are only exposed if the exception 9066 * is taken to AArch32 Hyp mode. Mask them out to get a valid 9067 * AArch64 format syndrome. 9068 */ 9069 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 9070 } 9071 env->cp15.esr_el[new_el] = env->exception.syndrome; 9072 break; 9073 case EXCP_IRQ: 9074 case EXCP_VIRQ: 9075 addr += 0x80; 9076 break; 9077 case EXCP_FIQ: 9078 case EXCP_VFIQ: 9079 addr += 0x100; 9080 break; 9081 default: 9082 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9083 } 9084 9085 if (is_a64(env)) { 9086 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env); 9087 aarch64_save_sp(env, arm_current_el(env)); 9088 env->elr_el[new_el] = env->pc; 9089 } else { 9090 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env); 9091 env->elr_el[new_el] = env->regs[15]; 9092 9093 aarch64_sync_32_to_64(env); 9094 9095 env->condexec_bits = 0; 9096 } 9097 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 9098 env->elr_el[new_el]); 9099 9100 pstate_write(env, PSTATE_DAIF | new_mode); 9101 env->aarch64 = 1; 9102 aarch64_restore_sp(env, new_el); 9103 helper_rebuild_hflags_a64(env, new_el); 9104 9105 env->pc = addr; 9106 9107 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 9108 new_el, env->pc, pstate_read(env)); 9109 } 9110 9111 /* 9112 * Do semihosting call and set the appropriate return value. All the 9113 * permission and validity checks have been done at translate time. 9114 * 9115 * We only see semihosting exceptions in TCG only as they are not 9116 * trapped to the hypervisor in KVM. 9117 */ 9118 #ifdef CONFIG_TCG 9119 static void handle_semihosting(CPUState *cs) 9120 { 9121 ARMCPU *cpu = ARM_CPU(cs); 9122 CPUARMState *env = &cpu->env; 9123 9124 if (is_a64(env)) { 9125 qemu_log_mask(CPU_LOG_INT, 9126 "...handling as semihosting call 0x%" PRIx64 "\n", 9127 env->xregs[0]); 9128 env->xregs[0] = do_arm_semihosting(env); 9129 env->pc += 4; 9130 } else { 9131 qemu_log_mask(CPU_LOG_INT, 9132 "...handling as semihosting call 0x%x\n", 9133 env->regs[0]); 9134 env->regs[0] = do_arm_semihosting(env); 9135 env->regs[15] += env->thumb ? 2 : 4; 9136 } 9137 } 9138 #endif 9139 9140 /* Handle a CPU exception for A and R profile CPUs. 9141 * Do any appropriate logging, handle PSCI calls, and then hand off 9142 * to the AArch64-entry or AArch32-entry function depending on the 9143 * target exception level's register width. 9144 */ 9145 void arm_cpu_do_interrupt(CPUState *cs) 9146 { 9147 ARMCPU *cpu = ARM_CPU(cs); 9148 CPUARMState *env = &cpu->env; 9149 unsigned int new_el = env->exception.target_el; 9150 9151 assert(!arm_feature(env, ARM_FEATURE_M)); 9152 9153 arm_log_exception(cs->exception_index); 9154 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 9155 new_el); 9156 if (qemu_loglevel_mask(CPU_LOG_INT) 9157 && !excp_is_internal(cs->exception_index)) { 9158 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 9159 syn_get_ec(env->exception.syndrome), 9160 env->exception.syndrome); 9161 } 9162 9163 if (arm_is_psci_call(cpu, cs->exception_index)) { 9164 arm_handle_psci_call(cpu); 9165 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 9166 return; 9167 } 9168 9169 /* 9170 * Semihosting semantics depend on the register width of the code 9171 * that caused the exception, not the target exception level, so 9172 * must be handled here. 9173 */ 9174 #ifdef CONFIG_TCG 9175 if (cs->exception_index == EXCP_SEMIHOST) { 9176 handle_semihosting(cs); 9177 return; 9178 } 9179 #endif 9180 9181 /* Hooks may change global state so BQL should be held, also the 9182 * BQL needs to be held for any modification of 9183 * cs->interrupt_request. 9184 */ 9185 g_assert(qemu_mutex_iothread_locked()); 9186 9187 arm_call_pre_el_change_hook(cpu); 9188 9189 assert(!excp_is_internal(cs->exception_index)); 9190 if (arm_el_is_aa64(env, new_el)) { 9191 arm_cpu_do_interrupt_aarch64(cs); 9192 } else { 9193 arm_cpu_do_interrupt_aarch32(cs); 9194 } 9195 9196 arm_call_el_change_hook(cpu); 9197 9198 if (!kvm_enabled()) { 9199 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 9200 } 9201 } 9202 #endif /* !CONFIG_USER_ONLY */ 9203 9204 /* Return the exception level which controls this address translation regime */ 9205 static uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx) 9206 { 9207 switch (mmu_idx) { 9208 case ARMMMUIdx_E20_0: 9209 case ARMMMUIdx_E20_2: 9210 case ARMMMUIdx_Stage2: 9211 case ARMMMUIdx_E2: 9212 return 2; 9213 case ARMMMUIdx_SE3: 9214 return 3; 9215 case ARMMMUIdx_SE10_0: 9216 return arm_el_is_aa64(env, 3) ? 1 : 3; 9217 case ARMMMUIdx_SE10_1: 9218 case ARMMMUIdx_Stage1_E0: 9219 case ARMMMUIdx_Stage1_E1: 9220 case ARMMMUIdx_E10_0: 9221 case ARMMMUIdx_E10_1: 9222 case ARMMMUIdx_MPrivNegPri: 9223 case ARMMMUIdx_MUserNegPri: 9224 case ARMMMUIdx_MPriv: 9225 case ARMMMUIdx_MUser: 9226 case ARMMMUIdx_MSPrivNegPri: 9227 case ARMMMUIdx_MSUserNegPri: 9228 case ARMMMUIdx_MSPriv: 9229 case ARMMMUIdx_MSUser: 9230 return 1; 9231 default: 9232 g_assert_not_reached(); 9233 } 9234 } 9235 9236 uint64_t arm_sctlr(CPUARMState *env, int el) 9237 { 9238 /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */ 9239 if (el == 0) { 9240 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0); 9241 el = (mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1); 9242 } 9243 return env->cp15.sctlr_el[el]; 9244 } 9245 9246 /* Return the SCTLR value which controls this address translation regime */ 9247 static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx) 9248 { 9249 return env->cp15.sctlr_el[regime_el(env, mmu_idx)]; 9250 } 9251 9252 #ifndef CONFIG_USER_ONLY 9253 9254 /* Return true if the specified stage of address translation is disabled */ 9255 static inline bool regime_translation_disabled(CPUARMState *env, 9256 ARMMMUIdx mmu_idx) 9257 { 9258 if (arm_feature(env, ARM_FEATURE_M)) { 9259 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] & 9260 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 9261 case R_V7M_MPU_CTRL_ENABLE_MASK: 9262 /* Enabled, but not for HardFault and NMI */ 9263 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 9264 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 9265 /* Enabled for all cases */ 9266 return false; 9267 case 0: 9268 default: 9269 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 9270 * we warned about that in armv7m_nvic.c when the guest set it. 9271 */ 9272 return true; 9273 } 9274 } 9275 9276 if (mmu_idx == ARMMMUIdx_Stage2) { 9277 /* HCR.DC means HCR.VM behaves as 1 */ 9278 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0; 9279 } 9280 9281 if (env->cp15.hcr_el2 & HCR_TGE) { 9282 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */ 9283 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) { 9284 return true; 9285 } 9286 } 9287 9288 if ((env->cp15.hcr_el2 & HCR_DC) && 9289 (mmu_idx == ARMMMUIdx_Stage1_E0 || mmu_idx == ARMMMUIdx_Stage1_E1)) { 9290 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 9291 return true; 9292 } 9293 9294 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 9295 } 9296 9297 static inline bool regime_translation_big_endian(CPUARMState *env, 9298 ARMMMUIdx mmu_idx) 9299 { 9300 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 9301 } 9302 9303 /* Return the TTBR associated with this translation regime */ 9304 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, 9305 int ttbrn) 9306 { 9307 if (mmu_idx == ARMMMUIdx_Stage2) { 9308 return env->cp15.vttbr_el2; 9309 } 9310 if (ttbrn == 0) { 9311 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 9312 } else { 9313 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 9314 } 9315 } 9316 9317 #endif /* !CONFIG_USER_ONLY */ 9318 9319 /* Return the TCR controlling this translation regime */ 9320 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx) 9321 { 9322 if (mmu_idx == ARMMMUIdx_Stage2) { 9323 return &env->cp15.vtcr_el2; 9324 } 9325 return &env->cp15.tcr_el[regime_el(env, mmu_idx)]; 9326 } 9327 9328 /* Convert a possible stage1+2 MMU index into the appropriate 9329 * stage 1 MMU index 9330 */ 9331 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 9332 { 9333 switch (mmu_idx) { 9334 case ARMMMUIdx_E10_0: 9335 return ARMMMUIdx_Stage1_E0; 9336 case ARMMMUIdx_E10_1: 9337 return ARMMMUIdx_Stage1_E1; 9338 default: 9339 return mmu_idx; 9340 } 9341 } 9342 9343 /* Return true if the translation regime is using LPAE format page tables */ 9344 static inline bool regime_using_lpae_format(CPUARMState *env, 9345 ARMMMUIdx mmu_idx) 9346 { 9347 int el = regime_el(env, mmu_idx); 9348 if (el == 2 || arm_el_is_aa64(env, el)) { 9349 return true; 9350 } 9351 if (arm_feature(env, ARM_FEATURE_LPAE) 9352 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) { 9353 return true; 9354 } 9355 return false; 9356 } 9357 9358 /* Returns true if the stage 1 translation regime is using LPAE format page 9359 * tables. Used when raising alignment exceptions, whose FSR changes depending 9360 * on whether the long or short descriptor format is in use. */ 9361 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx) 9362 { 9363 mmu_idx = stage_1_mmu_idx(mmu_idx); 9364 9365 return regime_using_lpae_format(env, mmu_idx); 9366 } 9367 9368 #ifndef CONFIG_USER_ONLY 9369 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx) 9370 { 9371 switch (mmu_idx) { 9372 case ARMMMUIdx_SE10_0: 9373 case ARMMMUIdx_E20_0: 9374 case ARMMMUIdx_Stage1_E0: 9375 case ARMMMUIdx_MUser: 9376 case ARMMMUIdx_MSUser: 9377 case ARMMMUIdx_MUserNegPri: 9378 case ARMMMUIdx_MSUserNegPri: 9379 return true; 9380 default: 9381 return false; 9382 case ARMMMUIdx_E10_0: 9383 case ARMMMUIdx_E10_1: 9384 g_assert_not_reached(); 9385 } 9386 } 9387 9388 /* Translate section/page access permissions to page 9389 * R/W protection flags 9390 * 9391 * @env: CPUARMState 9392 * @mmu_idx: MMU index indicating required translation regime 9393 * @ap: The 3-bit access permissions (AP[2:0]) 9394 * @domain_prot: The 2-bit domain access permissions 9395 */ 9396 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 9397 int ap, int domain_prot) 9398 { 9399 bool is_user = regime_is_user(env, mmu_idx); 9400 9401 if (domain_prot == 3) { 9402 return PAGE_READ | PAGE_WRITE; 9403 } 9404 9405 switch (ap) { 9406 case 0: 9407 if (arm_feature(env, ARM_FEATURE_V7)) { 9408 return 0; 9409 } 9410 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 9411 case SCTLR_S: 9412 return is_user ? 0 : PAGE_READ; 9413 case SCTLR_R: 9414 return PAGE_READ; 9415 default: 9416 return 0; 9417 } 9418 case 1: 9419 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 9420 case 2: 9421 if (is_user) { 9422 return PAGE_READ; 9423 } else { 9424 return PAGE_READ | PAGE_WRITE; 9425 } 9426 case 3: 9427 return PAGE_READ | PAGE_WRITE; 9428 case 4: /* Reserved. */ 9429 return 0; 9430 case 5: 9431 return is_user ? 0 : PAGE_READ; 9432 case 6: 9433 return PAGE_READ; 9434 case 7: 9435 if (!arm_feature(env, ARM_FEATURE_V6K)) { 9436 return 0; 9437 } 9438 return PAGE_READ; 9439 default: 9440 g_assert_not_reached(); 9441 } 9442 } 9443 9444 /* Translate section/page access permissions to page 9445 * R/W protection flags. 9446 * 9447 * @ap: The 2-bit simple AP (AP[2:1]) 9448 * @is_user: TRUE if accessing from PL0 9449 */ 9450 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 9451 { 9452 switch (ap) { 9453 case 0: 9454 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 9455 case 1: 9456 return PAGE_READ | PAGE_WRITE; 9457 case 2: 9458 return is_user ? 0 : PAGE_READ; 9459 case 3: 9460 return PAGE_READ; 9461 default: 9462 g_assert_not_reached(); 9463 } 9464 } 9465 9466 static inline int 9467 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 9468 { 9469 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 9470 } 9471 9472 /* Translate S2 section/page access permissions to protection flags 9473 * 9474 * @env: CPUARMState 9475 * @s2ap: The 2-bit stage2 access permissions (S2AP) 9476 * @xn: XN (execute-never) bit 9477 */ 9478 static int get_S2prot(CPUARMState *env, int s2ap, int xn) 9479 { 9480 int prot = 0; 9481 9482 if (s2ap & 1) { 9483 prot |= PAGE_READ; 9484 } 9485 if (s2ap & 2) { 9486 prot |= PAGE_WRITE; 9487 } 9488 if (!xn) { 9489 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 9490 prot |= PAGE_EXEC; 9491 } 9492 } 9493 return prot; 9494 } 9495 9496 /* Translate section/page access permissions to protection flags 9497 * 9498 * @env: CPUARMState 9499 * @mmu_idx: MMU index indicating required translation regime 9500 * @is_aa64: TRUE if AArch64 9501 * @ap: The 2-bit simple AP (AP[2:1]) 9502 * @ns: NS (non-secure) bit 9503 * @xn: XN (execute-never) bit 9504 * @pxn: PXN (privileged execute-never) bit 9505 */ 9506 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 9507 int ap, int ns, int xn, int pxn) 9508 { 9509 bool is_user = regime_is_user(env, mmu_idx); 9510 int prot_rw, user_rw; 9511 bool have_wxn; 9512 int wxn = 0; 9513 9514 assert(mmu_idx != ARMMMUIdx_Stage2); 9515 9516 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 9517 if (is_user) { 9518 prot_rw = user_rw; 9519 } else { 9520 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 9521 } 9522 9523 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 9524 return prot_rw; 9525 } 9526 9527 /* TODO have_wxn should be replaced with 9528 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 9529 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 9530 * compatible processors have EL2, which is required for [U]WXN. 9531 */ 9532 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 9533 9534 if (have_wxn) { 9535 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 9536 } 9537 9538 if (is_aa64) { 9539 if (regime_has_2_ranges(mmu_idx) && !is_user) { 9540 xn = pxn || (user_rw & PAGE_WRITE); 9541 } 9542 } else if (arm_feature(env, ARM_FEATURE_V7)) { 9543 switch (regime_el(env, mmu_idx)) { 9544 case 1: 9545 case 3: 9546 if (is_user) { 9547 xn = xn || !(user_rw & PAGE_READ); 9548 } else { 9549 int uwxn = 0; 9550 if (have_wxn) { 9551 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 9552 } 9553 xn = xn || !(prot_rw & PAGE_READ) || pxn || 9554 (uwxn && (user_rw & PAGE_WRITE)); 9555 } 9556 break; 9557 case 2: 9558 break; 9559 } 9560 } else { 9561 xn = wxn = 0; 9562 } 9563 9564 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 9565 return prot_rw; 9566 } 9567 return prot_rw | PAGE_EXEC; 9568 } 9569 9570 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 9571 uint32_t *table, uint32_t address) 9572 { 9573 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 9574 TCR *tcr = regime_tcr(env, mmu_idx); 9575 9576 if (address & tcr->mask) { 9577 if (tcr->raw_tcr & TTBCR_PD1) { 9578 /* Translation table walk disabled for TTBR1 */ 9579 return false; 9580 } 9581 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 9582 } else { 9583 if (tcr->raw_tcr & TTBCR_PD0) { 9584 /* Translation table walk disabled for TTBR0 */ 9585 return false; 9586 } 9587 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask; 9588 } 9589 *table |= (address >> 18) & 0x3ffc; 9590 return true; 9591 } 9592 9593 /* Translate a S1 pagetable walk through S2 if needed. */ 9594 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx, 9595 hwaddr addr, MemTxAttrs txattrs, 9596 ARMMMUFaultInfo *fi) 9597 { 9598 if ((mmu_idx == ARMMMUIdx_Stage1_E0 || mmu_idx == ARMMMUIdx_Stage1_E1) && 9599 !regime_translation_disabled(env, ARMMMUIdx_Stage2)) { 9600 target_ulong s2size; 9601 hwaddr s2pa; 9602 int s2prot; 9603 int ret; 9604 ARMCacheAttrs cacheattrs = {}; 9605 ARMCacheAttrs *pcacheattrs = NULL; 9606 9607 if (env->cp15.hcr_el2 & HCR_PTW) { 9608 /* 9609 * PTW means we must fault if this S1 walk touches S2 Device 9610 * memory; otherwise we don't care about the attributes and can 9611 * save the S2 translation the effort of computing them. 9612 */ 9613 pcacheattrs = &cacheattrs; 9614 } 9615 9616 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_Stage2, &s2pa, 9617 &txattrs, &s2prot, &s2size, fi, pcacheattrs); 9618 if (ret) { 9619 assert(fi->type != ARMFault_None); 9620 fi->s2addr = addr; 9621 fi->stage2 = true; 9622 fi->s1ptw = true; 9623 return ~0; 9624 } 9625 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) { 9626 /* Access was to Device memory: generate Permission fault */ 9627 fi->type = ARMFault_Permission; 9628 fi->s2addr = addr; 9629 fi->stage2 = true; 9630 fi->s1ptw = true; 9631 return ~0; 9632 } 9633 addr = s2pa; 9634 } 9635 return addr; 9636 } 9637 9638 /* All loads done in the course of a page table walk go through here. */ 9639 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure, 9640 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 9641 { 9642 ARMCPU *cpu = ARM_CPU(cs); 9643 CPUARMState *env = &cpu->env; 9644 MemTxAttrs attrs = {}; 9645 MemTxResult result = MEMTX_OK; 9646 AddressSpace *as; 9647 uint32_t data; 9648 9649 attrs.secure = is_secure; 9650 as = arm_addressspace(cs, attrs); 9651 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 9652 if (fi->s1ptw) { 9653 return 0; 9654 } 9655 if (regime_translation_big_endian(env, mmu_idx)) { 9656 data = address_space_ldl_be(as, addr, attrs, &result); 9657 } else { 9658 data = address_space_ldl_le(as, addr, attrs, &result); 9659 } 9660 if (result == MEMTX_OK) { 9661 return data; 9662 } 9663 fi->type = ARMFault_SyncExternalOnWalk; 9664 fi->ea = arm_extabort_type(result); 9665 return 0; 9666 } 9667 9668 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, 9669 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 9670 { 9671 ARMCPU *cpu = ARM_CPU(cs); 9672 CPUARMState *env = &cpu->env; 9673 MemTxAttrs attrs = {}; 9674 MemTxResult result = MEMTX_OK; 9675 AddressSpace *as; 9676 uint64_t data; 9677 9678 attrs.secure = is_secure; 9679 as = arm_addressspace(cs, attrs); 9680 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 9681 if (fi->s1ptw) { 9682 return 0; 9683 } 9684 if (regime_translation_big_endian(env, mmu_idx)) { 9685 data = address_space_ldq_be(as, addr, attrs, &result); 9686 } else { 9687 data = address_space_ldq_le(as, addr, attrs, &result); 9688 } 9689 if (result == MEMTX_OK) { 9690 return data; 9691 } 9692 fi->type = ARMFault_SyncExternalOnWalk; 9693 fi->ea = arm_extabort_type(result); 9694 return 0; 9695 } 9696 9697 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address, 9698 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9699 hwaddr *phys_ptr, int *prot, 9700 target_ulong *page_size, 9701 ARMMMUFaultInfo *fi) 9702 { 9703 CPUState *cs = env_cpu(env); 9704 int level = 1; 9705 uint32_t table; 9706 uint32_t desc; 9707 int type; 9708 int ap; 9709 int domain = 0; 9710 int domain_prot; 9711 hwaddr phys_addr; 9712 uint32_t dacr; 9713 9714 /* Pagetable walk. */ 9715 /* Lookup l1 descriptor. */ 9716 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 9717 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 9718 fi->type = ARMFault_Translation; 9719 goto do_fault; 9720 } 9721 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9722 mmu_idx, fi); 9723 if (fi->type != ARMFault_None) { 9724 goto do_fault; 9725 } 9726 type = (desc & 3); 9727 domain = (desc >> 5) & 0x0f; 9728 if (regime_el(env, mmu_idx) == 1) { 9729 dacr = env->cp15.dacr_ns; 9730 } else { 9731 dacr = env->cp15.dacr_s; 9732 } 9733 domain_prot = (dacr >> (domain * 2)) & 3; 9734 if (type == 0) { 9735 /* Section translation fault. */ 9736 fi->type = ARMFault_Translation; 9737 goto do_fault; 9738 } 9739 if (type != 2) { 9740 level = 2; 9741 } 9742 if (domain_prot == 0 || domain_prot == 2) { 9743 fi->type = ARMFault_Domain; 9744 goto do_fault; 9745 } 9746 if (type == 2) { 9747 /* 1Mb section. */ 9748 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 9749 ap = (desc >> 10) & 3; 9750 *page_size = 1024 * 1024; 9751 } else { 9752 /* Lookup l2 entry. */ 9753 if (type == 1) { 9754 /* Coarse pagetable. */ 9755 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 9756 } else { 9757 /* Fine pagetable. */ 9758 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 9759 } 9760 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9761 mmu_idx, fi); 9762 if (fi->type != ARMFault_None) { 9763 goto do_fault; 9764 } 9765 switch (desc & 3) { 9766 case 0: /* Page translation fault. */ 9767 fi->type = ARMFault_Translation; 9768 goto do_fault; 9769 case 1: /* 64k page. */ 9770 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 9771 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 9772 *page_size = 0x10000; 9773 break; 9774 case 2: /* 4k page. */ 9775 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 9776 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 9777 *page_size = 0x1000; 9778 break; 9779 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 9780 if (type == 1) { 9781 /* ARMv6/XScale extended small page format */ 9782 if (arm_feature(env, ARM_FEATURE_XSCALE) 9783 || arm_feature(env, ARM_FEATURE_V6)) { 9784 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 9785 *page_size = 0x1000; 9786 } else { 9787 /* UNPREDICTABLE in ARMv5; we choose to take a 9788 * page translation fault. 9789 */ 9790 fi->type = ARMFault_Translation; 9791 goto do_fault; 9792 } 9793 } else { 9794 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 9795 *page_size = 0x400; 9796 } 9797 ap = (desc >> 4) & 3; 9798 break; 9799 default: 9800 /* Never happens, but compiler isn't smart enough to tell. */ 9801 abort(); 9802 } 9803 } 9804 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 9805 *prot |= *prot ? PAGE_EXEC : 0; 9806 if (!(*prot & (1 << access_type))) { 9807 /* Access permission fault. */ 9808 fi->type = ARMFault_Permission; 9809 goto do_fault; 9810 } 9811 *phys_ptr = phys_addr; 9812 return false; 9813 do_fault: 9814 fi->domain = domain; 9815 fi->level = level; 9816 return true; 9817 } 9818 9819 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, 9820 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9821 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 9822 target_ulong *page_size, ARMMMUFaultInfo *fi) 9823 { 9824 CPUState *cs = env_cpu(env); 9825 int level = 1; 9826 uint32_t table; 9827 uint32_t desc; 9828 uint32_t xn; 9829 uint32_t pxn = 0; 9830 int type; 9831 int ap; 9832 int domain = 0; 9833 int domain_prot; 9834 hwaddr phys_addr; 9835 uint32_t dacr; 9836 bool ns; 9837 9838 /* Pagetable walk. */ 9839 /* Lookup l1 descriptor. */ 9840 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 9841 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 9842 fi->type = ARMFault_Translation; 9843 goto do_fault; 9844 } 9845 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9846 mmu_idx, fi); 9847 if (fi->type != ARMFault_None) { 9848 goto do_fault; 9849 } 9850 type = (desc & 3); 9851 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) { 9852 /* Section translation fault, or attempt to use the encoding 9853 * which is Reserved on implementations without PXN. 9854 */ 9855 fi->type = ARMFault_Translation; 9856 goto do_fault; 9857 } 9858 if ((type == 1) || !(desc & (1 << 18))) { 9859 /* Page or Section. */ 9860 domain = (desc >> 5) & 0x0f; 9861 } 9862 if (regime_el(env, mmu_idx) == 1) { 9863 dacr = env->cp15.dacr_ns; 9864 } else { 9865 dacr = env->cp15.dacr_s; 9866 } 9867 if (type == 1) { 9868 level = 2; 9869 } 9870 domain_prot = (dacr >> (domain * 2)) & 3; 9871 if (domain_prot == 0 || domain_prot == 2) { 9872 /* Section or Page domain fault */ 9873 fi->type = ARMFault_Domain; 9874 goto do_fault; 9875 } 9876 if (type != 1) { 9877 if (desc & (1 << 18)) { 9878 /* Supersection. */ 9879 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 9880 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 9881 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 9882 *page_size = 0x1000000; 9883 } else { 9884 /* Section. */ 9885 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 9886 *page_size = 0x100000; 9887 } 9888 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 9889 xn = desc & (1 << 4); 9890 pxn = desc & 1; 9891 ns = extract32(desc, 19, 1); 9892 } else { 9893 if (arm_feature(env, ARM_FEATURE_PXN)) { 9894 pxn = (desc >> 2) & 1; 9895 } 9896 ns = extract32(desc, 3, 1); 9897 /* Lookup l2 entry. */ 9898 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 9899 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9900 mmu_idx, fi); 9901 if (fi->type != ARMFault_None) { 9902 goto do_fault; 9903 } 9904 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 9905 switch (desc & 3) { 9906 case 0: /* Page translation fault. */ 9907 fi->type = ARMFault_Translation; 9908 goto do_fault; 9909 case 1: /* 64k page. */ 9910 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 9911 xn = desc & (1 << 15); 9912 *page_size = 0x10000; 9913 break; 9914 case 2: case 3: /* 4k page. */ 9915 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 9916 xn = desc & 1; 9917 *page_size = 0x1000; 9918 break; 9919 default: 9920 /* Never happens, but compiler isn't smart enough to tell. */ 9921 abort(); 9922 } 9923 } 9924 if (domain_prot == 3) { 9925 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 9926 } else { 9927 if (pxn && !regime_is_user(env, mmu_idx)) { 9928 xn = 1; 9929 } 9930 if (xn && access_type == MMU_INST_FETCH) { 9931 fi->type = ARMFault_Permission; 9932 goto do_fault; 9933 } 9934 9935 if (arm_feature(env, ARM_FEATURE_V6K) && 9936 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 9937 /* The simplified model uses AP[0] as an access control bit. */ 9938 if ((ap & 1) == 0) { 9939 /* Access flag fault. */ 9940 fi->type = ARMFault_AccessFlag; 9941 goto do_fault; 9942 } 9943 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 9944 } else { 9945 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 9946 } 9947 if (*prot && !xn) { 9948 *prot |= PAGE_EXEC; 9949 } 9950 if (!(*prot & (1 << access_type))) { 9951 /* Access permission fault. */ 9952 fi->type = ARMFault_Permission; 9953 goto do_fault; 9954 } 9955 } 9956 if (ns) { 9957 /* The NS bit will (as required by the architecture) have no effect if 9958 * the CPU doesn't support TZ or this is a non-secure translation 9959 * regime, because the attribute will already be non-secure. 9960 */ 9961 attrs->secure = false; 9962 } 9963 *phys_ptr = phys_addr; 9964 return false; 9965 do_fault: 9966 fi->domain = domain; 9967 fi->level = level; 9968 return true; 9969 } 9970 9971 /* 9972 * check_s2_mmu_setup 9973 * @cpu: ARMCPU 9974 * @is_aa64: True if the translation regime is in AArch64 state 9975 * @startlevel: Suggested starting level 9976 * @inputsize: Bitsize of IPAs 9977 * @stride: Page-table stride (See the ARM ARM) 9978 * 9979 * Returns true if the suggested S2 translation parameters are OK and 9980 * false otherwise. 9981 */ 9982 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, 9983 int inputsize, int stride) 9984 { 9985 const int grainsize = stride + 3; 9986 int startsizecheck; 9987 9988 /* Negative levels are never allowed. */ 9989 if (level < 0) { 9990 return false; 9991 } 9992 9993 startsizecheck = inputsize - ((3 - level) * stride + grainsize); 9994 if (startsizecheck < 1 || startsizecheck > stride + 4) { 9995 return false; 9996 } 9997 9998 if (is_aa64) { 9999 CPUARMState *env = &cpu->env; 10000 unsigned int pamax = arm_pamax(cpu); 10001 10002 switch (stride) { 10003 case 13: /* 64KB Pages. */ 10004 if (level == 0 || (level == 1 && pamax <= 42)) { 10005 return false; 10006 } 10007 break; 10008 case 11: /* 16KB Pages. */ 10009 if (level == 0 || (level == 1 && pamax <= 40)) { 10010 return false; 10011 } 10012 break; 10013 case 9: /* 4KB Pages. */ 10014 if (level == 0 && pamax <= 42) { 10015 return false; 10016 } 10017 break; 10018 default: 10019 g_assert_not_reached(); 10020 } 10021 10022 /* Inputsize checks. */ 10023 if (inputsize > pamax && 10024 (arm_el_is_aa64(env, 1) || inputsize > 40)) { 10025 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */ 10026 return false; 10027 } 10028 } else { 10029 /* AArch32 only supports 4KB pages. Assert on that. */ 10030 assert(stride == 9); 10031 10032 if (level == 0) { 10033 return false; 10034 } 10035 } 10036 return true; 10037 } 10038 10039 /* Translate from the 4-bit stage 2 representation of 10040 * memory attributes (without cache-allocation hints) to 10041 * the 8-bit representation of the stage 1 MAIR registers 10042 * (which includes allocation hints). 10043 * 10044 * ref: shared/translation/attrs/S2AttrDecode() 10045 * .../S2ConvertAttrsHints() 10046 */ 10047 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs) 10048 { 10049 uint8_t hiattr = extract32(s2attrs, 2, 2); 10050 uint8_t loattr = extract32(s2attrs, 0, 2); 10051 uint8_t hihint = 0, lohint = 0; 10052 10053 if (hiattr != 0) { /* normal memory */ 10054 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */ 10055 hiattr = loattr = 1; /* non-cacheable */ 10056 } else { 10057 if (hiattr != 1) { /* Write-through or write-back */ 10058 hihint = 3; /* RW allocate */ 10059 } 10060 if (loattr != 1) { /* Write-through or write-back */ 10061 lohint = 3; /* RW allocate */ 10062 } 10063 } 10064 } 10065 10066 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 10067 } 10068 #endif /* !CONFIG_USER_ONLY */ 10069 10070 ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va, 10071 ARMMMUIdx mmu_idx) 10072 { 10073 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10074 bool tbi, tbid, epd, hpd, using16k, using64k; 10075 int select, tsz; 10076 10077 /* 10078 * Bit 55 is always between the two regions, and is canonical for 10079 * determining if address tagging is enabled. 10080 */ 10081 select = extract64(va, 55, 1); 10082 10083 if (!regime_has_2_ranges(mmu_idx)) { 10084 tsz = extract32(tcr, 0, 6); 10085 using64k = extract32(tcr, 14, 1); 10086 using16k = extract32(tcr, 15, 1); 10087 if (mmu_idx == ARMMMUIdx_Stage2) { 10088 /* VTCR_EL2 */ 10089 tbi = tbid = hpd = false; 10090 } else { 10091 tbi = extract32(tcr, 20, 1); 10092 hpd = extract32(tcr, 24, 1); 10093 tbid = extract32(tcr, 29, 1); 10094 } 10095 epd = false; 10096 } else if (!select) { 10097 tsz = extract32(tcr, 0, 6); 10098 epd = extract32(tcr, 7, 1); 10099 using64k = extract32(tcr, 14, 1); 10100 using16k = extract32(tcr, 15, 1); 10101 tbi = extract64(tcr, 37, 1); 10102 hpd = extract64(tcr, 41, 1); 10103 tbid = extract64(tcr, 51, 1); 10104 } else { 10105 int tg = extract32(tcr, 30, 2); 10106 using16k = tg == 1; 10107 using64k = tg == 3; 10108 tsz = extract32(tcr, 16, 6); 10109 epd = extract32(tcr, 23, 1); 10110 tbi = extract64(tcr, 38, 1); 10111 hpd = extract64(tcr, 42, 1); 10112 tbid = extract64(tcr, 52, 1); 10113 } 10114 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */ 10115 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */ 10116 10117 return (ARMVAParameters) { 10118 .tsz = tsz, 10119 .select = select, 10120 .tbi = tbi, 10121 .tbid = tbid, 10122 .epd = epd, 10123 .hpd = hpd, 10124 .using16k = using16k, 10125 .using64k = using64k, 10126 }; 10127 } 10128 10129 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 10130 ARMMMUIdx mmu_idx, bool data) 10131 { 10132 ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx); 10133 10134 /* Present TBI as a composite with TBID. */ 10135 ret.tbi &= (data || !ret.tbid); 10136 return ret; 10137 } 10138 10139 #ifndef CONFIG_USER_ONLY 10140 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 10141 ARMMMUIdx mmu_idx) 10142 { 10143 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10144 uint32_t el = regime_el(env, mmu_idx); 10145 int select, tsz; 10146 bool epd, hpd; 10147 10148 if (mmu_idx == ARMMMUIdx_Stage2) { 10149 /* VTCR */ 10150 bool sext = extract32(tcr, 4, 1); 10151 bool sign = extract32(tcr, 3, 1); 10152 10153 /* 10154 * If the sign-extend bit is not the same as t0sz[3], the result 10155 * is unpredictable. Flag this as a guest error. 10156 */ 10157 if (sign != sext) { 10158 qemu_log_mask(LOG_GUEST_ERROR, 10159 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 10160 } 10161 tsz = sextract32(tcr, 0, 4) + 8; 10162 select = 0; 10163 hpd = false; 10164 epd = false; 10165 } else if (el == 2) { 10166 /* HTCR */ 10167 tsz = extract32(tcr, 0, 3); 10168 select = 0; 10169 hpd = extract64(tcr, 24, 1); 10170 epd = false; 10171 } else { 10172 int t0sz = extract32(tcr, 0, 3); 10173 int t1sz = extract32(tcr, 16, 3); 10174 10175 if (t1sz == 0) { 10176 select = va > (0xffffffffu >> t0sz); 10177 } else { 10178 /* Note that we will detect errors later. */ 10179 select = va >= ~(0xffffffffu >> t1sz); 10180 } 10181 if (!select) { 10182 tsz = t0sz; 10183 epd = extract32(tcr, 7, 1); 10184 hpd = extract64(tcr, 41, 1); 10185 } else { 10186 tsz = t1sz; 10187 epd = extract32(tcr, 23, 1); 10188 hpd = extract64(tcr, 42, 1); 10189 } 10190 /* For aarch32, hpd0 is not enabled without t2e as well. */ 10191 hpd &= extract32(tcr, 6, 1); 10192 } 10193 10194 return (ARMVAParameters) { 10195 .tsz = tsz, 10196 .select = select, 10197 .epd = epd, 10198 .hpd = hpd, 10199 }; 10200 } 10201 10202 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 10203 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10204 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 10205 target_ulong *page_size_ptr, 10206 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 10207 { 10208 ARMCPU *cpu = env_archcpu(env); 10209 CPUState *cs = CPU(cpu); 10210 /* Read an LPAE long-descriptor translation table. */ 10211 ARMFaultType fault_type = ARMFault_Translation; 10212 uint32_t level; 10213 ARMVAParameters param; 10214 uint64_t ttbr; 10215 hwaddr descaddr, indexmask, indexmask_grainsize; 10216 uint32_t tableattrs; 10217 target_ulong page_size; 10218 uint32_t attrs; 10219 int32_t stride; 10220 int addrsize, inputsize; 10221 TCR *tcr = regime_tcr(env, mmu_idx); 10222 int ap, ns, xn, pxn; 10223 uint32_t el = regime_el(env, mmu_idx); 10224 bool ttbr1_valid; 10225 uint64_t descaddrmask; 10226 bool aarch64 = arm_el_is_aa64(env, el); 10227 bool guarded = false; 10228 10229 /* TODO: 10230 * This code does not handle the different format TCR for VTCR_EL2. 10231 * This code also does not support shareability levels. 10232 * Attribute and permission bit handling should also be checked when adding 10233 * support for those page table walks. 10234 */ 10235 if (aarch64) { 10236 param = aa64_va_parameters(env, address, mmu_idx, 10237 access_type != MMU_INST_FETCH); 10238 level = 0; 10239 ttbr1_valid = regime_has_2_ranges(mmu_idx); 10240 addrsize = 64 - 8 * param.tbi; 10241 inputsize = 64 - param.tsz; 10242 } else { 10243 param = aa32_va_parameters(env, address, mmu_idx); 10244 level = 1; 10245 /* There is no TTBR1 for EL2 */ 10246 ttbr1_valid = (el != 2); 10247 addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32); 10248 inputsize = addrsize - param.tsz; 10249 } 10250 10251 /* 10252 * We determined the region when collecting the parameters, but we 10253 * have not yet validated that the address is valid for the region. 10254 * Extract the top bits and verify that they all match select. 10255 * 10256 * For aa32, if inputsize == addrsize, then we have selected the 10257 * region by exclusion in aa32_va_parameters and there is no more 10258 * validation to do here. 10259 */ 10260 if (inputsize < addrsize) { 10261 target_ulong top_bits = sextract64(address, inputsize, 10262 addrsize - inputsize); 10263 if (-top_bits != param.select || (param.select && !ttbr1_valid)) { 10264 /* The gap between the two regions is a Translation fault */ 10265 fault_type = ARMFault_Translation; 10266 goto do_fault; 10267 } 10268 } 10269 10270 if (param.using64k) { 10271 stride = 13; 10272 } else if (param.using16k) { 10273 stride = 11; 10274 } else { 10275 stride = 9; 10276 } 10277 10278 /* Note that QEMU ignores shareability and cacheability attributes, 10279 * so we don't need to do anything with the SH, ORGN, IRGN fields 10280 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 10281 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 10282 * implement any ASID-like capability so we can ignore it (instead 10283 * we will always flush the TLB any time the ASID is changed). 10284 */ 10285 ttbr = regime_ttbr(env, mmu_idx, param.select); 10286 10287 /* Here we should have set up all the parameters for the translation: 10288 * inputsize, ttbr, epd, stride, tbi 10289 */ 10290 10291 if (param.epd) { 10292 /* Translation table walk disabled => Translation fault on TLB miss 10293 * Note: This is always 0 on 64-bit EL2 and EL3. 10294 */ 10295 goto do_fault; 10296 } 10297 10298 if (mmu_idx != ARMMMUIdx_Stage2) { 10299 /* The starting level depends on the virtual address size (which can 10300 * be up to 48 bits) and the translation granule size. It indicates 10301 * the number of strides (stride bits at a time) needed to 10302 * consume the bits of the input address. In the pseudocode this is: 10303 * level = 4 - RoundUp((inputsize - grainsize) / stride) 10304 * where their 'inputsize' is our 'inputsize', 'grainsize' is 10305 * our 'stride + 3' and 'stride' is our 'stride'. 10306 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 10307 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 10308 * = 4 - (inputsize - 4) / stride; 10309 */ 10310 level = 4 - (inputsize - 4) / stride; 10311 } else { 10312 /* For stage 2 translations the starting level is specified by the 10313 * VTCR_EL2.SL0 field (whose interpretation depends on the page size) 10314 */ 10315 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2); 10316 uint32_t startlevel; 10317 bool ok; 10318 10319 if (!aarch64 || stride == 9) { 10320 /* AArch32 or 4KB pages */ 10321 startlevel = 2 - sl0; 10322 } else { 10323 /* 16KB or 64KB pages */ 10324 startlevel = 3 - sl0; 10325 } 10326 10327 /* Check that the starting level is valid. */ 10328 ok = check_s2_mmu_setup(cpu, aarch64, startlevel, 10329 inputsize, stride); 10330 if (!ok) { 10331 fault_type = ARMFault_Translation; 10332 goto do_fault; 10333 } 10334 level = startlevel; 10335 } 10336 10337 indexmask_grainsize = (1ULL << (stride + 3)) - 1; 10338 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1; 10339 10340 /* Now we can extract the actual base address from the TTBR */ 10341 descaddr = extract64(ttbr, 0, 48); 10342 descaddr &= ~indexmask; 10343 10344 /* The address field in the descriptor goes up to bit 39 for ARMv7 10345 * but up to bit 47 for ARMv8, but we use the descaddrmask 10346 * up to bit 39 for AArch32, because we don't need other bits in that case 10347 * to construct next descriptor address (anyway they should be all zeroes). 10348 */ 10349 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) & 10350 ~indexmask_grainsize; 10351 10352 /* Secure accesses start with the page table in secure memory and 10353 * can be downgraded to non-secure at any step. Non-secure accesses 10354 * remain non-secure. We implement this by just ORing in the NSTable/NS 10355 * bits at each step. 10356 */ 10357 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4); 10358 for (;;) { 10359 uint64_t descriptor; 10360 bool nstable; 10361 10362 descaddr |= (address >> (stride * (4 - level))) & indexmask; 10363 descaddr &= ~7ULL; 10364 nstable = extract32(tableattrs, 4, 1); 10365 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi); 10366 if (fi->type != ARMFault_None) { 10367 goto do_fault; 10368 } 10369 10370 if (!(descriptor & 1) || 10371 (!(descriptor & 2) && (level == 3))) { 10372 /* Invalid, or the Reserved level 3 encoding */ 10373 goto do_fault; 10374 } 10375 descaddr = descriptor & descaddrmask; 10376 10377 if ((descriptor & 2) && (level < 3)) { 10378 /* Table entry. The top five bits are attributes which may 10379 * propagate down through lower levels of the table (and 10380 * which are all arranged so that 0 means "no effect", so 10381 * we can gather them up by ORing in the bits at each level). 10382 */ 10383 tableattrs |= extract64(descriptor, 59, 5); 10384 level++; 10385 indexmask = indexmask_grainsize; 10386 continue; 10387 } 10388 /* Block entry at level 1 or 2, or page entry at level 3. 10389 * These are basically the same thing, although the number 10390 * of bits we pull in from the vaddr varies. 10391 */ 10392 page_size = (1ULL << ((stride * (4 - level)) + 3)); 10393 descaddr |= (address & (page_size - 1)); 10394 /* Extract attributes from the descriptor */ 10395 attrs = extract64(descriptor, 2, 10) 10396 | (extract64(descriptor, 52, 12) << 10); 10397 10398 if (mmu_idx == ARMMMUIdx_Stage2) { 10399 /* Stage 2 table descriptors do not include any attribute fields */ 10400 break; 10401 } 10402 /* Merge in attributes from table descriptors */ 10403 attrs |= nstable << 3; /* NS */ 10404 guarded = extract64(descriptor, 50, 1); /* GP */ 10405 if (param.hpd) { 10406 /* HPD disables all the table attributes except NSTable. */ 10407 break; 10408 } 10409 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */ 10410 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 10411 * means "force PL1 access only", which means forcing AP[1] to 0. 10412 */ 10413 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */ 10414 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */ 10415 break; 10416 } 10417 /* Here descaddr is the final physical address, and attributes 10418 * are all in attrs. 10419 */ 10420 fault_type = ARMFault_AccessFlag; 10421 if ((attrs & (1 << 8)) == 0) { 10422 /* Access flag */ 10423 goto do_fault; 10424 } 10425 10426 ap = extract32(attrs, 4, 2); 10427 xn = extract32(attrs, 12, 1); 10428 10429 if (mmu_idx == ARMMMUIdx_Stage2) { 10430 ns = true; 10431 *prot = get_S2prot(env, ap, xn); 10432 } else { 10433 ns = extract32(attrs, 3, 1); 10434 pxn = extract32(attrs, 11, 1); 10435 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 10436 } 10437 10438 fault_type = ARMFault_Permission; 10439 if (!(*prot & (1 << access_type))) { 10440 goto do_fault; 10441 } 10442 10443 if (ns) { 10444 /* The NS bit will (as required by the architecture) have no effect if 10445 * the CPU doesn't support TZ or this is a non-secure translation 10446 * regime, because the attribute will already be non-secure. 10447 */ 10448 txattrs->secure = false; 10449 } 10450 /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB. */ 10451 if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) { 10452 txattrs->target_tlb_bit0 = true; 10453 } 10454 10455 if (cacheattrs != NULL) { 10456 if (mmu_idx == ARMMMUIdx_Stage2) { 10457 cacheattrs->attrs = convert_stage2_attrs(env, 10458 extract32(attrs, 0, 4)); 10459 } else { 10460 /* Index into MAIR registers for cache attributes */ 10461 uint8_t attrindx = extract32(attrs, 0, 3); 10462 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 10463 assert(attrindx <= 7); 10464 cacheattrs->attrs = extract64(mair, attrindx * 8, 8); 10465 } 10466 cacheattrs->shareability = extract32(attrs, 6, 2); 10467 } 10468 10469 *phys_ptr = descaddr; 10470 *page_size_ptr = page_size; 10471 return false; 10472 10473 do_fault: 10474 fi->type = fault_type; 10475 fi->level = level; 10476 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 10477 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2); 10478 return true; 10479 } 10480 10481 static inline void get_phys_addr_pmsav7_default(CPUARMState *env, 10482 ARMMMUIdx mmu_idx, 10483 int32_t address, int *prot) 10484 { 10485 if (!arm_feature(env, ARM_FEATURE_M)) { 10486 *prot = PAGE_READ | PAGE_WRITE; 10487 switch (address) { 10488 case 0xF0000000 ... 0xFFFFFFFF: 10489 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 10490 /* hivecs execing is ok */ 10491 *prot |= PAGE_EXEC; 10492 } 10493 break; 10494 case 0x00000000 ... 0x7FFFFFFF: 10495 *prot |= PAGE_EXEC; 10496 break; 10497 } 10498 } else { 10499 /* Default system address map for M profile cores. 10500 * The architecture specifies which regions are execute-never; 10501 * at the MPU level no other checks are defined. 10502 */ 10503 switch (address) { 10504 case 0x00000000 ... 0x1fffffff: /* ROM */ 10505 case 0x20000000 ... 0x3fffffff: /* SRAM */ 10506 case 0x60000000 ... 0x7fffffff: /* RAM */ 10507 case 0x80000000 ... 0x9fffffff: /* RAM */ 10508 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10509 break; 10510 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 10511 case 0xa0000000 ... 0xbfffffff: /* Device */ 10512 case 0xc0000000 ... 0xdfffffff: /* Device */ 10513 case 0xe0000000 ... 0xffffffff: /* System */ 10514 *prot = PAGE_READ | PAGE_WRITE; 10515 break; 10516 default: 10517 g_assert_not_reached(); 10518 } 10519 } 10520 } 10521 10522 static bool pmsav7_use_background_region(ARMCPU *cpu, 10523 ARMMMUIdx mmu_idx, bool is_user) 10524 { 10525 /* Return true if we should use the default memory map as a 10526 * "background" region if there are no hits against any MPU regions. 10527 */ 10528 CPUARMState *env = &cpu->env; 10529 10530 if (is_user) { 10531 return false; 10532 } 10533 10534 if (arm_feature(env, ARM_FEATURE_M)) { 10535 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] 10536 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 10537 } else { 10538 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 10539 } 10540 } 10541 10542 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address) 10543 { 10544 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 10545 return arm_feature(env, ARM_FEATURE_M) && 10546 extract32(address, 20, 12) == 0xe00; 10547 } 10548 10549 static inline bool m_is_system_region(CPUARMState *env, uint32_t address) 10550 { 10551 /* True if address is in the M profile system region 10552 * 0xe0000000 - 0xffffffff 10553 */ 10554 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 10555 } 10556 10557 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 10558 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10559 hwaddr *phys_ptr, int *prot, 10560 target_ulong *page_size, 10561 ARMMMUFaultInfo *fi) 10562 { 10563 ARMCPU *cpu = env_archcpu(env); 10564 int n; 10565 bool is_user = regime_is_user(env, mmu_idx); 10566 10567 *phys_ptr = address; 10568 *page_size = TARGET_PAGE_SIZE; 10569 *prot = 0; 10570 10571 if (regime_translation_disabled(env, mmu_idx) || 10572 m_is_ppb_region(env, address)) { 10573 /* MPU disabled or M profile PPB access: use default memory map. 10574 * The other case which uses the default memory map in the 10575 * v7M ARM ARM pseudocode is exception vector reads from the vector 10576 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 10577 * which always does a direct read using address_space_ldl(), rather 10578 * than going via this function, so we don't need to check that here. 10579 */ 10580 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10581 } else { /* MPU enabled */ 10582 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 10583 /* region search */ 10584 uint32_t base = env->pmsav7.drbar[n]; 10585 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 10586 uint32_t rmask; 10587 bool srdis = false; 10588 10589 if (!(env->pmsav7.drsr[n] & 0x1)) { 10590 continue; 10591 } 10592 10593 if (!rsize) { 10594 qemu_log_mask(LOG_GUEST_ERROR, 10595 "DRSR[%d]: Rsize field cannot be 0\n", n); 10596 continue; 10597 } 10598 rsize++; 10599 rmask = (1ull << rsize) - 1; 10600 10601 if (base & rmask) { 10602 qemu_log_mask(LOG_GUEST_ERROR, 10603 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 10604 "to DRSR region size, mask = 0x%" PRIx32 "\n", 10605 n, base, rmask); 10606 continue; 10607 } 10608 10609 if (address < base || address > base + rmask) { 10610 /* 10611 * Address not in this region. We must check whether the 10612 * region covers addresses in the same page as our address. 10613 * In that case we must not report a size that covers the 10614 * whole page for a subsequent hit against a different MPU 10615 * region or the background region, because it would result in 10616 * incorrect TLB hits for subsequent accesses to addresses that 10617 * are in this MPU region. 10618 */ 10619 if (ranges_overlap(base, rmask, 10620 address & TARGET_PAGE_MASK, 10621 TARGET_PAGE_SIZE)) { 10622 *page_size = 1; 10623 } 10624 continue; 10625 } 10626 10627 /* Region matched */ 10628 10629 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 10630 int i, snd; 10631 uint32_t srdis_mask; 10632 10633 rsize -= 3; /* sub region size (power of 2) */ 10634 snd = ((address - base) >> rsize) & 0x7; 10635 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 10636 10637 srdis_mask = srdis ? 0x3 : 0x0; 10638 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 10639 /* This will check in groups of 2, 4 and then 8, whether 10640 * the subregion bits are consistent. rsize is incremented 10641 * back up to give the region size, considering consistent 10642 * adjacent subregions as one region. Stop testing if rsize 10643 * is already big enough for an entire QEMU page. 10644 */ 10645 int snd_rounded = snd & ~(i - 1); 10646 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 10647 snd_rounded + 8, i); 10648 if (srdis_mask ^ srdis_multi) { 10649 break; 10650 } 10651 srdis_mask = (srdis_mask << i) | srdis_mask; 10652 rsize++; 10653 } 10654 } 10655 if (srdis) { 10656 continue; 10657 } 10658 if (rsize < TARGET_PAGE_BITS) { 10659 *page_size = 1 << rsize; 10660 } 10661 break; 10662 } 10663 10664 if (n == -1) { /* no hits */ 10665 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 10666 /* background fault */ 10667 fi->type = ARMFault_Background; 10668 return true; 10669 } 10670 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10671 } else { /* a MPU hit! */ 10672 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 10673 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 10674 10675 if (m_is_system_region(env, address)) { 10676 /* System space is always execute never */ 10677 xn = 1; 10678 } 10679 10680 if (is_user) { /* User mode AP bit decoding */ 10681 switch (ap) { 10682 case 0: 10683 case 1: 10684 case 5: 10685 break; /* no access */ 10686 case 3: 10687 *prot |= PAGE_WRITE; 10688 /* fall through */ 10689 case 2: 10690 case 6: 10691 *prot |= PAGE_READ | PAGE_EXEC; 10692 break; 10693 case 7: 10694 /* for v7M, same as 6; for R profile a reserved value */ 10695 if (arm_feature(env, ARM_FEATURE_M)) { 10696 *prot |= PAGE_READ | PAGE_EXEC; 10697 break; 10698 } 10699 /* fall through */ 10700 default: 10701 qemu_log_mask(LOG_GUEST_ERROR, 10702 "DRACR[%d]: Bad value for AP bits: 0x%" 10703 PRIx32 "\n", n, ap); 10704 } 10705 } else { /* Priv. mode AP bits decoding */ 10706 switch (ap) { 10707 case 0: 10708 break; /* no access */ 10709 case 1: 10710 case 2: 10711 case 3: 10712 *prot |= PAGE_WRITE; 10713 /* fall through */ 10714 case 5: 10715 case 6: 10716 *prot |= PAGE_READ | PAGE_EXEC; 10717 break; 10718 case 7: 10719 /* for v7M, same as 6; for R profile a reserved value */ 10720 if (arm_feature(env, ARM_FEATURE_M)) { 10721 *prot |= PAGE_READ | PAGE_EXEC; 10722 break; 10723 } 10724 /* fall through */ 10725 default: 10726 qemu_log_mask(LOG_GUEST_ERROR, 10727 "DRACR[%d]: Bad value for AP bits: 0x%" 10728 PRIx32 "\n", n, ap); 10729 } 10730 } 10731 10732 /* execute never */ 10733 if (xn) { 10734 *prot &= ~PAGE_EXEC; 10735 } 10736 } 10737 } 10738 10739 fi->type = ARMFault_Permission; 10740 fi->level = 1; 10741 return !(*prot & (1 << access_type)); 10742 } 10743 10744 static bool v8m_is_sau_exempt(CPUARMState *env, 10745 uint32_t address, MMUAccessType access_type) 10746 { 10747 /* The architecture specifies that certain address ranges are 10748 * exempt from v8M SAU/IDAU checks. 10749 */ 10750 return 10751 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 10752 (address >= 0xe0000000 && address <= 0xe0002fff) || 10753 (address >= 0xe000e000 && address <= 0xe000efff) || 10754 (address >= 0xe002e000 && address <= 0xe002efff) || 10755 (address >= 0xe0040000 && address <= 0xe0041fff) || 10756 (address >= 0xe00ff000 && address <= 0xe00fffff); 10757 } 10758 10759 void v8m_security_lookup(CPUARMState *env, uint32_t address, 10760 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10761 V8M_SAttributes *sattrs) 10762 { 10763 /* Look up the security attributes for this address. Compare the 10764 * pseudocode SecurityCheck() function. 10765 * We assume the caller has zero-initialized *sattrs. 10766 */ 10767 ARMCPU *cpu = env_archcpu(env); 10768 int r; 10769 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 10770 int idau_region = IREGION_NOTVALID; 10771 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 10772 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 10773 10774 if (cpu->idau) { 10775 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 10776 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 10777 10778 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 10779 &idau_nsc); 10780 } 10781 10782 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 10783 /* 0xf0000000..0xffffffff is always S for insn fetches */ 10784 return; 10785 } 10786 10787 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 10788 sattrs->ns = !regime_is_secure(env, mmu_idx); 10789 return; 10790 } 10791 10792 if (idau_region != IREGION_NOTVALID) { 10793 sattrs->irvalid = true; 10794 sattrs->iregion = idau_region; 10795 } 10796 10797 switch (env->sau.ctrl & 3) { 10798 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 10799 break; 10800 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 10801 sattrs->ns = true; 10802 break; 10803 default: /* SAU.ENABLE == 1 */ 10804 for (r = 0; r < cpu->sau_sregion; r++) { 10805 if (env->sau.rlar[r] & 1) { 10806 uint32_t base = env->sau.rbar[r] & ~0x1f; 10807 uint32_t limit = env->sau.rlar[r] | 0x1f; 10808 10809 if (base <= address && limit >= address) { 10810 if (base > addr_page_base || limit < addr_page_limit) { 10811 sattrs->subpage = true; 10812 } 10813 if (sattrs->srvalid) { 10814 /* If we hit in more than one region then we must report 10815 * as Secure, not NS-Callable, with no valid region 10816 * number info. 10817 */ 10818 sattrs->ns = false; 10819 sattrs->nsc = false; 10820 sattrs->sregion = 0; 10821 sattrs->srvalid = false; 10822 break; 10823 } else { 10824 if (env->sau.rlar[r] & 2) { 10825 sattrs->nsc = true; 10826 } else { 10827 sattrs->ns = true; 10828 } 10829 sattrs->srvalid = true; 10830 sattrs->sregion = r; 10831 } 10832 } else { 10833 /* 10834 * Address not in this region. We must check whether the 10835 * region covers addresses in the same page as our address. 10836 * In that case we must not report a size that covers the 10837 * whole page for a subsequent hit against a different MPU 10838 * region or the background region, because it would result 10839 * in incorrect TLB hits for subsequent accesses to 10840 * addresses that are in this MPU region. 10841 */ 10842 if (limit >= base && 10843 ranges_overlap(base, limit - base + 1, 10844 addr_page_base, 10845 TARGET_PAGE_SIZE)) { 10846 sattrs->subpage = true; 10847 } 10848 } 10849 } 10850 } 10851 break; 10852 } 10853 10854 /* 10855 * The IDAU will override the SAU lookup results if it specifies 10856 * higher security than the SAU does. 10857 */ 10858 if (!idau_ns) { 10859 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 10860 sattrs->ns = false; 10861 sattrs->nsc = idau_nsc; 10862 } 10863 } 10864 } 10865 10866 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 10867 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10868 hwaddr *phys_ptr, MemTxAttrs *txattrs, 10869 int *prot, bool *is_subpage, 10870 ARMMMUFaultInfo *fi, uint32_t *mregion) 10871 { 10872 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check 10873 * that a full phys-to-virt translation does). 10874 * mregion is (if not NULL) set to the region number which matched, 10875 * or -1 if no region number is returned (MPU off, address did not 10876 * hit a region, address hit in multiple regions). 10877 * We set is_subpage to true if the region hit doesn't cover the 10878 * entire TARGET_PAGE the address is within. 10879 */ 10880 ARMCPU *cpu = env_archcpu(env); 10881 bool is_user = regime_is_user(env, mmu_idx); 10882 uint32_t secure = regime_is_secure(env, mmu_idx); 10883 int n; 10884 int matchregion = -1; 10885 bool hit = false; 10886 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 10887 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 10888 10889 *is_subpage = false; 10890 *phys_ptr = address; 10891 *prot = 0; 10892 if (mregion) { 10893 *mregion = -1; 10894 } 10895 10896 /* Unlike the ARM ARM pseudocode, we don't need to check whether this 10897 * was an exception vector read from the vector table (which is always 10898 * done using the default system address map), because those accesses 10899 * are done in arm_v7m_load_vector(), which always does a direct 10900 * read using address_space_ldl(), rather than going via this function. 10901 */ 10902 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */ 10903 hit = true; 10904 } else if (m_is_ppb_region(env, address)) { 10905 hit = true; 10906 } else { 10907 if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 10908 hit = true; 10909 } 10910 10911 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 10912 /* region search */ 10913 /* Note that the base address is bits [31:5] from the register 10914 * with bits [4:0] all zeroes, but the limit address is bits 10915 * [31:5] from the register with bits [4:0] all ones. 10916 */ 10917 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f; 10918 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f; 10919 10920 if (!(env->pmsav8.rlar[secure][n] & 0x1)) { 10921 /* Region disabled */ 10922 continue; 10923 } 10924 10925 if (address < base || address > limit) { 10926 /* 10927 * Address not in this region. We must check whether the 10928 * region covers addresses in the same page as our address. 10929 * In that case we must not report a size that covers the 10930 * whole page for a subsequent hit against a different MPU 10931 * region or the background region, because it would result in 10932 * incorrect TLB hits for subsequent accesses to addresses that 10933 * are in this MPU region. 10934 */ 10935 if (limit >= base && 10936 ranges_overlap(base, limit - base + 1, 10937 addr_page_base, 10938 TARGET_PAGE_SIZE)) { 10939 *is_subpage = true; 10940 } 10941 continue; 10942 } 10943 10944 if (base > addr_page_base || limit < addr_page_limit) { 10945 *is_subpage = true; 10946 } 10947 10948 if (matchregion != -1) { 10949 /* Multiple regions match -- always a failure (unlike 10950 * PMSAv7 where highest-numbered-region wins) 10951 */ 10952 fi->type = ARMFault_Permission; 10953 fi->level = 1; 10954 return true; 10955 } 10956 10957 matchregion = n; 10958 hit = true; 10959 } 10960 } 10961 10962 if (!hit) { 10963 /* background fault */ 10964 fi->type = ARMFault_Background; 10965 return true; 10966 } 10967 10968 if (matchregion == -1) { 10969 /* hit using the background region */ 10970 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10971 } else { 10972 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2); 10973 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1); 10974 10975 if (m_is_system_region(env, address)) { 10976 /* System space is always execute never */ 10977 xn = 1; 10978 } 10979 10980 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 10981 if (*prot && !xn) { 10982 *prot |= PAGE_EXEC; 10983 } 10984 /* We don't need to look the attribute up in the MAIR0/MAIR1 10985 * registers because that only tells us about cacheability. 10986 */ 10987 if (mregion) { 10988 *mregion = matchregion; 10989 } 10990 } 10991 10992 fi->type = ARMFault_Permission; 10993 fi->level = 1; 10994 return !(*prot & (1 << access_type)); 10995 } 10996 10997 10998 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 10999 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11000 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11001 int *prot, target_ulong *page_size, 11002 ARMMMUFaultInfo *fi) 11003 { 11004 uint32_t secure = regime_is_secure(env, mmu_idx); 11005 V8M_SAttributes sattrs = {}; 11006 bool ret; 11007 bool mpu_is_subpage; 11008 11009 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11010 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs); 11011 if (access_type == MMU_INST_FETCH) { 11012 /* Instruction fetches always use the MMU bank and the 11013 * transaction attribute determined by the fetch address, 11014 * regardless of CPU state. This is painful for QEMU 11015 * to handle, because it would mean we need to encode 11016 * into the mmu_idx not just the (user, negpri) information 11017 * for the current security state but also that for the 11018 * other security state, which would balloon the number 11019 * of mmu_idx values needed alarmingly. 11020 * Fortunately we can avoid this because it's not actually 11021 * possible to arbitrarily execute code from memory with 11022 * the wrong security attribute: it will always generate 11023 * an exception of some kind or another, apart from the 11024 * special case of an NS CPU executing an SG instruction 11025 * in S&NSC memory. So we always just fail the translation 11026 * here and sort things out in the exception handler 11027 * (including possibly emulating an SG instruction). 11028 */ 11029 if (sattrs.ns != !secure) { 11030 if (sattrs.nsc) { 11031 fi->type = ARMFault_QEMU_NSCExec; 11032 } else { 11033 fi->type = ARMFault_QEMU_SFault; 11034 } 11035 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11036 *phys_ptr = address; 11037 *prot = 0; 11038 return true; 11039 } 11040 } else { 11041 /* For data accesses we always use the MMU bank indicated 11042 * by the current CPU state, but the security attributes 11043 * might downgrade a secure access to nonsecure. 11044 */ 11045 if (sattrs.ns) { 11046 txattrs->secure = false; 11047 } else if (!secure) { 11048 /* NS access to S memory must fault. 11049 * Architecturally we should first check whether the 11050 * MPU information for this address indicates that we 11051 * are doing an unaligned access to Device memory, which 11052 * should generate a UsageFault instead. QEMU does not 11053 * currently check for that kind of unaligned access though. 11054 * If we added it we would need to do so as a special case 11055 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 11056 */ 11057 fi->type = ARMFault_QEMU_SFault; 11058 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11059 *phys_ptr = address; 11060 *prot = 0; 11061 return true; 11062 } 11063 } 11064 } 11065 11066 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr, 11067 txattrs, prot, &mpu_is_subpage, fi, NULL); 11068 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE; 11069 return ret; 11070 } 11071 11072 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 11073 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11074 hwaddr *phys_ptr, int *prot, 11075 ARMMMUFaultInfo *fi) 11076 { 11077 int n; 11078 uint32_t mask; 11079 uint32_t base; 11080 bool is_user = regime_is_user(env, mmu_idx); 11081 11082 if (regime_translation_disabled(env, mmu_idx)) { 11083 /* MPU disabled. */ 11084 *phys_ptr = address; 11085 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11086 return false; 11087 } 11088 11089 *phys_ptr = address; 11090 for (n = 7; n >= 0; n--) { 11091 base = env->cp15.c6_region[n]; 11092 if ((base & 1) == 0) { 11093 continue; 11094 } 11095 mask = 1 << ((base >> 1) & 0x1f); 11096 /* Keep this shift separate from the above to avoid an 11097 (undefined) << 32. */ 11098 mask = (mask << 1) - 1; 11099 if (((base ^ address) & ~mask) == 0) { 11100 break; 11101 } 11102 } 11103 if (n < 0) { 11104 fi->type = ARMFault_Background; 11105 return true; 11106 } 11107 11108 if (access_type == MMU_INST_FETCH) { 11109 mask = env->cp15.pmsav5_insn_ap; 11110 } else { 11111 mask = env->cp15.pmsav5_data_ap; 11112 } 11113 mask = (mask >> (n * 4)) & 0xf; 11114 switch (mask) { 11115 case 0: 11116 fi->type = ARMFault_Permission; 11117 fi->level = 1; 11118 return true; 11119 case 1: 11120 if (is_user) { 11121 fi->type = ARMFault_Permission; 11122 fi->level = 1; 11123 return true; 11124 } 11125 *prot = PAGE_READ | PAGE_WRITE; 11126 break; 11127 case 2: 11128 *prot = PAGE_READ; 11129 if (!is_user) { 11130 *prot |= PAGE_WRITE; 11131 } 11132 break; 11133 case 3: 11134 *prot = PAGE_READ | PAGE_WRITE; 11135 break; 11136 case 5: 11137 if (is_user) { 11138 fi->type = ARMFault_Permission; 11139 fi->level = 1; 11140 return true; 11141 } 11142 *prot = PAGE_READ; 11143 break; 11144 case 6: 11145 *prot = PAGE_READ; 11146 break; 11147 default: 11148 /* Bad permission. */ 11149 fi->type = ARMFault_Permission; 11150 fi->level = 1; 11151 return true; 11152 } 11153 *prot |= PAGE_EXEC; 11154 return false; 11155 } 11156 11157 /* Combine either inner or outer cacheability attributes for normal 11158 * memory, according to table D4-42 and pseudocode procedure 11159 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 11160 * 11161 * NB: only stage 1 includes allocation hints (RW bits), leading to 11162 * some asymmetry. 11163 */ 11164 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 11165 { 11166 if (s1 == 4 || s2 == 4) { 11167 /* non-cacheable has precedence */ 11168 return 4; 11169 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 11170 /* stage 1 write-through takes precedence */ 11171 return s1; 11172 } else if (extract32(s2, 2, 2) == 2) { 11173 /* stage 2 write-through takes precedence, but the allocation hint 11174 * is still taken from stage 1 11175 */ 11176 return (2 << 2) | extract32(s1, 0, 2); 11177 } else { /* write-back */ 11178 return s1; 11179 } 11180 } 11181 11182 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 11183 * and CombineS1S2Desc() 11184 * 11185 * @s1: Attributes from stage 1 walk 11186 * @s2: Attributes from stage 2 walk 11187 */ 11188 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2) 11189 { 11190 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4); 11191 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4); 11192 ARMCacheAttrs ret; 11193 11194 /* Combine shareability attributes (table D4-43) */ 11195 if (s1.shareability == 2 || s2.shareability == 2) { 11196 /* if either are outer-shareable, the result is outer-shareable */ 11197 ret.shareability = 2; 11198 } else if (s1.shareability == 3 || s2.shareability == 3) { 11199 /* if either are inner-shareable, the result is inner-shareable */ 11200 ret.shareability = 3; 11201 } else { 11202 /* both non-shareable */ 11203 ret.shareability = 0; 11204 } 11205 11206 /* Combine memory type and cacheability attributes */ 11207 if (s1hi == 0 || s2hi == 0) { 11208 /* Device has precedence over normal */ 11209 if (s1lo == 0 || s2lo == 0) { 11210 /* nGnRnE has precedence over anything */ 11211 ret.attrs = 0; 11212 } else if (s1lo == 4 || s2lo == 4) { 11213 /* non-Reordering has precedence over Reordering */ 11214 ret.attrs = 4; /* nGnRE */ 11215 } else if (s1lo == 8 || s2lo == 8) { 11216 /* non-Gathering has precedence over Gathering */ 11217 ret.attrs = 8; /* nGRE */ 11218 } else { 11219 ret.attrs = 0xc; /* GRE */ 11220 } 11221 11222 /* Any location for which the resultant memory type is any 11223 * type of Device memory is always treated as Outer Shareable. 11224 */ 11225 ret.shareability = 2; 11226 } else { /* Normal memory */ 11227 /* Outer/inner cacheability combine independently */ 11228 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 11229 | combine_cacheattr_nibble(s1lo, s2lo); 11230 11231 if (ret.attrs == 0x44) { 11232 /* Any location for which the resultant memory type is Normal 11233 * Inner Non-cacheable, Outer Non-cacheable is always treated 11234 * as Outer Shareable. 11235 */ 11236 ret.shareability = 2; 11237 } 11238 } 11239 11240 return ret; 11241 } 11242 11243 11244 /* get_phys_addr - get the physical address for this virtual address 11245 * 11246 * Find the physical address corresponding to the given virtual address, 11247 * by doing a translation table walk on MMU based systems or using the 11248 * MPU state on MPU based systems. 11249 * 11250 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs, 11251 * prot and page_size may not be filled in, and the populated fsr value provides 11252 * information on why the translation aborted, in the format of a 11253 * DFSR/IFSR fault register, with the following caveats: 11254 * * we honour the short vs long DFSR format differences. 11255 * * the WnR bit is never set (the caller must do this). 11256 * * for PSMAv5 based systems we don't bother to return a full FSR format 11257 * value. 11258 * 11259 * @env: CPUARMState 11260 * @address: virtual address to get physical address for 11261 * @access_type: 0 for read, 1 for write, 2 for execute 11262 * @mmu_idx: MMU index indicating required translation regime 11263 * @phys_ptr: set to the physical address corresponding to the virtual address 11264 * @attrs: set to the memory transaction attributes to use 11265 * @prot: set to the permissions for the page containing phys_ptr 11266 * @page_size: set to the size of the page containing phys_ptr 11267 * @fi: set to fault info if the translation fails 11268 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes 11269 */ 11270 bool get_phys_addr(CPUARMState *env, target_ulong address, 11271 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11272 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 11273 target_ulong *page_size, 11274 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 11275 { 11276 if (mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_E10_1) { 11277 /* Call ourselves recursively to do the stage 1 and then stage 2 11278 * translations. 11279 */ 11280 if (arm_feature(env, ARM_FEATURE_EL2)) { 11281 hwaddr ipa; 11282 int s2_prot; 11283 int ret; 11284 ARMCacheAttrs cacheattrs2 = {}; 11285 11286 ret = get_phys_addr(env, address, access_type, 11287 stage_1_mmu_idx(mmu_idx), &ipa, attrs, 11288 prot, page_size, fi, cacheattrs); 11289 11290 /* If S1 fails or S2 is disabled, return early. */ 11291 if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2)) { 11292 *phys_ptr = ipa; 11293 return ret; 11294 } 11295 11296 /* S1 is done. Now do S2 translation. */ 11297 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_Stage2, 11298 phys_ptr, attrs, &s2_prot, 11299 page_size, fi, 11300 cacheattrs != NULL ? &cacheattrs2 : NULL); 11301 fi->s2addr = ipa; 11302 /* Combine the S1 and S2 perms. */ 11303 *prot &= s2_prot; 11304 11305 /* Combine the S1 and S2 cache attributes, if needed */ 11306 if (!ret && cacheattrs != NULL) { 11307 if (env->cp15.hcr_el2 & HCR_DC) { 11308 /* 11309 * HCR.DC forces the first stage attributes to 11310 * Normal Non-Shareable, 11311 * Inner Write-Back Read-Allocate Write-Allocate, 11312 * Outer Write-Back Read-Allocate Write-Allocate. 11313 */ 11314 cacheattrs->attrs = 0xff; 11315 cacheattrs->shareability = 0; 11316 } 11317 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2); 11318 } 11319 11320 return ret; 11321 } else { 11322 /* 11323 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1. 11324 */ 11325 mmu_idx = stage_1_mmu_idx(mmu_idx); 11326 } 11327 } 11328 11329 /* The page table entries may downgrade secure to non-secure, but 11330 * cannot upgrade an non-secure translation regime's attributes 11331 * to secure. 11332 */ 11333 attrs->secure = regime_is_secure(env, mmu_idx); 11334 attrs->user = regime_is_user(env, mmu_idx); 11335 11336 /* Fast Context Switch Extension. This doesn't exist at all in v8. 11337 * In v7 and earlier it affects all stage 1 translations. 11338 */ 11339 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2 11340 && !arm_feature(env, ARM_FEATURE_V8)) { 11341 if (regime_el(env, mmu_idx) == 3) { 11342 address += env->cp15.fcseidr_s; 11343 } else { 11344 address += env->cp15.fcseidr_ns; 11345 } 11346 } 11347 11348 if (arm_feature(env, ARM_FEATURE_PMSA)) { 11349 bool ret; 11350 *page_size = TARGET_PAGE_SIZE; 11351 11352 if (arm_feature(env, ARM_FEATURE_V8)) { 11353 /* PMSAv8 */ 11354 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 11355 phys_ptr, attrs, prot, page_size, fi); 11356 } else if (arm_feature(env, ARM_FEATURE_V7)) { 11357 /* PMSAv7 */ 11358 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 11359 phys_ptr, prot, page_size, fi); 11360 } else { 11361 /* Pre-v7 MPU */ 11362 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 11363 phys_ptr, prot, fi); 11364 } 11365 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 11366 " mmu_idx %u -> %s (prot %c%c%c)\n", 11367 access_type == MMU_DATA_LOAD ? "reading" : 11368 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 11369 (uint32_t)address, mmu_idx, 11370 ret ? "Miss" : "Hit", 11371 *prot & PAGE_READ ? 'r' : '-', 11372 *prot & PAGE_WRITE ? 'w' : '-', 11373 *prot & PAGE_EXEC ? 'x' : '-'); 11374 11375 return ret; 11376 } 11377 11378 /* Definitely a real MMU, not an MPU */ 11379 11380 if (regime_translation_disabled(env, mmu_idx)) { 11381 /* MMU disabled. */ 11382 *phys_ptr = address; 11383 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11384 *page_size = TARGET_PAGE_SIZE; 11385 return 0; 11386 } 11387 11388 if (regime_using_lpae_format(env, mmu_idx)) { 11389 return get_phys_addr_lpae(env, address, access_type, mmu_idx, 11390 phys_ptr, attrs, prot, page_size, 11391 fi, cacheattrs); 11392 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) { 11393 return get_phys_addr_v6(env, address, access_type, mmu_idx, 11394 phys_ptr, attrs, prot, page_size, fi); 11395 } else { 11396 return get_phys_addr_v5(env, address, access_type, mmu_idx, 11397 phys_ptr, prot, page_size, fi); 11398 } 11399 } 11400 11401 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 11402 MemTxAttrs *attrs) 11403 { 11404 ARMCPU *cpu = ARM_CPU(cs); 11405 CPUARMState *env = &cpu->env; 11406 hwaddr phys_addr; 11407 target_ulong page_size; 11408 int prot; 11409 bool ret; 11410 ARMMMUFaultInfo fi = {}; 11411 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 11412 11413 *attrs = (MemTxAttrs) {}; 11414 11415 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr, 11416 attrs, &prot, &page_size, &fi, NULL); 11417 11418 if (ret) { 11419 return -1; 11420 } 11421 return phys_addr; 11422 } 11423 11424 #endif 11425 11426 /* Note that signed overflow is undefined in C. The following routines are 11427 careful to use unsigned types where modulo arithmetic is required. 11428 Failure to do so _will_ break on newer gcc. */ 11429 11430 /* Signed saturating arithmetic. */ 11431 11432 /* Perform 16-bit signed saturating addition. */ 11433 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 11434 { 11435 uint16_t res; 11436 11437 res = a + b; 11438 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 11439 if (a & 0x8000) 11440 res = 0x8000; 11441 else 11442 res = 0x7fff; 11443 } 11444 return res; 11445 } 11446 11447 /* Perform 8-bit signed saturating addition. */ 11448 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 11449 { 11450 uint8_t res; 11451 11452 res = a + b; 11453 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 11454 if (a & 0x80) 11455 res = 0x80; 11456 else 11457 res = 0x7f; 11458 } 11459 return res; 11460 } 11461 11462 /* Perform 16-bit signed saturating subtraction. */ 11463 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 11464 { 11465 uint16_t res; 11466 11467 res = a - b; 11468 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 11469 if (a & 0x8000) 11470 res = 0x8000; 11471 else 11472 res = 0x7fff; 11473 } 11474 return res; 11475 } 11476 11477 /* Perform 8-bit signed saturating subtraction. */ 11478 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 11479 { 11480 uint8_t res; 11481 11482 res = a - b; 11483 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 11484 if (a & 0x80) 11485 res = 0x80; 11486 else 11487 res = 0x7f; 11488 } 11489 return res; 11490 } 11491 11492 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 11493 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 11494 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 11495 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 11496 #define PFX q 11497 11498 #include "op_addsub.h" 11499 11500 /* Unsigned saturating arithmetic. */ 11501 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 11502 { 11503 uint16_t res; 11504 res = a + b; 11505 if (res < a) 11506 res = 0xffff; 11507 return res; 11508 } 11509 11510 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 11511 { 11512 if (a > b) 11513 return a - b; 11514 else 11515 return 0; 11516 } 11517 11518 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 11519 { 11520 uint8_t res; 11521 res = a + b; 11522 if (res < a) 11523 res = 0xff; 11524 return res; 11525 } 11526 11527 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 11528 { 11529 if (a > b) 11530 return a - b; 11531 else 11532 return 0; 11533 } 11534 11535 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 11536 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 11537 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 11538 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 11539 #define PFX uq 11540 11541 #include "op_addsub.h" 11542 11543 /* Signed modulo arithmetic. */ 11544 #define SARITH16(a, b, n, op) do { \ 11545 int32_t sum; \ 11546 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 11547 RESULT(sum, n, 16); \ 11548 if (sum >= 0) \ 11549 ge |= 3 << (n * 2); \ 11550 } while(0) 11551 11552 #define SARITH8(a, b, n, op) do { \ 11553 int32_t sum; \ 11554 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 11555 RESULT(sum, n, 8); \ 11556 if (sum >= 0) \ 11557 ge |= 1 << n; \ 11558 } while(0) 11559 11560 11561 #define ADD16(a, b, n) SARITH16(a, b, n, +) 11562 #define SUB16(a, b, n) SARITH16(a, b, n, -) 11563 #define ADD8(a, b, n) SARITH8(a, b, n, +) 11564 #define SUB8(a, b, n) SARITH8(a, b, n, -) 11565 #define PFX s 11566 #define ARITH_GE 11567 11568 #include "op_addsub.h" 11569 11570 /* Unsigned modulo arithmetic. */ 11571 #define ADD16(a, b, n) do { \ 11572 uint32_t sum; \ 11573 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 11574 RESULT(sum, n, 16); \ 11575 if ((sum >> 16) == 1) \ 11576 ge |= 3 << (n * 2); \ 11577 } while(0) 11578 11579 #define ADD8(a, b, n) do { \ 11580 uint32_t sum; \ 11581 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 11582 RESULT(sum, n, 8); \ 11583 if ((sum >> 8) == 1) \ 11584 ge |= 1 << n; \ 11585 } while(0) 11586 11587 #define SUB16(a, b, n) do { \ 11588 uint32_t sum; \ 11589 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 11590 RESULT(sum, n, 16); \ 11591 if ((sum >> 16) == 0) \ 11592 ge |= 3 << (n * 2); \ 11593 } while(0) 11594 11595 #define SUB8(a, b, n) do { \ 11596 uint32_t sum; \ 11597 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 11598 RESULT(sum, n, 8); \ 11599 if ((sum >> 8) == 0) \ 11600 ge |= 1 << n; \ 11601 } while(0) 11602 11603 #define PFX u 11604 #define ARITH_GE 11605 11606 #include "op_addsub.h" 11607 11608 /* Halved signed arithmetic. */ 11609 #define ADD16(a, b, n) \ 11610 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 11611 #define SUB16(a, b, n) \ 11612 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 11613 #define ADD8(a, b, n) \ 11614 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 11615 #define SUB8(a, b, n) \ 11616 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 11617 #define PFX sh 11618 11619 #include "op_addsub.h" 11620 11621 /* Halved unsigned arithmetic. */ 11622 #define ADD16(a, b, n) \ 11623 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 11624 #define SUB16(a, b, n) \ 11625 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 11626 #define ADD8(a, b, n) \ 11627 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 11628 #define SUB8(a, b, n) \ 11629 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 11630 #define PFX uh 11631 11632 #include "op_addsub.h" 11633 11634 static inline uint8_t do_usad(uint8_t a, uint8_t b) 11635 { 11636 if (a > b) 11637 return a - b; 11638 else 11639 return b - a; 11640 } 11641 11642 /* Unsigned sum of absolute byte differences. */ 11643 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 11644 { 11645 uint32_t sum; 11646 sum = do_usad(a, b); 11647 sum += do_usad(a >> 8, b >> 8); 11648 sum += do_usad(a >> 16, b >>16); 11649 sum += do_usad(a >> 24, b >> 24); 11650 return sum; 11651 } 11652 11653 /* For ARMv6 SEL instruction. */ 11654 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 11655 { 11656 uint32_t mask; 11657 11658 mask = 0; 11659 if (flags & 1) 11660 mask |= 0xff; 11661 if (flags & 2) 11662 mask |= 0xff00; 11663 if (flags & 4) 11664 mask |= 0xff0000; 11665 if (flags & 8) 11666 mask |= 0xff000000; 11667 return (a & mask) | (b & ~mask); 11668 } 11669 11670 /* CRC helpers. 11671 * The upper bytes of val (above the number specified by 'bytes') must have 11672 * been zeroed out by the caller. 11673 */ 11674 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 11675 { 11676 uint8_t buf[4]; 11677 11678 stl_le_p(buf, val); 11679 11680 /* zlib crc32 converts the accumulator and output to one's complement. */ 11681 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 11682 } 11683 11684 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 11685 { 11686 uint8_t buf[4]; 11687 11688 stl_le_p(buf, val); 11689 11690 /* Linux crc32c converts the output to one's complement. */ 11691 return crc32c(acc, buf, bytes) ^ 0xffffffff; 11692 } 11693 11694 /* Return the exception level to which FP-disabled exceptions should 11695 * be taken, or 0 if FP is enabled. 11696 */ 11697 int fp_exception_el(CPUARMState *env, int cur_el) 11698 { 11699 #ifndef CONFIG_USER_ONLY 11700 /* CPACR and the CPTR registers don't exist before v6, so FP is 11701 * always accessible 11702 */ 11703 if (!arm_feature(env, ARM_FEATURE_V6)) { 11704 return 0; 11705 } 11706 11707 if (arm_feature(env, ARM_FEATURE_M)) { 11708 /* CPACR can cause a NOCP UsageFault taken to current security state */ 11709 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) { 11710 return 1; 11711 } 11712 11713 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) { 11714 if (!extract32(env->v7m.nsacr, 10, 1)) { 11715 /* FP insns cause a NOCP UsageFault taken to Secure */ 11716 return 3; 11717 } 11718 } 11719 11720 return 0; 11721 } 11722 11723 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit: 11724 * 0, 2 : trap EL0 and EL1/PL1 accesses 11725 * 1 : trap only EL0 accesses 11726 * 3 : trap no accesses 11727 * This register is ignored if E2H+TGE are both set. 11728 */ 11729 if ((arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 11730 int fpen = extract32(env->cp15.cpacr_el1, 20, 2); 11731 11732 switch (fpen) { 11733 case 0: 11734 case 2: 11735 if (cur_el == 0 || cur_el == 1) { 11736 /* Trap to PL1, which might be EL1 or EL3 */ 11737 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) { 11738 return 3; 11739 } 11740 return 1; 11741 } 11742 if (cur_el == 3 && !is_a64(env)) { 11743 /* Secure PL1 running at EL3 */ 11744 return 3; 11745 } 11746 break; 11747 case 1: 11748 if (cur_el == 0) { 11749 return 1; 11750 } 11751 break; 11752 case 3: 11753 break; 11754 } 11755 } 11756 11757 /* 11758 * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode 11759 * to control non-secure access to the FPU. It doesn't have any 11760 * effect if EL3 is AArch64 or if EL3 doesn't exist at all. 11761 */ 11762 if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 11763 cur_el <= 2 && !arm_is_secure_below_el3(env))) { 11764 if (!extract32(env->cp15.nsacr, 10, 1)) { 11765 /* FP insns act as UNDEF */ 11766 return cur_el == 2 ? 2 : 1; 11767 } 11768 } 11769 11770 /* For the CPTR registers we don't need to guard with an ARM_FEATURE 11771 * check because zero bits in the registers mean "don't trap". 11772 */ 11773 11774 /* CPTR_EL2 : present in v7VE or v8 */ 11775 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1) 11776 && !arm_is_secure_below_el3(env)) { 11777 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */ 11778 return 2; 11779 } 11780 11781 /* CPTR_EL3 : present in v8 */ 11782 if (extract32(env->cp15.cptr_el[3], 10, 1)) { 11783 /* Trap all FP ops to EL3 */ 11784 return 3; 11785 } 11786 #endif 11787 return 0; 11788 } 11789 11790 /* Return the exception level we're running at if this is our mmu_idx */ 11791 int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx) 11792 { 11793 if (mmu_idx & ARM_MMU_IDX_M) { 11794 return mmu_idx & ARM_MMU_IDX_M_PRIV; 11795 } 11796 11797 switch (mmu_idx) { 11798 case ARMMMUIdx_E10_0: 11799 case ARMMMUIdx_E20_0: 11800 case ARMMMUIdx_SE10_0: 11801 return 0; 11802 case ARMMMUIdx_E10_1: 11803 case ARMMMUIdx_SE10_1: 11804 return 1; 11805 case ARMMMUIdx_E2: 11806 case ARMMMUIdx_E20_2: 11807 return 2; 11808 case ARMMMUIdx_SE3: 11809 return 3; 11810 default: 11811 g_assert_not_reached(); 11812 } 11813 } 11814 11815 #ifndef CONFIG_TCG 11816 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 11817 { 11818 g_assert_not_reached(); 11819 } 11820 #endif 11821 11822 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el) 11823 { 11824 if (arm_feature(env, ARM_FEATURE_M)) { 11825 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 11826 } 11827 11828 /* See ARM pseudo-function ELIsInHost. */ 11829 switch (el) { 11830 case 0: 11831 if (arm_is_secure_below_el3(env)) { 11832 return ARMMMUIdx_SE10_0; 11833 } 11834 if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE) 11835 && arm_el_is_aa64(env, 2)) { 11836 return ARMMMUIdx_E20_0; 11837 } 11838 return ARMMMUIdx_E10_0; 11839 case 1: 11840 if (arm_is_secure_below_el3(env)) { 11841 return ARMMMUIdx_SE10_1; 11842 } 11843 return ARMMMUIdx_E10_1; 11844 case 2: 11845 /* TODO: ARMv8.4-SecEL2 */ 11846 /* Note that TGE does not apply at EL2. */ 11847 if ((env->cp15.hcr_el2 & HCR_E2H) && arm_el_is_aa64(env, 2)) { 11848 return ARMMMUIdx_E20_2; 11849 } 11850 return ARMMMUIdx_E2; 11851 case 3: 11852 return ARMMMUIdx_SE3; 11853 default: 11854 g_assert_not_reached(); 11855 } 11856 } 11857 11858 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 11859 { 11860 return arm_mmu_idx_el(env, arm_current_el(env)); 11861 } 11862 11863 int cpu_mmu_index(CPUARMState *env, bool ifetch) 11864 { 11865 return arm_to_core_mmu_idx(arm_mmu_idx(env)); 11866 } 11867 11868 #ifndef CONFIG_USER_ONLY 11869 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 11870 { 11871 return stage_1_mmu_idx(arm_mmu_idx(env)); 11872 } 11873 #endif 11874 11875 static uint32_t rebuild_hflags_common(CPUARMState *env, int fp_el, 11876 ARMMMUIdx mmu_idx, uint32_t flags) 11877 { 11878 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el); 11879 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, 11880 arm_to_core_mmu_idx(mmu_idx)); 11881 11882 if (arm_singlestep_active(env)) { 11883 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1); 11884 } 11885 return flags; 11886 } 11887 11888 static uint32_t rebuild_hflags_common_32(CPUARMState *env, int fp_el, 11889 ARMMMUIdx mmu_idx, uint32_t flags) 11890 { 11891 bool sctlr_b = arm_sctlr_b(env); 11892 11893 if (sctlr_b) { 11894 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, 1); 11895 } 11896 if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) { 11897 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 11898 } 11899 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env)); 11900 11901 return rebuild_hflags_common(env, fp_el, mmu_idx, flags); 11902 } 11903 11904 static uint32_t rebuild_hflags_m32(CPUARMState *env, int fp_el, 11905 ARMMMUIdx mmu_idx) 11906 { 11907 uint32_t flags = 0; 11908 11909 if (arm_v7m_is_handler_mode(env)) { 11910 flags = FIELD_DP32(flags, TBFLAG_M32, HANDLER, 1); 11911 } 11912 11913 /* 11914 * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN 11915 * is suppressing them because the requested execution priority 11916 * is less than 0. 11917 */ 11918 if (arm_feature(env, ARM_FEATURE_V8) && 11919 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) && 11920 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) { 11921 flags = FIELD_DP32(flags, TBFLAG_M32, STACKCHECK, 1); 11922 } 11923 11924 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags); 11925 } 11926 11927 static uint32_t rebuild_hflags_aprofile(CPUARMState *env) 11928 { 11929 int flags = 0; 11930 11931 flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL, 11932 arm_debug_target_el(env)); 11933 return flags; 11934 } 11935 11936 static uint32_t rebuild_hflags_a32(CPUARMState *env, int fp_el, 11937 ARMMMUIdx mmu_idx) 11938 { 11939 uint32_t flags = rebuild_hflags_aprofile(env); 11940 11941 if (arm_el_is_aa64(env, 1)) { 11942 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 11943 } 11944 11945 if (arm_current_el(env) < 2 && env->cp15.hstr_el2 && 11946 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 11947 flags = FIELD_DP32(flags, TBFLAG_A32, HSTR_ACTIVE, 1); 11948 } 11949 11950 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags); 11951 } 11952 11953 static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el, 11954 ARMMMUIdx mmu_idx) 11955 { 11956 uint32_t flags = rebuild_hflags_aprofile(env); 11957 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx); 11958 ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1); 11959 uint64_t sctlr; 11960 int tbii, tbid; 11961 11962 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1); 11963 11964 /* Get control bits for tagged addresses. */ 11965 if (regime_has_2_ranges(mmu_idx)) { 11966 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1); 11967 tbid = (p1.tbi << 1) | p0.tbi; 11968 tbii = tbid & ~((p1.tbid << 1) | p0.tbid); 11969 } else { 11970 tbid = p0.tbi; 11971 tbii = tbid & !p0.tbid; 11972 } 11973 11974 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii); 11975 flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid); 11976 11977 if (cpu_isar_feature(aa64_sve, env_archcpu(env))) { 11978 int sve_el = sve_exception_el(env, el); 11979 uint32_t zcr_len; 11980 11981 /* 11982 * If SVE is disabled, but FP is enabled, 11983 * then the effective len is 0. 11984 */ 11985 if (sve_el != 0 && fp_el == 0) { 11986 zcr_len = 0; 11987 } else { 11988 zcr_len = sve_zcr_len_for_el(env, el); 11989 } 11990 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el); 11991 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len); 11992 } 11993 11994 sctlr = regime_sctlr(env, stage1); 11995 11996 if (arm_cpu_data_is_big_endian_a64(el, sctlr)) { 11997 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 11998 } 11999 12000 if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) { 12001 /* 12002 * In order to save space in flags, we record only whether 12003 * pauth is "inactive", meaning all insns are implemented as 12004 * a nop, or "active" when some action must be performed. 12005 * The decision of which action to take is left to a helper. 12006 */ 12007 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) { 12008 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1); 12009 } 12010 } 12011 12012 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) { 12013 /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */ 12014 if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) { 12015 flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1); 12016 } 12017 } 12018 12019 /* Compute the condition for using AccType_UNPRIV for LDTR et al. */ 12020 /* TODO: ARMv8.2-UAO */ 12021 switch (mmu_idx) { 12022 case ARMMMUIdx_E10_1: 12023 case ARMMMUIdx_SE10_1: 12024 /* TODO: ARMv8.3-NV */ 12025 flags = FIELD_DP32(flags, TBFLAG_A64, UNPRIV, 1); 12026 break; 12027 case ARMMMUIdx_E20_2: 12028 /* TODO: ARMv8.4-SecEL2 */ 12029 /* 12030 * Note that E20_2 is gated by HCR_EL2.E2H == 1, but E20_0 is 12031 * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR. 12032 */ 12033 if (env->cp15.hcr_el2 & HCR_TGE) { 12034 flags = FIELD_DP32(flags, TBFLAG_A64, UNPRIV, 1); 12035 } 12036 break; 12037 default: 12038 break; 12039 } 12040 12041 return rebuild_hflags_common(env, fp_el, mmu_idx, flags); 12042 } 12043 12044 static uint32_t rebuild_hflags_internal(CPUARMState *env) 12045 { 12046 int el = arm_current_el(env); 12047 int fp_el = fp_exception_el(env, el); 12048 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12049 12050 if (is_a64(env)) { 12051 return rebuild_hflags_a64(env, el, fp_el, mmu_idx); 12052 } else if (arm_feature(env, ARM_FEATURE_M)) { 12053 return rebuild_hflags_m32(env, fp_el, mmu_idx); 12054 } else { 12055 return rebuild_hflags_a32(env, fp_el, mmu_idx); 12056 } 12057 } 12058 12059 void arm_rebuild_hflags(CPUARMState *env) 12060 { 12061 env->hflags = rebuild_hflags_internal(env); 12062 } 12063 12064 void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el) 12065 { 12066 int fp_el = fp_exception_el(env, el); 12067 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12068 12069 env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx); 12070 } 12071 12072 /* 12073 * If we have triggered a EL state change we can't rely on the 12074 * translator having passed it too us, we need to recompute. 12075 */ 12076 void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env) 12077 { 12078 int el = arm_current_el(env); 12079 int fp_el = fp_exception_el(env, el); 12080 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12081 env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx); 12082 } 12083 12084 void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el) 12085 { 12086 int fp_el = fp_exception_el(env, el); 12087 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12088 12089 env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx); 12090 } 12091 12092 void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el) 12093 { 12094 int fp_el = fp_exception_el(env, el); 12095 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12096 12097 env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx); 12098 } 12099 12100 static inline void assert_hflags_rebuild_correctly(CPUARMState *env) 12101 { 12102 #ifdef CONFIG_DEBUG_TCG 12103 uint32_t env_flags_current = env->hflags; 12104 uint32_t env_flags_rebuilt = rebuild_hflags_internal(env); 12105 12106 if (unlikely(env_flags_current != env_flags_rebuilt)) { 12107 fprintf(stderr, "TCG hflags mismatch (current:0x%08x rebuilt:0x%08x)\n", 12108 env_flags_current, env_flags_rebuilt); 12109 abort(); 12110 } 12111 #endif 12112 } 12113 12114 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 12115 target_ulong *cs_base, uint32_t *pflags) 12116 { 12117 uint32_t flags = env->hflags; 12118 uint32_t pstate_for_ss; 12119 12120 *cs_base = 0; 12121 assert_hflags_rebuild_correctly(env); 12122 12123 if (FIELD_EX32(flags, TBFLAG_ANY, AARCH64_STATE)) { 12124 *pc = env->pc; 12125 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) { 12126 flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype); 12127 } 12128 pstate_for_ss = env->pstate; 12129 } else { 12130 *pc = env->regs[15]; 12131 12132 if (arm_feature(env, ARM_FEATURE_M)) { 12133 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 12134 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) 12135 != env->v7m.secure) { 12136 flags = FIELD_DP32(flags, TBFLAG_M32, FPCCR_S_WRONG, 1); 12137 } 12138 12139 if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) && 12140 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) || 12141 (env->v7m.secure && 12142 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) { 12143 /* 12144 * ASPEN is set, but FPCA/SFPA indicate that there is no 12145 * active FP context; we must create a new FP context before 12146 * executing any FP insn. 12147 */ 12148 flags = FIELD_DP32(flags, TBFLAG_M32, NEW_FP_CTXT_NEEDED, 1); 12149 } 12150 12151 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 12152 if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) { 12153 flags = FIELD_DP32(flags, TBFLAG_M32, LSPACT, 1); 12154 } 12155 } else { 12156 /* 12157 * Note that XSCALE_CPAR shares bits with VECSTRIDE. 12158 * Note that VECLEN+VECSTRIDE are RES0 for M-profile. 12159 */ 12160 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 12161 flags = FIELD_DP32(flags, TBFLAG_A32, 12162 XSCALE_CPAR, env->cp15.c15_cpar); 12163 } else { 12164 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, 12165 env->vfp.vec_len); 12166 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, 12167 env->vfp.vec_stride); 12168 } 12169 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) { 12170 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 12171 } 12172 } 12173 12174 flags = FIELD_DP32(flags, TBFLAG_AM32, THUMB, env->thumb); 12175 flags = FIELD_DP32(flags, TBFLAG_AM32, CONDEXEC, env->condexec_bits); 12176 pstate_for_ss = env->uncached_cpsr; 12177 } 12178 12179 /* 12180 * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 12181 * states defined in the ARM ARM for software singlestep: 12182 * SS_ACTIVE PSTATE.SS State 12183 * 0 x Inactive (the TB flag for SS is always 0) 12184 * 1 0 Active-pending 12185 * 1 1 Active-not-pending 12186 * SS_ACTIVE is set in hflags; PSTATE_SS is computed every TB. 12187 */ 12188 if (FIELD_EX32(flags, TBFLAG_ANY, SS_ACTIVE) && 12189 (pstate_for_ss & PSTATE_SS)) { 12190 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 12191 } 12192 12193 *pflags = flags; 12194 } 12195 12196 #ifdef TARGET_AARCH64 12197 /* 12198 * The manual says that when SVE is enabled and VQ is widened the 12199 * implementation is allowed to zero the previously inaccessible 12200 * portion of the registers. The corollary to that is that when 12201 * SVE is enabled and VQ is narrowed we are also allowed to zero 12202 * the now inaccessible portion of the registers. 12203 * 12204 * The intent of this is that no predicate bit beyond VQ is ever set. 12205 * Which means that some operations on predicate registers themselves 12206 * may operate on full uint64_t or even unrolled across the maximum 12207 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 12208 * may well be cheaper than conditionals to restrict the operation 12209 * to the relevant portion of a uint16_t[16]. 12210 */ 12211 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 12212 { 12213 int i, j; 12214 uint64_t pmask; 12215 12216 assert(vq >= 1 && vq <= ARM_MAX_VQ); 12217 assert(vq <= env_archcpu(env)->sve_max_vq); 12218 12219 /* Zap the high bits of the zregs. */ 12220 for (i = 0; i < 32; i++) { 12221 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 12222 } 12223 12224 /* Zap the high bits of the pregs and ffr. */ 12225 pmask = 0; 12226 if (vq & 3) { 12227 pmask = ~(-1ULL << (16 * (vq & 3))); 12228 } 12229 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 12230 for (i = 0; i < 17; ++i) { 12231 env->vfp.pregs[i].p[j] &= pmask; 12232 } 12233 pmask = 0; 12234 } 12235 } 12236 12237 /* 12238 * Notice a change in SVE vector size when changing EL. 12239 */ 12240 void aarch64_sve_change_el(CPUARMState *env, int old_el, 12241 int new_el, bool el0_a64) 12242 { 12243 ARMCPU *cpu = env_archcpu(env); 12244 int old_len, new_len; 12245 bool old_a64, new_a64; 12246 12247 /* Nothing to do if no SVE. */ 12248 if (!cpu_isar_feature(aa64_sve, cpu)) { 12249 return; 12250 } 12251 12252 /* Nothing to do if FP is disabled in either EL. */ 12253 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 12254 return; 12255 } 12256 12257 /* 12258 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 12259 * at ELx, or not available because the EL is in AArch32 state, then 12260 * for all purposes other than a direct read, the ZCR_ELx.LEN field 12261 * has an effective value of 0". 12262 * 12263 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 12264 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 12265 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 12266 * we already have the correct register contents when encountering the 12267 * vq0->vq0 transition between EL0->EL1. 12268 */ 12269 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 12270 old_len = (old_a64 && !sve_exception_el(env, old_el) 12271 ? sve_zcr_len_for_el(env, old_el) : 0); 12272 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 12273 new_len = (new_a64 && !sve_exception_el(env, new_el) 12274 ? sve_zcr_len_for_el(env, new_el) : 0); 12275 12276 /* When changing vector length, clear inaccessible state. */ 12277 if (new_len < old_len) { 12278 aarch64_sve_narrow_vq(env, new_len + 1); 12279 } 12280 } 12281 #endif 12282