1 #include "qemu/osdep.h" 2 #include "target/arm/idau.h" 3 #include "trace.h" 4 #include "cpu.h" 5 #include "internals.h" 6 #include "exec/gdbstub.h" 7 #include "exec/helper-proto.h" 8 #include "qemu/host-utils.h" 9 #include "sysemu/arch_init.h" 10 #include "sysemu/sysemu.h" 11 #include "qemu/bitops.h" 12 #include "qemu/crc32c.h" 13 #include "exec/exec-all.h" 14 #include "exec/cpu_ldst.h" 15 #include "arm_ldst.h" 16 #include <zlib.h> /* For crc32 */ 17 #include "exec/semihost.h" 18 #include "sysemu/cpus.h" 19 #include "sysemu/kvm.h" 20 #include "fpu/softfloat.h" 21 #include "qemu/range.h" 22 23 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 24 25 #ifndef CONFIG_USER_ONLY 26 /* Cacheability and shareability attributes for a memory access */ 27 typedef struct ARMCacheAttrs { 28 unsigned int attrs:8; /* as in the MAIR register encoding */ 29 unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */ 30 } ARMCacheAttrs; 31 32 static bool get_phys_addr(CPUARMState *env, target_ulong address, 33 MMUAccessType access_type, ARMMMUIdx mmu_idx, 34 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 35 target_ulong *page_size, 36 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 37 38 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 39 MMUAccessType access_type, ARMMMUIdx mmu_idx, 40 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 41 target_ulong *page_size_ptr, 42 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 43 44 /* Security attributes for an address, as returned by v8m_security_lookup. */ 45 typedef struct V8M_SAttributes { 46 bool subpage; /* true if these attrs don't cover the whole TARGET_PAGE */ 47 bool ns; 48 bool nsc; 49 uint8_t sregion; 50 bool srvalid; 51 uint8_t iregion; 52 bool irvalid; 53 } V8M_SAttributes; 54 55 static void v8m_security_lookup(CPUARMState *env, uint32_t address, 56 MMUAccessType access_type, ARMMMUIdx mmu_idx, 57 V8M_SAttributes *sattrs); 58 #endif 59 60 static void switch_mode(CPUARMState *env, int mode); 61 62 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 63 { 64 int nregs; 65 66 /* VFP data registers are always little-endian. */ 67 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 68 if (reg < nregs) { 69 stq_le_p(buf, *aa32_vfp_dreg(env, reg)); 70 return 8; 71 } 72 if (arm_feature(env, ARM_FEATURE_NEON)) { 73 /* Aliases for Q regs. */ 74 nregs += 16; 75 if (reg < nregs) { 76 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 77 stq_le_p(buf, q[0]); 78 stq_le_p(buf + 8, q[1]); 79 return 16; 80 } 81 } 82 switch (reg - nregs) { 83 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4; 84 case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4; 85 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4; 86 } 87 return 0; 88 } 89 90 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 91 { 92 int nregs; 93 94 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 95 if (reg < nregs) { 96 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf); 97 return 8; 98 } 99 if (arm_feature(env, ARM_FEATURE_NEON)) { 100 nregs += 16; 101 if (reg < nregs) { 102 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 103 q[0] = ldq_le_p(buf); 104 q[1] = ldq_le_p(buf + 8); 105 return 16; 106 } 107 } 108 switch (reg - nregs) { 109 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4; 110 case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4; 111 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4; 112 } 113 return 0; 114 } 115 116 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 117 { 118 switch (reg) { 119 case 0 ... 31: 120 /* 128 bit FP register */ 121 { 122 uint64_t *q = aa64_vfp_qreg(env, reg); 123 stq_le_p(buf, q[0]); 124 stq_le_p(buf + 8, q[1]); 125 return 16; 126 } 127 case 32: 128 /* FPSR */ 129 stl_p(buf, vfp_get_fpsr(env)); 130 return 4; 131 case 33: 132 /* FPCR */ 133 stl_p(buf, vfp_get_fpcr(env)); 134 return 4; 135 default: 136 return 0; 137 } 138 } 139 140 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 141 { 142 switch (reg) { 143 case 0 ... 31: 144 /* 128 bit FP register */ 145 { 146 uint64_t *q = aa64_vfp_qreg(env, reg); 147 q[0] = ldq_le_p(buf); 148 q[1] = ldq_le_p(buf + 8); 149 return 16; 150 } 151 case 32: 152 /* FPSR */ 153 vfp_set_fpsr(env, ldl_p(buf)); 154 return 4; 155 case 33: 156 /* FPCR */ 157 vfp_set_fpcr(env, ldl_p(buf)); 158 return 4; 159 default: 160 return 0; 161 } 162 } 163 164 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 165 { 166 assert(ri->fieldoffset); 167 if (cpreg_field_is_64bit(ri)) { 168 return CPREG_FIELD64(env, ri); 169 } else { 170 return CPREG_FIELD32(env, ri); 171 } 172 } 173 174 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 175 uint64_t value) 176 { 177 assert(ri->fieldoffset); 178 if (cpreg_field_is_64bit(ri)) { 179 CPREG_FIELD64(env, ri) = value; 180 } else { 181 CPREG_FIELD32(env, ri) = value; 182 } 183 } 184 185 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 186 { 187 return (char *)env + ri->fieldoffset; 188 } 189 190 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 191 { 192 /* Raw read of a coprocessor register (as needed for migration, etc). */ 193 if (ri->type & ARM_CP_CONST) { 194 return ri->resetvalue; 195 } else if (ri->raw_readfn) { 196 return ri->raw_readfn(env, ri); 197 } else if (ri->readfn) { 198 return ri->readfn(env, ri); 199 } else { 200 return raw_read(env, ri); 201 } 202 } 203 204 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 205 uint64_t v) 206 { 207 /* Raw write of a coprocessor register (as needed for migration, etc). 208 * Note that constant registers are treated as write-ignored; the 209 * caller should check for success by whether a readback gives the 210 * value written. 211 */ 212 if (ri->type & ARM_CP_CONST) { 213 return; 214 } else if (ri->raw_writefn) { 215 ri->raw_writefn(env, ri, v); 216 } else if (ri->writefn) { 217 ri->writefn(env, ri, v); 218 } else { 219 raw_write(env, ri, v); 220 } 221 } 222 223 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg) 224 { 225 ARMCPU *cpu = arm_env_get_cpu(env); 226 const ARMCPRegInfo *ri; 227 uint32_t key; 228 229 key = cpu->dyn_xml.cpregs_keys[reg]; 230 ri = get_arm_cp_reginfo(cpu->cp_regs, key); 231 if (ri) { 232 if (cpreg_field_is_64bit(ri)) { 233 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri)); 234 } else { 235 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri)); 236 } 237 } 238 return 0; 239 } 240 241 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg) 242 { 243 return 0; 244 } 245 246 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 247 { 248 /* Return true if the regdef would cause an assertion if you called 249 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 250 * program bug for it not to have the NO_RAW flag). 251 * NB that returning false here doesn't necessarily mean that calling 252 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 253 * read/write access functions which are safe for raw use" from "has 254 * read/write access functions which have side effects but has forgotten 255 * to provide raw access functions". 256 * The tests here line up with the conditions in read/write_raw_cp_reg() 257 * and assertions in raw_read()/raw_write(). 258 */ 259 if ((ri->type & ARM_CP_CONST) || 260 ri->fieldoffset || 261 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 262 return false; 263 } 264 return true; 265 } 266 267 bool write_cpustate_to_list(ARMCPU *cpu) 268 { 269 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 270 int i; 271 bool ok = true; 272 273 for (i = 0; i < cpu->cpreg_array_len; i++) { 274 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 275 const ARMCPRegInfo *ri; 276 277 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 278 if (!ri) { 279 ok = false; 280 continue; 281 } 282 if (ri->type & ARM_CP_NO_RAW) { 283 continue; 284 } 285 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri); 286 } 287 return ok; 288 } 289 290 bool write_list_to_cpustate(ARMCPU *cpu) 291 { 292 int i; 293 bool ok = true; 294 295 for (i = 0; i < cpu->cpreg_array_len; i++) { 296 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 297 uint64_t v = cpu->cpreg_values[i]; 298 const ARMCPRegInfo *ri; 299 300 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 301 if (!ri) { 302 ok = false; 303 continue; 304 } 305 if (ri->type & ARM_CP_NO_RAW) { 306 continue; 307 } 308 /* Write value and confirm it reads back as written 309 * (to catch read-only registers and partially read-only 310 * registers where the incoming migration value doesn't match) 311 */ 312 write_raw_cp_reg(&cpu->env, ri, v); 313 if (read_raw_cp_reg(&cpu->env, ri) != v) { 314 ok = false; 315 } 316 } 317 return ok; 318 } 319 320 static void add_cpreg_to_list(gpointer key, gpointer opaque) 321 { 322 ARMCPU *cpu = opaque; 323 uint64_t regidx; 324 const ARMCPRegInfo *ri; 325 326 regidx = *(uint32_t *)key; 327 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 328 329 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 330 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 331 /* The value array need not be initialized at this point */ 332 cpu->cpreg_array_len++; 333 } 334 } 335 336 static void count_cpreg(gpointer key, gpointer opaque) 337 { 338 ARMCPU *cpu = opaque; 339 uint64_t regidx; 340 const ARMCPRegInfo *ri; 341 342 regidx = *(uint32_t *)key; 343 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 344 345 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 346 cpu->cpreg_array_len++; 347 } 348 } 349 350 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 351 { 352 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a); 353 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b); 354 355 if (aidx > bidx) { 356 return 1; 357 } 358 if (aidx < bidx) { 359 return -1; 360 } 361 return 0; 362 } 363 364 void init_cpreg_list(ARMCPU *cpu) 365 { 366 /* Initialise the cpreg_tuples[] array based on the cp_regs hash. 367 * Note that we require cpreg_tuples[] to be sorted by key ID. 368 */ 369 GList *keys; 370 int arraylen; 371 372 keys = g_hash_table_get_keys(cpu->cp_regs); 373 keys = g_list_sort(keys, cpreg_key_compare); 374 375 cpu->cpreg_array_len = 0; 376 377 g_list_foreach(keys, count_cpreg, cpu); 378 379 arraylen = cpu->cpreg_array_len; 380 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 381 cpu->cpreg_values = g_new(uint64_t, arraylen); 382 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 383 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 384 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 385 cpu->cpreg_array_len = 0; 386 387 g_list_foreach(keys, add_cpreg_to_list, cpu); 388 389 assert(cpu->cpreg_array_len == arraylen); 390 391 g_list_free(keys); 392 } 393 394 /* 395 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but 396 * they are accessible when EL3 is using AArch64 regardless of EL3.NS. 397 * 398 * access_el3_aa32ns: Used to check AArch32 register views. 399 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views. 400 */ 401 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 402 const ARMCPRegInfo *ri, 403 bool isread) 404 { 405 bool secure = arm_is_secure_below_el3(env); 406 407 assert(!arm_el_is_aa64(env, 3)); 408 if (secure) { 409 return CP_ACCESS_TRAP_UNCATEGORIZED; 410 } 411 return CP_ACCESS_OK; 412 } 413 414 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env, 415 const ARMCPRegInfo *ri, 416 bool isread) 417 { 418 if (!arm_el_is_aa64(env, 3)) { 419 return access_el3_aa32ns(env, ri, isread); 420 } 421 return CP_ACCESS_OK; 422 } 423 424 /* Some secure-only AArch32 registers trap to EL3 if used from 425 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 426 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 427 * We assume that the .access field is set to PL1_RW. 428 */ 429 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 430 const ARMCPRegInfo *ri, 431 bool isread) 432 { 433 if (arm_current_el(env) == 3) { 434 return CP_ACCESS_OK; 435 } 436 if (arm_is_secure_below_el3(env)) { 437 return CP_ACCESS_TRAP_EL3; 438 } 439 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 440 return CP_ACCESS_TRAP_UNCATEGORIZED; 441 } 442 443 /* Check for traps to "powerdown debug" registers, which are controlled 444 * by MDCR.TDOSA 445 */ 446 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, 447 bool isread) 448 { 449 int el = arm_current_el(env); 450 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) || 451 (env->cp15.mdcr_el2 & MDCR_TDE) || 452 (arm_hcr_el2_eff(env) & HCR_TGE); 453 454 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) { 455 return CP_ACCESS_TRAP_EL2; 456 } 457 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { 458 return CP_ACCESS_TRAP_EL3; 459 } 460 return CP_ACCESS_OK; 461 } 462 463 /* Check for traps to "debug ROM" registers, which are controlled 464 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. 465 */ 466 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, 467 bool isread) 468 { 469 int el = arm_current_el(env); 470 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) || 471 (env->cp15.mdcr_el2 & MDCR_TDE) || 472 (arm_hcr_el2_eff(env) & HCR_TGE); 473 474 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) { 475 return CP_ACCESS_TRAP_EL2; 476 } 477 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 478 return CP_ACCESS_TRAP_EL3; 479 } 480 return CP_ACCESS_OK; 481 } 482 483 /* Check for traps to general debug registers, which are controlled 484 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. 485 */ 486 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, 487 bool isread) 488 { 489 int el = arm_current_el(env); 490 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) || 491 (env->cp15.mdcr_el2 & MDCR_TDE) || 492 (arm_hcr_el2_eff(env) & HCR_TGE); 493 494 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) { 495 return CP_ACCESS_TRAP_EL2; 496 } 497 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 498 return CP_ACCESS_TRAP_EL3; 499 } 500 return CP_ACCESS_OK; 501 } 502 503 /* Check for traps to performance monitor registers, which are controlled 504 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 505 */ 506 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 507 bool isread) 508 { 509 int el = arm_current_el(env); 510 511 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 512 && !arm_is_secure_below_el3(env)) { 513 return CP_ACCESS_TRAP_EL2; 514 } 515 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 516 return CP_ACCESS_TRAP_EL3; 517 } 518 return CP_ACCESS_OK; 519 } 520 521 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 522 { 523 ARMCPU *cpu = arm_env_get_cpu(env); 524 525 raw_write(env, ri, value); 526 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 527 } 528 529 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 530 { 531 ARMCPU *cpu = arm_env_get_cpu(env); 532 533 if (raw_read(env, ri) != value) { 534 /* Unlike real hardware the qemu TLB uses virtual addresses, 535 * not modified virtual addresses, so this causes a TLB flush. 536 */ 537 tlb_flush(CPU(cpu)); 538 raw_write(env, ri, value); 539 } 540 } 541 542 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 543 uint64_t value) 544 { 545 ARMCPU *cpu = arm_env_get_cpu(env); 546 547 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 548 && !extended_addresses_enabled(env)) { 549 /* For VMSA (when not using the LPAE long descriptor page table 550 * format) this register includes the ASID, so do a TLB flush. 551 * For PMSA it is purely a process ID and no action is needed. 552 */ 553 tlb_flush(CPU(cpu)); 554 } 555 raw_write(env, ri, value); 556 } 557 558 /* IS variants of TLB operations must affect all cores */ 559 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 560 uint64_t value) 561 { 562 CPUState *cs = ENV_GET_CPU(env); 563 564 tlb_flush_all_cpus_synced(cs); 565 } 566 567 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 568 uint64_t value) 569 { 570 CPUState *cs = ENV_GET_CPU(env); 571 572 tlb_flush_all_cpus_synced(cs); 573 } 574 575 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 576 uint64_t value) 577 { 578 CPUState *cs = ENV_GET_CPU(env); 579 580 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 581 } 582 583 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 584 uint64_t value) 585 { 586 CPUState *cs = ENV_GET_CPU(env); 587 588 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 589 } 590 591 /* 592 * Non-IS variants of TLB operations are upgraded to 593 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to 594 * force broadcast of these operations. 595 */ 596 static bool tlb_force_broadcast(CPUARMState *env) 597 { 598 return (env->cp15.hcr_el2 & HCR_FB) && 599 arm_current_el(env) == 1 && arm_is_secure_below_el3(env); 600 } 601 602 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 603 uint64_t value) 604 { 605 /* Invalidate all (TLBIALL) */ 606 ARMCPU *cpu = arm_env_get_cpu(env); 607 608 if (tlb_force_broadcast(env)) { 609 tlbiall_is_write(env, NULL, value); 610 return; 611 } 612 613 tlb_flush(CPU(cpu)); 614 } 615 616 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 617 uint64_t value) 618 { 619 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 620 ARMCPU *cpu = arm_env_get_cpu(env); 621 622 if (tlb_force_broadcast(env)) { 623 tlbimva_is_write(env, NULL, value); 624 return; 625 } 626 627 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 628 } 629 630 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 631 uint64_t value) 632 { 633 /* Invalidate by ASID (TLBIASID) */ 634 ARMCPU *cpu = arm_env_get_cpu(env); 635 636 if (tlb_force_broadcast(env)) { 637 tlbiasid_is_write(env, NULL, value); 638 return; 639 } 640 641 tlb_flush(CPU(cpu)); 642 } 643 644 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 645 uint64_t value) 646 { 647 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 648 ARMCPU *cpu = arm_env_get_cpu(env); 649 650 if (tlb_force_broadcast(env)) { 651 tlbimvaa_is_write(env, NULL, value); 652 return; 653 } 654 655 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK); 656 } 657 658 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 659 uint64_t value) 660 { 661 CPUState *cs = ENV_GET_CPU(env); 662 663 tlb_flush_by_mmuidx(cs, 664 ARMMMUIdxBit_S12NSE1 | 665 ARMMMUIdxBit_S12NSE0 | 666 ARMMMUIdxBit_S2NS); 667 } 668 669 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 670 uint64_t value) 671 { 672 CPUState *cs = ENV_GET_CPU(env); 673 674 tlb_flush_by_mmuidx_all_cpus_synced(cs, 675 ARMMMUIdxBit_S12NSE1 | 676 ARMMMUIdxBit_S12NSE0 | 677 ARMMMUIdxBit_S2NS); 678 } 679 680 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri, 681 uint64_t value) 682 { 683 /* Invalidate by IPA. This has to invalidate any structures that 684 * contain only stage 2 translation information, but does not need 685 * to apply to structures that contain combined stage 1 and stage 2 686 * translation information. 687 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 688 */ 689 CPUState *cs = ENV_GET_CPU(env); 690 uint64_t pageaddr; 691 692 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 693 return; 694 } 695 696 pageaddr = sextract64(value << 12, 0, 40); 697 698 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 699 } 700 701 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 702 uint64_t value) 703 { 704 CPUState *cs = ENV_GET_CPU(env); 705 uint64_t pageaddr; 706 707 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 708 return; 709 } 710 711 pageaddr = sextract64(value << 12, 0, 40); 712 713 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 714 ARMMMUIdxBit_S2NS); 715 } 716 717 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 718 uint64_t value) 719 { 720 CPUState *cs = ENV_GET_CPU(env); 721 722 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 723 } 724 725 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 726 uint64_t value) 727 { 728 CPUState *cs = ENV_GET_CPU(env); 729 730 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 731 } 732 733 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 734 uint64_t value) 735 { 736 CPUState *cs = ENV_GET_CPU(env); 737 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 738 739 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 740 } 741 742 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 743 uint64_t value) 744 { 745 CPUState *cs = ENV_GET_CPU(env); 746 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 747 748 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 749 ARMMMUIdxBit_S1E2); 750 } 751 752 static const ARMCPRegInfo cp_reginfo[] = { 753 /* Define the secure and non-secure FCSE identifier CP registers 754 * separately because there is no secure bank in V8 (no _EL3). This allows 755 * the secure register to be properly reset and migrated. There is also no 756 * v8 EL1 version of the register so the non-secure instance stands alone. 757 */ 758 { .name = "FCSEIDR", 759 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 760 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 761 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 762 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 763 { .name = "FCSEIDR_S", 764 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 765 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 766 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 767 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 768 /* Define the secure and non-secure context identifier CP registers 769 * separately because there is no secure bank in V8 (no _EL3). This allows 770 * the secure register to be properly reset and migrated. In the 771 * non-secure case, the 32-bit register will have reset and migration 772 * disabled during registration as it is handled by the 64-bit instance. 773 */ 774 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 775 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 776 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 777 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 778 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 779 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 780 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 781 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 782 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 783 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 784 REGINFO_SENTINEL 785 }; 786 787 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 788 /* NB: Some of these registers exist in v8 but with more precise 789 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 790 */ 791 /* MMU Domain access control / MPU write buffer control */ 792 { .name = "DACR", 793 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 794 .access = PL1_RW, .resetvalue = 0, 795 .writefn = dacr_write, .raw_writefn = raw_write, 796 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 797 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 798 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 799 * For v6 and v5, these mappings are overly broad. 800 */ 801 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 802 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 803 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 804 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 805 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 806 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 807 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 808 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 809 /* Cache maintenance ops; some of this space may be overridden later. */ 810 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 811 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 812 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 813 REGINFO_SENTINEL 814 }; 815 816 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 817 /* Not all pre-v6 cores implemented this WFI, so this is slightly 818 * over-broad. 819 */ 820 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 821 .access = PL1_W, .type = ARM_CP_WFI }, 822 REGINFO_SENTINEL 823 }; 824 825 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 826 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 827 * is UNPREDICTABLE; we choose to NOP as most implementations do). 828 */ 829 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 830 .access = PL1_W, .type = ARM_CP_WFI }, 831 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice 832 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 833 * OMAPCP will override this space. 834 */ 835 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 836 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 837 .resetvalue = 0 }, 838 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 839 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 840 .resetvalue = 0 }, 841 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 842 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 843 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 844 .resetvalue = 0 }, 845 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 846 * implementing it as RAZ means the "debug architecture version" bits 847 * will read as a reserved value, which should cause Linux to not try 848 * to use the debug hardware. 849 */ 850 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 851 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 852 /* MMU TLB control. Note that the wildcarding means we cover not just 853 * the unified TLB ops but also the dside/iside/inner-shareable variants. 854 */ 855 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 856 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 857 .type = ARM_CP_NO_RAW }, 858 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 859 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 860 .type = ARM_CP_NO_RAW }, 861 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 862 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 863 .type = ARM_CP_NO_RAW }, 864 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 865 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 866 .type = ARM_CP_NO_RAW }, 867 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 868 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 869 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 870 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 871 REGINFO_SENTINEL 872 }; 873 874 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 875 uint64_t value) 876 { 877 uint32_t mask = 0; 878 879 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 880 if (!arm_feature(env, ARM_FEATURE_V8)) { 881 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 882 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 883 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 884 */ 885 if (arm_feature(env, ARM_FEATURE_VFP)) { 886 /* VFP coprocessor: cp10 & cp11 [23:20] */ 887 mask |= (1 << 31) | (1 << 30) | (0xf << 20); 888 889 if (!arm_feature(env, ARM_FEATURE_NEON)) { 890 /* ASEDIS [31] bit is RAO/WI */ 891 value |= (1 << 31); 892 } 893 894 /* VFPv3 and upwards with NEON implement 32 double precision 895 * registers (D0-D31). 896 */ 897 if (!arm_feature(env, ARM_FEATURE_NEON) || 898 !arm_feature(env, ARM_FEATURE_VFP3)) { 899 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 900 value |= (1 << 30); 901 } 902 } 903 value &= mask; 904 } 905 env->cp15.cpacr_el1 = value; 906 } 907 908 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 909 { 910 /* Call cpacr_write() so that we reset with the correct RAO bits set 911 * for our CPU features. 912 */ 913 cpacr_write(env, ri, 0); 914 } 915 916 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 917 bool isread) 918 { 919 if (arm_feature(env, ARM_FEATURE_V8)) { 920 /* Check if CPACR accesses are to be trapped to EL2 */ 921 if (arm_current_el(env) == 1 && 922 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) { 923 return CP_ACCESS_TRAP_EL2; 924 /* Check if CPACR accesses are to be trapped to EL3 */ 925 } else if (arm_current_el(env) < 3 && 926 (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 927 return CP_ACCESS_TRAP_EL3; 928 } 929 } 930 931 return CP_ACCESS_OK; 932 } 933 934 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 935 bool isread) 936 { 937 /* Check if CPTR accesses are set to trap to EL3 */ 938 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 939 return CP_ACCESS_TRAP_EL3; 940 } 941 942 return CP_ACCESS_OK; 943 } 944 945 static const ARMCPRegInfo v6_cp_reginfo[] = { 946 /* prefetch by MVA in v6, NOP in v7 */ 947 { .name = "MVA_prefetch", 948 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 949 .access = PL1_W, .type = ARM_CP_NOP }, 950 /* We need to break the TB after ISB to execute self-modifying code 951 * correctly and also to take any pending interrupts immediately. 952 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 953 */ 954 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 955 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 956 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 957 .access = PL0_W, .type = ARM_CP_NOP }, 958 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 959 .access = PL0_W, .type = ARM_CP_NOP }, 960 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 961 .access = PL1_RW, 962 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 963 offsetof(CPUARMState, cp15.ifar_ns) }, 964 .resetvalue = 0, }, 965 /* Watchpoint Fault Address Register : should actually only be present 966 * for 1136, 1176, 11MPCore. 967 */ 968 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 969 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 970 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 971 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 972 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 973 .resetfn = cpacr_reset, .writefn = cpacr_write }, 974 REGINFO_SENTINEL 975 }; 976 977 /* Definitions for the PMU registers */ 978 #define PMCRN_MASK 0xf800 979 #define PMCRN_SHIFT 11 980 #define PMCRLC 0x40 981 #define PMCRDP 0x10 982 #define PMCRD 0x8 983 #define PMCRC 0x4 984 #define PMCRP 0x2 985 #define PMCRE 0x1 986 987 #define PMXEVTYPER_P 0x80000000 988 #define PMXEVTYPER_U 0x40000000 989 #define PMXEVTYPER_NSK 0x20000000 990 #define PMXEVTYPER_NSU 0x10000000 991 #define PMXEVTYPER_NSH 0x08000000 992 #define PMXEVTYPER_M 0x04000000 993 #define PMXEVTYPER_MT 0x02000000 994 #define PMXEVTYPER_EVTCOUNT 0x0000ffff 995 #define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \ 996 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \ 997 PMXEVTYPER_M | PMXEVTYPER_MT | \ 998 PMXEVTYPER_EVTCOUNT) 999 1000 #define PMCCFILTR 0xf8000000 1001 #define PMCCFILTR_M PMXEVTYPER_M 1002 #define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M) 1003 1004 static inline uint32_t pmu_num_counters(CPUARMState *env) 1005 { 1006 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT; 1007 } 1008 1009 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */ 1010 static inline uint64_t pmu_counter_mask(CPUARMState *env) 1011 { 1012 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1); 1013 } 1014 1015 typedef struct pm_event { 1016 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 1017 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 1018 bool (*supported)(CPUARMState *); 1019 /* 1020 * Retrieve the current count of the underlying event. The programmed 1021 * counters hold a difference from the return value from this function 1022 */ 1023 uint64_t (*get_count)(CPUARMState *); 1024 /* 1025 * Return how many nanoseconds it will take (at a minimum) for count events 1026 * to occur. A negative value indicates the counter will never overflow, or 1027 * that the counter has otherwise arranged for the overflow bit to be set 1028 * and the PMU interrupt to be raised on overflow. 1029 */ 1030 int64_t (*ns_per_count)(uint64_t); 1031 } pm_event; 1032 1033 static bool event_always_supported(CPUARMState *env) 1034 { 1035 return true; 1036 } 1037 1038 static uint64_t swinc_get_count(CPUARMState *env) 1039 { 1040 /* 1041 * SW_INCR events are written directly to the pmevcntr's by writes to 1042 * PMSWINC, so there is no underlying count maintained by the PMU itself 1043 */ 1044 return 0; 1045 } 1046 1047 static int64_t swinc_ns_per(uint64_t ignored) 1048 { 1049 return -1; 1050 } 1051 1052 /* 1053 * Return the underlying cycle count for the PMU cycle counters. If we're in 1054 * usermode, simply return 0. 1055 */ 1056 static uint64_t cycles_get_count(CPUARMState *env) 1057 { 1058 #ifndef CONFIG_USER_ONLY 1059 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1060 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 1061 #else 1062 return cpu_get_host_ticks(); 1063 #endif 1064 } 1065 1066 #ifndef CONFIG_USER_ONLY 1067 static int64_t cycles_ns_per(uint64_t cycles) 1068 { 1069 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 1070 } 1071 1072 static bool instructions_supported(CPUARMState *env) 1073 { 1074 return use_icount == 1 /* Precise instruction counting */; 1075 } 1076 1077 static uint64_t instructions_get_count(CPUARMState *env) 1078 { 1079 return (uint64_t)cpu_get_icount_raw(); 1080 } 1081 1082 static int64_t instructions_ns_per(uint64_t icount) 1083 { 1084 return cpu_icount_to_ns((int64_t)icount); 1085 } 1086 #endif 1087 1088 static const pm_event pm_events[] = { 1089 { .number = 0x000, /* SW_INCR */ 1090 .supported = event_always_supported, 1091 .get_count = swinc_get_count, 1092 .ns_per_count = swinc_ns_per, 1093 }, 1094 #ifndef CONFIG_USER_ONLY 1095 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 1096 .supported = instructions_supported, 1097 .get_count = instructions_get_count, 1098 .ns_per_count = instructions_ns_per, 1099 }, 1100 { .number = 0x011, /* CPU_CYCLES, Cycle */ 1101 .supported = event_always_supported, 1102 .get_count = cycles_get_count, 1103 .ns_per_count = cycles_ns_per, 1104 } 1105 #endif 1106 }; 1107 1108 /* 1109 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1110 * events (i.e. the statistical profiling extension), this implementation 1111 * should first be updated to something sparse instead of the current 1112 * supported_event_map[] array. 1113 */ 1114 #define MAX_EVENT_ID 0x11 1115 #define UNSUPPORTED_EVENT UINT16_MAX 1116 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1117 1118 /* 1119 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 1120 * of ARM event numbers to indices in our pm_events array. 1121 * 1122 * Note: Events in the 0x40XX range are not currently supported. 1123 */ 1124 void pmu_init(ARMCPU *cpu) 1125 { 1126 unsigned int i; 1127 1128 /* 1129 * Empty supported_event_map and cpu->pmceid[01] before adding supported 1130 * events to them 1131 */ 1132 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1133 supported_event_map[i] = UNSUPPORTED_EVENT; 1134 } 1135 cpu->pmceid0 = 0; 1136 cpu->pmceid1 = 0; 1137 1138 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1139 const pm_event *cnt = &pm_events[i]; 1140 assert(cnt->number <= MAX_EVENT_ID); 1141 /* We do not currently support events in the 0x40xx range */ 1142 assert(cnt->number <= 0x3f); 1143 1144 if (cnt->supported(&cpu->env)) { 1145 supported_event_map[cnt->number] = i; 1146 uint64_t event_mask = 1 << (cnt->number & 0x1f); 1147 if (cnt->number & 0x20) { 1148 cpu->pmceid1 |= event_mask; 1149 } else { 1150 cpu->pmceid0 |= event_mask; 1151 } 1152 } 1153 } 1154 } 1155 1156 /* 1157 * Check at runtime whether a PMU event is supported for the current machine 1158 */ 1159 static bool event_supported(uint16_t number) 1160 { 1161 if (number > MAX_EVENT_ID) { 1162 return false; 1163 } 1164 return supported_event_map[number] != UNSUPPORTED_EVENT; 1165 } 1166 1167 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1168 bool isread) 1169 { 1170 /* Performance monitor registers user accessibility is controlled 1171 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1172 * trapping to EL2 or EL3 for other accesses. 1173 */ 1174 int el = arm_current_el(env); 1175 1176 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1177 return CP_ACCESS_TRAP; 1178 } 1179 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 1180 && !arm_is_secure_below_el3(env)) { 1181 return CP_ACCESS_TRAP_EL2; 1182 } 1183 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1184 return CP_ACCESS_TRAP_EL3; 1185 } 1186 1187 return CP_ACCESS_OK; 1188 } 1189 1190 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1191 const ARMCPRegInfo *ri, 1192 bool isread) 1193 { 1194 /* ER: event counter read trap control */ 1195 if (arm_feature(env, ARM_FEATURE_V8) 1196 && arm_current_el(env) == 0 1197 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1198 && isread) { 1199 return CP_ACCESS_OK; 1200 } 1201 1202 return pmreg_access(env, ri, isread); 1203 } 1204 1205 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1206 const ARMCPRegInfo *ri, 1207 bool isread) 1208 { 1209 /* SW: software increment write trap control */ 1210 if (arm_feature(env, ARM_FEATURE_V8) 1211 && arm_current_el(env) == 0 1212 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1213 && !isread) { 1214 return CP_ACCESS_OK; 1215 } 1216 1217 return pmreg_access(env, ri, isread); 1218 } 1219 1220 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1221 const ARMCPRegInfo *ri, 1222 bool isread) 1223 { 1224 /* ER: event counter read trap control */ 1225 if (arm_feature(env, ARM_FEATURE_V8) 1226 && arm_current_el(env) == 0 1227 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1228 return CP_ACCESS_OK; 1229 } 1230 1231 return pmreg_access(env, ri, isread); 1232 } 1233 1234 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1235 const ARMCPRegInfo *ri, 1236 bool isread) 1237 { 1238 /* CR: cycle counter read trap control */ 1239 if (arm_feature(env, ARM_FEATURE_V8) 1240 && arm_current_el(env) == 0 1241 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1242 && isread) { 1243 return CP_ACCESS_OK; 1244 } 1245 1246 return pmreg_access(env, ri, isread); 1247 } 1248 1249 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using 1250 * the current EL, security state, and register configuration. 1251 */ 1252 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1253 { 1254 uint64_t filter; 1255 bool e, p, u, nsk, nsu, nsh, m; 1256 bool enabled, prohibited, filtered; 1257 bool secure = arm_is_secure(env); 1258 int el = arm_current_el(env); 1259 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1260 1261 if (!arm_feature(env, ARM_FEATURE_EL2) || 1262 (counter < hpmn || counter == 31)) { 1263 e = env->cp15.c9_pmcr & PMCRE; 1264 } else { 1265 e = env->cp15.mdcr_el2 & MDCR_HPME; 1266 } 1267 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1268 1269 if (!secure) { 1270 if (el == 2 && (counter < hpmn || counter == 31)) { 1271 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD; 1272 } else { 1273 prohibited = false; 1274 } 1275 } else { 1276 prohibited = arm_feature(env, ARM_FEATURE_EL3) && 1277 (env->cp15.mdcr_el3 & MDCR_SPME); 1278 } 1279 1280 if (prohibited && counter == 31) { 1281 prohibited = env->cp15.c9_pmcr & PMCRDP; 1282 } 1283 1284 if (counter == 31) { 1285 filter = env->cp15.pmccfiltr_el0; 1286 } else { 1287 filter = env->cp15.c14_pmevtyper[counter]; 1288 } 1289 1290 p = filter & PMXEVTYPER_P; 1291 u = filter & PMXEVTYPER_U; 1292 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1293 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1294 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1295 m = arm_el_is_aa64(env, 1) && 1296 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1297 1298 if (el == 0) { 1299 filtered = secure ? u : u != nsu; 1300 } else if (el == 1) { 1301 filtered = secure ? p : p != nsk; 1302 } else if (el == 2) { 1303 filtered = !nsh; 1304 } else { /* EL3 */ 1305 filtered = m != p; 1306 } 1307 1308 if (counter != 31) { 1309 /* 1310 * If not checking PMCCNTR, ensure the counter is setup to an event we 1311 * support 1312 */ 1313 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1314 if (!event_supported(event)) { 1315 return false; 1316 } 1317 } 1318 1319 return enabled && !prohibited && !filtered; 1320 } 1321 1322 static void pmu_update_irq(CPUARMState *env) 1323 { 1324 ARMCPU *cpu = arm_env_get_cpu(env); 1325 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1326 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1327 } 1328 1329 /* 1330 * Ensure c15_ccnt is the guest-visible count so that operations such as 1331 * enabling/disabling the counter or filtering, modifying the count itself, 1332 * etc. can be done logically. This is essentially a no-op if the counter is 1333 * not enabled at the time of the call. 1334 */ 1335 void pmccntr_op_start(CPUARMState *env) 1336 { 1337 uint64_t cycles = cycles_get_count(env); 1338 1339 if (pmu_counter_enabled(env, 31)) { 1340 uint64_t eff_cycles = cycles; 1341 if (env->cp15.c9_pmcr & PMCRD) { 1342 /* Increment once every 64 processor clock cycles */ 1343 eff_cycles /= 64; 1344 } 1345 1346 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1347 1348 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1349 1ull << 63 : 1ull << 31; 1350 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1351 env->cp15.c9_pmovsr |= (1 << 31); 1352 pmu_update_irq(env); 1353 } 1354 1355 env->cp15.c15_ccnt = new_pmccntr; 1356 } 1357 env->cp15.c15_ccnt_delta = cycles; 1358 } 1359 1360 /* 1361 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1362 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1363 * pmccntr_op_start. 1364 */ 1365 void pmccntr_op_finish(CPUARMState *env) 1366 { 1367 if (pmu_counter_enabled(env, 31)) { 1368 #ifndef CONFIG_USER_ONLY 1369 /* Calculate when the counter will next overflow */ 1370 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1371 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1372 remaining_cycles = (uint32_t)remaining_cycles; 1373 } 1374 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1375 1376 if (overflow_in > 0) { 1377 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1378 overflow_in; 1379 ARMCPU *cpu = arm_env_get_cpu(env); 1380 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1381 } 1382 #endif 1383 1384 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1385 if (env->cp15.c9_pmcr & PMCRD) { 1386 /* Increment once every 64 processor clock cycles */ 1387 prev_cycles /= 64; 1388 } 1389 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1390 } 1391 } 1392 1393 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1394 { 1395 1396 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1397 uint64_t count = 0; 1398 if (event_supported(event)) { 1399 uint16_t event_idx = supported_event_map[event]; 1400 count = pm_events[event_idx].get_count(env); 1401 } 1402 1403 if (pmu_counter_enabled(env, counter)) { 1404 uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1405 1406 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) { 1407 env->cp15.c9_pmovsr |= (1 << counter); 1408 pmu_update_irq(env); 1409 } 1410 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1411 } 1412 env->cp15.c14_pmevcntr_delta[counter] = count; 1413 } 1414 1415 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1416 { 1417 if (pmu_counter_enabled(env, counter)) { 1418 #ifndef CONFIG_USER_ONLY 1419 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1420 uint16_t event_idx = supported_event_map[event]; 1421 uint64_t delta = UINT32_MAX - 1422 (uint32_t)env->cp15.c14_pmevcntr[counter] + 1; 1423 int64_t overflow_in = pm_events[event_idx].ns_per_count(delta); 1424 1425 if (overflow_in > 0) { 1426 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1427 overflow_in; 1428 ARMCPU *cpu = arm_env_get_cpu(env); 1429 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1430 } 1431 #endif 1432 1433 env->cp15.c14_pmevcntr_delta[counter] -= 1434 env->cp15.c14_pmevcntr[counter]; 1435 } 1436 } 1437 1438 void pmu_op_start(CPUARMState *env) 1439 { 1440 unsigned int i; 1441 pmccntr_op_start(env); 1442 for (i = 0; i < pmu_num_counters(env); i++) { 1443 pmevcntr_op_start(env, i); 1444 } 1445 } 1446 1447 void pmu_op_finish(CPUARMState *env) 1448 { 1449 unsigned int i; 1450 pmccntr_op_finish(env); 1451 for (i = 0; i < pmu_num_counters(env); i++) { 1452 pmevcntr_op_finish(env, i); 1453 } 1454 } 1455 1456 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1457 { 1458 pmu_op_start(&cpu->env); 1459 } 1460 1461 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1462 { 1463 pmu_op_finish(&cpu->env); 1464 } 1465 1466 void arm_pmu_timer_cb(void *opaque) 1467 { 1468 ARMCPU *cpu = opaque; 1469 1470 /* 1471 * Update all the counter values based on the current underlying counts, 1472 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1473 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1474 * counter may expire. 1475 */ 1476 pmu_op_start(&cpu->env); 1477 pmu_op_finish(&cpu->env); 1478 } 1479 1480 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1481 uint64_t value) 1482 { 1483 pmu_op_start(env); 1484 1485 if (value & PMCRC) { 1486 /* The counter has been reset */ 1487 env->cp15.c15_ccnt = 0; 1488 } 1489 1490 if (value & PMCRP) { 1491 unsigned int i; 1492 for (i = 0; i < pmu_num_counters(env); i++) { 1493 env->cp15.c14_pmevcntr[i] = 0; 1494 } 1495 } 1496 1497 /* only the DP, X, D and E bits are writable */ 1498 env->cp15.c9_pmcr &= ~0x39; 1499 env->cp15.c9_pmcr |= (value & 0x39); 1500 1501 pmu_op_finish(env); 1502 } 1503 1504 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1505 uint64_t value) 1506 { 1507 unsigned int i; 1508 for (i = 0; i < pmu_num_counters(env); i++) { 1509 /* Increment a counter's count iff: */ 1510 if ((value & (1 << i)) && /* counter's bit is set */ 1511 /* counter is enabled and not filtered */ 1512 pmu_counter_enabled(env, i) && 1513 /* counter is SW_INCR */ 1514 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1515 pmevcntr_op_start(env, i); 1516 1517 /* 1518 * Detect if this write causes an overflow since we can't predict 1519 * PMSWINC overflows like we can for other events 1520 */ 1521 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1522 1523 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) { 1524 env->cp15.c9_pmovsr |= (1 << i); 1525 pmu_update_irq(env); 1526 } 1527 1528 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1529 1530 pmevcntr_op_finish(env, i); 1531 } 1532 } 1533 } 1534 1535 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1536 { 1537 uint64_t ret; 1538 pmccntr_op_start(env); 1539 ret = env->cp15.c15_ccnt; 1540 pmccntr_op_finish(env); 1541 return ret; 1542 } 1543 1544 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1545 uint64_t value) 1546 { 1547 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1548 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1549 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1550 * accessed. 1551 */ 1552 env->cp15.c9_pmselr = value & 0x1f; 1553 } 1554 1555 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1556 uint64_t value) 1557 { 1558 pmccntr_op_start(env); 1559 env->cp15.c15_ccnt = value; 1560 pmccntr_op_finish(env); 1561 } 1562 1563 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1564 uint64_t value) 1565 { 1566 uint64_t cur_val = pmccntr_read(env, NULL); 1567 1568 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1569 } 1570 1571 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1572 uint64_t value) 1573 { 1574 pmccntr_op_start(env); 1575 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1576 pmccntr_op_finish(env); 1577 } 1578 1579 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1580 uint64_t value) 1581 { 1582 pmccntr_op_start(env); 1583 /* M is not accessible from AArch32 */ 1584 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1585 (value & PMCCFILTR); 1586 pmccntr_op_finish(env); 1587 } 1588 1589 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1590 { 1591 /* M is not visible in AArch32 */ 1592 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1593 } 1594 1595 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1596 uint64_t value) 1597 { 1598 value &= pmu_counter_mask(env); 1599 env->cp15.c9_pmcnten |= value; 1600 } 1601 1602 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1603 uint64_t value) 1604 { 1605 value &= pmu_counter_mask(env); 1606 env->cp15.c9_pmcnten &= ~value; 1607 } 1608 1609 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1610 uint64_t value) 1611 { 1612 value &= pmu_counter_mask(env); 1613 env->cp15.c9_pmovsr &= ~value; 1614 pmu_update_irq(env); 1615 } 1616 1617 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1618 uint64_t value) 1619 { 1620 value &= pmu_counter_mask(env); 1621 env->cp15.c9_pmovsr |= value; 1622 pmu_update_irq(env); 1623 } 1624 1625 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1626 uint64_t value, const uint8_t counter) 1627 { 1628 if (counter == 31) { 1629 pmccfiltr_write(env, ri, value); 1630 } else if (counter < pmu_num_counters(env)) { 1631 pmevcntr_op_start(env, counter); 1632 1633 /* 1634 * If this counter's event type is changing, store the current 1635 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1636 * pmevcntr_op_finish has the correct baseline when it converts back to 1637 * a delta. 1638 */ 1639 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1640 PMXEVTYPER_EVTCOUNT; 1641 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1642 if (old_event != new_event) { 1643 uint64_t count = 0; 1644 if (event_supported(new_event)) { 1645 uint16_t event_idx = supported_event_map[new_event]; 1646 count = pm_events[event_idx].get_count(env); 1647 } 1648 env->cp15.c14_pmevcntr_delta[counter] = count; 1649 } 1650 1651 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1652 pmevcntr_op_finish(env, counter); 1653 } 1654 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1655 * PMSELR value is equal to or greater than the number of implemented 1656 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1657 */ 1658 } 1659 1660 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1661 const uint8_t counter) 1662 { 1663 if (counter == 31) { 1664 return env->cp15.pmccfiltr_el0; 1665 } else if (counter < pmu_num_counters(env)) { 1666 return env->cp15.c14_pmevtyper[counter]; 1667 } else { 1668 /* 1669 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1670 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1671 */ 1672 return 0; 1673 } 1674 } 1675 1676 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1677 uint64_t value) 1678 { 1679 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1680 pmevtyper_write(env, ri, value, counter); 1681 } 1682 1683 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1684 uint64_t value) 1685 { 1686 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1687 env->cp15.c14_pmevtyper[counter] = value; 1688 1689 /* 1690 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1691 * pmu_op_finish calls when loading saved state for a migration. Because 1692 * we're potentially updating the type of event here, the value written to 1693 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a 1694 * different counter type. Therefore, we need to set this value to the 1695 * current count for the counter type we're writing so that pmu_op_finish 1696 * has the correct count for its calculation. 1697 */ 1698 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1699 if (event_supported(event)) { 1700 uint16_t event_idx = supported_event_map[event]; 1701 env->cp15.c14_pmevcntr_delta[counter] = 1702 pm_events[event_idx].get_count(env); 1703 } 1704 } 1705 1706 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1707 { 1708 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1709 return pmevtyper_read(env, ri, counter); 1710 } 1711 1712 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1713 uint64_t value) 1714 { 1715 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1716 } 1717 1718 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1719 { 1720 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1721 } 1722 1723 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1724 uint64_t value, uint8_t counter) 1725 { 1726 if (counter < pmu_num_counters(env)) { 1727 pmevcntr_op_start(env, counter); 1728 env->cp15.c14_pmevcntr[counter] = value; 1729 pmevcntr_op_finish(env, counter); 1730 } 1731 /* 1732 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1733 * are CONSTRAINED UNPREDICTABLE. 1734 */ 1735 } 1736 1737 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1738 uint8_t counter) 1739 { 1740 if (counter < pmu_num_counters(env)) { 1741 uint64_t ret; 1742 pmevcntr_op_start(env, counter); 1743 ret = env->cp15.c14_pmevcntr[counter]; 1744 pmevcntr_op_finish(env, counter); 1745 return ret; 1746 } else { 1747 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1748 * are CONSTRAINED UNPREDICTABLE. */ 1749 return 0; 1750 } 1751 } 1752 1753 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1754 uint64_t value) 1755 { 1756 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1757 pmevcntr_write(env, ri, value, counter); 1758 } 1759 1760 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1761 { 1762 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1763 return pmevcntr_read(env, ri, counter); 1764 } 1765 1766 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1767 uint64_t value) 1768 { 1769 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1770 assert(counter < pmu_num_counters(env)); 1771 env->cp15.c14_pmevcntr[counter] = value; 1772 pmevcntr_write(env, ri, value, counter); 1773 } 1774 1775 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1776 { 1777 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1778 assert(counter < pmu_num_counters(env)); 1779 return env->cp15.c14_pmevcntr[counter]; 1780 } 1781 1782 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1783 uint64_t value) 1784 { 1785 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1786 } 1787 1788 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1789 { 1790 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1791 } 1792 1793 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1794 uint64_t value) 1795 { 1796 if (arm_feature(env, ARM_FEATURE_V8)) { 1797 env->cp15.c9_pmuserenr = value & 0xf; 1798 } else { 1799 env->cp15.c9_pmuserenr = value & 1; 1800 } 1801 } 1802 1803 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1804 uint64_t value) 1805 { 1806 /* We have no event counters so only the C bit can be changed */ 1807 value &= pmu_counter_mask(env); 1808 env->cp15.c9_pminten |= value; 1809 pmu_update_irq(env); 1810 } 1811 1812 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1813 uint64_t value) 1814 { 1815 value &= pmu_counter_mask(env); 1816 env->cp15.c9_pminten &= ~value; 1817 pmu_update_irq(env); 1818 } 1819 1820 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1821 uint64_t value) 1822 { 1823 /* Note that even though the AArch64 view of this register has bits 1824 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1825 * architectural requirements for bits which are RES0 only in some 1826 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1827 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1828 */ 1829 raw_write(env, ri, value & ~0x1FULL); 1830 } 1831 1832 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1833 { 1834 /* Begin with base v8.0 state. */ 1835 uint32_t valid_mask = 0x3fff; 1836 ARMCPU *cpu = arm_env_get_cpu(env); 1837 1838 if (arm_el_is_aa64(env, 3)) { 1839 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */ 1840 valid_mask &= ~SCR_NET; 1841 } else { 1842 valid_mask &= ~(SCR_RW | SCR_ST); 1843 } 1844 1845 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1846 valid_mask &= ~SCR_HCE; 1847 1848 /* On ARMv7, SMD (or SCD as it is called in v7) is only 1849 * supported if EL2 exists. The bit is UNK/SBZP when 1850 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1851 * when EL2 is unavailable. 1852 * On ARMv8, this bit is always available. 1853 */ 1854 if (arm_feature(env, ARM_FEATURE_V7) && 1855 !arm_feature(env, ARM_FEATURE_V8)) { 1856 valid_mask &= ~SCR_SMD; 1857 } 1858 } 1859 if (cpu_isar_feature(aa64_lor, cpu)) { 1860 valid_mask |= SCR_TLOR; 1861 } 1862 if (cpu_isar_feature(aa64_pauth, cpu)) { 1863 valid_mask |= SCR_API | SCR_APK; 1864 } 1865 1866 /* Clear all-context RES0 bits. */ 1867 value &= valid_mask; 1868 raw_write(env, ri, value); 1869 } 1870 1871 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1872 { 1873 ARMCPU *cpu = arm_env_get_cpu(env); 1874 1875 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR 1876 * bank 1877 */ 1878 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1879 ri->secure & ARM_CP_SECSTATE_S); 1880 1881 return cpu->ccsidr[index]; 1882 } 1883 1884 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1885 uint64_t value) 1886 { 1887 raw_write(env, ri, value & 0xf); 1888 } 1889 1890 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1891 { 1892 CPUState *cs = ENV_GET_CPU(env); 1893 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 1894 uint64_t ret = 0; 1895 1896 if (hcr_el2 & HCR_IMO) { 1897 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1898 ret |= CPSR_I; 1899 } 1900 } else { 1901 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1902 ret |= CPSR_I; 1903 } 1904 } 1905 1906 if (hcr_el2 & HCR_FMO) { 1907 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1908 ret |= CPSR_F; 1909 } 1910 } else { 1911 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1912 ret |= CPSR_F; 1913 } 1914 } 1915 1916 /* External aborts are not possible in QEMU so A bit is always clear */ 1917 return ret; 1918 } 1919 1920 static const ARMCPRegInfo v7_cp_reginfo[] = { 1921 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 1922 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 1923 .access = PL1_W, .type = ARM_CP_NOP }, 1924 /* Performance monitors are implementation defined in v7, 1925 * but with an ARM recommended set of registers, which we 1926 * follow. 1927 * 1928 * Performance registers fall into three categories: 1929 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 1930 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 1931 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 1932 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 1933 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 1934 */ 1935 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 1936 .access = PL0_RW, .type = ARM_CP_ALIAS, 1937 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1938 .writefn = pmcntenset_write, 1939 .accessfn = pmreg_access, 1940 .raw_writefn = raw_write }, 1941 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, 1942 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 1943 .access = PL0_RW, .accessfn = pmreg_access, 1944 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 1945 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 1946 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 1947 .access = PL0_RW, 1948 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1949 .accessfn = pmreg_access, 1950 .writefn = pmcntenclr_write, 1951 .type = ARM_CP_ALIAS }, 1952 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 1953 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 1954 .access = PL0_RW, .accessfn = pmreg_access, 1955 .type = ARM_CP_ALIAS, 1956 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 1957 .writefn = pmcntenclr_write }, 1958 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 1959 .access = PL0_RW, .type = ARM_CP_IO, 1960 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 1961 .accessfn = pmreg_access, 1962 .writefn = pmovsr_write, 1963 .raw_writefn = raw_write }, 1964 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 1965 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 1966 .access = PL0_RW, .accessfn = pmreg_access, 1967 .type = ARM_CP_ALIAS | ARM_CP_IO, 1968 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 1969 .writefn = pmovsr_write, 1970 .raw_writefn = raw_write }, 1971 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 1972 .access = PL0_W, .accessfn = pmreg_access_swinc, 1973 .type = ARM_CP_NO_RAW | ARM_CP_IO, 1974 .writefn = pmswinc_write }, 1975 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 1976 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 1977 .access = PL0_W, .accessfn = pmreg_access_swinc, 1978 .type = ARM_CP_NO_RAW | ARM_CP_IO, 1979 .writefn = pmswinc_write }, 1980 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 1981 .access = PL0_RW, .type = ARM_CP_ALIAS, 1982 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 1983 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 1984 .raw_writefn = raw_write}, 1985 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 1986 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 1987 .access = PL0_RW, .accessfn = pmreg_access_selr, 1988 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 1989 .writefn = pmselr_write, .raw_writefn = raw_write, }, 1990 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 1991 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 1992 .readfn = pmccntr_read, .writefn = pmccntr_write32, 1993 .accessfn = pmreg_access_ccntr }, 1994 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 1995 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 1996 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 1997 .type = ARM_CP_IO, 1998 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 1999 .readfn = pmccntr_read, .writefn = pmccntr_write, 2000 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 2001 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 2002 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 2003 .access = PL0_RW, .accessfn = pmreg_access, 2004 .type = ARM_CP_ALIAS | ARM_CP_IO, 2005 .resetvalue = 0, }, 2006 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 2007 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 2008 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 2009 .access = PL0_RW, .accessfn = pmreg_access, 2010 .type = ARM_CP_IO, 2011 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 2012 .resetvalue = 0, }, 2013 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 2014 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2015 .accessfn = pmreg_access, 2016 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2017 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 2018 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 2019 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2020 .accessfn = pmreg_access, 2021 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2022 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 2023 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2024 .accessfn = pmreg_access_xevcntr, 2025 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2026 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 2027 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 2028 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2029 .accessfn = pmreg_access_xevcntr, 2030 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2031 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2032 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2033 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2034 .resetvalue = 0, 2035 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2036 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2037 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2038 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2039 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2040 .resetvalue = 0, 2041 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2042 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2043 .access = PL1_RW, .accessfn = access_tpm, 2044 .type = ARM_CP_ALIAS | ARM_CP_IO, 2045 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2046 .resetvalue = 0, 2047 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2048 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2049 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2050 .access = PL1_RW, .accessfn = access_tpm, 2051 .type = ARM_CP_IO, 2052 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2053 .writefn = pmintenset_write, .raw_writefn = raw_write, 2054 .resetvalue = 0x0 }, 2055 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2056 .access = PL1_RW, .accessfn = access_tpm, 2057 .type = ARM_CP_ALIAS | ARM_CP_IO, 2058 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2059 .writefn = pmintenclr_write, }, 2060 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2061 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2062 .access = PL1_RW, .accessfn = access_tpm, 2063 .type = ARM_CP_ALIAS | ARM_CP_IO, 2064 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2065 .writefn = pmintenclr_write }, 2066 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2067 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2068 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2069 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2070 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2071 .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0, 2072 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2073 offsetof(CPUARMState, cp15.csselr_ns) } }, 2074 /* Auxiliary ID register: this actually has an IMPDEF value but for now 2075 * just RAZ for all cores: 2076 */ 2077 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2078 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2079 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 2080 /* Auxiliary fault status registers: these also are IMPDEF, and we 2081 * choose to RAZ/WI for all cores. 2082 */ 2083 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2084 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2085 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2086 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2087 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2088 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2089 /* MAIR can just read-as-written because we don't implement caches 2090 * and so don't need to care about memory attributes. 2091 */ 2092 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2093 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2094 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2095 .resetvalue = 0 }, 2096 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2097 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2098 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2099 .resetvalue = 0 }, 2100 /* For non-long-descriptor page tables these are PRRR and NMRR; 2101 * regardless they still act as reads-as-written for QEMU. 2102 */ 2103 /* MAIR0/1 are defined separately from their 64-bit counterpart which 2104 * allows them to assign the correct fieldoffset based on the endianness 2105 * handled in the field definitions. 2106 */ 2107 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2108 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW, 2109 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2110 offsetof(CPUARMState, cp15.mair0_ns) }, 2111 .resetfn = arm_cp_reset_ignore }, 2112 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2113 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW, 2114 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2115 offsetof(CPUARMState, cp15.mair1_ns) }, 2116 .resetfn = arm_cp_reset_ignore }, 2117 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2118 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2119 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2120 /* 32 bit ITLB invalidates */ 2121 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2122 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2123 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2124 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2125 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2126 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2127 /* 32 bit DTLB invalidates */ 2128 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2129 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2130 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2131 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2132 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2133 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2134 /* 32 bit TLB invalidates */ 2135 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2136 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2137 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2138 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2139 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2140 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2141 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2142 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 2143 REGINFO_SENTINEL 2144 }; 2145 2146 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2147 /* 32 bit TLB invalidates, Inner Shareable */ 2148 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2149 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write }, 2150 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2151 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 2152 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2153 .type = ARM_CP_NO_RAW, .access = PL1_W, 2154 .writefn = tlbiasid_is_write }, 2155 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2156 .type = ARM_CP_NO_RAW, .access = PL1_W, 2157 .writefn = tlbimvaa_is_write }, 2158 REGINFO_SENTINEL 2159 }; 2160 2161 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2162 /* PMOVSSET is not implemented in v7 before v7ve */ 2163 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2164 .access = PL0_RW, .accessfn = pmreg_access, 2165 .type = ARM_CP_ALIAS | ARM_CP_IO, 2166 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2167 .writefn = pmovsset_write, 2168 .raw_writefn = raw_write }, 2169 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2170 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2171 .access = PL0_RW, .accessfn = pmreg_access, 2172 .type = ARM_CP_ALIAS | ARM_CP_IO, 2173 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2174 .writefn = pmovsset_write, 2175 .raw_writefn = raw_write }, 2176 REGINFO_SENTINEL 2177 }; 2178 2179 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2180 uint64_t value) 2181 { 2182 value &= 1; 2183 env->teecr = value; 2184 } 2185 2186 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2187 bool isread) 2188 { 2189 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2190 return CP_ACCESS_TRAP; 2191 } 2192 return CP_ACCESS_OK; 2193 } 2194 2195 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2196 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2197 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2198 .resetvalue = 0, 2199 .writefn = teecr_write }, 2200 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2201 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2202 .accessfn = teehbr_access, .resetvalue = 0 }, 2203 REGINFO_SENTINEL 2204 }; 2205 2206 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2207 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2208 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2209 .access = PL0_RW, 2210 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2211 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2212 .access = PL0_RW, 2213 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2214 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2215 .resetfn = arm_cp_reset_ignore }, 2216 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2217 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2218 .access = PL0_R|PL1_W, 2219 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2220 .resetvalue = 0}, 2221 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2222 .access = PL0_R|PL1_W, 2223 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2224 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2225 .resetfn = arm_cp_reset_ignore }, 2226 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2227 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2228 .access = PL1_RW, 2229 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2230 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2231 .access = PL1_RW, 2232 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2233 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2234 .resetvalue = 0 }, 2235 REGINFO_SENTINEL 2236 }; 2237 2238 #ifndef CONFIG_USER_ONLY 2239 2240 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2241 bool isread) 2242 { 2243 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2244 * Writable only at the highest implemented exception level. 2245 */ 2246 int el = arm_current_el(env); 2247 2248 switch (el) { 2249 case 0: 2250 if (!extract32(env->cp15.c14_cntkctl, 0, 2)) { 2251 return CP_ACCESS_TRAP; 2252 } 2253 break; 2254 case 1: 2255 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2256 arm_is_secure_below_el3(env)) { 2257 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2258 return CP_ACCESS_TRAP_UNCATEGORIZED; 2259 } 2260 break; 2261 case 2: 2262 case 3: 2263 break; 2264 } 2265 2266 if (!isread && el < arm_highest_el(env)) { 2267 return CP_ACCESS_TRAP_UNCATEGORIZED; 2268 } 2269 2270 return CP_ACCESS_OK; 2271 } 2272 2273 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2274 bool isread) 2275 { 2276 unsigned int cur_el = arm_current_el(env); 2277 bool secure = arm_is_secure(env); 2278 2279 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */ 2280 if (cur_el == 0 && 2281 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2282 return CP_ACCESS_TRAP; 2283 } 2284 2285 if (arm_feature(env, ARM_FEATURE_EL2) && 2286 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2287 !extract32(env->cp15.cnthctl_el2, 0, 1)) { 2288 return CP_ACCESS_TRAP_EL2; 2289 } 2290 return CP_ACCESS_OK; 2291 } 2292 2293 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2294 bool isread) 2295 { 2296 unsigned int cur_el = arm_current_el(env); 2297 bool secure = arm_is_secure(env); 2298 2299 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if 2300 * EL0[PV]TEN is zero. 2301 */ 2302 if (cur_el == 0 && 2303 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2304 return CP_ACCESS_TRAP; 2305 } 2306 2307 if (arm_feature(env, ARM_FEATURE_EL2) && 2308 timeridx == GTIMER_PHYS && !secure && cur_el < 2 && 2309 !extract32(env->cp15.cnthctl_el2, 1, 1)) { 2310 return CP_ACCESS_TRAP_EL2; 2311 } 2312 return CP_ACCESS_OK; 2313 } 2314 2315 static CPAccessResult gt_pct_access(CPUARMState *env, 2316 const ARMCPRegInfo *ri, 2317 bool isread) 2318 { 2319 return gt_counter_access(env, GTIMER_PHYS, isread); 2320 } 2321 2322 static CPAccessResult gt_vct_access(CPUARMState *env, 2323 const ARMCPRegInfo *ri, 2324 bool isread) 2325 { 2326 return gt_counter_access(env, GTIMER_VIRT, isread); 2327 } 2328 2329 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2330 bool isread) 2331 { 2332 return gt_timer_access(env, GTIMER_PHYS, isread); 2333 } 2334 2335 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2336 bool isread) 2337 { 2338 return gt_timer_access(env, GTIMER_VIRT, isread); 2339 } 2340 2341 static CPAccessResult gt_stimer_access(CPUARMState *env, 2342 const ARMCPRegInfo *ri, 2343 bool isread) 2344 { 2345 /* The AArch64 register view of the secure physical timer is 2346 * always accessible from EL3, and configurably accessible from 2347 * Secure EL1. 2348 */ 2349 switch (arm_current_el(env)) { 2350 case 1: 2351 if (!arm_is_secure(env)) { 2352 return CP_ACCESS_TRAP; 2353 } 2354 if (!(env->cp15.scr_el3 & SCR_ST)) { 2355 return CP_ACCESS_TRAP_EL3; 2356 } 2357 return CP_ACCESS_OK; 2358 case 0: 2359 case 2: 2360 return CP_ACCESS_TRAP; 2361 case 3: 2362 return CP_ACCESS_OK; 2363 default: 2364 g_assert_not_reached(); 2365 } 2366 } 2367 2368 static uint64_t gt_get_countervalue(CPUARMState *env) 2369 { 2370 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE; 2371 } 2372 2373 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2374 { 2375 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2376 2377 if (gt->ctl & 1) { 2378 /* Timer enabled: calculate and set current ISTATUS, irq, and 2379 * reset timer to when ISTATUS next has to change 2380 */ 2381 uint64_t offset = timeridx == GTIMER_VIRT ? 2382 cpu->env.cp15.cntvoff_el2 : 0; 2383 uint64_t count = gt_get_countervalue(&cpu->env); 2384 /* Note that this must be unsigned 64 bit arithmetic: */ 2385 int istatus = count - offset >= gt->cval; 2386 uint64_t nexttick; 2387 int irqstate; 2388 2389 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2390 2391 irqstate = (istatus && !(gt->ctl & 2)); 2392 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2393 2394 if (istatus) { 2395 /* Next transition is when count rolls back over to zero */ 2396 nexttick = UINT64_MAX; 2397 } else { 2398 /* Next transition is when we hit cval */ 2399 nexttick = gt->cval + offset; 2400 } 2401 /* Note that the desired next expiry time might be beyond the 2402 * signed-64-bit range of a QEMUTimer -- in this case we just 2403 * set the timer for as far in the future as possible. When the 2404 * timer expires we will reset the timer for any remaining period. 2405 */ 2406 if (nexttick > INT64_MAX / GTIMER_SCALE) { 2407 nexttick = INT64_MAX / GTIMER_SCALE; 2408 } 2409 timer_mod(cpu->gt_timer[timeridx], nexttick); 2410 trace_arm_gt_recalc(timeridx, irqstate, nexttick); 2411 } else { 2412 /* Timer disabled: ISTATUS and timer output always clear */ 2413 gt->ctl &= ~4; 2414 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0); 2415 timer_del(cpu->gt_timer[timeridx]); 2416 trace_arm_gt_recalc_disabled(timeridx); 2417 } 2418 } 2419 2420 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2421 int timeridx) 2422 { 2423 ARMCPU *cpu = arm_env_get_cpu(env); 2424 2425 timer_del(cpu->gt_timer[timeridx]); 2426 } 2427 2428 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2429 { 2430 return gt_get_countervalue(env); 2431 } 2432 2433 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2434 { 2435 return gt_get_countervalue(env) - env->cp15.cntvoff_el2; 2436 } 2437 2438 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2439 int timeridx, 2440 uint64_t value) 2441 { 2442 trace_arm_gt_cval_write(timeridx, value); 2443 env->cp15.c14_timer[timeridx].cval = value; 2444 gt_recalc_timer(arm_env_get_cpu(env), timeridx); 2445 } 2446 2447 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2448 int timeridx) 2449 { 2450 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2451 2452 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2453 (gt_get_countervalue(env) - offset)); 2454 } 2455 2456 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2457 int timeridx, 2458 uint64_t value) 2459 { 2460 uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0; 2461 2462 trace_arm_gt_tval_write(timeridx, value); 2463 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2464 sextract64(value, 0, 32); 2465 gt_recalc_timer(arm_env_get_cpu(env), timeridx); 2466 } 2467 2468 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2469 int timeridx, 2470 uint64_t value) 2471 { 2472 ARMCPU *cpu = arm_env_get_cpu(env); 2473 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2474 2475 trace_arm_gt_ctl_write(timeridx, value); 2476 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2477 if ((oldval ^ value) & 1) { 2478 /* Enable toggled */ 2479 gt_recalc_timer(cpu, timeridx); 2480 } else if ((oldval ^ value) & 2) { 2481 /* IMASK toggled: don't need to recalculate, 2482 * just set the interrupt line based on ISTATUS 2483 */ 2484 int irqstate = (oldval & 4) && !(value & 2); 2485 2486 trace_arm_gt_imask_toggle(timeridx, irqstate); 2487 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2488 } 2489 } 2490 2491 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2492 { 2493 gt_timer_reset(env, ri, GTIMER_PHYS); 2494 } 2495 2496 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2497 uint64_t value) 2498 { 2499 gt_cval_write(env, ri, GTIMER_PHYS, value); 2500 } 2501 2502 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2503 { 2504 return gt_tval_read(env, ri, GTIMER_PHYS); 2505 } 2506 2507 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2508 uint64_t value) 2509 { 2510 gt_tval_write(env, ri, GTIMER_PHYS, value); 2511 } 2512 2513 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2514 uint64_t value) 2515 { 2516 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2517 } 2518 2519 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2520 { 2521 gt_timer_reset(env, ri, GTIMER_VIRT); 2522 } 2523 2524 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2525 uint64_t value) 2526 { 2527 gt_cval_write(env, ri, GTIMER_VIRT, value); 2528 } 2529 2530 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2531 { 2532 return gt_tval_read(env, ri, GTIMER_VIRT); 2533 } 2534 2535 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2536 uint64_t value) 2537 { 2538 gt_tval_write(env, ri, GTIMER_VIRT, value); 2539 } 2540 2541 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2542 uint64_t value) 2543 { 2544 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2545 } 2546 2547 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2548 uint64_t value) 2549 { 2550 ARMCPU *cpu = arm_env_get_cpu(env); 2551 2552 trace_arm_gt_cntvoff_write(value); 2553 raw_write(env, ri, value); 2554 gt_recalc_timer(cpu, GTIMER_VIRT); 2555 } 2556 2557 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2558 { 2559 gt_timer_reset(env, ri, GTIMER_HYP); 2560 } 2561 2562 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2563 uint64_t value) 2564 { 2565 gt_cval_write(env, ri, GTIMER_HYP, value); 2566 } 2567 2568 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2569 { 2570 return gt_tval_read(env, ri, GTIMER_HYP); 2571 } 2572 2573 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2574 uint64_t value) 2575 { 2576 gt_tval_write(env, ri, GTIMER_HYP, value); 2577 } 2578 2579 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2580 uint64_t value) 2581 { 2582 gt_ctl_write(env, ri, GTIMER_HYP, value); 2583 } 2584 2585 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2586 { 2587 gt_timer_reset(env, ri, GTIMER_SEC); 2588 } 2589 2590 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2591 uint64_t value) 2592 { 2593 gt_cval_write(env, ri, GTIMER_SEC, value); 2594 } 2595 2596 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2597 { 2598 return gt_tval_read(env, ri, GTIMER_SEC); 2599 } 2600 2601 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2602 uint64_t value) 2603 { 2604 gt_tval_write(env, ri, GTIMER_SEC, value); 2605 } 2606 2607 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2608 uint64_t value) 2609 { 2610 gt_ctl_write(env, ri, GTIMER_SEC, value); 2611 } 2612 2613 void arm_gt_ptimer_cb(void *opaque) 2614 { 2615 ARMCPU *cpu = opaque; 2616 2617 gt_recalc_timer(cpu, GTIMER_PHYS); 2618 } 2619 2620 void arm_gt_vtimer_cb(void *opaque) 2621 { 2622 ARMCPU *cpu = opaque; 2623 2624 gt_recalc_timer(cpu, GTIMER_VIRT); 2625 } 2626 2627 void arm_gt_htimer_cb(void *opaque) 2628 { 2629 ARMCPU *cpu = opaque; 2630 2631 gt_recalc_timer(cpu, GTIMER_HYP); 2632 } 2633 2634 void arm_gt_stimer_cb(void *opaque) 2635 { 2636 ARMCPU *cpu = opaque; 2637 2638 gt_recalc_timer(cpu, GTIMER_SEC); 2639 } 2640 2641 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2642 /* Note that CNTFRQ is purely reads-as-written for the benefit 2643 * of software; writing it doesn't actually change the timer frequency. 2644 * Our reset value matches the fixed frequency we implement the timer at. 2645 */ 2646 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 2647 .type = ARM_CP_ALIAS, 2648 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2649 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 2650 }, 2651 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2652 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2653 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2654 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2655 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE, 2656 }, 2657 /* overall control: mostly access permissions */ 2658 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 2659 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 2660 .access = PL1_RW, 2661 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 2662 .resetvalue = 0, 2663 }, 2664 /* per-timer control */ 2665 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2666 .secure = ARM_CP_SECSTATE_NS, 2667 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R, 2668 .accessfn = gt_ptimer_access, 2669 .fieldoffset = offsetoflow32(CPUARMState, 2670 cp15.c14_timer[GTIMER_PHYS].ctl), 2671 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2672 }, 2673 { .name = "CNTP_CTL_S", 2674 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2675 .secure = ARM_CP_SECSTATE_S, 2676 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R, 2677 .accessfn = gt_ptimer_access, 2678 .fieldoffset = offsetoflow32(CPUARMState, 2679 cp15.c14_timer[GTIMER_SEC].ctl), 2680 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2681 }, 2682 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 2683 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 2684 .type = ARM_CP_IO, .access = PL1_RW | PL0_R, 2685 .accessfn = gt_ptimer_access, 2686 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 2687 .resetvalue = 0, 2688 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write, 2689 }, 2690 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 2691 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R, 2692 .accessfn = gt_vtimer_access, 2693 .fieldoffset = offsetoflow32(CPUARMState, 2694 cp15.c14_timer[GTIMER_VIRT].ctl), 2695 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2696 }, 2697 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 2698 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 2699 .type = ARM_CP_IO, .access = PL1_RW | PL0_R, 2700 .accessfn = gt_vtimer_access, 2701 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 2702 .resetvalue = 0, 2703 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write, 2704 }, 2705 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 2706 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2707 .secure = ARM_CP_SECSTATE_NS, 2708 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2709 .accessfn = gt_ptimer_access, 2710 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2711 }, 2712 { .name = "CNTP_TVAL_S", 2713 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 2714 .secure = ARM_CP_SECSTATE_S, 2715 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2716 .accessfn = gt_ptimer_access, 2717 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 2718 }, 2719 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2720 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 2721 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2722 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 2723 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write, 2724 }, 2725 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 2726 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2727 .accessfn = gt_vtimer_access, 2728 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2729 }, 2730 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 2731 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 2732 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R, 2733 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 2734 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write, 2735 }, 2736 /* The counter itself */ 2737 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 2738 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2739 .accessfn = gt_pct_access, 2740 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 2741 }, 2742 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 2743 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 2744 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2745 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 2746 }, 2747 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 2748 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 2749 .accessfn = gt_vct_access, 2750 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 2751 }, 2752 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2753 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2754 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2755 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 2756 }, 2757 /* Comparison value, indicating when the timer goes off */ 2758 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 2759 .secure = ARM_CP_SECSTATE_NS, 2760 .access = PL1_RW | PL0_R, 2761 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2762 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2763 .accessfn = gt_ptimer_access, 2764 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2765 }, 2766 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 2767 .secure = ARM_CP_SECSTATE_S, 2768 .access = PL1_RW | PL0_R, 2769 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2770 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2771 .accessfn = gt_ptimer_access, 2772 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2773 }, 2774 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2775 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 2776 .access = PL1_RW | PL0_R, 2777 .type = ARM_CP_IO, 2778 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 2779 .resetvalue = 0, .accessfn = gt_ptimer_access, 2780 .writefn = gt_phys_cval_write, .raw_writefn = raw_write, 2781 }, 2782 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 2783 .access = PL1_RW | PL0_R, 2784 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 2785 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2786 .accessfn = gt_vtimer_access, 2787 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2788 }, 2789 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 2790 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 2791 .access = PL1_RW | PL0_R, 2792 .type = ARM_CP_IO, 2793 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 2794 .resetvalue = 0, .accessfn = gt_vtimer_access, 2795 .writefn = gt_virt_cval_write, .raw_writefn = raw_write, 2796 }, 2797 /* Secure timer -- this is actually restricted to only EL3 2798 * and configurably Secure-EL1 via the accessfn. 2799 */ 2800 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 2801 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 2802 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 2803 .accessfn = gt_stimer_access, 2804 .readfn = gt_sec_tval_read, 2805 .writefn = gt_sec_tval_write, 2806 .resetfn = gt_sec_timer_reset, 2807 }, 2808 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 2809 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 2810 .type = ARM_CP_IO, .access = PL1_RW, 2811 .accessfn = gt_stimer_access, 2812 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 2813 .resetvalue = 0, 2814 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 2815 }, 2816 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 2817 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 2818 .type = ARM_CP_IO, .access = PL1_RW, 2819 .accessfn = gt_stimer_access, 2820 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 2821 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 2822 }, 2823 REGINFO_SENTINEL 2824 }; 2825 2826 #else 2827 2828 /* In user-mode most of the generic timer registers are inaccessible 2829 * however modern kernels (4.12+) allow access to cntvct_el0 2830 */ 2831 2832 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2833 { 2834 /* Currently we have no support for QEMUTimer in linux-user so we 2835 * can't call gt_get_countervalue(env), instead we directly 2836 * call the lower level functions. 2837 */ 2838 return cpu_get_clock() / GTIMER_SCALE; 2839 } 2840 2841 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2842 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2843 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2844 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 2845 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2846 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE, 2847 }, 2848 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 2849 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 2850 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2851 .readfn = gt_virt_cnt_read, 2852 }, 2853 REGINFO_SENTINEL 2854 }; 2855 2856 #endif 2857 2858 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2859 { 2860 if (arm_feature(env, ARM_FEATURE_LPAE)) { 2861 raw_write(env, ri, value); 2862 } else if (arm_feature(env, ARM_FEATURE_V7)) { 2863 raw_write(env, ri, value & 0xfffff6ff); 2864 } else { 2865 raw_write(env, ri, value & 0xfffff1ff); 2866 } 2867 } 2868 2869 #ifndef CONFIG_USER_ONLY 2870 /* get_phys_addr() isn't present for user-mode-only targets */ 2871 2872 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 2873 bool isread) 2874 { 2875 if (ri->opc2 & 4) { 2876 /* The ATS12NSO* operations must trap to EL3 if executed in 2877 * Secure EL1 (which can only happen if EL3 is AArch64). 2878 * They are simply UNDEF if executed from NS EL1. 2879 * They function normally from EL2 or EL3. 2880 */ 2881 if (arm_current_el(env) == 1) { 2882 if (arm_is_secure_below_el3(env)) { 2883 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3; 2884 } 2885 return CP_ACCESS_TRAP_UNCATEGORIZED; 2886 } 2887 } 2888 return CP_ACCESS_OK; 2889 } 2890 2891 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 2892 MMUAccessType access_type, ARMMMUIdx mmu_idx) 2893 { 2894 hwaddr phys_addr; 2895 target_ulong page_size; 2896 int prot; 2897 bool ret; 2898 uint64_t par64; 2899 bool format64 = false; 2900 MemTxAttrs attrs = {}; 2901 ARMMMUFaultInfo fi = {}; 2902 ARMCacheAttrs cacheattrs = {}; 2903 2904 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs, 2905 &prot, &page_size, &fi, &cacheattrs); 2906 2907 if (is_a64(env)) { 2908 format64 = true; 2909 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 2910 /* 2911 * ATS1Cxx: 2912 * * TTBCR.EAE determines whether the result is returned using the 2913 * 32-bit or the 64-bit PAR format 2914 * * Instructions executed in Hyp mode always use the 64bit format 2915 * 2916 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 2917 * * The Non-secure TTBCR.EAE bit is set to 1 2918 * * The implementation includes EL2, and the value of HCR.VM is 1 2919 * 2920 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 2921 * 2922 * ATS1Hx always uses the 64bit format. 2923 */ 2924 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 2925 2926 if (arm_feature(env, ARM_FEATURE_EL2)) { 2927 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 2928 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 2929 } else { 2930 format64 |= arm_current_el(env) == 2; 2931 } 2932 } 2933 } 2934 2935 if (format64) { 2936 /* Create a 64-bit PAR */ 2937 par64 = (1 << 11); /* LPAE bit always set */ 2938 if (!ret) { 2939 par64 |= phys_addr & ~0xfffULL; 2940 if (!attrs.secure) { 2941 par64 |= (1 << 9); /* NS */ 2942 } 2943 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */ 2944 par64 |= cacheattrs.shareability << 7; /* SH */ 2945 } else { 2946 uint32_t fsr = arm_fi_to_lfsc(&fi); 2947 2948 par64 |= 1; /* F */ 2949 par64 |= (fsr & 0x3f) << 1; /* FS */ 2950 if (fi.stage2) { 2951 par64 |= (1 << 9); /* S */ 2952 } 2953 if (fi.s1ptw) { 2954 par64 |= (1 << 8); /* PTW */ 2955 } 2956 } 2957 } else { 2958 /* fsr is a DFSR/IFSR value for the short descriptor 2959 * translation table format (with WnR always clear). 2960 * Convert it to a 32-bit PAR. 2961 */ 2962 if (!ret) { 2963 /* We do not set any attribute bits in the PAR */ 2964 if (page_size == (1 << 24) 2965 && arm_feature(env, ARM_FEATURE_V7)) { 2966 par64 = (phys_addr & 0xff000000) | (1 << 1); 2967 } else { 2968 par64 = phys_addr & 0xfffff000; 2969 } 2970 if (!attrs.secure) { 2971 par64 |= (1 << 9); /* NS */ 2972 } 2973 } else { 2974 uint32_t fsr = arm_fi_to_sfsc(&fi); 2975 2976 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 2977 ((fsr & 0xf) << 1) | 1; 2978 } 2979 } 2980 return par64; 2981 } 2982 2983 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 2984 { 2985 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 2986 uint64_t par64; 2987 ARMMMUIdx mmu_idx; 2988 int el = arm_current_el(env); 2989 bool secure = arm_is_secure_below_el3(env); 2990 2991 switch (ri->opc2 & 6) { 2992 case 0: 2993 /* stage 1 current state PL1: ATS1CPR, ATS1CPW */ 2994 switch (el) { 2995 case 3: 2996 mmu_idx = ARMMMUIdx_S1E3; 2997 break; 2998 case 2: 2999 mmu_idx = ARMMMUIdx_S1NSE1; 3000 break; 3001 case 1: 3002 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 3003 break; 3004 default: 3005 g_assert_not_reached(); 3006 } 3007 break; 3008 case 2: 3009 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3010 switch (el) { 3011 case 3: 3012 mmu_idx = ARMMMUIdx_S1SE0; 3013 break; 3014 case 2: 3015 mmu_idx = ARMMMUIdx_S1NSE0; 3016 break; 3017 case 1: 3018 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 3019 break; 3020 default: 3021 g_assert_not_reached(); 3022 } 3023 break; 3024 case 4: 3025 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3026 mmu_idx = ARMMMUIdx_S12NSE1; 3027 break; 3028 case 6: 3029 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3030 mmu_idx = ARMMMUIdx_S12NSE0; 3031 break; 3032 default: 3033 g_assert_not_reached(); 3034 } 3035 3036 par64 = do_ats_write(env, value, access_type, mmu_idx); 3037 3038 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3039 } 3040 3041 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3042 uint64_t value) 3043 { 3044 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3045 uint64_t par64; 3046 3047 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2); 3048 3049 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3050 } 3051 3052 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3053 bool isread) 3054 { 3055 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) { 3056 return CP_ACCESS_TRAP; 3057 } 3058 return CP_ACCESS_OK; 3059 } 3060 3061 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3062 uint64_t value) 3063 { 3064 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3065 ARMMMUIdx mmu_idx; 3066 int secure = arm_is_secure_below_el3(env); 3067 3068 switch (ri->opc2 & 6) { 3069 case 0: 3070 switch (ri->opc1) { 3071 case 0: /* AT S1E1R, AT S1E1W */ 3072 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1; 3073 break; 3074 case 4: /* AT S1E2R, AT S1E2W */ 3075 mmu_idx = ARMMMUIdx_S1E2; 3076 break; 3077 case 6: /* AT S1E3R, AT S1E3W */ 3078 mmu_idx = ARMMMUIdx_S1E3; 3079 break; 3080 default: 3081 g_assert_not_reached(); 3082 } 3083 break; 3084 case 2: /* AT S1E0R, AT S1E0W */ 3085 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0; 3086 break; 3087 case 4: /* AT S12E1R, AT S12E1W */ 3088 mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1; 3089 break; 3090 case 6: /* AT S12E0R, AT S12E0W */ 3091 mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0; 3092 break; 3093 default: 3094 g_assert_not_reached(); 3095 } 3096 3097 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx); 3098 } 3099 #endif 3100 3101 static const ARMCPRegInfo vapa_cp_reginfo[] = { 3102 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 3103 .access = PL1_RW, .resetvalue = 0, 3104 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 3105 offsetoflow32(CPUARMState, cp15.par_ns) }, 3106 .writefn = par_write }, 3107 #ifndef CONFIG_USER_ONLY 3108 /* This underdecoding is safe because the reginfo is NO_RAW. */ 3109 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 3110 .access = PL1_W, .accessfn = ats_access, 3111 .writefn = ats_write, .type = ARM_CP_NO_RAW }, 3112 #endif 3113 REGINFO_SENTINEL 3114 }; 3115 3116 /* Return basic MPU access permission bits. */ 3117 static uint32_t simple_mpu_ap_bits(uint32_t val) 3118 { 3119 uint32_t ret; 3120 uint32_t mask; 3121 int i; 3122 ret = 0; 3123 mask = 3; 3124 for (i = 0; i < 16; i += 2) { 3125 ret |= (val >> i) & mask; 3126 mask <<= 2; 3127 } 3128 return ret; 3129 } 3130 3131 /* Pad basic MPU access permission bits to extended format. */ 3132 static uint32_t extended_mpu_ap_bits(uint32_t val) 3133 { 3134 uint32_t ret; 3135 uint32_t mask; 3136 int i; 3137 ret = 0; 3138 mask = 3; 3139 for (i = 0; i < 16; i += 2) { 3140 ret |= (val & mask) << i; 3141 mask <<= 2; 3142 } 3143 return ret; 3144 } 3145 3146 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3147 uint64_t value) 3148 { 3149 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3150 } 3151 3152 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3153 { 3154 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3155 } 3156 3157 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3158 uint64_t value) 3159 { 3160 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3161 } 3162 3163 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3164 { 3165 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3166 } 3167 3168 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3169 { 3170 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3171 3172 if (!u32p) { 3173 return 0; 3174 } 3175 3176 u32p += env->pmsav7.rnr[M_REG_NS]; 3177 return *u32p; 3178 } 3179 3180 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3181 uint64_t value) 3182 { 3183 ARMCPU *cpu = arm_env_get_cpu(env); 3184 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3185 3186 if (!u32p) { 3187 return; 3188 } 3189 3190 u32p += env->pmsav7.rnr[M_REG_NS]; 3191 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3192 *u32p = value; 3193 } 3194 3195 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3196 uint64_t value) 3197 { 3198 ARMCPU *cpu = arm_env_get_cpu(env); 3199 uint32_t nrgs = cpu->pmsav7_dregion; 3200 3201 if (value >= nrgs) { 3202 qemu_log_mask(LOG_GUEST_ERROR, 3203 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3204 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3205 return; 3206 } 3207 3208 raw_write(env, ri, value); 3209 } 3210 3211 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 3212 /* Reset for all these registers is handled in arm_cpu_reset(), 3213 * because the PMSAv7 is also used by M-profile CPUs, which do 3214 * not register cpregs but still need the state to be reset. 3215 */ 3216 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 3217 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3218 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 3219 .readfn = pmsav7_read, .writefn = pmsav7_write, 3220 .resetfn = arm_cp_reset_ignore }, 3221 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 3222 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3223 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 3224 .readfn = pmsav7_read, .writefn = pmsav7_write, 3225 .resetfn = arm_cp_reset_ignore }, 3226 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 3227 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3228 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 3229 .readfn = pmsav7_read, .writefn = pmsav7_write, 3230 .resetfn = arm_cp_reset_ignore }, 3231 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 3232 .access = PL1_RW, 3233 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 3234 .writefn = pmsav7_rgnr_write, 3235 .resetfn = arm_cp_reset_ignore }, 3236 REGINFO_SENTINEL 3237 }; 3238 3239 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 3240 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3241 .access = PL1_RW, .type = ARM_CP_ALIAS, 3242 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3243 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 3244 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3245 .access = PL1_RW, .type = ARM_CP_ALIAS, 3246 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3247 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 3248 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 3249 .access = PL1_RW, 3250 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3251 .resetvalue = 0, }, 3252 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 3253 .access = PL1_RW, 3254 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3255 .resetvalue = 0, }, 3256 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 3257 .access = PL1_RW, 3258 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 3259 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 3260 .access = PL1_RW, 3261 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 3262 /* Protection region base and size registers */ 3263 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 3264 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3265 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 3266 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 3267 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3268 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 3269 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 3270 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3271 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 3272 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 3273 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3274 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 3275 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 3276 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3277 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 3278 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 3279 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3280 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 3281 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 3282 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3283 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 3284 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 3285 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3286 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 3287 REGINFO_SENTINEL 3288 }; 3289 3290 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 3291 uint64_t value) 3292 { 3293 TCR *tcr = raw_ptr(env, ri); 3294 int maskshift = extract32(value, 0, 3); 3295 3296 if (!arm_feature(env, ARM_FEATURE_V8)) { 3297 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 3298 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 3299 * using Long-desciptor translation table format */ 3300 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 3301 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 3302 /* In an implementation that includes the Security Extensions 3303 * TTBCR has additional fields PD0 [4] and PD1 [5] for 3304 * Short-descriptor translation table format. 3305 */ 3306 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 3307 } else { 3308 value &= TTBCR_N; 3309 } 3310 } 3311 3312 /* Update the masks corresponding to the TCR bank being written 3313 * Note that we always calculate mask and base_mask, but 3314 * they are only used for short-descriptor tables (ie if EAE is 0); 3315 * for long-descriptor tables the TCR fields are used differently 3316 * and the mask and base_mask values are meaningless. 3317 */ 3318 tcr->raw_tcr = value; 3319 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift); 3320 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift); 3321 } 3322 3323 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3324 uint64_t value) 3325 { 3326 ARMCPU *cpu = arm_env_get_cpu(env); 3327 TCR *tcr = raw_ptr(env, ri); 3328 3329 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3330 /* With LPAE the TTBCR could result in a change of ASID 3331 * via the TTBCR.A1 bit, so do a TLB flush. 3332 */ 3333 tlb_flush(CPU(cpu)); 3334 } 3335 /* Preserve the high half of TCR_EL1, set via TTBCR2. */ 3336 value = deposit64(tcr->raw_tcr, 0, 32, value); 3337 vmsa_ttbcr_raw_write(env, ri, value); 3338 } 3339 3340 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3341 { 3342 TCR *tcr = raw_ptr(env, ri); 3343 3344 /* Reset both the TCR as well as the masks corresponding to the bank of 3345 * the TCR being reset. 3346 */ 3347 tcr->raw_tcr = 0; 3348 tcr->mask = 0; 3349 tcr->base_mask = 0xffffc000u; 3350 } 3351 3352 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3353 uint64_t value) 3354 { 3355 ARMCPU *cpu = arm_env_get_cpu(env); 3356 TCR *tcr = raw_ptr(env, ri); 3357 3358 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 3359 tlb_flush(CPU(cpu)); 3360 tcr->raw_tcr = value; 3361 } 3362 3363 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3364 uint64_t value) 3365 { 3366 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 3367 if (cpreg_field_is_64bit(ri) && 3368 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 3369 ARMCPU *cpu = arm_env_get_cpu(env); 3370 tlb_flush(CPU(cpu)); 3371 } 3372 raw_write(env, ri, value); 3373 } 3374 3375 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3376 uint64_t value) 3377 { 3378 ARMCPU *cpu = arm_env_get_cpu(env); 3379 CPUState *cs = CPU(cpu); 3380 3381 /* Accesses to VTTBR may change the VMID so we must flush the TLB. */ 3382 if (raw_read(env, ri) != value) { 3383 tlb_flush_by_mmuidx(cs, 3384 ARMMMUIdxBit_S12NSE1 | 3385 ARMMMUIdxBit_S12NSE0 | 3386 ARMMMUIdxBit_S2NS); 3387 raw_write(env, ri, value); 3388 } 3389 } 3390 3391 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 3392 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3393 .access = PL1_RW, .type = ARM_CP_ALIAS, 3394 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 3395 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 3396 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3397 .access = PL1_RW, .resetvalue = 0, 3398 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 3399 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 3400 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 3401 .access = PL1_RW, .resetvalue = 0, 3402 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 3403 offsetof(CPUARMState, cp15.dfar_ns) } }, 3404 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 3405 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 3406 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 3407 .resetvalue = 0, }, 3408 REGINFO_SENTINEL 3409 }; 3410 3411 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 3412 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 3413 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 3414 .access = PL1_RW, 3415 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 3416 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 3417 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 3418 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3419 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3420 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 3421 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 3422 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 3423 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3424 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3425 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 3426 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 3427 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3428 .access = PL1_RW, .writefn = vmsa_tcr_el1_write, 3429 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write, 3430 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 3431 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3432 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 3433 .raw_writefn = vmsa_ttbcr_raw_write, 3434 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 3435 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 3436 REGINFO_SENTINEL 3437 }; 3438 3439 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing 3440 * qemu tlbs nor adjusting cached masks. 3441 */ 3442 static const ARMCPRegInfo ttbcr2_reginfo = { 3443 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 3444 .access = PL1_RW, .type = ARM_CP_ALIAS, 3445 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 3446 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) }, 3447 }; 3448 3449 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 3450 uint64_t value) 3451 { 3452 env->cp15.c15_ticonfig = value & 0xe7; 3453 /* The OS_TYPE bit in this register changes the reported CPUID! */ 3454 env->cp15.c0_cpuid = (value & (1 << 5)) ? 3455 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 3456 } 3457 3458 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 3459 uint64_t value) 3460 { 3461 env->cp15.c15_threadid = value & 0xffff; 3462 } 3463 3464 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 3465 uint64_t value) 3466 { 3467 /* Wait-for-interrupt (deprecated) */ 3468 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT); 3469 } 3470 3471 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 3472 uint64_t value) 3473 { 3474 /* On OMAP there are registers indicating the max/min index of dcache lines 3475 * containing a dirty line; cache flush operations have to reset these. 3476 */ 3477 env->cp15.c15_i_max = 0x000; 3478 env->cp15.c15_i_min = 0xff0; 3479 } 3480 3481 static const ARMCPRegInfo omap_cp_reginfo[] = { 3482 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 3483 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 3484 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 3485 .resetvalue = 0, }, 3486 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 3487 .access = PL1_RW, .type = ARM_CP_NOP }, 3488 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 3489 .access = PL1_RW, 3490 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 3491 .writefn = omap_ticonfig_write }, 3492 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 3493 .access = PL1_RW, 3494 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 3495 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 3496 .access = PL1_RW, .resetvalue = 0xff0, 3497 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 3498 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 3499 .access = PL1_RW, 3500 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 3501 .writefn = omap_threadid_write }, 3502 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 3503 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3504 .type = ARM_CP_NO_RAW, 3505 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 3506 /* TODO: Peripheral port remap register: 3507 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 3508 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 3509 * when MMU is off. 3510 */ 3511 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 3512 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 3513 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 3514 .writefn = omap_cachemaint_write }, 3515 { .name = "C9", .cp = 15, .crn = 9, 3516 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 3517 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 3518 REGINFO_SENTINEL 3519 }; 3520 3521 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3522 uint64_t value) 3523 { 3524 env->cp15.c15_cpar = value & 0x3fff; 3525 } 3526 3527 static const ARMCPRegInfo xscale_cp_reginfo[] = { 3528 { .name = "XSCALE_CPAR", 3529 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3530 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 3531 .writefn = xscale_cpar_write, }, 3532 { .name = "XSCALE_AUXCR", 3533 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 3534 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 3535 .resetvalue = 0, }, 3536 /* XScale specific cache-lockdown: since we have no cache we NOP these 3537 * and hope the guest does not really rely on cache behaviour. 3538 */ 3539 { .name = "XSCALE_LOCK_ICACHE_LINE", 3540 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 3541 .access = PL1_W, .type = ARM_CP_NOP }, 3542 { .name = "XSCALE_UNLOCK_ICACHE", 3543 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 3544 .access = PL1_W, .type = ARM_CP_NOP }, 3545 { .name = "XSCALE_DCACHE_LOCK", 3546 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 3547 .access = PL1_RW, .type = ARM_CP_NOP }, 3548 { .name = "XSCALE_UNLOCK_DCACHE", 3549 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 3550 .access = PL1_W, .type = ARM_CP_NOP }, 3551 REGINFO_SENTINEL 3552 }; 3553 3554 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 3555 /* RAZ/WI the whole crn=15 space, when we don't have a more specific 3556 * implementation of this implementation-defined space. 3557 * Ideally this should eventually disappear in favour of actually 3558 * implementing the correct behaviour for all cores. 3559 */ 3560 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 3561 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3562 .access = PL1_RW, 3563 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 3564 .resetvalue = 0 }, 3565 REGINFO_SENTINEL 3566 }; 3567 3568 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 3569 /* Cache status: RAZ because we have no cache so it's always clean */ 3570 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 3571 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3572 .resetvalue = 0 }, 3573 REGINFO_SENTINEL 3574 }; 3575 3576 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 3577 /* We never have a a block transfer operation in progress */ 3578 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 3579 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3580 .resetvalue = 0 }, 3581 /* The cache ops themselves: these all NOP for QEMU */ 3582 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 3583 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3584 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 3585 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3586 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 3587 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3588 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 3589 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3590 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 3591 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3592 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 3593 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 3594 REGINFO_SENTINEL 3595 }; 3596 3597 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 3598 /* The cache test-and-clean instructions always return (1 << 30) 3599 * to indicate that there are no dirty cache lines. 3600 */ 3601 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 3602 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3603 .resetvalue = (1 << 30) }, 3604 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 3605 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 3606 .resetvalue = (1 << 30) }, 3607 REGINFO_SENTINEL 3608 }; 3609 3610 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 3611 /* Ignore ReadBuffer accesses */ 3612 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 3613 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 3614 .access = PL1_RW, .resetvalue = 0, 3615 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 3616 REGINFO_SENTINEL 3617 }; 3618 3619 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3620 { 3621 ARMCPU *cpu = arm_env_get_cpu(env); 3622 unsigned int cur_el = arm_current_el(env); 3623 bool secure = arm_is_secure(env); 3624 3625 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3626 return env->cp15.vpidr_el2; 3627 } 3628 return raw_read(env, ri); 3629 } 3630 3631 static uint64_t mpidr_read_val(CPUARMState *env) 3632 { 3633 ARMCPU *cpu = ARM_CPU(arm_env_get_cpu(env)); 3634 uint64_t mpidr = cpu->mp_affinity; 3635 3636 if (arm_feature(env, ARM_FEATURE_V7MP)) { 3637 mpidr |= (1U << 31); 3638 /* Cores which are uniprocessor (non-coherent) 3639 * but still implement the MP extensions set 3640 * bit 30. (For instance, Cortex-R5). 3641 */ 3642 if (cpu->mp_is_up) { 3643 mpidr |= (1u << 30); 3644 } 3645 } 3646 return mpidr; 3647 } 3648 3649 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3650 { 3651 unsigned int cur_el = arm_current_el(env); 3652 bool secure = arm_is_secure(env); 3653 3654 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 3655 return env->cp15.vmpidr_el2; 3656 } 3657 return mpidr_read_val(env); 3658 } 3659 3660 static const ARMCPRegInfo mpidr_cp_reginfo[] = { 3661 { .name = "MPIDR", .state = ARM_CP_STATE_BOTH, 3662 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 3663 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 3664 REGINFO_SENTINEL 3665 }; 3666 3667 static const ARMCPRegInfo lpae_cp_reginfo[] = { 3668 /* NOP AMAIR0/1 */ 3669 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 3670 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 3671 .access = PL1_RW, .type = ARM_CP_CONST, 3672 .resetvalue = 0 }, 3673 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 3674 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 3675 .access = PL1_RW, .type = ARM_CP_CONST, 3676 .resetvalue = 0 }, 3677 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 3678 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 3679 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 3680 offsetof(CPUARMState, cp15.par_ns)} }, 3681 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 3682 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3683 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3684 offsetof(CPUARMState, cp15.ttbr0_ns) }, 3685 .writefn = vmsa_ttbr_write, }, 3686 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 3687 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 3688 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3689 offsetof(CPUARMState, cp15.ttbr1_ns) }, 3690 .writefn = vmsa_ttbr_write, }, 3691 REGINFO_SENTINEL 3692 }; 3693 3694 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3695 { 3696 return vfp_get_fpcr(env); 3697 } 3698 3699 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3700 uint64_t value) 3701 { 3702 vfp_set_fpcr(env, value); 3703 } 3704 3705 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3706 { 3707 return vfp_get_fpsr(env); 3708 } 3709 3710 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3711 uint64_t value) 3712 { 3713 vfp_set_fpsr(env, value); 3714 } 3715 3716 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 3717 bool isread) 3718 { 3719 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) { 3720 return CP_ACCESS_TRAP; 3721 } 3722 return CP_ACCESS_OK; 3723 } 3724 3725 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 3726 uint64_t value) 3727 { 3728 env->daif = value & PSTATE_DAIF; 3729 } 3730 3731 static CPAccessResult aa64_cacheop_access(CPUARMState *env, 3732 const ARMCPRegInfo *ri, 3733 bool isread) 3734 { 3735 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless 3736 * SCTLR_EL1.UCI is set. 3737 */ 3738 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) { 3739 return CP_ACCESS_TRAP; 3740 } 3741 return CP_ACCESS_OK; 3742 } 3743 3744 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 3745 * Page D4-1736 (DDI0487A.b) 3746 */ 3747 3748 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3749 uint64_t value) 3750 { 3751 CPUState *cs = ENV_GET_CPU(env); 3752 bool sec = arm_is_secure_below_el3(env); 3753 3754 if (sec) { 3755 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3756 ARMMMUIdxBit_S1SE1 | 3757 ARMMMUIdxBit_S1SE0); 3758 } else { 3759 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3760 ARMMMUIdxBit_S12NSE1 | 3761 ARMMMUIdxBit_S12NSE0); 3762 } 3763 } 3764 3765 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3766 uint64_t value) 3767 { 3768 CPUState *cs = ENV_GET_CPU(env); 3769 3770 if (tlb_force_broadcast(env)) { 3771 tlbi_aa64_vmalle1is_write(env, NULL, value); 3772 return; 3773 } 3774 3775 if (arm_is_secure_below_el3(env)) { 3776 tlb_flush_by_mmuidx(cs, 3777 ARMMMUIdxBit_S1SE1 | 3778 ARMMMUIdxBit_S1SE0); 3779 } else { 3780 tlb_flush_by_mmuidx(cs, 3781 ARMMMUIdxBit_S12NSE1 | 3782 ARMMMUIdxBit_S12NSE0); 3783 } 3784 } 3785 3786 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3787 uint64_t value) 3788 { 3789 /* Note that the 'ALL' scope must invalidate both stage 1 and 3790 * stage 2 translations, whereas most other scopes only invalidate 3791 * stage 1 translations. 3792 */ 3793 ARMCPU *cpu = arm_env_get_cpu(env); 3794 CPUState *cs = CPU(cpu); 3795 3796 if (arm_is_secure_below_el3(env)) { 3797 tlb_flush_by_mmuidx(cs, 3798 ARMMMUIdxBit_S1SE1 | 3799 ARMMMUIdxBit_S1SE0); 3800 } else { 3801 if (arm_feature(env, ARM_FEATURE_EL2)) { 3802 tlb_flush_by_mmuidx(cs, 3803 ARMMMUIdxBit_S12NSE1 | 3804 ARMMMUIdxBit_S12NSE0 | 3805 ARMMMUIdxBit_S2NS); 3806 } else { 3807 tlb_flush_by_mmuidx(cs, 3808 ARMMMUIdxBit_S12NSE1 | 3809 ARMMMUIdxBit_S12NSE0); 3810 } 3811 } 3812 } 3813 3814 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3815 uint64_t value) 3816 { 3817 ARMCPU *cpu = arm_env_get_cpu(env); 3818 CPUState *cs = CPU(cpu); 3819 3820 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2); 3821 } 3822 3823 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3824 uint64_t value) 3825 { 3826 ARMCPU *cpu = arm_env_get_cpu(env); 3827 CPUState *cs = CPU(cpu); 3828 3829 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3); 3830 } 3831 3832 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3833 uint64_t value) 3834 { 3835 /* Note that the 'ALL' scope must invalidate both stage 1 and 3836 * stage 2 translations, whereas most other scopes only invalidate 3837 * stage 1 translations. 3838 */ 3839 CPUState *cs = ENV_GET_CPU(env); 3840 bool sec = arm_is_secure_below_el3(env); 3841 bool has_el2 = arm_feature(env, ARM_FEATURE_EL2); 3842 3843 if (sec) { 3844 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3845 ARMMMUIdxBit_S1SE1 | 3846 ARMMMUIdxBit_S1SE0); 3847 } else if (has_el2) { 3848 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3849 ARMMMUIdxBit_S12NSE1 | 3850 ARMMMUIdxBit_S12NSE0 | 3851 ARMMMUIdxBit_S2NS); 3852 } else { 3853 tlb_flush_by_mmuidx_all_cpus_synced(cs, 3854 ARMMMUIdxBit_S12NSE1 | 3855 ARMMMUIdxBit_S12NSE0); 3856 } 3857 } 3858 3859 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3860 uint64_t value) 3861 { 3862 CPUState *cs = ENV_GET_CPU(env); 3863 3864 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2); 3865 } 3866 3867 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3868 uint64_t value) 3869 { 3870 CPUState *cs = ENV_GET_CPU(env); 3871 3872 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3); 3873 } 3874 3875 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3876 uint64_t value) 3877 { 3878 /* Invalidate by VA, EL2 3879 * Currently handles both VAE2 and VALE2, since we don't support 3880 * flush-last-level-only. 3881 */ 3882 ARMCPU *cpu = arm_env_get_cpu(env); 3883 CPUState *cs = CPU(cpu); 3884 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3885 3886 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2); 3887 } 3888 3889 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 3890 uint64_t value) 3891 { 3892 /* Invalidate by VA, EL3 3893 * Currently handles both VAE3 and VALE3, since we don't support 3894 * flush-last-level-only. 3895 */ 3896 ARMCPU *cpu = arm_env_get_cpu(env); 3897 CPUState *cs = CPU(cpu); 3898 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3899 3900 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3); 3901 } 3902 3903 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3904 uint64_t value) 3905 { 3906 ARMCPU *cpu = arm_env_get_cpu(env); 3907 CPUState *cs = CPU(cpu); 3908 bool sec = arm_is_secure_below_el3(env); 3909 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3910 3911 if (sec) { 3912 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3913 ARMMMUIdxBit_S1SE1 | 3914 ARMMMUIdxBit_S1SE0); 3915 } else { 3916 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3917 ARMMMUIdxBit_S12NSE1 | 3918 ARMMMUIdxBit_S12NSE0); 3919 } 3920 } 3921 3922 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3923 uint64_t value) 3924 { 3925 /* Invalidate by VA, EL1&0 (AArch64 version). 3926 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 3927 * since we don't support flush-for-specific-ASID-only or 3928 * flush-last-level-only. 3929 */ 3930 ARMCPU *cpu = arm_env_get_cpu(env); 3931 CPUState *cs = CPU(cpu); 3932 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3933 3934 if (tlb_force_broadcast(env)) { 3935 tlbi_aa64_vae1is_write(env, NULL, value); 3936 return; 3937 } 3938 3939 if (arm_is_secure_below_el3(env)) { 3940 tlb_flush_page_by_mmuidx(cs, pageaddr, 3941 ARMMMUIdxBit_S1SE1 | 3942 ARMMMUIdxBit_S1SE0); 3943 } else { 3944 tlb_flush_page_by_mmuidx(cs, pageaddr, 3945 ARMMMUIdxBit_S12NSE1 | 3946 ARMMMUIdxBit_S12NSE0); 3947 } 3948 } 3949 3950 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3951 uint64_t value) 3952 { 3953 CPUState *cs = ENV_GET_CPU(env); 3954 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3955 3956 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3957 ARMMMUIdxBit_S1E2); 3958 } 3959 3960 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3961 uint64_t value) 3962 { 3963 CPUState *cs = ENV_GET_CPU(env); 3964 uint64_t pageaddr = sextract64(value << 12, 0, 56); 3965 3966 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 3967 ARMMMUIdxBit_S1E3); 3968 } 3969 3970 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 3971 uint64_t value) 3972 { 3973 /* Invalidate by IPA. This has to invalidate any structures that 3974 * contain only stage 2 translation information, but does not need 3975 * to apply to structures that contain combined stage 1 and stage 2 3976 * translation information. 3977 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 3978 */ 3979 ARMCPU *cpu = arm_env_get_cpu(env); 3980 CPUState *cs = CPU(cpu); 3981 uint64_t pageaddr; 3982 3983 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 3984 return; 3985 } 3986 3987 pageaddr = sextract64(value << 12, 0, 48); 3988 3989 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS); 3990 } 3991 3992 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 3993 uint64_t value) 3994 { 3995 CPUState *cs = ENV_GET_CPU(env); 3996 uint64_t pageaddr; 3997 3998 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 3999 return; 4000 } 4001 4002 pageaddr = sextract64(value << 12, 0, 48); 4003 4004 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4005 ARMMMUIdxBit_S2NS); 4006 } 4007 4008 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 4009 bool isread) 4010 { 4011 /* We don't implement EL2, so the only control on DC ZVA is the 4012 * bit in the SCTLR which can prohibit access for EL0. 4013 */ 4014 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 4015 return CP_ACCESS_TRAP; 4016 } 4017 return CP_ACCESS_OK; 4018 } 4019 4020 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 4021 { 4022 ARMCPU *cpu = arm_env_get_cpu(env); 4023 int dzp_bit = 1 << 4; 4024 4025 /* DZP indicates whether DC ZVA access is allowed */ 4026 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 4027 dzp_bit = 0; 4028 } 4029 return cpu->dcz_blocksize | dzp_bit; 4030 } 4031 4032 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 4033 bool isread) 4034 { 4035 if (!(env->pstate & PSTATE_SP)) { 4036 /* Access to SP_EL0 is undefined if it's being used as 4037 * the stack pointer. 4038 */ 4039 return CP_ACCESS_TRAP_UNCATEGORIZED; 4040 } 4041 return CP_ACCESS_OK; 4042 } 4043 4044 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 4045 { 4046 return env->pstate & PSTATE_SP; 4047 } 4048 4049 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 4050 { 4051 update_spsel(env, val); 4052 } 4053 4054 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4055 uint64_t value) 4056 { 4057 ARMCPU *cpu = arm_env_get_cpu(env); 4058 4059 if (raw_read(env, ri) == value) { 4060 /* Skip the TLB flush if nothing actually changed; Linux likes 4061 * to do a lot of pointless SCTLR writes. 4062 */ 4063 return; 4064 } 4065 4066 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 4067 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 4068 value &= ~SCTLR_M; 4069 } 4070 4071 raw_write(env, ri, value); 4072 /* ??? Lots of these bits are not implemented. */ 4073 /* This may enable/disable the MMU, so do a TLB flush. */ 4074 tlb_flush(CPU(cpu)); 4075 } 4076 4077 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri, 4078 bool isread) 4079 { 4080 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) { 4081 return CP_ACCESS_TRAP_FP_EL2; 4082 } 4083 if (env->cp15.cptr_el[3] & CPTR_TFP) { 4084 return CP_ACCESS_TRAP_FP_EL3; 4085 } 4086 return CP_ACCESS_OK; 4087 } 4088 4089 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4090 uint64_t value) 4091 { 4092 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK; 4093 } 4094 4095 static const ARMCPRegInfo v8_cp_reginfo[] = { 4096 /* Minimal set of EL0-visible registers. This will need to be expanded 4097 * significantly for system emulation of AArch64 CPUs. 4098 */ 4099 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 4100 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 4101 .access = PL0_RW, .type = ARM_CP_NZCV }, 4102 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 4103 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 4104 .type = ARM_CP_NO_RAW, 4105 .access = PL0_RW, .accessfn = aa64_daif_access, 4106 .fieldoffset = offsetof(CPUARMState, daif), 4107 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 4108 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 4109 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 4110 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4111 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 4112 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 4113 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 4114 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4115 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 4116 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 4117 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 4118 .access = PL0_R, .type = ARM_CP_NO_RAW, 4119 .readfn = aa64_dczid_read }, 4120 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 4121 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 4122 .access = PL0_W, .type = ARM_CP_DC_ZVA, 4123 #ifndef CONFIG_USER_ONLY 4124 /* Avoid overhead of an access check that always passes in user-mode */ 4125 .accessfn = aa64_zva_access, 4126 #endif 4127 }, 4128 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 4129 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 4130 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 4131 /* Cache ops: all NOPs since we don't emulate caches */ 4132 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 4133 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4134 .access = PL1_W, .type = ARM_CP_NOP }, 4135 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 4136 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4137 .access = PL1_W, .type = ARM_CP_NOP }, 4138 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 4139 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 4140 .access = PL0_W, .type = ARM_CP_NOP, 4141 .accessfn = aa64_cacheop_access }, 4142 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 4143 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4144 .access = PL1_W, .type = ARM_CP_NOP }, 4145 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 4146 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4147 .access = PL1_W, .type = ARM_CP_NOP }, 4148 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 4149 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 4150 .access = PL0_W, .type = ARM_CP_NOP, 4151 .accessfn = aa64_cacheop_access }, 4152 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 4153 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4154 .access = PL1_W, .type = ARM_CP_NOP }, 4155 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 4156 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 4157 .access = PL0_W, .type = ARM_CP_NOP, 4158 .accessfn = aa64_cacheop_access }, 4159 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 4160 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 4161 .access = PL0_W, .type = ARM_CP_NOP, 4162 .accessfn = aa64_cacheop_access }, 4163 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 4164 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4165 .access = PL1_W, .type = ARM_CP_NOP }, 4166 /* TLBI operations */ 4167 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 4168 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 4169 .access = PL1_W, .type = ARM_CP_NO_RAW, 4170 .writefn = tlbi_aa64_vmalle1is_write }, 4171 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 4172 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 4173 .access = PL1_W, .type = ARM_CP_NO_RAW, 4174 .writefn = tlbi_aa64_vae1is_write }, 4175 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 4176 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 4177 .access = PL1_W, .type = ARM_CP_NO_RAW, 4178 .writefn = tlbi_aa64_vmalle1is_write }, 4179 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 4180 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 4181 .access = PL1_W, .type = ARM_CP_NO_RAW, 4182 .writefn = tlbi_aa64_vae1is_write }, 4183 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 4184 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4185 .access = PL1_W, .type = ARM_CP_NO_RAW, 4186 .writefn = tlbi_aa64_vae1is_write }, 4187 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 4188 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4189 .access = PL1_W, .type = ARM_CP_NO_RAW, 4190 .writefn = tlbi_aa64_vae1is_write }, 4191 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 4192 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 4193 .access = PL1_W, .type = ARM_CP_NO_RAW, 4194 .writefn = tlbi_aa64_vmalle1_write }, 4195 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 4196 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 4197 .access = PL1_W, .type = ARM_CP_NO_RAW, 4198 .writefn = tlbi_aa64_vae1_write }, 4199 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 4200 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 4201 .access = PL1_W, .type = ARM_CP_NO_RAW, 4202 .writefn = tlbi_aa64_vmalle1_write }, 4203 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 4204 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 4205 .access = PL1_W, .type = ARM_CP_NO_RAW, 4206 .writefn = tlbi_aa64_vae1_write }, 4207 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 4208 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4209 .access = PL1_W, .type = ARM_CP_NO_RAW, 4210 .writefn = tlbi_aa64_vae1_write }, 4211 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 4212 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4213 .access = PL1_W, .type = ARM_CP_NO_RAW, 4214 .writefn = tlbi_aa64_vae1_write }, 4215 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 4216 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4217 .access = PL2_W, .type = ARM_CP_NO_RAW, 4218 .writefn = tlbi_aa64_ipas2e1is_write }, 4219 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 4220 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4221 .access = PL2_W, .type = ARM_CP_NO_RAW, 4222 .writefn = tlbi_aa64_ipas2e1is_write }, 4223 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 4224 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4225 .access = PL2_W, .type = ARM_CP_NO_RAW, 4226 .writefn = tlbi_aa64_alle1is_write }, 4227 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 4228 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 4229 .access = PL2_W, .type = ARM_CP_NO_RAW, 4230 .writefn = tlbi_aa64_alle1is_write }, 4231 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 4232 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4233 .access = PL2_W, .type = ARM_CP_NO_RAW, 4234 .writefn = tlbi_aa64_ipas2e1_write }, 4235 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 4236 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4237 .access = PL2_W, .type = ARM_CP_NO_RAW, 4238 .writefn = tlbi_aa64_ipas2e1_write }, 4239 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 4240 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4241 .access = PL2_W, .type = ARM_CP_NO_RAW, 4242 .writefn = tlbi_aa64_alle1_write }, 4243 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 4244 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 4245 .access = PL2_W, .type = ARM_CP_NO_RAW, 4246 .writefn = tlbi_aa64_alle1is_write }, 4247 #ifndef CONFIG_USER_ONLY 4248 /* 64 bit address translation operations */ 4249 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 4250 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 4251 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4252 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 4253 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 4254 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4255 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 4256 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 4257 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4258 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 4259 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 4260 .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4261 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 4262 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 4263 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4264 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 4265 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 4266 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4267 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 4268 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 4269 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4270 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 4271 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 4272 .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4273 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 4274 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 4275 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 4276 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4277 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 4278 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 4279 .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4280 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 4281 .type = ARM_CP_ALIAS, 4282 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 4283 .access = PL1_RW, .resetvalue = 0, 4284 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 4285 .writefn = par_write }, 4286 #endif 4287 /* TLB invalidate last level of translation table walk */ 4288 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4289 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 4290 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4291 .type = ARM_CP_NO_RAW, .access = PL1_W, 4292 .writefn = tlbimvaa_is_write }, 4293 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4294 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 4295 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4296 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 4297 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4298 .type = ARM_CP_NO_RAW, .access = PL2_W, 4299 .writefn = tlbimva_hyp_write }, 4300 { .name = "TLBIMVALHIS", 4301 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4302 .type = ARM_CP_NO_RAW, .access = PL2_W, 4303 .writefn = tlbimva_hyp_is_write }, 4304 { .name = "TLBIIPAS2", 4305 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4306 .type = ARM_CP_NO_RAW, .access = PL2_W, 4307 .writefn = tlbiipas2_write }, 4308 { .name = "TLBIIPAS2IS", 4309 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4310 .type = ARM_CP_NO_RAW, .access = PL2_W, 4311 .writefn = tlbiipas2_is_write }, 4312 { .name = "TLBIIPAS2L", 4313 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4314 .type = ARM_CP_NO_RAW, .access = PL2_W, 4315 .writefn = tlbiipas2_write }, 4316 { .name = "TLBIIPAS2LIS", 4317 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4318 .type = ARM_CP_NO_RAW, .access = PL2_W, 4319 .writefn = tlbiipas2_is_write }, 4320 /* 32 bit cache operations */ 4321 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4322 .type = ARM_CP_NOP, .access = PL1_W }, 4323 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 4324 .type = ARM_CP_NOP, .access = PL1_W }, 4325 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4326 .type = ARM_CP_NOP, .access = PL1_W }, 4327 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 4328 .type = ARM_CP_NOP, .access = PL1_W }, 4329 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 4330 .type = ARM_CP_NOP, .access = PL1_W }, 4331 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 4332 .type = ARM_CP_NOP, .access = PL1_W }, 4333 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4334 .type = ARM_CP_NOP, .access = PL1_W }, 4335 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4336 .type = ARM_CP_NOP, .access = PL1_W }, 4337 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 4338 .type = ARM_CP_NOP, .access = PL1_W }, 4339 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4340 .type = ARM_CP_NOP, .access = PL1_W }, 4341 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 4342 .type = ARM_CP_NOP, .access = PL1_W }, 4343 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 4344 .type = ARM_CP_NOP, .access = PL1_W }, 4345 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4346 .type = ARM_CP_NOP, .access = PL1_W }, 4347 /* MMU Domain access control / MPU write buffer control */ 4348 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 4349 .access = PL1_RW, .resetvalue = 0, 4350 .writefn = dacr_write, .raw_writefn = raw_write, 4351 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 4352 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 4353 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 4354 .type = ARM_CP_ALIAS, 4355 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 4356 .access = PL1_RW, 4357 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 4358 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 4359 .type = ARM_CP_ALIAS, 4360 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 4361 .access = PL1_RW, 4362 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 4363 /* We rely on the access checks not allowing the guest to write to the 4364 * state field when SPSel indicates that it's being used as the stack 4365 * pointer. 4366 */ 4367 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 4368 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 4369 .access = PL1_RW, .accessfn = sp_el0_access, 4370 .type = ARM_CP_ALIAS, 4371 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 4372 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 4373 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 4374 .access = PL2_RW, .type = ARM_CP_ALIAS, 4375 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 4376 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 4377 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 4378 .type = ARM_CP_NO_RAW, 4379 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 4380 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 4381 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 4382 .type = ARM_CP_ALIAS, 4383 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]), 4384 .access = PL2_RW, .accessfn = fpexc32_access }, 4385 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 4386 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 4387 .access = PL2_RW, .resetvalue = 0, 4388 .writefn = dacr_write, .raw_writefn = raw_write, 4389 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 4390 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 4391 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 4392 .access = PL2_RW, .resetvalue = 0, 4393 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 4394 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 4395 .type = ARM_CP_ALIAS, 4396 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 4397 .access = PL2_RW, 4398 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 4399 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 4400 .type = ARM_CP_ALIAS, 4401 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 4402 .access = PL2_RW, 4403 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 4404 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 4405 .type = ARM_CP_ALIAS, 4406 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 4407 .access = PL2_RW, 4408 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 4409 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 4410 .type = ARM_CP_ALIAS, 4411 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 4412 .access = PL2_RW, 4413 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 4414 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 4415 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 4416 .resetvalue = 0, 4417 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 4418 { .name = "SDCR", .type = ARM_CP_ALIAS, 4419 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 4420 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4421 .writefn = sdcr_write, 4422 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 4423 REGINFO_SENTINEL 4424 }; 4425 4426 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */ 4427 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = { 4428 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4429 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4430 .access = PL2_RW, 4431 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore }, 4432 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH, 4433 .type = ARM_CP_NO_RAW, 4434 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4435 .access = PL2_RW, 4436 .type = ARM_CP_CONST, .resetvalue = 0 }, 4437 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4438 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4439 .access = PL2_RW, 4440 .type = ARM_CP_CONST, .resetvalue = 0 }, 4441 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4442 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4443 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4444 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4445 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4446 .access = PL2_RW, .type = ARM_CP_CONST, 4447 .resetvalue = 0 }, 4448 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4449 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4450 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4451 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4452 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4453 .access = PL2_RW, .type = ARM_CP_CONST, 4454 .resetvalue = 0 }, 4455 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4456 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4457 .access = PL2_RW, .type = ARM_CP_CONST, 4458 .resetvalue = 0 }, 4459 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4460 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4461 .access = PL2_RW, .type = ARM_CP_CONST, 4462 .resetvalue = 0 }, 4463 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4464 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4465 .access = PL2_RW, .type = ARM_CP_CONST, 4466 .resetvalue = 0 }, 4467 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4468 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4469 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4470 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH, 4471 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4472 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4473 .type = ARM_CP_CONST, .resetvalue = 0 }, 4474 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4475 .cp = 15, .opc1 = 6, .crm = 2, 4476 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4477 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 }, 4478 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4479 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4480 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4481 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4482 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4483 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4484 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4485 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4486 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4487 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4488 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4489 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4490 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4491 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4492 .resetvalue = 0 }, 4493 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4494 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4495 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4496 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4497 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4498 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4499 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4500 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4501 .resetvalue = 0 }, 4502 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4503 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4504 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4505 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4506 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4507 .resetvalue = 0 }, 4508 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4509 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4510 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4511 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4512 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4513 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4514 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4515 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4516 .access = PL2_RW, .accessfn = access_tda, 4517 .type = ARM_CP_CONST, .resetvalue = 0 }, 4518 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH, 4519 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4520 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4521 .type = ARM_CP_CONST, .resetvalue = 0 }, 4522 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4523 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4524 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4525 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4526 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4527 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4528 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4529 .type = ARM_CP_CONST, 4530 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4531 .access = PL2_RW, .resetvalue = 0 }, 4532 REGINFO_SENTINEL 4533 }; 4534 4535 /* Ditto, but for registers which exist in ARMv8 but not v7 */ 4536 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = { 4537 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4538 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4539 .access = PL2_RW, 4540 .type = ARM_CP_CONST, .resetvalue = 0 }, 4541 REGINFO_SENTINEL 4542 }; 4543 4544 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 4545 { 4546 ARMCPU *cpu = arm_env_get_cpu(env); 4547 uint64_t valid_mask = HCR_MASK; 4548 4549 if (arm_feature(env, ARM_FEATURE_EL3)) { 4550 valid_mask &= ~HCR_HCD; 4551 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 4552 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented. 4553 * However, if we're using the SMC PSCI conduit then QEMU is 4554 * effectively acting like EL3 firmware and so the guest at 4555 * EL2 should retain the ability to prevent EL1 from being 4556 * able to make SMC calls into the ersatz firmware, so in 4557 * that case HCR.TSC should be read/write. 4558 */ 4559 valid_mask &= ~HCR_TSC; 4560 } 4561 if (cpu_isar_feature(aa64_lor, cpu)) { 4562 valid_mask |= HCR_TLOR; 4563 } 4564 if (cpu_isar_feature(aa64_pauth, cpu)) { 4565 valid_mask |= HCR_API | HCR_APK; 4566 } 4567 4568 /* Clear RES0 bits. */ 4569 value &= valid_mask; 4570 4571 /* These bits change the MMU setup: 4572 * HCR_VM enables stage 2 translation 4573 * HCR_PTW forbids certain page-table setups 4574 * HCR_DC Disables stage1 and enables stage2 translation 4575 */ 4576 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) { 4577 tlb_flush(CPU(cpu)); 4578 } 4579 env->cp15.hcr_el2 = value; 4580 4581 /* 4582 * Updates to VI and VF require us to update the status of 4583 * virtual interrupts, which are the logical OR of these bits 4584 * and the state of the input lines from the GIC. (This requires 4585 * that we have the iothread lock, which is done by marking the 4586 * reginfo structs as ARM_CP_IO.) 4587 * Note that if a write to HCR pends a VIRQ or VFIQ it is never 4588 * possible for it to be taken immediately, because VIRQ and 4589 * VFIQ are masked unless running at EL0 or EL1, and HCR 4590 * can only be written at EL2. 4591 */ 4592 g_assert(qemu_mutex_iothread_locked()); 4593 arm_cpu_update_virq(cpu); 4594 arm_cpu_update_vfiq(cpu); 4595 } 4596 4597 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 4598 uint64_t value) 4599 { 4600 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 4601 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 4602 hcr_write(env, NULL, value); 4603 } 4604 4605 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 4606 uint64_t value) 4607 { 4608 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 4609 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 4610 hcr_write(env, NULL, value); 4611 } 4612 4613 /* 4614 * Return the effective value of HCR_EL2. 4615 * Bits that are not included here: 4616 * RW (read from SCR_EL3.RW as needed) 4617 */ 4618 uint64_t arm_hcr_el2_eff(CPUARMState *env) 4619 { 4620 uint64_t ret = env->cp15.hcr_el2; 4621 4622 if (arm_is_secure_below_el3(env)) { 4623 /* 4624 * "This register has no effect if EL2 is not enabled in the 4625 * current Security state". This is ARMv8.4-SecEL2 speak for 4626 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 4627 * 4628 * Prior to that, the language was "In an implementation that 4629 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 4630 * as if this field is 0 for all purposes other than a direct 4631 * read or write access of HCR_EL2". With lots of enumeration 4632 * on a per-field basis. In current QEMU, this is condition 4633 * is arm_is_secure_below_el3. 4634 * 4635 * Since the v8.4 language applies to the entire register, and 4636 * appears to be backward compatible, use that. 4637 */ 4638 ret = 0; 4639 } else if (ret & HCR_TGE) { 4640 /* These bits are up-to-date as of ARMv8.4. */ 4641 if (ret & HCR_E2H) { 4642 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 4643 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 4644 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 4645 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE); 4646 } else { 4647 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 4648 } 4649 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 4650 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 4651 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 4652 HCR_TLOR); 4653 } 4654 4655 return ret; 4656 } 4657 4658 static const ARMCPRegInfo el2_cp_reginfo[] = { 4659 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 4660 .type = ARM_CP_IO, 4661 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4662 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4663 .writefn = hcr_write }, 4664 { .name = "HCR", .state = ARM_CP_STATE_AA32, 4665 .type = ARM_CP_ALIAS | ARM_CP_IO, 4666 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4667 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 4668 .writefn = hcr_writelow }, 4669 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 4670 .type = ARM_CP_ALIAS, 4671 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 4672 .access = PL2_RW, 4673 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 4674 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4675 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4676 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 4677 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 4678 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 4679 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 4680 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 4681 .type = ARM_CP_ALIAS, 4682 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 4683 .access = PL2_RW, 4684 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 4685 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 4686 .type = ARM_CP_ALIAS, 4687 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 4688 .access = PL2_RW, 4689 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 4690 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4691 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4692 .access = PL2_RW, .writefn = vbar_write, 4693 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 4694 .resetvalue = 0 }, 4695 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 4696 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 4697 .access = PL3_RW, .type = ARM_CP_ALIAS, 4698 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 4699 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4700 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4701 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 4702 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]) }, 4703 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4704 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4705 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 4706 .resetvalue = 0 }, 4707 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4708 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4709 .access = PL2_RW, .type = ARM_CP_ALIAS, 4710 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 4711 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4712 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4713 .access = PL2_RW, .type = ARM_CP_CONST, 4714 .resetvalue = 0 }, 4715 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 4716 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4717 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4718 .access = PL2_RW, .type = ARM_CP_CONST, 4719 .resetvalue = 0 }, 4720 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4721 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4722 .access = PL2_RW, .type = ARM_CP_CONST, 4723 .resetvalue = 0 }, 4724 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4725 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4726 .access = PL2_RW, .type = ARM_CP_CONST, 4727 .resetvalue = 0 }, 4728 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4729 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4730 .access = PL2_RW, 4731 /* no .writefn needed as this can't cause an ASID change; 4732 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4733 */ 4734 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 4735 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 4736 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4737 .type = ARM_CP_ALIAS, 4738 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4739 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4740 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 4741 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4742 .access = PL2_RW, 4743 /* no .writefn needed as this can't cause an ASID change; 4744 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 4745 */ 4746 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 4747 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4748 .cp = 15, .opc1 = 6, .crm = 2, 4749 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4750 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4751 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 4752 .writefn = vttbr_write }, 4753 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4754 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4755 .access = PL2_RW, .writefn = vttbr_write, 4756 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 4757 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4758 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4759 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 4760 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 4761 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4762 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4763 .access = PL2_RW, .resetvalue = 0, 4764 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 4765 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4766 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4767 .access = PL2_RW, .resetvalue = 0, 4768 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4769 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4770 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4771 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 4772 { .name = "TLBIALLNSNH", 4773 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4774 .type = ARM_CP_NO_RAW, .access = PL2_W, 4775 .writefn = tlbiall_nsnh_write }, 4776 { .name = "TLBIALLNSNHIS", 4777 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4778 .type = ARM_CP_NO_RAW, .access = PL2_W, 4779 .writefn = tlbiall_nsnh_is_write }, 4780 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4781 .type = ARM_CP_NO_RAW, .access = PL2_W, 4782 .writefn = tlbiall_hyp_write }, 4783 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4784 .type = ARM_CP_NO_RAW, .access = PL2_W, 4785 .writefn = tlbiall_hyp_is_write }, 4786 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4787 .type = ARM_CP_NO_RAW, .access = PL2_W, 4788 .writefn = tlbimva_hyp_write }, 4789 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4790 .type = ARM_CP_NO_RAW, .access = PL2_W, 4791 .writefn = tlbimva_hyp_is_write }, 4792 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 4793 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 4794 .type = ARM_CP_NO_RAW, .access = PL2_W, 4795 .writefn = tlbi_aa64_alle2_write }, 4796 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 4797 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 4798 .type = ARM_CP_NO_RAW, .access = PL2_W, 4799 .writefn = tlbi_aa64_vae2_write }, 4800 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 4801 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4802 .access = PL2_W, .type = ARM_CP_NO_RAW, 4803 .writefn = tlbi_aa64_vae2_write }, 4804 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 4805 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 4806 .access = PL2_W, .type = ARM_CP_NO_RAW, 4807 .writefn = tlbi_aa64_alle2is_write }, 4808 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 4809 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 4810 .type = ARM_CP_NO_RAW, .access = PL2_W, 4811 .writefn = tlbi_aa64_vae2is_write }, 4812 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 4813 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4814 .access = PL2_W, .type = ARM_CP_NO_RAW, 4815 .writefn = tlbi_aa64_vae2is_write }, 4816 #ifndef CONFIG_USER_ONLY 4817 /* Unlike the other EL2-related AT operations, these must 4818 * UNDEF from EL3 if EL2 is not implemented, which is why we 4819 * define them here rather than with the rest of the AT ops. 4820 */ 4821 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 4822 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4823 .access = PL2_W, .accessfn = at_s1e2_access, 4824 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4825 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 4826 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4827 .access = PL2_W, .accessfn = at_s1e2_access, 4828 .type = ARM_CP_NO_RAW, .writefn = ats_write64 }, 4829 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 4830 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 4831 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 4832 * to behave as if SCR.NS was 1. 4833 */ 4834 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 4835 .access = PL2_W, 4836 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4837 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 4838 .access = PL2_W, 4839 .writefn = ats1h_write, .type = ARM_CP_NO_RAW }, 4840 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4841 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4842 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 4843 * reset values as IMPDEF. We choose to reset to 3 to comply with 4844 * both ARMv7 and ARMv8. 4845 */ 4846 .access = PL2_RW, .resetvalue = 3, 4847 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 4848 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4849 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4850 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 4851 .writefn = gt_cntvoff_write, 4852 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4853 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 4854 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 4855 .writefn = gt_cntvoff_write, 4856 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 4857 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 4858 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 4859 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4860 .type = ARM_CP_IO, .access = PL2_RW, 4861 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4862 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 4863 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 4864 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 4865 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 4866 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 4867 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 4868 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 4869 .resetfn = gt_hyp_timer_reset, 4870 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 4871 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 4872 .type = ARM_CP_IO, 4873 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 4874 .access = PL2_RW, 4875 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 4876 .resetvalue = 0, 4877 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 4878 #endif 4879 /* The only field of MDCR_EL2 that has a defined architectural reset value 4880 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we 4881 * don't implement any PMU event counters, so using zero as a reset 4882 * value for MDCR_EL2 is okay 4883 */ 4884 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 4885 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 4886 .access = PL2_RW, .resetvalue = 0, 4887 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), }, 4888 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 4889 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4890 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4891 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4892 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 4893 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 4894 .access = PL2_RW, 4895 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 4896 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 4897 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 4898 .access = PL2_RW, 4899 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 4900 REGINFO_SENTINEL 4901 }; 4902 4903 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 4904 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 4905 .type = ARM_CP_ALIAS | ARM_CP_IO, 4906 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 4907 .access = PL2_RW, 4908 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 4909 .writefn = hcr_writehigh }, 4910 REGINFO_SENTINEL 4911 }; 4912 4913 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 4914 bool isread) 4915 { 4916 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 4917 * At Secure EL1 it traps to EL3. 4918 */ 4919 if (arm_current_el(env) == 3) { 4920 return CP_ACCESS_OK; 4921 } 4922 if (arm_is_secure_below_el3(env)) { 4923 return CP_ACCESS_TRAP_EL3; 4924 } 4925 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 4926 if (isread) { 4927 return CP_ACCESS_OK; 4928 } 4929 return CP_ACCESS_TRAP_UNCATEGORIZED; 4930 } 4931 4932 static const ARMCPRegInfo el3_cp_reginfo[] = { 4933 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 4934 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 4935 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 4936 .resetvalue = 0, .writefn = scr_write }, 4937 { .name = "SCR", .type = ARM_CP_ALIAS, 4938 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 4939 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4940 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 4941 .writefn = scr_write }, 4942 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 4943 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 4944 .access = PL3_RW, .resetvalue = 0, 4945 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 4946 { .name = "SDER", 4947 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 4948 .access = PL3_RW, .resetvalue = 0, 4949 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 4950 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 4951 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4952 .writefn = vbar_write, .resetvalue = 0, 4953 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 4954 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 4955 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 4956 .access = PL3_RW, .resetvalue = 0, 4957 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 4958 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 4959 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 4960 .access = PL3_RW, 4961 /* no .writefn needed as this can't cause an ASID change; 4962 * we must provide a .raw_writefn and .resetfn because we handle 4963 * reset and migration for the AArch32 TTBCR(S), which might be 4964 * using mask and base_mask. 4965 */ 4966 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write, 4967 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 4968 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 4969 .type = ARM_CP_ALIAS, 4970 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 4971 .access = PL3_RW, 4972 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 4973 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 4974 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 4975 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 4976 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 4977 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 4978 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 4979 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 4980 .type = ARM_CP_ALIAS, 4981 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 4982 .access = PL3_RW, 4983 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 4984 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 4985 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 4986 .access = PL3_RW, .writefn = vbar_write, 4987 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 4988 .resetvalue = 0 }, 4989 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 4990 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 4991 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 4992 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 4993 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 4994 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 4995 .access = PL3_RW, .resetvalue = 0, 4996 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 4997 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 4998 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 4999 .access = PL3_RW, .type = ARM_CP_CONST, 5000 .resetvalue = 0 }, 5001 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 5002 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 5003 .access = PL3_RW, .type = ARM_CP_CONST, 5004 .resetvalue = 0 }, 5005 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 5006 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 5007 .access = PL3_RW, .type = ARM_CP_CONST, 5008 .resetvalue = 0 }, 5009 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 5010 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 5011 .access = PL3_W, .type = ARM_CP_NO_RAW, 5012 .writefn = tlbi_aa64_alle3is_write }, 5013 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 5014 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 5015 .access = PL3_W, .type = ARM_CP_NO_RAW, 5016 .writefn = tlbi_aa64_vae3is_write }, 5017 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 5018 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 5019 .access = PL3_W, .type = ARM_CP_NO_RAW, 5020 .writefn = tlbi_aa64_vae3is_write }, 5021 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 5022 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 5023 .access = PL3_W, .type = ARM_CP_NO_RAW, 5024 .writefn = tlbi_aa64_alle3_write }, 5025 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 5026 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 5027 .access = PL3_W, .type = ARM_CP_NO_RAW, 5028 .writefn = tlbi_aa64_vae3_write }, 5029 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 5030 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 5031 .access = PL3_W, .type = ARM_CP_NO_RAW, 5032 .writefn = tlbi_aa64_vae3_write }, 5033 REGINFO_SENTINEL 5034 }; 5035 5036 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 5037 bool isread) 5038 { 5039 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64, 5040 * but the AArch32 CTR has its own reginfo struct) 5041 */ 5042 if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 5043 return CP_ACCESS_TRAP; 5044 } 5045 return CP_ACCESS_OK; 5046 } 5047 5048 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, 5049 uint64_t value) 5050 { 5051 /* Writes to OSLAR_EL1 may update the OS lock status, which can be 5052 * read via a bit in OSLSR_EL1. 5053 */ 5054 int oslock; 5055 5056 if (ri->state == ARM_CP_STATE_AA32) { 5057 oslock = (value == 0xC5ACCE55); 5058 } else { 5059 oslock = value & 1; 5060 } 5061 5062 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock); 5063 } 5064 5065 static const ARMCPRegInfo debug_cp_reginfo[] = { 5066 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped 5067 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; 5068 * unlike DBGDRAR it is never accessible from EL0. 5069 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64 5070 * accessor. 5071 */ 5072 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, 5073 .access = PL0_R, .accessfn = access_tdra, 5074 .type = ARM_CP_CONST, .resetvalue = 0 }, 5075 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, 5076 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 5077 .access = PL1_R, .accessfn = access_tdra, 5078 .type = ARM_CP_CONST, .resetvalue = 0 }, 5079 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 5080 .access = PL0_R, .accessfn = access_tdra, 5081 .type = ARM_CP_CONST, .resetvalue = 0 }, 5082 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ 5083 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, 5084 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5085 .access = PL1_RW, .accessfn = access_tda, 5086 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), 5087 .resetvalue = 0 }, 5088 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1. 5089 * We don't implement the configurable EL0 access. 5090 */ 5091 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH, 5092 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5093 .type = ARM_CP_ALIAS, 5094 .access = PL1_R, .accessfn = access_tda, 5095 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, 5096 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, 5097 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, 5098 .access = PL1_W, .type = ARM_CP_NO_RAW, 5099 .accessfn = access_tdosa, 5100 .writefn = oslar_write }, 5101 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, 5102 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, 5103 .access = PL1_R, .resetvalue = 10, 5104 .accessfn = access_tdosa, 5105 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, 5106 /* Dummy OSDLR_EL1: 32-bit Linux will read this */ 5107 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, 5108 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, 5109 .access = PL1_RW, .accessfn = access_tdosa, 5110 .type = ARM_CP_NOP }, 5111 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't 5112 * implement vector catch debug events yet. 5113 */ 5114 { .name = "DBGVCR", 5115 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 5116 .access = PL1_RW, .accessfn = access_tda, 5117 .type = ARM_CP_NOP }, 5118 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor 5119 * to save and restore a 32-bit guest's DBGVCR) 5120 */ 5121 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64, 5122 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0, 5123 .access = PL2_RW, .accessfn = access_tda, 5124 .type = ARM_CP_NOP }, 5125 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications 5126 * Channel but Linux may try to access this register. The 32-bit 5127 * alias is DBGDCCINT. 5128 */ 5129 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH, 5130 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5131 .access = PL1_RW, .accessfn = access_tda, 5132 .type = ARM_CP_NOP }, 5133 REGINFO_SENTINEL 5134 }; 5135 5136 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = { 5137 /* 64 bit access versions of the (dummy) debug registers */ 5138 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0, 5139 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5140 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0, 5141 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5142 REGINFO_SENTINEL 5143 }; 5144 5145 /* Return the exception level to which exceptions should be taken 5146 * via SVEAccessTrap. If an exception should be routed through 5147 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should 5148 * take care of raising that exception. 5149 * C.f. the ARM pseudocode function CheckSVEEnabled. 5150 */ 5151 int sve_exception_el(CPUARMState *env, int el) 5152 { 5153 #ifndef CONFIG_USER_ONLY 5154 if (el <= 1) { 5155 bool disabled = false; 5156 5157 /* The CPACR.ZEN controls traps to EL1: 5158 * 0, 2 : trap EL0 and EL1 accesses 5159 * 1 : trap only EL0 accesses 5160 * 3 : trap no accesses 5161 */ 5162 if (!extract32(env->cp15.cpacr_el1, 16, 1)) { 5163 disabled = true; 5164 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) { 5165 disabled = el == 0; 5166 } 5167 if (disabled) { 5168 /* route_to_el2 */ 5169 return (arm_feature(env, ARM_FEATURE_EL2) 5170 && (arm_hcr_el2_eff(env) & HCR_TGE) ? 2 : 1); 5171 } 5172 5173 /* Check CPACR.FPEN. */ 5174 if (!extract32(env->cp15.cpacr_el1, 20, 1)) { 5175 disabled = true; 5176 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) { 5177 disabled = el == 0; 5178 } 5179 if (disabled) { 5180 return 0; 5181 } 5182 } 5183 5184 /* CPTR_EL2. Since TZ and TFP are positive, 5185 * they will be zero when EL2 is not present. 5186 */ 5187 if (el <= 2 && !arm_is_secure_below_el3(env)) { 5188 if (env->cp15.cptr_el[2] & CPTR_TZ) { 5189 return 2; 5190 } 5191 if (env->cp15.cptr_el[2] & CPTR_TFP) { 5192 return 0; 5193 } 5194 } 5195 5196 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 5197 if (arm_feature(env, ARM_FEATURE_EL3) 5198 && !(env->cp15.cptr_el[3] & CPTR_EZ)) { 5199 return 3; 5200 } 5201 #endif 5202 return 0; 5203 } 5204 5205 /* 5206 * Given that SVE is enabled, return the vector length for EL. 5207 */ 5208 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) 5209 { 5210 ARMCPU *cpu = arm_env_get_cpu(env); 5211 uint32_t zcr_len = cpu->sve_max_vq - 1; 5212 5213 if (el <= 1) { 5214 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]); 5215 } 5216 if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) { 5217 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]); 5218 } 5219 if (el < 3 && arm_feature(env, ARM_FEATURE_EL3)) { 5220 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); 5221 } 5222 return zcr_len; 5223 } 5224 5225 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5226 uint64_t value) 5227 { 5228 int cur_el = arm_current_el(env); 5229 int old_len = sve_zcr_len_for_el(env, cur_el); 5230 int new_len; 5231 5232 /* Bits other than [3:0] are RAZ/WI. */ 5233 raw_write(env, ri, value & 0xf); 5234 5235 /* 5236 * Because we arrived here, we know both FP and SVE are enabled; 5237 * otherwise we would have trapped access to the ZCR_ELn register. 5238 */ 5239 new_len = sve_zcr_len_for_el(env, cur_el); 5240 if (new_len < old_len) { 5241 aarch64_sve_narrow_vq(env, new_len + 1); 5242 } 5243 } 5244 5245 static const ARMCPRegInfo zcr_el1_reginfo = { 5246 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 5247 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 5248 .access = PL1_RW, .type = ARM_CP_SVE, 5249 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 5250 .writefn = zcr_write, .raw_writefn = raw_write 5251 }; 5252 5253 static const ARMCPRegInfo zcr_el2_reginfo = { 5254 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5255 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5256 .access = PL2_RW, .type = ARM_CP_SVE, 5257 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 5258 .writefn = zcr_write, .raw_writefn = raw_write 5259 }; 5260 5261 static const ARMCPRegInfo zcr_no_el2_reginfo = { 5262 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5263 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5264 .access = PL2_RW, .type = ARM_CP_SVE, 5265 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore 5266 }; 5267 5268 static const ARMCPRegInfo zcr_el3_reginfo = { 5269 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 5270 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 5271 .access = PL3_RW, .type = ARM_CP_SVE, 5272 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 5273 .writefn = zcr_write, .raw_writefn = raw_write 5274 }; 5275 5276 void hw_watchpoint_update(ARMCPU *cpu, int n) 5277 { 5278 CPUARMState *env = &cpu->env; 5279 vaddr len = 0; 5280 vaddr wvr = env->cp15.dbgwvr[n]; 5281 uint64_t wcr = env->cp15.dbgwcr[n]; 5282 int mask; 5283 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 5284 5285 if (env->cpu_watchpoint[n]) { 5286 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); 5287 env->cpu_watchpoint[n] = NULL; 5288 } 5289 5290 if (!extract64(wcr, 0, 1)) { 5291 /* E bit clear : watchpoint disabled */ 5292 return; 5293 } 5294 5295 switch (extract64(wcr, 3, 2)) { 5296 case 0: 5297 /* LSC 00 is reserved and must behave as if the wp is disabled */ 5298 return; 5299 case 1: 5300 flags |= BP_MEM_READ; 5301 break; 5302 case 2: 5303 flags |= BP_MEM_WRITE; 5304 break; 5305 case 3: 5306 flags |= BP_MEM_ACCESS; 5307 break; 5308 } 5309 5310 /* Attempts to use both MASK and BAS fields simultaneously are 5311 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, 5312 * thus generating a watchpoint for every byte in the masked region. 5313 */ 5314 mask = extract64(wcr, 24, 4); 5315 if (mask == 1 || mask == 2) { 5316 /* Reserved values of MASK; we must act as if the mask value was 5317 * some non-reserved value, or as if the watchpoint were disabled. 5318 * We choose the latter. 5319 */ 5320 return; 5321 } else if (mask) { 5322 /* Watchpoint covers an aligned area up to 2GB in size */ 5323 len = 1ULL << mask; 5324 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE 5325 * whether the watchpoint fires when the unmasked bits match; we opt 5326 * to generate the exceptions. 5327 */ 5328 wvr &= ~(len - 1); 5329 } else { 5330 /* Watchpoint covers bytes defined by the byte address select bits */ 5331 int bas = extract64(wcr, 5, 8); 5332 int basstart; 5333 5334 if (bas == 0) { 5335 /* This must act as if the watchpoint is disabled */ 5336 return; 5337 } 5338 5339 if (extract64(wvr, 2, 1)) { 5340 /* Deprecated case of an only 4-aligned address. BAS[7:4] are 5341 * ignored, and BAS[3:0] define which bytes to watch. 5342 */ 5343 bas &= 0xf; 5344 } 5345 /* The BAS bits are supposed to be programmed to indicate a contiguous 5346 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether 5347 * we fire for each byte in the word/doubleword addressed by the WVR. 5348 * We choose to ignore any non-zero bits after the first range of 1s. 5349 */ 5350 basstart = ctz32(bas); 5351 len = cto32(bas >> basstart); 5352 wvr += basstart; 5353 } 5354 5355 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, 5356 &env->cpu_watchpoint[n]); 5357 } 5358 5359 void hw_watchpoint_update_all(ARMCPU *cpu) 5360 { 5361 int i; 5362 CPUARMState *env = &cpu->env; 5363 5364 /* Completely clear out existing QEMU watchpoints and our array, to 5365 * avoid possible stale entries following migration load. 5366 */ 5367 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); 5368 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); 5369 5370 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { 5371 hw_watchpoint_update(cpu, i); 5372 } 5373 } 5374 5375 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5376 uint64_t value) 5377 { 5378 ARMCPU *cpu = arm_env_get_cpu(env); 5379 int i = ri->crm; 5380 5381 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the 5382 * register reads and behaves as if values written are sign extended. 5383 * Bits [1:0] are RES0. 5384 */ 5385 value = sextract64(value, 0, 49) & ~3ULL; 5386 5387 raw_write(env, ri, value); 5388 hw_watchpoint_update(cpu, i); 5389 } 5390 5391 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5392 uint64_t value) 5393 { 5394 ARMCPU *cpu = arm_env_get_cpu(env); 5395 int i = ri->crm; 5396 5397 raw_write(env, ri, value); 5398 hw_watchpoint_update(cpu, i); 5399 } 5400 5401 void hw_breakpoint_update(ARMCPU *cpu, int n) 5402 { 5403 CPUARMState *env = &cpu->env; 5404 uint64_t bvr = env->cp15.dbgbvr[n]; 5405 uint64_t bcr = env->cp15.dbgbcr[n]; 5406 vaddr addr; 5407 int bt; 5408 int flags = BP_CPU; 5409 5410 if (env->cpu_breakpoint[n]) { 5411 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); 5412 env->cpu_breakpoint[n] = NULL; 5413 } 5414 5415 if (!extract64(bcr, 0, 1)) { 5416 /* E bit clear : watchpoint disabled */ 5417 return; 5418 } 5419 5420 bt = extract64(bcr, 20, 4); 5421 5422 switch (bt) { 5423 case 4: /* unlinked address mismatch (reserved if AArch64) */ 5424 case 5: /* linked address mismatch (reserved if AArch64) */ 5425 qemu_log_mask(LOG_UNIMP, 5426 "arm: address mismatch breakpoint types not implemented\n"); 5427 return; 5428 case 0: /* unlinked address match */ 5429 case 1: /* linked address match */ 5430 { 5431 /* Bits [63:49] are hardwired to the value of bit [48]; that is, 5432 * we behave as if the register was sign extended. Bits [1:0] are 5433 * RES0. The BAS field is used to allow setting breakpoints on 16 5434 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether 5435 * a bp will fire if the addresses covered by the bp and the addresses 5436 * covered by the insn overlap but the insn doesn't start at the 5437 * start of the bp address range. We choose to require the insn and 5438 * the bp to have the same address. The constraints on writing to 5439 * BAS enforced in dbgbcr_write mean we have only four cases: 5440 * 0b0000 => no breakpoint 5441 * 0b0011 => breakpoint on addr 5442 * 0b1100 => breakpoint on addr + 2 5443 * 0b1111 => breakpoint on addr 5444 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). 5445 */ 5446 int bas = extract64(bcr, 5, 4); 5447 addr = sextract64(bvr, 0, 49) & ~3ULL; 5448 if (bas == 0) { 5449 return; 5450 } 5451 if (bas == 0xc) { 5452 addr += 2; 5453 } 5454 break; 5455 } 5456 case 2: /* unlinked context ID match */ 5457 case 8: /* unlinked VMID match (reserved if no EL2) */ 5458 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ 5459 qemu_log_mask(LOG_UNIMP, 5460 "arm: unlinked context breakpoint types not implemented\n"); 5461 return; 5462 case 9: /* linked VMID match (reserved if no EL2) */ 5463 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 5464 case 3: /* linked context ID match */ 5465 default: 5466 /* We must generate no events for Linked context matches (unless 5467 * they are linked to by some other bp/wp, which is handled in 5468 * updates for the linking bp/wp). We choose to also generate no events 5469 * for reserved values. 5470 */ 5471 return; 5472 } 5473 5474 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); 5475 } 5476 5477 void hw_breakpoint_update_all(ARMCPU *cpu) 5478 { 5479 int i; 5480 CPUARMState *env = &cpu->env; 5481 5482 /* Completely clear out existing QEMU breakpoints and our array, to 5483 * avoid possible stale entries following migration load. 5484 */ 5485 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); 5486 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); 5487 5488 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { 5489 hw_breakpoint_update(cpu, i); 5490 } 5491 } 5492 5493 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5494 uint64_t value) 5495 { 5496 ARMCPU *cpu = arm_env_get_cpu(env); 5497 int i = ri->crm; 5498 5499 raw_write(env, ri, value); 5500 hw_breakpoint_update(cpu, i); 5501 } 5502 5503 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5504 uint64_t value) 5505 { 5506 ARMCPU *cpu = arm_env_get_cpu(env); 5507 int i = ri->crm; 5508 5509 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only 5510 * copy of BAS[0]. 5511 */ 5512 value = deposit64(value, 6, 1, extract64(value, 5, 1)); 5513 value = deposit64(value, 8, 1, extract64(value, 7, 1)); 5514 5515 raw_write(env, ri, value); 5516 hw_breakpoint_update(cpu, i); 5517 } 5518 5519 static void define_debug_regs(ARMCPU *cpu) 5520 { 5521 /* Define v7 and v8 architectural debug registers. 5522 * These are just dummy implementations for now. 5523 */ 5524 int i; 5525 int wrps, brps, ctx_cmps; 5526 ARMCPRegInfo dbgdidr = { 5527 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 5528 .access = PL0_R, .accessfn = access_tda, 5529 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, 5530 }; 5531 5532 /* Note that all these register fields hold "number of Xs minus 1". */ 5533 brps = extract32(cpu->dbgdidr, 24, 4); 5534 wrps = extract32(cpu->dbgdidr, 28, 4); 5535 ctx_cmps = extract32(cpu->dbgdidr, 20, 4); 5536 5537 assert(ctx_cmps <= brps); 5538 5539 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties 5540 * of the debug registers such as number of breakpoints; 5541 * check that if they both exist then they agree. 5542 */ 5543 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 5544 assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps); 5545 assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps); 5546 assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps); 5547 } 5548 5549 define_one_arm_cp_reg(cpu, &dbgdidr); 5550 define_arm_cp_regs(cpu, debug_cp_reginfo); 5551 5552 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { 5553 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); 5554 } 5555 5556 for (i = 0; i < brps + 1; i++) { 5557 ARMCPRegInfo dbgregs[] = { 5558 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH, 5559 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, 5560 .access = PL1_RW, .accessfn = access_tda, 5561 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), 5562 .writefn = dbgbvr_write, .raw_writefn = raw_write 5563 }, 5564 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH, 5565 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, 5566 .access = PL1_RW, .accessfn = access_tda, 5567 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), 5568 .writefn = dbgbcr_write, .raw_writefn = raw_write 5569 }, 5570 REGINFO_SENTINEL 5571 }; 5572 define_arm_cp_regs(cpu, dbgregs); 5573 } 5574 5575 for (i = 0; i < wrps + 1; i++) { 5576 ARMCPRegInfo dbgregs[] = { 5577 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH, 5578 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, 5579 .access = PL1_RW, .accessfn = access_tda, 5580 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), 5581 .writefn = dbgwvr_write, .raw_writefn = raw_write 5582 }, 5583 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH, 5584 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, 5585 .access = PL1_RW, .accessfn = access_tda, 5586 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), 5587 .writefn = dbgwcr_write, .raw_writefn = raw_write 5588 }, 5589 REGINFO_SENTINEL 5590 }; 5591 define_arm_cp_regs(cpu, dbgregs); 5592 } 5593 } 5594 5595 /* We don't know until after realize whether there's a GICv3 5596 * attached, and that is what registers the gicv3 sysregs. 5597 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 5598 * at runtime. 5599 */ 5600 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 5601 { 5602 ARMCPU *cpu = arm_env_get_cpu(env); 5603 uint64_t pfr1 = cpu->id_pfr1; 5604 5605 if (env->gicv3state) { 5606 pfr1 |= 1 << 28; 5607 } 5608 return pfr1; 5609 } 5610 5611 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 5612 { 5613 ARMCPU *cpu = arm_env_get_cpu(env); 5614 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 5615 5616 if (env->gicv3state) { 5617 pfr0 |= 1 << 24; 5618 } 5619 return pfr0; 5620 } 5621 5622 /* Shared logic between LORID and the rest of the LOR* registers. 5623 * Secure state has already been delt with. 5624 */ 5625 static CPAccessResult access_lor_ns(CPUARMState *env) 5626 { 5627 int el = arm_current_el(env); 5628 5629 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 5630 return CP_ACCESS_TRAP_EL2; 5631 } 5632 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 5633 return CP_ACCESS_TRAP_EL3; 5634 } 5635 return CP_ACCESS_OK; 5636 } 5637 5638 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri, 5639 bool isread) 5640 { 5641 if (arm_is_secure_below_el3(env)) { 5642 /* Access ok in secure mode. */ 5643 return CP_ACCESS_OK; 5644 } 5645 return access_lor_ns(env); 5646 } 5647 5648 static CPAccessResult access_lor_other(CPUARMState *env, 5649 const ARMCPRegInfo *ri, bool isread) 5650 { 5651 if (arm_is_secure_below_el3(env)) { 5652 /* Access denied in secure mode. */ 5653 return CP_ACCESS_TRAP; 5654 } 5655 return access_lor_ns(env); 5656 } 5657 5658 #ifdef TARGET_AARCH64 5659 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 5660 bool isread) 5661 { 5662 int el = arm_current_el(env); 5663 5664 if (el < 2 && 5665 arm_feature(env, ARM_FEATURE_EL2) && 5666 !(arm_hcr_el2_eff(env) & HCR_APK)) { 5667 return CP_ACCESS_TRAP_EL2; 5668 } 5669 if (el < 3 && 5670 arm_feature(env, ARM_FEATURE_EL3) && 5671 !(env->cp15.scr_el3 & SCR_APK)) { 5672 return CP_ACCESS_TRAP_EL3; 5673 } 5674 return CP_ACCESS_OK; 5675 } 5676 5677 static const ARMCPRegInfo pauth_reginfo[] = { 5678 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5679 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 5680 .access = PL1_RW, .accessfn = access_pauth, 5681 .fieldoffset = offsetof(CPUARMState, apda_key.lo) }, 5682 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5683 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 5684 .access = PL1_RW, .accessfn = access_pauth, 5685 .fieldoffset = offsetof(CPUARMState, apda_key.hi) }, 5686 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5687 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 5688 .access = PL1_RW, .accessfn = access_pauth, 5689 .fieldoffset = offsetof(CPUARMState, apdb_key.lo) }, 5690 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5691 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 5692 .access = PL1_RW, .accessfn = access_pauth, 5693 .fieldoffset = offsetof(CPUARMState, apdb_key.hi) }, 5694 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5695 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 5696 .access = PL1_RW, .accessfn = access_pauth, 5697 .fieldoffset = offsetof(CPUARMState, apga_key.lo) }, 5698 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5699 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 5700 .access = PL1_RW, .accessfn = access_pauth, 5701 .fieldoffset = offsetof(CPUARMState, apga_key.hi) }, 5702 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5703 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 5704 .access = PL1_RW, .accessfn = access_pauth, 5705 .fieldoffset = offsetof(CPUARMState, apia_key.lo) }, 5706 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5707 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 5708 .access = PL1_RW, .accessfn = access_pauth, 5709 .fieldoffset = offsetof(CPUARMState, apia_key.hi) }, 5710 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 5711 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 5712 .access = PL1_RW, .accessfn = access_pauth, 5713 .fieldoffset = offsetof(CPUARMState, apib_key.lo) }, 5714 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 5715 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 5716 .access = PL1_RW, .accessfn = access_pauth, 5717 .fieldoffset = offsetof(CPUARMState, apib_key.hi) }, 5718 REGINFO_SENTINEL 5719 }; 5720 #endif 5721 5722 void register_cp_regs_for_features(ARMCPU *cpu) 5723 { 5724 /* Register all the coprocessor registers based on feature bits */ 5725 CPUARMState *env = &cpu->env; 5726 if (arm_feature(env, ARM_FEATURE_M)) { 5727 /* M profile has no coprocessor registers */ 5728 return; 5729 } 5730 5731 define_arm_cp_regs(cpu, cp_reginfo); 5732 if (!arm_feature(env, ARM_FEATURE_V8)) { 5733 /* Must go early as it is full of wildcards that may be 5734 * overridden by later definitions. 5735 */ 5736 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 5737 } 5738 5739 if (arm_feature(env, ARM_FEATURE_V6)) { 5740 /* The ID registers all have impdef reset values */ 5741 ARMCPRegInfo v6_idregs[] = { 5742 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 5743 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5744 .access = PL1_R, .type = ARM_CP_CONST, 5745 .resetvalue = cpu->id_pfr0 }, 5746 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know 5747 * the value of the GIC field until after we define these regs. 5748 */ 5749 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 5750 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 5751 .access = PL1_R, .type = ARM_CP_NO_RAW, 5752 .readfn = id_pfr1_read, 5753 .writefn = arm_cp_write_ignore }, 5754 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 5755 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 5756 .access = PL1_R, .type = ARM_CP_CONST, 5757 .resetvalue = cpu->id_dfr0 }, 5758 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 5759 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 5760 .access = PL1_R, .type = ARM_CP_CONST, 5761 .resetvalue = cpu->id_afr0 }, 5762 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 5763 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 5764 .access = PL1_R, .type = ARM_CP_CONST, 5765 .resetvalue = cpu->id_mmfr0 }, 5766 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 5767 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 5768 .access = PL1_R, .type = ARM_CP_CONST, 5769 .resetvalue = cpu->id_mmfr1 }, 5770 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 5771 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 5772 .access = PL1_R, .type = ARM_CP_CONST, 5773 .resetvalue = cpu->id_mmfr2 }, 5774 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 5775 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 5776 .access = PL1_R, .type = ARM_CP_CONST, 5777 .resetvalue = cpu->id_mmfr3 }, 5778 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 5779 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5780 .access = PL1_R, .type = ARM_CP_CONST, 5781 .resetvalue = cpu->isar.id_isar0 }, 5782 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 5783 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 5784 .access = PL1_R, .type = ARM_CP_CONST, 5785 .resetvalue = cpu->isar.id_isar1 }, 5786 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 5787 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5788 .access = PL1_R, .type = ARM_CP_CONST, 5789 .resetvalue = cpu->isar.id_isar2 }, 5790 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 5791 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 5792 .access = PL1_R, .type = ARM_CP_CONST, 5793 .resetvalue = cpu->isar.id_isar3 }, 5794 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 5795 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 5796 .access = PL1_R, .type = ARM_CP_CONST, 5797 .resetvalue = cpu->isar.id_isar4 }, 5798 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 5799 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 5800 .access = PL1_R, .type = ARM_CP_CONST, 5801 .resetvalue = cpu->isar.id_isar5 }, 5802 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 5803 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 5804 .access = PL1_R, .type = ARM_CP_CONST, 5805 .resetvalue = cpu->id_mmfr4 }, 5806 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 5807 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 5808 .access = PL1_R, .type = ARM_CP_CONST, 5809 .resetvalue = cpu->isar.id_isar6 }, 5810 REGINFO_SENTINEL 5811 }; 5812 define_arm_cp_regs(cpu, v6_idregs); 5813 define_arm_cp_regs(cpu, v6_cp_reginfo); 5814 } else { 5815 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 5816 } 5817 if (arm_feature(env, ARM_FEATURE_V6K)) { 5818 define_arm_cp_regs(cpu, v6k_cp_reginfo); 5819 } 5820 if (arm_feature(env, ARM_FEATURE_V7MP) && 5821 !arm_feature(env, ARM_FEATURE_PMSA)) { 5822 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 5823 } 5824 if (arm_feature(env, ARM_FEATURE_V7VE)) { 5825 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 5826 } 5827 if (arm_feature(env, ARM_FEATURE_V7)) { 5828 /* v7 performance monitor control register: same implementor 5829 * field as main ID register, and we implement four counters in 5830 * addition to the cycle count register. 5831 */ 5832 unsigned int i, pmcrn = 4; 5833 ARMCPRegInfo pmcr = { 5834 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 5835 .access = PL0_RW, 5836 .type = ARM_CP_IO | ARM_CP_ALIAS, 5837 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 5838 .accessfn = pmreg_access, .writefn = pmcr_write, 5839 .raw_writefn = raw_write, 5840 }; 5841 ARMCPRegInfo pmcr64 = { 5842 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 5843 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 5844 .access = PL0_RW, .accessfn = pmreg_access, 5845 .type = ARM_CP_IO, 5846 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 5847 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT), 5848 .writefn = pmcr_write, .raw_writefn = raw_write, 5849 }; 5850 define_one_arm_cp_reg(cpu, &pmcr); 5851 define_one_arm_cp_reg(cpu, &pmcr64); 5852 for (i = 0; i < pmcrn; i++) { 5853 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 5854 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 5855 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 5856 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 5857 ARMCPRegInfo pmev_regs[] = { 5858 { .name = pmevcntr_name, .cp = 15, .crn = 15, 5859 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 5860 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 5861 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 5862 .accessfn = pmreg_access }, 5863 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 5864 .opc0 = 3, .opc1 = 3, .crn = 15, .crm = 8 | (3 & (i >> 3)), 5865 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 5866 .type = ARM_CP_IO, 5867 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 5868 .raw_readfn = pmevcntr_rawread, 5869 .raw_writefn = pmevcntr_rawwrite }, 5870 { .name = pmevtyper_name, .cp = 15, .crn = 15, 5871 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 5872 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 5873 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 5874 .accessfn = pmreg_access }, 5875 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 5876 .opc0 = 3, .opc1 = 3, .crn = 15, .crm = 12 | (3 & (i >> 3)), 5877 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 5878 .type = ARM_CP_IO, 5879 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 5880 .raw_writefn = pmevtyper_rawwrite }, 5881 REGINFO_SENTINEL 5882 }; 5883 define_arm_cp_regs(cpu, pmev_regs); 5884 g_free(pmevcntr_name); 5885 g_free(pmevcntr_el0_name); 5886 g_free(pmevtyper_name); 5887 g_free(pmevtyper_el0_name); 5888 } 5889 ARMCPRegInfo clidr = { 5890 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 5891 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 5892 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr 5893 }; 5894 define_one_arm_cp_reg(cpu, &clidr); 5895 define_arm_cp_regs(cpu, v7_cp_reginfo); 5896 define_debug_regs(cpu); 5897 } else { 5898 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 5899 } 5900 if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 && 5901 FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) { 5902 ARMCPRegInfo v81_pmu_regs[] = { 5903 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 5904 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 5905 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5906 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 5907 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 5908 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 5909 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 5910 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 5911 REGINFO_SENTINEL 5912 }; 5913 define_arm_cp_regs(cpu, v81_pmu_regs); 5914 } 5915 if (arm_feature(env, ARM_FEATURE_V8)) { 5916 /* AArch64 ID registers, which all have impdef reset values. 5917 * Note that within the ID register ranges the unused slots 5918 * must all RAZ, not UNDEF; future architecture versions may 5919 * define new registers here. 5920 */ 5921 ARMCPRegInfo v8_idregs[] = { 5922 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't 5923 * know the right value for the GIC field until after we 5924 * define these regs. 5925 */ 5926 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 5927 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 5928 .access = PL1_R, .type = ARM_CP_NO_RAW, 5929 .readfn = id_aa64pfr0_read, 5930 .writefn = arm_cp_write_ignore }, 5931 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 5932 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 5933 .access = PL1_R, .type = ARM_CP_CONST, 5934 .resetvalue = cpu->isar.id_aa64pfr1}, 5935 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5936 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 5937 .access = PL1_R, .type = ARM_CP_CONST, 5938 .resetvalue = 0 }, 5939 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5940 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 5941 .access = PL1_R, .type = ARM_CP_CONST, 5942 .resetvalue = 0 }, 5943 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 5944 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 5945 .access = PL1_R, .type = ARM_CP_CONST, 5946 /* At present, only SVEver == 0 is defined anyway. */ 5947 .resetvalue = 0 }, 5948 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5949 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 5950 .access = PL1_R, .type = ARM_CP_CONST, 5951 .resetvalue = 0 }, 5952 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5953 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 5954 .access = PL1_R, .type = ARM_CP_CONST, 5955 .resetvalue = 0 }, 5956 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5957 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 5958 .access = PL1_R, .type = ARM_CP_CONST, 5959 .resetvalue = 0 }, 5960 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 5961 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 5962 .access = PL1_R, .type = ARM_CP_CONST, 5963 .resetvalue = cpu->id_aa64dfr0 }, 5964 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 5965 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 5966 .access = PL1_R, .type = ARM_CP_CONST, 5967 .resetvalue = cpu->id_aa64dfr1 }, 5968 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5969 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 5970 .access = PL1_R, .type = ARM_CP_CONST, 5971 .resetvalue = 0 }, 5972 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5973 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 5974 .access = PL1_R, .type = ARM_CP_CONST, 5975 .resetvalue = 0 }, 5976 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 5977 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 5978 .access = PL1_R, .type = ARM_CP_CONST, 5979 .resetvalue = cpu->id_aa64afr0 }, 5980 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 5981 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 5982 .access = PL1_R, .type = ARM_CP_CONST, 5983 .resetvalue = cpu->id_aa64afr1 }, 5984 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5985 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 5986 .access = PL1_R, .type = ARM_CP_CONST, 5987 .resetvalue = 0 }, 5988 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 5989 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 5990 .access = PL1_R, .type = ARM_CP_CONST, 5991 .resetvalue = 0 }, 5992 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 5993 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 5994 .access = PL1_R, .type = ARM_CP_CONST, 5995 .resetvalue = cpu->isar.id_aa64isar0 }, 5996 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 5997 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 5998 .access = PL1_R, .type = ARM_CP_CONST, 5999 .resetvalue = cpu->isar.id_aa64isar1 }, 6000 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6001 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 6002 .access = PL1_R, .type = ARM_CP_CONST, 6003 .resetvalue = 0 }, 6004 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6005 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 6006 .access = PL1_R, .type = ARM_CP_CONST, 6007 .resetvalue = 0 }, 6008 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6009 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 6010 .access = PL1_R, .type = ARM_CP_CONST, 6011 .resetvalue = 0 }, 6012 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6013 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 6014 .access = PL1_R, .type = ARM_CP_CONST, 6015 .resetvalue = 0 }, 6016 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6017 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 6018 .access = PL1_R, .type = ARM_CP_CONST, 6019 .resetvalue = 0 }, 6020 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6021 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 6022 .access = PL1_R, .type = ARM_CP_CONST, 6023 .resetvalue = 0 }, 6024 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 6025 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 6026 .access = PL1_R, .type = ARM_CP_CONST, 6027 .resetvalue = cpu->isar.id_aa64mmfr0 }, 6028 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 6029 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 6030 .access = PL1_R, .type = ARM_CP_CONST, 6031 .resetvalue = cpu->isar.id_aa64mmfr1 }, 6032 { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6033 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 6034 .access = PL1_R, .type = ARM_CP_CONST, 6035 .resetvalue = 0 }, 6036 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6037 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 6038 .access = PL1_R, .type = ARM_CP_CONST, 6039 .resetvalue = 0 }, 6040 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6041 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 6042 .access = PL1_R, .type = ARM_CP_CONST, 6043 .resetvalue = 0 }, 6044 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6045 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 6046 .access = PL1_R, .type = ARM_CP_CONST, 6047 .resetvalue = 0 }, 6048 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6049 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 6050 .access = PL1_R, .type = ARM_CP_CONST, 6051 .resetvalue = 0 }, 6052 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6053 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 6054 .access = PL1_R, .type = ARM_CP_CONST, 6055 .resetvalue = 0 }, 6056 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 6057 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 6058 .access = PL1_R, .type = ARM_CP_CONST, 6059 .resetvalue = cpu->isar.mvfr0 }, 6060 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 6061 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 6062 .access = PL1_R, .type = ARM_CP_CONST, 6063 .resetvalue = cpu->isar.mvfr1 }, 6064 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 6065 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 6066 .access = PL1_R, .type = ARM_CP_CONST, 6067 .resetvalue = cpu->isar.mvfr2 }, 6068 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6069 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 6070 .access = PL1_R, .type = ARM_CP_CONST, 6071 .resetvalue = 0 }, 6072 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6073 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 6074 .access = PL1_R, .type = ARM_CP_CONST, 6075 .resetvalue = 0 }, 6076 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6077 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 6078 .access = PL1_R, .type = ARM_CP_CONST, 6079 .resetvalue = 0 }, 6080 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6081 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 6082 .access = PL1_R, .type = ARM_CP_CONST, 6083 .resetvalue = 0 }, 6084 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6085 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 6086 .access = PL1_R, .type = ARM_CP_CONST, 6087 .resetvalue = 0 }, 6088 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 6089 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 6090 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6091 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 6092 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 6093 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 6094 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6095 .resetvalue = cpu->pmceid0 }, 6096 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 6097 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 6098 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6099 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 6100 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 6101 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 6102 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6103 .resetvalue = cpu->pmceid1 }, 6104 REGINFO_SENTINEL 6105 }; 6106 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ 6107 if (!arm_feature(env, ARM_FEATURE_EL3) && 6108 !arm_feature(env, ARM_FEATURE_EL2)) { 6109 ARMCPRegInfo rvbar = { 6110 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64, 6111 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 6112 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar 6113 }; 6114 define_one_arm_cp_reg(cpu, &rvbar); 6115 } 6116 define_arm_cp_regs(cpu, v8_idregs); 6117 define_arm_cp_regs(cpu, v8_cp_reginfo); 6118 } 6119 if (arm_feature(env, ARM_FEATURE_EL2)) { 6120 uint64_t vmpidr_def = mpidr_read_val(env); 6121 ARMCPRegInfo vpidr_regs[] = { 6122 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 6123 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6124 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6125 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS, 6126 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 6127 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 6128 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6129 .access = PL2_RW, .resetvalue = cpu->midr, 6130 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6131 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 6132 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6133 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6134 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS, 6135 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 6136 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 6137 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6138 .access = PL2_RW, 6139 .resetvalue = vmpidr_def, 6140 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 6141 REGINFO_SENTINEL 6142 }; 6143 define_arm_cp_regs(cpu, vpidr_regs); 6144 define_arm_cp_regs(cpu, el2_cp_reginfo); 6145 if (arm_feature(env, ARM_FEATURE_V8)) { 6146 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 6147 } 6148 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */ 6149 if (!arm_feature(env, ARM_FEATURE_EL3)) { 6150 ARMCPRegInfo rvbar = { 6151 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 6152 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 6153 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar 6154 }; 6155 define_one_arm_cp_reg(cpu, &rvbar); 6156 } 6157 } else { 6158 /* If EL2 is missing but higher ELs are enabled, we need to 6159 * register the no_el2 reginfos. 6160 */ 6161 if (arm_feature(env, ARM_FEATURE_EL3)) { 6162 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value 6163 * of MIDR_EL1 and MPIDR_EL1. 6164 */ 6165 ARMCPRegInfo vpidr_regs[] = { 6166 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6167 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 6168 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6169 .type = ARM_CP_CONST, .resetvalue = cpu->midr, 6170 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 6171 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6172 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 6173 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 6174 .type = ARM_CP_NO_RAW, 6175 .writefn = arm_cp_write_ignore, .readfn = mpidr_read }, 6176 REGINFO_SENTINEL 6177 }; 6178 define_arm_cp_regs(cpu, vpidr_regs); 6179 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo); 6180 if (arm_feature(env, ARM_FEATURE_V8)) { 6181 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo); 6182 } 6183 } 6184 } 6185 if (arm_feature(env, ARM_FEATURE_EL3)) { 6186 define_arm_cp_regs(cpu, el3_cp_reginfo); 6187 ARMCPRegInfo el3_regs[] = { 6188 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 6189 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 6190 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar }, 6191 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 6192 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 6193 .access = PL3_RW, 6194 .raw_writefn = raw_write, .writefn = sctlr_write, 6195 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 6196 .resetvalue = cpu->reset_sctlr }, 6197 REGINFO_SENTINEL 6198 }; 6199 6200 define_arm_cp_regs(cpu, el3_regs); 6201 } 6202 /* The behaviour of NSACR is sufficiently various that we don't 6203 * try to describe it in a single reginfo: 6204 * if EL3 is 64 bit, then trap to EL3 from S EL1, 6205 * reads as constant 0xc00 from NS EL1 and NS EL2 6206 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 6207 * if v7 without EL3, register doesn't exist 6208 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 6209 */ 6210 if (arm_feature(env, ARM_FEATURE_EL3)) { 6211 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6212 ARMCPRegInfo nsacr = { 6213 .name = "NSACR", .type = ARM_CP_CONST, 6214 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6215 .access = PL1_RW, .accessfn = nsacr_access, 6216 .resetvalue = 0xc00 6217 }; 6218 define_one_arm_cp_reg(cpu, &nsacr); 6219 } else { 6220 ARMCPRegInfo nsacr = { 6221 .name = "NSACR", 6222 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6223 .access = PL3_RW | PL1_R, 6224 .resetvalue = 0, 6225 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 6226 }; 6227 define_one_arm_cp_reg(cpu, &nsacr); 6228 } 6229 } else { 6230 if (arm_feature(env, ARM_FEATURE_V8)) { 6231 ARMCPRegInfo nsacr = { 6232 .name = "NSACR", .type = ARM_CP_CONST, 6233 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 6234 .access = PL1_R, 6235 .resetvalue = 0xc00 6236 }; 6237 define_one_arm_cp_reg(cpu, &nsacr); 6238 } 6239 } 6240 6241 if (arm_feature(env, ARM_FEATURE_PMSA)) { 6242 if (arm_feature(env, ARM_FEATURE_V6)) { 6243 /* PMSAv6 not implemented */ 6244 assert(arm_feature(env, ARM_FEATURE_V7)); 6245 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6246 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 6247 } else { 6248 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 6249 } 6250 } else { 6251 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 6252 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 6253 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */ 6254 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) { 6255 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 6256 } 6257 } 6258 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 6259 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 6260 } 6261 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 6262 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 6263 } 6264 if (arm_feature(env, ARM_FEATURE_VAPA)) { 6265 define_arm_cp_regs(cpu, vapa_cp_reginfo); 6266 } 6267 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 6268 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 6269 } 6270 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 6271 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 6272 } 6273 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 6274 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 6275 } 6276 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 6277 define_arm_cp_regs(cpu, omap_cp_reginfo); 6278 } 6279 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 6280 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 6281 } 6282 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6283 define_arm_cp_regs(cpu, xscale_cp_reginfo); 6284 } 6285 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 6286 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 6287 } 6288 if (arm_feature(env, ARM_FEATURE_LPAE)) { 6289 define_arm_cp_regs(cpu, lpae_cp_reginfo); 6290 } 6291 /* Slightly awkwardly, the OMAP and StrongARM cores need all of 6292 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 6293 * be read-only (ie write causes UNDEF exception). 6294 */ 6295 { 6296 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 6297 /* Pre-v8 MIDR space. 6298 * Note that the MIDR isn't a simple constant register because 6299 * of the TI925 behaviour where writes to another register can 6300 * cause the MIDR value to change. 6301 * 6302 * Unimplemented registers in the c15 0 0 0 space default to 6303 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 6304 * and friends override accordingly. 6305 */ 6306 { .name = "MIDR", 6307 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 6308 .access = PL1_R, .resetvalue = cpu->midr, 6309 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 6310 .readfn = midr_read, 6311 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6312 .type = ARM_CP_OVERRIDE }, 6313 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 6314 { .name = "DUMMY", 6315 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 6316 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6317 { .name = "DUMMY", 6318 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 6319 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6320 { .name = "DUMMY", 6321 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 6322 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6323 { .name = "DUMMY", 6324 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 6325 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6326 { .name = "DUMMY", 6327 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 6328 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6329 REGINFO_SENTINEL 6330 }; 6331 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 6332 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 6333 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 6334 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 6335 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 6336 .readfn = midr_read }, 6337 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */ 6338 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6339 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6340 .access = PL1_R, .resetvalue = cpu->midr }, 6341 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 6342 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 6343 .access = PL1_R, .resetvalue = cpu->midr }, 6344 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 6345 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 6346 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 6347 REGINFO_SENTINEL 6348 }; 6349 ARMCPRegInfo id_cp_reginfo[] = { 6350 /* These are common to v8 and pre-v8 */ 6351 { .name = "CTR", 6352 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 6353 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6354 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 6355 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 6356 .access = PL0_R, .accessfn = ctr_el0_access, 6357 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 6358 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 6359 { .name = "TCMTR", 6360 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 6361 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 6362 REGINFO_SENTINEL 6363 }; 6364 /* TLBTR is specific to VMSA */ 6365 ARMCPRegInfo id_tlbtr_reginfo = { 6366 .name = "TLBTR", 6367 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 6368 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0, 6369 }; 6370 /* MPUIR is specific to PMSA V6+ */ 6371 ARMCPRegInfo id_mpuir_reginfo = { 6372 .name = "MPUIR", 6373 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 6374 .access = PL1_R, .type = ARM_CP_CONST, 6375 .resetvalue = cpu->pmsav7_dregion << 8 6376 }; 6377 ARMCPRegInfo crn0_wi_reginfo = { 6378 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 6379 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 6380 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 6381 }; 6382 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 6383 arm_feature(env, ARM_FEATURE_STRONGARM)) { 6384 ARMCPRegInfo *r; 6385 /* Register the blanket "writes ignored" value first to cover the 6386 * whole space. Then update the specific ID registers to allow write 6387 * access, so that they ignore writes rather than causing them to 6388 * UNDEF. 6389 */ 6390 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 6391 for (r = id_pre_v8_midr_cp_reginfo; 6392 r->type != ARM_CP_SENTINEL; r++) { 6393 r->access = PL1_RW; 6394 } 6395 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) { 6396 r->access = PL1_RW; 6397 } 6398 id_mpuir_reginfo.access = PL1_RW; 6399 id_tlbtr_reginfo.access = PL1_RW; 6400 } 6401 if (arm_feature(env, ARM_FEATURE_V8)) { 6402 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 6403 } else { 6404 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 6405 } 6406 define_arm_cp_regs(cpu, id_cp_reginfo); 6407 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 6408 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 6409 } else if (arm_feature(env, ARM_FEATURE_V7)) { 6410 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 6411 } 6412 } 6413 6414 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 6415 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 6416 } 6417 6418 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 6419 ARMCPRegInfo auxcr_reginfo[] = { 6420 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 6421 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 6422 .access = PL1_RW, .type = ARM_CP_CONST, 6423 .resetvalue = cpu->reset_auxcr }, 6424 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 6425 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 6426 .access = PL2_RW, .type = ARM_CP_CONST, 6427 .resetvalue = 0 }, 6428 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 6429 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 6430 .access = PL3_RW, .type = ARM_CP_CONST, 6431 .resetvalue = 0 }, 6432 REGINFO_SENTINEL 6433 }; 6434 define_arm_cp_regs(cpu, auxcr_reginfo); 6435 if (arm_feature(env, ARM_FEATURE_V8)) { 6436 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */ 6437 ARMCPRegInfo hactlr2_reginfo = { 6438 .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 6439 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 6440 .access = PL2_RW, .type = ARM_CP_CONST, 6441 .resetvalue = 0 6442 }; 6443 define_one_arm_cp_reg(cpu, &hactlr2_reginfo); 6444 } 6445 } 6446 6447 if (arm_feature(env, ARM_FEATURE_CBAR)) { 6448 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6449 /* 32 bit view is [31:18] 0...0 [43:32]. */ 6450 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 6451 | extract64(cpu->reset_cbar, 32, 12); 6452 ARMCPRegInfo cbar_reginfo[] = { 6453 { .name = "CBAR", 6454 .type = ARM_CP_CONST, 6455 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6456 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 6457 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 6458 .type = ARM_CP_CONST, 6459 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 6460 .access = PL1_R, .resetvalue = cbar32 }, 6461 REGINFO_SENTINEL 6462 }; 6463 /* We don't implement a r/w 64 bit CBAR currently */ 6464 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 6465 define_arm_cp_regs(cpu, cbar_reginfo); 6466 } else { 6467 ARMCPRegInfo cbar = { 6468 .name = "CBAR", 6469 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 6470 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar, 6471 .fieldoffset = offsetof(CPUARMState, 6472 cp15.c15_config_base_address) 6473 }; 6474 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 6475 cbar.access = PL1_R; 6476 cbar.fieldoffset = 0; 6477 cbar.type = ARM_CP_CONST; 6478 } 6479 define_one_arm_cp_reg(cpu, &cbar); 6480 } 6481 } 6482 6483 if (arm_feature(env, ARM_FEATURE_VBAR)) { 6484 ARMCPRegInfo vbar_cp_reginfo[] = { 6485 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 6486 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 6487 .access = PL1_RW, .writefn = vbar_write, 6488 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 6489 offsetof(CPUARMState, cp15.vbar_ns) }, 6490 .resetvalue = 0 }, 6491 REGINFO_SENTINEL 6492 }; 6493 define_arm_cp_regs(cpu, vbar_cp_reginfo); 6494 } 6495 6496 /* Generic registers whose values depend on the implementation */ 6497 { 6498 ARMCPRegInfo sctlr = { 6499 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 6500 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 6501 .access = PL1_RW, 6502 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 6503 offsetof(CPUARMState, cp15.sctlr_ns) }, 6504 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 6505 .raw_writefn = raw_write, 6506 }; 6507 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 6508 /* Normally we would always end the TB on an SCTLR write, but Linux 6509 * arch/arm/mach-pxa/sleep.S expects two instructions following 6510 * an MMU enable to execute from cache. Imitate this behaviour. 6511 */ 6512 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 6513 } 6514 define_one_arm_cp_reg(cpu, &sctlr); 6515 } 6516 6517 if (cpu_isar_feature(aa64_lor, cpu)) { 6518 /* 6519 * A trivial implementation of ARMv8.1-LOR leaves all of these 6520 * registers fixed at 0, which indicates that there are zero 6521 * supported Limited Ordering regions. 6522 */ 6523 static const ARMCPRegInfo lor_reginfo[] = { 6524 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 6525 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 6526 .access = PL1_RW, .accessfn = access_lor_other, 6527 .type = ARM_CP_CONST, .resetvalue = 0 }, 6528 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 6529 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 6530 .access = PL1_RW, .accessfn = access_lor_other, 6531 .type = ARM_CP_CONST, .resetvalue = 0 }, 6532 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 6533 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 6534 .access = PL1_RW, .accessfn = access_lor_other, 6535 .type = ARM_CP_CONST, .resetvalue = 0 }, 6536 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 6537 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 6538 .access = PL1_RW, .accessfn = access_lor_other, 6539 .type = ARM_CP_CONST, .resetvalue = 0 }, 6540 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 6541 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 6542 .access = PL1_R, .accessfn = access_lorid, 6543 .type = ARM_CP_CONST, .resetvalue = 0 }, 6544 REGINFO_SENTINEL 6545 }; 6546 define_arm_cp_regs(cpu, lor_reginfo); 6547 } 6548 6549 if (cpu_isar_feature(aa64_sve, cpu)) { 6550 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo); 6551 if (arm_feature(env, ARM_FEATURE_EL2)) { 6552 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo); 6553 } else { 6554 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo); 6555 } 6556 if (arm_feature(env, ARM_FEATURE_EL3)) { 6557 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo); 6558 } 6559 } 6560 6561 #ifdef TARGET_AARCH64 6562 if (cpu_isar_feature(aa64_pauth, cpu)) { 6563 define_arm_cp_regs(cpu, pauth_reginfo); 6564 } 6565 #endif 6566 } 6567 6568 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) 6569 { 6570 CPUState *cs = CPU(cpu); 6571 CPUARMState *env = &cpu->env; 6572 6573 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6574 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg, 6575 aarch64_fpu_gdb_set_reg, 6576 34, "aarch64-fpu.xml", 0); 6577 } else if (arm_feature(env, ARM_FEATURE_NEON)) { 6578 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6579 51, "arm-neon.xml", 0); 6580 } else if (arm_feature(env, ARM_FEATURE_VFP3)) { 6581 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6582 35, "arm-vfp3.xml", 0); 6583 } else if (arm_feature(env, ARM_FEATURE_VFP)) { 6584 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 6585 19, "arm-vfp.xml", 0); 6586 } 6587 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg, 6588 arm_gen_dynamic_xml(cs), 6589 "system-registers.xml", 0); 6590 } 6591 6592 /* Sort alphabetically by type name, except for "any". */ 6593 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b) 6594 { 6595 ObjectClass *class_a = (ObjectClass *)a; 6596 ObjectClass *class_b = (ObjectClass *)b; 6597 const char *name_a, *name_b; 6598 6599 name_a = object_class_get_name(class_a); 6600 name_b = object_class_get_name(class_b); 6601 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) { 6602 return 1; 6603 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) { 6604 return -1; 6605 } else { 6606 return strcmp(name_a, name_b); 6607 } 6608 } 6609 6610 static void arm_cpu_list_entry(gpointer data, gpointer user_data) 6611 { 6612 ObjectClass *oc = data; 6613 CPUListState *s = user_data; 6614 const char *typename; 6615 char *name; 6616 6617 typename = object_class_get_name(oc); 6618 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6619 (*s->cpu_fprintf)(s->file, " %s\n", 6620 name); 6621 g_free(name); 6622 } 6623 6624 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf) 6625 { 6626 CPUListState s = { 6627 .file = f, 6628 .cpu_fprintf = cpu_fprintf, 6629 }; 6630 GSList *list; 6631 6632 list = object_class_get_list(TYPE_ARM_CPU, false); 6633 list = g_slist_sort(list, arm_cpu_list_compare); 6634 (*cpu_fprintf)(f, "Available CPUs:\n"); 6635 g_slist_foreach(list, arm_cpu_list_entry, &s); 6636 g_slist_free(list); 6637 } 6638 6639 static void arm_cpu_add_definition(gpointer data, gpointer user_data) 6640 { 6641 ObjectClass *oc = data; 6642 CpuDefinitionInfoList **cpu_list = user_data; 6643 CpuDefinitionInfoList *entry; 6644 CpuDefinitionInfo *info; 6645 const char *typename; 6646 6647 typename = object_class_get_name(oc); 6648 info = g_malloc0(sizeof(*info)); 6649 info->name = g_strndup(typename, 6650 strlen(typename) - strlen("-" TYPE_ARM_CPU)); 6651 info->q_typename = g_strdup(typename); 6652 6653 entry = g_malloc0(sizeof(*entry)); 6654 entry->value = info; 6655 entry->next = *cpu_list; 6656 *cpu_list = entry; 6657 } 6658 6659 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp) 6660 { 6661 CpuDefinitionInfoList *cpu_list = NULL; 6662 GSList *list; 6663 6664 list = object_class_get_list(TYPE_ARM_CPU, false); 6665 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list); 6666 g_slist_free(list); 6667 6668 return cpu_list; 6669 } 6670 6671 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 6672 void *opaque, int state, int secstate, 6673 int crm, int opc1, int opc2, 6674 const char *name) 6675 { 6676 /* Private utility function for define_one_arm_cp_reg_with_opaque(): 6677 * add a single reginfo struct to the hash table. 6678 */ 6679 uint32_t *key = g_new(uint32_t, 1); 6680 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo)); 6681 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0; 6682 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0; 6683 6684 r2->name = g_strdup(name); 6685 /* Reset the secure state to the specific incoming state. This is 6686 * necessary as the register may have been defined with both states. 6687 */ 6688 r2->secure = secstate; 6689 6690 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6691 /* Register is banked (using both entries in array). 6692 * Overwriting fieldoffset as the array is only used to define 6693 * banked registers but later only fieldoffset is used. 6694 */ 6695 r2->fieldoffset = r->bank_fieldoffsets[ns]; 6696 } 6697 6698 if (state == ARM_CP_STATE_AA32) { 6699 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 6700 /* If the register is banked then we don't need to migrate or 6701 * reset the 32-bit instance in certain cases: 6702 * 6703 * 1) If the register has both 32-bit and 64-bit instances then we 6704 * can count on the 64-bit instance taking care of the 6705 * non-secure bank. 6706 * 2) If ARMv8 is enabled then we can count on a 64-bit version 6707 * taking care of the secure bank. This requires that separate 6708 * 32 and 64-bit definitions are provided. 6709 */ 6710 if ((r->state == ARM_CP_STATE_BOTH && ns) || 6711 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) { 6712 r2->type |= ARM_CP_ALIAS; 6713 } 6714 } else if ((secstate != r->secure) && !ns) { 6715 /* The register is not banked so we only want to allow migration of 6716 * the non-secure instance. 6717 */ 6718 r2->type |= ARM_CP_ALIAS; 6719 } 6720 6721 if (r->state == ARM_CP_STATE_BOTH) { 6722 /* We assume it is a cp15 register if the .cp field is left unset. 6723 */ 6724 if (r2->cp == 0) { 6725 r2->cp = 15; 6726 } 6727 6728 #ifdef HOST_WORDS_BIGENDIAN 6729 if (r2->fieldoffset) { 6730 r2->fieldoffset += sizeof(uint32_t); 6731 } 6732 #endif 6733 } 6734 } 6735 if (state == ARM_CP_STATE_AA64) { 6736 /* To allow abbreviation of ARMCPRegInfo 6737 * definitions, we treat cp == 0 as equivalent to 6738 * the value for "standard guest-visible sysreg". 6739 * STATE_BOTH definitions are also always "standard 6740 * sysreg" in their AArch64 view (the .cp value may 6741 * be non-zero for the benefit of the AArch32 view). 6742 */ 6743 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) { 6744 r2->cp = CP_REG_ARM64_SYSREG_CP; 6745 } 6746 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm, 6747 r2->opc0, opc1, opc2); 6748 } else { 6749 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2); 6750 } 6751 if (opaque) { 6752 r2->opaque = opaque; 6753 } 6754 /* reginfo passed to helpers is correct for the actual access, 6755 * and is never ARM_CP_STATE_BOTH: 6756 */ 6757 r2->state = state; 6758 /* Make sure reginfo passed to helpers for wildcarded regs 6759 * has the correct crm/opc1/opc2 for this reg, not CP_ANY: 6760 */ 6761 r2->crm = crm; 6762 r2->opc1 = opc1; 6763 r2->opc2 = opc2; 6764 /* By convention, for wildcarded registers only the first 6765 * entry is used for migration; the others are marked as 6766 * ALIAS so we don't try to transfer the register 6767 * multiple times. Special registers (ie NOP/WFI) are 6768 * never migratable and not even raw-accessible. 6769 */ 6770 if ((r->type & ARM_CP_SPECIAL)) { 6771 r2->type |= ARM_CP_NO_RAW; 6772 } 6773 if (((r->crm == CP_ANY) && crm != 0) || 6774 ((r->opc1 == CP_ANY) && opc1 != 0) || 6775 ((r->opc2 == CP_ANY) && opc2 != 0)) { 6776 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 6777 } 6778 6779 /* Check that raw accesses are either forbidden or handled. Note that 6780 * we can't assert this earlier because the setup of fieldoffset for 6781 * banked registers has to be done first. 6782 */ 6783 if (!(r2->type & ARM_CP_NO_RAW)) { 6784 assert(!raw_accessors_invalid(r2)); 6785 } 6786 6787 /* Overriding of an existing definition must be explicitly 6788 * requested. 6789 */ 6790 if (!(r->type & ARM_CP_OVERRIDE)) { 6791 ARMCPRegInfo *oldreg; 6792 oldreg = g_hash_table_lookup(cpu->cp_regs, key); 6793 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) { 6794 fprintf(stderr, "Register redefined: cp=%d %d bit " 6795 "crn=%d crm=%d opc1=%d opc2=%d, " 6796 "was %s, now %s\n", r2->cp, 32 + 32 * is64, 6797 r2->crn, r2->crm, r2->opc1, r2->opc2, 6798 oldreg->name, r2->name); 6799 g_assert_not_reached(); 6800 } 6801 } 6802 g_hash_table_insert(cpu->cp_regs, key, r2); 6803 } 6804 6805 6806 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 6807 const ARMCPRegInfo *r, void *opaque) 6808 { 6809 /* Define implementations of coprocessor registers. 6810 * We store these in a hashtable because typically 6811 * there are less than 150 registers in a space which 6812 * is 16*16*16*8*8 = 262144 in size. 6813 * Wildcarding is supported for the crm, opc1 and opc2 fields. 6814 * If a register is defined twice then the second definition is 6815 * used, so this can be used to define some generic registers and 6816 * then override them with implementation specific variations. 6817 * At least one of the original and the second definition should 6818 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 6819 * against accidental use. 6820 * 6821 * The state field defines whether the register is to be 6822 * visible in the AArch32 or AArch64 execution state. If the 6823 * state is set to ARM_CP_STATE_BOTH then we synthesise a 6824 * reginfo structure for the AArch32 view, which sees the lower 6825 * 32 bits of the 64 bit register. 6826 * 6827 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 6828 * be wildcarded. AArch64 registers are always considered to be 64 6829 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 6830 * the register, if any. 6831 */ 6832 int crm, opc1, opc2, state; 6833 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 6834 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 6835 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 6836 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 6837 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 6838 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 6839 /* 64 bit registers have only CRm and Opc1 fields */ 6840 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 6841 /* op0 only exists in the AArch64 encodings */ 6842 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 6843 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 6844 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 6845 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1 6846 * encodes a minimum access level for the register. We roll this 6847 * runtime check into our general permission check code, so check 6848 * here that the reginfo's specified permissions are strict enough 6849 * to encompass the generic architectural permission check. 6850 */ 6851 if (r->state != ARM_CP_STATE_AA32) { 6852 int mask = 0; 6853 switch (r->opc1) { 6854 case 0: case 1: case 2: 6855 /* min_EL EL1 */ 6856 mask = PL1_RW; 6857 break; 6858 case 3: 6859 /* min_EL EL0 */ 6860 mask = PL0_RW; 6861 break; 6862 case 4: 6863 /* min_EL EL2 */ 6864 mask = PL2_RW; 6865 break; 6866 case 5: 6867 /* unallocated encoding, so not possible */ 6868 assert(false); 6869 break; 6870 case 6: 6871 /* min_EL EL3 */ 6872 mask = PL3_RW; 6873 break; 6874 case 7: 6875 /* min_EL EL1, secure mode only (we don't check the latter) */ 6876 mask = PL1_RW; 6877 break; 6878 default: 6879 /* broken reginfo with out-of-range opc1 */ 6880 assert(false); 6881 break; 6882 } 6883 /* assert our permissions are not too lax (stricter is fine) */ 6884 assert((r->access & ~mask) == 0); 6885 } 6886 6887 /* Check that the register definition has enough info to handle 6888 * reads and writes if they are permitted. 6889 */ 6890 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) { 6891 if (r->access & PL3_R) { 6892 assert((r->fieldoffset || 6893 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 6894 r->readfn); 6895 } 6896 if (r->access & PL3_W) { 6897 assert((r->fieldoffset || 6898 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 6899 r->writefn); 6900 } 6901 } 6902 /* Bad type field probably means missing sentinel at end of reg list */ 6903 assert(cptype_valid(r->type)); 6904 for (crm = crmmin; crm <= crmmax; crm++) { 6905 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 6906 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 6907 for (state = ARM_CP_STATE_AA32; 6908 state <= ARM_CP_STATE_AA64; state++) { 6909 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 6910 continue; 6911 } 6912 if (state == ARM_CP_STATE_AA32) { 6913 /* Under AArch32 CP registers can be common 6914 * (same for secure and non-secure world) or banked. 6915 */ 6916 char *name; 6917 6918 switch (r->secure) { 6919 case ARM_CP_SECSTATE_S: 6920 case ARM_CP_SECSTATE_NS: 6921 add_cpreg_to_hashtable(cpu, r, opaque, state, 6922 r->secure, crm, opc1, opc2, 6923 r->name); 6924 break; 6925 default: 6926 name = g_strdup_printf("%s_S", r->name); 6927 add_cpreg_to_hashtable(cpu, r, opaque, state, 6928 ARM_CP_SECSTATE_S, 6929 crm, opc1, opc2, name); 6930 g_free(name); 6931 add_cpreg_to_hashtable(cpu, r, opaque, state, 6932 ARM_CP_SECSTATE_NS, 6933 crm, opc1, opc2, r->name); 6934 break; 6935 } 6936 } else { 6937 /* AArch64 registers get mapped to non-secure instance 6938 * of AArch32 */ 6939 add_cpreg_to_hashtable(cpu, r, opaque, state, 6940 ARM_CP_SECSTATE_NS, 6941 crm, opc1, opc2, r->name); 6942 } 6943 } 6944 } 6945 } 6946 } 6947 } 6948 6949 void define_arm_cp_regs_with_opaque(ARMCPU *cpu, 6950 const ARMCPRegInfo *regs, void *opaque) 6951 { 6952 /* Define a whole list of registers */ 6953 const ARMCPRegInfo *r; 6954 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 6955 define_one_arm_cp_reg_with_opaque(cpu, r, opaque); 6956 } 6957 } 6958 6959 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 6960 { 6961 return g_hash_table_lookup(cpregs, &encoded_cp); 6962 } 6963 6964 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 6965 uint64_t value) 6966 { 6967 /* Helper coprocessor write function for write-ignore registers */ 6968 } 6969 6970 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 6971 { 6972 /* Helper coprocessor write function for read-as-zero registers */ 6973 return 0; 6974 } 6975 6976 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 6977 { 6978 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 6979 } 6980 6981 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 6982 { 6983 /* Return true if it is not valid for us to switch to 6984 * this CPU mode (ie all the UNPREDICTABLE cases in 6985 * the ARM ARM CPSRWriteByInstr pseudocode). 6986 */ 6987 6988 /* Changes to or from Hyp via MSR and CPS are illegal. */ 6989 if (write_type == CPSRWriteByInstr && 6990 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 6991 mode == ARM_CPU_MODE_HYP)) { 6992 return 1; 6993 } 6994 6995 switch (mode) { 6996 case ARM_CPU_MODE_USR: 6997 return 0; 6998 case ARM_CPU_MODE_SYS: 6999 case ARM_CPU_MODE_SVC: 7000 case ARM_CPU_MODE_ABT: 7001 case ARM_CPU_MODE_UND: 7002 case ARM_CPU_MODE_IRQ: 7003 case ARM_CPU_MODE_FIQ: 7004 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7 7005 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 7006 */ 7007 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 7008 * and CPS are treated as illegal mode changes. 7009 */ 7010 if (write_type == CPSRWriteByInstr && 7011 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 7012 (arm_hcr_el2_eff(env) & HCR_TGE)) { 7013 return 1; 7014 } 7015 return 0; 7016 case ARM_CPU_MODE_HYP: 7017 return !arm_feature(env, ARM_FEATURE_EL2) 7018 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env); 7019 case ARM_CPU_MODE_MON: 7020 return arm_current_el(env) < 3; 7021 default: 7022 return 1; 7023 } 7024 } 7025 7026 uint32_t cpsr_read(CPUARMState *env) 7027 { 7028 int ZF; 7029 ZF = (env->ZF == 0); 7030 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 7031 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 7032 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 7033 | ((env->condexec_bits & 0xfc) << 8) 7034 | (env->GE << 16) | (env->daif & CPSR_AIF); 7035 } 7036 7037 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 7038 CPSRWriteType write_type) 7039 { 7040 uint32_t changed_daif; 7041 7042 if (mask & CPSR_NZCV) { 7043 env->ZF = (~val) & CPSR_Z; 7044 env->NF = val; 7045 env->CF = (val >> 29) & 1; 7046 env->VF = (val << 3) & 0x80000000; 7047 } 7048 if (mask & CPSR_Q) 7049 env->QF = ((val & CPSR_Q) != 0); 7050 if (mask & CPSR_T) 7051 env->thumb = ((val & CPSR_T) != 0); 7052 if (mask & CPSR_IT_0_1) { 7053 env->condexec_bits &= ~3; 7054 env->condexec_bits |= (val >> 25) & 3; 7055 } 7056 if (mask & CPSR_IT_2_7) { 7057 env->condexec_bits &= 3; 7058 env->condexec_bits |= (val >> 8) & 0xfc; 7059 } 7060 if (mask & CPSR_GE) { 7061 env->GE = (val >> 16) & 0xf; 7062 } 7063 7064 /* In a V7 implementation that includes the security extensions but does 7065 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 7066 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 7067 * bits respectively. 7068 * 7069 * In a V8 implementation, it is permitted for privileged software to 7070 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 7071 */ 7072 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 7073 arm_feature(env, ARM_FEATURE_EL3) && 7074 !arm_feature(env, ARM_FEATURE_EL2) && 7075 !arm_is_secure(env)) { 7076 7077 changed_daif = (env->daif ^ val) & mask; 7078 7079 if (changed_daif & CPSR_A) { 7080 /* Check to see if we are allowed to change the masking of async 7081 * abort exceptions from a non-secure state. 7082 */ 7083 if (!(env->cp15.scr_el3 & SCR_AW)) { 7084 qemu_log_mask(LOG_GUEST_ERROR, 7085 "Ignoring attempt to switch CPSR_A flag from " 7086 "non-secure world with SCR.AW bit clear\n"); 7087 mask &= ~CPSR_A; 7088 } 7089 } 7090 7091 if (changed_daif & CPSR_F) { 7092 /* Check to see if we are allowed to change the masking of FIQ 7093 * exceptions from a non-secure state. 7094 */ 7095 if (!(env->cp15.scr_el3 & SCR_FW)) { 7096 qemu_log_mask(LOG_GUEST_ERROR, 7097 "Ignoring attempt to switch CPSR_F flag from " 7098 "non-secure world with SCR.FW bit clear\n"); 7099 mask &= ~CPSR_F; 7100 } 7101 7102 /* Check whether non-maskable FIQ (NMFI) support is enabled. 7103 * If this bit is set software is not allowed to mask 7104 * FIQs, but is allowed to set CPSR_F to 0. 7105 */ 7106 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 7107 (val & CPSR_F)) { 7108 qemu_log_mask(LOG_GUEST_ERROR, 7109 "Ignoring attempt to enable CPSR_F flag " 7110 "(non-maskable FIQ [NMFI] support enabled)\n"); 7111 mask &= ~CPSR_F; 7112 } 7113 } 7114 } 7115 7116 env->daif &= ~(CPSR_AIF & mask); 7117 env->daif |= val & CPSR_AIF & mask; 7118 7119 if (write_type != CPSRWriteRaw && 7120 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 7121 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 7122 /* Note that we can only get here in USR mode if this is a 7123 * gdb stub write; for this case we follow the architectural 7124 * behaviour for guest writes in USR mode of ignoring an attempt 7125 * to switch mode. (Those are caught by translate.c for writes 7126 * triggered by guest instructions.) 7127 */ 7128 mask &= ~CPSR_M; 7129 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 7130 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in 7131 * v7, and has defined behaviour in v8: 7132 * + leave CPSR.M untouched 7133 * + allow changes to the other CPSR fields 7134 * + set PSTATE.IL 7135 * For user changes via the GDB stub, we don't set PSTATE.IL, 7136 * as this would be unnecessarily harsh for a user error. 7137 */ 7138 mask &= ~CPSR_M; 7139 if (write_type != CPSRWriteByGDBStub && 7140 arm_feature(env, ARM_FEATURE_V8)) { 7141 mask |= CPSR_IL; 7142 val |= CPSR_IL; 7143 } 7144 qemu_log_mask(LOG_GUEST_ERROR, 7145 "Illegal AArch32 mode switch attempt from %s to %s\n", 7146 aarch32_mode_name(env->uncached_cpsr), 7147 aarch32_mode_name(val)); 7148 } else { 7149 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 7150 write_type == CPSRWriteExceptionReturn ? 7151 "Exception return from AArch32" : 7152 "AArch32 mode switch from", 7153 aarch32_mode_name(env->uncached_cpsr), 7154 aarch32_mode_name(val), env->regs[15]); 7155 switch_mode(env, val & CPSR_M); 7156 } 7157 } 7158 mask &= ~CACHED_CPSR_BITS; 7159 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 7160 } 7161 7162 /* Sign/zero extend */ 7163 uint32_t HELPER(sxtb16)(uint32_t x) 7164 { 7165 uint32_t res; 7166 res = (uint16_t)(int8_t)x; 7167 res |= (uint32_t)(int8_t)(x >> 16) << 16; 7168 return res; 7169 } 7170 7171 uint32_t HELPER(uxtb16)(uint32_t x) 7172 { 7173 uint32_t res; 7174 res = (uint16_t)(uint8_t)x; 7175 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 7176 return res; 7177 } 7178 7179 int32_t HELPER(sdiv)(int32_t num, int32_t den) 7180 { 7181 if (den == 0) 7182 return 0; 7183 if (num == INT_MIN && den == -1) 7184 return INT_MIN; 7185 return num / den; 7186 } 7187 7188 uint32_t HELPER(udiv)(uint32_t num, uint32_t den) 7189 { 7190 if (den == 0) 7191 return 0; 7192 return num / den; 7193 } 7194 7195 uint32_t HELPER(rbit)(uint32_t x) 7196 { 7197 return revbit32(x); 7198 } 7199 7200 #if defined(CONFIG_USER_ONLY) 7201 7202 /* These should probably raise undefined insn exceptions. */ 7203 void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val) 7204 { 7205 ARMCPU *cpu = arm_env_get_cpu(env); 7206 7207 cpu_abort(CPU(cpu), "v7m_msr %d\n", reg); 7208 } 7209 7210 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) 7211 { 7212 ARMCPU *cpu = arm_env_get_cpu(env); 7213 7214 cpu_abort(CPU(cpu), "v7m_mrs %d\n", reg); 7215 return 0; 7216 } 7217 7218 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest) 7219 { 7220 /* translate.c should never generate calls here in user-only mode */ 7221 g_assert_not_reached(); 7222 } 7223 7224 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest) 7225 { 7226 /* translate.c should never generate calls here in user-only mode */ 7227 g_assert_not_reached(); 7228 } 7229 7230 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) 7231 { 7232 /* The TT instructions can be used by unprivileged code, but in 7233 * user-only emulation we don't have the MPU. 7234 * Luckily since we know we are NonSecure unprivileged (and that in 7235 * turn means that the A flag wasn't specified), all the bits in the 7236 * register must be zero: 7237 * IREGION: 0 because IRVALID is 0 7238 * IRVALID: 0 because NS 7239 * S: 0 because NS 7240 * NSRW: 0 because NS 7241 * NSR: 0 because NS 7242 * RW: 0 because unpriv and A flag not set 7243 * R: 0 because unpriv and A flag not set 7244 * SRVALID: 0 because NS 7245 * MRVALID: 0 because unpriv and A flag not set 7246 * SREGION: 0 becaus SRVALID is 0 7247 * MREGION: 0 because MRVALID is 0 7248 */ 7249 return 0; 7250 } 7251 7252 static void switch_mode(CPUARMState *env, int mode) 7253 { 7254 ARMCPU *cpu = arm_env_get_cpu(env); 7255 7256 if (mode != ARM_CPU_MODE_USR) { 7257 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 7258 } 7259 } 7260 7261 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7262 uint32_t cur_el, bool secure) 7263 { 7264 return 1; 7265 } 7266 7267 void aarch64_sync_64_to_32(CPUARMState *env) 7268 { 7269 g_assert_not_reached(); 7270 } 7271 7272 #else 7273 7274 static void switch_mode(CPUARMState *env, int mode) 7275 { 7276 int old_mode; 7277 int i; 7278 7279 old_mode = env->uncached_cpsr & CPSR_M; 7280 if (mode == old_mode) 7281 return; 7282 7283 if (old_mode == ARM_CPU_MODE_FIQ) { 7284 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7285 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 7286 } else if (mode == ARM_CPU_MODE_FIQ) { 7287 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 7288 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 7289 } 7290 7291 i = bank_number(old_mode); 7292 env->banked_r13[i] = env->regs[13]; 7293 env->banked_spsr[i] = env->spsr; 7294 7295 i = bank_number(mode); 7296 env->regs[13] = env->banked_r13[i]; 7297 env->spsr = env->banked_spsr[i]; 7298 7299 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 7300 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 7301 } 7302 7303 /* Physical Interrupt Target EL Lookup Table 7304 * 7305 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 7306 * 7307 * The below multi-dimensional table is used for looking up the target 7308 * exception level given numerous condition criteria. Specifically, the 7309 * target EL is based on SCR and HCR routing controls as well as the 7310 * currently executing EL and secure state. 7311 * 7312 * Dimensions: 7313 * target_el_table[2][2][2][2][2][4] 7314 * | | | | | +--- Current EL 7315 * | | | | +------ Non-secure(0)/Secure(1) 7316 * | | | +--------- HCR mask override 7317 * | | +------------ SCR exec state control 7318 * | +--------------- SCR mask override 7319 * +------------------ 32-bit(0)/64-bit(1) EL3 7320 * 7321 * The table values are as such: 7322 * 0-3 = EL0-EL3 7323 * -1 = Cannot occur 7324 * 7325 * The ARM ARM target EL table includes entries indicating that an "exception 7326 * is not taken". The two cases where this is applicable are: 7327 * 1) An exception is taken from EL3 but the SCR does not have the exception 7328 * routed to EL3. 7329 * 2) An exception is taken from EL2 but the HCR does not have the exception 7330 * routed to EL2. 7331 * In these two cases, the below table contain a target of EL1. This value is 7332 * returned as it is expected that the consumer of the table data will check 7333 * for "target EL >= current EL" to ensure the exception is not taken. 7334 * 7335 * SCR HCR 7336 * 64 EA AMO From 7337 * BIT IRQ IMO Non-secure Secure 7338 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 7339 */ 7340 static const int8_t target_el_table[2][2][2][2][2][4] = { 7341 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7342 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 7343 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 7344 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 7345 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7346 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 7347 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 7348 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 7349 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 7350 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},}, 7351 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },}, 7352 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},}, 7353 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7354 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 7355 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 7356 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},}, 7357 }; 7358 7359 /* 7360 * Determine the target EL for physical exceptions 7361 */ 7362 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 7363 uint32_t cur_el, bool secure) 7364 { 7365 CPUARMState *env = cs->env_ptr; 7366 bool rw; 7367 bool scr; 7368 bool hcr; 7369 int target_el; 7370 /* Is the highest EL AArch64? */ 7371 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 7372 uint64_t hcr_el2; 7373 7374 if (arm_feature(env, ARM_FEATURE_EL3)) { 7375 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 7376 } else { 7377 /* Either EL2 is the highest EL (and so the EL2 register width 7378 * is given by is64); or there is no EL2 or EL3, in which case 7379 * the value of 'rw' does not affect the table lookup anyway. 7380 */ 7381 rw = is64; 7382 } 7383 7384 hcr_el2 = arm_hcr_el2_eff(env); 7385 switch (excp_idx) { 7386 case EXCP_IRQ: 7387 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 7388 hcr = hcr_el2 & HCR_IMO; 7389 break; 7390 case EXCP_FIQ: 7391 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 7392 hcr = hcr_el2 & HCR_FMO; 7393 break; 7394 default: 7395 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 7396 hcr = hcr_el2 & HCR_AMO; 7397 break; 7398 }; 7399 7400 /* Perform a table-lookup for the target EL given the current state */ 7401 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 7402 7403 assert(target_el > 0); 7404 7405 return target_el; 7406 } 7407 7408 static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value, 7409 ARMMMUIdx mmu_idx, bool ignfault) 7410 { 7411 CPUState *cs = CPU(cpu); 7412 CPUARMState *env = &cpu->env; 7413 MemTxAttrs attrs = {}; 7414 MemTxResult txres; 7415 target_ulong page_size; 7416 hwaddr physaddr; 7417 int prot; 7418 ARMMMUFaultInfo fi = {}; 7419 bool secure = mmu_idx & ARM_MMU_IDX_M_S; 7420 int exc; 7421 bool exc_secure; 7422 7423 if (get_phys_addr(env, addr, MMU_DATA_STORE, mmu_idx, &physaddr, 7424 &attrs, &prot, &page_size, &fi, NULL)) { 7425 /* MPU/SAU lookup failed */ 7426 if (fi.type == ARMFault_QEMU_SFault) { 7427 qemu_log_mask(CPU_LOG_INT, 7428 "...SecureFault with SFSR.AUVIOL during stacking\n"); 7429 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK; 7430 env->v7m.sfar = addr; 7431 exc = ARMV7M_EXCP_SECURE; 7432 exc_secure = false; 7433 } else { 7434 qemu_log_mask(CPU_LOG_INT, "...MemManageFault with CFSR.MSTKERR\n"); 7435 env->v7m.cfsr[secure] |= R_V7M_CFSR_MSTKERR_MASK; 7436 exc = ARMV7M_EXCP_MEM; 7437 exc_secure = secure; 7438 } 7439 goto pend_fault; 7440 } 7441 address_space_stl_le(arm_addressspace(cs, attrs), physaddr, value, 7442 attrs, &txres); 7443 if (txres != MEMTX_OK) { 7444 /* BusFault trying to write the data */ 7445 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.STKERR\n"); 7446 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_STKERR_MASK; 7447 exc = ARMV7M_EXCP_BUS; 7448 exc_secure = false; 7449 goto pend_fault; 7450 } 7451 return true; 7452 7453 pend_fault: 7454 /* By pending the exception at this point we are making 7455 * the IMPDEF choice "overridden exceptions pended" (see the 7456 * MergeExcInfo() pseudocode). The other choice would be to not 7457 * pend them now and then make a choice about which to throw away 7458 * later if we have two derived exceptions. 7459 * The only case when we must not pend the exception but instead 7460 * throw it away is if we are doing the push of the callee registers 7461 * and we've already generated a derived exception. Even in this 7462 * case we will still update the fault status registers. 7463 */ 7464 if (!ignfault) { 7465 armv7m_nvic_set_pending_derived(env->nvic, exc, exc_secure); 7466 } 7467 return false; 7468 } 7469 7470 static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr, 7471 ARMMMUIdx mmu_idx) 7472 { 7473 CPUState *cs = CPU(cpu); 7474 CPUARMState *env = &cpu->env; 7475 MemTxAttrs attrs = {}; 7476 MemTxResult txres; 7477 target_ulong page_size; 7478 hwaddr physaddr; 7479 int prot; 7480 ARMMMUFaultInfo fi = {}; 7481 bool secure = mmu_idx & ARM_MMU_IDX_M_S; 7482 int exc; 7483 bool exc_secure; 7484 uint32_t value; 7485 7486 if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr, 7487 &attrs, &prot, &page_size, &fi, NULL)) { 7488 /* MPU/SAU lookup failed */ 7489 if (fi.type == ARMFault_QEMU_SFault) { 7490 qemu_log_mask(CPU_LOG_INT, 7491 "...SecureFault with SFSR.AUVIOL during unstack\n"); 7492 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK; 7493 env->v7m.sfar = addr; 7494 exc = ARMV7M_EXCP_SECURE; 7495 exc_secure = false; 7496 } else { 7497 qemu_log_mask(CPU_LOG_INT, 7498 "...MemManageFault with CFSR.MUNSTKERR\n"); 7499 env->v7m.cfsr[secure] |= R_V7M_CFSR_MUNSTKERR_MASK; 7500 exc = ARMV7M_EXCP_MEM; 7501 exc_secure = secure; 7502 } 7503 goto pend_fault; 7504 } 7505 7506 value = address_space_ldl(arm_addressspace(cs, attrs), physaddr, 7507 attrs, &txres); 7508 if (txres != MEMTX_OK) { 7509 /* BusFault trying to read the data */ 7510 qemu_log_mask(CPU_LOG_INT, "...BusFault with BFSR.UNSTKERR\n"); 7511 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_UNSTKERR_MASK; 7512 exc = ARMV7M_EXCP_BUS; 7513 exc_secure = false; 7514 goto pend_fault; 7515 } 7516 7517 *dest = value; 7518 return true; 7519 7520 pend_fault: 7521 /* By pending the exception at this point we are making 7522 * the IMPDEF choice "overridden exceptions pended" (see the 7523 * MergeExcInfo() pseudocode). The other choice would be to not 7524 * pend them now and then make a choice about which to throw away 7525 * later if we have two derived exceptions. 7526 */ 7527 armv7m_nvic_set_pending(env->nvic, exc, exc_secure); 7528 return false; 7529 } 7530 7531 /* Write to v7M CONTROL.SPSEL bit for the specified security bank. 7532 * This may change the current stack pointer between Main and Process 7533 * stack pointers if it is done for the CONTROL register for the current 7534 * security state. 7535 */ 7536 static void write_v7m_control_spsel_for_secstate(CPUARMState *env, 7537 bool new_spsel, 7538 bool secstate) 7539 { 7540 bool old_is_psp = v7m_using_psp(env); 7541 7542 env->v7m.control[secstate] = 7543 deposit32(env->v7m.control[secstate], 7544 R_V7M_CONTROL_SPSEL_SHIFT, 7545 R_V7M_CONTROL_SPSEL_LENGTH, new_spsel); 7546 7547 if (secstate == env->v7m.secure) { 7548 bool new_is_psp = v7m_using_psp(env); 7549 uint32_t tmp; 7550 7551 if (old_is_psp != new_is_psp) { 7552 tmp = env->v7m.other_sp; 7553 env->v7m.other_sp = env->regs[13]; 7554 env->regs[13] = tmp; 7555 } 7556 } 7557 } 7558 7559 /* Write to v7M CONTROL.SPSEL bit. This may change the current 7560 * stack pointer between Main and Process stack pointers. 7561 */ 7562 static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel) 7563 { 7564 write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure); 7565 } 7566 7567 void write_v7m_exception(CPUARMState *env, uint32_t new_exc) 7568 { 7569 /* Write a new value to v7m.exception, thus transitioning into or out 7570 * of Handler mode; this may result in a change of active stack pointer. 7571 */ 7572 bool new_is_psp, old_is_psp = v7m_using_psp(env); 7573 uint32_t tmp; 7574 7575 env->v7m.exception = new_exc; 7576 7577 new_is_psp = v7m_using_psp(env); 7578 7579 if (old_is_psp != new_is_psp) { 7580 tmp = env->v7m.other_sp; 7581 env->v7m.other_sp = env->regs[13]; 7582 env->regs[13] = tmp; 7583 } 7584 } 7585 7586 /* Switch M profile security state between NS and S */ 7587 static void switch_v7m_security_state(CPUARMState *env, bool new_secstate) 7588 { 7589 uint32_t new_ss_msp, new_ss_psp; 7590 7591 if (env->v7m.secure == new_secstate) { 7592 return; 7593 } 7594 7595 /* All the banked state is accessed by looking at env->v7m.secure 7596 * except for the stack pointer; rearrange the SP appropriately. 7597 */ 7598 new_ss_msp = env->v7m.other_ss_msp; 7599 new_ss_psp = env->v7m.other_ss_psp; 7600 7601 if (v7m_using_psp(env)) { 7602 env->v7m.other_ss_psp = env->regs[13]; 7603 env->v7m.other_ss_msp = env->v7m.other_sp; 7604 } else { 7605 env->v7m.other_ss_msp = env->regs[13]; 7606 env->v7m.other_ss_psp = env->v7m.other_sp; 7607 } 7608 7609 env->v7m.secure = new_secstate; 7610 7611 if (v7m_using_psp(env)) { 7612 env->regs[13] = new_ss_psp; 7613 env->v7m.other_sp = new_ss_msp; 7614 } else { 7615 env->regs[13] = new_ss_msp; 7616 env->v7m.other_sp = new_ss_psp; 7617 } 7618 } 7619 7620 void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest) 7621 { 7622 /* Handle v7M BXNS: 7623 * - if the return value is a magic value, do exception return (like BX) 7624 * - otherwise bit 0 of the return value is the target security state 7625 */ 7626 uint32_t min_magic; 7627 7628 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7629 /* Covers FNC_RETURN and EXC_RETURN magic */ 7630 min_magic = FNC_RETURN_MIN_MAGIC; 7631 } else { 7632 /* EXC_RETURN magic only */ 7633 min_magic = EXC_RETURN_MIN_MAGIC; 7634 } 7635 7636 if (dest >= min_magic) { 7637 /* This is an exception return magic value; put it where 7638 * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT. 7639 * Note that if we ever add gen_ss_advance() singlestep support to 7640 * M profile this should count as an "instruction execution complete" 7641 * event (compare gen_bx_excret_final_code()). 7642 */ 7643 env->regs[15] = dest & ~1; 7644 env->thumb = dest & 1; 7645 HELPER(exception_internal)(env, EXCP_EXCEPTION_EXIT); 7646 /* notreached */ 7647 } 7648 7649 /* translate.c should have made BXNS UNDEF unless we're secure */ 7650 assert(env->v7m.secure); 7651 7652 switch_v7m_security_state(env, dest & 1); 7653 env->thumb = 1; 7654 env->regs[15] = dest & ~1; 7655 } 7656 7657 void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest) 7658 { 7659 /* Handle v7M BLXNS: 7660 * - bit 0 of the destination address is the target security state 7661 */ 7662 7663 /* At this point regs[15] is the address just after the BLXNS */ 7664 uint32_t nextinst = env->regs[15] | 1; 7665 uint32_t sp = env->regs[13] - 8; 7666 uint32_t saved_psr; 7667 7668 /* translate.c will have made BLXNS UNDEF unless we're secure */ 7669 assert(env->v7m.secure); 7670 7671 if (dest & 1) { 7672 /* target is Secure, so this is just a normal BLX, 7673 * except that the low bit doesn't indicate Thumb/not. 7674 */ 7675 env->regs[14] = nextinst; 7676 env->thumb = 1; 7677 env->regs[15] = dest & ~1; 7678 return; 7679 } 7680 7681 /* Target is non-secure: first push a stack frame */ 7682 if (!QEMU_IS_ALIGNED(sp, 8)) { 7683 qemu_log_mask(LOG_GUEST_ERROR, 7684 "BLXNS with misaligned SP is UNPREDICTABLE\n"); 7685 } 7686 7687 if (sp < v7m_sp_limit(env)) { 7688 raise_exception(env, EXCP_STKOF, 0, 1); 7689 } 7690 7691 saved_psr = env->v7m.exception; 7692 if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) { 7693 saved_psr |= XPSR_SFPA; 7694 } 7695 7696 /* Note that these stores can throw exceptions on MPU faults */ 7697 cpu_stl_data(env, sp, nextinst); 7698 cpu_stl_data(env, sp + 4, saved_psr); 7699 7700 env->regs[13] = sp; 7701 env->regs[14] = 0xfeffffff; 7702 if (arm_v7m_is_handler_mode(env)) { 7703 /* Write a dummy value to IPSR, to avoid leaking the current secure 7704 * exception number to non-secure code. This is guaranteed not 7705 * to cause write_v7m_exception() to actually change stacks. 7706 */ 7707 write_v7m_exception(env, 1); 7708 } 7709 switch_v7m_security_state(env, 0); 7710 env->thumb = 1; 7711 env->regs[15] = dest; 7712 } 7713 7714 static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode, 7715 bool spsel) 7716 { 7717 /* Return a pointer to the location where we currently store the 7718 * stack pointer for the requested security state and thread mode. 7719 * This pointer will become invalid if the CPU state is updated 7720 * such that the stack pointers are switched around (eg changing 7721 * the SPSEL control bit). 7722 * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode(). 7723 * Unlike that pseudocode, we require the caller to pass us in the 7724 * SPSEL control bit value; this is because we also use this 7725 * function in handling of pushing of the callee-saves registers 7726 * part of the v8M stack frame (pseudocode PushCalleeStack()), 7727 * and in the tailchain codepath the SPSEL bit comes from the exception 7728 * return magic LR value from the previous exception. The pseudocode 7729 * opencodes the stack-selection in PushCalleeStack(), but we prefer 7730 * to make this utility function generic enough to do the job. 7731 */ 7732 bool want_psp = threadmode && spsel; 7733 7734 if (secure == env->v7m.secure) { 7735 if (want_psp == v7m_using_psp(env)) { 7736 return &env->regs[13]; 7737 } else { 7738 return &env->v7m.other_sp; 7739 } 7740 } else { 7741 if (want_psp) { 7742 return &env->v7m.other_ss_psp; 7743 } else { 7744 return &env->v7m.other_ss_msp; 7745 } 7746 } 7747 } 7748 7749 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure, 7750 uint32_t *pvec) 7751 { 7752 CPUState *cs = CPU(cpu); 7753 CPUARMState *env = &cpu->env; 7754 MemTxResult result; 7755 uint32_t addr = env->v7m.vecbase[targets_secure] + exc * 4; 7756 uint32_t vector_entry; 7757 MemTxAttrs attrs = {}; 7758 ARMMMUIdx mmu_idx; 7759 bool exc_secure; 7760 7761 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true); 7762 7763 /* We don't do a get_phys_addr() here because the rules for vector 7764 * loads are special: they always use the default memory map, and 7765 * the default memory map permits reads from all addresses. 7766 * Since there's no easy way to pass through to pmsav8_mpu_lookup() 7767 * that we want this special case which would always say "yes", 7768 * we just do the SAU lookup here followed by a direct physical load. 7769 */ 7770 attrs.secure = targets_secure; 7771 attrs.user = false; 7772 7773 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7774 V8M_SAttributes sattrs = {}; 7775 7776 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs); 7777 if (sattrs.ns) { 7778 attrs.secure = false; 7779 } else if (!targets_secure) { 7780 /* NS access to S memory */ 7781 goto load_fail; 7782 } 7783 } 7784 7785 vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr, 7786 attrs, &result); 7787 if (result != MEMTX_OK) { 7788 goto load_fail; 7789 } 7790 *pvec = vector_entry; 7791 return true; 7792 7793 load_fail: 7794 /* All vector table fetch fails are reported as HardFault, with 7795 * HFSR.VECTTBL and .FORCED set. (FORCED is set because 7796 * technically the underlying exception is a MemManage or BusFault 7797 * that is escalated to HardFault.) This is a terminal exception, 7798 * so we will either take the HardFault immediately or else enter 7799 * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()). 7800 */ 7801 exc_secure = targets_secure || 7802 !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK); 7803 env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK; 7804 armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure); 7805 return false; 7806 } 7807 7808 static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain, 7809 bool ignore_faults) 7810 { 7811 /* For v8M, push the callee-saves register part of the stack frame. 7812 * Compare the v8M pseudocode PushCalleeStack(). 7813 * In the tailchaining case this may not be the current stack. 7814 */ 7815 CPUARMState *env = &cpu->env; 7816 uint32_t *frame_sp_p; 7817 uint32_t frameptr; 7818 ARMMMUIdx mmu_idx; 7819 bool stacked_ok; 7820 uint32_t limit; 7821 bool want_psp; 7822 7823 if (dotailchain) { 7824 bool mode = lr & R_V7M_EXCRET_MODE_MASK; 7825 bool priv = !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_NPRIV_MASK) || 7826 !mode; 7827 7828 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv); 7829 frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode, 7830 lr & R_V7M_EXCRET_SPSEL_MASK); 7831 want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK); 7832 if (want_psp) { 7833 limit = env->v7m.psplim[M_REG_S]; 7834 } else { 7835 limit = env->v7m.msplim[M_REG_S]; 7836 } 7837 } else { 7838 mmu_idx = arm_mmu_idx(env); 7839 frame_sp_p = &env->regs[13]; 7840 limit = v7m_sp_limit(env); 7841 } 7842 7843 frameptr = *frame_sp_p - 0x28; 7844 if (frameptr < limit) { 7845 /* 7846 * Stack limit failure: set SP to the limit value, and generate 7847 * STKOF UsageFault. Stack pushes below the limit must not be 7848 * performed. It is IMPDEF whether pushes above the limit are 7849 * performed; we choose not to. 7850 */ 7851 qemu_log_mask(CPU_LOG_INT, 7852 "...STKOF during callee-saves register stacking\n"); 7853 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 7854 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 7855 env->v7m.secure); 7856 *frame_sp_p = limit; 7857 return true; 7858 } 7859 7860 /* Write as much of the stack frame as we can. A write failure may 7861 * cause us to pend a derived exception. 7862 */ 7863 stacked_ok = 7864 v7m_stack_write(cpu, frameptr, 0xfefa125b, mmu_idx, ignore_faults) && 7865 v7m_stack_write(cpu, frameptr + 0x8, env->regs[4], mmu_idx, 7866 ignore_faults) && 7867 v7m_stack_write(cpu, frameptr + 0xc, env->regs[5], mmu_idx, 7868 ignore_faults) && 7869 v7m_stack_write(cpu, frameptr + 0x10, env->regs[6], mmu_idx, 7870 ignore_faults) && 7871 v7m_stack_write(cpu, frameptr + 0x14, env->regs[7], mmu_idx, 7872 ignore_faults) && 7873 v7m_stack_write(cpu, frameptr + 0x18, env->regs[8], mmu_idx, 7874 ignore_faults) && 7875 v7m_stack_write(cpu, frameptr + 0x1c, env->regs[9], mmu_idx, 7876 ignore_faults) && 7877 v7m_stack_write(cpu, frameptr + 0x20, env->regs[10], mmu_idx, 7878 ignore_faults) && 7879 v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx, 7880 ignore_faults); 7881 7882 /* Update SP regardless of whether any of the stack accesses failed. */ 7883 *frame_sp_p = frameptr; 7884 7885 return !stacked_ok; 7886 } 7887 7888 static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain, 7889 bool ignore_stackfaults) 7890 { 7891 /* Do the "take the exception" parts of exception entry, 7892 * but not the pushing of state to the stack. This is 7893 * similar to the pseudocode ExceptionTaken() function. 7894 */ 7895 CPUARMState *env = &cpu->env; 7896 uint32_t addr; 7897 bool targets_secure; 7898 int exc; 7899 bool push_failed = false; 7900 7901 armv7m_nvic_get_pending_irq_info(env->nvic, &exc, &targets_secure); 7902 qemu_log_mask(CPU_LOG_INT, "...taking pending %s exception %d\n", 7903 targets_secure ? "secure" : "nonsecure", exc); 7904 7905 if (arm_feature(env, ARM_FEATURE_V8)) { 7906 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 7907 (lr & R_V7M_EXCRET_S_MASK)) { 7908 /* The background code (the owner of the registers in the 7909 * exception frame) is Secure. This means it may either already 7910 * have or now needs to push callee-saves registers. 7911 */ 7912 if (targets_secure) { 7913 if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) { 7914 /* We took an exception from Secure to NonSecure 7915 * (which means the callee-saved registers got stacked) 7916 * and are now tailchaining to a Secure exception. 7917 * Clear DCRS so eventual return from this Secure 7918 * exception unstacks the callee-saved registers. 7919 */ 7920 lr &= ~R_V7M_EXCRET_DCRS_MASK; 7921 } 7922 } else { 7923 /* We're going to a non-secure exception; push the 7924 * callee-saves registers to the stack now, if they're 7925 * not already saved. 7926 */ 7927 if (lr & R_V7M_EXCRET_DCRS_MASK && 7928 !(dotailchain && !(lr & R_V7M_EXCRET_ES_MASK))) { 7929 push_failed = v7m_push_callee_stack(cpu, lr, dotailchain, 7930 ignore_stackfaults); 7931 } 7932 lr |= R_V7M_EXCRET_DCRS_MASK; 7933 } 7934 } 7935 7936 lr &= ~R_V7M_EXCRET_ES_MASK; 7937 if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7938 lr |= R_V7M_EXCRET_ES_MASK; 7939 } 7940 lr &= ~R_V7M_EXCRET_SPSEL_MASK; 7941 if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) { 7942 lr |= R_V7M_EXCRET_SPSEL_MASK; 7943 } 7944 7945 /* Clear registers if necessary to prevent non-secure exception 7946 * code being able to see register values from secure code. 7947 * Where register values become architecturally UNKNOWN we leave 7948 * them with their previous values. 7949 */ 7950 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 7951 if (!targets_secure) { 7952 /* Always clear the caller-saved registers (they have been 7953 * pushed to the stack earlier in v7m_push_stack()). 7954 * Clear callee-saved registers if the background code is 7955 * Secure (in which case these regs were saved in 7956 * v7m_push_callee_stack()). 7957 */ 7958 int i; 7959 7960 for (i = 0; i < 13; i++) { 7961 /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */ 7962 if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) { 7963 env->regs[i] = 0; 7964 } 7965 } 7966 /* Clear EAPSR */ 7967 xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT); 7968 } 7969 } 7970 } 7971 7972 if (push_failed && !ignore_stackfaults) { 7973 /* Derived exception on callee-saves register stacking: 7974 * we might now want to take a different exception which 7975 * targets a different security state, so try again from the top. 7976 */ 7977 qemu_log_mask(CPU_LOG_INT, 7978 "...derived exception on callee-saves register stacking"); 7979 v7m_exception_taken(cpu, lr, true, true); 7980 return; 7981 } 7982 7983 if (!arm_v7m_load_vector(cpu, exc, targets_secure, &addr)) { 7984 /* Vector load failed: derived exception */ 7985 qemu_log_mask(CPU_LOG_INT, "...derived exception on vector table load"); 7986 v7m_exception_taken(cpu, lr, true, true); 7987 return; 7988 } 7989 7990 /* Now we've done everything that might cause a derived exception 7991 * we can go ahead and activate whichever exception we're going to 7992 * take (which might now be the derived exception). 7993 */ 7994 armv7m_nvic_acknowledge_irq(env->nvic); 7995 7996 /* Switch to target security state -- must do this before writing SPSEL */ 7997 switch_v7m_security_state(env, targets_secure); 7998 write_v7m_control_spsel(env, 0); 7999 arm_clear_exclusive(env); 8000 /* Clear IT bits */ 8001 env->condexec_bits = 0; 8002 env->regs[14] = lr; 8003 env->regs[15] = addr & 0xfffffffe; 8004 env->thumb = addr & 1; 8005 } 8006 8007 static bool v7m_push_stack(ARMCPU *cpu) 8008 { 8009 /* Do the "set up stack frame" part of exception entry, 8010 * similar to pseudocode PushStack(). 8011 * Return true if we generate a derived exception (and so 8012 * should ignore further stack faults trying to process 8013 * that derived exception.) 8014 */ 8015 bool stacked_ok; 8016 CPUARMState *env = &cpu->env; 8017 uint32_t xpsr = xpsr_read(env); 8018 uint32_t frameptr = env->regs[13]; 8019 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 8020 8021 /* Align stack pointer if the guest wants that */ 8022 if ((frameptr & 4) && 8023 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKALIGN_MASK)) { 8024 frameptr -= 4; 8025 xpsr |= XPSR_SPREALIGN; 8026 } 8027 8028 frameptr -= 0x20; 8029 8030 if (arm_feature(env, ARM_FEATURE_V8)) { 8031 uint32_t limit = v7m_sp_limit(env); 8032 8033 if (frameptr < limit) { 8034 /* 8035 * Stack limit failure: set SP to the limit value, and generate 8036 * STKOF UsageFault. Stack pushes below the limit must not be 8037 * performed. It is IMPDEF whether pushes above the limit are 8038 * performed; we choose not to. 8039 */ 8040 qemu_log_mask(CPU_LOG_INT, 8041 "...STKOF during stacking\n"); 8042 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 8043 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8044 env->v7m.secure); 8045 env->regs[13] = limit; 8046 return true; 8047 } 8048 } 8049 8050 /* Write as much of the stack frame as we can. If we fail a stack 8051 * write this will result in a derived exception being pended 8052 * (which may be taken in preference to the one we started with 8053 * if it has higher priority). 8054 */ 8055 stacked_ok = 8056 v7m_stack_write(cpu, frameptr, env->regs[0], mmu_idx, false) && 8057 v7m_stack_write(cpu, frameptr + 4, env->regs[1], mmu_idx, false) && 8058 v7m_stack_write(cpu, frameptr + 8, env->regs[2], mmu_idx, false) && 8059 v7m_stack_write(cpu, frameptr + 12, env->regs[3], mmu_idx, false) && 8060 v7m_stack_write(cpu, frameptr + 16, env->regs[12], mmu_idx, false) && 8061 v7m_stack_write(cpu, frameptr + 20, env->regs[14], mmu_idx, false) && 8062 v7m_stack_write(cpu, frameptr + 24, env->regs[15], mmu_idx, false) && 8063 v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, false); 8064 8065 /* Update SP regardless of whether any of the stack accesses failed. */ 8066 env->regs[13] = frameptr; 8067 8068 return !stacked_ok; 8069 } 8070 8071 static void do_v7m_exception_exit(ARMCPU *cpu) 8072 { 8073 CPUARMState *env = &cpu->env; 8074 uint32_t excret; 8075 uint32_t xpsr; 8076 bool ufault = false; 8077 bool sfault = false; 8078 bool return_to_sp_process; 8079 bool return_to_handler; 8080 bool rettobase = false; 8081 bool exc_secure = false; 8082 bool return_to_secure; 8083 8084 /* If we're not in Handler mode then jumps to magic exception-exit 8085 * addresses don't have magic behaviour. However for the v8M 8086 * security extensions the magic secure-function-return has to 8087 * work in thread mode too, so to avoid doing an extra check in 8088 * the generated code we allow exception-exit magic to also cause the 8089 * internal exception and bring us here in thread mode. Correct code 8090 * will never try to do this (the following insn fetch will always 8091 * fault) so we the overhead of having taken an unnecessary exception 8092 * doesn't matter. 8093 */ 8094 if (!arm_v7m_is_handler_mode(env)) { 8095 return; 8096 } 8097 8098 /* In the spec pseudocode ExceptionReturn() is called directly 8099 * from BXWritePC() and gets the full target PC value including 8100 * bit zero. In QEMU's implementation we treat it as a normal 8101 * jump-to-register (which is then caught later on), and so split 8102 * the target value up between env->regs[15] and env->thumb in 8103 * gen_bx(). Reconstitute it. 8104 */ 8105 excret = env->regs[15]; 8106 if (env->thumb) { 8107 excret |= 1; 8108 } 8109 8110 qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32 8111 " previous exception %d\n", 8112 excret, env->v7m.exception); 8113 8114 if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) { 8115 qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception " 8116 "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", 8117 excret); 8118 } 8119 8120 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8121 /* EXC_RETURN.ES validation check (R_SMFL). We must do this before 8122 * we pick which FAULTMASK to clear. 8123 */ 8124 if (!env->v7m.secure && 8125 ((excret & R_V7M_EXCRET_ES_MASK) || 8126 !(excret & R_V7M_EXCRET_DCRS_MASK))) { 8127 sfault = 1; 8128 /* For all other purposes, treat ES as 0 (R_HXSR) */ 8129 excret &= ~R_V7M_EXCRET_ES_MASK; 8130 } 8131 exc_secure = excret & R_V7M_EXCRET_ES_MASK; 8132 } 8133 8134 if (env->v7m.exception != ARMV7M_EXCP_NMI) { 8135 /* Auto-clear FAULTMASK on return from other than NMI. 8136 * If the security extension is implemented then this only 8137 * happens if the raw execution priority is >= 0; the 8138 * value of the ES bit in the exception return value indicates 8139 * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.) 8140 */ 8141 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8142 if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) { 8143 env->v7m.faultmask[exc_secure] = 0; 8144 } 8145 } else { 8146 env->v7m.faultmask[M_REG_NS] = 0; 8147 } 8148 } 8149 8150 switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception, 8151 exc_secure)) { 8152 case -1: 8153 /* attempt to exit an exception that isn't active */ 8154 ufault = true; 8155 break; 8156 case 0: 8157 /* still an irq active now */ 8158 break; 8159 case 1: 8160 /* we returned to base exception level, no nesting. 8161 * (In the pseudocode this is written using "NestedActivation != 1" 8162 * where we have 'rettobase == false'.) 8163 */ 8164 rettobase = true; 8165 break; 8166 default: 8167 g_assert_not_reached(); 8168 } 8169 8170 return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK); 8171 return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK; 8172 return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) && 8173 (excret & R_V7M_EXCRET_S_MASK); 8174 8175 if (arm_feature(env, ARM_FEATURE_V8)) { 8176 if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) { 8177 /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP); 8178 * we choose to take the UsageFault. 8179 */ 8180 if ((excret & R_V7M_EXCRET_S_MASK) || 8181 (excret & R_V7M_EXCRET_ES_MASK) || 8182 !(excret & R_V7M_EXCRET_DCRS_MASK)) { 8183 ufault = true; 8184 } 8185 } 8186 if (excret & R_V7M_EXCRET_RES0_MASK) { 8187 ufault = true; 8188 } 8189 } else { 8190 /* For v7M we only recognize certain combinations of the low bits */ 8191 switch (excret & 0xf) { 8192 case 1: /* Return to Handler */ 8193 break; 8194 case 13: /* Return to Thread using Process stack */ 8195 case 9: /* Return to Thread using Main stack */ 8196 /* We only need to check NONBASETHRDENA for v7M, because in 8197 * v8M this bit does not exist (it is RES1). 8198 */ 8199 if (!rettobase && 8200 !(env->v7m.ccr[env->v7m.secure] & 8201 R_V7M_CCR_NONBASETHRDENA_MASK)) { 8202 ufault = true; 8203 } 8204 break; 8205 default: 8206 ufault = true; 8207 } 8208 } 8209 8210 /* 8211 * Set CONTROL.SPSEL from excret.SPSEL. Since we're still in 8212 * Handler mode (and will be until we write the new XPSR.Interrupt 8213 * field) this does not switch around the current stack pointer. 8214 * We must do this before we do any kind of tailchaining, including 8215 * for the derived exceptions on integrity check failures, or we will 8216 * give the guest an incorrect EXCRET.SPSEL value on exception entry. 8217 */ 8218 write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure); 8219 8220 if (sfault) { 8221 env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK; 8222 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8223 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8224 "stackframe: failed EXC_RETURN.ES validity check\n"); 8225 v7m_exception_taken(cpu, excret, true, false); 8226 return; 8227 } 8228 8229 if (ufault) { 8230 /* Bad exception return: instead of popping the exception 8231 * stack, directly take a usage fault on the current stack. 8232 */ 8233 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8234 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8235 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " 8236 "stackframe: failed exception return integrity check\n"); 8237 v7m_exception_taken(cpu, excret, true, false); 8238 return; 8239 } 8240 8241 /* 8242 * Tailchaining: if there is currently a pending exception that 8243 * is high enough priority to preempt execution at the level we're 8244 * about to return to, then just directly take that exception now, 8245 * avoiding an unstack-and-then-stack. Note that now we have 8246 * deactivated the previous exception by calling armv7m_nvic_complete_irq() 8247 * our current execution priority is already the execution priority we are 8248 * returning to -- none of the state we would unstack or set based on 8249 * the EXCRET value affects it. 8250 */ 8251 if (armv7m_nvic_can_take_pending_exception(env->nvic)) { 8252 qemu_log_mask(CPU_LOG_INT, "...tailchaining to pending exception\n"); 8253 v7m_exception_taken(cpu, excret, true, false); 8254 return; 8255 } 8256 8257 switch_v7m_security_state(env, return_to_secure); 8258 8259 { 8260 /* The stack pointer we should be reading the exception frame from 8261 * depends on bits in the magic exception return type value (and 8262 * for v8M isn't necessarily the stack pointer we will eventually 8263 * end up resuming execution with). Get a pointer to the location 8264 * in the CPU state struct where the SP we need is currently being 8265 * stored; we will use and modify it in place. 8266 * We use this limited C variable scope so we don't accidentally 8267 * use 'frame_sp_p' after we do something that makes it invalid. 8268 */ 8269 uint32_t *frame_sp_p = get_v7m_sp_ptr(env, 8270 return_to_secure, 8271 !return_to_handler, 8272 return_to_sp_process); 8273 uint32_t frameptr = *frame_sp_p; 8274 bool pop_ok = true; 8275 ARMMMUIdx mmu_idx; 8276 bool return_to_priv = return_to_handler || 8277 !(env->v7m.control[return_to_secure] & R_V7M_CONTROL_NPRIV_MASK); 8278 8279 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, return_to_secure, 8280 return_to_priv); 8281 8282 if (!QEMU_IS_ALIGNED(frameptr, 8) && 8283 arm_feature(env, ARM_FEATURE_V8)) { 8284 qemu_log_mask(LOG_GUEST_ERROR, 8285 "M profile exception return with non-8-aligned SP " 8286 "for destination state is UNPREDICTABLE\n"); 8287 } 8288 8289 /* Do we need to pop callee-saved registers? */ 8290 if (return_to_secure && 8291 ((excret & R_V7M_EXCRET_ES_MASK) == 0 || 8292 (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) { 8293 uint32_t expected_sig = 0xfefa125b; 8294 uint32_t actual_sig; 8295 8296 pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx); 8297 8298 if (pop_ok && expected_sig != actual_sig) { 8299 /* Take a SecureFault on the current stack */ 8300 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK; 8301 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8302 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing " 8303 "stackframe: failed exception return integrity " 8304 "signature check\n"); 8305 v7m_exception_taken(cpu, excret, true, false); 8306 return; 8307 } 8308 8309 pop_ok = pop_ok && 8310 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) && 8311 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) && 8312 v7m_stack_read(cpu, &env->regs[6], frameptr + 0x10, mmu_idx) && 8313 v7m_stack_read(cpu, &env->regs[7], frameptr + 0x14, mmu_idx) && 8314 v7m_stack_read(cpu, &env->regs[8], frameptr + 0x18, mmu_idx) && 8315 v7m_stack_read(cpu, &env->regs[9], frameptr + 0x1c, mmu_idx) && 8316 v7m_stack_read(cpu, &env->regs[10], frameptr + 0x20, mmu_idx) && 8317 v7m_stack_read(cpu, &env->regs[11], frameptr + 0x24, mmu_idx); 8318 8319 frameptr += 0x28; 8320 } 8321 8322 /* Pop registers */ 8323 pop_ok = pop_ok && 8324 v7m_stack_read(cpu, &env->regs[0], frameptr, mmu_idx) && 8325 v7m_stack_read(cpu, &env->regs[1], frameptr + 0x4, mmu_idx) && 8326 v7m_stack_read(cpu, &env->regs[2], frameptr + 0x8, mmu_idx) && 8327 v7m_stack_read(cpu, &env->regs[3], frameptr + 0xc, mmu_idx) && 8328 v7m_stack_read(cpu, &env->regs[12], frameptr + 0x10, mmu_idx) && 8329 v7m_stack_read(cpu, &env->regs[14], frameptr + 0x14, mmu_idx) && 8330 v7m_stack_read(cpu, &env->regs[15], frameptr + 0x18, mmu_idx) && 8331 v7m_stack_read(cpu, &xpsr, frameptr + 0x1c, mmu_idx); 8332 8333 if (!pop_ok) { 8334 /* v7m_stack_read() pended a fault, so take it (as a tail 8335 * chained exception on the same stack frame) 8336 */ 8337 qemu_log_mask(CPU_LOG_INT, "...derived exception on unstacking\n"); 8338 v7m_exception_taken(cpu, excret, true, false); 8339 return; 8340 } 8341 8342 /* Returning from an exception with a PC with bit 0 set is defined 8343 * behaviour on v8M (bit 0 is ignored), but for v7M it was specified 8344 * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore 8345 * the lsbit, and there are several RTOSes out there which incorrectly 8346 * assume the r15 in the stack frame should be a Thumb-style "lsbit 8347 * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but 8348 * complain about the badly behaved guest. 8349 */ 8350 if (env->regs[15] & 1) { 8351 env->regs[15] &= ~1U; 8352 if (!arm_feature(env, ARM_FEATURE_V8)) { 8353 qemu_log_mask(LOG_GUEST_ERROR, 8354 "M profile return from interrupt with misaligned " 8355 "PC is UNPREDICTABLE on v7M\n"); 8356 } 8357 } 8358 8359 if (arm_feature(env, ARM_FEATURE_V8)) { 8360 /* For v8M we have to check whether the xPSR exception field 8361 * matches the EXCRET value for return to handler/thread 8362 * before we commit to changing the SP and xPSR. 8363 */ 8364 bool will_be_handler = (xpsr & XPSR_EXCP) != 0; 8365 if (return_to_handler != will_be_handler) { 8366 /* Take an INVPC UsageFault on the current stack. 8367 * By this point we will have switched to the security state 8368 * for the background state, so this UsageFault will target 8369 * that state. 8370 */ 8371 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8372 env->v7m.secure); 8373 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8374 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " 8375 "stackframe: failed exception return integrity " 8376 "check\n"); 8377 v7m_exception_taken(cpu, excret, true, false); 8378 return; 8379 } 8380 } 8381 8382 /* Commit to consuming the stack frame */ 8383 frameptr += 0x20; 8384 /* Undo stack alignment (the SPREALIGN bit indicates that the original 8385 * pre-exception SP was not 8-aligned and we added a padding word to 8386 * align it, so we undo this by ORing in the bit that increases it 8387 * from the current 8-aligned value to the 8-unaligned value. (Adding 4 8388 * would work too but a logical OR is how the pseudocode specifies it.) 8389 */ 8390 if (xpsr & XPSR_SPREALIGN) { 8391 frameptr |= 4; 8392 } 8393 *frame_sp_p = frameptr; 8394 } 8395 /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */ 8396 xpsr_write(env, xpsr, ~XPSR_SPREALIGN); 8397 8398 /* The restored xPSR exception field will be zero if we're 8399 * resuming in Thread mode. If that doesn't match what the 8400 * exception return excret specified then this is a UsageFault. 8401 * v7M requires we make this check here; v8M did it earlier. 8402 */ 8403 if (return_to_handler != arm_v7m_is_handler_mode(env)) { 8404 /* Take an INVPC UsageFault by pushing the stack again; 8405 * we know we're v7M so this is never a Secure UsageFault. 8406 */ 8407 bool ignore_stackfaults; 8408 8409 assert(!arm_feature(env, ARM_FEATURE_V8)); 8410 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false); 8411 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8412 ignore_stackfaults = v7m_push_stack(cpu); 8413 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: " 8414 "failed exception return integrity check\n"); 8415 v7m_exception_taken(cpu, excret, false, ignore_stackfaults); 8416 return; 8417 } 8418 8419 /* Otherwise, we have a successful exception exit. */ 8420 arm_clear_exclusive(env); 8421 qemu_log_mask(CPU_LOG_INT, "...successful exception return\n"); 8422 } 8423 8424 static bool do_v7m_function_return(ARMCPU *cpu) 8425 { 8426 /* v8M security extensions magic function return. 8427 * We may either: 8428 * (1) throw an exception (longjump) 8429 * (2) return true if we successfully handled the function return 8430 * (3) return false if we failed a consistency check and have 8431 * pended a UsageFault that needs to be taken now 8432 * 8433 * At this point the magic return value is split between env->regs[15] 8434 * and env->thumb. We don't bother to reconstitute it because we don't 8435 * need it (all values are handled the same way). 8436 */ 8437 CPUARMState *env = &cpu->env; 8438 uint32_t newpc, newpsr, newpsr_exc; 8439 8440 qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n"); 8441 8442 { 8443 bool threadmode, spsel; 8444 TCGMemOpIdx oi; 8445 ARMMMUIdx mmu_idx; 8446 uint32_t *frame_sp_p; 8447 uint32_t frameptr; 8448 8449 /* Pull the return address and IPSR from the Secure stack */ 8450 threadmode = !arm_v7m_is_handler_mode(env); 8451 spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK; 8452 8453 frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel); 8454 frameptr = *frame_sp_p; 8455 8456 /* These loads may throw an exception (for MPU faults). We want to 8457 * do them as secure, so work out what MMU index that is. 8458 */ 8459 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true); 8460 oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx)); 8461 newpc = helper_le_ldul_mmu(env, frameptr, oi, 0); 8462 newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0); 8463 8464 /* Consistency checks on new IPSR */ 8465 newpsr_exc = newpsr & XPSR_EXCP; 8466 if (!((env->v7m.exception == 0 && newpsr_exc == 0) || 8467 (env->v7m.exception == 1 && newpsr_exc != 0))) { 8468 /* Pend the fault and tell our caller to take it */ 8469 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; 8470 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, 8471 env->v7m.secure); 8472 qemu_log_mask(CPU_LOG_INT, 8473 "...taking INVPC UsageFault: " 8474 "IPSR consistency check failed\n"); 8475 return false; 8476 } 8477 8478 *frame_sp_p = frameptr + 8; 8479 } 8480 8481 /* This invalidates frame_sp_p */ 8482 switch_v7m_security_state(env, true); 8483 env->v7m.exception = newpsr_exc; 8484 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK; 8485 if (newpsr & XPSR_SFPA) { 8486 env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK; 8487 } 8488 xpsr_write(env, 0, XPSR_IT); 8489 env->thumb = newpc & 1; 8490 env->regs[15] = newpc & ~1; 8491 8492 qemu_log_mask(CPU_LOG_INT, "...function return successful\n"); 8493 return true; 8494 } 8495 8496 static void arm_log_exception(int idx) 8497 { 8498 if (qemu_loglevel_mask(CPU_LOG_INT)) { 8499 const char *exc = NULL; 8500 static const char * const excnames[] = { 8501 [EXCP_UDEF] = "Undefined Instruction", 8502 [EXCP_SWI] = "SVC", 8503 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 8504 [EXCP_DATA_ABORT] = "Data Abort", 8505 [EXCP_IRQ] = "IRQ", 8506 [EXCP_FIQ] = "FIQ", 8507 [EXCP_BKPT] = "Breakpoint", 8508 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 8509 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 8510 [EXCP_HVC] = "Hypervisor Call", 8511 [EXCP_HYP_TRAP] = "Hypervisor Trap", 8512 [EXCP_SMC] = "Secure Monitor Call", 8513 [EXCP_VIRQ] = "Virtual IRQ", 8514 [EXCP_VFIQ] = "Virtual FIQ", 8515 [EXCP_SEMIHOST] = "Semihosting call", 8516 [EXCP_NOCP] = "v7M NOCP UsageFault", 8517 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 8518 [EXCP_STKOF] = "v8M STKOF UsageFault", 8519 }; 8520 8521 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 8522 exc = excnames[idx]; 8523 } 8524 if (!exc) { 8525 exc = "unknown"; 8526 } 8527 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc); 8528 } 8529 } 8530 8531 static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx, 8532 uint32_t addr, uint16_t *insn) 8533 { 8534 /* Load a 16-bit portion of a v7M instruction, returning true on success, 8535 * or false on failure (in which case we will have pended the appropriate 8536 * exception). 8537 * We need to do the instruction fetch's MPU and SAU checks 8538 * like this because there is no MMU index that would allow 8539 * doing the load with a single function call. Instead we must 8540 * first check that the security attributes permit the load 8541 * and that they don't mismatch on the two halves of the instruction, 8542 * and then we do the load as a secure load (ie using the security 8543 * attributes of the address, not the CPU, as architecturally required). 8544 */ 8545 CPUState *cs = CPU(cpu); 8546 CPUARMState *env = &cpu->env; 8547 V8M_SAttributes sattrs = {}; 8548 MemTxAttrs attrs = {}; 8549 ARMMMUFaultInfo fi = {}; 8550 MemTxResult txres; 8551 target_ulong page_size; 8552 hwaddr physaddr; 8553 int prot; 8554 8555 v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs); 8556 if (!sattrs.nsc || sattrs.ns) { 8557 /* This must be the second half of the insn, and it straddles a 8558 * region boundary with the second half not being S&NSC. 8559 */ 8560 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 8561 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8562 qemu_log_mask(CPU_LOG_INT, 8563 "...really SecureFault with SFSR.INVEP\n"); 8564 return false; 8565 } 8566 if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx, 8567 &physaddr, &attrs, &prot, &page_size, &fi, NULL)) { 8568 /* the MPU lookup failed */ 8569 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK; 8570 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure); 8571 qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n"); 8572 return false; 8573 } 8574 *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr, 8575 attrs, &txres); 8576 if (txres != MEMTX_OK) { 8577 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; 8578 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); 8579 qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n"); 8580 return false; 8581 } 8582 return true; 8583 } 8584 8585 static bool v7m_handle_execute_nsc(ARMCPU *cpu) 8586 { 8587 /* Check whether this attempt to execute code in a Secure & NS-Callable 8588 * memory region is for an SG instruction; if so, then emulate the 8589 * effect of the SG instruction and return true. Otherwise pend 8590 * the correct kind of exception and return false. 8591 */ 8592 CPUARMState *env = &cpu->env; 8593 ARMMMUIdx mmu_idx; 8594 uint16_t insn; 8595 8596 /* We should never get here unless get_phys_addr_pmsav8() caused 8597 * an exception for NS executing in S&NSC memory. 8598 */ 8599 assert(!env->v7m.secure); 8600 assert(arm_feature(env, ARM_FEATURE_M_SECURITY)); 8601 8602 /* We want to do the MPU lookup as secure; work out what mmu_idx that is */ 8603 mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true); 8604 8605 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) { 8606 return false; 8607 } 8608 8609 if (!env->thumb) { 8610 goto gen_invep; 8611 } 8612 8613 if (insn != 0xe97f) { 8614 /* Not an SG instruction first half (we choose the IMPDEF 8615 * early-SG-check option). 8616 */ 8617 goto gen_invep; 8618 } 8619 8620 if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) { 8621 return false; 8622 } 8623 8624 if (insn != 0xe97f) { 8625 /* Not an SG instruction second half (yes, both halves of the SG 8626 * insn have the same hex value) 8627 */ 8628 goto gen_invep; 8629 } 8630 8631 /* OK, we have confirmed that we really have an SG instruction. 8632 * We know we're NS in S memory so don't need to repeat those checks. 8633 */ 8634 qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32 8635 ", executing it\n", env->regs[15]); 8636 env->regs[14] &= ~1; 8637 switch_v7m_security_state(env, true); 8638 xpsr_write(env, 0, XPSR_IT); 8639 env->regs[15] += 4; 8640 return true; 8641 8642 gen_invep: 8643 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 8644 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8645 qemu_log_mask(CPU_LOG_INT, 8646 "...really SecureFault with SFSR.INVEP\n"); 8647 return false; 8648 } 8649 8650 void arm_v7m_cpu_do_interrupt(CPUState *cs) 8651 { 8652 ARMCPU *cpu = ARM_CPU(cs); 8653 CPUARMState *env = &cpu->env; 8654 uint32_t lr; 8655 bool ignore_stackfaults; 8656 8657 arm_log_exception(cs->exception_index); 8658 8659 /* For exceptions we just mark as pending on the NVIC, and let that 8660 handle it. */ 8661 switch (cs->exception_index) { 8662 case EXCP_UDEF: 8663 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8664 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNDEFINSTR_MASK; 8665 break; 8666 case EXCP_NOCP: 8667 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8668 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_NOCP_MASK; 8669 break; 8670 case EXCP_INVSTATE: 8671 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8672 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVSTATE_MASK; 8673 break; 8674 case EXCP_STKOF: 8675 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); 8676 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK; 8677 break; 8678 case EXCP_SWI: 8679 /* The PC already points to the next instruction. */ 8680 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC, env->v7m.secure); 8681 break; 8682 case EXCP_PREFETCH_ABORT: 8683 case EXCP_DATA_ABORT: 8684 /* Note that for M profile we don't have a guest facing FSR, but 8685 * the env->exception.fsr will be populated by the code that 8686 * raises the fault, in the A profile short-descriptor format. 8687 */ 8688 switch (env->exception.fsr & 0xf) { 8689 case M_FAKE_FSR_NSC_EXEC: 8690 /* Exception generated when we try to execute code at an address 8691 * which is marked as Secure & Non-Secure Callable and the CPU 8692 * is in the Non-Secure state. The only instruction which can 8693 * be executed like this is SG (and that only if both halves of 8694 * the SG instruction have the same security attributes.) 8695 * Everything else must generate an INVEP SecureFault, so we 8696 * emulate the SG instruction here. 8697 */ 8698 if (v7m_handle_execute_nsc(cpu)) { 8699 return; 8700 } 8701 break; 8702 case M_FAKE_FSR_SFAULT: 8703 /* Various flavours of SecureFault for attempts to execute or 8704 * access data in the wrong security state. 8705 */ 8706 switch (cs->exception_index) { 8707 case EXCP_PREFETCH_ABORT: 8708 if (env->v7m.secure) { 8709 env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK; 8710 qemu_log_mask(CPU_LOG_INT, 8711 "...really SecureFault with SFSR.INVTRAN\n"); 8712 } else { 8713 env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK; 8714 qemu_log_mask(CPU_LOG_INT, 8715 "...really SecureFault with SFSR.INVEP\n"); 8716 } 8717 break; 8718 case EXCP_DATA_ABORT: 8719 /* This must be an NS access to S memory */ 8720 env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK; 8721 qemu_log_mask(CPU_LOG_INT, 8722 "...really SecureFault with SFSR.AUVIOL\n"); 8723 break; 8724 } 8725 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false); 8726 break; 8727 case 0x8: /* External Abort */ 8728 switch (cs->exception_index) { 8729 case EXCP_PREFETCH_ABORT: 8730 env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; 8731 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n"); 8732 break; 8733 case EXCP_DATA_ABORT: 8734 env->v7m.cfsr[M_REG_NS] |= 8735 (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK); 8736 env->v7m.bfar = env->exception.vaddress; 8737 qemu_log_mask(CPU_LOG_INT, 8738 "...with CFSR.PRECISERR and BFAR 0x%x\n", 8739 env->v7m.bfar); 8740 break; 8741 } 8742 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); 8743 break; 8744 default: 8745 /* All other FSR values are either MPU faults or "can't happen 8746 * for M profile" cases. 8747 */ 8748 switch (cs->exception_index) { 8749 case EXCP_PREFETCH_ABORT: 8750 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK; 8751 qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n"); 8752 break; 8753 case EXCP_DATA_ABORT: 8754 env->v7m.cfsr[env->v7m.secure] |= 8755 (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK); 8756 env->v7m.mmfar[env->v7m.secure] = env->exception.vaddress; 8757 qemu_log_mask(CPU_LOG_INT, 8758 "...with CFSR.DACCVIOL and MMFAR 0x%x\n", 8759 env->v7m.mmfar[env->v7m.secure]); 8760 break; 8761 } 8762 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, 8763 env->v7m.secure); 8764 break; 8765 } 8766 break; 8767 case EXCP_BKPT: 8768 if (semihosting_enabled()) { 8769 int nr; 8770 nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff; 8771 if (nr == 0xab) { 8772 env->regs[15] += 2; 8773 qemu_log_mask(CPU_LOG_INT, 8774 "...handling as semihosting call 0x%x\n", 8775 env->regs[0]); 8776 env->regs[0] = do_arm_semihosting(env); 8777 return; 8778 } 8779 } 8780 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false); 8781 break; 8782 case EXCP_IRQ: 8783 break; 8784 case EXCP_EXCEPTION_EXIT: 8785 if (env->regs[15] < EXC_RETURN_MIN_MAGIC) { 8786 /* Must be v8M security extension function return */ 8787 assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC); 8788 assert(arm_feature(env, ARM_FEATURE_M_SECURITY)); 8789 if (do_v7m_function_return(cpu)) { 8790 return; 8791 } 8792 } else { 8793 do_v7m_exception_exit(cpu); 8794 return; 8795 } 8796 break; 8797 default: 8798 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 8799 return; /* Never happens. Keep compiler happy. */ 8800 } 8801 8802 if (arm_feature(env, ARM_FEATURE_V8)) { 8803 lr = R_V7M_EXCRET_RES1_MASK | 8804 R_V7M_EXCRET_DCRS_MASK | 8805 R_V7M_EXCRET_FTYPE_MASK; 8806 /* The S bit indicates whether we should return to Secure 8807 * or NonSecure (ie our current state). 8808 * The ES bit indicates whether we're taking this exception 8809 * to Secure or NonSecure (ie our target state). We set it 8810 * later, in v7m_exception_taken(). 8811 * The SPSEL bit is also set in v7m_exception_taken() for v8M. 8812 * This corresponds to the ARM ARM pseudocode for v8M setting 8813 * some LR bits in PushStack() and some in ExceptionTaken(); 8814 * the distinction matters for the tailchain cases where we 8815 * can take an exception without pushing the stack. 8816 */ 8817 if (env->v7m.secure) { 8818 lr |= R_V7M_EXCRET_S_MASK; 8819 } 8820 } else { 8821 lr = R_V7M_EXCRET_RES1_MASK | 8822 R_V7M_EXCRET_S_MASK | 8823 R_V7M_EXCRET_DCRS_MASK | 8824 R_V7M_EXCRET_FTYPE_MASK | 8825 R_V7M_EXCRET_ES_MASK; 8826 if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) { 8827 lr |= R_V7M_EXCRET_SPSEL_MASK; 8828 } 8829 } 8830 if (!arm_v7m_is_handler_mode(env)) { 8831 lr |= R_V7M_EXCRET_MODE_MASK; 8832 } 8833 8834 ignore_stackfaults = v7m_push_stack(cpu); 8835 v7m_exception_taken(cpu, lr, false, ignore_stackfaults); 8836 } 8837 8838 /* Function used to synchronize QEMU's AArch64 register set with AArch32 8839 * register set. This is necessary when switching between AArch32 and AArch64 8840 * execution state. 8841 */ 8842 void aarch64_sync_32_to_64(CPUARMState *env) 8843 { 8844 int i; 8845 uint32_t mode = env->uncached_cpsr & CPSR_M; 8846 8847 /* We can blanket copy R[0:7] to X[0:7] */ 8848 for (i = 0; i < 8; i++) { 8849 env->xregs[i] = env->regs[i]; 8850 } 8851 8852 /* Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 8853 * Otherwise, they come from the banked user regs. 8854 */ 8855 if (mode == ARM_CPU_MODE_FIQ) { 8856 for (i = 8; i < 13; i++) { 8857 env->xregs[i] = env->usr_regs[i - 8]; 8858 } 8859 } else { 8860 for (i = 8; i < 13; i++) { 8861 env->xregs[i] = env->regs[i]; 8862 } 8863 } 8864 8865 /* Registers x13-x23 are the various mode SP and FP registers. Registers 8866 * r13 and r14 are only copied if we are in that mode, otherwise we copy 8867 * from the mode banked register. 8868 */ 8869 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 8870 env->xregs[13] = env->regs[13]; 8871 env->xregs[14] = env->regs[14]; 8872 } else { 8873 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 8874 /* HYP is an exception in that it is copied from r14 */ 8875 if (mode == ARM_CPU_MODE_HYP) { 8876 env->xregs[14] = env->regs[14]; 8877 } else { 8878 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 8879 } 8880 } 8881 8882 if (mode == ARM_CPU_MODE_HYP) { 8883 env->xregs[15] = env->regs[13]; 8884 } else { 8885 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 8886 } 8887 8888 if (mode == ARM_CPU_MODE_IRQ) { 8889 env->xregs[16] = env->regs[14]; 8890 env->xregs[17] = env->regs[13]; 8891 } else { 8892 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 8893 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 8894 } 8895 8896 if (mode == ARM_CPU_MODE_SVC) { 8897 env->xregs[18] = env->regs[14]; 8898 env->xregs[19] = env->regs[13]; 8899 } else { 8900 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 8901 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 8902 } 8903 8904 if (mode == ARM_CPU_MODE_ABT) { 8905 env->xregs[20] = env->regs[14]; 8906 env->xregs[21] = env->regs[13]; 8907 } else { 8908 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 8909 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 8910 } 8911 8912 if (mode == ARM_CPU_MODE_UND) { 8913 env->xregs[22] = env->regs[14]; 8914 env->xregs[23] = env->regs[13]; 8915 } else { 8916 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 8917 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 8918 } 8919 8920 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 8921 * mode, then we can copy from r8-r14. Otherwise, we copy from the 8922 * FIQ bank for r8-r14. 8923 */ 8924 if (mode == ARM_CPU_MODE_FIQ) { 8925 for (i = 24; i < 31; i++) { 8926 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 8927 } 8928 } else { 8929 for (i = 24; i < 29; i++) { 8930 env->xregs[i] = env->fiq_regs[i - 24]; 8931 } 8932 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 8933 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 8934 } 8935 8936 env->pc = env->regs[15]; 8937 } 8938 8939 /* Function used to synchronize QEMU's AArch32 register set with AArch64 8940 * register set. This is necessary when switching between AArch32 and AArch64 8941 * execution state. 8942 */ 8943 void aarch64_sync_64_to_32(CPUARMState *env) 8944 { 8945 int i; 8946 uint32_t mode = env->uncached_cpsr & CPSR_M; 8947 8948 /* We can blanket copy X[0:7] to R[0:7] */ 8949 for (i = 0; i < 8; i++) { 8950 env->regs[i] = env->xregs[i]; 8951 } 8952 8953 /* Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 8954 * Otherwise, we copy x8-x12 into the banked user regs. 8955 */ 8956 if (mode == ARM_CPU_MODE_FIQ) { 8957 for (i = 8; i < 13; i++) { 8958 env->usr_regs[i - 8] = env->xregs[i]; 8959 } 8960 } else { 8961 for (i = 8; i < 13; i++) { 8962 env->regs[i] = env->xregs[i]; 8963 } 8964 } 8965 8966 /* Registers r13 & r14 depend on the current mode. 8967 * If we are in a given mode, we copy the corresponding x registers to r13 8968 * and r14. Otherwise, we copy the x register to the banked r13 and r14 8969 * for the mode. 8970 */ 8971 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 8972 env->regs[13] = env->xregs[13]; 8973 env->regs[14] = env->xregs[14]; 8974 } else { 8975 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 8976 8977 /* HYP is an exception in that it does not have its own banked r14 but 8978 * shares the USR r14 8979 */ 8980 if (mode == ARM_CPU_MODE_HYP) { 8981 env->regs[14] = env->xregs[14]; 8982 } else { 8983 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 8984 } 8985 } 8986 8987 if (mode == ARM_CPU_MODE_HYP) { 8988 env->regs[13] = env->xregs[15]; 8989 } else { 8990 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 8991 } 8992 8993 if (mode == ARM_CPU_MODE_IRQ) { 8994 env->regs[14] = env->xregs[16]; 8995 env->regs[13] = env->xregs[17]; 8996 } else { 8997 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 8998 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 8999 } 9000 9001 if (mode == ARM_CPU_MODE_SVC) { 9002 env->regs[14] = env->xregs[18]; 9003 env->regs[13] = env->xregs[19]; 9004 } else { 9005 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 9006 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 9007 } 9008 9009 if (mode == ARM_CPU_MODE_ABT) { 9010 env->regs[14] = env->xregs[20]; 9011 env->regs[13] = env->xregs[21]; 9012 } else { 9013 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 9014 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 9015 } 9016 9017 if (mode == ARM_CPU_MODE_UND) { 9018 env->regs[14] = env->xregs[22]; 9019 env->regs[13] = env->xregs[23]; 9020 } else { 9021 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 9022 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 9023 } 9024 9025 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 9026 * mode, then we can copy to r8-r14. Otherwise, we copy to the 9027 * FIQ bank for r8-r14. 9028 */ 9029 if (mode == ARM_CPU_MODE_FIQ) { 9030 for (i = 24; i < 31; i++) { 9031 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 9032 } 9033 } else { 9034 for (i = 24; i < 29; i++) { 9035 env->fiq_regs[i - 24] = env->xregs[i]; 9036 } 9037 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 9038 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 9039 } 9040 9041 env->regs[15] = env->pc; 9042 } 9043 9044 static void take_aarch32_exception(CPUARMState *env, int new_mode, 9045 uint32_t mask, uint32_t offset, 9046 uint32_t newpc) 9047 { 9048 /* Change the CPU state so as to actually take the exception. */ 9049 switch_mode(env, new_mode); 9050 /* 9051 * For exceptions taken to AArch32 we must clear the SS bit in both 9052 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 9053 */ 9054 env->uncached_cpsr &= ~PSTATE_SS; 9055 env->spsr = cpsr_read(env); 9056 /* Clear IT bits. */ 9057 env->condexec_bits = 0; 9058 /* Switch to the new mode, and to the correct instruction set. */ 9059 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 9060 /* Set new mode endianness */ 9061 env->uncached_cpsr &= ~CPSR_E; 9062 if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) { 9063 env->uncached_cpsr |= CPSR_E; 9064 } 9065 /* J and IL must always be cleared for exception entry */ 9066 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 9067 env->daif |= mask; 9068 9069 if (new_mode == ARM_CPU_MODE_HYP) { 9070 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 9071 env->elr_el[2] = env->regs[15]; 9072 } else { 9073 /* 9074 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 9075 * and we should just guard the thumb mode on V4 9076 */ 9077 if (arm_feature(env, ARM_FEATURE_V4T)) { 9078 env->thumb = 9079 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 9080 } 9081 env->regs[14] = env->regs[15] + offset; 9082 } 9083 env->regs[15] = newpc; 9084 } 9085 9086 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 9087 { 9088 /* 9089 * Handle exception entry to Hyp mode; this is sufficiently 9090 * different to entry to other AArch32 modes that we handle it 9091 * separately here. 9092 * 9093 * The vector table entry used is always the 0x14 Hyp mode entry point, 9094 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp. 9095 * The offset applied to the preferred return address is always zero 9096 * (see DDI0487C.a section G1.12.3). 9097 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 9098 */ 9099 uint32_t addr, mask; 9100 ARMCPU *cpu = ARM_CPU(cs); 9101 CPUARMState *env = &cpu->env; 9102 9103 switch (cs->exception_index) { 9104 case EXCP_UDEF: 9105 addr = 0x04; 9106 break; 9107 case EXCP_SWI: 9108 addr = 0x14; 9109 break; 9110 case EXCP_BKPT: 9111 /* Fall through to prefetch abort. */ 9112 case EXCP_PREFETCH_ABORT: 9113 env->cp15.ifar_s = env->exception.vaddress; 9114 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 9115 (uint32_t)env->exception.vaddress); 9116 addr = 0x0c; 9117 break; 9118 case EXCP_DATA_ABORT: 9119 env->cp15.dfar_s = env->exception.vaddress; 9120 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 9121 (uint32_t)env->exception.vaddress); 9122 addr = 0x10; 9123 break; 9124 case EXCP_IRQ: 9125 addr = 0x18; 9126 break; 9127 case EXCP_FIQ: 9128 addr = 0x1c; 9129 break; 9130 case EXCP_HVC: 9131 addr = 0x08; 9132 break; 9133 case EXCP_HYP_TRAP: 9134 addr = 0x14; 9135 default: 9136 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9137 } 9138 9139 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 9140 if (!arm_feature(env, ARM_FEATURE_V8)) { 9141 /* 9142 * QEMU syndrome values are v8-style. v7 has the IL bit 9143 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 9144 * If this is a v7 CPU, squash the IL bit in those cases. 9145 */ 9146 if (cs->exception_index == EXCP_PREFETCH_ABORT || 9147 (cs->exception_index == EXCP_DATA_ABORT && 9148 !(env->exception.syndrome & ARM_EL_ISV)) || 9149 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 9150 env->exception.syndrome &= ~ARM_EL_IL; 9151 } 9152 } 9153 env->cp15.esr_el[2] = env->exception.syndrome; 9154 } 9155 9156 if (arm_current_el(env) != 2 && addr < 0x14) { 9157 addr = 0x14; 9158 } 9159 9160 mask = 0; 9161 if (!(env->cp15.scr_el3 & SCR_EA)) { 9162 mask |= CPSR_A; 9163 } 9164 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 9165 mask |= CPSR_I; 9166 } 9167 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 9168 mask |= CPSR_F; 9169 } 9170 9171 addr += env->cp15.hvbar; 9172 9173 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 9174 } 9175 9176 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 9177 { 9178 ARMCPU *cpu = ARM_CPU(cs); 9179 CPUARMState *env = &cpu->env; 9180 uint32_t addr; 9181 uint32_t mask; 9182 int new_mode; 9183 uint32_t offset; 9184 uint32_t moe; 9185 9186 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 9187 switch (syn_get_ec(env->exception.syndrome)) { 9188 case EC_BREAKPOINT: 9189 case EC_BREAKPOINT_SAME_EL: 9190 moe = 1; 9191 break; 9192 case EC_WATCHPOINT: 9193 case EC_WATCHPOINT_SAME_EL: 9194 moe = 10; 9195 break; 9196 case EC_AA32_BKPT: 9197 moe = 3; 9198 break; 9199 case EC_VECTORCATCH: 9200 moe = 5; 9201 break; 9202 default: 9203 moe = 0; 9204 break; 9205 } 9206 9207 if (moe) { 9208 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 9209 } 9210 9211 if (env->exception.target_el == 2) { 9212 arm_cpu_do_interrupt_aarch32_hyp(cs); 9213 return; 9214 } 9215 9216 switch (cs->exception_index) { 9217 case EXCP_UDEF: 9218 new_mode = ARM_CPU_MODE_UND; 9219 addr = 0x04; 9220 mask = CPSR_I; 9221 if (env->thumb) 9222 offset = 2; 9223 else 9224 offset = 4; 9225 break; 9226 case EXCP_SWI: 9227 new_mode = ARM_CPU_MODE_SVC; 9228 addr = 0x08; 9229 mask = CPSR_I; 9230 /* The PC already points to the next instruction. */ 9231 offset = 0; 9232 break; 9233 case EXCP_BKPT: 9234 /* Fall through to prefetch abort. */ 9235 case EXCP_PREFETCH_ABORT: 9236 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 9237 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 9238 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 9239 env->exception.fsr, (uint32_t)env->exception.vaddress); 9240 new_mode = ARM_CPU_MODE_ABT; 9241 addr = 0x0c; 9242 mask = CPSR_A | CPSR_I; 9243 offset = 4; 9244 break; 9245 case EXCP_DATA_ABORT: 9246 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 9247 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 9248 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 9249 env->exception.fsr, 9250 (uint32_t)env->exception.vaddress); 9251 new_mode = ARM_CPU_MODE_ABT; 9252 addr = 0x10; 9253 mask = CPSR_A | CPSR_I; 9254 offset = 8; 9255 break; 9256 case EXCP_IRQ: 9257 new_mode = ARM_CPU_MODE_IRQ; 9258 addr = 0x18; 9259 /* Disable IRQ and imprecise data aborts. */ 9260 mask = CPSR_A | CPSR_I; 9261 offset = 4; 9262 if (env->cp15.scr_el3 & SCR_IRQ) { 9263 /* IRQ routed to monitor mode */ 9264 new_mode = ARM_CPU_MODE_MON; 9265 mask |= CPSR_F; 9266 } 9267 break; 9268 case EXCP_FIQ: 9269 new_mode = ARM_CPU_MODE_FIQ; 9270 addr = 0x1c; 9271 /* Disable FIQ, IRQ and imprecise data aborts. */ 9272 mask = CPSR_A | CPSR_I | CPSR_F; 9273 if (env->cp15.scr_el3 & SCR_FIQ) { 9274 /* FIQ routed to monitor mode */ 9275 new_mode = ARM_CPU_MODE_MON; 9276 } 9277 offset = 4; 9278 break; 9279 case EXCP_VIRQ: 9280 new_mode = ARM_CPU_MODE_IRQ; 9281 addr = 0x18; 9282 /* Disable IRQ and imprecise data aborts. */ 9283 mask = CPSR_A | CPSR_I; 9284 offset = 4; 9285 break; 9286 case EXCP_VFIQ: 9287 new_mode = ARM_CPU_MODE_FIQ; 9288 addr = 0x1c; 9289 /* Disable FIQ, IRQ and imprecise data aborts. */ 9290 mask = CPSR_A | CPSR_I | CPSR_F; 9291 offset = 4; 9292 break; 9293 case EXCP_SMC: 9294 new_mode = ARM_CPU_MODE_MON; 9295 addr = 0x08; 9296 mask = CPSR_A | CPSR_I | CPSR_F; 9297 offset = 0; 9298 break; 9299 default: 9300 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9301 return; /* Never happens. Keep compiler happy. */ 9302 } 9303 9304 if (new_mode == ARM_CPU_MODE_MON) { 9305 addr += env->cp15.mvbar; 9306 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 9307 /* High vectors. When enabled, base address cannot be remapped. */ 9308 addr += 0xffff0000; 9309 } else { 9310 /* ARM v7 architectures provide a vector base address register to remap 9311 * the interrupt vector table. 9312 * This register is only followed in non-monitor mode, and is banked. 9313 * Note: only bits 31:5 are valid. 9314 */ 9315 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 9316 } 9317 9318 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 9319 env->cp15.scr_el3 &= ~SCR_NS; 9320 } 9321 9322 take_aarch32_exception(env, new_mode, mask, offset, addr); 9323 } 9324 9325 /* Handle exception entry to a target EL which is using AArch64 */ 9326 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 9327 { 9328 ARMCPU *cpu = ARM_CPU(cs); 9329 CPUARMState *env = &cpu->env; 9330 unsigned int new_el = env->exception.target_el; 9331 target_ulong addr = env->cp15.vbar_el[new_el]; 9332 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 9333 unsigned int cur_el = arm_current_el(env); 9334 9335 /* 9336 * Note that new_el can never be 0. If cur_el is 0, then 9337 * el0_a64 is is_a64(), else el0_a64 is ignored. 9338 */ 9339 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 9340 9341 if (cur_el < new_el) { 9342 /* Entry vector offset depends on whether the implemented EL 9343 * immediately lower than the target level is using AArch32 or AArch64 9344 */ 9345 bool is_aa64; 9346 9347 switch (new_el) { 9348 case 3: 9349 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 9350 break; 9351 case 2: 9352 is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0; 9353 break; 9354 case 1: 9355 is_aa64 = is_a64(env); 9356 break; 9357 default: 9358 g_assert_not_reached(); 9359 } 9360 9361 if (is_aa64) { 9362 addr += 0x400; 9363 } else { 9364 addr += 0x600; 9365 } 9366 } else if (pstate_read(env) & PSTATE_SP) { 9367 addr += 0x200; 9368 } 9369 9370 switch (cs->exception_index) { 9371 case EXCP_PREFETCH_ABORT: 9372 case EXCP_DATA_ABORT: 9373 env->cp15.far_el[new_el] = env->exception.vaddress; 9374 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 9375 env->cp15.far_el[new_el]); 9376 /* fall through */ 9377 case EXCP_BKPT: 9378 case EXCP_UDEF: 9379 case EXCP_SWI: 9380 case EXCP_HVC: 9381 case EXCP_HYP_TRAP: 9382 case EXCP_SMC: 9383 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) { 9384 /* 9385 * QEMU internal FP/SIMD syndromes from AArch32 include the 9386 * TA and coproc fields which are only exposed if the exception 9387 * is taken to AArch32 Hyp mode. Mask them out to get a valid 9388 * AArch64 format syndrome. 9389 */ 9390 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 9391 } 9392 env->cp15.esr_el[new_el] = env->exception.syndrome; 9393 break; 9394 case EXCP_IRQ: 9395 case EXCP_VIRQ: 9396 addr += 0x80; 9397 break; 9398 case EXCP_FIQ: 9399 case EXCP_VFIQ: 9400 addr += 0x100; 9401 break; 9402 case EXCP_SEMIHOST: 9403 qemu_log_mask(CPU_LOG_INT, 9404 "...handling as semihosting call 0x%" PRIx64 "\n", 9405 env->xregs[0]); 9406 env->xregs[0] = do_arm_semihosting(env); 9407 return; 9408 default: 9409 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9410 } 9411 9412 if (is_a64(env)) { 9413 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env); 9414 aarch64_save_sp(env, arm_current_el(env)); 9415 env->elr_el[new_el] = env->pc; 9416 } else { 9417 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env); 9418 env->elr_el[new_el] = env->regs[15]; 9419 9420 aarch64_sync_32_to_64(env); 9421 9422 env->condexec_bits = 0; 9423 } 9424 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 9425 env->elr_el[new_el]); 9426 9427 pstate_write(env, PSTATE_DAIF | new_mode); 9428 env->aarch64 = 1; 9429 aarch64_restore_sp(env, new_el); 9430 9431 env->pc = addr; 9432 9433 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 9434 new_el, env->pc, pstate_read(env)); 9435 } 9436 9437 static inline bool check_for_semihosting(CPUState *cs) 9438 { 9439 /* Check whether this exception is a semihosting call; if so 9440 * then handle it and return true; otherwise return false. 9441 */ 9442 ARMCPU *cpu = ARM_CPU(cs); 9443 CPUARMState *env = &cpu->env; 9444 9445 if (is_a64(env)) { 9446 if (cs->exception_index == EXCP_SEMIHOST) { 9447 /* This is always the 64-bit semihosting exception. 9448 * The "is this usermode" and "is semihosting enabled" 9449 * checks have been done at translate time. 9450 */ 9451 qemu_log_mask(CPU_LOG_INT, 9452 "...handling as semihosting call 0x%" PRIx64 "\n", 9453 env->xregs[0]); 9454 env->xregs[0] = do_arm_semihosting(env); 9455 return true; 9456 } 9457 return false; 9458 } else { 9459 uint32_t imm; 9460 9461 /* Only intercept calls from privileged modes, to provide some 9462 * semblance of security. 9463 */ 9464 if (cs->exception_index != EXCP_SEMIHOST && 9465 (!semihosting_enabled() || 9466 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) { 9467 return false; 9468 } 9469 9470 switch (cs->exception_index) { 9471 case EXCP_SEMIHOST: 9472 /* This is always a semihosting call; the "is this usermode" 9473 * and "is semihosting enabled" checks have been done at 9474 * translate time. 9475 */ 9476 break; 9477 case EXCP_SWI: 9478 /* Check for semihosting interrupt. */ 9479 if (env->thumb) { 9480 imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env)) 9481 & 0xff; 9482 if (imm == 0xab) { 9483 break; 9484 } 9485 } else { 9486 imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env)) 9487 & 0xffffff; 9488 if (imm == 0x123456) { 9489 break; 9490 } 9491 } 9492 return false; 9493 case EXCP_BKPT: 9494 /* See if this is a semihosting syscall. */ 9495 if (env->thumb) { 9496 imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) 9497 & 0xff; 9498 if (imm == 0xab) { 9499 env->regs[15] += 2; 9500 break; 9501 } 9502 } 9503 return false; 9504 default: 9505 return false; 9506 } 9507 9508 qemu_log_mask(CPU_LOG_INT, 9509 "...handling as semihosting call 0x%x\n", 9510 env->regs[0]); 9511 env->regs[0] = do_arm_semihosting(env); 9512 return true; 9513 } 9514 } 9515 9516 /* Handle a CPU exception for A and R profile CPUs. 9517 * Do any appropriate logging, handle PSCI calls, and then hand off 9518 * to the AArch64-entry or AArch32-entry function depending on the 9519 * target exception level's register width. 9520 */ 9521 void arm_cpu_do_interrupt(CPUState *cs) 9522 { 9523 ARMCPU *cpu = ARM_CPU(cs); 9524 CPUARMState *env = &cpu->env; 9525 unsigned int new_el = env->exception.target_el; 9526 9527 assert(!arm_feature(env, ARM_FEATURE_M)); 9528 9529 arm_log_exception(cs->exception_index); 9530 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 9531 new_el); 9532 if (qemu_loglevel_mask(CPU_LOG_INT) 9533 && !excp_is_internal(cs->exception_index)) { 9534 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 9535 syn_get_ec(env->exception.syndrome), 9536 env->exception.syndrome); 9537 } 9538 9539 if (arm_is_psci_call(cpu, cs->exception_index)) { 9540 arm_handle_psci_call(cpu); 9541 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 9542 return; 9543 } 9544 9545 /* Semihosting semantics depend on the register width of the 9546 * code that caused the exception, not the target exception level, 9547 * so must be handled here. 9548 */ 9549 if (check_for_semihosting(cs)) { 9550 return; 9551 } 9552 9553 /* Hooks may change global state so BQL should be held, also the 9554 * BQL needs to be held for any modification of 9555 * cs->interrupt_request. 9556 */ 9557 g_assert(qemu_mutex_iothread_locked()); 9558 9559 arm_call_pre_el_change_hook(cpu); 9560 9561 assert(!excp_is_internal(cs->exception_index)); 9562 if (arm_el_is_aa64(env, new_el)) { 9563 arm_cpu_do_interrupt_aarch64(cs); 9564 } else { 9565 arm_cpu_do_interrupt_aarch32(cs); 9566 } 9567 9568 arm_call_el_change_hook(cpu); 9569 9570 if (!kvm_enabled()) { 9571 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 9572 } 9573 } 9574 9575 /* Return the exception level which controls this address translation regime */ 9576 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx) 9577 { 9578 switch (mmu_idx) { 9579 case ARMMMUIdx_S2NS: 9580 case ARMMMUIdx_S1E2: 9581 return 2; 9582 case ARMMMUIdx_S1E3: 9583 return 3; 9584 case ARMMMUIdx_S1SE0: 9585 return arm_el_is_aa64(env, 3) ? 1 : 3; 9586 case ARMMMUIdx_S1SE1: 9587 case ARMMMUIdx_S1NSE0: 9588 case ARMMMUIdx_S1NSE1: 9589 case ARMMMUIdx_MPrivNegPri: 9590 case ARMMMUIdx_MUserNegPri: 9591 case ARMMMUIdx_MPriv: 9592 case ARMMMUIdx_MUser: 9593 case ARMMMUIdx_MSPrivNegPri: 9594 case ARMMMUIdx_MSUserNegPri: 9595 case ARMMMUIdx_MSPriv: 9596 case ARMMMUIdx_MSUser: 9597 return 1; 9598 default: 9599 g_assert_not_reached(); 9600 } 9601 } 9602 9603 /* Return the SCTLR value which controls this address translation regime */ 9604 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx) 9605 { 9606 return env->cp15.sctlr_el[regime_el(env, mmu_idx)]; 9607 } 9608 9609 /* Return true if the specified stage of address translation is disabled */ 9610 static inline bool regime_translation_disabled(CPUARMState *env, 9611 ARMMMUIdx mmu_idx) 9612 { 9613 if (arm_feature(env, ARM_FEATURE_M)) { 9614 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] & 9615 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 9616 case R_V7M_MPU_CTRL_ENABLE_MASK: 9617 /* Enabled, but not for HardFault and NMI */ 9618 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 9619 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 9620 /* Enabled for all cases */ 9621 return false; 9622 case 0: 9623 default: 9624 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 9625 * we warned about that in armv7m_nvic.c when the guest set it. 9626 */ 9627 return true; 9628 } 9629 } 9630 9631 if (mmu_idx == ARMMMUIdx_S2NS) { 9632 /* HCR.DC means HCR.VM behaves as 1 */ 9633 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0; 9634 } 9635 9636 if (env->cp15.hcr_el2 & HCR_TGE) { 9637 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */ 9638 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) { 9639 return true; 9640 } 9641 } 9642 9643 if ((env->cp15.hcr_el2 & HCR_DC) && 9644 (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) { 9645 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 9646 return true; 9647 } 9648 9649 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 9650 } 9651 9652 static inline bool regime_translation_big_endian(CPUARMState *env, 9653 ARMMMUIdx mmu_idx) 9654 { 9655 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 9656 } 9657 9658 /* Return the TCR controlling this translation regime */ 9659 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx) 9660 { 9661 if (mmu_idx == ARMMMUIdx_S2NS) { 9662 return &env->cp15.vtcr_el2; 9663 } 9664 return &env->cp15.tcr_el[regime_el(env, mmu_idx)]; 9665 } 9666 9667 /* Convert a possible stage1+2 MMU index into the appropriate 9668 * stage 1 MMU index 9669 */ 9670 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 9671 { 9672 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 9673 mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0); 9674 } 9675 return mmu_idx; 9676 } 9677 9678 /* Return the TTBR associated with this translation regime */ 9679 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, 9680 int ttbrn) 9681 { 9682 if (mmu_idx == ARMMMUIdx_S2NS) { 9683 return env->cp15.vttbr_el2; 9684 } 9685 if (ttbrn == 0) { 9686 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 9687 } else { 9688 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 9689 } 9690 } 9691 9692 /* Return true if the translation regime is using LPAE format page tables */ 9693 static inline bool regime_using_lpae_format(CPUARMState *env, 9694 ARMMMUIdx mmu_idx) 9695 { 9696 int el = regime_el(env, mmu_idx); 9697 if (el == 2 || arm_el_is_aa64(env, el)) { 9698 return true; 9699 } 9700 if (arm_feature(env, ARM_FEATURE_LPAE) 9701 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) { 9702 return true; 9703 } 9704 return false; 9705 } 9706 9707 /* Returns true if the stage 1 translation regime is using LPAE format page 9708 * tables. Used when raising alignment exceptions, whose FSR changes depending 9709 * on whether the long or short descriptor format is in use. */ 9710 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx) 9711 { 9712 mmu_idx = stage_1_mmu_idx(mmu_idx); 9713 9714 return regime_using_lpae_format(env, mmu_idx); 9715 } 9716 9717 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx) 9718 { 9719 switch (mmu_idx) { 9720 case ARMMMUIdx_S1SE0: 9721 case ARMMMUIdx_S1NSE0: 9722 case ARMMMUIdx_MUser: 9723 case ARMMMUIdx_MSUser: 9724 case ARMMMUIdx_MUserNegPri: 9725 case ARMMMUIdx_MSUserNegPri: 9726 return true; 9727 default: 9728 return false; 9729 case ARMMMUIdx_S12NSE0: 9730 case ARMMMUIdx_S12NSE1: 9731 g_assert_not_reached(); 9732 } 9733 } 9734 9735 /* Translate section/page access permissions to page 9736 * R/W protection flags 9737 * 9738 * @env: CPUARMState 9739 * @mmu_idx: MMU index indicating required translation regime 9740 * @ap: The 3-bit access permissions (AP[2:0]) 9741 * @domain_prot: The 2-bit domain access permissions 9742 */ 9743 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 9744 int ap, int domain_prot) 9745 { 9746 bool is_user = regime_is_user(env, mmu_idx); 9747 9748 if (domain_prot == 3) { 9749 return PAGE_READ | PAGE_WRITE; 9750 } 9751 9752 switch (ap) { 9753 case 0: 9754 if (arm_feature(env, ARM_FEATURE_V7)) { 9755 return 0; 9756 } 9757 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 9758 case SCTLR_S: 9759 return is_user ? 0 : PAGE_READ; 9760 case SCTLR_R: 9761 return PAGE_READ; 9762 default: 9763 return 0; 9764 } 9765 case 1: 9766 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 9767 case 2: 9768 if (is_user) { 9769 return PAGE_READ; 9770 } else { 9771 return PAGE_READ | PAGE_WRITE; 9772 } 9773 case 3: 9774 return PAGE_READ | PAGE_WRITE; 9775 case 4: /* Reserved. */ 9776 return 0; 9777 case 5: 9778 return is_user ? 0 : PAGE_READ; 9779 case 6: 9780 return PAGE_READ; 9781 case 7: 9782 if (!arm_feature(env, ARM_FEATURE_V6K)) { 9783 return 0; 9784 } 9785 return PAGE_READ; 9786 default: 9787 g_assert_not_reached(); 9788 } 9789 } 9790 9791 /* Translate section/page access permissions to page 9792 * R/W protection flags. 9793 * 9794 * @ap: The 2-bit simple AP (AP[2:1]) 9795 * @is_user: TRUE if accessing from PL0 9796 */ 9797 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 9798 { 9799 switch (ap) { 9800 case 0: 9801 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 9802 case 1: 9803 return PAGE_READ | PAGE_WRITE; 9804 case 2: 9805 return is_user ? 0 : PAGE_READ; 9806 case 3: 9807 return PAGE_READ; 9808 default: 9809 g_assert_not_reached(); 9810 } 9811 } 9812 9813 static inline int 9814 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 9815 { 9816 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 9817 } 9818 9819 /* Translate S2 section/page access permissions to protection flags 9820 * 9821 * @env: CPUARMState 9822 * @s2ap: The 2-bit stage2 access permissions (S2AP) 9823 * @xn: XN (execute-never) bit 9824 */ 9825 static int get_S2prot(CPUARMState *env, int s2ap, int xn) 9826 { 9827 int prot = 0; 9828 9829 if (s2ap & 1) { 9830 prot |= PAGE_READ; 9831 } 9832 if (s2ap & 2) { 9833 prot |= PAGE_WRITE; 9834 } 9835 if (!xn) { 9836 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 9837 prot |= PAGE_EXEC; 9838 } 9839 } 9840 return prot; 9841 } 9842 9843 /* Translate section/page access permissions to protection flags 9844 * 9845 * @env: CPUARMState 9846 * @mmu_idx: MMU index indicating required translation regime 9847 * @is_aa64: TRUE if AArch64 9848 * @ap: The 2-bit simple AP (AP[2:1]) 9849 * @ns: NS (non-secure) bit 9850 * @xn: XN (execute-never) bit 9851 * @pxn: PXN (privileged execute-never) bit 9852 */ 9853 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 9854 int ap, int ns, int xn, int pxn) 9855 { 9856 bool is_user = regime_is_user(env, mmu_idx); 9857 int prot_rw, user_rw; 9858 bool have_wxn; 9859 int wxn = 0; 9860 9861 assert(mmu_idx != ARMMMUIdx_S2NS); 9862 9863 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 9864 if (is_user) { 9865 prot_rw = user_rw; 9866 } else { 9867 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 9868 } 9869 9870 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 9871 return prot_rw; 9872 } 9873 9874 /* TODO have_wxn should be replaced with 9875 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 9876 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 9877 * compatible processors have EL2, which is required for [U]WXN. 9878 */ 9879 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 9880 9881 if (have_wxn) { 9882 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 9883 } 9884 9885 if (is_aa64) { 9886 switch (regime_el(env, mmu_idx)) { 9887 case 1: 9888 if (!is_user) { 9889 xn = pxn || (user_rw & PAGE_WRITE); 9890 } 9891 break; 9892 case 2: 9893 case 3: 9894 break; 9895 } 9896 } else if (arm_feature(env, ARM_FEATURE_V7)) { 9897 switch (regime_el(env, mmu_idx)) { 9898 case 1: 9899 case 3: 9900 if (is_user) { 9901 xn = xn || !(user_rw & PAGE_READ); 9902 } else { 9903 int uwxn = 0; 9904 if (have_wxn) { 9905 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 9906 } 9907 xn = xn || !(prot_rw & PAGE_READ) || pxn || 9908 (uwxn && (user_rw & PAGE_WRITE)); 9909 } 9910 break; 9911 case 2: 9912 break; 9913 } 9914 } else { 9915 xn = wxn = 0; 9916 } 9917 9918 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 9919 return prot_rw; 9920 } 9921 return prot_rw | PAGE_EXEC; 9922 } 9923 9924 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 9925 uint32_t *table, uint32_t address) 9926 { 9927 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 9928 TCR *tcr = regime_tcr(env, mmu_idx); 9929 9930 if (address & tcr->mask) { 9931 if (tcr->raw_tcr & TTBCR_PD1) { 9932 /* Translation table walk disabled for TTBR1 */ 9933 return false; 9934 } 9935 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 9936 } else { 9937 if (tcr->raw_tcr & TTBCR_PD0) { 9938 /* Translation table walk disabled for TTBR0 */ 9939 return false; 9940 } 9941 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask; 9942 } 9943 *table |= (address >> 18) & 0x3ffc; 9944 return true; 9945 } 9946 9947 /* Translate a S1 pagetable walk through S2 if needed. */ 9948 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx, 9949 hwaddr addr, MemTxAttrs txattrs, 9950 ARMMMUFaultInfo *fi) 9951 { 9952 if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) && 9953 !regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 9954 target_ulong s2size; 9955 hwaddr s2pa; 9956 int s2prot; 9957 int ret; 9958 ARMCacheAttrs cacheattrs = {}; 9959 ARMCacheAttrs *pcacheattrs = NULL; 9960 9961 if (env->cp15.hcr_el2 & HCR_PTW) { 9962 /* 9963 * PTW means we must fault if this S1 walk touches S2 Device 9964 * memory; otherwise we don't care about the attributes and can 9965 * save the S2 translation the effort of computing them. 9966 */ 9967 pcacheattrs = &cacheattrs; 9968 } 9969 9970 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa, 9971 &txattrs, &s2prot, &s2size, fi, pcacheattrs); 9972 if (ret) { 9973 assert(fi->type != ARMFault_None); 9974 fi->s2addr = addr; 9975 fi->stage2 = true; 9976 fi->s1ptw = true; 9977 return ~0; 9978 } 9979 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) { 9980 /* Access was to Device memory: generate Permission fault */ 9981 fi->type = ARMFault_Permission; 9982 fi->s2addr = addr; 9983 fi->stage2 = true; 9984 fi->s1ptw = true; 9985 return ~0; 9986 } 9987 addr = s2pa; 9988 } 9989 return addr; 9990 } 9991 9992 /* All loads done in the course of a page table walk go through here. */ 9993 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure, 9994 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 9995 { 9996 ARMCPU *cpu = ARM_CPU(cs); 9997 CPUARMState *env = &cpu->env; 9998 MemTxAttrs attrs = {}; 9999 MemTxResult result = MEMTX_OK; 10000 AddressSpace *as; 10001 uint32_t data; 10002 10003 attrs.secure = is_secure; 10004 as = arm_addressspace(cs, attrs); 10005 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 10006 if (fi->s1ptw) { 10007 return 0; 10008 } 10009 if (regime_translation_big_endian(env, mmu_idx)) { 10010 data = address_space_ldl_be(as, addr, attrs, &result); 10011 } else { 10012 data = address_space_ldl_le(as, addr, attrs, &result); 10013 } 10014 if (result == MEMTX_OK) { 10015 return data; 10016 } 10017 fi->type = ARMFault_SyncExternalOnWalk; 10018 fi->ea = arm_extabort_type(result); 10019 return 0; 10020 } 10021 10022 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, 10023 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 10024 { 10025 ARMCPU *cpu = ARM_CPU(cs); 10026 CPUARMState *env = &cpu->env; 10027 MemTxAttrs attrs = {}; 10028 MemTxResult result = MEMTX_OK; 10029 AddressSpace *as; 10030 uint64_t data; 10031 10032 attrs.secure = is_secure; 10033 as = arm_addressspace(cs, attrs); 10034 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 10035 if (fi->s1ptw) { 10036 return 0; 10037 } 10038 if (regime_translation_big_endian(env, mmu_idx)) { 10039 data = address_space_ldq_be(as, addr, attrs, &result); 10040 } else { 10041 data = address_space_ldq_le(as, addr, attrs, &result); 10042 } 10043 if (result == MEMTX_OK) { 10044 return data; 10045 } 10046 fi->type = ARMFault_SyncExternalOnWalk; 10047 fi->ea = arm_extabort_type(result); 10048 return 0; 10049 } 10050 10051 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address, 10052 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10053 hwaddr *phys_ptr, int *prot, 10054 target_ulong *page_size, 10055 ARMMMUFaultInfo *fi) 10056 { 10057 CPUState *cs = CPU(arm_env_get_cpu(env)); 10058 int level = 1; 10059 uint32_t table; 10060 uint32_t desc; 10061 int type; 10062 int ap; 10063 int domain = 0; 10064 int domain_prot; 10065 hwaddr phys_addr; 10066 uint32_t dacr; 10067 10068 /* Pagetable walk. */ 10069 /* Lookup l1 descriptor. */ 10070 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 10071 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 10072 fi->type = ARMFault_Translation; 10073 goto do_fault; 10074 } 10075 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10076 mmu_idx, fi); 10077 if (fi->type != ARMFault_None) { 10078 goto do_fault; 10079 } 10080 type = (desc & 3); 10081 domain = (desc >> 5) & 0x0f; 10082 if (regime_el(env, mmu_idx) == 1) { 10083 dacr = env->cp15.dacr_ns; 10084 } else { 10085 dacr = env->cp15.dacr_s; 10086 } 10087 domain_prot = (dacr >> (domain * 2)) & 3; 10088 if (type == 0) { 10089 /* Section translation fault. */ 10090 fi->type = ARMFault_Translation; 10091 goto do_fault; 10092 } 10093 if (type != 2) { 10094 level = 2; 10095 } 10096 if (domain_prot == 0 || domain_prot == 2) { 10097 fi->type = ARMFault_Domain; 10098 goto do_fault; 10099 } 10100 if (type == 2) { 10101 /* 1Mb section. */ 10102 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 10103 ap = (desc >> 10) & 3; 10104 *page_size = 1024 * 1024; 10105 } else { 10106 /* Lookup l2 entry. */ 10107 if (type == 1) { 10108 /* Coarse pagetable. */ 10109 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 10110 } else { 10111 /* Fine pagetable. */ 10112 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 10113 } 10114 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10115 mmu_idx, fi); 10116 if (fi->type != ARMFault_None) { 10117 goto do_fault; 10118 } 10119 switch (desc & 3) { 10120 case 0: /* Page translation fault. */ 10121 fi->type = ARMFault_Translation; 10122 goto do_fault; 10123 case 1: /* 64k page. */ 10124 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 10125 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 10126 *page_size = 0x10000; 10127 break; 10128 case 2: /* 4k page. */ 10129 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10130 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 10131 *page_size = 0x1000; 10132 break; 10133 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 10134 if (type == 1) { 10135 /* ARMv6/XScale extended small page format */ 10136 if (arm_feature(env, ARM_FEATURE_XSCALE) 10137 || arm_feature(env, ARM_FEATURE_V6)) { 10138 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10139 *page_size = 0x1000; 10140 } else { 10141 /* UNPREDICTABLE in ARMv5; we choose to take a 10142 * page translation fault. 10143 */ 10144 fi->type = ARMFault_Translation; 10145 goto do_fault; 10146 } 10147 } else { 10148 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 10149 *page_size = 0x400; 10150 } 10151 ap = (desc >> 4) & 3; 10152 break; 10153 default: 10154 /* Never happens, but compiler isn't smart enough to tell. */ 10155 abort(); 10156 } 10157 } 10158 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 10159 *prot |= *prot ? PAGE_EXEC : 0; 10160 if (!(*prot & (1 << access_type))) { 10161 /* Access permission fault. */ 10162 fi->type = ARMFault_Permission; 10163 goto do_fault; 10164 } 10165 *phys_ptr = phys_addr; 10166 return false; 10167 do_fault: 10168 fi->domain = domain; 10169 fi->level = level; 10170 return true; 10171 } 10172 10173 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, 10174 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10175 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 10176 target_ulong *page_size, ARMMMUFaultInfo *fi) 10177 { 10178 CPUState *cs = CPU(arm_env_get_cpu(env)); 10179 int level = 1; 10180 uint32_t table; 10181 uint32_t desc; 10182 uint32_t xn; 10183 uint32_t pxn = 0; 10184 int type; 10185 int ap; 10186 int domain = 0; 10187 int domain_prot; 10188 hwaddr phys_addr; 10189 uint32_t dacr; 10190 bool ns; 10191 10192 /* Pagetable walk. */ 10193 /* Lookup l1 descriptor. */ 10194 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 10195 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 10196 fi->type = ARMFault_Translation; 10197 goto do_fault; 10198 } 10199 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10200 mmu_idx, fi); 10201 if (fi->type != ARMFault_None) { 10202 goto do_fault; 10203 } 10204 type = (desc & 3); 10205 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) { 10206 /* Section translation fault, or attempt to use the encoding 10207 * which is Reserved on implementations without PXN. 10208 */ 10209 fi->type = ARMFault_Translation; 10210 goto do_fault; 10211 } 10212 if ((type == 1) || !(desc & (1 << 18))) { 10213 /* Page or Section. */ 10214 domain = (desc >> 5) & 0x0f; 10215 } 10216 if (regime_el(env, mmu_idx) == 1) { 10217 dacr = env->cp15.dacr_ns; 10218 } else { 10219 dacr = env->cp15.dacr_s; 10220 } 10221 if (type == 1) { 10222 level = 2; 10223 } 10224 domain_prot = (dacr >> (domain * 2)) & 3; 10225 if (domain_prot == 0 || domain_prot == 2) { 10226 /* Section or Page domain fault */ 10227 fi->type = ARMFault_Domain; 10228 goto do_fault; 10229 } 10230 if (type != 1) { 10231 if (desc & (1 << 18)) { 10232 /* Supersection. */ 10233 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 10234 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 10235 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 10236 *page_size = 0x1000000; 10237 } else { 10238 /* Section. */ 10239 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 10240 *page_size = 0x100000; 10241 } 10242 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 10243 xn = desc & (1 << 4); 10244 pxn = desc & 1; 10245 ns = extract32(desc, 19, 1); 10246 } else { 10247 if (arm_feature(env, ARM_FEATURE_PXN)) { 10248 pxn = (desc >> 2) & 1; 10249 } 10250 ns = extract32(desc, 3, 1); 10251 /* Lookup l2 entry. */ 10252 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 10253 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10254 mmu_idx, fi); 10255 if (fi->type != ARMFault_None) { 10256 goto do_fault; 10257 } 10258 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 10259 switch (desc & 3) { 10260 case 0: /* Page translation fault. */ 10261 fi->type = ARMFault_Translation; 10262 goto do_fault; 10263 case 1: /* 64k page. */ 10264 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 10265 xn = desc & (1 << 15); 10266 *page_size = 0x10000; 10267 break; 10268 case 2: case 3: /* 4k page. */ 10269 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10270 xn = desc & 1; 10271 *page_size = 0x1000; 10272 break; 10273 default: 10274 /* Never happens, but compiler isn't smart enough to tell. */ 10275 abort(); 10276 } 10277 } 10278 if (domain_prot == 3) { 10279 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10280 } else { 10281 if (pxn && !regime_is_user(env, mmu_idx)) { 10282 xn = 1; 10283 } 10284 if (xn && access_type == MMU_INST_FETCH) { 10285 fi->type = ARMFault_Permission; 10286 goto do_fault; 10287 } 10288 10289 if (arm_feature(env, ARM_FEATURE_V6K) && 10290 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 10291 /* The simplified model uses AP[0] as an access control bit. */ 10292 if ((ap & 1) == 0) { 10293 /* Access flag fault. */ 10294 fi->type = ARMFault_AccessFlag; 10295 goto do_fault; 10296 } 10297 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 10298 } else { 10299 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 10300 } 10301 if (*prot && !xn) { 10302 *prot |= PAGE_EXEC; 10303 } 10304 if (!(*prot & (1 << access_type))) { 10305 /* Access permission fault. */ 10306 fi->type = ARMFault_Permission; 10307 goto do_fault; 10308 } 10309 } 10310 if (ns) { 10311 /* The NS bit will (as required by the architecture) have no effect if 10312 * the CPU doesn't support TZ or this is a non-secure translation 10313 * regime, because the attribute will already be non-secure. 10314 */ 10315 attrs->secure = false; 10316 } 10317 *phys_ptr = phys_addr; 10318 return false; 10319 do_fault: 10320 fi->domain = domain; 10321 fi->level = level; 10322 return true; 10323 } 10324 10325 /* 10326 * check_s2_mmu_setup 10327 * @cpu: ARMCPU 10328 * @is_aa64: True if the translation regime is in AArch64 state 10329 * @startlevel: Suggested starting level 10330 * @inputsize: Bitsize of IPAs 10331 * @stride: Page-table stride (See the ARM ARM) 10332 * 10333 * Returns true if the suggested S2 translation parameters are OK and 10334 * false otherwise. 10335 */ 10336 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, 10337 int inputsize, int stride) 10338 { 10339 const int grainsize = stride + 3; 10340 int startsizecheck; 10341 10342 /* Negative levels are never allowed. */ 10343 if (level < 0) { 10344 return false; 10345 } 10346 10347 startsizecheck = inputsize - ((3 - level) * stride + grainsize); 10348 if (startsizecheck < 1 || startsizecheck > stride + 4) { 10349 return false; 10350 } 10351 10352 if (is_aa64) { 10353 CPUARMState *env = &cpu->env; 10354 unsigned int pamax = arm_pamax(cpu); 10355 10356 switch (stride) { 10357 case 13: /* 64KB Pages. */ 10358 if (level == 0 || (level == 1 && pamax <= 42)) { 10359 return false; 10360 } 10361 break; 10362 case 11: /* 16KB Pages. */ 10363 if (level == 0 || (level == 1 && pamax <= 40)) { 10364 return false; 10365 } 10366 break; 10367 case 9: /* 4KB Pages. */ 10368 if (level == 0 && pamax <= 42) { 10369 return false; 10370 } 10371 break; 10372 default: 10373 g_assert_not_reached(); 10374 } 10375 10376 /* Inputsize checks. */ 10377 if (inputsize > pamax && 10378 (arm_el_is_aa64(env, 1) || inputsize > 40)) { 10379 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */ 10380 return false; 10381 } 10382 } else { 10383 /* AArch32 only supports 4KB pages. Assert on that. */ 10384 assert(stride == 9); 10385 10386 if (level == 0) { 10387 return false; 10388 } 10389 } 10390 return true; 10391 } 10392 10393 /* Translate from the 4-bit stage 2 representation of 10394 * memory attributes (without cache-allocation hints) to 10395 * the 8-bit representation of the stage 1 MAIR registers 10396 * (which includes allocation hints). 10397 * 10398 * ref: shared/translation/attrs/S2AttrDecode() 10399 * .../S2ConvertAttrsHints() 10400 */ 10401 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs) 10402 { 10403 uint8_t hiattr = extract32(s2attrs, 2, 2); 10404 uint8_t loattr = extract32(s2attrs, 0, 2); 10405 uint8_t hihint = 0, lohint = 0; 10406 10407 if (hiattr != 0) { /* normal memory */ 10408 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */ 10409 hiattr = loattr = 1; /* non-cacheable */ 10410 } else { 10411 if (hiattr != 1) { /* Write-through or write-back */ 10412 hihint = 3; /* RW allocate */ 10413 } 10414 if (loattr != 1) { /* Write-through or write-back */ 10415 lohint = 3; /* RW allocate */ 10416 } 10417 } 10418 } 10419 10420 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 10421 } 10422 10423 ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va, 10424 ARMMMUIdx mmu_idx) 10425 { 10426 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10427 uint32_t el = regime_el(env, mmu_idx); 10428 bool tbi, tbid, epd, hpd, using16k, using64k; 10429 int select, tsz; 10430 10431 /* 10432 * Bit 55 is always between the two regions, and is canonical for 10433 * determining if address tagging is enabled. 10434 */ 10435 select = extract64(va, 55, 1); 10436 10437 if (el > 1) { 10438 tsz = extract32(tcr, 0, 6); 10439 using64k = extract32(tcr, 14, 1); 10440 using16k = extract32(tcr, 15, 1); 10441 if (mmu_idx == ARMMMUIdx_S2NS) { 10442 /* VTCR_EL2 */ 10443 tbi = tbid = hpd = false; 10444 } else { 10445 tbi = extract32(tcr, 20, 1); 10446 hpd = extract32(tcr, 24, 1); 10447 tbid = extract32(tcr, 29, 1); 10448 } 10449 epd = false; 10450 } else if (!select) { 10451 tsz = extract32(tcr, 0, 6); 10452 epd = extract32(tcr, 7, 1); 10453 using64k = extract32(tcr, 14, 1); 10454 using16k = extract32(tcr, 15, 1); 10455 tbi = extract64(tcr, 37, 1); 10456 hpd = extract64(tcr, 41, 1); 10457 tbid = extract64(tcr, 51, 1); 10458 } else { 10459 int tg = extract32(tcr, 30, 2); 10460 using16k = tg == 1; 10461 using64k = tg == 3; 10462 tsz = extract32(tcr, 16, 6); 10463 epd = extract32(tcr, 23, 1); 10464 tbi = extract64(tcr, 38, 1); 10465 hpd = extract64(tcr, 42, 1); 10466 tbid = extract64(tcr, 52, 1); 10467 } 10468 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */ 10469 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */ 10470 10471 return (ARMVAParameters) { 10472 .tsz = tsz, 10473 .select = select, 10474 .tbi = tbi, 10475 .tbid = tbid, 10476 .epd = epd, 10477 .hpd = hpd, 10478 .using16k = using16k, 10479 .using64k = using64k, 10480 }; 10481 } 10482 10483 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 10484 ARMMMUIdx mmu_idx, bool data) 10485 { 10486 ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx); 10487 10488 /* Present TBI as a composite with TBID. */ 10489 ret.tbi &= (data || !ret.tbid); 10490 return ret; 10491 } 10492 10493 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 10494 ARMMMUIdx mmu_idx) 10495 { 10496 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10497 uint32_t el = regime_el(env, mmu_idx); 10498 int select, tsz; 10499 bool epd, hpd; 10500 10501 if (mmu_idx == ARMMMUIdx_S2NS) { 10502 /* VTCR */ 10503 bool sext = extract32(tcr, 4, 1); 10504 bool sign = extract32(tcr, 3, 1); 10505 10506 /* 10507 * If the sign-extend bit is not the same as t0sz[3], the result 10508 * is unpredictable. Flag this as a guest error. 10509 */ 10510 if (sign != sext) { 10511 qemu_log_mask(LOG_GUEST_ERROR, 10512 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 10513 } 10514 tsz = sextract32(tcr, 0, 4) + 8; 10515 select = 0; 10516 hpd = false; 10517 epd = false; 10518 } else if (el == 2) { 10519 /* HTCR */ 10520 tsz = extract32(tcr, 0, 3); 10521 select = 0; 10522 hpd = extract64(tcr, 24, 1); 10523 epd = false; 10524 } else { 10525 int t0sz = extract32(tcr, 0, 3); 10526 int t1sz = extract32(tcr, 16, 3); 10527 10528 if (t1sz == 0) { 10529 select = va > (0xffffffffu >> t0sz); 10530 } else { 10531 /* Note that we will detect errors later. */ 10532 select = va >= ~(0xffffffffu >> t1sz); 10533 } 10534 if (!select) { 10535 tsz = t0sz; 10536 epd = extract32(tcr, 7, 1); 10537 hpd = extract64(tcr, 41, 1); 10538 } else { 10539 tsz = t1sz; 10540 epd = extract32(tcr, 23, 1); 10541 hpd = extract64(tcr, 42, 1); 10542 } 10543 /* For aarch32, hpd0 is not enabled without t2e as well. */ 10544 hpd &= extract32(tcr, 6, 1); 10545 } 10546 10547 return (ARMVAParameters) { 10548 .tsz = tsz, 10549 .select = select, 10550 .epd = epd, 10551 .hpd = hpd, 10552 }; 10553 } 10554 10555 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 10556 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10557 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 10558 target_ulong *page_size_ptr, 10559 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 10560 { 10561 ARMCPU *cpu = arm_env_get_cpu(env); 10562 CPUState *cs = CPU(cpu); 10563 /* Read an LPAE long-descriptor translation table. */ 10564 ARMFaultType fault_type = ARMFault_Translation; 10565 uint32_t level; 10566 ARMVAParameters param; 10567 uint64_t ttbr; 10568 hwaddr descaddr, indexmask, indexmask_grainsize; 10569 uint32_t tableattrs; 10570 target_ulong page_size; 10571 uint32_t attrs; 10572 int32_t stride; 10573 int addrsize, inputsize; 10574 TCR *tcr = regime_tcr(env, mmu_idx); 10575 int ap, ns, xn, pxn; 10576 uint32_t el = regime_el(env, mmu_idx); 10577 bool ttbr1_valid; 10578 uint64_t descaddrmask; 10579 bool aarch64 = arm_el_is_aa64(env, el); 10580 10581 /* TODO: 10582 * This code does not handle the different format TCR for VTCR_EL2. 10583 * This code also does not support shareability levels. 10584 * Attribute and permission bit handling should also be checked when adding 10585 * support for those page table walks. 10586 */ 10587 if (aarch64) { 10588 param = aa64_va_parameters(env, address, mmu_idx, 10589 access_type != MMU_INST_FETCH); 10590 level = 0; 10591 /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it 10592 * invalid. 10593 */ 10594 ttbr1_valid = (el < 2); 10595 addrsize = 64 - 8 * param.tbi; 10596 inputsize = 64 - param.tsz; 10597 } else { 10598 param = aa32_va_parameters(env, address, mmu_idx); 10599 level = 1; 10600 /* There is no TTBR1 for EL2 */ 10601 ttbr1_valid = (el != 2); 10602 addrsize = (mmu_idx == ARMMMUIdx_S2NS ? 40 : 32); 10603 inputsize = addrsize - param.tsz; 10604 } 10605 10606 /* 10607 * We determined the region when collecting the parameters, but we 10608 * have not yet validated that the address is valid for the region. 10609 * Extract the top bits and verify that they all match select. 10610 * 10611 * For aa32, if inputsize == addrsize, then we have selected the 10612 * region by exclusion in aa32_va_parameters and there is no more 10613 * validation to do here. 10614 */ 10615 if (inputsize < addrsize) { 10616 target_ulong top_bits = sextract64(address, inputsize, 10617 addrsize - inputsize); 10618 if (-top_bits != param.select || (param.select && !ttbr1_valid)) { 10619 /* The gap between the two regions is a Translation fault */ 10620 fault_type = ARMFault_Translation; 10621 goto do_fault; 10622 } 10623 } 10624 10625 if (param.using64k) { 10626 stride = 13; 10627 } else if (param.using16k) { 10628 stride = 11; 10629 } else { 10630 stride = 9; 10631 } 10632 10633 /* Note that QEMU ignores shareability and cacheability attributes, 10634 * so we don't need to do anything with the SH, ORGN, IRGN fields 10635 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 10636 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 10637 * implement any ASID-like capability so we can ignore it (instead 10638 * we will always flush the TLB any time the ASID is changed). 10639 */ 10640 ttbr = regime_ttbr(env, mmu_idx, param.select); 10641 10642 /* Here we should have set up all the parameters for the translation: 10643 * inputsize, ttbr, epd, stride, tbi 10644 */ 10645 10646 if (param.epd) { 10647 /* Translation table walk disabled => Translation fault on TLB miss 10648 * Note: This is always 0 on 64-bit EL2 and EL3. 10649 */ 10650 goto do_fault; 10651 } 10652 10653 if (mmu_idx != ARMMMUIdx_S2NS) { 10654 /* The starting level depends on the virtual address size (which can 10655 * be up to 48 bits) and the translation granule size. It indicates 10656 * the number of strides (stride bits at a time) needed to 10657 * consume the bits of the input address. In the pseudocode this is: 10658 * level = 4 - RoundUp((inputsize - grainsize) / stride) 10659 * where their 'inputsize' is our 'inputsize', 'grainsize' is 10660 * our 'stride + 3' and 'stride' is our 'stride'. 10661 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 10662 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 10663 * = 4 - (inputsize - 4) / stride; 10664 */ 10665 level = 4 - (inputsize - 4) / stride; 10666 } else { 10667 /* For stage 2 translations the starting level is specified by the 10668 * VTCR_EL2.SL0 field (whose interpretation depends on the page size) 10669 */ 10670 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2); 10671 uint32_t startlevel; 10672 bool ok; 10673 10674 if (!aarch64 || stride == 9) { 10675 /* AArch32 or 4KB pages */ 10676 startlevel = 2 - sl0; 10677 } else { 10678 /* 16KB or 64KB pages */ 10679 startlevel = 3 - sl0; 10680 } 10681 10682 /* Check that the starting level is valid. */ 10683 ok = check_s2_mmu_setup(cpu, aarch64, startlevel, 10684 inputsize, stride); 10685 if (!ok) { 10686 fault_type = ARMFault_Translation; 10687 goto do_fault; 10688 } 10689 level = startlevel; 10690 } 10691 10692 indexmask_grainsize = (1ULL << (stride + 3)) - 1; 10693 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1; 10694 10695 /* Now we can extract the actual base address from the TTBR */ 10696 descaddr = extract64(ttbr, 0, 48); 10697 descaddr &= ~indexmask; 10698 10699 /* The address field in the descriptor goes up to bit 39 for ARMv7 10700 * but up to bit 47 for ARMv8, but we use the descaddrmask 10701 * up to bit 39 for AArch32, because we don't need other bits in that case 10702 * to construct next descriptor address (anyway they should be all zeroes). 10703 */ 10704 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) & 10705 ~indexmask_grainsize; 10706 10707 /* Secure accesses start with the page table in secure memory and 10708 * can be downgraded to non-secure at any step. Non-secure accesses 10709 * remain non-secure. We implement this by just ORing in the NSTable/NS 10710 * bits at each step. 10711 */ 10712 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4); 10713 for (;;) { 10714 uint64_t descriptor; 10715 bool nstable; 10716 10717 descaddr |= (address >> (stride * (4 - level))) & indexmask; 10718 descaddr &= ~7ULL; 10719 nstable = extract32(tableattrs, 4, 1); 10720 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi); 10721 if (fi->type != ARMFault_None) { 10722 goto do_fault; 10723 } 10724 10725 if (!(descriptor & 1) || 10726 (!(descriptor & 2) && (level == 3))) { 10727 /* Invalid, or the Reserved level 3 encoding */ 10728 goto do_fault; 10729 } 10730 descaddr = descriptor & descaddrmask; 10731 10732 if ((descriptor & 2) && (level < 3)) { 10733 /* Table entry. The top five bits are attributes which may 10734 * propagate down through lower levels of the table (and 10735 * which are all arranged so that 0 means "no effect", so 10736 * we can gather them up by ORing in the bits at each level). 10737 */ 10738 tableattrs |= extract64(descriptor, 59, 5); 10739 level++; 10740 indexmask = indexmask_grainsize; 10741 continue; 10742 } 10743 /* Block entry at level 1 or 2, or page entry at level 3. 10744 * These are basically the same thing, although the number 10745 * of bits we pull in from the vaddr varies. 10746 */ 10747 page_size = (1ULL << ((stride * (4 - level)) + 3)); 10748 descaddr |= (address & (page_size - 1)); 10749 /* Extract attributes from the descriptor */ 10750 attrs = extract64(descriptor, 2, 10) 10751 | (extract64(descriptor, 52, 12) << 10); 10752 10753 if (mmu_idx == ARMMMUIdx_S2NS) { 10754 /* Stage 2 table descriptors do not include any attribute fields */ 10755 break; 10756 } 10757 /* Merge in attributes from table descriptors */ 10758 attrs |= nstable << 3; /* NS */ 10759 if (param.hpd) { 10760 /* HPD disables all the table attributes except NSTable. */ 10761 break; 10762 } 10763 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */ 10764 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 10765 * means "force PL1 access only", which means forcing AP[1] to 0. 10766 */ 10767 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */ 10768 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */ 10769 break; 10770 } 10771 /* Here descaddr is the final physical address, and attributes 10772 * are all in attrs. 10773 */ 10774 fault_type = ARMFault_AccessFlag; 10775 if ((attrs & (1 << 8)) == 0) { 10776 /* Access flag */ 10777 goto do_fault; 10778 } 10779 10780 ap = extract32(attrs, 4, 2); 10781 xn = extract32(attrs, 12, 1); 10782 10783 if (mmu_idx == ARMMMUIdx_S2NS) { 10784 ns = true; 10785 *prot = get_S2prot(env, ap, xn); 10786 } else { 10787 ns = extract32(attrs, 3, 1); 10788 pxn = extract32(attrs, 11, 1); 10789 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 10790 } 10791 10792 fault_type = ARMFault_Permission; 10793 if (!(*prot & (1 << access_type))) { 10794 goto do_fault; 10795 } 10796 10797 if (ns) { 10798 /* The NS bit will (as required by the architecture) have no effect if 10799 * the CPU doesn't support TZ or this is a non-secure translation 10800 * regime, because the attribute will already be non-secure. 10801 */ 10802 txattrs->secure = false; 10803 } 10804 10805 if (cacheattrs != NULL) { 10806 if (mmu_idx == ARMMMUIdx_S2NS) { 10807 cacheattrs->attrs = convert_stage2_attrs(env, 10808 extract32(attrs, 0, 4)); 10809 } else { 10810 /* Index into MAIR registers for cache attributes */ 10811 uint8_t attrindx = extract32(attrs, 0, 3); 10812 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 10813 assert(attrindx <= 7); 10814 cacheattrs->attrs = extract64(mair, attrindx * 8, 8); 10815 } 10816 cacheattrs->shareability = extract32(attrs, 6, 2); 10817 } 10818 10819 *phys_ptr = descaddr; 10820 *page_size_ptr = page_size; 10821 return false; 10822 10823 do_fault: 10824 fi->type = fault_type; 10825 fi->level = level; 10826 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 10827 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS); 10828 return true; 10829 } 10830 10831 static inline void get_phys_addr_pmsav7_default(CPUARMState *env, 10832 ARMMMUIdx mmu_idx, 10833 int32_t address, int *prot) 10834 { 10835 if (!arm_feature(env, ARM_FEATURE_M)) { 10836 *prot = PAGE_READ | PAGE_WRITE; 10837 switch (address) { 10838 case 0xF0000000 ... 0xFFFFFFFF: 10839 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 10840 /* hivecs execing is ok */ 10841 *prot |= PAGE_EXEC; 10842 } 10843 break; 10844 case 0x00000000 ... 0x7FFFFFFF: 10845 *prot |= PAGE_EXEC; 10846 break; 10847 } 10848 } else { 10849 /* Default system address map for M profile cores. 10850 * The architecture specifies which regions are execute-never; 10851 * at the MPU level no other checks are defined. 10852 */ 10853 switch (address) { 10854 case 0x00000000 ... 0x1fffffff: /* ROM */ 10855 case 0x20000000 ... 0x3fffffff: /* SRAM */ 10856 case 0x60000000 ... 0x7fffffff: /* RAM */ 10857 case 0x80000000 ... 0x9fffffff: /* RAM */ 10858 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10859 break; 10860 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 10861 case 0xa0000000 ... 0xbfffffff: /* Device */ 10862 case 0xc0000000 ... 0xdfffffff: /* Device */ 10863 case 0xe0000000 ... 0xffffffff: /* System */ 10864 *prot = PAGE_READ | PAGE_WRITE; 10865 break; 10866 default: 10867 g_assert_not_reached(); 10868 } 10869 } 10870 } 10871 10872 static bool pmsav7_use_background_region(ARMCPU *cpu, 10873 ARMMMUIdx mmu_idx, bool is_user) 10874 { 10875 /* Return true if we should use the default memory map as a 10876 * "background" region if there are no hits against any MPU regions. 10877 */ 10878 CPUARMState *env = &cpu->env; 10879 10880 if (is_user) { 10881 return false; 10882 } 10883 10884 if (arm_feature(env, ARM_FEATURE_M)) { 10885 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] 10886 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 10887 } else { 10888 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 10889 } 10890 } 10891 10892 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address) 10893 { 10894 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 10895 return arm_feature(env, ARM_FEATURE_M) && 10896 extract32(address, 20, 12) == 0xe00; 10897 } 10898 10899 static inline bool m_is_system_region(CPUARMState *env, uint32_t address) 10900 { 10901 /* True if address is in the M profile system region 10902 * 0xe0000000 - 0xffffffff 10903 */ 10904 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 10905 } 10906 10907 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 10908 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10909 hwaddr *phys_ptr, int *prot, 10910 target_ulong *page_size, 10911 ARMMMUFaultInfo *fi) 10912 { 10913 ARMCPU *cpu = arm_env_get_cpu(env); 10914 int n; 10915 bool is_user = regime_is_user(env, mmu_idx); 10916 10917 *phys_ptr = address; 10918 *page_size = TARGET_PAGE_SIZE; 10919 *prot = 0; 10920 10921 if (regime_translation_disabled(env, mmu_idx) || 10922 m_is_ppb_region(env, address)) { 10923 /* MPU disabled or M profile PPB access: use default memory map. 10924 * The other case which uses the default memory map in the 10925 * v7M ARM ARM pseudocode is exception vector reads from the vector 10926 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 10927 * which always does a direct read using address_space_ldl(), rather 10928 * than going via this function, so we don't need to check that here. 10929 */ 10930 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10931 } else { /* MPU enabled */ 10932 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 10933 /* region search */ 10934 uint32_t base = env->pmsav7.drbar[n]; 10935 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 10936 uint32_t rmask; 10937 bool srdis = false; 10938 10939 if (!(env->pmsav7.drsr[n] & 0x1)) { 10940 continue; 10941 } 10942 10943 if (!rsize) { 10944 qemu_log_mask(LOG_GUEST_ERROR, 10945 "DRSR[%d]: Rsize field cannot be 0\n", n); 10946 continue; 10947 } 10948 rsize++; 10949 rmask = (1ull << rsize) - 1; 10950 10951 if (base & rmask) { 10952 qemu_log_mask(LOG_GUEST_ERROR, 10953 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 10954 "to DRSR region size, mask = 0x%" PRIx32 "\n", 10955 n, base, rmask); 10956 continue; 10957 } 10958 10959 if (address < base || address > base + rmask) { 10960 /* 10961 * Address not in this region. We must check whether the 10962 * region covers addresses in the same page as our address. 10963 * In that case we must not report a size that covers the 10964 * whole page for a subsequent hit against a different MPU 10965 * region or the background region, because it would result in 10966 * incorrect TLB hits for subsequent accesses to addresses that 10967 * are in this MPU region. 10968 */ 10969 if (ranges_overlap(base, rmask, 10970 address & TARGET_PAGE_MASK, 10971 TARGET_PAGE_SIZE)) { 10972 *page_size = 1; 10973 } 10974 continue; 10975 } 10976 10977 /* Region matched */ 10978 10979 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 10980 int i, snd; 10981 uint32_t srdis_mask; 10982 10983 rsize -= 3; /* sub region size (power of 2) */ 10984 snd = ((address - base) >> rsize) & 0x7; 10985 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 10986 10987 srdis_mask = srdis ? 0x3 : 0x0; 10988 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 10989 /* This will check in groups of 2, 4 and then 8, whether 10990 * the subregion bits are consistent. rsize is incremented 10991 * back up to give the region size, considering consistent 10992 * adjacent subregions as one region. Stop testing if rsize 10993 * is already big enough for an entire QEMU page. 10994 */ 10995 int snd_rounded = snd & ~(i - 1); 10996 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 10997 snd_rounded + 8, i); 10998 if (srdis_mask ^ srdis_multi) { 10999 break; 11000 } 11001 srdis_mask = (srdis_mask << i) | srdis_mask; 11002 rsize++; 11003 } 11004 } 11005 if (srdis) { 11006 continue; 11007 } 11008 if (rsize < TARGET_PAGE_BITS) { 11009 *page_size = 1 << rsize; 11010 } 11011 break; 11012 } 11013 11014 if (n == -1) { /* no hits */ 11015 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 11016 /* background fault */ 11017 fi->type = ARMFault_Background; 11018 return true; 11019 } 11020 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11021 } else { /* a MPU hit! */ 11022 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 11023 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 11024 11025 if (m_is_system_region(env, address)) { 11026 /* System space is always execute never */ 11027 xn = 1; 11028 } 11029 11030 if (is_user) { /* User mode AP bit decoding */ 11031 switch (ap) { 11032 case 0: 11033 case 1: 11034 case 5: 11035 break; /* no access */ 11036 case 3: 11037 *prot |= PAGE_WRITE; 11038 /* fall through */ 11039 case 2: 11040 case 6: 11041 *prot |= PAGE_READ | PAGE_EXEC; 11042 break; 11043 case 7: 11044 /* for v7M, same as 6; for R profile a reserved value */ 11045 if (arm_feature(env, ARM_FEATURE_M)) { 11046 *prot |= PAGE_READ | PAGE_EXEC; 11047 break; 11048 } 11049 /* fall through */ 11050 default: 11051 qemu_log_mask(LOG_GUEST_ERROR, 11052 "DRACR[%d]: Bad value for AP bits: 0x%" 11053 PRIx32 "\n", n, ap); 11054 } 11055 } else { /* Priv. mode AP bits decoding */ 11056 switch (ap) { 11057 case 0: 11058 break; /* no access */ 11059 case 1: 11060 case 2: 11061 case 3: 11062 *prot |= PAGE_WRITE; 11063 /* fall through */ 11064 case 5: 11065 case 6: 11066 *prot |= PAGE_READ | PAGE_EXEC; 11067 break; 11068 case 7: 11069 /* for v7M, same as 6; for R profile a reserved value */ 11070 if (arm_feature(env, ARM_FEATURE_M)) { 11071 *prot |= PAGE_READ | PAGE_EXEC; 11072 break; 11073 } 11074 /* fall through */ 11075 default: 11076 qemu_log_mask(LOG_GUEST_ERROR, 11077 "DRACR[%d]: Bad value for AP bits: 0x%" 11078 PRIx32 "\n", n, ap); 11079 } 11080 } 11081 11082 /* execute never */ 11083 if (xn) { 11084 *prot &= ~PAGE_EXEC; 11085 } 11086 } 11087 } 11088 11089 fi->type = ARMFault_Permission; 11090 fi->level = 1; 11091 return !(*prot & (1 << access_type)); 11092 } 11093 11094 static bool v8m_is_sau_exempt(CPUARMState *env, 11095 uint32_t address, MMUAccessType access_type) 11096 { 11097 /* The architecture specifies that certain address ranges are 11098 * exempt from v8M SAU/IDAU checks. 11099 */ 11100 return 11101 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 11102 (address >= 0xe0000000 && address <= 0xe0002fff) || 11103 (address >= 0xe000e000 && address <= 0xe000efff) || 11104 (address >= 0xe002e000 && address <= 0xe002efff) || 11105 (address >= 0xe0040000 && address <= 0xe0041fff) || 11106 (address >= 0xe00ff000 && address <= 0xe00fffff); 11107 } 11108 11109 static void v8m_security_lookup(CPUARMState *env, uint32_t address, 11110 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11111 V8M_SAttributes *sattrs) 11112 { 11113 /* Look up the security attributes for this address. Compare the 11114 * pseudocode SecurityCheck() function. 11115 * We assume the caller has zero-initialized *sattrs. 11116 */ 11117 ARMCPU *cpu = arm_env_get_cpu(env); 11118 int r; 11119 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 11120 int idau_region = IREGION_NOTVALID; 11121 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 11122 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 11123 11124 if (cpu->idau) { 11125 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 11126 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 11127 11128 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 11129 &idau_nsc); 11130 } 11131 11132 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 11133 /* 0xf0000000..0xffffffff is always S for insn fetches */ 11134 return; 11135 } 11136 11137 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 11138 sattrs->ns = !regime_is_secure(env, mmu_idx); 11139 return; 11140 } 11141 11142 if (idau_region != IREGION_NOTVALID) { 11143 sattrs->irvalid = true; 11144 sattrs->iregion = idau_region; 11145 } 11146 11147 switch (env->sau.ctrl & 3) { 11148 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 11149 break; 11150 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 11151 sattrs->ns = true; 11152 break; 11153 default: /* SAU.ENABLE == 1 */ 11154 for (r = 0; r < cpu->sau_sregion; r++) { 11155 if (env->sau.rlar[r] & 1) { 11156 uint32_t base = env->sau.rbar[r] & ~0x1f; 11157 uint32_t limit = env->sau.rlar[r] | 0x1f; 11158 11159 if (base <= address && limit >= address) { 11160 if (base > addr_page_base || limit < addr_page_limit) { 11161 sattrs->subpage = true; 11162 } 11163 if (sattrs->srvalid) { 11164 /* If we hit in more than one region then we must report 11165 * as Secure, not NS-Callable, with no valid region 11166 * number info. 11167 */ 11168 sattrs->ns = false; 11169 sattrs->nsc = false; 11170 sattrs->sregion = 0; 11171 sattrs->srvalid = false; 11172 break; 11173 } else { 11174 if (env->sau.rlar[r] & 2) { 11175 sattrs->nsc = true; 11176 } else { 11177 sattrs->ns = true; 11178 } 11179 sattrs->srvalid = true; 11180 sattrs->sregion = r; 11181 } 11182 } else { 11183 /* 11184 * Address not in this region. We must check whether the 11185 * region covers addresses in the same page as our address. 11186 * In that case we must not report a size that covers the 11187 * whole page for a subsequent hit against a different MPU 11188 * region or the background region, because it would result 11189 * in incorrect TLB hits for subsequent accesses to 11190 * addresses that are in this MPU region. 11191 */ 11192 if (limit >= base && 11193 ranges_overlap(base, limit - base + 1, 11194 addr_page_base, 11195 TARGET_PAGE_SIZE)) { 11196 sattrs->subpage = true; 11197 } 11198 } 11199 } 11200 } 11201 break; 11202 } 11203 11204 /* 11205 * The IDAU will override the SAU lookup results if it specifies 11206 * higher security than the SAU does. 11207 */ 11208 if (!idau_ns) { 11209 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 11210 sattrs->ns = false; 11211 sattrs->nsc = idau_nsc; 11212 } 11213 } 11214 } 11215 11216 static bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 11217 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11218 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11219 int *prot, bool *is_subpage, 11220 ARMMMUFaultInfo *fi, uint32_t *mregion) 11221 { 11222 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check 11223 * that a full phys-to-virt translation does). 11224 * mregion is (if not NULL) set to the region number which matched, 11225 * or -1 if no region number is returned (MPU off, address did not 11226 * hit a region, address hit in multiple regions). 11227 * We set is_subpage to true if the region hit doesn't cover the 11228 * entire TARGET_PAGE the address is within. 11229 */ 11230 ARMCPU *cpu = arm_env_get_cpu(env); 11231 bool is_user = regime_is_user(env, mmu_idx); 11232 uint32_t secure = regime_is_secure(env, mmu_idx); 11233 int n; 11234 int matchregion = -1; 11235 bool hit = false; 11236 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 11237 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 11238 11239 *is_subpage = false; 11240 *phys_ptr = address; 11241 *prot = 0; 11242 if (mregion) { 11243 *mregion = -1; 11244 } 11245 11246 /* Unlike the ARM ARM pseudocode, we don't need to check whether this 11247 * was an exception vector read from the vector table (which is always 11248 * done using the default system address map), because those accesses 11249 * are done in arm_v7m_load_vector(), which always does a direct 11250 * read using address_space_ldl(), rather than going via this function. 11251 */ 11252 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */ 11253 hit = true; 11254 } else if (m_is_ppb_region(env, address)) { 11255 hit = true; 11256 } else if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 11257 hit = true; 11258 } else { 11259 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 11260 /* region search */ 11261 /* Note that the base address is bits [31:5] from the register 11262 * with bits [4:0] all zeroes, but the limit address is bits 11263 * [31:5] from the register with bits [4:0] all ones. 11264 */ 11265 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f; 11266 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f; 11267 11268 if (!(env->pmsav8.rlar[secure][n] & 0x1)) { 11269 /* Region disabled */ 11270 continue; 11271 } 11272 11273 if (address < base || address > limit) { 11274 /* 11275 * Address not in this region. We must check whether the 11276 * region covers addresses in the same page as our address. 11277 * In that case we must not report a size that covers the 11278 * whole page for a subsequent hit against a different MPU 11279 * region or the background region, because it would result in 11280 * incorrect TLB hits for subsequent accesses to addresses that 11281 * are in this MPU region. 11282 */ 11283 if (limit >= base && 11284 ranges_overlap(base, limit - base + 1, 11285 addr_page_base, 11286 TARGET_PAGE_SIZE)) { 11287 *is_subpage = true; 11288 } 11289 continue; 11290 } 11291 11292 if (base > addr_page_base || limit < addr_page_limit) { 11293 *is_subpage = true; 11294 } 11295 11296 if (hit) { 11297 /* Multiple regions match -- always a failure (unlike 11298 * PMSAv7 where highest-numbered-region wins) 11299 */ 11300 fi->type = ARMFault_Permission; 11301 fi->level = 1; 11302 return true; 11303 } 11304 11305 matchregion = n; 11306 hit = true; 11307 } 11308 } 11309 11310 if (!hit) { 11311 /* background fault */ 11312 fi->type = ARMFault_Background; 11313 return true; 11314 } 11315 11316 if (matchregion == -1) { 11317 /* hit using the background region */ 11318 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11319 } else { 11320 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2); 11321 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1); 11322 11323 if (m_is_system_region(env, address)) { 11324 /* System space is always execute never */ 11325 xn = 1; 11326 } 11327 11328 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 11329 if (*prot && !xn) { 11330 *prot |= PAGE_EXEC; 11331 } 11332 /* We don't need to look the attribute up in the MAIR0/MAIR1 11333 * registers because that only tells us about cacheability. 11334 */ 11335 if (mregion) { 11336 *mregion = matchregion; 11337 } 11338 } 11339 11340 fi->type = ARMFault_Permission; 11341 fi->level = 1; 11342 return !(*prot & (1 << access_type)); 11343 } 11344 11345 11346 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 11347 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11348 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11349 int *prot, target_ulong *page_size, 11350 ARMMMUFaultInfo *fi) 11351 { 11352 uint32_t secure = regime_is_secure(env, mmu_idx); 11353 V8M_SAttributes sattrs = {}; 11354 bool ret; 11355 bool mpu_is_subpage; 11356 11357 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11358 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs); 11359 if (access_type == MMU_INST_FETCH) { 11360 /* Instruction fetches always use the MMU bank and the 11361 * transaction attribute determined by the fetch address, 11362 * regardless of CPU state. This is painful for QEMU 11363 * to handle, because it would mean we need to encode 11364 * into the mmu_idx not just the (user, negpri) information 11365 * for the current security state but also that for the 11366 * other security state, which would balloon the number 11367 * of mmu_idx values needed alarmingly. 11368 * Fortunately we can avoid this because it's not actually 11369 * possible to arbitrarily execute code from memory with 11370 * the wrong security attribute: it will always generate 11371 * an exception of some kind or another, apart from the 11372 * special case of an NS CPU executing an SG instruction 11373 * in S&NSC memory. So we always just fail the translation 11374 * here and sort things out in the exception handler 11375 * (including possibly emulating an SG instruction). 11376 */ 11377 if (sattrs.ns != !secure) { 11378 if (sattrs.nsc) { 11379 fi->type = ARMFault_QEMU_NSCExec; 11380 } else { 11381 fi->type = ARMFault_QEMU_SFault; 11382 } 11383 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11384 *phys_ptr = address; 11385 *prot = 0; 11386 return true; 11387 } 11388 } else { 11389 /* For data accesses we always use the MMU bank indicated 11390 * by the current CPU state, but the security attributes 11391 * might downgrade a secure access to nonsecure. 11392 */ 11393 if (sattrs.ns) { 11394 txattrs->secure = false; 11395 } else if (!secure) { 11396 /* NS access to S memory must fault. 11397 * Architecturally we should first check whether the 11398 * MPU information for this address indicates that we 11399 * are doing an unaligned access to Device memory, which 11400 * should generate a UsageFault instead. QEMU does not 11401 * currently check for that kind of unaligned access though. 11402 * If we added it we would need to do so as a special case 11403 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 11404 */ 11405 fi->type = ARMFault_QEMU_SFault; 11406 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11407 *phys_ptr = address; 11408 *prot = 0; 11409 return true; 11410 } 11411 } 11412 } 11413 11414 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr, 11415 txattrs, prot, &mpu_is_subpage, fi, NULL); 11416 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE; 11417 return ret; 11418 } 11419 11420 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 11421 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11422 hwaddr *phys_ptr, int *prot, 11423 ARMMMUFaultInfo *fi) 11424 { 11425 int n; 11426 uint32_t mask; 11427 uint32_t base; 11428 bool is_user = regime_is_user(env, mmu_idx); 11429 11430 if (regime_translation_disabled(env, mmu_idx)) { 11431 /* MPU disabled. */ 11432 *phys_ptr = address; 11433 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11434 return false; 11435 } 11436 11437 *phys_ptr = address; 11438 for (n = 7; n >= 0; n--) { 11439 base = env->cp15.c6_region[n]; 11440 if ((base & 1) == 0) { 11441 continue; 11442 } 11443 mask = 1 << ((base >> 1) & 0x1f); 11444 /* Keep this shift separate from the above to avoid an 11445 (undefined) << 32. */ 11446 mask = (mask << 1) - 1; 11447 if (((base ^ address) & ~mask) == 0) { 11448 break; 11449 } 11450 } 11451 if (n < 0) { 11452 fi->type = ARMFault_Background; 11453 return true; 11454 } 11455 11456 if (access_type == MMU_INST_FETCH) { 11457 mask = env->cp15.pmsav5_insn_ap; 11458 } else { 11459 mask = env->cp15.pmsav5_data_ap; 11460 } 11461 mask = (mask >> (n * 4)) & 0xf; 11462 switch (mask) { 11463 case 0: 11464 fi->type = ARMFault_Permission; 11465 fi->level = 1; 11466 return true; 11467 case 1: 11468 if (is_user) { 11469 fi->type = ARMFault_Permission; 11470 fi->level = 1; 11471 return true; 11472 } 11473 *prot = PAGE_READ | PAGE_WRITE; 11474 break; 11475 case 2: 11476 *prot = PAGE_READ; 11477 if (!is_user) { 11478 *prot |= PAGE_WRITE; 11479 } 11480 break; 11481 case 3: 11482 *prot = PAGE_READ | PAGE_WRITE; 11483 break; 11484 case 5: 11485 if (is_user) { 11486 fi->type = ARMFault_Permission; 11487 fi->level = 1; 11488 return true; 11489 } 11490 *prot = PAGE_READ; 11491 break; 11492 case 6: 11493 *prot = PAGE_READ; 11494 break; 11495 default: 11496 /* Bad permission. */ 11497 fi->type = ARMFault_Permission; 11498 fi->level = 1; 11499 return true; 11500 } 11501 *prot |= PAGE_EXEC; 11502 return false; 11503 } 11504 11505 /* Combine either inner or outer cacheability attributes for normal 11506 * memory, according to table D4-42 and pseudocode procedure 11507 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 11508 * 11509 * NB: only stage 1 includes allocation hints (RW bits), leading to 11510 * some asymmetry. 11511 */ 11512 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 11513 { 11514 if (s1 == 4 || s2 == 4) { 11515 /* non-cacheable has precedence */ 11516 return 4; 11517 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 11518 /* stage 1 write-through takes precedence */ 11519 return s1; 11520 } else if (extract32(s2, 2, 2) == 2) { 11521 /* stage 2 write-through takes precedence, but the allocation hint 11522 * is still taken from stage 1 11523 */ 11524 return (2 << 2) | extract32(s1, 0, 2); 11525 } else { /* write-back */ 11526 return s1; 11527 } 11528 } 11529 11530 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 11531 * and CombineS1S2Desc() 11532 * 11533 * @s1: Attributes from stage 1 walk 11534 * @s2: Attributes from stage 2 walk 11535 */ 11536 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2) 11537 { 11538 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4); 11539 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4); 11540 ARMCacheAttrs ret; 11541 11542 /* Combine shareability attributes (table D4-43) */ 11543 if (s1.shareability == 2 || s2.shareability == 2) { 11544 /* if either are outer-shareable, the result is outer-shareable */ 11545 ret.shareability = 2; 11546 } else if (s1.shareability == 3 || s2.shareability == 3) { 11547 /* if either are inner-shareable, the result is inner-shareable */ 11548 ret.shareability = 3; 11549 } else { 11550 /* both non-shareable */ 11551 ret.shareability = 0; 11552 } 11553 11554 /* Combine memory type and cacheability attributes */ 11555 if (s1hi == 0 || s2hi == 0) { 11556 /* Device has precedence over normal */ 11557 if (s1lo == 0 || s2lo == 0) { 11558 /* nGnRnE has precedence over anything */ 11559 ret.attrs = 0; 11560 } else if (s1lo == 4 || s2lo == 4) { 11561 /* non-Reordering has precedence over Reordering */ 11562 ret.attrs = 4; /* nGnRE */ 11563 } else if (s1lo == 8 || s2lo == 8) { 11564 /* non-Gathering has precedence over Gathering */ 11565 ret.attrs = 8; /* nGRE */ 11566 } else { 11567 ret.attrs = 0xc; /* GRE */ 11568 } 11569 11570 /* Any location for which the resultant memory type is any 11571 * type of Device memory is always treated as Outer Shareable. 11572 */ 11573 ret.shareability = 2; 11574 } else { /* Normal memory */ 11575 /* Outer/inner cacheability combine independently */ 11576 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 11577 | combine_cacheattr_nibble(s1lo, s2lo); 11578 11579 if (ret.attrs == 0x44) { 11580 /* Any location for which the resultant memory type is Normal 11581 * Inner Non-cacheable, Outer Non-cacheable is always treated 11582 * as Outer Shareable. 11583 */ 11584 ret.shareability = 2; 11585 } 11586 } 11587 11588 return ret; 11589 } 11590 11591 11592 /* get_phys_addr - get the physical address for this virtual address 11593 * 11594 * Find the physical address corresponding to the given virtual address, 11595 * by doing a translation table walk on MMU based systems or using the 11596 * MPU state on MPU based systems. 11597 * 11598 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs, 11599 * prot and page_size may not be filled in, and the populated fsr value provides 11600 * information on why the translation aborted, in the format of a 11601 * DFSR/IFSR fault register, with the following caveats: 11602 * * we honour the short vs long DFSR format differences. 11603 * * the WnR bit is never set (the caller must do this). 11604 * * for PSMAv5 based systems we don't bother to return a full FSR format 11605 * value. 11606 * 11607 * @env: CPUARMState 11608 * @address: virtual address to get physical address for 11609 * @access_type: 0 for read, 1 for write, 2 for execute 11610 * @mmu_idx: MMU index indicating required translation regime 11611 * @phys_ptr: set to the physical address corresponding to the virtual address 11612 * @attrs: set to the memory transaction attributes to use 11613 * @prot: set to the permissions for the page containing phys_ptr 11614 * @page_size: set to the size of the page containing phys_ptr 11615 * @fi: set to fault info if the translation fails 11616 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes 11617 */ 11618 static bool get_phys_addr(CPUARMState *env, target_ulong address, 11619 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11620 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 11621 target_ulong *page_size, 11622 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 11623 { 11624 if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) { 11625 /* Call ourselves recursively to do the stage 1 and then stage 2 11626 * translations. 11627 */ 11628 if (arm_feature(env, ARM_FEATURE_EL2)) { 11629 hwaddr ipa; 11630 int s2_prot; 11631 int ret; 11632 ARMCacheAttrs cacheattrs2 = {}; 11633 11634 ret = get_phys_addr(env, address, access_type, 11635 stage_1_mmu_idx(mmu_idx), &ipa, attrs, 11636 prot, page_size, fi, cacheattrs); 11637 11638 /* If S1 fails or S2 is disabled, return early. */ 11639 if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) { 11640 *phys_ptr = ipa; 11641 return ret; 11642 } 11643 11644 /* S1 is done. Now do S2 translation. */ 11645 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS, 11646 phys_ptr, attrs, &s2_prot, 11647 page_size, fi, 11648 cacheattrs != NULL ? &cacheattrs2 : NULL); 11649 fi->s2addr = ipa; 11650 /* Combine the S1 and S2 perms. */ 11651 *prot &= s2_prot; 11652 11653 /* Combine the S1 and S2 cache attributes, if needed */ 11654 if (!ret && cacheattrs != NULL) { 11655 if (env->cp15.hcr_el2 & HCR_DC) { 11656 /* 11657 * HCR.DC forces the first stage attributes to 11658 * Normal Non-Shareable, 11659 * Inner Write-Back Read-Allocate Write-Allocate, 11660 * Outer Write-Back Read-Allocate Write-Allocate. 11661 */ 11662 cacheattrs->attrs = 0xff; 11663 cacheattrs->shareability = 0; 11664 } 11665 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2); 11666 } 11667 11668 return ret; 11669 } else { 11670 /* 11671 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1. 11672 */ 11673 mmu_idx = stage_1_mmu_idx(mmu_idx); 11674 } 11675 } 11676 11677 /* The page table entries may downgrade secure to non-secure, but 11678 * cannot upgrade an non-secure translation regime's attributes 11679 * to secure. 11680 */ 11681 attrs->secure = regime_is_secure(env, mmu_idx); 11682 attrs->user = regime_is_user(env, mmu_idx); 11683 11684 /* Fast Context Switch Extension. This doesn't exist at all in v8. 11685 * In v7 and earlier it affects all stage 1 translations. 11686 */ 11687 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS 11688 && !arm_feature(env, ARM_FEATURE_V8)) { 11689 if (regime_el(env, mmu_idx) == 3) { 11690 address += env->cp15.fcseidr_s; 11691 } else { 11692 address += env->cp15.fcseidr_ns; 11693 } 11694 } 11695 11696 if (arm_feature(env, ARM_FEATURE_PMSA)) { 11697 bool ret; 11698 *page_size = TARGET_PAGE_SIZE; 11699 11700 if (arm_feature(env, ARM_FEATURE_V8)) { 11701 /* PMSAv8 */ 11702 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 11703 phys_ptr, attrs, prot, page_size, fi); 11704 } else if (arm_feature(env, ARM_FEATURE_V7)) { 11705 /* PMSAv7 */ 11706 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 11707 phys_ptr, prot, page_size, fi); 11708 } else { 11709 /* Pre-v7 MPU */ 11710 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 11711 phys_ptr, prot, fi); 11712 } 11713 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 11714 " mmu_idx %u -> %s (prot %c%c%c)\n", 11715 access_type == MMU_DATA_LOAD ? "reading" : 11716 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 11717 (uint32_t)address, mmu_idx, 11718 ret ? "Miss" : "Hit", 11719 *prot & PAGE_READ ? 'r' : '-', 11720 *prot & PAGE_WRITE ? 'w' : '-', 11721 *prot & PAGE_EXEC ? 'x' : '-'); 11722 11723 return ret; 11724 } 11725 11726 /* Definitely a real MMU, not an MPU */ 11727 11728 if (regime_translation_disabled(env, mmu_idx)) { 11729 /* MMU disabled. */ 11730 *phys_ptr = address; 11731 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11732 *page_size = TARGET_PAGE_SIZE; 11733 return 0; 11734 } 11735 11736 if (regime_using_lpae_format(env, mmu_idx)) { 11737 return get_phys_addr_lpae(env, address, access_type, mmu_idx, 11738 phys_ptr, attrs, prot, page_size, 11739 fi, cacheattrs); 11740 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) { 11741 return get_phys_addr_v6(env, address, access_type, mmu_idx, 11742 phys_ptr, attrs, prot, page_size, fi); 11743 } else { 11744 return get_phys_addr_v5(env, address, access_type, mmu_idx, 11745 phys_ptr, prot, page_size, fi); 11746 } 11747 } 11748 11749 /* Walk the page table and (if the mapping exists) add the page 11750 * to the TLB. Return false on success, or true on failure. Populate 11751 * fsr with ARM DFSR/IFSR fault register format value on failure. 11752 */ 11753 bool arm_tlb_fill(CPUState *cs, vaddr address, 11754 MMUAccessType access_type, int mmu_idx, 11755 ARMMMUFaultInfo *fi) 11756 { 11757 ARMCPU *cpu = ARM_CPU(cs); 11758 CPUARMState *env = &cpu->env; 11759 hwaddr phys_addr; 11760 target_ulong page_size; 11761 int prot; 11762 int ret; 11763 MemTxAttrs attrs = {}; 11764 11765 ret = get_phys_addr(env, address, access_type, 11766 core_to_arm_mmu_idx(env, mmu_idx), &phys_addr, 11767 &attrs, &prot, &page_size, fi, NULL); 11768 if (!ret) { 11769 /* 11770 * Map a single [sub]page. Regions smaller than our declared 11771 * target page size are handled specially, so for those we 11772 * pass in the exact addresses. 11773 */ 11774 if (page_size >= TARGET_PAGE_SIZE) { 11775 phys_addr &= TARGET_PAGE_MASK; 11776 address &= TARGET_PAGE_MASK; 11777 } 11778 tlb_set_page_with_attrs(cs, address, phys_addr, attrs, 11779 prot, mmu_idx, page_size); 11780 return 0; 11781 } 11782 11783 return ret; 11784 } 11785 11786 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 11787 MemTxAttrs *attrs) 11788 { 11789 ARMCPU *cpu = ARM_CPU(cs); 11790 CPUARMState *env = &cpu->env; 11791 hwaddr phys_addr; 11792 target_ulong page_size; 11793 int prot; 11794 bool ret; 11795 ARMMMUFaultInfo fi = {}; 11796 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 11797 11798 *attrs = (MemTxAttrs) {}; 11799 11800 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr, 11801 attrs, &prot, &page_size, &fi, NULL); 11802 11803 if (ret) { 11804 return -1; 11805 } 11806 return phys_addr; 11807 } 11808 11809 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) 11810 { 11811 uint32_t mask; 11812 unsigned el = arm_current_el(env); 11813 11814 /* First handle registers which unprivileged can read */ 11815 11816 switch (reg) { 11817 case 0 ... 7: /* xPSR sub-fields */ 11818 mask = 0; 11819 if ((reg & 1) && el) { 11820 mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */ 11821 } 11822 if (!(reg & 4)) { 11823 mask |= XPSR_NZCV | XPSR_Q; /* APSR */ 11824 } 11825 /* EPSR reads as zero */ 11826 return xpsr_read(env) & mask; 11827 break; 11828 case 20: /* CONTROL */ 11829 return env->v7m.control[env->v7m.secure]; 11830 case 0x94: /* CONTROL_NS */ 11831 /* We have to handle this here because unprivileged Secure code 11832 * can read the NS CONTROL register. 11833 */ 11834 if (!env->v7m.secure) { 11835 return 0; 11836 } 11837 return env->v7m.control[M_REG_NS]; 11838 } 11839 11840 if (el == 0) { 11841 return 0; /* unprivileged reads others as zero */ 11842 } 11843 11844 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11845 switch (reg) { 11846 case 0x88: /* MSP_NS */ 11847 if (!env->v7m.secure) { 11848 return 0; 11849 } 11850 return env->v7m.other_ss_msp; 11851 case 0x89: /* PSP_NS */ 11852 if (!env->v7m.secure) { 11853 return 0; 11854 } 11855 return env->v7m.other_ss_psp; 11856 case 0x8a: /* MSPLIM_NS */ 11857 if (!env->v7m.secure) { 11858 return 0; 11859 } 11860 return env->v7m.msplim[M_REG_NS]; 11861 case 0x8b: /* PSPLIM_NS */ 11862 if (!env->v7m.secure) { 11863 return 0; 11864 } 11865 return env->v7m.psplim[M_REG_NS]; 11866 case 0x90: /* PRIMASK_NS */ 11867 if (!env->v7m.secure) { 11868 return 0; 11869 } 11870 return env->v7m.primask[M_REG_NS]; 11871 case 0x91: /* BASEPRI_NS */ 11872 if (!env->v7m.secure) { 11873 return 0; 11874 } 11875 return env->v7m.basepri[M_REG_NS]; 11876 case 0x93: /* FAULTMASK_NS */ 11877 if (!env->v7m.secure) { 11878 return 0; 11879 } 11880 return env->v7m.faultmask[M_REG_NS]; 11881 case 0x98: /* SP_NS */ 11882 { 11883 /* This gives the non-secure SP selected based on whether we're 11884 * currently in handler mode or not, using the NS CONTROL.SPSEL. 11885 */ 11886 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK; 11887 11888 if (!env->v7m.secure) { 11889 return 0; 11890 } 11891 if (!arm_v7m_is_handler_mode(env) && spsel) { 11892 return env->v7m.other_ss_psp; 11893 } else { 11894 return env->v7m.other_ss_msp; 11895 } 11896 } 11897 default: 11898 break; 11899 } 11900 } 11901 11902 switch (reg) { 11903 case 8: /* MSP */ 11904 return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13]; 11905 case 9: /* PSP */ 11906 return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp; 11907 case 10: /* MSPLIM */ 11908 if (!arm_feature(env, ARM_FEATURE_V8)) { 11909 goto bad_reg; 11910 } 11911 return env->v7m.msplim[env->v7m.secure]; 11912 case 11: /* PSPLIM */ 11913 if (!arm_feature(env, ARM_FEATURE_V8)) { 11914 goto bad_reg; 11915 } 11916 return env->v7m.psplim[env->v7m.secure]; 11917 case 16: /* PRIMASK */ 11918 return env->v7m.primask[env->v7m.secure]; 11919 case 17: /* BASEPRI */ 11920 case 18: /* BASEPRI_MAX */ 11921 return env->v7m.basepri[env->v7m.secure]; 11922 case 19: /* FAULTMASK */ 11923 return env->v7m.faultmask[env->v7m.secure]; 11924 default: 11925 bad_reg: 11926 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special" 11927 " register %d\n", reg); 11928 return 0; 11929 } 11930 } 11931 11932 void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) 11933 { 11934 /* We're passed bits [11..0] of the instruction; extract 11935 * SYSm and the mask bits. 11936 * Invalid combinations of SYSm and mask are UNPREDICTABLE; 11937 * we choose to treat them as if the mask bits were valid. 11938 * NB that the pseudocode 'mask' variable is bits [11..10], 11939 * whereas ours is [11..8]. 11940 */ 11941 uint32_t mask = extract32(maskreg, 8, 4); 11942 uint32_t reg = extract32(maskreg, 0, 8); 11943 11944 if (arm_current_el(env) == 0 && reg > 7) { 11945 /* only xPSR sub-fields may be written by unprivileged */ 11946 return; 11947 } 11948 11949 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11950 switch (reg) { 11951 case 0x88: /* MSP_NS */ 11952 if (!env->v7m.secure) { 11953 return; 11954 } 11955 env->v7m.other_ss_msp = val; 11956 return; 11957 case 0x89: /* PSP_NS */ 11958 if (!env->v7m.secure) { 11959 return; 11960 } 11961 env->v7m.other_ss_psp = val; 11962 return; 11963 case 0x8a: /* MSPLIM_NS */ 11964 if (!env->v7m.secure) { 11965 return; 11966 } 11967 env->v7m.msplim[M_REG_NS] = val & ~7; 11968 return; 11969 case 0x8b: /* PSPLIM_NS */ 11970 if (!env->v7m.secure) { 11971 return; 11972 } 11973 env->v7m.psplim[M_REG_NS] = val & ~7; 11974 return; 11975 case 0x90: /* PRIMASK_NS */ 11976 if (!env->v7m.secure) { 11977 return; 11978 } 11979 env->v7m.primask[M_REG_NS] = val & 1; 11980 return; 11981 case 0x91: /* BASEPRI_NS */ 11982 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) { 11983 return; 11984 } 11985 env->v7m.basepri[M_REG_NS] = val & 0xff; 11986 return; 11987 case 0x93: /* FAULTMASK_NS */ 11988 if (!env->v7m.secure || !arm_feature(env, ARM_FEATURE_M_MAIN)) { 11989 return; 11990 } 11991 env->v7m.faultmask[M_REG_NS] = val & 1; 11992 return; 11993 case 0x94: /* CONTROL_NS */ 11994 if (!env->v7m.secure) { 11995 return; 11996 } 11997 write_v7m_control_spsel_for_secstate(env, 11998 val & R_V7M_CONTROL_SPSEL_MASK, 11999 M_REG_NS); 12000 if (arm_feature(env, ARM_FEATURE_M_MAIN)) { 12001 env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK; 12002 env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK; 12003 } 12004 return; 12005 case 0x98: /* SP_NS */ 12006 { 12007 /* This gives the non-secure SP selected based on whether we're 12008 * currently in handler mode or not, using the NS CONTROL.SPSEL. 12009 */ 12010 bool spsel = env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK; 12011 bool is_psp = !arm_v7m_is_handler_mode(env) && spsel; 12012 uint32_t limit; 12013 12014 if (!env->v7m.secure) { 12015 return; 12016 } 12017 12018 limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false]; 12019 12020 if (val < limit) { 12021 CPUState *cs = CPU(arm_env_get_cpu(env)); 12022 12023 cpu_restore_state(cs, GETPC(), true); 12024 raise_exception(env, EXCP_STKOF, 0, 1); 12025 } 12026 12027 if (is_psp) { 12028 env->v7m.other_ss_psp = val; 12029 } else { 12030 env->v7m.other_ss_msp = val; 12031 } 12032 return; 12033 } 12034 default: 12035 break; 12036 } 12037 } 12038 12039 switch (reg) { 12040 case 0 ... 7: /* xPSR sub-fields */ 12041 /* only APSR is actually writable */ 12042 if (!(reg & 4)) { 12043 uint32_t apsrmask = 0; 12044 12045 if (mask & 8) { 12046 apsrmask |= XPSR_NZCV | XPSR_Q; 12047 } 12048 if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) { 12049 apsrmask |= XPSR_GE; 12050 } 12051 xpsr_write(env, val, apsrmask); 12052 } 12053 break; 12054 case 8: /* MSP */ 12055 if (v7m_using_psp(env)) { 12056 env->v7m.other_sp = val; 12057 } else { 12058 env->regs[13] = val; 12059 } 12060 break; 12061 case 9: /* PSP */ 12062 if (v7m_using_psp(env)) { 12063 env->regs[13] = val; 12064 } else { 12065 env->v7m.other_sp = val; 12066 } 12067 break; 12068 case 10: /* MSPLIM */ 12069 if (!arm_feature(env, ARM_FEATURE_V8)) { 12070 goto bad_reg; 12071 } 12072 env->v7m.msplim[env->v7m.secure] = val & ~7; 12073 break; 12074 case 11: /* PSPLIM */ 12075 if (!arm_feature(env, ARM_FEATURE_V8)) { 12076 goto bad_reg; 12077 } 12078 env->v7m.psplim[env->v7m.secure] = val & ~7; 12079 break; 12080 case 16: /* PRIMASK */ 12081 env->v7m.primask[env->v7m.secure] = val & 1; 12082 break; 12083 case 17: /* BASEPRI */ 12084 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12085 goto bad_reg; 12086 } 12087 env->v7m.basepri[env->v7m.secure] = val & 0xff; 12088 break; 12089 case 18: /* BASEPRI_MAX */ 12090 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12091 goto bad_reg; 12092 } 12093 val &= 0xff; 12094 if (val != 0 && (val < env->v7m.basepri[env->v7m.secure] 12095 || env->v7m.basepri[env->v7m.secure] == 0)) { 12096 env->v7m.basepri[env->v7m.secure] = val; 12097 } 12098 break; 12099 case 19: /* FAULTMASK */ 12100 if (!arm_feature(env, ARM_FEATURE_M_MAIN)) { 12101 goto bad_reg; 12102 } 12103 env->v7m.faultmask[env->v7m.secure] = val & 1; 12104 break; 12105 case 20: /* CONTROL */ 12106 /* Writing to the SPSEL bit only has an effect if we are in 12107 * thread mode; other bits can be updated by any privileged code. 12108 * write_v7m_control_spsel() deals with updating the SPSEL bit in 12109 * env->v7m.control, so we only need update the others. 12110 * For v7M, we must just ignore explicit writes to SPSEL in handler 12111 * mode; for v8M the write is permitted but will have no effect. 12112 */ 12113 if (arm_feature(env, ARM_FEATURE_V8) || 12114 !arm_v7m_is_handler_mode(env)) { 12115 write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0); 12116 } 12117 if (arm_feature(env, ARM_FEATURE_M_MAIN)) { 12118 env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK; 12119 env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK; 12120 } 12121 break; 12122 default: 12123 bad_reg: 12124 qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special" 12125 " register %d\n", reg); 12126 return; 12127 } 12128 } 12129 12130 uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op) 12131 { 12132 /* Implement the TT instruction. op is bits [7:6] of the insn. */ 12133 bool forceunpriv = op & 1; 12134 bool alt = op & 2; 12135 V8M_SAttributes sattrs = {}; 12136 uint32_t tt_resp; 12137 bool r, rw, nsr, nsrw, mrvalid; 12138 int prot; 12139 ARMMMUFaultInfo fi = {}; 12140 MemTxAttrs attrs = {}; 12141 hwaddr phys_addr; 12142 ARMMMUIdx mmu_idx; 12143 uint32_t mregion; 12144 bool targetpriv; 12145 bool targetsec = env->v7m.secure; 12146 bool is_subpage; 12147 12148 /* Work out what the security state and privilege level we're 12149 * interested in is... 12150 */ 12151 if (alt) { 12152 targetsec = !targetsec; 12153 } 12154 12155 if (forceunpriv) { 12156 targetpriv = false; 12157 } else { 12158 targetpriv = arm_v7m_is_handler_mode(env) || 12159 !(env->v7m.control[targetsec] & R_V7M_CONTROL_NPRIV_MASK); 12160 } 12161 12162 /* ...and then figure out which MMU index this is */ 12163 mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targetsec, targetpriv); 12164 12165 /* We know that the MPU and SAU don't care about the access type 12166 * for our purposes beyond that we don't want to claim to be 12167 * an insn fetch, so we arbitrarily call this a read. 12168 */ 12169 12170 /* MPU region info only available for privileged or if 12171 * inspecting the other MPU state. 12172 */ 12173 if (arm_current_el(env) != 0 || alt) { 12174 /* We can ignore the return value as prot is always set */ 12175 pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, 12176 &phys_addr, &attrs, &prot, &is_subpage, 12177 &fi, &mregion); 12178 if (mregion == -1) { 12179 mrvalid = false; 12180 mregion = 0; 12181 } else { 12182 mrvalid = true; 12183 } 12184 r = prot & PAGE_READ; 12185 rw = prot & PAGE_WRITE; 12186 } else { 12187 r = false; 12188 rw = false; 12189 mrvalid = false; 12190 mregion = 0; 12191 } 12192 12193 if (env->v7m.secure) { 12194 v8m_security_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, &sattrs); 12195 nsr = sattrs.ns && r; 12196 nsrw = sattrs.ns && rw; 12197 } else { 12198 sattrs.ns = true; 12199 nsr = false; 12200 nsrw = false; 12201 } 12202 12203 tt_resp = (sattrs.iregion << 24) | 12204 (sattrs.irvalid << 23) | 12205 ((!sattrs.ns) << 22) | 12206 (nsrw << 21) | 12207 (nsr << 20) | 12208 (rw << 19) | 12209 (r << 18) | 12210 (sattrs.srvalid << 17) | 12211 (mrvalid << 16) | 12212 (sattrs.sregion << 8) | 12213 mregion; 12214 12215 return tt_resp; 12216 } 12217 12218 #endif 12219 12220 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in) 12221 { 12222 /* Implement DC ZVA, which zeroes a fixed-length block of memory. 12223 * Note that we do not implement the (architecturally mandated) 12224 * alignment fault for attempts to use this on Device memory 12225 * (which matches the usual QEMU behaviour of not implementing either 12226 * alignment faults or any memory attribute handling). 12227 */ 12228 12229 ARMCPU *cpu = arm_env_get_cpu(env); 12230 uint64_t blocklen = 4 << cpu->dcz_blocksize; 12231 uint64_t vaddr = vaddr_in & ~(blocklen - 1); 12232 12233 #ifndef CONFIG_USER_ONLY 12234 { 12235 /* Slightly awkwardly, QEMU's TARGET_PAGE_SIZE may be less than 12236 * the block size so we might have to do more than one TLB lookup. 12237 * We know that in fact for any v8 CPU the page size is at least 4K 12238 * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only 12239 * 1K as an artefact of legacy v5 subpage support being present in the 12240 * same QEMU executable. 12241 */ 12242 int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE); 12243 void *hostaddr[maxidx]; 12244 int try, i; 12245 unsigned mmu_idx = cpu_mmu_index(env, false); 12246 TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx); 12247 12248 for (try = 0; try < 2; try++) { 12249 12250 for (i = 0; i < maxidx; i++) { 12251 hostaddr[i] = tlb_vaddr_to_host(env, 12252 vaddr + TARGET_PAGE_SIZE * i, 12253 1, mmu_idx); 12254 if (!hostaddr[i]) { 12255 break; 12256 } 12257 } 12258 if (i == maxidx) { 12259 /* If it's all in the TLB it's fair game for just writing to; 12260 * we know we don't need to update dirty status, etc. 12261 */ 12262 for (i = 0; i < maxidx - 1; i++) { 12263 memset(hostaddr[i], 0, TARGET_PAGE_SIZE); 12264 } 12265 memset(hostaddr[i], 0, blocklen - (i * TARGET_PAGE_SIZE)); 12266 return; 12267 } 12268 /* OK, try a store and see if we can populate the tlb. This 12269 * might cause an exception if the memory isn't writable, 12270 * in which case we will longjmp out of here. We must for 12271 * this purpose use the actual register value passed to us 12272 * so that we get the fault address right. 12273 */ 12274 helper_ret_stb_mmu(env, vaddr_in, 0, oi, GETPC()); 12275 /* Now we can populate the other TLB entries, if any */ 12276 for (i = 0; i < maxidx; i++) { 12277 uint64_t va = vaddr + TARGET_PAGE_SIZE * i; 12278 if (va != (vaddr_in & TARGET_PAGE_MASK)) { 12279 helper_ret_stb_mmu(env, va, 0, oi, GETPC()); 12280 } 12281 } 12282 } 12283 12284 /* Slow path (probably attempt to do this to an I/O device or 12285 * similar, or clearing of a block of code we have translations 12286 * cached for). Just do a series of byte writes as the architecture 12287 * demands. It's not worth trying to use a cpu_physical_memory_map(), 12288 * memset(), unmap() sequence here because: 12289 * + we'd need to account for the blocksize being larger than a page 12290 * + the direct-RAM access case is almost always going to be dealt 12291 * with in the fastpath code above, so there's no speed benefit 12292 * + we would have to deal with the map returning NULL because the 12293 * bounce buffer was in use 12294 */ 12295 for (i = 0; i < blocklen; i++) { 12296 helper_ret_stb_mmu(env, vaddr + i, 0, oi, GETPC()); 12297 } 12298 } 12299 #else 12300 memset(g2h(vaddr), 0, blocklen); 12301 #endif 12302 } 12303 12304 /* Note that signed overflow is undefined in C. The following routines are 12305 careful to use unsigned types where modulo arithmetic is required. 12306 Failure to do so _will_ break on newer gcc. */ 12307 12308 /* Signed saturating arithmetic. */ 12309 12310 /* Perform 16-bit signed saturating addition. */ 12311 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 12312 { 12313 uint16_t res; 12314 12315 res = a + b; 12316 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 12317 if (a & 0x8000) 12318 res = 0x8000; 12319 else 12320 res = 0x7fff; 12321 } 12322 return res; 12323 } 12324 12325 /* Perform 8-bit signed saturating addition. */ 12326 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 12327 { 12328 uint8_t res; 12329 12330 res = a + b; 12331 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 12332 if (a & 0x80) 12333 res = 0x80; 12334 else 12335 res = 0x7f; 12336 } 12337 return res; 12338 } 12339 12340 /* Perform 16-bit signed saturating subtraction. */ 12341 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 12342 { 12343 uint16_t res; 12344 12345 res = a - b; 12346 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 12347 if (a & 0x8000) 12348 res = 0x8000; 12349 else 12350 res = 0x7fff; 12351 } 12352 return res; 12353 } 12354 12355 /* Perform 8-bit signed saturating subtraction. */ 12356 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 12357 { 12358 uint8_t res; 12359 12360 res = a - b; 12361 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 12362 if (a & 0x80) 12363 res = 0x80; 12364 else 12365 res = 0x7f; 12366 } 12367 return res; 12368 } 12369 12370 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 12371 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 12372 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 12373 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 12374 #define PFX q 12375 12376 #include "op_addsub.h" 12377 12378 /* Unsigned saturating arithmetic. */ 12379 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 12380 { 12381 uint16_t res; 12382 res = a + b; 12383 if (res < a) 12384 res = 0xffff; 12385 return res; 12386 } 12387 12388 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 12389 { 12390 if (a > b) 12391 return a - b; 12392 else 12393 return 0; 12394 } 12395 12396 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 12397 { 12398 uint8_t res; 12399 res = a + b; 12400 if (res < a) 12401 res = 0xff; 12402 return res; 12403 } 12404 12405 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 12406 { 12407 if (a > b) 12408 return a - b; 12409 else 12410 return 0; 12411 } 12412 12413 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 12414 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 12415 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 12416 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 12417 #define PFX uq 12418 12419 #include "op_addsub.h" 12420 12421 /* Signed modulo arithmetic. */ 12422 #define SARITH16(a, b, n, op) do { \ 12423 int32_t sum; \ 12424 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 12425 RESULT(sum, n, 16); \ 12426 if (sum >= 0) \ 12427 ge |= 3 << (n * 2); \ 12428 } while(0) 12429 12430 #define SARITH8(a, b, n, op) do { \ 12431 int32_t sum; \ 12432 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 12433 RESULT(sum, n, 8); \ 12434 if (sum >= 0) \ 12435 ge |= 1 << n; \ 12436 } while(0) 12437 12438 12439 #define ADD16(a, b, n) SARITH16(a, b, n, +) 12440 #define SUB16(a, b, n) SARITH16(a, b, n, -) 12441 #define ADD8(a, b, n) SARITH8(a, b, n, +) 12442 #define SUB8(a, b, n) SARITH8(a, b, n, -) 12443 #define PFX s 12444 #define ARITH_GE 12445 12446 #include "op_addsub.h" 12447 12448 /* Unsigned modulo arithmetic. */ 12449 #define ADD16(a, b, n) do { \ 12450 uint32_t sum; \ 12451 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 12452 RESULT(sum, n, 16); \ 12453 if ((sum >> 16) == 1) \ 12454 ge |= 3 << (n * 2); \ 12455 } while(0) 12456 12457 #define ADD8(a, b, n) do { \ 12458 uint32_t sum; \ 12459 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 12460 RESULT(sum, n, 8); \ 12461 if ((sum >> 8) == 1) \ 12462 ge |= 1 << n; \ 12463 } while(0) 12464 12465 #define SUB16(a, b, n) do { \ 12466 uint32_t sum; \ 12467 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 12468 RESULT(sum, n, 16); \ 12469 if ((sum >> 16) == 0) \ 12470 ge |= 3 << (n * 2); \ 12471 } while(0) 12472 12473 #define SUB8(a, b, n) do { \ 12474 uint32_t sum; \ 12475 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 12476 RESULT(sum, n, 8); \ 12477 if ((sum >> 8) == 0) \ 12478 ge |= 1 << n; \ 12479 } while(0) 12480 12481 #define PFX u 12482 #define ARITH_GE 12483 12484 #include "op_addsub.h" 12485 12486 /* Halved signed arithmetic. */ 12487 #define ADD16(a, b, n) \ 12488 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 12489 #define SUB16(a, b, n) \ 12490 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 12491 #define ADD8(a, b, n) \ 12492 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 12493 #define SUB8(a, b, n) \ 12494 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 12495 #define PFX sh 12496 12497 #include "op_addsub.h" 12498 12499 /* Halved unsigned arithmetic. */ 12500 #define ADD16(a, b, n) \ 12501 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 12502 #define SUB16(a, b, n) \ 12503 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 12504 #define ADD8(a, b, n) \ 12505 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 12506 #define SUB8(a, b, n) \ 12507 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 12508 #define PFX uh 12509 12510 #include "op_addsub.h" 12511 12512 static inline uint8_t do_usad(uint8_t a, uint8_t b) 12513 { 12514 if (a > b) 12515 return a - b; 12516 else 12517 return b - a; 12518 } 12519 12520 /* Unsigned sum of absolute byte differences. */ 12521 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 12522 { 12523 uint32_t sum; 12524 sum = do_usad(a, b); 12525 sum += do_usad(a >> 8, b >> 8); 12526 sum += do_usad(a >> 16, b >>16); 12527 sum += do_usad(a >> 24, b >> 24); 12528 return sum; 12529 } 12530 12531 /* For ARMv6 SEL instruction. */ 12532 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 12533 { 12534 uint32_t mask; 12535 12536 mask = 0; 12537 if (flags & 1) 12538 mask |= 0xff; 12539 if (flags & 2) 12540 mask |= 0xff00; 12541 if (flags & 4) 12542 mask |= 0xff0000; 12543 if (flags & 8) 12544 mask |= 0xff000000; 12545 return (a & mask) | (b & ~mask); 12546 } 12547 12548 /* VFP support. We follow the convention used for VFP instructions: 12549 Single precision routines have a "s" suffix, double precision a 12550 "d" suffix. */ 12551 12552 /* Convert host exception flags to vfp form. */ 12553 static inline int vfp_exceptbits_from_host(int host_bits) 12554 { 12555 int target_bits = 0; 12556 12557 if (host_bits & float_flag_invalid) 12558 target_bits |= 1; 12559 if (host_bits & float_flag_divbyzero) 12560 target_bits |= 2; 12561 if (host_bits & float_flag_overflow) 12562 target_bits |= 4; 12563 if (host_bits & (float_flag_underflow | float_flag_output_denormal)) 12564 target_bits |= 8; 12565 if (host_bits & float_flag_inexact) 12566 target_bits |= 0x10; 12567 if (host_bits & float_flag_input_denormal) 12568 target_bits |= 0x80; 12569 return target_bits; 12570 } 12571 12572 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env) 12573 { 12574 int i; 12575 uint32_t fpscr; 12576 12577 fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff) 12578 | (env->vfp.vec_len << 16) 12579 | (env->vfp.vec_stride << 20); 12580 12581 i = get_float_exception_flags(&env->vfp.fp_status); 12582 i |= get_float_exception_flags(&env->vfp.standard_fp_status); 12583 /* FZ16 does not generate an input denormal exception. */ 12584 i |= (get_float_exception_flags(&env->vfp.fp_status_f16) 12585 & ~float_flag_input_denormal); 12586 12587 fpscr |= vfp_exceptbits_from_host(i); 12588 return fpscr; 12589 } 12590 12591 uint32_t vfp_get_fpscr(CPUARMState *env) 12592 { 12593 return HELPER(vfp_get_fpscr)(env); 12594 } 12595 12596 /* Convert vfp exception flags to target form. */ 12597 static inline int vfp_exceptbits_to_host(int target_bits) 12598 { 12599 int host_bits = 0; 12600 12601 if (target_bits & 1) 12602 host_bits |= float_flag_invalid; 12603 if (target_bits & 2) 12604 host_bits |= float_flag_divbyzero; 12605 if (target_bits & 4) 12606 host_bits |= float_flag_overflow; 12607 if (target_bits & 8) 12608 host_bits |= float_flag_underflow; 12609 if (target_bits & 0x10) 12610 host_bits |= float_flag_inexact; 12611 if (target_bits & 0x80) 12612 host_bits |= float_flag_input_denormal; 12613 return host_bits; 12614 } 12615 12616 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val) 12617 { 12618 int i; 12619 uint32_t changed; 12620 12621 /* When ARMv8.2-FP16 is not supported, FZ16 is RES0. */ 12622 if (!cpu_isar_feature(aa64_fp16, arm_env_get_cpu(env))) { 12623 val &= ~FPCR_FZ16; 12624 } 12625 12626 changed = env->vfp.xregs[ARM_VFP_FPSCR]; 12627 env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff); 12628 env->vfp.vec_len = (val >> 16) & 7; 12629 env->vfp.vec_stride = (val >> 20) & 3; 12630 12631 changed ^= val; 12632 if (changed & (3 << 22)) { 12633 i = (val >> 22) & 3; 12634 switch (i) { 12635 case FPROUNDING_TIEEVEN: 12636 i = float_round_nearest_even; 12637 break; 12638 case FPROUNDING_POSINF: 12639 i = float_round_up; 12640 break; 12641 case FPROUNDING_NEGINF: 12642 i = float_round_down; 12643 break; 12644 case FPROUNDING_ZERO: 12645 i = float_round_to_zero; 12646 break; 12647 } 12648 set_float_rounding_mode(i, &env->vfp.fp_status); 12649 set_float_rounding_mode(i, &env->vfp.fp_status_f16); 12650 } 12651 if (changed & FPCR_FZ16) { 12652 bool ftz_enabled = val & FPCR_FZ16; 12653 set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16); 12654 set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16); 12655 } 12656 if (changed & FPCR_FZ) { 12657 bool ftz_enabled = val & FPCR_FZ; 12658 set_flush_to_zero(ftz_enabled, &env->vfp.fp_status); 12659 set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status); 12660 } 12661 if (changed & FPCR_DN) { 12662 bool dnan_enabled = val & FPCR_DN; 12663 set_default_nan_mode(dnan_enabled, &env->vfp.fp_status); 12664 set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16); 12665 } 12666 12667 /* The exception flags are ORed together when we read fpscr so we 12668 * only need to preserve the current state in one of our 12669 * float_status values. 12670 */ 12671 i = vfp_exceptbits_to_host(val); 12672 set_float_exception_flags(i, &env->vfp.fp_status); 12673 set_float_exception_flags(0, &env->vfp.fp_status_f16); 12674 set_float_exception_flags(0, &env->vfp.standard_fp_status); 12675 } 12676 12677 void vfp_set_fpscr(CPUARMState *env, uint32_t val) 12678 { 12679 HELPER(vfp_set_fpscr)(env, val); 12680 } 12681 12682 #define VFP_HELPER(name, p) HELPER(glue(glue(vfp_,name),p)) 12683 12684 #define VFP_BINOP(name) \ 12685 float32 VFP_HELPER(name, s)(float32 a, float32 b, void *fpstp) \ 12686 { \ 12687 float_status *fpst = fpstp; \ 12688 return float32_ ## name(a, b, fpst); \ 12689 } \ 12690 float64 VFP_HELPER(name, d)(float64 a, float64 b, void *fpstp) \ 12691 { \ 12692 float_status *fpst = fpstp; \ 12693 return float64_ ## name(a, b, fpst); \ 12694 } 12695 VFP_BINOP(add) 12696 VFP_BINOP(sub) 12697 VFP_BINOP(mul) 12698 VFP_BINOP(div) 12699 VFP_BINOP(min) 12700 VFP_BINOP(max) 12701 VFP_BINOP(minnum) 12702 VFP_BINOP(maxnum) 12703 #undef VFP_BINOP 12704 12705 float32 VFP_HELPER(neg, s)(float32 a) 12706 { 12707 return float32_chs(a); 12708 } 12709 12710 float64 VFP_HELPER(neg, d)(float64 a) 12711 { 12712 return float64_chs(a); 12713 } 12714 12715 float32 VFP_HELPER(abs, s)(float32 a) 12716 { 12717 return float32_abs(a); 12718 } 12719 12720 float64 VFP_HELPER(abs, d)(float64 a) 12721 { 12722 return float64_abs(a); 12723 } 12724 12725 float32 VFP_HELPER(sqrt, s)(float32 a, CPUARMState *env) 12726 { 12727 return float32_sqrt(a, &env->vfp.fp_status); 12728 } 12729 12730 float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env) 12731 { 12732 return float64_sqrt(a, &env->vfp.fp_status); 12733 } 12734 12735 /* XXX: check quiet/signaling case */ 12736 #define DO_VFP_cmp(p, type) \ 12737 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env) \ 12738 { \ 12739 uint32_t flags; \ 12740 switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \ 12741 case 0: flags = 0x6; break; \ 12742 case -1: flags = 0x8; break; \ 12743 case 1: flags = 0x2; break; \ 12744 default: case 2: flags = 0x3; break; \ 12745 } \ 12746 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \ 12747 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \ 12748 } \ 12749 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \ 12750 { \ 12751 uint32_t flags; \ 12752 switch(type ## _compare(a, b, &env->vfp.fp_status)) { \ 12753 case 0: flags = 0x6; break; \ 12754 case -1: flags = 0x8; break; \ 12755 case 1: flags = 0x2; break; \ 12756 default: case 2: flags = 0x3; break; \ 12757 } \ 12758 env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \ 12759 | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \ 12760 } 12761 DO_VFP_cmp(s, float32) 12762 DO_VFP_cmp(d, float64) 12763 #undef DO_VFP_cmp 12764 12765 /* Integer to float and float to integer conversions */ 12766 12767 #define CONV_ITOF(name, ftype, fsz, sign) \ 12768 ftype HELPER(name)(uint32_t x, void *fpstp) \ 12769 { \ 12770 float_status *fpst = fpstp; \ 12771 return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \ 12772 } 12773 12774 #define CONV_FTOI(name, ftype, fsz, sign, round) \ 12775 sign##int32_t HELPER(name)(ftype x, void *fpstp) \ 12776 { \ 12777 float_status *fpst = fpstp; \ 12778 if (float##fsz##_is_any_nan(x)) { \ 12779 float_raise(float_flag_invalid, fpst); \ 12780 return 0; \ 12781 } \ 12782 return float##fsz##_to_##sign##int32##round(x, fpst); \ 12783 } 12784 12785 #define FLOAT_CONVS(name, p, ftype, fsz, sign) \ 12786 CONV_ITOF(vfp_##name##to##p, ftype, fsz, sign) \ 12787 CONV_FTOI(vfp_to##name##p, ftype, fsz, sign, ) \ 12788 CONV_FTOI(vfp_to##name##z##p, ftype, fsz, sign, _round_to_zero) 12789 12790 FLOAT_CONVS(si, h, uint32_t, 16, ) 12791 FLOAT_CONVS(si, s, float32, 32, ) 12792 FLOAT_CONVS(si, d, float64, 64, ) 12793 FLOAT_CONVS(ui, h, uint32_t, 16, u) 12794 FLOAT_CONVS(ui, s, float32, 32, u) 12795 FLOAT_CONVS(ui, d, float64, 64, u) 12796 12797 #undef CONV_ITOF 12798 #undef CONV_FTOI 12799 #undef FLOAT_CONVS 12800 12801 /* floating point conversion */ 12802 float64 VFP_HELPER(fcvtd, s)(float32 x, CPUARMState *env) 12803 { 12804 return float32_to_float64(x, &env->vfp.fp_status); 12805 } 12806 12807 float32 VFP_HELPER(fcvts, d)(float64 x, CPUARMState *env) 12808 { 12809 return float64_to_float32(x, &env->vfp.fp_status); 12810 } 12811 12812 /* VFP3 fixed point conversion. */ 12813 #define VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \ 12814 float##fsz HELPER(vfp_##name##to##p)(uint##isz##_t x, uint32_t shift, \ 12815 void *fpstp) \ 12816 { return itype##_to_##float##fsz##_scalbn(x, -shift, fpstp); } 12817 12818 #define VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, ROUND, suff) \ 12819 uint##isz##_t HELPER(vfp_to##name##p##suff)(float##fsz x, uint32_t shift, \ 12820 void *fpst) \ 12821 { \ 12822 if (unlikely(float##fsz##_is_any_nan(x))) { \ 12823 float_raise(float_flag_invalid, fpst); \ 12824 return 0; \ 12825 } \ 12826 return float##fsz##_to_##itype##_scalbn(x, ROUND, shift, fpst); \ 12827 } 12828 12829 #define VFP_CONV_FIX(name, p, fsz, isz, itype) \ 12830 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \ 12831 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \ 12832 float_round_to_zero, _round_to_zero) \ 12833 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \ 12834 get_float_rounding_mode(fpst), ) 12835 12836 #define VFP_CONV_FIX_A64(name, p, fsz, isz, itype) \ 12837 VFP_CONV_FIX_FLOAT(name, p, fsz, isz, itype) \ 12838 VFP_CONV_FLOAT_FIX_ROUND(name, p, fsz, isz, itype, \ 12839 get_float_rounding_mode(fpst), ) 12840 12841 VFP_CONV_FIX(sh, d, 64, 64, int16) 12842 VFP_CONV_FIX(sl, d, 64, 64, int32) 12843 VFP_CONV_FIX_A64(sq, d, 64, 64, int64) 12844 VFP_CONV_FIX(uh, d, 64, 64, uint16) 12845 VFP_CONV_FIX(ul, d, 64, 64, uint32) 12846 VFP_CONV_FIX_A64(uq, d, 64, 64, uint64) 12847 VFP_CONV_FIX(sh, s, 32, 32, int16) 12848 VFP_CONV_FIX(sl, s, 32, 32, int32) 12849 VFP_CONV_FIX_A64(sq, s, 32, 64, int64) 12850 VFP_CONV_FIX(uh, s, 32, 32, uint16) 12851 VFP_CONV_FIX(ul, s, 32, 32, uint32) 12852 VFP_CONV_FIX_A64(uq, s, 32, 64, uint64) 12853 12854 #undef VFP_CONV_FIX 12855 #undef VFP_CONV_FIX_FLOAT 12856 #undef VFP_CONV_FLOAT_FIX_ROUND 12857 #undef VFP_CONV_FIX_A64 12858 12859 uint32_t HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst) 12860 { 12861 return int32_to_float16_scalbn(x, -shift, fpst); 12862 } 12863 12864 uint32_t HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst) 12865 { 12866 return uint32_to_float16_scalbn(x, -shift, fpst); 12867 } 12868 12869 uint32_t HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst) 12870 { 12871 return int64_to_float16_scalbn(x, -shift, fpst); 12872 } 12873 12874 uint32_t HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst) 12875 { 12876 return uint64_to_float16_scalbn(x, -shift, fpst); 12877 } 12878 12879 uint32_t HELPER(vfp_toshh)(uint32_t x, uint32_t shift, void *fpst) 12880 { 12881 if (unlikely(float16_is_any_nan(x))) { 12882 float_raise(float_flag_invalid, fpst); 12883 return 0; 12884 } 12885 return float16_to_int16_scalbn(x, get_float_rounding_mode(fpst), 12886 shift, fpst); 12887 } 12888 12889 uint32_t HELPER(vfp_touhh)(uint32_t x, uint32_t shift, void *fpst) 12890 { 12891 if (unlikely(float16_is_any_nan(x))) { 12892 float_raise(float_flag_invalid, fpst); 12893 return 0; 12894 } 12895 return float16_to_uint16_scalbn(x, get_float_rounding_mode(fpst), 12896 shift, fpst); 12897 } 12898 12899 uint32_t HELPER(vfp_toslh)(uint32_t x, uint32_t shift, void *fpst) 12900 { 12901 if (unlikely(float16_is_any_nan(x))) { 12902 float_raise(float_flag_invalid, fpst); 12903 return 0; 12904 } 12905 return float16_to_int32_scalbn(x, get_float_rounding_mode(fpst), 12906 shift, fpst); 12907 } 12908 12909 uint32_t HELPER(vfp_toulh)(uint32_t x, uint32_t shift, void *fpst) 12910 { 12911 if (unlikely(float16_is_any_nan(x))) { 12912 float_raise(float_flag_invalid, fpst); 12913 return 0; 12914 } 12915 return float16_to_uint32_scalbn(x, get_float_rounding_mode(fpst), 12916 shift, fpst); 12917 } 12918 12919 uint64_t HELPER(vfp_tosqh)(uint32_t x, uint32_t shift, void *fpst) 12920 { 12921 if (unlikely(float16_is_any_nan(x))) { 12922 float_raise(float_flag_invalid, fpst); 12923 return 0; 12924 } 12925 return float16_to_int64_scalbn(x, get_float_rounding_mode(fpst), 12926 shift, fpst); 12927 } 12928 12929 uint64_t HELPER(vfp_touqh)(uint32_t x, uint32_t shift, void *fpst) 12930 { 12931 if (unlikely(float16_is_any_nan(x))) { 12932 float_raise(float_flag_invalid, fpst); 12933 return 0; 12934 } 12935 return float16_to_uint64_scalbn(x, get_float_rounding_mode(fpst), 12936 shift, fpst); 12937 } 12938 12939 /* Set the current fp rounding mode and return the old one. 12940 * The argument is a softfloat float_round_ value. 12941 */ 12942 uint32_t HELPER(set_rmode)(uint32_t rmode, void *fpstp) 12943 { 12944 float_status *fp_status = fpstp; 12945 12946 uint32_t prev_rmode = get_float_rounding_mode(fp_status); 12947 set_float_rounding_mode(rmode, fp_status); 12948 12949 return prev_rmode; 12950 } 12951 12952 /* Set the current fp rounding mode in the standard fp status and return 12953 * the old one. This is for NEON instructions that need to change the 12954 * rounding mode but wish to use the standard FPSCR values for everything 12955 * else. Always set the rounding mode back to the correct value after 12956 * modifying it. 12957 * The argument is a softfloat float_round_ value. 12958 */ 12959 uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env) 12960 { 12961 float_status *fp_status = &env->vfp.standard_fp_status; 12962 12963 uint32_t prev_rmode = get_float_rounding_mode(fp_status); 12964 set_float_rounding_mode(rmode, fp_status); 12965 12966 return prev_rmode; 12967 } 12968 12969 /* Half precision conversions. */ 12970 float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, void *fpstp, uint32_t ahp_mode) 12971 { 12972 /* Squash FZ16 to 0 for the duration of conversion. In this case, 12973 * it would affect flushing input denormals. 12974 */ 12975 float_status *fpst = fpstp; 12976 flag save = get_flush_inputs_to_zero(fpst); 12977 set_flush_inputs_to_zero(false, fpst); 12978 float32 r = float16_to_float32(a, !ahp_mode, fpst); 12979 set_flush_inputs_to_zero(save, fpst); 12980 return r; 12981 } 12982 12983 uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode) 12984 { 12985 /* Squash FZ16 to 0 for the duration of conversion. In this case, 12986 * it would affect flushing output denormals. 12987 */ 12988 float_status *fpst = fpstp; 12989 flag save = get_flush_to_zero(fpst); 12990 set_flush_to_zero(false, fpst); 12991 float16 r = float32_to_float16(a, !ahp_mode, fpst); 12992 set_flush_to_zero(save, fpst); 12993 return r; 12994 } 12995 12996 float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, void *fpstp, uint32_t ahp_mode) 12997 { 12998 /* Squash FZ16 to 0 for the duration of conversion. In this case, 12999 * it would affect flushing input denormals. 13000 */ 13001 float_status *fpst = fpstp; 13002 flag save = get_flush_inputs_to_zero(fpst); 13003 set_flush_inputs_to_zero(false, fpst); 13004 float64 r = float16_to_float64(a, !ahp_mode, fpst); 13005 set_flush_inputs_to_zero(save, fpst); 13006 return r; 13007 } 13008 13009 uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode) 13010 { 13011 /* Squash FZ16 to 0 for the duration of conversion. In this case, 13012 * it would affect flushing output denormals. 13013 */ 13014 float_status *fpst = fpstp; 13015 flag save = get_flush_to_zero(fpst); 13016 set_flush_to_zero(false, fpst); 13017 float16 r = float64_to_float16(a, !ahp_mode, fpst); 13018 set_flush_to_zero(save, fpst); 13019 return r; 13020 } 13021 13022 #define float32_two make_float32(0x40000000) 13023 #define float32_three make_float32(0x40400000) 13024 #define float32_one_point_five make_float32(0x3fc00000) 13025 13026 float32 HELPER(recps_f32)(float32 a, float32 b, CPUARMState *env) 13027 { 13028 float_status *s = &env->vfp.standard_fp_status; 13029 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) || 13030 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) { 13031 if (!(float32_is_zero(a) || float32_is_zero(b))) { 13032 float_raise(float_flag_input_denormal, s); 13033 } 13034 return float32_two; 13035 } 13036 return float32_sub(float32_two, float32_mul(a, b, s), s); 13037 } 13038 13039 float32 HELPER(rsqrts_f32)(float32 a, float32 b, CPUARMState *env) 13040 { 13041 float_status *s = &env->vfp.standard_fp_status; 13042 float32 product; 13043 if ((float32_is_infinity(a) && float32_is_zero_or_denormal(b)) || 13044 (float32_is_infinity(b) && float32_is_zero_or_denormal(a))) { 13045 if (!(float32_is_zero(a) || float32_is_zero(b))) { 13046 float_raise(float_flag_input_denormal, s); 13047 } 13048 return float32_one_point_five; 13049 } 13050 product = float32_mul(a, b, s); 13051 return float32_div(float32_sub(float32_three, product, s), float32_two, s); 13052 } 13053 13054 /* NEON helpers. */ 13055 13056 /* Constants 256 and 512 are used in some helpers; we avoid relying on 13057 * int->float conversions at run-time. */ 13058 #define float64_256 make_float64(0x4070000000000000LL) 13059 #define float64_512 make_float64(0x4080000000000000LL) 13060 #define float16_maxnorm make_float16(0x7bff) 13061 #define float32_maxnorm make_float32(0x7f7fffff) 13062 #define float64_maxnorm make_float64(0x7fefffffffffffffLL) 13063 13064 /* Reciprocal functions 13065 * 13066 * The algorithm that must be used to calculate the estimate 13067 * is specified by the ARM ARM, see FPRecipEstimate()/RecipEstimate 13068 */ 13069 13070 /* See RecipEstimate() 13071 * 13072 * input is a 9 bit fixed point number 13073 * input range 256 .. 511 for a number from 0.5 <= x < 1.0. 13074 * result range 256 .. 511 for a number from 1.0 to 511/256. 13075 */ 13076 13077 static int recip_estimate(int input) 13078 { 13079 int a, b, r; 13080 assert(256 <= input && input < 512); 13081 a = (input * 2) + 1; 13082 b = (1 << 19) / a; 13083 r = (b + 1) >> 1; 13084 assert(256 <= r && r < 512); 13085 return r; 13086 } 13087 13088 /* 13089 * Common wrapper to call recip_estimate 13090 * 13091 * The parameters are exponent and 64 bit fraction (without implicit 13092 * bit) where the binary point is nominally at bit 52. Returns a 13093 * float64 which can then be rounded to the appropriate size by the 13094 * callee. 13095 */ 13096 13097 static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac) 13098 { 13099 uint32_t scaled, estimate; 13100 uint64_t result_frac; 13101 int result_exp; 13102 13103 /* Handle sub-normals */ 13104 if (*exp == 0) { 13105 if (extract64(frac, 51, 1) == 0) { 13106 *exp = -1; 13107 frac <<= 2; 13108 } else { 13109 frac <<= 1; 13110 } 13111 } 13112 13113 /* scaled = UInt('1':fraction<51:44>) */ 13114 scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8)); 13115 estimate = recip_estimate(scaled); 13116 13117 result_exp = exp_off - *exp; 13118 result_frac = deposit64(0, 44, 8, estimate); 13119 if (result_exp == 0) { 13120 result_frac = deposit64(result_frac >> 1, 51, 1, 1); 13121 } else if (result_exp == -1) { 13122 result_frac = deposit64(result_frac >> 2, 50, 2, 1); 13123 result_exp = 0; 13124 } 13125 13126 *exp = result_exp; 13127 13128 return result_frac; 13129 } 13130 13131 static bool round_to_inf(float_status *fpst, bool sign_bit) 13132 { 13133 switch (fpst->float_rounding_mode) { 13134 case float_round_nearest_even: /* Round to Nearest */ 13135 return true; 13136 case float_round_up: /* Round to +Inf */ 13137 return !sign_bit; 13138 case float_round_down: /* Round to -Inf */ 13139 return sign_bit; 13140 case float_round_to_zero: /* Round to Zero */ 13141 return false; 13142 } 13143 13144 g_assert_not_reached(); 13145 } 13146 13147 uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp) 13148 { 13149 float_status *fpst = fpstp; 13150 float16 f16 = float16_squash_input_denormal(input, fpst); 13151 uint32_t f16_val = float16_val(f16); 13152 uint32_t f16_sign = float16_is_neg(f16); 13153 int f16_exp = extract32(f16_val, 10, 5); 13154 uint32_t f16_frac = extract32(f16_val, 0, 10); 13155 uint64_t f64_frac; 13156 13157 if (float16_is_any_nan(f16)) { 13158 float16 nan = f16; 13159 if (float16_is_signaling_nan(f16, fpst)) { 13160 float_raise(float_flag_invalid, fpst); 13161 nan = float16_silence_nan(f16, fpst); 13162 } 13163 if (fpst->default_nan_mode) { 13164 nan = float16_default_nan(fpst); 13165 } 13166 return nan; 13167 } else if (float16_is_infinity(f16)) { 13168 return float16_set_sign(float16_zero, float16_is_neg(f16)); 13169 } else if (float16_is_zero(f16)) { 13170 float_raise(float_flag_divbyzero, fpst); 13171 return float16_set_sign(float16_infinity, float16_is_neg(f16)); 13172 } else if (float16_abs(f16) < (1 << 8)) { 13173 /* Abs(value) < 2.0^-16 */ 13174 float_raise(float_flag_overflow | float_flag_inexact, fpst); 13175 if (round_to_inf(fpst, f16_sign)) { 13176 return float16_set_sign(float16_infinity, f16_sign); 13177 } else { 13178 return float16_set_sign(float16_maxnorm, f16_sign); 13179 } 13180 } else if (f16_exp >= 29 && fpst->flush_to_zero) { 13181 float_raise(float_flag_underflow, fpst); 13182 return float16_set_sign(float16_zero, float16_is_neg(f16)); 13183 } 13184 13185 f64_frac = call_recip_estimate(&f16_exp, 29, 13186 ((uint64_t) f16_frac) << (52 - 10)); 13187 13188 /* result = sign : result_exp<4:0> : fraction<51:42> */ 13189 f16_val = deposit32(0, 15, 1, f16_sign); 13190 f16_val = deposit32(f16_val, 10, 5, f16_exp); 13191 f16_val = deposit32(f16_val, 0, 10, extract64(f64_frac, 52 - 10, 10)); 13192 return make_float16(f16_val); 13193 } 13194 13195 float32 HELPER(recpe_f32)(float32 input, void *fpstp) 13196 { 13197 float_status *fpst = fpstp; 13198 float32 f32 = float32_squash_input_denormal(input, fpst); 13199 uint32_t f32_val = float32_val(f32); 13200 bool f32_sign = float32_is_neg(f32); 13201 int f32_exp = extract32(f32_val, 23, 8); 13202 uint32_t f32_frac = extract32(f32_val, 0, 23); 13203 uint64_t f64_frac; 13204 13205 if (float32_is_any_nan(f32)) { 13206 float32 nan = f32; 13207 if (float32_is_signaling_nan(f32, fpst)) { 13208 float_raise(float_flag_invalid, fpst); 13209 nan = float32_silence_nan(f32, fpst); 13210 } 13211 if (fpst->default_nan_mode) { 13212 nan = float32_default_nan(fpst); 13213 } 13214 return nan; 13215 } else if (float32_is_infinity(f32)) { 13216 return float32_set_sign(float32_zero, float32_is_neg(f32)); 13217 } else if (float32_is_zero(f32)) { 13218 float_raise(float_flag_divbyzero, fpst); 13219 return float32_set_sign(float32_infinity, float32_is_neg(f32)); 13220 } else if (float32_abs(f32) < (1ULL << 21)) { 13221 /* Abs(value) < 2.0^-128 */ 13222 float_raise(float_flag_overflow | float_flag_inexact, fpst); 13223 if (round_to_inf(fpst, f32_sign)) { 13224 return float32_set_sign(float32_infinity, f32_sign); 13225 } else { 13226 return float32_set_sign(float32_maxnorm, f32_sign); 13227 } 13228 } else if (f32_exp >= 253 && fpst->flush_to_zero) { 13229 float_raise(float_flag_underflow, fpst); 13230 return float32_set_sign(float32_zero, float32_is_neg(f32)); 13231 } 13232 13233 f64_frac = call_recip_estimate(&f32_exp, 253, 13234 ((uint64_t) f32_frac) << (52 - 23)); 13235 13236 /* result = sign : result_exp<7:0> : fraction<51:29> */ 13237 f32_val = deposit32(0, 31, 1, f32_sign); 13238 f32_val = deposit32(f32_val, 23, 8, f32_exp); 13239 f32_val = deposit32(f32_val, 0, 23, extract64(f64_frac, 52 - 23, 23)); 13240 return make_float32(f32_val); 13241 } 13242 13243 float64 HELPER(recpe_f64)(float64 input, void *fpstp) 13244 { 13245 float_status *fpst = fpstp; 13246 float64 f64 = float64_squash_input_denormal(input, fpst); 13247 uint64_t f64_val = float64_val(f64); 13248 bool f64_sign = float64_is_neg(f64); 13249 int f64_exp = extract64(f64_val, 52, 11); 13250 uint64_t f64_frac = extract64(f64_val, 0, 52); 13251 13252 /* Deal with any special cases */ 13253 if (float64_is_any_nan(f64)) { 13254 float64 nan = f64; 13255 if (float64_is_signaling_nan(f64, fpst)) { 13256 float_raise(float_flag_invalid, fpst); 13257 nan = float64_silence_nan(f64, fpst); 13258 } 13259 if (fpst->default_nan_mode) { 13260 nan = float64_default_nan(fpst); 13261 } 13262 return nan; 13263 } else if (float64_is_infinity(f64)) { 13264 return float64_set_sign(float64_zero, float64_is_neg(f64)); 13265 } else if (float64_is_zero(f64)) { 13266 float_raise(float_flag_divbyzero, fpst); 13267 return float64_set_sign(float64_infinity, float64_is_neg(f64)); 13268 } else if ((f64_val & ~(1ULL << 63)) < (1ULL << 50)) { 13269 /* Abs(value) < 2.0^-1024 */ 13270 float_raise(float_flag_overflow | float_flag_inexact, fpst); 13271 if (round_to_inf(fpst, f64_sign)) { 13272 return float64_set_sign(float64_infinity, f64_sign); 13273 } else { 13274 return float64_set_sign(float64_maxnorm, f64_sign); 13275 } 13276 } else if (f64_exp >= 2045 && fpst->flush_to_zero) { 13277 float_raise(float_flag_underflow, fpst); 13278 return float64_set_sign(float64_zero, float64_is_neg(f64)); 13279 } 13280 13281 f64_frac = call_recip_estimate(&f64_exp, 2045, f64_frac); 13282 13283 /* result = sign : result_exp<10:0> : fraction<51:0>; */ 13284 f64_val = deposit64(0, 63, 1, f64_sign); 13285 f64_val = deposit64(f64_val, 52, 11, f64_exp); 13286 f64_val = deposit64(f64_val, 0, 52, f64_frac); 13287 return make_float64(f64_val); 13288 } 13289 13290 /* The algorithm that must be used to calculate the estimate 13291 * is specified by the ARM ARM. 13292 */ 13293 13294 static int do_recip_sqrt_estimate(int a) 13295 { 13296 int b, estimate; 13297 13298 assert(128 <= a && a < 512); 13299 if (a < 256) { 13300 a = a * 2 + 1; 13301 } else { 13302 a = (a >> 1) << 1; 13303 a = (a + 1) * 2; 13304 } 13305 b = 512; 13306 while (a * (b + 1) * (b + 1) < (1 << 28)) { 13307 b += 1; 13308 } 13309 estimate = (b + 1) / 2; 13310 assert(256 <= estimate && estimate < 512); 13311 13312 return estimate; 13313 } 13314 13315 13316 static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac) 13317 { 13318 int estimate; 13319 uint32_t scaled; 13320 13321 if (*exp == 0) { 13322 while (extract64(frac, 51, 1) == 0) { 13323 frac = frac << 1; 13324 *exp -= 1; 13325 } 13326 frac = extract64(frac, 0, 51) << 1; 13327 } 13328 13329 if (*exp & 1) { 13330 /* scaled = UInt('01':fraction<51:45>) */ 13331 scaled = deposit32(1 << 7, 0, 7, extract64(frac, 45, 7)); 13332 } else { 13333 /* scaled = UInt('1':fraction<51:44>) */ 13334 scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8)); 13335 } 13336 estimate = do_recip_sqrt_estimate(scaled); 13337 13338 *exp = (exp_off - *exp) / 2; 13339 return extract64(estimate, 0, 8) << 44; 13340 } 13341 13342 uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp) 13343 { 13344 float_status *s = fpstp; 13345 float16 f16 = float16_squash_input_denormal(input, s); 13346 uint16_t val = float16_val(f16); 13347 bool f16_sign = float16_is_neg(f16); 13348 int f16_exp = extract32(val, 10, 5); 13349 uint16_t f16_frac = extract32(val, 0, 10); 13350 uint64_t f64_frac; 13351 13352 if (float16_is_any_nan(f16)) { 13353 float16 nan = f16; 13354 if (float16_is_signaling_nan(f16, s)) { 13355 float_raise(float_flag_invalid, s); 13356 nan = float16_silence_nan(f16, s); 13357 } 13358 if (s->default_nan_mode) { 13359 nan = float16_default_nan(s); 13360 } 13361 return nan; 13362 } else if (float16_is_zero(f16)) { 13363 float_raise(float_flag_divbyzero, s); 13364 return float16_set_sign(float16_infinity, f16_sign); 13365 } else if (f16_sign) { 13366 float_raise(float_flag_invalid, s); 13367 return float16_default_nan(s); 13368 } else if (float16_is_infinity(f16)) { 13369 return float16_zero; 13370 } 13371 13372 /* Scale and normalize to a double-precision value between 0.25 and 1.0, 13373 * preserving the parity of the exponent. */ 13374 13375 f64_frac = ((uint64_t) f16_frac) << (52 - 10); 13376 13377 f64_frac = recip_sqrt_estimate(&f16_exp, 44, f64_frac); 13378 13379 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(2) */ 13380 val = deposit32(0, 15, 1, f16_sign); 13381 val = deposit32(val, 10, 5, f16_exp); 13382 val = deposit32(val, 2, 8, extract64(f64_frac, 52 - 8, 8)); 13383 return make_float16(val); 13384 } 13385 13386 float32 HELPER(rsqrte_f32)(float32 input, void *fpstp) 13387 { 13388 float_status *s = fpstp; 13389 float32 f32 = float32_squash_input_denormal(input, s); 13390 uint32_t val = float32_val(f32); 13391 uint32_t f32_sign = float32_is_neg(f32); 13392 int f32_exp = extract32(val, 23, 8); 13393 uint32_t f32_frac = extract32(val, 0, 23); 13394 uint64_t f64_frac; 13395 13396 if (float32_is_any_nan(f32)) { 13397 float32 nan = f32; 13398 if (float32_is_signaling_nan(f32, s)) { 13399 float_raise(float_flag_invalid, s); 13400 nan = float32_silence_nan(f32, s); 13401 } 13402 if (s->default_nan_mode) { 13403 nan = float32_default_nan(s); 13404 } 13405 return nan; 13406 } else if (float32_is_zero(f32)) { 13407 float_raise(float_flag_divbyzero, s); 13408 return float32_set_sign(float32_infinity, float32_is_neg(f32)); 13409 } else if (float32_is_neg(f32)) { 13410 float_raise(float_flag_invalid, s); 13411 return float32_default_nan(s); 13412 } else if (float32_is_infinity(f32)) { 13413 return float32_zero; 13414 } 13415 13416 /* Scale and normalize to a double-precision value between 0.25 and 1.0, 13417 * preserving the parity of the exponent. */ 13418 13419 f64_frac = ((uint64_t) f32_frac) << 29; 13420 13421 f64_frac = recip_sqrt_estimate(&f32_exp, 380, f64_frac); 13422 13423 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(15) */ 13424 val = deposit32(0, 31, 1, f32_sign); 13425 val = deposit32(val, 23, 8, f32_exp); 13426 val = deposit32(val, 15, 8, extract64(f64_frac, 52 - 8, 8)); 13427 return make_float32(val); 13428 } 13429 13430 float64 HELPER(rsqrte_f64)(float64 input, void *fpstp) 13431 { 13432 float_status *s = fpstp; 13433 float64 f64 = float64_squash_input_denormal(input, s); 13434 uint64_t val = float64_val(f64); 13435 bool f64_sign = float64_is_neg(f64); 13436 int f64_exp = extract64(val, 52, 11); 13437 uint64_t f64_frac = extract64(val, 0, 52); 13438 13439 if (float64_is_any_nan(f64)) { 13440 float64 nan = f64; 13441 if (float64_is_signaling_nan(f64, s)) { 13442 float_raise(float_flag_invalid, s); 13443 nan = float64_silence_nan(f64, s); 13444 } 13445 if (s->default_nan_mode) { 13446 nan = float64_default_nan(s); 13447 } 13448 return nan; 13449 } else if (float64_is_zero(f64)) { 13450 float_raise(float_flag_divbyzero, s); 13451 return float64_set_sign(float64_infinity, float64_is_neg(f64)); 13452 } else if (float64_is_neg(f64)) { 13453 float_raise(float_flag_invalid, s); 13454 return float64_default_nan(s); 13455 } else if (float64_is_infinity(f64)) { 13456 return float64_zero; 13457 } 13458 13459 f64_frac = recip_sqrt_estimate(&f64_exp, 3068, f64_frac); 13460 13461 /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(44) */ 13462 val = deposit64(0, 61, 1, f64_sign); 13463 val = deposit64(val, 52, 11, f64_exp); 13464 val = deposit64(val, 44, 8, extract64(f64_frac, 52 - 8, 8)); 13465 return make_float64(val); 13466 } 13467 13468 uint32_t HELPER(recpe_u32)(uint32_t a, void *fpstp) 13469 { 13470 /* float_status *s = fpstp; */ 13471 int input, estimate; 13472 13473 if ((a & 0x80000000) == 0) { 13474 return 0xffffffff; 13475 } 13476 13477 input = extract32(a, 23, 9); 13478 estimate = recip_estimate(input); 13479 13480 return deposit32(0, (32 - 9), 9, estimate); 13481 } 13482 13483 uint32_t HELPER(rsqrte_u32)(uint32_t a, void *fpstp) 13484 { 13485 int estimate; 13486 13487 if ((a & 0xc0000000) == 0) { 13488 return 0xffffffff; 13489 } 13490 13491 estimate = do_recip_sqrt_estimate(extract32(a, 23, 9)); 13492 13493 return deposit32(0, 23, 9, estimate); 13494 } 13495 13496 /* VFPv4 fused multiply-accumulate */ 13497 float32 VFP_HELPER(muladd, s)(float32 a, float32 b, float32 c, void *fpstp) 13498 { 13499 float_status *fpst = fpstp; 13500 return float32_muladd(a, b, c, 0, fpst); 13501 } 13502 13503 float64 VFP_HELPER(muladd, d)(float64 a, float64 b, float64 c, void *fpstp) 13504 { 13505 float_status *fpst = fpstp; 13506 return float64_muladd(a, b, c, 0, fpst); 13507 } 13508 13509 /* ARMv8 round to integral */ 13510 float32 HELPER(rints_exact)(float32 x, void *fp_status) 13511 { 13512 return float32_round_to_int(x, fp_status); 13513 } 13514 13515 float64 HELPER(rintd_exact)(float64 x, void *fp_status) 13516 { 13517 return float64_round_to_int(x, fp_status); 13518 } 13519 13520 float32 HELPER(rints)(float32 x, void *fp_status) 13521 { 13522 int old_flags = get_float_exception_flags(fp_status), new_flags; 13523 float32 ret; 13524 13525 ret = float32_round_to_int(x, fp_status); 13526 13527 /* Suppress any inexact exceptions the conversion produced */ 13528 if (!(old_flags & float_flag_inexact)) { 13529 new_flags = get_float_exception_flags(fp_status); 13530 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status); 13531 } 13532 13533 return ret; 13534 } 13535 13536 float64 HELPER(rintd)(float64 x, void *fp_status) 13537 { 13538 int old_flags = get_float_exception_flags(fp_status), new_flags; 13539 float64 ret; 13540 13541 ret = float64_round_to_int(x, fp_status); 13542 13543 new_flags = get_float_exception_flags(fp_status); 13544 13545 /* Suppress any inexact exceptions the conversion produced */ 13546 if (!(old_flags & float_flag_inexact)) { 13547 new_flags = get_float_exception_flags(fp_status); 13548 set_float_exception_flags(new_flags & ~float_flag_inexact, fp_status); 13549 } 13550 13551 return ret; 13552 } 13553 13554 /* Convert ARM rounding mode to softfloat */ 13555 int arm_rmode_to_sf(int rmode) 13556 { 13557 switch (rmode) { 13558 case FPROUNDING_TIEAWAY: 13559 rmode = float_round_ties_away; 13560 break; 13561 case FPROUNDING_ODD: 13562 /* FIXME: add support for TIEAWAY and ODD */ 13563 qemu_log_mask(LOG_UNIMP, "arm: unimplemented rounding mode: %d\n", 13564 rmode); 13565 /* fall through for now */ 13566 case FPROUNDING_TIEEVEN: 13567 default: 13568 rmode = float_round_nearest_even; 13569 break; 13570 case FPROUNDING_POSINF: 13571 rmode = float_round_up; 13572 break; 13573 case FPROUNDING_NEGINF: 13574 rmode = float_round_down; 13575 break; 13576 case FPROUNDING_ZERO: 13577 rmode = float_round_to_zero; 13578 break; 13579 } 13580 return rmode; 13581 } 13582 13583 /* CRC helpers. 13584 * The upper bytes of val (above the number specified by 'bytes') must have 13585 * been zeroed out by the caller. 13586 */ 13587 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 13588 { 13589 uint8_t buf[4]; 13590 13591 stl_le_p(buf, val); 13592 13593 /* zlib crc32 converts the accumulator and output to one's complement. */ 13594 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 13595 } 13596 13597 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 13598 { 13599 uint8_t buf[4]; 13600 13601 stl_le_p(buf, val); 13602 13603 /* Linux crc32c converts the output to one's complement. */ 13604 return crc32c(acc, buf, bytes) ^ 0xffffffff; 13605 } 13606 13607 /* Return the exception level to which FP-disabled exceptions should 13608 * be taken, or 0 if FP is enabled. 13609 */ 13610 int fp_exception_el(CPUARMState *env, int cur_el) 13611 { 13612 #ifndef CONFIG_USER_ONLY 13613 int fpen; 13614 13615 /* CPACR and the CPTR registers don't exist before v6, so FP is 13616 * always accessible 13617 */ 13618 if (!arm_feature(env, ARM_FEATURE_V6)) { 13619 return 0; 13620 } 13621 13622 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit: 13623 * 0, 2 : trap EL0 and EL1/PL1 accesses 13624 * 1 : trap only EL0 accesses 13625 * 3 : trap no accesses 13626 */ 13627 fpen = extract32(env->cp15.cpacr_el1, 20, 2); 13628 switch (fpen) { 13629 case 0: 13630 case 2: 13631 if (cur_el == 0 || cur_el == 1) { 13632 /* Trap to PL1, which might be EL1 or EL3 */ 13633 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) { 13634 return 3; 13635 } 13636 return 1; 13637 } 13638 if (cur_el == 3 && !is_a64(env)) { 13639 /* Secure PL1 running at EL3 */ 13640 return 3; 13641 } 13642 break; 13643 case 1: 13644 if (cur_el == 0) { 13645 return 1; 13646 } 13647 break; 13648 case 3: 13649 break; 13650 } 13651 13652 /* For the CPTR registers we don't need to guard with an ARM_FEATURE 13653 * check because zero bits in the registers mean "don't trap". 13654 */ 13655 13656 /* CPTR_EL2 : present in v7VE or v8 */ 13657 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1) 13658 && !arm_is_secure_below_el3(env)) { 13659 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */ 13660 return 2; 13661 } 13662 13663 /* CPTR_EL3 : present in v8 */ 13664 if (extract32(env->cp15.cptr_el[3], 10, 1)) { 13665 /* Trap all FP ops to EL3 */ 13666 return 3; 13667 } 13668 #endif 13669 return 0; 13670 } 13671 13672 ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env, 13673 bool secstate, bool priv) 13674 { 13675 ARMMMUIdx mmu_idx = ARM_MMU_IDX_M; 13676 13677 if (priv) { 13678 mmu_idx |= ARM_MMU_IDX_M_PRIV; 13679 } 13680 13681 if (armv7m_nvic_neg_prio_requested(env->nvic, secstate)) { 13682 mmu_idx |= ARM_MMU_IDX_M_NEGPRI; 13683 } 13684 13685 if (secstate) { 13686 mmu_idx |= ARM_MMU_IDX_M_S; 13687 } 13688 13689 return mmu_idx; 13690 } 13691 13692 /* Return the MMU index for a v7M CPU in the specified security state */ 13693 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 13694 { 13695 bool priv = arm_current_el(env) != 0; 13696 13697 return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv); 13698 } 13699 13700 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 13701 { 13702 int el; 13703 13704 if (arm_feature(env, ARM_FEATURE_M)) { 13705 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 13706 } 13707 13708 el = arm_current_el(env); 13709 if (el < 2 && arm_is_secure_below_el3(env)) { 13710 return ARMMMUIdx_S1SE0 + el; 13711 } else { 13712 return ARMMMUIdx_S12NSE0 + el; 13713 } 13714 } 13715 13716 int cpu_mmu_index(CPUARMState *env, bool ifetch) 13717 { 13718 return arm_to_core_mmu_idx(arm_mmu_idx(env)); 13719 } 13720 13721 #ifndef CONFIG_USER_ONLY 13722 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 13723 { 13724 return stage_1_mmu_idx(arm_mmu_idx(env)); 13725 } 13726 #endif 13727 13728 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 13729 target_ulong *cs_base, uint32_t *pflags) 13730 { 13731 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 13732 int current_el = arm_current_el(env); 13733 int fp_el = fp_exception_el(env, current_el); 13734 uint32_t flags = 0; 13735 13736 if (is_a64(env)) { 13737 ARMCPU *cpu = arm_env_get_cpu(env); 13738 13739 *pc = env->pc; 13740 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1); 13741 13742 #ifndef CONFIG_USER_ONLY 13743 /* 13744 * Get control bits for tagged addresses. Note that the 13745 * translator only uses this for instruction addresses. 13746 */ 13747 { 13748 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx); 13749 ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1); 13750 int tbii, tbid; 13751 13752 /* FIXME: ARMv8.1-VHE S2 translation regime. */ 13753 if (regime_el(env, stage1) < 2) { 13754 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1); 13755 tbid = (p1.tbi << 1) | p0.tbi; 13756 tbii = tbid & ~((p1.tbid << 1) | p0.tbid); 13757 } else { 13758 tbid = p0.tbi; 13759 tbii = tbid & !p0.tbid; 13760 } 13761 13762 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii); 13763 } 13764 #endif 13765 13766 if (cpu_isar_feature(aa64_sve, cpu)) { 13767 int sve_el = sve_exception_el(env, current_el); 13768 uint32_t zcr_len; 13769 13770 /* If SVE is disabled, but FP is enabled, 13771 * then the effective len is 0. 13772 */ 13773 if (sve_el != 0 && fp_el == 0) { 13774 zcr_len = 0; 13775 } else { 13776 zcr_len = sve_zcr_len_for_el(env, current_el); 13777 } 13778 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el); 13779 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len); 13780 } 13781 13782 if (cpu_isar_feature(aa64_pauth, cpu)) { 13783 /* 13784 * In order to save space in flags, we record only whether 13785 * pauth is "inactive", meaning all insns are implemented as 13786 * a nop, or "active" when some action must be performed. 13787 * The decision of which action to take is left to a helper. 13788 */ 13789 uint64_t sctlr; 13790 if (current_el == 0) { 13791 /* FIXME: ARMv8.1-VHE S2 translation regime. */ 13792 sctlr = env->cp15.sctlr_el[1]; 13793 } else { 13794 sctlr = env->cp15.sctlr_el[current_el]; 13795 } 13796 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) { 13797 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1); 13798 } 13799 } 13800 } else { 13801 *pc = env->regs[15]; 13802 flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb); 13803 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, env->vfp.vec_len); 13804 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, env->vfp.vec_stride); 13805 flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits); 13806 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, arm_sctlr_b(env)); 13807 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env)); 13808 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30) 13809 || arm_el_is_aa64(env, 1)) { 13810 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 13811 } 13812 flags = FIELD_DP32(flags, TBFLAG_A32, XSCALE_CPAR, env->cp15.c15_cpar); 13813 } 13814 13815 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, arm_to_core_mmu_idx(mmu_idx)); 13816 13817 /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 13818 * states defined in the ARM ARM for software singlestep: 13819 * SS_ACTIVE PSTATE.SS State 13820 * 0 x Inactive (the TB flag for SS is always 0) 13821 * 1 0 Active-pending 13822 * 1 1 Active-not-pending 13823 */ 13824 if (arm_singlestep_active(env)) { 13825 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1); 13826 if (is_a64(env)) { 13827 if (env->pstate & PSTATE_SS) { 13828 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 13829 } 13830 } else { 13831 if (env->uncached_cpsr & PSTATE_SS) { 13832 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 13833 } 13834 } 13835 } 13836 if (arm_cpu_data_is_big_endian(env)) { 13837 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 13838 } 13839 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el); 13840 13841 if (arm_v7m_is_handler_mode(env)) { 13842 flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1); 13843 } 13844 13845 /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is 13846 * suppressing them because the requested execution priority is less than 0. 13847 */ 13848 if (arm_feature(env, ARM_FEATURE_V8) && 13849 arm_feature(env, ARM_FEATURE_M) && 13850 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) && 13851 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) { 13852 flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1); 13853 } 13854 13855 *pflags = flags; 13856 *cs_base = 0; 13857 } 13858 13859 #ifdef TARGET_AARCH64 13860 /* 13861 * The manual says that when SVE is enabled and VQ is widened the 13862 * implementation is allowed to zero the previously inaccessible 13863 * portion of the registers. The corollary to that is that when 13864 * SVE is enabled and VQ is narrowed we are also allowed to zero 13865 * the now inaccessible portion of the registers. 13866 * 13867 * The intent of this is that no predicate bit beyond VQ is ever set. 13868 * Which means that some operations on predicate registers themselves 13869 * may operate on full uint64_t or even unrolled across the maximum 13870 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 13871 * may well be cheaper than conditionals to restrict the operation 13872 * to the relevant portion of a uint16_t[16]. 13873 */ 13874 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 13875 { 13876 int i, j; 13877 uint64_t pmask; 13878 13879 assert(vq >= 1 && vq <= ARM_MAX_VQ); 13880 assert(vq <= arm_env_get_cpu(env)->sve_max_vq); 13881 13882 /* Zap the high bits of the zregs. */ 13883 for (i = 0; i < 32; i++) { 13884 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 13885 } 13886 13887 /* Zap the high bits of the pregs and ffr. */ 13888 pmask = 0; 13889 if (vq & 3) { 13890 pmask = ~(-1ULL << (16 * (vq & 3))); 13891 } 13892 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 13893 for (i = 0; i < 17; ++i) { 13894 env->vfp.pregs[i].p[j] &= pmask; 13895 } 13896 pmask = 0; 13897 } 13898 } 13899 13900 /* 13901 * Notice a change in SVE vector size when changing EL. 13902 */ 13903 void aarch64_sve_change_el(CPUARMState *env, int old_el, 13904 int new_el, bool el0_a64) 13905 { 13906 ARMCPU *cpu = arm_env_get_cpu(env); 13907 int old_len, new_len; 13908 bool old_a64, new_a64; 13909 13910 /* Nothing to do if no SVE. */ 13911 if (!cpu_isar_feature(aa64_sve, cpu)) { 13912 return; 13913 } 13914 13915 /* Nothing to do if FP is disabled in either EL. */ 13916 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 13917 return; 13918 } 13919 13920 /* 13921 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 13922 * at ELx, or not available because the EL is in AArch32 state, then 13923 * for all purposes other than a direct read, the ZCR_ELx.LEN field 13924 * has an effective value of 0". 13925 * 13926 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 13927 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 13928 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 13929 * we already have the correct register contents when encountering the 13930 * vq0->vq0 transition between EL0->EL1. 13931 */ 13932 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 13933 old_len = (old_a64 && !sve_exception_el(env, old_el) 13934 ? sve_zcr_len_for_el(env, old_el) : 0); 13935 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 13936 new_len = (new_a64 && !sve_exception_el(env, new_el) 13937 ? sve_zcr_len_for_el(env, new_el) : 0); 13938 13939 /* When changing vector length, clear inaccessible state. */ 13940 if (new_len < old_len) { 13941 aarch64_sve_narrow_vq(env, new_len + 1); 13942 } 13943 } 13944 #endif 13945