1 /* 2 * ARM generic helpers. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "trace.h" 12 #include "cpu.h" 13 #include "internals.h" 14 #include "cpu-features.h" 15 #include "exec/helper-proto.h" 16 #include "qemu/main-loop.h" 17 #include "qemu/timer.h" 18 #include "qemu/bitops.h" 19 #include "qemu/crc32c.h" 20 #include "qemu/qemu-print.h" 21 #include "exec/exec-all.h" 22 #include <zlib.h> /* for crc32 */ 23 #include "hw/irq.h" 24 #include "sysemu/cpu-timers.h" 25 #include "sysemu/kvm.h" 26 #include "sysemu/tcg.h" 27 #include "qapi/error.h" 28 #include "qemu/guest-random.h" 29 #ifdef CONFIG_TCG 30 #include "semihosting/common-semi.h" 31 #endif 32 #include "cpregs.h" 33 #include "target/arm/gtimer.h" 34 35 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 36 37 static void switch_mode(CPUARMState *env, int mode); 38 39 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 40 { 41 assert(ri->fieldoffset); 42 if (cpreg_field_is_64bit(ri)) { 43 return CPREG_FIELD64(env, ri); 44 } else { 45 return CPREG_FIELD32(env, ri); 46 } 47 } 48 49 void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 50 { 51 assert(ri->fieldoffset); 52 if (cpreg_field_is_64bit(ri)) { 53 CPREG_FIELD64(env, ri) = value; 54 } else { 55 CPREG_FIELD32(env, ri) = value; 56 } 57 } 58 59 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 60 { 61 return (char *)env + ri->fieldoffset; 62 } 63 64 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 65 { 66 /* Raw read of a coprocessor register (as needed for migration, etc). */ 67 if (ri->type & ARM_CP_CONST) { 68 return ri->resetvalue; 69 } else if (ri->raw_readfn) { 70 return ri->raw_readfn(env, ri); 71 } else if (ri->readfn) { 72 return ri->readfn(env, ri); 73 } else { 74 return raw_read(env, ri); 75 } 76 } 77 78 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 79 uint64_t v) 80 { 81 /* 82 * Raw write of a coprocessor register (as needed for migration, etc). 83 * Note that constant registers are treated as write-ignored; the 84 * caller should check for success by whether a readback gives the 85 * value written. 86 */ 87 if (ri->type & ARM_CP_CONST) { 88 return; 89 } else if (ri->raw_writefn) { 90 ri->raw_writefn(env, ri, v); 91 } else if (ri->writefn) { 92 ri->writefn(env, ri, v); 93 } else { 94 raw_write(env, ri, v); 95 } 96 } 97 98 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 99 { 100 /* 101 * Return true if the regdef would cause an assertion if you called 102 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 103 * program bug for it not to have the NO_RAW flag). 104 * NB that returning false here doesn't necessarily mean that calling 105 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 106 * read/write access functions which are safe for raw use" from "has 107 * read/write access functions which have side effects but has forgotten 108 * to provide raw access functions". 109 * The tests here line up with the conditions in read/write_raw_cp_reg() 110 * and assertions in raw_read()/raw_write(). 111 */ 112 if ((ri->type & ARM_CP_CONST) || 113 ri->fieldoffset || 114 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 115 return false; 116 } 117 return true; 118 } 119 120 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync) 121 { 122 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 123 int i; 124 bool ok = true; 125 126 for (i = 0; i < cpu->cpreg_array_len; i++) { 127 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 128 const ARMCPRegInfo *ri; 129 uint64_t newval; 130 131 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 132 if (!ri) { 133 ok = false; 134 continue; 135 } 136 if (ri->type & ARM_CP_NO_RAW) { 137 continue; 138 } 139 140 newval = read_raw_cp_reg(&cpu->env, ri); 141 if (kvm_sync) { 142 /* 143 * Only sync if the previous list->cpustate sync succeeded. 144 * Rather than tracking the success/failure state for every 145 * item in the list, we just recheck "does the raw write we must 146 * have made in write_list_to_cpustate() read back OK" here. 147 */ 148 uint64_t oldval = cpu->cpreg_values[i]; 149 150 if (oldval == newval) { 151 continue; 152 } 153 154 write_raw_cp_reg(&cpu->env, ri, oldval); 155 if (read_raw_cp_reg(&cpu->env, ri) != oldval) { 156 continue; 157 } 158 159 write_raw_cp_reg(&cpu->env, ri, newval); 160 } 161 cpu->cpreg_values[i] = newval; 162 } 163 return ok; 164 } 165 166 bool write_list_to_cpustate(ARMCPU *cpu) 167 { 168 int i; 169 bool ok = true; 170 171 for (i = 0; i < cpu->cpreg_array_len; i++) { 172 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 173 uint64_t v = cpu->cpreg_values[i]; 174 const ARMCPRegInfo *ri; 175 176 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 177 if (!ri) { 178 ok = false; 179 continue; 180 } 181 if (ri->type & ARM_CP_NO_RAW) { 182 continue; 183 } 184 /* 185 * Write value and confirm it reads back as written 186 * (to catch read-only registers and partially read-only 187 * registers where the incoming migration value doesn't match) 188 */ 189 write_raw_cp_reg(&cpu->env, ri, v); 190 if (read_raw_cp_reg(&cpu->env, ri) != v) { 191 ok = false; 192 } 193 } 194 return ok; 195 } 196 197 static void add_cpreg_to_list(gpointer key, gpointer opaque) 198 { 199 ARMCPU *cpu = opaque; 200 uint32_t regidx = (uintptr_t)key; 201 const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 202 203 if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) { 204 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 205 /* The value array need not be initialized at this point */ 206 cpu->cpreg_array_len++; 207 } 208 } 209 210 static void count_cpreg(gpointer key, gpointer opaque) 211 { 212 ARMCPU *cpu = opaque; 213 const ARMCPRegInfo *ri; 214 215 ri = g_hash_table_lookup(cpu->cp_regs, key); 216 217 if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) { 218 cpu->cpreg_array_len++; 219 } 220 } 221 222 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 223 { 224 uint64_t aidx = cpreg_to_kvm_id((uintptr_t)a); 225 uint64_t bidx = cpreg_to_kvm_id((uintptr_t)b); 226 227 if (aidx > bidx) { 228 return 1; 229 } 230 if (aidx < bidx) { 231 return -1; 232 } 233 return 0; 234 } 235 236 void init_cpreg_list(ARMCPU *cpu) 237 { 238 /* 239 * Initialise the cpreg_tuples[] array based on the cp_regs hash. 240 * Note that we require cpreg_tuples[] to be sorted by key ID. 241 */ 242 GList *keys; 243 int arraylen; 244 245 keys = g_hash_table_get_keys(cpu->cp_regs); 246 keys = g_list_sort(keys, cpreg_key_compare); 247 248 cpu->cpreg_array_len = 0; 249 250 g_list_foreach(keys, count_cpreg, cpu); 251 252 arraylen = cpu->cpreg_array_len; 253 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 254 cpu->cpreg_values = g_new(uint64_t, arraylen); 255 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 256 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 257 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 258 cpu->cpreg_array_len = 0; 259 260 g_list_foreach(keys, add_cpreg_to_list, cpu); 261 262 assert(cpu->cpreg_array_len == arraylen); 263 264 g_list_free(keys); 265 } 266 267 static bool arm_pan_enabled(CPUARMState *env) 268 { 269 if (is_a64(env)) { 270 if ((arm_hcr_el2_eff(env) & (HCR_NV | HCR_NV1)) == (HCR_NV | HCR_NV1)) { 271 return false; 272 } 273 return env->pstate & PSTATE_PAN; 274 } else { 275 return env->uncached_cpsr & CPSR_PAN; 276 } 277 } 278 279 /* 280 * Some registers are not accessible from AArch32 EL3 if SCR.NS == 0. 281 */ 282 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 283 const ARMCPRegInfo *ri, 284 bool isread) 285 { 286 if (!is_a64(env) && arm_current_el(env) == 3 && 287 arm_is_secure_below_el3(env)) { 288 return CP_ACCESS_TRAP_UNCATEGORIZED; 289 } 290 return CP_ACCESS_OK; 291 } 292 293 /* 294 * Some secure-only AArch32 registers trap to EL3 if used from 295 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 296 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 297 * We assume that the .access field is set to PL1_RW. 298 */ 299 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 300 const ARMCPRegInfo *ri, 301 bool isread) 302 { 303 if (arm_current_el(env) == 3) { 304 return CP_ACCESS_OK; 305 } 306 if (arm_is_secure_below_el3(env)) { 307 if (env->cp15.scr_el3 & SCR_EEL2) { 308 return CP_ACCESS_TRAP_EL2; 309 } 310 return CP_ACCESS_TRAP_EL3; 311 } 312 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 313 return CP_ACCESS_TRAP_UNCATEGORIZED; 314 } 315 316 /* 317 * Check for traps to performance monitor registers, which are controlled 318 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 319 */ 320 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 321 bool isread) 322 { 323 int el = arm_current_el(env); 324 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 325 326 if (el < 2 && (mdcr_el2 & MDCR_TPM)) { 327 return CP_ACCESS_TRAP_EL2; 328 } 329 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 330 return CP_ACCESS_TRAP_EL3; 331 } 332 return CP_ACCESS_OK; 333 } 334 335 /* Check for traps from EL1 due to HCR_EL2.TVM and HCR_EL2.TRVM. */ 336 CPAccessResult access_tvm_trvm(CPUARMState *env, const ARMCPRegInfo *ri, 337 bool isread) 338 { 339 if (arm_current_el(env) == 1) { 340 uint64_t trap = isread ? HCR_TRVM : HCR_TVM; 341 if (arm_hcr_el2_eff(env) & trap) { 342 return CP_ACCESS_TRAP_EL2; 343 } 344 } 345 return CP_ACCESS_OK; 346 } 347 348 /* Check for traps from EL1 due to HCR_EL2.TSW. */ 349 static CPAccessResult access_tsw(CPUARMState *env, const ARMCPRegInfo *ri, 350 bool isread) 351 { 352 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TSW)) { 353 return CP_ACCESS_TRAP_EL2; 354 } 355 return CP_ACCESS_OK; 356 } 357 358 /* Check for traps from EL1 due to HCR_EL2.TACR. */ 359 static CPAccessResult access_tacr(CPUARMState *env, const ARMCPRegInfo *ri, 360 bool isread) 361 { 362 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TACR)) { 363 return CP_ACCESS_TRAP_EL2; 364 } 365 return CP_ACCESS_OK; 366 } 367 368 /* Check for traps from EL1 due to HCR_EL2.TTLB. */ 369 static CPAccessResult access_ttlb(CPUARMState *env, const ARMCPRegInfo *ri, 370 bool isread) 371 { 372 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TTLB)) { 373 return CP_ACCESS_TRAP_EL2; 374 } 375 return CP_ACCESS_OK; 376 } 377 378 /* Check for traps from EL1 due to HCR_EL2.TTLB or TTLBIS. */ 379 static CPAccessResult access_ttlbis(CPUARMState *env, const ARMCPRegInfo *ri, 380 bool isread) 381 { 382 if (arm_current_el(env) == 1 && 383 (arm_hcr_el2_eff(env) & (HCR_TTLB | HCR_TTLBIS))) { 384 return CP_ACCESS_TRAP_EL2; 385 } 386 return CP_ACCESS_OK; 387 } 388 389 #ifdef TARGET_AARCH64 390 /* Check for traps from EL1 due to HCR_EL2.TTLB or TTLBOS. */ 391 static CPAccessResult access_ttlbos(CPUARMState *env, const ARMCPRegInfo *ri, 392 bool isread) 393 { 394 if (arm_current_el(env) == 1 && 395 (arm_hcr_el2_eff(env) & (HCR_TTLB | HCR_TTLBOS))) { 396 return CP_ACCESS_TRAP_EL2; 397 } 398 return CP_ACCESS_OK; 399 } 400 #endif 401 402 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 403 { 404 ARMCPU *cpu = env_archcpu(env); 405 406 raw_write(env, ri, value); 407 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 408 } 409 410 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 411 { 412 ARMCPU *cpu = env_archcpu(env); 413 414 if (raw_read(env, ri) != value) { 415 /* 416 * Unlike real hardware the qemu TLB uses virtual addresses, 417 * not modified virtual addresses, so this causes a TLB flush. 418 */ 419 tlb_flush(CPU(cpu)); 420 raw_write(env, ri, value); 421 } 422 } 423 424 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 425 uint64_t value) 426 { 427 ARMCPU *cpu = env_archcpu(env); 428 429 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 430 && !extended_addresses_enabled(env)) { 431 /* 432 * For VMSA (when not using the LPAE long descriptor page table 433 * format) this register includes the ASID, so do a TLB flush. 434 * For PMSA it is purely a process ID and no action is needed. 435 */ 436 tlb_flush(CPU(cpu)); 437 } 438 raw_write(env, ri, value); 439 } 440 441 static int alle1_tlbmask(CPUARMState *env) 442 { 443 /* 444 * Note that the 'ALL' scope must invalidate both stage 1 and 445 * stage 2 translations, whereas most other scopes only invalidate 446 * stage 1 translations. 447 * 448 * For AArch32 this is only used for TLBIALLNSNH and VTTBR 449 * writes, so only needs to apply to NS PL1&0, not S PL1&0. 450 */ 451 return (ARMMMUIdxBit_E10_1 | 452 ARMMMUIdxBit_E10_1_PAN | 453 ARMMMUIdxBit_E10_0 | 454 ARMMMUIdxBit_Stage2 | 455 ARMMMUIdxBit_Stage2_S); 456 } 457 458 459 /* IS variants of TLB operations must affect all cores */ 460 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 461 uint64_t value) 462 { 463 CPUState *cs = env_cpu(env); 464 465 tlb_flush_all_cpus_synced(cs); 466 } 467 468 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 469 uint64_t value) 470 { 471 CPUState *cs = env_cpu(env); 472 473 tlb_flush_all_cpus_synced(cs); 474 } 475 476 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 477 uint64_t value) 478 { 479 CPUState *cs = env_cpu(env); 480 481 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 482 } 483 484 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 485 uint64_t value) 486 { 487 CPUState *cs = env_cpu(env); 488 489 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 490 } 491 492 /* 493 * Non-IS variants of TLB operations are upgraded to 494 * IS versions if we are at EL1 and HCR_EL2.FB is effectively set to 495 * force broadcast of these operations. 496 */ 497 static bool tlb_force_broadcast(CPUARMState *env) 498 { 499 return arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_FB); 500 } 501 502 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 503 uint64_t value) 504 { 505 /* Invalidate all (TLBIALL) */ 506 CPUState *cs = env_cpu(env); 507 508 if (tlb_force_broadcast(env)) { 509 tlb_flush_all_cpus_synced(cs); 510 } else { 511 tlb_flush(cs); 512 } 513 } 514 515 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 516 uint64_t value) 517 { 518 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 519 CPUState *cs = env_cpu(env); 520 521 value &= TARGET_PAGE_MASK; 522 if (tlb_force_broadcast(env)) { 523 tlb_flush_page_all_cpus_synced(cs, value); 524 } else { 525 tlb_flush_page(cs, value); 526 } 527 } 528 529 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 530 uint64_t value) 531 { 532 /* Invalidate by ASID (TLBIASID) */ 533 CPUState *cs = env_cpu(env); 534 535 if (tlb_force_broadcast(env)) { 536 tlb_flush_all_cpus_synced(cs); 537 } else { 538 tlb_flush(cs); 539 } 540 } 541 542 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 543 uint64_t value) 544 { 545 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 546 CPUState *cs = env_cpu(env); 547 548 value &= TARGET_PAGE_MASK; 549 if (tlb_force_broadcast(env)) { 550 tlb_flush_page_all_cpus_synced(cs, value); 551 } else { 552 tlb_flush_page(cs, value); 553 } 554 } 555 556 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 557 uint64_t value) 558 { 559 CPUState *cs = env_cpu(env); 560 561 tlb_flush_by_mmuidx(cs, alle1_tlbmask(env)); 562 } 563 564 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 565 uint64_t value) 566 { 567 CPUState *cs = env_cpu(env); 568 569 tlb_flush_by_mmuidx_all_cpus_synced(cs, alle1_tlbmask(env)); 570 } 571 572 573 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 574 uint64_t value) 575 { 576 CPUState *cs = env_cpu(env); 577 578 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2); 579 } 580 581 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 582 uint64_t value) 583 { 584 CPUState *cs = env_cpu(env); 585 586 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E2); 587 } 588 589 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 590 uint64_t value) 591 { 592 CPUState *cs = env_cpu(env); 593 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 594 595 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E2); 596 } 597 598 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 599 uint64_t value) 600 { 601 CPUState *cs = env_cpu(env); 602 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 603 604 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 605 ARMMMUIdxBit_E2); 606 } 607 608 static void tlbiipas2_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 609 uint64_t value) 610 { 611 CPUState *cs = env_cpu(env); 612 uint64_t pageaddr = (value & MAKE_64BIT_MASK(0, 28)) << 12; 613 614 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2); 615 } 616 617 static void tlbiipas2is_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 618 uint64_t value) 619 { 620 CPUState *cs = env_cpu(env); 621 uint64_t pageaddr = (value & MAKE_64BIT_MASK(0, 28)) << 12; 622 623 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, ARMMMUIdxBit_Stage2); 624 } 625 626 static const ARMCPRegInfo cp_reginfo[] = { 627 /* 628 * Define the secure and non-secure FCSE identifier CP registers 629 * separately because there is no secure bank in V8 (no _EL3). This allows 630 * the secure register to be properly reset and migrated. There is also no 631 * v8 EL1 version of the register so the non-secure instance stands alone. 632 */ 633 { .name = "FCSEIDR", 634 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 635 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 636 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 637 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 638 { .name = "FCSEIDR_S", 639 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 640 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 641 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 642 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 643 /* 644 * Define the secure and non-secure context identifier CP registers 645 * separately because there is no secure bank in V8 (no _EL3). This allows 646 * the secure register to be properly reset and migrated. In the 647 * non-secure case, the 32-bit register will have reset and migration 648 * disabled during registration as it is handled by the 64-bit instance. 649 */ 650 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 651 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 652 .access = PL1_RW, .accessfn = access_tvm_trvm, 653 .fgt = FGT_CONTEXTIDR_EL1, 654 .nv2_redirect_offset = 0x108 | NV2_REDIR_NV1, 655 .secure = ARM_CP_SECSTATE_NS, 656 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 657 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 658 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 659 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 660 .access = PL1_RW, .accessfn = access_tvm_trvm, 661 .secure = ARM_CP_SECSTATE_S, 662 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 663 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 664 }; 665 666 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 667 /* 668 * NB: Some of these registers exist in v8 but with more precise 669 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 670 */ 671 /* MMU Domain access control / MPU write buffer control */ 672 { .name = "DACR", 673 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 674 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 675 .writefn = dacr_write, .raw_writefn = raw_write, 676 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 677 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 678 /* 679 * ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 680 * For v6 and v5, these mappings are overly broad. 681 */ 682 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 683 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 684 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 685 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 686 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 687 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 688 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 689 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 690 /* Cache maintenance ops; some of this space may be overridden later. */ 691 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 692 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 693 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 694 }; 695 696 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 697 /* 698 * Not all pre-v6 cores implemented this WFI, so this is slightly 699 * over-broad. 700 */ 701 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 702 .access = PL1_W, .type = ARM_CP_WFI }, 703 }; 704 705 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 706 /* 707 * Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 708 * is UNPREDICTABLE; we choose to NOP as most implementations do). 709 */ 710 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 711 .access = PL1_W, .type = ARM_CP_WFI }, 712 /* 713 * L1 cache lockdown. Not architectural in v6 and earlier but in practice 714 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 715 * OMAPCP will override this space. 716 */ 717 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 718 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 719 .resetvalue = 0 }, 720 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 721 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 722 .resetvalue = 0 }, 723 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 724 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 725 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 726 .resetvalue = 0 }, 727 /* 728 * We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 729 * implementing it as RAZ means the "debug architecture version" bits 730 * will read as a reserved value, which should cause Linux to not try 731 * to use the debug hardware. 732 */ 733 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 734 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 735 /* 736 * MMU TLB control. Note that the wildcarding means we cover not just 737 * the unified TLB ops but also the dside/iside/inner-shareable variants. 738 */ 739 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 740 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 741 .type = ARM_CP_NO_RAW }, 742 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 743 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 744 .type = ARM_CP_NO_RAW }, 745 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 746 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 747 .type = ARM_CP_NO_RAW }, 748 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 749 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 750 .type = ARM_CP_NO_RAW }, 751 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 752 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 753 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 754 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 755 }; 756 757 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 758 uint64_t value) 759 { 760 uint32_t mask = 0; 761 762 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 763 if (!arm_feature(env, ARM_FEATURE_V8)) { 764 /* 765 * ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 766 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 767 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 768 */ 769 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) { 770 /* VFP coprocessor: cp10 & cp11 [23:20] */ 771 mask |= R_CPACR_ASEDIS_MASK | 772 R_CPACR_D32DIS_MASK | 773 R_CPACR_CP11_MASK | 774 R_CPACR_CP10_MASK; 775 776 if (!arm_feature(env, ARM_FEATURE_NEON)) { 777 /* ASEDIS [31] bit is RAO/WI */ 778 value |= R_CPACR_ASEDIS_MASK; 779 } 780 781 /* 782 * VFPv3 and upwards with NEON implement 32 double precision 783 * registers (D0-D31). 784 */ 785 if (!cpu_isar_feature(aa32_simd_r32, env_archcpu(env))) { 786 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 787 value |= R_CPACR_D32DIS_MASK; 788 } 789 } 790 value &= mask; 791 } 792 793 /* 794 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 795 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 796 */ 797 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 798 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 799 mask = R_CPACR_CP11_MASK | R_CPACR_CP10_MASK; 800 value = (value & ~mask) | (env->cp15.cpacr_el1 & mask); 801 } 802 803 env->cp15.cpacr_el1 = value; 804 } 805 806 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri) 807 { 808 /* 809 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 810 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 811 */ 812 uint64_t value = env->cp15.cpacr_el1; 813 814 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 815 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 816 value = ~(R_CPACR_CP11_MASK | R_CPACR_CP10_MASK); 817 } 818 return value; 819 } 820 821 822 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 823 { 824 /* 825 * Call cpacr_write() so that we reset with the correct RAO bits set 826 * for our CPU features. 827 */ 828 cpacr_write(env, ri, 0); 829 } 830 831 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 832 bool isread) 833 { 834 if (arm_feature(env, ARM_FEATURE_V8)) { 835 /* Check if CPACR accesses are to be trapped to EL2 */ 836 if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) && 837 FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TCPAC)) { 838 return CP_ACCESS_TRAP_EL2; 839 /* Check if CPACR accesses are to be trapped to EL3 */ 840 } else if (arm_current_el(env) < 3 && 841 FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) { 842 return CP_ACCESS_TRAP_EL3; 843 } 844 } 845 846 return CP_ACCESS_OK; 847 } 848 849 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 850 bool isread) 851 { 852 /* Check if CPTR accesses are set to trap to EL3 */ 853 if (arm_current_el(env) == 2 && 854 FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) { 855 return CP_ACCESS_TRAP_EL3; 856 } 857 858 return CP_ACCESS_OK; 859 } 860 861 static const ARMCPRegInfo v6_cp_reginfo[] = { 862 /* prefetch by MVA in v6, NOP in v7 */ 863 { .name = "MVA_prefetch", 864 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 865 .access = PL1_W, .type = ARM_CP_NOP }, 866 /* 867 * We need to break the TB after ISB to execute self-modifying code 868 * correctly and also to take any pending interrupts immediately. 869 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 870 */ 871 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 872 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 873 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 874 .access = PL0_W, .type = ARM_CP_NOP }, 875 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 876 .access = PL0_W, .type = ARM_CP_NOP }, 877 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 878 .access = PL1_RW, .accessfn = access_tvm_trvm, 879 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 880 offsetof(CPUARMState, cp15.ifar_ns) }, 881 .resetvalue = 0, }, 882 /* 883 * Watchpoint Fault Address Register : should actually only be present 884 * for 1136, 1176, 11MPCore. 885 */ 886 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 887 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 888 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 889 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 890 .fgt = FGT_CPACR_EL1, 891 .nv2_redirect_offset = 0x100 | NV2_REDIR_NV1, 892 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 893 .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read }, 894 }; 895 896 typedef struct pm_event { 897 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 898 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 899 bool (*supported)(CPUARMState *); 900 /* 901 * Retrieve the current count of the underlying event. The programmed 902 * counters hold a difference from the return value from this function 903 */ 904 uint64_t (*get_count)(CPUARMState *); 905 /* 906 * Return how many nanoseconds it will take (at a minimum) for count events 907 * to occur. A negative value indicates the counter will never overflow, or 908 * that the counter has otherwise arranged for the overflow bit to be set 909 * and the PMU interrupt to be raised on overflow. 910 */ 911 int64_t (*ns_per_count)(uint64_t); 912 } pm_event; 913 914 static bool event_always_supported(CPUARMState *env) 915 { 916 return true; 917 } 918 919 static uint64_t swinc_get_count(CPUARMState *env) 920 { 921 /* 922 * SW_INCR events are written directly to the pmevcntr's by writes to 923 * PMSWINC, so there is no underlying count maintained by the PMU itself 924 */ 925 return 0; 926 } 927 928 static int64_t swinc_ns_per(uint64_t ignored) 929 { 930 return -1; 931 } 932 933 /* 934 * Return the underlying cycle count for the PMU cycle counters. If we're in 935 * usermode, simply return 0. 936 */ 937 static uint64_t cycles_get_count(CPUARMState *env) 938 { 939 #ifndef CONFIG_USER_ONLY 940 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 941 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 942 #else 943 return cpu_get_host_ticks(); 944 #endif 945 } 946 947 #ifndef CONFIG_USER_ONLY 948 static int64_t cycles_ns_per(uint64_t cycles) 949 { 950 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 951 } 952 953 static bool instructions_supported(CPUARMState *env) 954 { 955 /* Precise instruction counting */ 956 return icount_enabled() == ICOUNT_PRECISE; 957 } 958 959 static uint64_t instructions_get_count(CPUARMState *env) 960 { 961 assert(icount_enabled() == ICOUNT_PRECISE); 962 return (uint64_t)icount_get_raw(); 963 } 964 965 static int64_t instructions_ns_per(uint64_t icount) 966 { 967 assert(icount_enabled() == ICOUNT_PRECISE); 968 return icount_to_ns((int64_t)icount); 969 } 970 #endif 971 972 static bool pmuv3p1_events_supported(CPUARMState *env) 973 { 974 /* For events which are supported in any v8.1 PMU */ 975 return cpu_isar_feature(any_pmuv3p1, env_archcpu(env)); 976 } 977 978 static bool pmuv3p4_events_supported(CPUARMState *env) 979 { 980 /* For events which are supported in any v8.1 PMU */ 981 return cpu_isar_feature(any_pmuv3p4, env_archcpu(env)); 982 } 983 984 static uint64_t zero_event_get_count(CPUARMState *env) 985 { 986 /* For events which on QEMU never fire, so their count is always zero */ 987 return 0; 988 } 989 990 static int64_t zero_event_ns_per(uint64_t cycles) 991 { 992 /* An event which never fires can never overflow */ 993 return -1; 994 } 995 996 static const pm_event pm_events[] = { 997 { .number = 0x000, /* SW_INCR */ 998 .supported = event_always_supported, 999 .get_count = swinc_get_count, 1000 .ns_per_count = swinc_ns_per, 1001 }, 1002 #ifndef CONFIG_USER_ONLY 1003 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 1004 .supported = instructions_supported, 1005 .get_count = instructions_get_count, 1006 .ns_per_count = instructions_ns_per, 1007 }, 1008 { .number = 0x011, /* CPU_CYCLES, Cycle */ 1009 .supported = event_always_supported, 1010 .get_count = cycles_get_count, 1011 .ns_per_count = cycles_ns_per, 1012 }, 1013 #endif 1014 { .number = 0x023, /* STALL_FRONTEND */ 1015 .supported = pmuv3p1_events_supported, 1016 .get_count = zero_event_get_count, 1017 .ns_per_count = zero_event_ns_per, 1018 }, 1019 { .number = 0x024, /* STALL_BACKEND */ 1020 .supported = pmuv3p1_events_supported, 1021 .get_count = zero_event_get_count, 1022 .ns_per_count = zero_event_ns_per, 1023 }, 1024 { .number = 0x03c, /* STALL */ 1025 .supported = pmuv3p4_events_supported, 1026 .get_count = zero_event_get_count, 1027 .ns_per_count = zero_event_ns_per, 1028 }, 1029 }; 1030 1031 /* 1032 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1033 * events (i.e. the statistical profiling extension), this implementation 1034 * should first be updated to something sparse instead of the current 1035 * supported_event_map[] array. 1036 */ 1037 #define MAX_EVENT_ID 0x3c 1038 #define UNSUPPORTED_EVENT UINT16_MAX 1039 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1040 1041 /* 1042 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 1043 * of ARM event numbers to indices in our pm_events array. 1044 * 1045 * Note: Events in the 0x40XX range are not currently supported. 1046 */ 1047 void pmu_init(ARMCPU *cpu) 1048 { 1049 unsigned int i; 1050 1051 /* 1052 * Empty supported_event_map and cpu->pmceid[01] before adding supported 1053 * events to them 1054 */ 1055 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1056 supported_event_map[i] = UNSUPPORTED_EVENT; 1057 } 1058 cpu->pmceid0 = 0; 1059 cpu->pmceid1 = 0; 1060 1061 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1062 const pm_event *cnt = &pm_events[i]; 1063 assert(cnt->number <= MAX_EVENT_ID); 1064 /* We do not currently support events in the 0x40xx range */ 1065 assert(cnt->number <= 0x3f); 1066 1067 if (cnt->supported(&cpu->env)) { 1068 supported_event_map[cnt->number] = i; 1069 uint64_t event_mask = 1ULL << (cnt->number & 0x1f); 1070 if (cnt->number & 0x20) { 1071 cpu->pmceid1 |= event_mask; 1072 } else { 1073 cpu->pmceid0 |= event_mask; 1074 } 1075 } 1076 } 1077 } 1078 1079 /* 1080 * Check at runtime whether a PMU event is supported for the current machine 1081 */ 1082 static bool event_supported(uint16_t number) 1083 { 1084 if (number > MAX_EVENT_ID) { 1085 return false; 1086 } 1087 return supported_event_map[number] != UNSUPPORTED_EVENT; 1088 } 1089 1090 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1091 bool isread) 1092 { 1093 /* 1094 * Performance monitor registers user accessibility is controlled 1095 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1096 * trapping to EL2 or EL3 for other accesses. 1097 */ 1098 int el = arm_current_el(env); 1099 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 1100 1101 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1102 return CP_ACCESS_TRAP; 1103 } 1104 if (el < 2 && (mdcr_el2 & MDCR_TPM)) { 1105 return CP_ACCESS_TRAP_EL2; 1106 } 1107 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1108 return CP_ACCESS_TRAP_EL3; 1109 } 1110 1111 return CP_ACCESS_OK; 1112 } 1113 1114 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1115 const ARMCPRegInfo *ri, 1116 bool isread) 1117 { 1118 /* ER: event counter read trap control */ 1119 if (arm_feature(env, ARM_FEATURE_V8) 1120 && arm_current_el(env) == 0 1121 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1122 && isread) { 1123 return CP_ACCESS_OK; 1124 } 1125 1126 return pmreg_access(env, ri, isread); 1127 } 1128 1129 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1130 const ARMCPRegInfo *ri, 1131 bool isread) 1132 { 1133 /* SW: software increment write trap control */ 1134 if (arm_feature(env, ARM_FEATURE_V8) 1135 && arm_current_el(env) == 0 1136 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1137 && !isread) { 1138 return CP_ACCESS_OK; 1139 } 1140 1141 return pmreg_access(env, ri, isread); 1142 } 1143 1144 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1145 const ARMCPRegInfo *ri, 1146 bool isread) 1147 { 1148 /* ER: event counter read trap control */ 1149 if (arm_feature(env, ARM_FEATURE_V8) 1150 && arm_current_el(env) == 0 1151 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1152 return CP_ACCESS_OK; 1153 } 1154 1155 return pmreg_access(env, ri, isread); 1156 } 1157 1158 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1159 const ARMCPRegInfo *ri, 1160 bool isread) 1161 { 1162 /* CR: cycle counter read trap control */ 1163 if (arm_feature(env, ARM_FEATURE_V8) 1164 && arm_current_el(env) == 0 1165 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1166 && isread) { 1167 return CP_ACCESS_OK; 1168 } 1169 1170 return pmreg_access(env, ri, isread); 1171 } 1172 1173 /* 1174 * Bits in MDCR_EL2 and MDCR_EL3 which pmu_counter_enabled() looks at. 1175 * We use these to decide whether we need to wrap a write to MDCR_EL2 1176 * or MDCR_EL3 in pmu_op_start()/pmu_op_finish() calls. 1177 */ 1178 #define MDCR_EL2_PMU_ENABLE_BITS \ 1179 (MDCR_HPME | MDCR_HPMD | MDCR_HPMN | MDCR_HCCD | MDCR_HLP) 1180 #define MDCR_EL3_PMU_ENABLE_BITS (MDCR_SPME | MDCR_SCCD) 1181 1182 /* 1183 * Returns true if the counter (pass 31 for PMCCNTR) should count events using 1184 * the current EL, security state, and register configuration. 1185 */ 1186 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1187 { 1188 uint64_t filter; 1189 bool e, p, u, nsk, nsu, nsh, m; 1190 bool enabled, prohibited = false, filtered; 1191 bool secure = arm_is_secure(env); 1192 int el = arm_current_el(env); 1193 uint64_t mdcr_el2; 1194 uint8_t hpmn; 1195 1196 /* 1197 * We might be called for M-profile cores where MDCR_EL2 doesn't 1198 * exist and arm_mdcr_el2_eff() will assert, so this early-exit check 1199 * must be before we read that value. 1200 */ 1201 if (!arm_feature(env, ARM_FEATURE_PMU)) { 1202 return false; 1203 } 1204 1205 mdcr_el2 = arm_mdcr_el2_eff(env); 1206 hpmn = mdcr_el2 & MDCR_HPMN; 1207 1208 if (!arm_feature(env, ARM_FEATURE_EL2) || 1209 (counter < hpmn || counter == 31)) { 1210 e = env->cp15.c9_pmcr & PMCRE; 1211 } else { 1212 e = mdcr_el2 & MDCR_HPME; 1213 } 1214 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1215 1216 /* Is event counting prohibited? */ 1217 if (el == 2 && (counter < hpmn || counter == 31)) { 1218 prohibited = mdcr_el2 & MDCR_HPMD; 1219 } 1220 if (secure) { 1221 prohibited = prohibited || !(env->cp15.mdcr_el3 & MDCR_SPME); 1222 } 1223 1224 if (counter == 31) { 1225 /* 1226 * The cycle counter defaults to running. PMCR.DP says "disable 1227 * the cycle counter when event counting is prohibited". 1228 * Some MDCR bits disable the cycle counter specifically. 1229 */ 1230 prohibited = prohibited && env->cp15.c9_pmcr & PMCRDP; 1231 if (cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1232 if (secure) { 1233 prohibited = prohibited || (env->cp15.mdcr_el3 & MDCR_SCCD); 1234 } 1235 if (el == 2) { 1236 prohibited = prohibited || (mdcr_el2 & MDCR_HCCD); 1237 } 1238 } 1239 } 1240 1241 if (counter == 31) { 1242 filter = env->cp15.pmccfiltr_el0; 1243 } else { 1244 filter = env->cp15.c14_pmevtyper[counter]; 1245 } 1246 1247 p = filter & PMXEVTYPER_P; 1248 u = filter & PMXEVTYPER_U; 1249 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1250 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1251 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1252 m = arm_el_is_aa64(env, 1) && 1253 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1254 1255 if (el == 0) { 1256 filtered = secure ? u : u != nsu; 1257 } else if (el == 1) { 1258 filtered = secure ? p : p != nsk; 1259 } else if (el == 2) { 1260 filtered = !nsh; 1261 } else { /* EL3 */ 1262 filtered = m != p; 1263 } 1264 1265 if (counter != 31) { 1266 /* 1267 * If not checking PMCCNTR, ensure the counter is setup to an event we 1268 * support 1269 */ 1270 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1271 if (!event_supported(event)) { 1272 return false; 1273 } 1274 } 1275 1276 return enabled && !prohibited && !filtered; 1277 } 1278 1279 static void pmu_update_irq(CPUARMState *env) 1280 { 1281 ARMCPU *cpu = env_archcpu(env); 1282 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1283 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1284 } 1285 1286 static bool pmccntr_clockdiv_enabled(CPUARMState *env) 1287 { 1288 /* 1289 * Return true if the clock divider is enabled and the cycle counter 1290 * is supposed to tick only once every 64 clock cycles. This is 1291 * controlled by PMCR.D, but if PMCR.LC is set to enable the long 1292 * (64-bit) cycle counter PMCR.D has no effect. 1293 */ 1294 return (env->cp15.c9_pmcr & (PMCRD | PMCRLC)) == PMCRD; 1295 } 1296 1297 static bool pmevcntr_is_64_bit(CPUARMState *env, int counter) 1298 { 1299 /* Return true if the specified event counter is configured to be 64 bit */ 1300 1301 /* This isn't intended to be used with the cycle counter */ 1302 assert(counter < 31); 1303 1304 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1305 return false; 1306 } 1307 1308 if (arm_feature(env, ARM_FEATURE_EL2)) { 1309 /* 1310 * MDCR_EL2.HLP still applies even when EL2 is disabled in the 1311 * current security state, so we don't use arm_mdcr_el2_eff() here. 1312 */ 1313 bool hlp = env->cp15.mdcr_el2 & MDCR_HLP; 1314 int hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1315 1316 if (counter >= hpmn) { 1317 return hlp; 1318 } 1319 } 1320 return env->cp15.c9_pmcr & PMCRLP; 1321 } 1322 1323 /* 1324 * Ensure c15_ccnt is the guest-visible count so that operations such as 1325 * enabling/disabling the counter or filtering, modifying the count itself, 1326 * etc. can be done logically. This is essentially a no-op if the counter is 1327 * not enabled at the time of the call. 1328 */ 1329 static void pmccntr_op_start(CPUARMState *env) 1330 { 1331 uint64_t cycles = cycles_get_count(env); 1332 1333 if (pmu_counter_enabled(env, 31)) { 1334 uint64_t eff_cycles = cycles; 1335 if (pmccntr_clockdiv_enabled(env)) { 1336 eff_cycles /= 64; 1337 } 1338 1339 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1340 1341 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1342 1ull << 63 : 1ull << 31; 1343 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1344 env->cp15.c9_pmovsr |= (1ULL << 31); 1345 pmu_update_irq(env); 1346 } 1347 1348 env->cp15.c15_ccnt = new_pmccntr; 1349 } 1350 env->cp15.c15_ccnt_delta = cycles; 1351 } 1352 1353 /* 1354 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1355 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1356 * pmccntr_op_start. 1357 */ 1358 static void pmccntr_op_finish(CPUARMState *env) 1359 { 1360 if (pmu_counter_enabled(env, 31)) { 1361 #ifndef CONFIG_USER_ONLY 1362 /* Calculate when the counter will next overflow */ 1363 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1364 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1365 remaining_cycles = (uint32_t)remaining_cycles; 1366 } 1367 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1368 1369 if (overflow_in > 0) { 1370 int64_t overflow_at; 1371 1372 if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1373 overflow_in, &overflow_at)) { 1374 ARMCPU *cpu = env_archcpu(env); 1375 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1376 } 1377 } 1378 #endif 1379 1380 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1381 if (pmccntr_clockdiv_enabled(env)) { 1382 prev_cycles /= 64; 1383 } 1384 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1385 } 1386 } 1387 1388 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1389 { 1390 1391 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1392 uint64_t count = 0; 1393 if (event_supported(event)) { 1394 uint16_t event_idx = supported_event_map[event]; 1395 count = pm_events[event_idx].get_count(env); 1396 } 1397 1398 if (pmu_counter_enabled(env, counter)) { 1399 uint64_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1400 uint64_t overflow_mask = pmevcntr_is_64_bit(env, counter) ? 1401 1ULL << 63 : 1ULL << 31; 1402 1403 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & overflow_mask) { 1404 env->cp15.c9_pmovsr |= (1 << counter); 1405 pmu_update_irq(env); 1406 } 1407 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1408 } 1409 env->cp15.c14_pmevcntr_delta[counter] = count; 1410 } 1411 1412 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1413 { 1414 if (pmu_counter_enabled(env, counter)) { 1415 #ifndef CONFIG_USER_ONLY 1416 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1417 uint16_t event_idx = supported_event_map[event]; 1418 uint64_t delta = -(env->cp15.c14_pmevcntr[counter] + 1); 1419 int64_t overflow_in; 1420 1421 if (!pmevcntr_is_64_bit(env, counter)) { 1422 delta = (uint32_t)delta; 1423 } 1424 overflow_in = pm_events[event_idx].ns_per_count(delta); 1425 1426 if (overflow_in > 0) { 1427 int64_t overflow_at; 1428 1429 if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1430 overflow_in, &overflow_at)) { 1431 ARMCPU *cpu = env_archcpu(env); 1432 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1433 } 1434 } 1435 #endif 1436 1437 env->cp15.c14_pmevcntr_delta[counter] -= 1438 env->cp15.c14_pmevcntr[counter]; 1439 } 1440 } 1441 1442 void pmu_op_start(CPUARMState *env) 1443 { 1444 unsigned int i; 1445 pmccntr_op_start(env); 1446 for (i = 0; i < pmu_num_counters(env); i++) { 1447 pmevcntr_op_start(env, i); 1448 } 1449 } 1450 1451 void pmu_op_finish(CPUARMState *env) 1452 { 1453 unsigned int i; 1454 pmccntr_op_finish(env); 1455 for (i = 0; i < pmu_num_counters(env); i++) { 1456 pmevcntr_op_finish(env, i); 1457 } 1458 } 1459 1460 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1461 { 1462 pmu_op_start(&cpu->env); 1463 } 1464 1465 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1466 { 1467 pmu_op_finish(&cpu->env); 1468 } 1469 1470 void arm_pmu_timer_cb(void *opaque) 1471 { 1472 ARMCPU *cpu = opaque; 1473 1474 /* 1475 * Update all the counter values based on the current underlying counts, 1476 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1477 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1478 * counter may expire. 1479 */ 1480 pmu_op_start(&cpu->env); 1481 pmu_op_finish(&cpu->env); 1482 } 1483 1484 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1485 uint64_t value) 1486 { 1487 pmu_op_start(env); 1488 1489 if (value & PMCRC) { 1490 /* The counter has been reset */ 1491 env->cp15.c15_ccnt = 0; 1492 } 1493 1494 if (value & PMCRP) { 1495 unsigned int i; 1496 for (i = 0; i < pmu_num_counters(env); i++) { 1497 env->cp15.c14_pmevcntr[i] = 0; 1498 } 1499 } 1500 1501 env->cp15.c9_pmcr &= ~PMCR_WRITABLE_MASK; 1502 env->cp15.c9_pmcr |= (value & PMCR_WRITABLE_MASK); 1503 1504 pmu_op_finish(env); 1505 } 1506 1507 static uint64_t pmcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1508 { 1509 uint64_t pmcr = env->cp15.c9_pmcr; 1510 1511 /* 1512 * If EL2 is implemented and enabled for the current security state, reads 1513 * of PMCR.N from EL1 or EL0 return the value of MDCR_EL2.HPMN or HDCR.HPMN. 1514 */ 1515 if (arm_current_el(env) <= 1 && arm_is_el2_enabled(env)) { 1516 pmcr &= ~PMCRN_MASK; 1517 pmcr |= (env->cp15.mdcr_el2 & MDCR_HPMN) << PMCRN_SHIFT; 1518 } 1519 1520 return pmcr; 1521 } 1522 1523 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1524 uint64_t value) 1525 { 1526 unsigned int i; 1527 uint64_t overflow_mask, new_pmswinc; 1528 1529 for (i = 0; i < pmu_num_counters(env); i++) { 1530 /* Increment a counter's count iff: */ 1531 if ((value & (1 << i)) && /* counter's bit is set */ 1532 /* counter is enabled and not filtered */ 1533 pmu_counter_enabled(env, i) && 1534 /* counter is SW_INCR */ 1535 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1536 pmevcntr_op_start(env, i); 1537 1538 /* 1539 * Detect if this write causes an overflow since we can't predict 1540 * PMSWINC overflows like we can for other events 1541 */ 1542 new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1543 1544 overflow_mask = pmevcntr_is_64_bit(env, i) ? 1545 1ULL << 63 : 1ULL << 31; 1546 1547 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & overflow_mask) { 1548 env->cp15.c9_pmovsr |= (1 << i); 1549 pmu_update_irq(env); 1550 } 1551 1552 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1553 1554 pmevcntr_op_finish(env, i); 1555 } 1556 } 1557 } 1558 1559 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1560 { 1561 uint64_t ret; 1562 pmccntr_op_start(env); 1563 ret = env->cp15.c15_ccnt; 1564 pmccntr_op_finish(env); 1565 return ret; 1566 } 1567 1568 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1569 uint64_t value) 1570 { 1571 /* 1572 * The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1573 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1574 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1575 * accessed. 1576 */ 1577 env->cp15.c9_pmselr = value & 0x1f; 1578 } 1579 1580 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1581 uint64_t value) 1582 { 1583 pmccntr_op_start(env); 1584 env->cp15.c15_ccnt = value; 1585 pmccntr_op_finish(env); 1586 } 1587 1588 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1589 uint64_t value) 1590 { 1591 uint64_t cur_val = pmccntr_read(env, NULL); 1592 1593 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1594 } 1595 1596 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1597 uint64_t value) 1598 { 1599 pmccntr_op_start(env); 1600 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1601 pmccntr_op_finish(env); 1602 } 1603 1604 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1605 uint64_t value) 1606 { 1607 pmccntr_op_start(env); 1608 /* M is not accessible from AArch32 */ 1609 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1610 (value & PMCCFILTR); 1611 pmccntr_op_finish(env); 1612 } 1613 1614 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1615 { 1616 /* M is not visible in AArch32 */ 1617 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1618 } 1619 1620 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1621 uint64_t value) 1622 { 1623 pmu_op_start(env); 1624 value &= pmu_counter_mask(env); 1625 env->cp15.c9_pmcnten |= value; 1626 pmu_op_finish(env); 1627 } 1628 1629 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1630 uint64_t value) 1631 { 1632 pmu_op_start(env); 1633 value &= pmu_counter_mask(env); 1634 env->cp15.c9_pmcnten &= ~value; 1635 pmu_op_finish(env); 1636 } 1637 1638 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1639 uint64_t value) 1640 { 1641 value &= pmu_counter_mask(env); 1642 env->cp15.c9_pmovsr &= ~value; 1643 pmu_update_irq(env); 1644 } 1645 1646 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1647 uint64_t value) 1648 { 1649 value &= pmu_counter_mask(env); 1650 env->cp15.c9_pmovsr |= value; 1651 pmu_update_irq(env); 1652 } 1653 1654 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1655 uint64_t value, const uint8_t counter) 1656 { 1657 if (counter == 31) { 1658 pmccfiltr_write(env, ri, value); 1659 } else if (counter < pmu_num_counters(env)) { 1660 pmevcntr_op_start(env, counter); 1661 1662 /* 1663 * If this counter's event type is changing, store the current 1664 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1665 * pmevcntr_op_finish has the correct baseline when it converts back to 1666 * a delta. 1667 */ 1668 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1669 PMXEVTYPER_EVTCOUNT; 1670 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1671 if (old_event != new_event) { 1672 uint64_t count = 0; 1673 if (event_supported(new_event)) { 1674 uint16_t event_idx = supported_event_map[new_event]; 1675 count = pm_events[event_idx].get_count(env); 1676 } 1677 env->cp15.c14_pmevcntr_delta[counter] = count; 1678 } 1679 1680 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1681 pmevcntr_op_finish(env, counter); 1682 } 1683 /* 1684 * Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1685 * PMSELR value is equal to or greater than the number of implemented 1686 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1687 */ 1688 } 1689 1690 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1691 const uint8_t counter) 1692 { 1693 if (counter == 31) { 1694 return env->cp15.pmccfiltr_el0; 1695 } else if (counter < pmu_num_counters(env)) { 1696 return env->cp15.c14_pmevtyper[counter]; 1697 } else { 1698 /* 1699 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1700 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1701 */ 1702 return 0; 1703 } 1704 } 1705 1706 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1707 uint64_t value) 1708 { 1709 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1710 pmevtyper_write(env, ri, value, counter); 1711 } 1712 1713 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1714 uint64_t value) 1715 { 1716 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1717 env->cp15.c14_pmevtyper[counter] = value; 1718 1719 /* 1720 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1721 * pmu_op_finish calls when loading saved state for a migration. Because 1722 * we're potentially updating the type of event here, the value written to 1723 * c14_pmevcntr_delta by the preceding pmu_op_start call may be for a 1724 * different counter type. Therefore, we need to set this value to the 1725 * current count for the counter type we're writing so that pmu_op_finish 1726 * has the correct count for its calculation. 1727 */ 1728 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1729 if (event_supported(event)) { 1730 uint16_t event_idx = supported_event_map[event]; 1731 env->cp15.c14_pmevcntr_delta[counter] = 1732 pm_events[event_idx].get_count(env); 1733 } 1734 } 1735 1736 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1737 { 1738 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1739 return pmevtyper_read(env, ri, counter); 1740 } 1741 1742 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1743 uint64_t value) 1744 { 1745 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1746 } 1747 1748 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1749 { 1750 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1751 } 1752 1753 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1754 uint64_t value, uint8_t counter) 1755 { 1756 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1757 /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */ 1758 value &= MAKE_64BIT_MASK(0, 32); 1759 } 1760 if (counter < pmu_num_counters(env)) { 1761 pmevcntr_op_start(env, counter); 1762 env->cp15.c14_pmevcntr[counter] = value; 1763 pmevcntr_op_finish(env, counter); 1764 } 1765 /* 1766 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1767 * are CONSTRAINED UNPREDICTABLE. 1768 */ 1769 } 1770 1771 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1772 uint8_t counter) 1773 { 1774 if (counter < pmu_num_counters(env)) { 1775 uint64_t ret; 1776 pmevcntr_op_start(env, counter); 1777 ret = env->cp15.c14_pmevcntr[counter]; 1778 pmevcntr_op_finish(env, counter); 1779 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1780 /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */ 1781 ret &= MAKE_64BIT_MASK(0, 32); 1782 } 1783 return ret; 1784 } else { 1785 /* 1786 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1787 * are CONSTRAINED UNPREDICTABLE. 1788 */ 1789 return 0; 1790 } 1791 } 1792 1793 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1794 uint64_t value) 1795 { 1796 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1797 pmevcntr_write(env, ri, value, counter); 1798 } 1799 1800 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1801 { 1802 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1803 return pmevcntr_read(env, ri, counter); 1804 } 1805 1806 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1807 uint64_t value) 1808 { 1809 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1810 assert(counter < pmu_num_counters(env)); 1811 env->cp15.c14_pmevcntr[counter] = value; 1812 pmevcntr_write(env, ri, value, counter); 1813 } 1814 1815 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1816 { 1817 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1818 assert(counter < pmu_num_counters(env)); 1819 return env->cp15.c14_pmevcntr[counter]; 1820 } 1821 1822 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1823 uint64_t value) 1824 { 1825 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1826 } 1827 1828 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1829 { 1830 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1831 } 1832 1833 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1834 uint64_t value) 1835 { 1836 if (arm_feature(env, ARM_FEATURE_V8)) { 1837 env->cp15.c9_pmuserenr = value & 0xf; 1838 } else { 1839 env->cp15.c9_pmuserenr = value & 1; 1840 } 1841 } 1842 1843 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1844 uint64_t value) 1845 { 1846 /* We have no event counters so only the C bit can be changed */ 1847 value &= pmu_counter_mask(env); 1848 env->cp15.c9_pminten |= value; 1849 pmu_update_irq(env); 1850 } 1851 1852 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1853 uint64_t value) 1854 { 1855 value &= pmu_counter_mask(env); 1856 env->cp15.c9_pminten &= ~value; 1857 pmu_update_irq(env); 1858 } 1859 1860 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1861 uint64_t value) 1862 { 1863 /* 1864 * Note that even though the AArch64 view of this register has bits 1865 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1866 * architectural requirements for bits which are RES0 only in some 1867 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1868 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1869 */ 1870 raw_write(env, ri, value & ~0x1FULL); 1871 } 1872 1873 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1874 { 1875 /* Begin with base v8.0 state. */ 1876 uint64_t valid_mask = 0x3fff; 1877 ARMCPU *cpu = env_archcpu(env); 1878 uint64_t changed; 1879 1880 /* 1881 * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always 1882 * passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64. 1883 * Instead, choose the format based on the mode of EL3. 1884 */ 1885 if (arm_el_is_aa64(env, 3)) { 1886 value |= SCR_FW | SCR_AW; /* RES1 */ 1887 valid_mask &= ~SCR_NET; /* RES0 */ 1888 1889 if (!cpu_isar_feature(aa64_aa32_el1, cpu) && 1890 !cpu_isar_feature(aa64_aa32_el2, cpu)) { 1891 value |= SCR_RW; /* RAO/WI */ 1892 } 1893 if (cpu_isar_feature(aa64_ras, cpu)) { 1894 valid_mask |= SCR_TERR; 1895 } 1896 if (cpu_isar_feature(aa64_lor, cpu)) { 1897 valid_mask |= SCR_TLOR; 1898 } 1899 if (cpu_isar_feature(aa64_pauth, cpu)) { 1900 valid_mask |= SCR_API | SCR_APK; 1901 } 1902 if (cpu_isar_feature(aa64_sel2, cpu)) { 1903 valid_mask |= SCR_EEL2; 1904 } else if (cpu_isar_feature(aa64_rme, cpu)) { 1905 /* With RME and without SEL2, NS is RES1 (R_GSWWH, I_DJJQJ). */ 1906 value |= SCR_NS; 1907 } 1908 if (cpu_isar_feature(aa64_mte, cpu)) { 1909 valid_mask |= SCR_ATA; 1910 } 1911 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 1912 valid_mask |= SCR_ENSCXT; 1913 } 1914 if (cpu_isar_feature(aa64_doublefault, cpu)) { 1915 valid_mask |= SCR_EASE | SCR_NMEA; 1916 } 1917 if (cpu_isar_feature(aa64_sme, cpu)) { 1918 valid_mask |= SCR_ENTP2; 1919 } 1920 if (cpu_isar_feature(aa64_hcx, cpu)) { 1921 valid_mask |= SCR_HXEN; 1922 } 1923 if (cpu_isar_feature(aa64_fgt, cpu)) { 1924 valid_mask |= SCR_FGTEN; 1925 } 1926 if (cpu_isar_feature(aa64_rme, cpu)) { 1927 valid_mask |= SCR_NSE | SCR_GPF; 1928 } 1929 if (cpu_isar_feature(aa64_ecv, cpu)) { 1930 valid_mask |= SCR_ECVEN; 1931 } 1932 } else { 1933 valid_mask &= ~(SCR_RW | SCR_ST); 1934 if (cpu_isar_feature(aa32_ras, cpu)) { 1935 valid_mask |= SCR_TERR; 1936 } 1937 } 1938 1939 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1940 valid_mask &= ~SCR_HCE; 1941 1942 /* 1943 * On ARMv7, SMD (or SCD as it is called in v7) is only 1944 * supported if EL2 exists. The bit is UNK/SBZP when 1945 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1946 * when EL2 is unavailable. 1947 * On ARMv8, this bit is always available. 1948 */ 1949 if (arm_feature(env, ARM_FEATURE_V7) && 1950 !arm_feature(env, ARM_FEATURE_V8)) { 1951 valid_mask &= ~SCR_SMD; 1952 } 1953 } 1954 1955 /* Clear all-context RES0 bits. */ 1956 value &= valid_mask; 1957 changed = env->cp15.scr_el3 ^ value; 1958 env->cp15.scr_el3 = value; 1959 1960 /* 1961 * If SCR_EL3.{NS,NSE} changes, i.e. change of security state, 1962 * we must invalidate all TLBs below EL3. 1963 */ 1964 if (changed & (SCR_NS | SCR_NSE)) { 1965 tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 | 1966 ARMMMUIdxBit_E20_0 | 1967 ARMMMUIdxBit_E10_1 | 1968 ARMMMUIdxBit_E20_2 | 1969 ARMMMUIdxBit_E10_1_PAN | 1970 ARMMMUIdxBit_E20_2_PAN | 1971 ARMMMUIdxBit_E2)); 1972 } 1973 } 1974 1975 static void scr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 1976 { 1977 /* 1978 * scr_write will set the RES1 bits on an AArch64-only CPU. 1979 * The reset value will be 0x30 on an AArch64-only CPU and 0 otherwise. 1980 */ 1981 scr_write(env, ri, 0); 1982 } 1983 1984 static CPAccessResult access_tid4(CPUARMState *env, 1985 const ARMCPRegInfo *ri, 1986 bool isread) 1987 { 1988 if (arm_current_el(env) == 1 && 1989 (arm_hcr_el2_eff(env) & (HCR_TID2 | HCR_TID4))) { 1990 return CP_ACCESS_TRAP_EL2; 1991 } 1992 1993 return CP_ACCESS_OK; 1994 } 1995 1996 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1997 { 1998 ARMCPU *cpu = env_archcpu(env); 1999 2000 /* 2001 * Acquire the CSSELR index from the bank corresponding to the CCSIDR 2002 * bank 2003 */ 2004 uint32_t index = A32_BANKED_REG_GET(env, csselr, 2005 ri->secure & ARM_CP_SECSTATE_S); 2006 2007 return cpu->ccsidr[index]; 2008 } 2009 2010 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2011 uint64_t value) 2012 { 2013 raw_write(env, ri, value & 0xf); 2014 } 2015 2016 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 2017 { 2018 CPUState *cs = env_cpu(env); 2019 bool el1 = arm_current_el(env) == 1; 2020 uint64_t hcr_el2 = el1 ? arm_hcr_el2_eff(env) : 0; 2021 uint64_t ret = 0; 2022 2023 if (hcr_el2 & HCR_IMO) { 2024 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 2025 ret |= CPSR_I; 2026 } 2027 if (cs->interrupt_request & CPU_INTERRUPT_VINMI) { 2028 ret |= ISR_IS; 2029 ret |= CPSR_I; 2030 } 2031 } else { 2032 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 2033 ret |= CPSR_I; 2034 } 2035 2036 if (cs->interrupt_request & CPU_INTERRUPT_NMI) { 2037 ret |= ISR_IS; 2038 ret |= CPSR_I; 2039 } 2040 } 2041 2042 if (hcr_el2 & HCR_FMO) { 2043 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 2044 ret |= CPSR_F; 2045 } 2046 if (cs->interrupt_request & CPU_INTERRUPT_VFNMI) { 2047 ret |= ISR_FS; 2048 ret |= CPSR_F; 2049 } 2050 } else { 2051 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 2052 ret |= CPSR_F; 2053 } 2054 } 2055 2056 if (hcr_el2 & HCR_AMO) { 2057 if (cs->interrupt_request & CPU_INTERRUPT_VSERR) { 2058 ret |= CPSR_A; 2059 } 2060 } 2061 2062 return ret; 2063 } 2064 2065 static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 2066 bool isread) 2067 { 2068 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) { 2069 return CP_ACCESS_TRAP_EL2; 2070 } 2071 2072 return CP_ACCESS_OK; 2073 } 2074 2075 static CPAccessResult access_aa32_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 2076 bool isread) 2077 { 2078 if (arm_feature(env, ARM_FEATURE_V8)) { 2079 return access_aa64_tid1(env, ri, isread); 2080 } 2081 2082 return CP_ACCESS_OK; 2083 } 2084 2085 static const ARMCPRegInfo v7_cp_reginfo[] = { 2086 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 2087 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 2088 .access = PL1_W, .type = ARM_CP_NOP }, 2089 /* 2090 * Performance monitors are implementation defined in v7, 2091 * but with an ARM recommended set of registers, which we 2092 * follow. 2093 * 2094 * Performance registers fall into three categories: 2095 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 2096 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 2097 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 2098 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 2099 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 2100 */ 2101 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 2102 .access = PL0_RW, .type = ARM_CP_ALIAS | ARM_CP_IO, 2103 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 2104 .writefn = pmcntenset_write, 2105 .accessfn = pmreg_access, 2106 .fgt = FGT_PMCNTEN, 2107 .raw_writefn = raw_write }, 2108 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, .type = ARM_CP_IO, 2109 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 2110 .access = PL0_RW, .accessfn = pmreg_access, 2111 .fgt = FGT_PMCNTEN, 2112 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 2113 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 2114 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 2115 .access = PL0_RW, 2116 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 2117 .accessfn = pmreg_access, 2118 .fgt = FGT_PMCNTEN, 2119 .writefn = pmcntenclr_write, 2120 .type = ARM_CP_ALIAS | ARM_CP_IO }, 2121 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 2122 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 2123 .access = PL0_RW, .accessfn = pmreg_access, 2124 .fgt = FGT_PMCNTEN, 2125 .type = ARM_CP_ALIAS | ARM_CP_IO, 2126 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 2127 .writefn = pmcntenclr_write }, 2128 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 2129 .access = PL0_RW, .type = ARM_CP_IO, 2130 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2131 .accessfn = pmreg_access, 2132 .fgt = FGT_PMOVS, 2133 .writefn = pmovsr_write, 2134 .raw_writefn = raw_write }, 2135 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 2136 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 2137 .access = PL0_RW, .accessfn = pmreg_access, 2138 .fgt = FGT_PMOVS, 2139 .type = ARM_CP_ALIAS | ARM_CP_IO, 2140 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2141 .writefn = pmovsr_write, 2142 .raw_writefn = raw_write }, 2143 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 2144 .access = PL0_W, .accessfn = pmreg_access_swinc, 2145 .fgt = FGT_PMSWINC_EL0, 2146 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2147 .writefn = pmswinc_write }, 2148 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 2149 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 2150 .access = PL0_W, .accessfn = pmreg_access_swinc, 2151 .fgt = FGT_PMSWINC_EL0, 2152 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2153 .writefn = pmswinc_write }, 2154 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 2155 .access = PL0_RW, .type = ARM_CP_ALIAS, 2156 .fgt = FGT_PMSELR_EL0, 2157 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 2158 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 2159 .raw_writefn = raw_write}, 2160 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 2161 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 2162 .access = PL0_RW, .accessfn = pmreg_access_selr, 2163 .fgt = FGT_PMSELR_EL0, 2164 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 2165 .writefn = pmselr_write, .raw_writefn = raw_write, }, 2166 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 2167 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 2168 .fgt = FGT_PMCCNTR_EL0, 2169 .readfn = pmccntr_read, .writefn = pmccntr_write32, 2170 .accessfn = pmreg_access_ccntr }, 2171 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 2172 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 2173 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 2174 .fgt = FGT_PMCCNTR_EL0, 2175 .type = ARM_CP_IO, 2176 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 2177 .readfn = pmccntr_read, .writefn = pmccntr_write, 2178 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 2179 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 2180 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 2181 .access = PL0_RW, .accessfn = pmreg_access, 2182 .fgt = FGT_PMCCFILTR_EL0, 2183 .type = ARM_CP_ALIAS | ARM_CP_IO, 2184 .resetvalue = 0, }, 2185 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 2186 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 2187 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 2188 .access = PL0_RW, .accessfn = pmreg_access, 2189 .fgt = FGT_PMCCFILTR_EL0, 2190 .type = ARM_CP_IO, 2191 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 2192 .resetvalue = 0, }, 2193 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 2194 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2195 .accessfn = pmreg_access, 2196 .fgt = FGT_PMEVTYPERN_EL0, 2197 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2198 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 2199 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 2200 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2201 .accessfn = pmreg_access, 2202 .fgt = FGT_PMEVTYPERN_EL0, 2203 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2204 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 2205 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2206 .accessfn = pmreg_access_xevcntr, 2207 .fgt = FGT_PMEVCNTRN_EL0, 2208 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2209 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 2210 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 2211 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2212 .accessfn = pmreg_access_xevcntr, 2213 .fgt = FGT_PMEVCNTRN_EL0, 2214 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2215 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2216 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2217 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2218 .resetvalue = 0, 2219 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2220 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2221 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2222 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2223 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2224 .resetvalue = 0, 2225 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2226 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2227 .access = PL1_RW, .accessfn = access_tpm, 2228 .fgt = FGT_PMINTEN, 2229 .type = ARM_CP_ALIAS | ARM_CP_IO, 2230 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2231 .resetvalue = 0, 2232 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2233 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2234 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2235 .access = PL1_RW, .accessfn = access_tpm, 2236 .fgt = FGT_PMINTEN, 2237 .type = ARM_CP_IO, 2238 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2239 .writefn = pmintenset_write, .raw_writefn = raw_write, 2240 .resetvalue = 0x0 }, 2241 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2242 .access = PL1_RW, .accessfn = access_tpm, 2243 .fgt = FGT_PMINTEN, 2244 .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW, 2245 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2246 .writefn = pmintenclr_write, }, 2247 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2248 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2249 .access = PL1_RW, .accessfn = access_tpm, 2250 .fgt = FGT_PMINTEN, 2251 .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW, 2252 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2253 .writefn = pmintenclr_write }, 2254 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2255 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2256 .access = PL1_R, 2257 .accessfn = access_tid4, 2258 .fgt = FGT_CCSIDR_EL1, 2259 .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2260 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2261 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2262 .access = PL1_RW, 2263 .accessfn = access_tid4, 2264 .fgt = FGT_CSSELR_EL1, 2265 .writefn = csselr_write, .resetvalue = 0, 2266 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2267 offsetof(CPUARMState, cp15.csselr_ns) } }, 2268 /* 2269 * Auxiliary ID register: this actually has an IMPDEF value but for now 2270 * just RAZ for all cores: 2271 */ 2272 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2273 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2274 .access = PL1_R, .type = ARM_CP_CONST, 2275 .accessfn = access_aa64_tid1, 2276 .fgt = FGT_AIDR_EL1, 2277 .resetvalue = 0 }, 2278 /* 2279 * Auxiliary fault status registers: these also are IMPDEF, and we 2280 * choose to RAZ/WI for all cores. 2281 */ 2282 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2283 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2284 .access = PL1_RW, .accessfn = access_tvm_trvm, 2285 .fgt = FGT_AFSR0_EL1, 2286 .nv2_redirect_offset = 0x128 | NV2_REDIR_NV1, 2287 .type = ARM_CP_CONST, .resetvalue = 0 }, 2288 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2289 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2290 .access = PL1_RW, .accessfn = access_tvm_trvm, 2291 .fgt = FGT_AFSR1_EL1, 2292 .nv2_redirect_offset = 0x130 | NV2_REDIR_NV1, 2293 .type = ARM_CP_CONST, .resetvalue = 0 }, 2294 /* 2295 * MAIR can just read-as-written because we don't implement caches 2296 * and so don't need to care about memory attributes. 2297 */ 2298 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2299 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2300 .access = PL1_RW, .accessfn = access_tvm_trvm, 2301 .fgt = FGT_MAIR_EL1, 2302 .nv2_redirect_offset = 0x140 | NV2_REDIR_NV1, 2303 .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2304 .resetvalue = 0 }, 2305 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2306 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2307 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2308 .resetvalue = 0 }, 2309 /* 2310 * For non-long-descriptor page tables these are PRRR and NMRR; 2311 * regardless they still act as reads-as-written for QEMU. 2312 */ 2313 /* 2314 * MAIR0/1 are defined separately from their 64-bit counterpart which 2315 * allows them to assign the correct fieldoffset based on the endianness 2316 * handled in the field definitions. 2317 */ 2318 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2319 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2320 .access = PL1_RW, .accessfn = access_tvm_trvm, 2321 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2322 offsetof(CPUARMState, cp15.mair0_ns) }, 2323 .resetfn = arm_cp_reset_ignore }, 2324 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2325 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, 2326 .access = PL1_RW, .accessfn = access_tvm_trvm, 2327 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2328 offsetof(CPUARMState, cp15.mair1_ns) }, 2329 .resetfn = arm_cp_reset_ignore }, 2330 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2331 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2332 .fgt = FGT_ISR_EL1, 2333 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2334 /* 32 bit ITLB invalidates */ 2335 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2336 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2337 .writefn = tlbiall_write }, 2338 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2339 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2340 .writefn = tlbimva_write }, 2341 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2342 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2343 .writefn = tlbiasid_write }, 2344 /* 32 bit DTLB invalidates */ 2345 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2346 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2347 .writefn = tlbiall_write }, 2348 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2349 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2350 .writefn = tlbimva_write }, 2351 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2352 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2353 .writefn = tlbiasid_write }, 2354 /* 32 bit TLB invalidates */ 2355 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2356 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2357 .writefn = tlbiall_write }, 2358 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2359 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2360 .writefn = tlbimva_write }, 2361 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2362 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2363 .writefn = tlbiasid_write }, 2364 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2365 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2366 .writefn = tlbimvaa_write }, 2367 }; 2368 2369 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2370 /* 32 bit TLB invalidates, Inner Shareable */ 2371 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2372 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 2373 .writefn = tlbiall_is_write }, 2374 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2375 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 2376 .writefn = tlbimva_is_write }, 2377 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2378 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 2379 .writefn = tlbiasid_is_write }, 2380 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2381 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 2382 .writefn = tlbimvaa_is_write }, 2383 }; 2384 2385 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2386 /* PMOVSSET is not implemented in v7 before v7ve */ 2387 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2388 .access = PL0_RW, .accessfn = pmreg_access, 2389 .fgt = FGT_PMOVS, 2390 .type = ARM_CP_ALIAS | ARM_CP_IO, 2391 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2392 .writefn = pmovsset_write, 2393 .raw_writefn = raw_write }, 2394 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2395 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2396 .access = PL0_RW, .accessfn = pmreg_access, 2397 .fgt = FGT_PMOVS, 2398 .type = ARM_CP_ALIAS | ARM_CP_IO, 2399 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2400 .writefn = pmovsset_write, 2401 .raw_writefn = raw_write }, 2402 }; 2403 2404 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2405 uint64_t value) 2406 { 2407 value &= 1; 2408 env->teecr = value; 2409 } 2410 2411 static CPAccessResult teecr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2412 bool isread) 2413 { 2414 /* 2415 * HSTR.TTEE only exists in v7A, not v8A, but v8A doesn't have T2EE 2416 * at all, so we don't need to check whether we're v8A. 2417 */ 2418 if (arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) && 2419 (env->cp15.hstr_el2 & HSTR_TTEE)) { 2420 return CP_ACCESS_TRAP_EL2; 2421 } 2422 return CP_ACCESS_OK; 2423 } 2424 2425 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2426 bool isread) 2427 { 2428 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2429 return CP_ACCESS_TRAP; 2430 } 2431 return teecr_access(env, ri, isread); 2432 } 2433 2434 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2435 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2436 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2437 .resetvalue = 0, 2438 .writefn = teecr_write, .accessfn = teecr_access }, 2439 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2440 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2441 .accessfn = teehbr_access, .resetvalue = 0 }, 2442 }; 2443 2444 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2445 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2446 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2447 .access = PL0_RW, 2448 .fgt = FGT_TPIDR_EL0, 2449 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2450 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2451 .access = PL0_RW, 2452 .fgt = FGT_TPIDR_EL0, 2453 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2454 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2455 .resetfn = arm_cp_reset_ignore }, 2456 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2457 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2458 .access = PL0_R | PL1_W, 2459 .fgt = FGT_TPIDRRO_EL0, 2460 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2461 .resetvalue = 0}, 2462 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2463 .access = PL0_R | PL1_W, 2464 .fgt = FGT_TPIDRRO_EL0, 2465 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2466 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2467 .resetfn = arm_cp_reset_ignore }, 2468 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2469 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2470 .access = PL1_RW, 2471 .fgt = FGT_TPIDR_EL1, 2472 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2473 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2474 .access = PL1_RW, 2475 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2476 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2477 .resetvalue = 0 }, 2478 }; 2479 2480 static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque) 2481 { 2482 ARMCPU *cpu = env_archcpu(env); 2483 2484 cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz; 2485 } 2486 2487 #ifndef CONFIG_USER_ONLY 2488 2489 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2490 bool isread) 2491 { 2492 /* 2493 * CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2494 * Writable only at the highest implemented exception level. 2495 */ 2496 int el = arm_current_el(env); 2497 uint64_t hcr; 2498 uint32_t cntkctl; 2499 2500 switch (el) { 2501 case 0: 2502 hcr = arm_hcr_el2_eff(env); 2503 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2504 cntkctl = env->cp15.cnthctl_el2; 2505 } else { 2506 cntkctl = env->cp15.c14_cntkctl; 2507 } 2508 if (!extract32(cntkctl, 0, 2)) { 2509 return CP_ACCESS_TRAP; 2510 } 2511 break; 2512 case 1: 2513 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2514 arm_is_secure_below_el3(env)) { 2515 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2516 return CP_ACCESS_TRAP_UNCATEGORIZED; 2517 } 2518 break; 2519 case 2: 2520 case 3: 2521 break; 2522 } 2523 2524 if (!isread && el < arm_highest_el(env)) { 2525 return CP_ACCESS_TRAP_UNCATEGORIZED; 2526 } 2527 2528 return CP_ACCESS_OK; 2529 } 2530 2531 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2532 bool isread) 2533 { 2534 unsigned int cur_el = arm_current_el(env); 2535 bool has_el2 = arm_is_el2_enabled(env); 2536 uint64_t hcr = arm_hcr_el2_eff(env); 2537 2538 switch (cur_el) { 2539 case 0: 2540 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]CTEN. */ 2541 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2542 return (extract32(env->cp15.cnthctl_el2, timeridx, 1) 2543 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2544 } 2545 2546 /* CNT[PV]CT: not visible from PL0 if EL0[PV]CTEN is zero */ 2547 if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2548 return CP_ACCESS_TRAP; 2549 } 2550 /* fall through */ 2551 case 1: 2552 /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */ 2553 if (has_el2 && timeridx == GTIMER_PHYS && 2554 (hcr & HCR_E2H 2555 ? !extract32(env->cp15.cnthctl_el2, 10, 1) 2556 : !extract32(env->cp15.cnthctl_el2, 0, 1))) { 2557 return CP_ACCESS_TRAP_EL2; 2558 } 2559 if (has_el2 && timeridx == GTIMER_VIRT) { 2560 if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) { 2561 return CP_ACCESS_TRAP_EL2; 2562 } 2563 } 2564 break; 2565 } 2566 return CP_ACCESS_OK; 2567 } 2568 2569 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2570 bool isread) 2571 { 2572 unsigned int cur_el = arm_current_el(env); 2573 bool has_el2 = arm_is_el2_enabled(env); 2574 uint64_t hcr = arm_hcr_el2_eff(env); 2575 2576 switch (cur_el) { 2577 case 0: 2578 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2579 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]TEN. */ 2580 return (extract32(env->cp15.cnthctl_el2, 9 - timeridx, 1) 2581 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2582 } 2583 2584 /* 2585 * CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from 2586 * EL0 if EL0[PV]TEN is zero. 2587 */ 2588 if (!extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2589 return CP_ACCESS_TRAP; 2590 } 2591 /* fall through */ 2592 2593 case 1: 2594 if (has_el2 && timeridx == GTIMER_PHYS) { 2595 if (hcr & HCR_E2H) { 2596 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */ 2597 if (!extract32(env->cp15.cnthctl_el2, 11, 1)) { 2598 return CP_ACCESS_TRAP_EL2; 2599 } 2600 } else { 2601 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ 2602 if (!extract32(env->cp15.cnthctl_el2, 1, 1)) { 2603 return CP_ACCESS_TRAP_EL2; 2604 } 2605 } 2606 } 2607 if (has_el2 && timeridx == GTIMER_VIRT) { 2608 if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) { 2609 return CP_ACCESS_TRAP_EL2; 2610 } 2611 } 2612 break; 2613 } 2614 return CP_ACCESS_OK; 2615 } 2616 2617 static CPAccessResult gt_pct_access(CPUARMState *env, 2618 const ARMCPRegInfo *ri, 2619 bool isread) 2620 { 2621 return gt_counter_access(env, GTIMER_PHYS, isread); 2622 } 2623 2624 static CPAccessResult gt_vct_access(CPUARMState *env, 2625 const ARMCPRegInfo *ri, 2626 bool isread) 2627 { 2628 return gt_counter_access(env, GTIMER_VIRT, isread); 2629 } 2630 2631 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2632 bool isread) 2633 { 2634 return gt_timer_access(env, GTIMER_PHYS, isread); 2635 } 2636 2637 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2638 bool isread) 2639 { 2640 return gt_timer_access(env, GTIMER_VIRT, isread); 2641 } 2642 2643 static CPAccessResult gt_stimer_access(CPUARMState *env, 2644 const ARMCPRegInfo *ri, 2645 bool isread) 2646 { 2647 /* 2648 * The AArch64 register view of the secure physical timer is 2649 * always accessible from EL3, and configurably accessible from 2650 * Secure EL1. 2651 */ 2652 switch (arm_current_el(env)) { 2653 case 1: 2654 if (!arm_is_secure(env)) { 2655 return CP_ACCESS_TRAP; 2656 } 2657 if (!(env->cp15.scr_el3 & SCR_ST)) { 2658 return CP_ACCESS_TRAP_EL3; 2659 } 2660 return CP_ACCESS_OK; 2661 case 0: 2662 case 2: 2663 return CP_ACCESS_TRAP; 2664 case 3: 2665 return CP_ACCESS_OK; 2666 default: 2667 g_assert_not_reached(); 2668 } 2669 } 2670 2671 uint64_t gt_get_countervalue(CPUARMState *env) 2672 { 2673 ARMCPU *cpu = env_archcpu(env); 2674 2675 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu); 2676 } 2677 2678 static void gt_update_irq(ARMCPU *cpu, int timeridx) 2679 { 2680 CPUARMState *env = &cpu->env; 2681 uint64_t cnthctl = env->cp15.cnthctl_el2; 2682 ARMSecuritySpace ss = arm_security_space(env); 2683 /* ISTATUS && !IMASK */ 2684 int irqstate = (env->cp15.c14_timer[timeridx].ctl & 6) == 4; 2685 2686 /* 2687 * If bit CNTHCTL_EL2.CNT[VP]MASK is set, it overrides IMASK. 2688 * It is RES0 in Secure and NonSecure state. 2689 */ 2690 if ((ss == ARMSS_Root || ss == ARMSS_Realm) && 2691 ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) || 2692 (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) { 2693 irqstate = 0; 2694 } 2695 2696 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2697 trace_arm_gt_update_irq(timeridx, irqstate); 2698 } 2699 2700 void gt_rme_post_el_change(ARMCPU *cpu, void *ignored) 2701 { 2702 /* 2703 * Changing security state between Root and Secure/NonSecure, which may 2704 * happen when switching EL, can change the effective value of CNTHCTL_EL2 2705 * mask bits. Update the IRQ state accordingly. 2706 */ 2707 gt_update_irq(cpu, GTIMER_VIRT); 2708 gt_update_irq(cpu, GTIMER_PHYS); 2709 } 2710 2711 static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env) 2712 { 2713 if ((env->cp15.scr_el3 & SCR_ECVEN) && 2714 FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) && 2715 arm_is_el2_enabled(env) && 2716 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 2717 return env->cp15.cntpoff_el2; 2718 } 2719 return 0; 2720 } 2721 2722 static uint64_t gt_phys_cnt_offset(CPUARMState *env) 2723 { 2724 if (arm_current_el(env) >= 2) { 2725 return 0; 2726 } 2727 return gt_phys_raw_cnt_offset(env); 2728 } 2729 2730 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2731 { 2732 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2733 2734 if (gt->ctl & 1) { 2735 /* 2736 * Timer enabled: calculate and set current ISTATUS, irq, and 2737 * reset timer to when ISTATUS next has to change 2738 */ 2739 uint64_t offset = timeridx == GTIMER_VIRT ? 2740 cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env); 2741 uint64_t count = gt_get_countervalue(&cpu->env); 2742 /* Note that this must be unsigned 64 bit arithmetic: */ 2743 int istatus = count - offset >= gt->cval; 2744 uint64_t nexttick; 2745 2746 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2747 2748 if (istatus) { 2749 /* 2750 * Next transition is when (count - offset) rolls back over to 0. 2751 * If offset > count then this is when count == offset; 2752 * if offset <= count then this is when count == offset + 2^64 2753 * For the latter case we set nexttick to an "as far in future 2754 * as possible" value and let the code below handle it. 2755 */ 2756 if (offset > count) { 2757 nexttick = offset; 2758 } else { 2759 nexttick = UINT64_MAX; 2760 } 2761 } else { 2762 /* 2763 * Next transition is when (count - offset) == cval, i.e. 2764 * when count == (cval + offset). 2765 * If that would overflow, then again we set up the next interrupt 2766 * for "as far in the future as possible" for the code below. 2767 */ 2768 if (uadd64_overflow(gt->cval, offset, &nexttick)) { 2769 nexttick = UINT64_MAX; 2770 } 2771 } 2772 /* 2773 * Note that the desired next expiry time might be beyond the 2774 * signed-64-bit range of a QEMUTimer -- in this case we just 2775 * set the timer for as far in the future as possible. When the 2776 * timer expires we will reset the timer for any remaining period. 2777 */ 2778 if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { 2779 timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX); 2780 } else { 2781 timer_mod(cpu->gt_timer[timeridx], nexttick); 2782 } 2783 trace_arm_gt_recalc(timeridx, nexttick); 2784 } else { 2785 /* Timer disabled: ISTATUS and timer output always clear */ 2786 gt->ctl &= ~4; 2787 timer_del(cpu->gt_timer[timeridx]); 2788 trace_arm_gt_recalc_disabled(timeridx); 2789 } 2790 gt_update_irq(cpu, timeridx); 2791 } 2792 2793 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2794 int timeridx) 2795 { 2796 ARMCPU *cpu = env_archcpu(env); 2797 2798 timer_del(cpu->gt_timer[timeridx]); 2799 } 2800 2801 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2802 { 2803 return gt_get_countervalue(env) - gt_phys_cnt_offset(env); 2804 } 2805 2806 uint64_t gt_virt_cnt_offset(CPUARMState *env) 2807 { 2808 uint64_t hcr; 2809 2810 switch (arm_current_el(env)) { 2811 case 2: 2812 hcr = arm_hcr_el2_eff(env); 2813 if (hcr & HCR_E2H) { 2814 return 0; 2815 } 2816 break; 2817 case 0: 2818 hcr = arm_hcr_el2_eff(env); 2819 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2820 return 0; 2821 } 2822 break; 2823 } 2824 2825 return env->cp15.cntvoff_el2; 2826 } 2827 2828 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2829 { 2830 return gt_get_countervalue(env) - gt_virt_cnt_offset(env); 2831 } 2832 2833 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2834 int timeridx, 2835 uint64_t value) 2836 { 2837 trace_arm_gt_cval_write(timeridx, value); 2838 env->cp15.c14_timer[timeridx].cval = value; 2839 gt_recalc_timer(env_archcpu(env), timeridx); 2840 } 2841 2842 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2843 int timeridx) 2844 { 2845 uint64_t offset = 0; 2846 2847 switch (timeridx) { 2848 case GTIMER_VIRT: 2849 case GTIMER_HYPVIRT: 2850 offset = gt_virt_cnt_offset(env); 2851 break; 2852 case GTIMER_PHYS: 2853 offset = gt_phys_cnt_offset(env); 2854 break; 2855 } 2856 2857 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2858 (gt_get_countervalue(env) - offset)); 2859 } 2860 2861 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2862 int timeridx, 2863 uint64_t value) 2864 { 2865 uint64_t offset = 0; 2866 2867 switch (timeridx) { 2868 case GTIMER_VIRT: 2869 case GTIMER_HYPVIRT: 2870 offset = gt_virt_cnt_offset(env); 2871 break; 2872 case GTIMER_PHYS: 2873 offset = gt_phys_cnt_offset(env); 2874 break; 2875 } 2876 2877 trace_arm_gt_tval_write(timeridx, value); 2878 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2879 sextract64(value, 0, 32); 2880 gt_recalc_timer(env_archcpu(env), timeridx); 2881 } 2882 2883 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2884 int timeridx, 2885 uint64_t value) 2886 { 2887 ARMCPU *cpu = env_archcpu(env); 2888 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2889 2890 trace_arm_gt_ctl_write(timeridx, value); 2891 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2892 if ((oldval ^ value) & 1) { 2893 /* Enable toggled */ 2894 gt_recalc_timer(cpu, timeridx); 2895 } else if ((oldval ^ value) & 2) { 2896 /* 2897 * IMASK toggled: don't need to recalculate, 2898 * just set the interrupt line based on ISTATUS 2899 */ 2900 trace_arm_gt_imask_toggle(timeridx); 2901 gt_update_irq(cpu, timeridx); 2902 } 2903 } 2904 2905 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2906 { 2907 gt_timer_reset(env, ri, GTIMER_PHYS); 2908 } 2909 2910 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2911 uint64_t value) 2912 { 2913 gt_cval_write(env, ri, GTIMER_PHYS, value); 2914 } 2915 2916 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2917 { 2918 return gt_tval_read(env, ri, GTIMER_PHYS); 2919 } 2920 2921 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2922 uint64_t value) 2923 { 2924 gt_tval_write(env, ri, GTIMER_PHYS, value); 2925 } 2926 2927 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2928 uint64_t value) 2929 { 2930 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2931 } 2932 2933 static int gt_phys_redir_timeridx(CPUARMState *env) 2934 { 2935 switch (arm_mmu_idx(env)) { 2936 case ARMMMUIdx_E20_0: 2937 case ARMMMUIdx_E20_2: 2938 case ARMMMUIdx_E20_2_PAN: 2939 return GTIMER_HYP; 2940 default: 2941 return GTIMER_PHYS; 2942 } 2943 } 2944 2945 static int gt_virt_redir_timeridx(CPUARMState *env) 2946 { 2947 switch (arm_mmu_idx(env)) { 2948 case ARMMMUIdx_E20_0: 2949 case ARMMMUIdx_E20_2: 2950 case ARMMMUIdx_E20_2_PAN: 2951 return GTIMER_HYPVIRT; 2952 default: 2953 return GTIMER_VIRT; 2954 } 2955 } 2956 2957 static uint64_t gt_phys_redir_cval_read(CPUARMState *env, 2958 const ARMCPRegInfo *ri) 2959 { 2960 int timeridx = gt_phys_redir_timeridx(env); 2961 return env->cp15.c14_timer[timeridx].cval; 2962 } 2963 2964 static void gt_phys_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2965 uint64_t value) 2966 { 2967 int timeridx = gt_phys_redir_timeridx(env); 2968 gt_cval_write(env, ri, timeridx, value); 2969 } 2970 2971 static uint64_t gt_phys_redir_tval_read(CPUARMState *env, 2972 const ARMCPRegInfo *ri) 2973 { 2974 int timeridx = gt_phys_redir_timeridx(env); 2975 return gt_tval_read(env, ri, timeridx); 2976 } 2977 2978 static void gt_phys_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2979 uint64_t value) 2980 { 2981 int timeridx = gt_phys_redir_timeridx(env); 2982 gt_tval_write(env, ri, timeridx, value); 2983 } 2984 2985 static uint64_t gt_phys_redir_ctl_read(CPUARMState *env, 2986 const ARMCPRegInfo *ri) 2987 { 2988 int timeridx = gt_phys_redir_timeridx(env); 2989 return env->cp15.c14_timer[timeridx].ctl; 2990 } 2991 2992 static void gt_phys_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2993 uint64_t value) 2994 { 2995 int timeridx = gt_phys_redir_timeridx(env); 2996 gt_ctl_write(env, ri, timeridx, value); 2997 } 2998 2999 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3000 { 3001 gt_timer_reset(env, ri, GTIMER_VIRT); 3002 } 3003 3004 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3005 uint64_t value) 3006 { 3007 gt_cval_write(env, ri, GTIMER_VIRT, value); 3008 } 3009 3010 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 3011 { 3012 return gt_tval_read(env, ri, GTIMER_VIRT); 3013 } 3014 3015 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3016 uint64_t value) 3017 { 3018 gt_tval_write(env, ri, GTIMER_VIRT, value); 3019 } 3020 3021 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3022 uint64_t value) 3023 { 3024 gt_ctl_write(env, ri, GTIMER_VIRT, value); 3025 } 3026 3027 static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3028 uint64_t value) 3029 { 3030 ARMCPU *cpu = env_archcpu(env); 3031 uint32_t oldval = env->cp15.cnthctl_el2; 3032 uint32_t valid_mask = 3033 R_CNTHCTL_EL0PCTEN_E2H1_MASK | 3034 R_CNTHCTL_EL0VCTEN_E2H1_MASK | 3035 R_CNTHCTL_EVNTEN_MASK | 3036 R_CNTHCTL_EVNTDIR_MASK | 3037 R_CNTHCTL_EVNTI_MASK | 3038 R_CNTHCTL_EL0VTEN_MASK | 3039 R_CNTHCTL_EL0PTEN_MASK | 3040 R_CNTHCTL_EL1PCTEN_E2H1_MASK | 3041 R_CNTHCTL_EL1PTEN_MASK; 3042 3043 if (cpu_isar_feature(aa64_rme, cpu)) { 3044 valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK; 3045 } 3046 if (cpu_isar_feature(aa64_ecv_traps, cpu)) { 3047 valid_mask |= 3048 R_CNTHCTL_EL1TVT_MASK | 3049 R_CNTHCTL_EL1TVCT_MASK | 3050 R_CNTHCTL_EL1NVPCT_MASK | 3051 R_CNTHCTL_EL1NVVCT_MASK | 3052 R_CNTHCTL_EVNTIS_MASK; 3053 } 3054 if (cpu_isar_feature(aa64_ecv, cpu)) { 3055 valid_mask |= R_CNTHCTL_ECV_MASK; 3056 } 3057 3058 /* Clear RES0 bits */ 3059 value &= valid_mask; 3060 3061 raw_write(env, ri, value); 3062 3063 if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) { 3064 gt_update_irq(cpu, GTIMER_VIRT); 3065 } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) { 3066 gt_update_irq(cpu, GTIMER_PHYS); 3067 } 3068 } 3069 3070 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 3071 uint64_t value) 3072 { 3073 ARMCPU *cpu = env_archcpu(env); 3074 3075 trace_arm_gt_cntvoff_write(value); 3076 raw_write(env, ri, value); 3077 gt_recalc_timer(cpu, GTIMER_VIRT); 3078 } 3079 3080 static uint64_t gt_virt_redir_cval_read(CPUARMState *env, 3081 const ARMCPRegInfo *ri) 3082 { 3083 int timeridx = gt_virt_redir_timeridx(env); 3084 return env->cp15.c14_timer[timeridx].cval; 3085 } 3086 3087 static void gt_virt_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3088 uint64_t value) 3089 { 3090 int timeridx = gt_virt_redir_timeridx(env); 3091 gt_cval_write(env, ri, timeridx, value); 3092 } 3093 3094 static uint64_t gt_virt_redir_tval_read(CPUARMState *env, 3095 const ARMCPRegInfo *ri) 3096 { 3097 int timeridx = gt_virt_redir_timeridx(env); 3098 return gt_tval_read(env, ri, timeridx); 3099 } 3100 3101 static void gt_virt_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3102 uint64_t value) 3103 { 3104 int timeridx = gt_virt_redir_timeridx(env); 3105 gt_tval_write(env, ri, timeridx, value); 3106 } 3107 3108 static uint64_t gt_virt_redir_ctl_read(CPUARMState *env, 3109 const ARMCPRegInfo *ri) 3110 { 3111 int timeridx = gt_virt_redir_timeridx(env); 3112 return env->cp15.c14_timer[timeridx].ctl; 3113 } 3114 3115 static void gt_virt_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3116 uint64_t value) 3117 { 3118 int timeridx = gt_virt_redir_timeridx(env); 3119 gt_ctl_write(env, ri, timeridx, value); 3120 } 3121 3122 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3123 { 3124 gt_timer_reset(env, ri, GTIMER_HYP); 3125 } 3126 3127 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3128 uint64_t value) 3129 { 3130 gt_cval_write(env, ri, GTIMER_HYP, value); 3131 } 3132 3133 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 3134 { 3135 return gt_tval_read(env, ri, GTIMER_HYP); 3136 } 3137 3138 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3139 uint64_t value) 3140 { 3141 gt_tval_write(env, ri, GTIMER_HYP, value); 3142 } 3143 3144 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3145 uint64_t value) 3146 { 3147 gt_ctl_write(env, ri, GTIMER_HYP, value); 3148 } 3149 3150 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3151 { 3152 gt_timer_reset(env, ri, GTIMER_SEC); 3153 } 3154 3155 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3156 uint64_t value) 3157 { 3158 gt_cval_write(env, ri, GTIMER_SEC, value); 3159 } 3160 3161 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 3162 { 3163 return gt_tval_read(env, ri, GTIMER_SEC); 3164 } 3165 3166 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3167 uint64_t value) 3168 { 3169 gt_tval_write(env, ri, GTIMER_SEC, value); 3170 } 3171 3172 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3173 uint64_t value) 3174 { 3175 gt_ctl_write(env, ri, GTIMER_SEC, value); 3176 } 3177 3178 static void gt_hv_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3179 { 3180 gt_timer_reset(env, ri, GTIMER_HYPVIRT); 3181 } 3182 3183 static void gt_hv_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3184 uint64_t value) 3185 { 3186 gt_cval_write(env, ri, GTIMER_HYPVIRT, value); 3187 } 3188 3189 static uint64_t gt_hv_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 3190 { 3191 return gt_tval_read(env, ri, GTIMER_HYPVIRT); 3192 } 3193 3194 static void gt_hv_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3195 uint64_t value) 3196 { 3197 gt_tval_write(env, ri, GTIMER_HYPVIRT, value); 3198 } 3199 3200 static void gt_hv_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3201 uint64_t value) 3202 { 3203 gt_ctl_write(env, ri, GTIMER_HYPVIRT, value); 3204 } 3205 3206 void arm_gt_ptimer_cb(void *opaque) 3207 { 3208 ARMCPU *cpu = opaque; 3209 3210 gt_recalc_timer(cpu, GTIMER_PHYS); 3211 } 3212 3213 void arm_gt_vtimer_cb(void *opaque) 3214 { 3215 ARMCPU *cpu = opaque; 3216 3217 gt_recalc_timer(cpu, GTIMER_VIRT); 3218 } 3219 3220 void arm_gt_htimer_cb(void *opaque) 3221 { 3222 ARMCPU *cpu = opaque; 3223 3224 gt_recalc_timer(cpu, GTIMER_HYP); 3225 } 3226 3227 void arm_gt_stimer_cb(void *opaque) 3228 { 3229 ARMCPU *cpu = opaque; 3230 3231 gt_recalc_timer(cpu, GTIMER_SEC); 3232 } 3233 3234 void arm_gt_hvtimer_cb(void *opaque) 3235 { 3236 ARMCPU *cpu = opaque; 3237 3238 gt_recalc_timer(cpu, GTIMER_HYPVIRT); 3239 } 3240 3241 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 3242 /* 3243 * Note that CNTFRQ is purely reads-as-written for the benefit 3244 * of software; writing it doesn't actually change the timer frequency. 3245 * Our reset value matches the fixed frequency we implement the timer at. 3246 */ 3247 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 3248 .type = ARM_CP_ALIAS, 3249 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 3250 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 3251 }, 3252 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 3253 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 3254 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 3255 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 3256 .resetfn = arm_gt_cntfrq_reset, 3257 }, 3258 /* overall control: mostly access permissions */ 3259 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 3260 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 3261 .access = PL1_RW, 3262 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 3263 .resetvalue = 0, 3264 }, 3265 /* per-timer control */ 3266 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 3267 .secure = ARM_CP_SECSTATE_NS, 3268 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3269 .accessfn = gt_ptimer_access, 3270 .fieldoffset = offsetoflow32(CPUARMState, 3271 cp15.c14_timer[GTIMER_PHYS].ctl), 3272 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3273 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3274 }, 3275 { .name = "CNTP_CTL_S", 3276 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 3277 .secure = ARM_CP_SECSTATE_S, 3278 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3279 .accessfn = gt_ptimer_access, 3280 .fieldoffset = offsetoflow32(CPUARMState, 3281 cp15.c14_timer[GTIMER_SEC].ctl), 3282 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3283 }, 3284 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 3285 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 3286 .type = ARM_CP_IO, .access = PL0_RW, 3287 .accessfn = gt_ptimer_access, 3288 .nv2_redirect_offset = 0x180 | NV2_REDIR_NV1, 3289 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 3290 .resetvalue = 0, 3291 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3292 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3293 }, 3294 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 3295 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3296 .accessfn = gt_vtimer_access, 3297 .fieldoffset = offsetoflow32(CPUARMState, 3298 cp15.c14_timer[GTIMER_VIRT].ctl), 3299 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3300 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3301 }, 3302 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 3303 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 3304 .type = ARM_CP_IO, .access = PL0_RW, 3305 .accessfn = gt_vtimer_access, 3306 .nv2_redirect_offset = 0x170 | NV2_REDIR_NV1, 3307 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 3308 .resetvalue = 0, 3309 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3310 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3311 }, 3312 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 3313 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3314 .secure = ARM_CP_SECSTATE_NS, 3315 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3316 .accessfn = gt_ptimer_access, 3317 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3318 }, 3319 { .name = "CNTP_TVAL_S", 3320 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3321 .secure = ARM_CP_SECSTATE_S, 3322 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3323 .accessfn = gt_ptimer_access, 3324 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 3325 }, 3326 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3327 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 3328 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3329 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 3330 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3331 }, 3332 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 3333 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3334 .accessfn = gt_vtimer_access, 3335 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3336 }, 3337 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3338 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 3339 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3340 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 3341 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3342 }, 3343 /* The counter itself */ 3344 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 3345 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3346 .accessfn = gt_pct_access, 3347 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 3348 }, 3349 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 3350 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 3351 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3352 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 3353 }, 3354 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 3355 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3356 .accessfn = gt_vct_access, 3357 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 3358 }, 3359 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3360 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3361 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3362 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 3363 }, 3364 /* Comparison value, indicating when the timer goes off */ 3365 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 3366 .secure = ARM_CP_SECSTATE_NS, 3367 .access = PL0_RW, 3368 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3369 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3370 .accessfn = gt_ptimer_access, 3371 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3372 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3373 }, 3374 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 3375 .secure = ARM_CP_SECSTATE_S, 3376 .access = PL0_RW, 3377 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3378 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3379 .accessfn = gt_ptimer_access, 3380 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3381 }, 3382 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3383 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 3384 .access = PL0_RW, 3385 .type = ARM_CP_IO, 3386 .nv2_redirect_offset = 0x178 | NV2_REDIR_NV1, 3387 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3388 .resetvalue = 0, .accessfn = gt_ptimer_access, 3389 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3390 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3391 }, 3392 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 3393 .access = PL0_RW, 3394 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3395 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3396 .accessfn = gt_vtimer_access, 3397 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3398 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3399 }, 3400 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3401 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 3402 .access = PL0_RW, 3403 .type = ARM_CP_IO, 3404 .nv2_redirect_offset = 0x168 | NV2_REDIR_NV1, 3405 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3406 .resetvalue = 0, .accessfn = gt_vtimer_access, 3407 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3408 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3409 }, 3410 /* 3411 * Secure timer -- this is actually restricted to only EL3 3412 * and configurably Secure-EL1 via the accessfn. 3413 */ 3414 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 3415 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 3416 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 3417 .accessfn = gt_stimer_access, 3418 .readfn = gt_sec_tval_read, 3419 .writefn = gt_sec_tval_write, 3420 .resetfn = gt_sec_timer_reset, 3421 }, 3422 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 3423 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 3424 .type = ARM_CP_IO, .access = PL1_RW, 3425 .accessfn = gt_stimer_access, 3426 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 3427 .resetvalue = 0, 3428 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3429 }, 3430 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 3431 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 3432 .type = ARM_CP_IO, .access = PL1_RW, 3433 .accessfn = gt_stimer_access, 3434 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3435 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3436 }, 3437 }; 3438 3439 /* 3440 * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which 3441 * are "self-synchronizing". For QEMU all sysregs are self-synchronizing, 3442 * so our implementations here are identical to the normal registers. 3443 */ 3444 static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = { 3445 { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9, 3446 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3447 .accessfn = gt_vct_access, 3448 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 3449 }, 3450 { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64, 3451 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6, 3452 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3453 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 3454 }, 3455 { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8, 3456 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3457 .accessfn = gt_pct_access, 3458 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 3459 }, 3460 { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64, 3461 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5, 3462 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3463 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 3464 }, 3465 }; 3466 3467 static CPAccessResult gt_cntpoff_access(CPUARMState *env, 3468 const ARMCPRegInfo *ri, 3469 bool isread) 3470 { 3471 if (arm_current_el(env) == 2 && arm_feature(env, ARM_FEATURE_EL3) && 3472 !(env->cp15.scr_el3 & SCR_ECVEN)) { 3473 return CP_ACCESS_TRAP_EL3; 3474 } 3475 return CP_ACCESS_OK; 3476 } 3477 3478 static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 3479 uint64_t value) 3480 { 3481 ARMCPU *cpu = env_archcpu(env); 3482 3483 trace_arm_gt_cntpoff_write(value); 3484 raw_write(env, ri, value); 3485 gt_recalc_timer(cpu, GTIMER_PHYS); 3486 } 3487 3488 static const ARMCPRegInfo gen_timer_cntpoff_reginfo = { 3489 .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64, 3490 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6, 3491 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 3492 .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write, 3493 .nv2_redirect_offset = 0x1a8, 3494 .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2), 3495 }; 3496 #else 3497 3498 /* 3499 * In user-mode most of the generic timer registers are inaccessible 3500 * however modern kernels (4.12+) allow access to cntvct_el0 3501 */ 3502 3503 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 3504 { 3505 ARMCPU *cpu = env_archcpu(env); 3506 3507 /* 3508 * Currently we have no support for QEMUTimer in linux-user so we 3509 * can't call gt_get_countervalue(env), instead we directly 3510 * call the lower level functions. 3511 */ 3512 return cpu_get_clock() / gt_cntfrq_period_ns(cpu); 3513 } 3514 3515 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 3516 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 3517 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 3518 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 3519 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 3520 .resetfn = arm_gt_cntfrq_reset, 3521 }, 3522 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3523 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3524 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3525 .readfn = gt_virt_cnt_read, 3526 }, 3527 }; 3528 3529 /* 3530 * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also 3531 * is exposed to userspace by Linux. 3532 */ 3533 static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = { 3534 { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64, 3535 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6, 3536 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3537 .readfn = gt_virt_cnt_read, 3538 }, 3539 }; 3540 3541 #endif 3542 3543 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3544 { 3545 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3546 raw_write(env, ri, value); 3547 } else if (arm_feature(env, ARM_FEATURE_V7)) { 3548 raw_write(env, ri, value & 0xfffff6ff); 3549 } else { 3550 raw_write(env, ri, value & 0xfffff1ff); 3551 } 3552 } 3553 3554 #ifndef CONFIG_USER_ONLY 3555 /* get_phys_addr() isn't present for user-mode-only targets */ 3556 3557 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 3558 bool isread) 3559 { 3560 if (ri->opc2 & 4) { 3561 /* 3562 * The ATS12NSO* operations must trap to EL3 or EL2 if executed in 3563 * Secure EL1 (which can only happen if EL3 is AArch64). 3564 * They are simply UNDEF if executed from NS EL1. 3565 * They function normally from EL2 or EL3. 3566 */ 3567 if (arm_current_el(env) == 1) { 3568 if (arm_is_secure_below_el3(env)) { 3569 if (env->cp15.scr_el3 & SCR_EEL2) { 3570 return CP_ACCESS_TRAP_EL2; 3571 } 3572 return CP_ACCESS_TRAP_EL3; 3573 } 3574 return CP_ACCESS_TRAP_UNCATEGORIZED; 3575 } 3576 } 3577 return CP_ACCESS_OK; 3578 } 3579 3580 #ifdef CONFIG_TCG 3581 static int par_el1_shareability(GetPhysAddrResult *res) 3582 { 3583 /* 3584 * The PAR_EL1.SH field must be 0b10 for Device or Normal-NC 3585 * memory -- see pseudocode PAREncodeShareability(). 3586 */ 3587 if (((res->cacheattrs.attrs & 0xf0) == 0) || 3588 res->cacheattrs.attrs == 0x44 || res->cacheattrs.attrs == 0x40) { 3589 return 2; 3590 } 3591 return res->cacheattrs.shareability; 3592 } 3593 3594 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 3595 MMUAccessType access_type, ARMMMUIdx mmu_idx, 3596 ARMSecuritySpace ss) 3597 { 3598 bool ret; 3599 uint64_t par64; 3600 bool format64 = false; 3601 ARMMMUFaultInfo fi = {}; 3602 GetPhysAddrResult res = {}; 3603 3604 /* 3605 * I_MXTJT: Granule protection checks are not performed on the final 3606 * address of a successful translation. This is a translation not a 3607 * memory reference, so "memop = none = 0". 3608 */ 3609 ret = get_phys_addr_with_space_nogpc(env, value, access_type, 0, 3610 mmu_idx, ss, &res, &fi); 3611 3612 /* 3613 * ATS operations only do S1 or S1+S2 translations, so we never 3614 * have to deal with the ARMCacheAttrs format for S2 only. 3615 */ 3616 assert(!res.cacheattrs.is_s2_format); 3617 3618 if (ret) { 3619 /* 3620 * Some kinds of translation fault must cause exceptions rather 3621 * than being reported in the PAR. 3622 */ 3623 int current_el = arm_current_el(env); 3624 int target_el; 3625 uint32_t syn, fsr, fsc; 3626 bool take_exc = false; 3627 3628 if (fi.s1ptw && current_el == 1 3629 && arm_mmu_idx_is_stage1_of_2(mmu_idx)) { 3630 /* 3631 * Synchronous stage 2 fault on an access made as part of the 3632 * translation table walk for AT S1E0* or AT S1E1* insn 3633 * executed from NS EL1. If this is a synchronous external abort 3634 * and SCR_EL3.EA == 1, then we take a synchronous external abort 3635 * to EL3. Otherwise the fault is taken as an exception to EL2, 3636 * and HPFAR_EL2 holds the faulting IPA. 3637 */ 3638 if (fi.type == ARMFault_SyncExternalOnWalk && 3639 (env->cp15.scr_el3 & SCR_EA)) { 3640 target_el = 3; 3641 } else { 3642 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4; 3643 if (arm_is_secure_below_el3(env) && fi.s1ns) { 3644 env->cp15.hpfar_el2 |= HPFAR_NS; 3645 } 3646 target_el = 2; 3647 } 3648 take_exc = true; 3649 } else if (fi.type == ARMFault_SyncExternalOnWalk) { 3650 /* 3651 * Synchronous external aborts during a translation table walk 3652 * are taken as Data Abort exceptions. 3653 */ 3654 if (fi.stage2) { 3655 if (current_el == 3) { 3656 target_el = 3; 3657 } else { 3658 target_el = 2; 3659 } 3660 } else { 3661 target_el = exception_target_el(env); 3662 } 3663 take_exc = true; 3664 } 3665 3666 if (take_exc) { 3667 /* Construct FSR and FSC using same logic as arm_deliver_fault() */ 3668 if (target_el == 2 || arm_el_is_aa64(env, target_el) || 3669 arm_s1_regime_using_lpae_format(env, mmu_idx)) { 3670 fsr = arm_fi_to_lfsc(&fi); 3671 fsc = extract32(fsr, 0, 6); 3672 } else { 3673 fsr = arm_fi_to_sfsc(&fi); 3674 fsc = 0x3f; 3675 } 3676 /* 3677 * Report exception with ESR indicating a fault due to a 3678 * translation table walk for a cache maintenance instruction. 3679 */ 3680 syn = syn_data_abort_no_iss(current_el == target_el, 0, 3681 fi.ea, 1, fi.s1ptw, 1, fsc); 3682 env->exception.vaddress = value; 3683 env->exception.fsr = fsr; 3684 raise_exception(env, EXCP_DATA_ABORT, syn, target_el); 3685 } 3686 } 3687 3688 if (is_a64(env)) { 3689 format64 = true; 3690 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 3691 /* 3692 * ATS1Cxx: 3693 * * TTBCR.EAE determines whether the result is returned using the 3694 * 32-bit or the 64-bit PAR format 3695 * * Instructions executed in Hyp mode always use the 64bit format 3696 * 3697 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 3698 * * The Non-secure TTBCR.EAE bit is set to 1 3699 * * The implementation includes EL2, and the value of HCR.VM is 1 3700 * 3701 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 3702 * 3703 * ATS1Hx always uses the 64bit format. 3704 */ 3705 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 3706 3707 if (arm_feature(env, ARM_FEATURE_EL2)) { 3708 if (mmu_idx == ARMMMUIdx_E10_0 || 3709 mmu_idx == ARMMMUIdx_E10_1 || 3710 mmu_idx == ARMMMUIdx_E10_1_PAN) { 3711 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 3712 } else { 3713 format64 |= arm_current_el(env) == 2; 3714 } 3715 } 3716 } 3717 3718 if (format64) { 3719 /* Create a 64-bit PAR */ 3720 par64 = (1 << 11); /* LPAE bit always set */ 3721 if (!ret) { 3722 par64 |= res.f.phys_addr & ~0xfffULL; 3723 if (!res.f.attrs.secure) { 3724 par64 |= (1 << 9); /* NS */ 3725 } 3726 par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */ 3727 par64 |= par_el1_shareability(&res) << 7; /* SH */ 3728 } else { 3729 uint32_t fsr = arm_fi_to_lfsc(&fi); 3730 3731 par64 |= 1; /* F */ 3732 par64 |= (fsr & 0x3f) << 1; /* FS */ 3733 if (fi.stage2) { 3734 par64 |= (1 << 9); /* S */ 3735 } 3736 if (fi.s1ptw) { 3737 par64 |= (1 << 8); /* PTW */ 3738 } 3739 } 3740 } else { 3741 /* 3742 * fsr is a DFSR/IFSR value for the short descriptor 3743 * translation table format (with WnR always clear). 3744 * Convert it to a 32-bit PAR. 3745 */ 3746 if (!ret) { 3747 /* We do not set any attribute bits in the PAR */ 3748 if (res.f.lg_page_size == 24 3749 && arm_feature(env, ARM_FEATURE_V7)) { 3750 par64 = (res.f.phys_addr & 0xff000000) | (1 << 1); 3751 } else { 3752 par64 = res.f.phys_addr & 0xfffff000; 3753 } 3754 if (!res.f.attrs.secure) { 3755 par64 |= (1 << 9); /* NS */ 3756 } 3757 } else { 3758 uint32_t fsr = arm_fi_to_sfsc(&fi); 3759 3760 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 3761 ((fsr & 0xf) << 1) | 1; 3762 } 3763 } 3764 return par64; 3765 } 3766 #endif /* CONFIG_TCG */ 3767 3768 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3769 { 3770 #ifdef CONFIG_TCG 3771 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3772 uint64_t par64; 3773 ARMMMUIdx mmu_idx; 3774 int el = arm_current_el(env); 3775 ARMSecuritySpace ss = arm_security_space(env); 3776 3777 switch (ri->opc2 & 6) { 3778 case 0: 3779 /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */ 3780 switch (el) { 3781 case 3: 3782 if (ri->crm == 9 && arm_pan_enabled(env)) { 3783 mmu_idx = ARMMMUIdx_E30_3_PAN; 3784 } else { 3785 mmu_idx = ARMMMUIdx_E3; 3786 } 3787 break; 3788 case 2: 3789 g_assert(ss != ARMSS_Secure); /* ARMv8.4-SecEL2 is 64-bit only */ 3790 /* fall through */ 3791 case 1: 3792 if (ri->crm == 9 && arm_pan_enabled(env)) { 3793 mmu_idx = ARMMMUIdx_Stage1_E1_PAN; 3794 } else { 3795 mmu_idx = ARMMMUIdx_Stage1_E1; 3796 } 3797 break; 3798 default: 3799 g_assert_not_reached(); 3800 } 3801 break; 3802 case 2: 3803 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3804 switch (el) { 3805 case 3: 3806 mmu_idx = ARMMMUIdx_E30_0; 3807 break; 3808 case 2: 3809 g_assert(ss != ARMSS_Secure); /* ARMv8.4-SecEL2 is 64-bit only */ 3810 mmu_idx = ARMMMUIdx_Stage1_E0; 3811 break; 3812 case 1: 3813 mmu_idx = ARMMMUIdx_Stage1_E0; 3814 break; 3815 default: 3816 g_assert_not_reached(); 3817 } 3818 break; 3819 case 4: 3820 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3821 mmu_idx = ARMMMUIdx_E10_1; 3822 ss = ARMSS_NonSecure; 3823 break; 3824 case 6: 3825 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3826 mmu_idx = ARMMMUIdx_E10_0; 3827 ss = ARMSS_NonSecure; 3828 break; 3829 default: 3830 g_assert_not_reached(); 3831 } 3832 3833 par64 = do_ats_write(env, value, access_type, mmu_idx, ss); 3834 3835 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3836 #else 3837 /* Handled by hardware accelerator. */ 3838 g_assert_not_reached(); 3839 #endif /* CONFIG_TCG */ 3840 } 3841 3842 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3843 uint64_t value) 3844 { 3845 #ifdef CONFIG_TCG 3846 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3847 uint64_t par64; 3848 3849 /* There is no SecureEL2 for AArch32. */ 3850 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2, 3851 ARMSS_NonSecure); 3852 3853 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3854 #else 3855 /* Handled by hardware accelerator. */ 3856 g_assert_not_reached(); 3857 #endif /* CONFIG_TCG */ 3858 } 3859 3860 static CPAccessResult at_e012_access(CPUARMState *env, const ARMCPRegInfo *ri, 3861 bool isread) 3862 { 3863 /* 3864 * R_NYXTL: instruction is UNDEFINED if it applies to an Exception level 3865 * lower than EL3 and the combination SCR_EL3.{NSE,NS} is reserved. This can 3866 * only happen when executing at EL3 because that combination also causes an 3867 * illegal exception return. We don't need to check FEAT_RME either, because 3868 * scr_write() ensures that the NSE bit is not set otherwise. 3869 */ 3870 if ((env->cp15.scr_el3 & (SCR_NSE | SCR_NS)) == SCR_NSE) { 3871 return CP_ACCESS_TRAP; 3872 } 3873 return CP_ACCESS_OK; 3874 } 3875 3876 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3877 bool isread) 3878 { 3879 if (arm_current_el(env) == 3 && 3880 !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) { 3881 return CP_ACCESS_TRAP; 3882 } 3883 return at_e012_access(env, ri, isread); 3884 } 3885 3886 static CPAccessResult at_s1e01_access(CPUARMState *env, const ARMCPRegInfo *ri, 3887 bool isread) 3888 { 3889 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_AT)) { 3890 return CP_ACCESS_TRAP_EL2; 3891 } 3892 return at_e012_access(env, ri, isread); 3893 } 3894 3895 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3896 uint64_t value) 3897 { 3898 #ifdef CONFIG_TCG 3899 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3900 ARMMMUIdx mmu_idx; 3901 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 3902 bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE); 3903 bool for_el3 = false; 3904 ARMSecuritySpace ss; 3905 3906 switch (ri->opc2 & 6) { 3907 case 0: 3908 switch (ri->opc1) { 3909 case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */ 3910 if (ri->crm == 9 && arm_pan_enabled(env)) { 3911 mmu_idx = regime_e20 ? 3912 ARMMMUIdx_E20_2_PAN : ARMMMUIdx_Stage1_E1_PAN; 3913 } else { 3914 mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1; 3915 } 3916 break; 3917 case 4: /* AT S1E2R, AT S1E2W */ 3918 mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2; 3919 break; 3920 case 6: /* AT S1E3R, AT S1E3W */ 3921 mmu_idx = ARMMMUIdx_E3; 3922 for_el3 = true; 3923 break; 3924 default: 3925 g_assert_not_reached(); 3926 } 3927 break; 3928 case 2: /* AT S1E0R, AT S1E0W */ 3929 mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_Stage1_E0; 3930 break; 3931 case 4: /* AT S12E1R, AT S12E1W */ 3932 mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_E10_1; 3933 break; 3934 case 6: /* AT S12E0R, AT S12E0W */ 3935 mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_E10_0; 3936 break; 3937 default: 3938 g_assert_not_reached(); 3939 } 3940 3941 ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env); 3942 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss); 3943 #else 3944 /* Handled by hardware accelerator. */ 3945 g_assert_not_reached(); 3946 #endif /* CONFIG_TCG */ 3947 } 3948 #endif 3949 3950 /* Return basic MPU access permission bits. */ 3951 static uint32_t simple_mpu_ap_bits(uint32_t val) 3952 { 3953 uint32_t ret; 3954 uint32_t mask; 3955 int i; 3956 ret = 0; 3957 mask = 3; 3958 for (i = 0; i < 16; i += 2) { 3959 ret |= (val >> i) & mask; 3960 mask <<= 2; 3961 } 3962 return ret; 3963 } 3964 3965 /* Pad basic MPU access permission bits to extended format. */ 3966 static uint32_t extended_mpu_ap_bits(uint32_t val) 3967 { 3968 uint32_t ret; 3969 uint32_t mask; 3970 int i; 3971 ret = 0; 3972 mask = 3; 3973 for (i = 0; i < 16; i += 2) { 3974 ret |= (val & mask) << i; 3975 mask <<= 2; 3976 } 3977 return ret; 3978 } 3979 3980 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3981 uint64_t value) 3982 { 3983 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3984 } 3985 3986 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3987 { 3988 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3989 } 3990 3991 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3992 uint64_t value) 3993 { 3994 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3995 } 3996 3997 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3998 { 3999 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 4000 } 4001 4002 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 4003 { 4004 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 4005 4006 if (!u32p) { 4007 return 0; 4008 } 4009 4010 u32p += env->pmsav7.rnr[M_REG_NS]; 4011 return *u32p; 4012 } 4013 4014 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 4015 uint64_t value) 4016 { 4017 ARMCPU *cpu = env_archcpu(env); 4018 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 4019 4020 if (!u32p) { 4021 return; 4022 } 4023 4024 u32p += env->pmsav7.rnr[M_REG_NS]; 4025 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4026 *u32p = value; 4027 } 4028 4029 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4030 uint64_t value) 4031 { 4032 ARMCPU *cpu = env_archcpu(env); 4033 uint32_t nrgs = cpu->pmsav7_dregion; 4034 4035 if (value >= nrgs) { 4036 qemu_log_mask(LOG_GUEST_ERROR, 4037 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 4038 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 4039 return; 4040 } 4041 4042 raw_write(env, ri, value); 4043 } 4044 4045 static void prbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4046 uint64_t value) 4047 { 4048 ARMCPU *cpu = env_archcpu(env); 4049 4050 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4051 env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value; 4052 } 4053 4054 static uint64_t prbar_read(CPUARMState *env, const ARMCPRegInfo *ri) 4055 { 4056 return env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]]; 4057 } 4058 4059 static void prlar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4060 uint64_t value) 4061 { 4062 ARMCPU *cpu = env_archcpu(env); 4063 4064 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4065 env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value; 4066 } 4067 4068 static uint64_t prlar_read(CPUARMState *env, const ARMCPRegInfo *ri) 4069 { 4070 return env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]]; 4071 } 4072 4073 static void prselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4074 uint64_t value) 4075 { 4076 ARMCPU *cpu = env_archcpu(env); 4077 4078 /* 4079 * Ignore writes that would select not implemented region. 4080 * This is architecturally UNPREDICTABLE. 4081 */ 4082 if (value >= cpu->pmsav7_dregion) { 4083 return; 4084 } 4085 4086 env->pmsav7.rnr[M_REG_NS] = value; 4087 } 4088 4089 static void hprbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4090 uint64_t value) 4091 { 4092 ARMCPU *cpu = env_archcpu(env); 4093 4094 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4095 env->pmsav8.hprbar[env->pmsav8.hprselr] = value; 4096 } 4097 4098 static uint64_t hprbar_read(CPUARMState *env, const ARMCPRegInfo *ri) 4099 { 4100 return env->pmsav8.hprbar[env->pmsav8.hprselr]; 4101 } 4102 4103 static void hprlar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4104 uint64_t value) 4105 { 4106 ARMCPU *cpu = env_archcpu(env); 4107 4108 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4109 env->pmsav8.hprlar[env->pmsav8.hprselr] = value; 4110 } 4111 4112 static uint64_t hprlar_read(CPUARMState *env, const ARMCPRegInfo *ri) 4113 { 4114 return env->pmsav8.hprlar[env->pmsav8.hprselr]; 4115 } 4116 4117 static void hprenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4118 uint64_t value) 4119 { 4120 uint32_t n; 4121 uint32_t bit; 4122 ARMCPU *cpu = env_archcpu(env); 4123 4124 /* Ignore writes to unimplemented regions */ 4125 int rmax = MIN(cpu->pmsav8r_hdregion, 32); 4126 value &= MAKE_64BIT_MASK(0, rmax); 4127 4128 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4129 4130 /* Register alias is only valid for first 32 indexes */ 4131 for (n = 0; n < rmax; ++n) { 4132 bit = extract32(value, n, 1); 4133 env->pmsav8.hprlar[n] = deposit32( 4134 env->pmsav8.hprlar[n], 0, 1, bit); 4135 } 4136 } 4137 4138 static uint64_t hprenr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4139 { 4140 uint32_t n; 4141 uint32_t result = 0x0; 4142 ARMCPU *cpu = env_archcpu(env); 4143 4144 /* Register alias is only valid for first 32 indexes */ 4145 for (n = 0; n < MIN(cpu->pmsav8r_hdregion, 32); ++n) { 4146 if (env->pmsav8.hprlar[n] & 0x1) { 4147 result |= (0x1 << n); 4148 } 4149 } 4150 return result; 4151 } 4152 4153 static void hprselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4154 uint64_t value) 4155 { 4156 ARMCPU *cpu = env_archcpu(env); 4157 4158 /* 4159 * Ignore writes that would select not implemented region. 4160 * This is architecturally UNPREDICTABLE. 4161 */ 4162 if (value >= cpu->pmsav8r_hdregion) { 4163 return; 4164 } 4165 4166 env->pmsav8.hprselr = value; 4167 } 4168 4169 static void pmsav8r_regn_write(CPUARMState *env, const ARMCPRegInfo *ri, 4170 uint64_t value) 4171 { 4172 ARMCPU *cpu = env_archcpu(env); 4173 uint8_t index = (extract32(ri->opc0, 0, 1) << 4) | 4174 (extract32(ri->crm, 0, 3) << 1) | extract32(ri->opc2, 2, 1); 4175 4176 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4177 4178 if (ri->opc1 & 4) { 4179 if (index >= cpu->pmsav8r_hdregion) { 4180 return; 4181 } 4182 if (ri->opc2 & 0x1) { 4183 env->pmsav8.hprlar[index] = value; 4184 } else { 4185 env->pmsav8.hprbar[index] = value; 4186 } 4187 } else { 4188 if (index >= cpu->pmsav7_dregion) { 4189 return; 4190 } 4191 if (ri->opc2 & 0x1) { 4192 env->pmsav8.rlar[M_REG_NS][index] = value; 4193 } else { 4194 env->pmsav8.rbar[M_REG_NS][index] = value; 4195 } 4196 } 4197 } 4198 4199 static uint64_t pmsav8r_regn_read(CPUARMState *env, const ARMCPRegInfo *ri) 4200 { 4201 ARMCPU *cpu = env_archcpu(env); 4202 uint8_t index = (extract32(ri->opc0, 0, 1) << 4) | 4203 (extract32(ri->crm, 0, 3) << 1) | extract32(ri->opc2, 2, 1); 4204 4205 if (ri->opc1 & 4) { 4206 if (index >= cpu->pmsav8r_hdregion) { 4207 return 0x0; 4208 } 4209 if (ri->opc2 & 0x1) { 4210 return env->pmsav8.hprlar[index]; 4211 } else { 4212 return env->pmsav8.hprbar[index]; 4213 } 4214 } else { 4215 if (index >= cpu->pmsav7_dregion) { 4216 return 0x0; 4217 } 4218 if (ri->opc2 & 0x1) { 4219 return env->pmsav8.rlar[M_REG_NS][index]; 4220 } else { 4221 return env->pmsav8.rbar[M_REG_NS][index]; 4222 } 4223 } 4224 } 4225 4226 static const ARMCPRegInfo pmsav8r_cp_reginfo[] = { 4227 { .name = "PRBAR", 4228 .cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 0, 4229 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4230 .accessfn = access_tvm_trvm, 4231 .readfn = prbar_read, .writefn = prbar_write }, 4232 { .name = "PRLAR", 4233 .cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 1, 4234 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4235 .accessfn = access_tvm_trvm, 4236 .readfn = prlar_read, .writefn = prlar_write }, 4237 { .name = "PRSELR", .resetvalue = 0, 4238 .cp = 15, .opc1 = 0, .crn = 6, .crm = 2, .opc2 = 1, 4239 .access = PL1_RW, .accessfn = access_tvm_trvm, 4240 .writefn = prselr_write, 4241 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]) }, 4242 { .name = "HPRBAR", .resetvalue = 0, 4243 .cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 0, 4244 .access = PL2_RW, .type = ARM_CP_NO_RAW, 4245 .readfn = hprbar_read, .writefn = hprbar_write }, 4246 { .name = "HPRLAR", 4247 .cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 1, 4248 .access = PL2_RW, .type = ARM_CP_NO_RAW, 4249 .readfn = hprlar_read, .writefn = hprlar_write }, 4250 { .name = "HPRSELR", .resetvalue = 0, 4251 .cp = 15, .opc1 = 4, .crn = 6, .crm = 2, .opc2 = 1, 4252 .access = PL2_RW, 4253 .writefn = hprselr_write, 4254 .fieldoffset = offsetof(CPUARMState, pmsav8.hprselr) }, 4255 { .name = "HPRENR", 4256 .cp = 15, .opc1 = 4, .crn = 6, .crm = 1, .opc2 = 1, 4257 .access = PL2_RW, .type = ARM_CP_NO_RAW, 4258 .readfn = hprenr_read, .writefn = hprenr_write }, 4259 }; 4260 4261 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 4262 /* 4263 * Reset for all these registers is handled in arm_cpu_reset(), 4264 * because the PMSAv7 is also used by M-profile CPUs, which do 4265 * not register cpregs but still need the state to be reset. 4266 */ 4267 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 4268 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4269 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 4270 .readfn = pmsav7_read, .writefn = pmsav7_write, 4271 .resetfn = arm_cp_reset_ignore }, 4272 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 4273 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4274 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 4275 .readfn = pmsav7_read, .writefn = pmsav7_write, 4276 .resetfn = arm_cp_reset_ignore }, 4277 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 4278 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4279 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 4280 .readfn = pmsav7_read, .writefn = pmsav7_write, 4281 .resetfn = arm_cp_reset_ignore }, 4282 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 4283 .access = PL1_RW, 4284 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 4285 .writefn = pmsav7_rgnr_write, 4286 .resetfn = arm_cp_reset_ignore }, 4287 }; 4288 4289 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 4290 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 4291 .access = PL1_RW, .type = ARM_CP_ALIAS, 4292 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 4293 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 4294 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 4295 .access = PL1_RW, .type = ARM_CP_ALIAS, 4296 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 4297 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 4298 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 4299 .access = PL1_RW, 4300 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 4301 .resetvalue = 0, }, 4302 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 4303 .access = PL1_RW, 4304 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 4305 .resetvalue = 0, }, 4306 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 4307 .access = PL1_RW, 4308 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 4309 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 4310 .access = PL1_RW, 4311 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 4312 /* Protection region base and size registers */ 4313 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 4314 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4315 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 4316 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 4317 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4318 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 4319 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 4320 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4321 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 4322 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 4323 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4324 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 4325 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 4326 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4327 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 4328 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 4329 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4330 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 4331 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 4332 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4333 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 4334 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 4335 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4336 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 4337 }; 4338 4339 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4340 uint64_t value) 4341 { 4342 ARMCPU *cpu = env_archcpu(env); 4343 4344 if (!arm_feature(env, ARM_FEATURE_V8)) { 4345 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 4346 /* 4347 * Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 4348 * using Long-descriptor translation table format 4349 */ 4350 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 4351 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 4352 /* 4353 * In an implementation that includes the Security Extensions 4354 * TTBCR has additional fields PD0 [4] and PD1 [5] for 4355 * Short-descriptor translation table format. 4356 */ 4357 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 4358 } else { 4359 value &= TTBCR_N; 4360 } 4361 } 4362 4363 if (arm_feature(env, ARM_FEATURE_LPAE)) { 4364 /* 4365 * With LPAE the TTBCR could result in a change of ASID 4366 * via the TTBCR.A1 bit, so do a TLB flush. 4367 */ 4368 tlb_flush(CPU(cpu)); 4369 } 4370 raw_write(env, ri, value); 4371 } 4372 4373 static void vmsa_tcr_el12_write(CPUARMState *env, const ARMCPRegInfo *ri, 4374 uint64_t value) 4375 { 4376 ARMCPU *cpu = env_archcpu(env); 4377 4378 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 4379 tlb_flush(CPU(cpu)); 4380 raw_write(env, ri, value); 4381 } 4382 4383 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4384 uint64_t value) 4385 { 4386 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 4387 if (cpreg_field_is_64bit(ri) && 4388 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 4389 ARMCPU *cpu = env_archcpu(env); 4390 tlb_flush(CPU(cpu)); 4391 } 4392 raw_write(env, ri, value); 4393 } 4394 4395 static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4396 uint64_t value) 4397 { 4398 /* 4399 * If we are running with E2&0 regime, then an ASID is active. 4400 * Flush if that might be changing. Note we're not checking 4401 * TCR_EL2.A1 to know if this is really the TTBRx_EL2 that 4402 * holds the active ASID, only checking the field that might. 4403 */ 4404 if (extract64(raw_read(env, ri) ^ value, 48, 16) && 4405 (arm_hcr_el2_eff(env) & HCR_E2H)) { 4406 uint16_t mask = ARMMMUIdxBit_E20_2 | 4407 ARMMMUIdxBit_E20_2_PAN | 4408 ARMMMUIdxBit_E20_0; 4409 tlb_flush_by_mmuidx(env_cpu(env), mask); 4410 } 4411 raw_write(env, ri, value); 4412 } 4413 4414 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4415 uint64_t value) 4416 { 4417 ARMCPU *cpu = env_archcpu(env); 4418 CPUState *cs = CPU(cpu); 4419 4420 /* 4421 * A change in VMID to the stage2 page table (Stage2) invalidates 4422 * the stage2 and combined stage 1&2 tlbs (EL10_1 and EL10_0). 4423 */ 4424 if (extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 4425 tlb_flush_by_mmuidx(cs, alle1_tlbmask(env)); 4426 } 4427 raw_write(env, ri, value); 4428 } 4429 4430 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 4431 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 4432 .access = PL1_RW, .accessfn = access_tvm_trvm, .type = ARM_CP_ALIAS, 4433 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 4434 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 4435 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 4436 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 4437 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 4438 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 4439 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 4440 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 4441 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 4442 offsetof(CPUARMState, cp15.dfar_ns) } }, 4443 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 4444 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 4445 .access = PL1_RW, .accessfn = access_tvm_trvm, 4446 .fgt = FGT_FAR_EL1, 4447 .nv2_redirect_offset = 0x220 | NV2_REDIR_NV1, 4448 .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 4449 .resetvalue = 0, }, 4450 }; 4451 4452 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 4453 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 4454 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 4455 .access = PL1_RW, .accessfn = access_tvm_trvm, 4456 .fgt = FGT_ESR_EL1, 4457 .nv2_redirect_offset = 0x138 | NV2_REDIR_NV1, 4458 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 4459 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 4460 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 4461 .access = PL1_RW, .accessfn = access_tvm_trvm, 4462 .fgt = FGT_TTBR0_EL1, 4463 .nv2_redirect_offset = 0x200 | NV2_REDIR_NV1, 4464 .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write, 4465 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 4466 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 4467 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 4468 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 4469 .access = PL1_RW, .accessfn = access_tvm_trvm, 4470 .fgt = FGT_TTBR1_EL1, 4471 .nv2_redirect_offset = 0x210 | NV2_REDIR_NV1, 4472 .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write, 4473 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 4474 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 4475 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 4476 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 4477 .access = PL1_RW, .accessfn = access_tvm_trvm, 4478 .fgt = FGT_TCR_EL1, 4479 .nv2_redirect_offset = 0x120 | NV2_REDIR_NV1, 4480 .writefn = vmsa_tcr_el12_write, 4481 .raw_writefn = raw_write, 4482 .resetvalue = 0, 4483 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 4484 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 4485 .access = PL1_RW, .accessfn = access_tvm_trvm, 4486 .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 4487 .raw_writefn = raw_write, 4488 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 4489 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 4490 }; 4491 4492 /* 4493 * Note that unlike TTBCR, writing to TTBCR2 does not require flushing 4494 * qemu tlbs nor adjusting cached masks. 4495 */ 4496 static const ARMCPRegInfo ttbcr2_reginfo = { 4497 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 4498 .access = PL1_RW, .accessfn = access_tvm_trvm, 4499 .type = ARM_CP_ALIAS, 4500 .bank_fieldoffsets = { 4501 offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 4502 offsetofhigh32(CPUARMState, cp15.tcr_el[1]), 4503 }, 4504 }; 4505 4506 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 4507 uint64_t value) 4508 { 4509 env->cp15.c15_ticonfig = value & 0xe7; 4510 /* The OS_TYPE bit in this register changes the reported CPUID! */ 4511 env->cp15.c0_cpuid = (value & (1 << 5)) ? 4512 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 4513 } 4514 4515 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 4516 uint64_t value) 4517 { 4518 env->cp15.c15_threadid = value & 0xffff; 4519 } 4520 4521 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 4522 uint64_t value) 4523 { 4524 /* Wait-for-interrupt (deprecated) */ 4525 cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT); 4526 } 4527 4528 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 4529 uint64_t value) 4530 { 4531 /* 4532 * On OMAP there are registers indicating the max/min index of dcache lines 4533 * containing a dirty line; cache flush operations have to reset these. 4534 */ 4535 env->cp15.c15_i_max = 0x000; 4536 env->cp15.c15_i_min = 0xff0; 4537 } 4538 4539 static const ARMCPRegInfo omap_cp_reginfo[] = { 4540 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 4541 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 4542 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 4543 .resetvalue = 0, }, 4544 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 4545 .access = PL1_RW, .type = ARM_CP_NOP }, 4546 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 4547 .access = PL1_RW, 4548 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 4549 .writefn = omap_ticonfig_write }, 4550 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 4551 .access = PL1_RW, 4552 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 4553 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 4554 .access = PL1_RW, .resetvalue = 0xff0, 4555 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 4556 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 4557 .access = PL1_RW, 4558 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 4559 .writefn = omap_threadid_write }, 4560 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 4561 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 4562 .type = ARM_CP_NO_RAW, 4563 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 4564 /* 4565 * TODO: Peripheral port remap register: 4566 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 4567 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 4568 * when MMU is off. 4569 */ 4570 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 4571 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 4572 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 4573 .writefn = omap_cachemaint_write }, 4574 { .name = "C9", .cp = 15, .crn = 9, 4575 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 4576 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 4577 }; 4578 4579 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4580 uint64_t value) 4581 { 4582 env->cp15.c15_cpar = value & 0x3fff; 4583 } 4584 4585 static const ARMCPRegInfo xscale_cp_reginfo[] = { 4586 { .name = "XSCALE_CPAR", 4587 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 4588 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 4589 .writefn = xscale_cpar_write, }, 4590 { .name = "XSCALE_AUXCR", 4591 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 4592 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 4593 .resetvalue = 0, }, 4594 /* 4595 * XScale specific cache-lockdown: since we have no cache we NOP these 4596 * and hope the guest does not really rely on cache behaviour. 4597 */ 4598 { .name = "XSCALE_LOCK_ICACHE_LINE", 4599 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 4600 .access = PL1_W, .type = ARM_CP_NOP }, 4601 { .name = "XSCALE_UNLOCK_ICACHE", 4602 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 4603 .access = PL1_W, .type = ARM_CP_NOP }, 4604 { .name = "XSCALE_DCACHE_LOCK", 4605 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 4606 .access = PL1_RW, .type = ARM_CP_NOP }, 4607 { .name = "XSCALE_UNLOCK_DCACHE", 4608 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 4609 .access = PL1_W, .type = ARM_CP_NOP }, 4610 }; 4611 4612 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 4613 /* 4614 * RAZ/WI the whole crn=15 space, when we don't have a more specific 4615 * implementation of this implementation-defined space. 4616 * Ideally this should eventually disappear in favour of actually 4617 * implementing the correct behaviour for all cores. 4618 */ 4619 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 4620 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4621 .access = PL1_RW, 4622 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 4623 .resetvalue = 0 }, 4624 }; 4625 4626 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 4627 /* Cache status: RAZ because we have no cache so it's always clean */ 4628 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 4629 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4630 .resetvalue = 0 }, 4631 }; 4632 4633 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 4634 /* We never have a block transfer operation in progress */ 4635 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 4636 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4637 .resetvalue = 0 }, 4638 /* The cache ops themselves: these all NOP for QEMU */ 4639 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 4640 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4641 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 4642 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4643 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 4644 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4645 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 4646 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4647 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 4648 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4649 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 4650 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4651 }; 4652 4653 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 4654 /* 4655 * The cache test-and-clean instructions always return (1 << 30) 4656 * to indicate that there are no dirty cache lines. 4657 */ 4658 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 4659 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4660 .resetvalue = (1 << 30) }, 4661 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 4662 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4663 .resetvalue = (1 << 30) }, 4664 }; 4665 4666 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 4667 /* Ignore ReadBuffer accesses */ 4668 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 4669 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4670 .access = PL1_RW, .resetvalue = 0, 4671 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 4672 }; 4673 4674 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4675 { 4676 unsigned int cur_el = arm_current_el(env); 4677 4678 if (arm_is_el2_enabled(env) && cur_el == 1) { 4679 return env->cp15.vpidr_el2; 4680 } 4681 return raw_read(env, ri); 4682 } 4683 4684 static uint64_t mpidr_read_val(CPUARMState *env) 4685 { 4686 ARMCPU *cpu = env_archcpu(env); 4687 uint64_t mpidr = cpu->mp_affinity; 4688 4689 if (arm_feature(env, ARM_FEATURE_V7MP)) { 4690 mpidr |= (1U << 31); 4691 /* 4692 * Cores which are uniprocessor (non-coherent) 4693 * but still implement the MP extensions set 4694 * bit 30. (For instance, Cortex-R5). 4695 */ 4696 if (cpu->mp_is_up) { 4697 mpidr |= (1u << 30); 4698 } 4699 } 4700 return mpidr; 4701 } 4702 4703 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4704 { 4705 unsigned int cur_el = arm_current_el(env); 4706 4707 if (arm_is_el2_enabled(env) && cur_el == 1) { 4708 return env->cp15.vmpidr_el2; 4709 } 4710 return mpidr_read_val(env); 4711 } 4712 4713 static const ARMCPRegInfo lpae_cp_reginfo[] = { 4714 /* NOP AMAIR0/1 */ 4715 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 4716 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 4717 .access = PL1_RW, .accessfn = access_tvm_trvm, 4718 .fgt = FGT_AMAIR_EL1, 4719 .nv2_redirect_offset = 0x148 | NV2_REDIR_NV1, 4720 .type = ARM_CP_CONST, .resetvalue = 0 }, 4721 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 4722 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 4723 .access = PL1_RW, .accessfn = access_tvm_trvm, 4724 .type = ARM_CP_CONST, .resetvalue = 0 }, 4725 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 4726 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 4727 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 4728 offsetof(CPUARMState, cp15.par_ns)} }, 4729 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 4730 .access = PL1_RW, .accessfn = access_tvm_trvm, 4731 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4732 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 4733 offsetof(CPUARMState, cp15.ttbr0_ns) }, 4734 .writefn = vmsa_ttbr_write, .raw_writefn = raw_write }, 4735 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 4736 .access = PL1_RW, .accessfn = access_tvm_trvm, 4737 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4738 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 4739 offsetof(CPUARMState, cp15.ttbr1_ns) }, 4740 .writefn = vmsa_ttbr_write, .raw_writefn = raw_write }, 4741 }; 4742 4743 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4744 { 4745 return vfp_get_fpcr(env); 4746 } 4747 4748 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4749 uint64_t value) 4750 { 4751 vfp_set_fpcr(env, value); 4752 } 4753 4754 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4755 { 4756 return vfp_get_fpsr(env); 4757 } 4758 4759 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4760 uint64_t value) 4761 { 4762 vfp_set_fpsr(env, value); 4763 } 4764 4765 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 4766 bool isread) 4767 { 4768 if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UMA)) { 4769 return CP_ACCESS_TRAP; 4770 } 4771 return CP_ACCESS_OK; 4772 } 4773 4774 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 4775 uint64_t value) 4776 { 4777 env->daif = value & PSTATE_DAIF; 4778 } 4779 4780 static uint64_t aa64_pan_read(CPUARMState *env, const ARMCPRegInfo *ri) 4781 { 4782 return env->pstate & PSTATE_PAN; 4783 } 4784 4785 static void aa64_pan_write(CPUARMState *env, const ARMCPRegInfo *ri, 4786 uint64_t value) 4787 { 4788 env->pstate = (env->pstate & ~PSTATE_PAN) | (value & PSTATE_PAN); 4789 } 4790 4791 static const ARMCPRegInfo pan_reginfo = { 4792 .name = "PAN", .state = ARM_CP_STATE_AA64, 4793 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 3, 4794 .type = ARM_CP_NO_RAW, .access = PL1_RW, 4795 .readfn = aa64_pan_read, .writefn = aa64_pan_write 4796 }; 4797 4798 static uint64_t aa64_uao_read(CPUARMState *env, const ARMCPRegInfo *ri) 4799 { 4800 return env->pstate & PSTATE_UAO; 4801 } 4802 4803 static void aa64_uao_write(CPUARMState *env, const ARMCPRegInfo *ri, 4804 uint64_t value) 4805 { 4806 env->pstate = (env->pstate & ~PSTATE_UAO) | (value & PSTATE_UAO); 4807 } 4808 4809 static const ARMCPRegInfo uao_reginfo = { 4810 .name = "UAO", .state = ARM_CP_STATE_AA64, 4811 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 4, 4812 .type = ARM_CP_NO_RAW, .access = PL1_RW, 4813 .readfn = aa64_uao_read, .writefn = aa64_uao_write 4814 }; 4815 4816 static uint64_t aa64_dit_read(CPUARMState *env, const ARMCPRegInfo *ri) 4817 { 4818 return env->pstate & PSTATE_DIT; 4819 } 4820 4821 static void aa64_dit_write(CPUARMState *env, const ARMCPRegInfo *ri, 4822 uint64_t value) 4823 { 4824 env->pstate = (env->pstate & ~PSTATE_DIT) | (value & PSTATE_DIT); 4825 } 4826 4827 static const ARMCPRegInfo dit_reginfo = { 4828 .name = "DIT", .state = ARM_CP_STATE_AA64, 4829 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 5, 4830 .type = ARM_CP_NO_RAW, .access = PL0_RW, 4831 .readfn = aa64_dit_read, .writefn = aa64_dit_write 4832 }; 4833 4834 static uint64_t aa64_ssbs_read(CPUARMState *env, const ARMCPRegInfo *ri) 4835 { 4836 return env->pstate & PSTATE_SSBS; 4837 } 4838 4839 static void aa64_ssbs_write(CPUARMState *env, const ARMCPRegInfo *ri, 4840 uint64_t value) 4841 { 4842 env->pstate = (env->pstate & ~PSTATE_SSBS) | (value & PSTATE_SSBS); 4843 } 4844 4845 static const ARMCPRegInfo ssbs_reginfo = { 4846 .name = "SSBS", .state = ARM_CP_STATE_AA64, 4847 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 6, 4848 .type = ARM_CP_NO_RAW, .access = PL0_RW, 4849 .readfn = aa64_ssbs_read, .writefn = aa64_ssbs_write 4850 }; 4851 4852 static CPAccessResult aa64_cacheop_poc_access(CPUARMState *env, 4853 const ARMCPRegInfo *ri, 4854 bool isread) 4855 { 4856 /* Cache invalidate/clean to Point of Coherency or Persistence... */ 4857 switch (arm_current_el(env)) { 4858 case 0: 4859 /* ... EL0 must UNDEF unless SCTLR_EL1.UCI is set. */ 4860 if (!(arm_sctlr(env, 0) & SCTLR_UCI)) { 4861 return CP_ACCESS_TRAP; 4862 } 4863 /* fall through */ 4864 case 1: 4865 /* ... EL1 must trap to EL2 if HCR_EL2.TPCP is set. */ 4866 if (arm_hcr_el2_eff(env) & HCR_TPCP) { 4867 return CP_ACCESS_TRAP_EL2; 4868 } 4869 break; 4870 } 4871 return CP_ACCESS_OK; 4872 } 4873 4874 static CPAccessResult do_cacheop_pou_access(CPUARMState *env, uint64_t hcrflags) 4875 { 4876 /* Cache invalidate/clean to Point of Unification... */ 4877 switch (arm_current_el(env)) { 4878 case 0: 4879 /* ... EL0 must UNDEF unless SCTLR_EL1.UCI is set. */ 4880 if (!(arm_sctlr(env, 0) & SCTLR_UCI)) { 4881 return CP_ACCESS_TRAP; 4882 } 4883 /* fall through */ 4884 case 1: 4885 /* ... EL1 must trap to EL2 if relevant HCR_EL2 flags are set. */ 4886 if (arm_hcr_el2_eff(env) & hcrflags) { 4887 return CP_ACCESS_TRAP_EL2; 4888 } 4889 break; 4890 } 4891 return CP_ACCESS_OK; 4892 } 4893 4894 static CPAccessResult access_ticab(CPUARMState *env, const ARMCPRegInfo *ri, 4895 bool isread) 4896 { 4897 return do_cacheop_pou_access(env, HCR_TICAB | HCR_TPU); 4898 } 4899 4900 static CPAccessResult access_tocu(CPUARMState *env, const ARMCPRegInfo *ri, 4901 bool isread) 4902 { 4903 return do_cacheop_pou_access(env, HCR_TOCU | HCR_TPU); 4904 } 4905 4906 /* 4907 * See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 4908 * Page D4-1736 (DDI0487A.b) 4909 */ 4910 4911 static int vae1_tlbmask(CPUARMState *env) 4912 { 4913 uint64_t hcr = arm_hcr_el2_eff(env); 4914 uint16_t mask; 4915 4916 assert(arm_feature(env, ARM_FEATURE_AARCH64)); 4917 4918 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 4919 mask = ARMMMUIdxBit_E20_2 | 4920 ARMMMUIdxBit_E20_2_PAN | 4921 ARMMMUIdxBit_E20_0; 4922 } else { 4923 /* This is AArch64 only, so we don't need to touch the EL30_x TLBs */ 4924 mask = ARMMMUIdxBit_E10_1 | 4925 ARMMMUIdxBit_E10_1_PAN | 4926 ARMMMUIdxBit_E10_0; 4927 } 4928 return mask; 4929 } 4930 4931 static int vae2_tlbmask(CPUARMState *env) 4932 { 4933 uint64_t hcr = arm_hcr_el2_eff(env); 4934 uint16_t mask; 4935 4936 if (hcr & HCR_E2H) { 4937 mask = ARMMMUIdxBit_E20_2 | 4938 ARMMMUIdxBit_E20_2_PAN | 4939 ARMMMUIdxBit_E20_0; 4940 } else { 4941 mask = ARMMMUIdxBit_E2; 4942 } 4943 return mask; 4944 } 4945 4946 /* Return 56 if TBI is enabled, 64 otherwise. */ 4947 static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx, 4948 uint64_t addr) 4949 { 4950 uint64_t tcr = regime_tcr(env, mmu_idx); 4951 int tbi = aa64_va_parameter_tbi(tcr, mmu_idx); 4952 int select = extract64(addr, 55, 1); 4953 4954 return (tbi >> select) & 1 ? 56 : 64; 4955 } 4956 4957 static int vae1_tlbbits(CPUARMState *env, uint64_t addr) 4958 { 4959 uint64_t hcr = arm_hcr_el2_eff(env); 4960 ARMMMUIdx mmu_idx; 4961 4962 assert(arm_feature(env, ARM_FEATURE_AARCH64)); 4963 4964 /* Only the regime of the mmu_idx below is significant. */ 4965 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 4966 mmu_idx = ARMMMUIdx_E20_0; 4967 } else { 4968 mmu_idx = ARMMMUIdx_E10_0; 4969 } 4970 4971 return tlbbits_for_regime(env, mmu_idx, addr); 4972 } 4973 4974 static int vae2_tlbbits(CPUARMState *env, uint64_t addr) 4975 { 4976 uint64_t hcr = arm_hcr_el2_eff(env); 4977 ARMMMUIdx mmu_idx; 4978 4979 /* 4980 * Only the regime of the mmu_idx below is significant. 4981 * Regime EL2&0 has two ranges with separate TBI configuration, while EL2 4982 * only has one. 4983 */ 4984 if (hcr & HCR_E2H) { 4985 mmu_idx = ARMMMUIdx_E20_2; 4986 } else { 4987 mmu_idx = ARMMMUIdx_E2; 4988 } 4989 4990 return tlbbits_for_regime(env, mmu_idx, addr); 4991 } 4992 4993 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4994 uint64_t value) 4995 { 4996 CPUState *cs = env_cpu(env); 4997 int mask = vae1_tlbmask(env); 4998 4999 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 5000 } 5001 5002 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 5003 uint64_t value) 5004 { 5005 CPUState *cs = env_cpu(env); 5006 int mask = vae1_tlbmask(env); 5007 5008 if (tlb_force_broadcast(env)) { 5009 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 5010 } else { 5011 tlb_flush_by_mmuidx(cs, mask); 5012 } 5013 } 5014 5015 static int e2_tlbmask(CPUARMState *env) 5016 { 5017 return (ARMMMUIdxBit_E20_0 | 5018 ARMMMUIdxBit_E20_2 | 5019 ARMMMUIdxBit_E20_2_PAN | 5020 ARMMMUIdxBit_E2); 5021 } 5022 5023 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 5024 uint64_t value) 5025 { 5026 CPUState *cs = env_cpu(env); 5027 int mask = alle1_tlbmask(env); 5028 5029 tlb_flush_by_mmuidx(cs, mask); 5030 } 5031 5032 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 5033 uint64_t value) 5034 { 5035 CPUState *cs = env_cpu(env); 5036 int mask = e2_tlbmask(env); 5037 5038 tlb_flush_by_mmuidx(cs, mask); 5039 } 5040 5041 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 5042 uint64_t value) 5043 { 5044 ARMCPU *cpu = env_archcpu(env); 5045 CPUState *cs = CPU(cpu); 5046 5047 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E3); 5048 } 5049 5050 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 5051 uint64_t value) 5052 { 5053 CPUState *cs = env_cpu(env); 5054 int mask = alle1_tlbmask(env); 5055 5056 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 5057 } 5058 5059 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 5060 uint64_t value) 5061 { 5062 CPUState *cs = env_cpu(env); 5063 int mask = e2_tlbmask(env); 5064 5065 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 5066 } 5067 5068 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 5069 uint64_t value) 5070 { 5071 CPUState *cs = env_cpu(env); 5072 5073 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E3); 5074 } 5075 5076 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 5077 uint64_t value) 5078 { 5079 /* 5080 * Invalidate by VA, EL2 5081 * Currently handles both VAE2 and VALE2, since we don't support 5082 * flush-last-level-only. 5083 */ 5084 CPUState *cs = env_cpu(env); 5085 int mask = vae2_tlbmask(env); 5086 uint64_t pageaddr = sextract64(value << 12, 0, 56); 5087 int bits = vae2_tlbbits(env, pageaddr); 5088 5089 tlb_flush_page_bits_by_mmuidx(cs, pageaddr, mask, bits); 5090 } 5091 5092 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 5093 uint64_t value) 5094 { 5095 /* 5096 * Invalidate by VA, EL3 5097 * Currently handles both VAE3 and VALE3, since we don't support 5098 * flush-last-level-only. 5099 */ 5100 ARMCPU *cpu = env_archcpu(env); 5101 CPUState *cs = CPU(cpu); 5102 uint64_t pageaddr = sextract64(value << 12, 0, 56); 5103 5104 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E3); 5105 } 5106 5107 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 5108 uint64_t value) 5109 { 5110 CPUState *cs = env_cpu(env); 5111 int mask = vae1_tlbmask(env); 5112 uint64_t pageaddr = sextract64(value << 12, 0, 56); 5113 int bits = vae1_tlbbits(env, pageaddr); 5114 5115 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits); 5116 } 5117 5118 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 5119 uint64_t value) 5120 { 5121 /* 5122 * Invalidate by VA, EL1&0 (AArch64 version). 5123 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 5124 * since we don't support flush-for-specific-ASID-only or 5125 * flush-last-level-only. 5126 */ 5127 CPUState *cs = env_cpu(env); 5128 int mask = vae1_tlbmask(env); 5129 uint64_t pageaddr = sextract64(value << 12, 0, 56); 5130 int bits = vae1_tlbbits(env, pageaddr); 5131 5132 if (tlb_force_broadcast(env)) { 5133 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits); 5134 } else { 5135 tlb_flush_page_bits_by_mmuidx(cs, pageaddr, mask, bits); 5136 } 5137 } 5138 5139 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 5140 uint64_t value) 5141 { 5142 CPUState *cs = env_cpu(env); 5143 int mask = vae2_tlbmask(env); 5144 uint64_t pageaddr = sextract64(value << 12, 0, 56); 5145 int bits = vae2_tlbbits(env, pageaddr); 5146 5147 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits); 5148 } 5149 5150 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 5151 uint64_t value) 5152 { 5153 CPUState *cs = env_cpu(env); 5154 uint64_t pageaddr = sextract64(value << 12, 0, 56); 5155 int bits = tlbbits_for_regime(env, ARMMMUIdx_E3, pageaddr); 5156 5157 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, 5158 ARMMMUIdxBit_E3, bits); 5159 } 5160 5161 static int ipas2e1_tlbmask(CPUARMState *env, int64_t value) 5162 { 5163 /* 5164 * The MSB of value is the NS field, which only applies if SEL2 5165 * is implemented and SCR_EL3.NS is not set (i.e. in secure mode). 5166 */ 5167 return (value >= 0 5168 && cpu_isar_feature(aa64_sel2, env_archcpu(env)) 5169 && arm_is_secure_below_el3(env) 5170 ? ARMMMUIdxBit_Stage2_S 5171 : ARMMMUIdxBit_Stage2); 5172 } 5173 5174 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 5175 uint64_t value) 5176 { 5177 CPUState *cs = env_cpu(env); 5178 int mask = ipas2e1_tlbmask(env, value); 5179 uint64_t pageaddr = sextract64(value << 12, 0, 56); 5180 5181 if (tlb_force_broadcast(env)) { 5182 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask); 5183 } else { 5184 tlb_flush_page_by_mmuidx(cs, pageaddr, mask); 5185 } 5186 } 5187 5188 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 5189 uint64_t value) 5190 { 5191 CPUState *cs = env_cpu(env); 5192 int mask = ipas2e1_tlbmask(env, value); 5193 uint64_t pageaddr = sextract64(value << 12, 0, 56); 5194 5195 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask); 5196 } 5197 5198 #ifdef TARGET_AARCH64 5199 typedef struct { 5200 uint64_t base; 5201 uint64_t length; 5202 } TLBIRange; 5203 5204 static ARMGranuleSize tlbi_range_tg_to_gran_size(int tg) 5205 { 5206 /* 5207 * Note that the TLBI range TG field encoding differs from both 5208 * TG0 and TG1 encodings. 5209 */ 5210 switch (tg) { 5211 case 1: 5212 return Gran4K; 5213 case 2: 5214 return Gran16K; 5215 case 3: 5216 return Gran64K; 5217 default: 5218 return GranInvalid; 5219 } 5220 } 5221 5222 static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx, 5223 uint64_t value) 5224 { 5225 unsigned int page_size_granule, page_shift, num, scale, exponent; 5226 /* Extract one bit to represent the va selector in use. */ 5227 uint64_t select = sextract64(value, 36, 1); 5228 ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true, false); 5229 TLBIRange ret = { }; 5230 ARMGranuleSize gran; 5231 5232 page_size_granule = extract64(value, 46, 2); 5233 gran = tlbi_range_tg_to_gran_size(page_size_granule); 5234 5235 /* The granule encoded in value must match the granule in use. */ 5236 if (gran != param.gran) { 5237 qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n", 5238 page_size_granule); 5239 return ret; 5240 } 5241 5242 page_shift = arm_granule_bits(gran); 5243 num = extract64(value, 39, 5); 5244 scale = extract64(value, 44, 2); 5245 exponent = (5 * scale) + 1; 5246 5247 ret.length = (num + 1) << (exponent + page_shift); 5248 5249 if (param.select) { 5250 ret.base = sextract64(value, 0, 37); 5251 } else { 5252 ret.base = extract64(value, 0, 37); 5253 } 5254 if (param.ds) { 5255 /* 5256 * With DS=1, BaseADDR is always shifted 16 so that it is able 5257 * to address all 52 va bits. The input address is perforce 5258 * aligned on a 64k boundary regardless of translation granule. 5259 */ 5260 page_shift = 16; 5261 } 5262 ret.base <<= page_shift; 5263 5264 return ret; 5265 } 5266 5267 static void do_rvae_write(CPUARMState *env, uint64_t value, 5268 int idxmap, bool synced) 5269 { 5270 ARMMMUIdx one_idx = ARM_MMU_IDX_A | ctz32(idxmap); 5271 TLBIRange range; 5272 int bits; 5273 5274 range = tlbi_aa64_get_range(env, one_idx, value); 5275 bits = tlbbits_for_regime(env, one_idx, range.base); 5276 5277 if (synced) { 5278 tlb_flush_range_by_mmuidx_all_cpus_synced(env_cpu(env), 5279 range.base, 5280 range.length, 5281 idxmap, 5282 bits); 5283 } else { 5284 tlb_flush_range_by_mmuidx(env_cpu(env), range.base, 5285 range.length, idxmap, bits); 5286 } 5287 } 5288 5289 static void tlbi_aa64_rvae1_write(CPUARMState *env, 5290 const ARMCPRegInfo *ri, 5291 uint64_t value) 5292 { 5293 /* 5294 * Invalidate by VA range, EL1&0. 5295 * Currently handles all of RVAE1, RVAAE1, RVAALE1 and RVALE1, 5296 * since we don't support flush-for-specific-ASID-only or 5297 * flush-last-level-only. 5298 */ 5299 5300 do_rvae_write(env, value, vae1_tlbmask(env), 5301 tlb_force_broadcast(env)); 5302 } 5303 5304 static void tlbi_aa64_rvae1is_write(CPUARMState *env, 5305 const ARMCPRegInfo *ri, 5306 uint64_t value) 5307 { 5308 /* 5309 * Invalidate by VA range, Inner/Outer Shareable EL1&0. 5310 * Currently handles all of RVAE1IS, RVAE1OS, RVAAE1IS, RVAAE1OS, 5311 * RVAALE1IS, RVAALE1OS, RVALE1IS and RVALE1OS, since we don't support 5312 * flush-for-specific-ASID-only, flush-last-level-only or inner/outer 5313 * shareable specific flushes. 5314 */ 5315 5316 do_rvae_write(env, value, vae1_tlbmask(env), true); 5317 } 5318 5319 static void tlbi_aa64_rvae2_write(CPUARMState *env, 5320 const ARMCPRegInfo *ri, 5321 uint64_t value) 5322 { 5323 /* 5324 * Invalidate by VA range, EL2. 5325 * Currently handles all of RVAE2 and RVALE2, 5326 * since we don't support flush-for-specific-ASID-only or 5327 * flush-last-level-only. 5328 */ 5329 5330 do_rvae_write(env, value, vae2_tlbmask(env), 5331 tlb_force_broadcast(env)); 5332 5333 5334 } 5335 5336 static void tlbi_aa64_rvae2is_write(CPUARMState *env, 5337 const ARMCPRegInfo *ri, 5338 uint64_t value) 5339 { 5340 /* 5341 * Invalidate by VA range, Inner/Outer Shareable, EL2. 5342 * Currently handles all of RVAE2IS, RVAE2OS, RVALE2IS and RVALE2OS, 5343 * since we don't support flush-for-specific-ASID-only, 5344 * flush-last-level-only or inner/outer shareable specific flushes. 5345 */ 5346 5347 do_rvae_write(env, value, vae2_tlbmask(env), true); 5348 5349 } 5350 5351 static void tlbi_aa64_rvae3_write(CPUARMState *env, 5352 const ARMCPRegInfo *ri, 5353 uint64_t value) 5354 { 5355 /* 5356 * Invalidate by VA range, EL3. 5357 * Currently handles all of RVAE3 and RVALE3, 5358 * since we don't support flush-for-specific-ASID-only or 5359 * flush-last-level-only. 5360 */ 5361 5362 do_rvae_write(env, value, ARMMMUIdxBit_E3, tlb_force_broadcast(env)); 5363 } 5364 5365 static void tlbi_aa64_rvae3is_write(CPUARMState *env, 5366 const ARMCPRegInfo *ri, 5367 uint64_t value) 5368 { 5369 /* 5370 * Invalidate by VA range, EL3, Inner/Outer Shareable. 5371 * Currently handles all of RVAE3IS, RVAE3OS, RVALE3IS and RVALE3OS, 5372 * since we don't support flush-for-specific-ASID-only, 5373 * flush-last-level-only or inner/outer specific flushes. 5374 */ 5375 5376 do_rvae_write(env, value, ARMMMUIdxBit_E3, true); 5377 } 5378 5379 static void tlbi_aa64_ripas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 5380 uint64_t value) 5381 { 5382 do_rvae_write(env, value, ipas2e1_tlbmask(env, value), 5383 tlb_force_broadcast(env)); 5384 } 5385 5386 static void tlbi_aa64_ripas2e1is_write(CPUARMState *env, 5387 const ARMCPRegInfo *ri, 5388 uint64_t value) 5389 { 5390 do_rvae_write(env, value, ipas2e1_tlbmask(env, value), true); 5391 } 5392 #endif 5393 5394 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 5395 bool isread) 5396 { 5397 int cur_el = arm_current_el(env); 5398 5399 if (cur_el < 2) { 5400 uint64_t hcr = arm_hcr_el2_eff(env); 5401 5402 if (cur_el == 0) { 5403 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 5404 if (!(env->cp15.sctlr_el[2] & SCTLR_DZE)) { 5405 return CP_ACCESS_TRAP_EL2; 5406 } 5407 } else { 5408 if (!(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 5409 return CP_ACCESS_TRAP; 5410 } 5411 if (hcr & HCR_TDZ) { 5412 return CP_ACCESS_TRAP_EL2; 5413 } 5414 } 5415 } else if (hcr & HCR_TDZ) { 5416 return CP_ACCESS_TRAP_EL2; 5417 } 5418 } 5419 return CP_ACCESS_OK; 5420 } 5421 5422 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 5423 { 5424 ARMCPU *cpu = env_archcpu(env); 5425 int dzp_bit = 1 << 4; 5426 5427 /* DZP indicates whether DC ZVA access is allowed */ 5428 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 5429 dzp_bit = 0; 5430 } 5431 return cpu->dcz_blocksize | dzp_bit; 5432 } 5433 5434 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 5435 bool isread) 5436 { 5437 if (!(env->pstate & PSTATE_SP)) { 5438 /* 5439 * Access to SP_EL0 is undefined if it's being used as 5440 * the stack pointer. 5441 */ 5442 return CP_ACCESS_TRAP_UNCATEGORIZED; 5443 } 5444 return CP_ACCESS_OK; 5445 } 5446 5447 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 5448 { 5449 return env->pstate & PSTATE_SP; 5450 } 5451 5452 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 5453 { 5454 update_spsel(env, val); 5455 } 5456 5457 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5458 uint64_t value) 5459 { 5460 ARMCPU *cpu = env_archcpu(env); 5461 5462 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 5463 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 5464 value &= ~SCTLR_M; 5465 } 5466 5467 /* ??? Lots of these bits are not implemented. */ 5468 5469 if (ri->state == ARM_CP_STATE_AA64 && !cpu_isar_feature(aa64_mte, cpu)) { 5470 if (ri->opc1 == 6) { /* SCTLR_EL3 */ 5471 value &= ~(SCTLR_ITFSB | SCTLR_TCF | SCTLR_ATA); 5472 } else { 5473 value &= ~(SCTLR_ITFSB | SCTLR_TCF0 | SCTLR_TCF | 5474 SCTLR_ATA0 | SCTLR_ATA); 5475 } 5476 } 5477 5478 if (raw_read(env, ri) == value) { 5479 /* 5480 * Skip the TLB flush if nothing actually changed; Linux likes 5481 * to do a lot of pointless SCTLR writes. 5482 */ 5483 return; 5484 } 5485 5486 raw_write(env, ri, value); 5487 5488 /* This may enable/disable the MMU, so do a TLB flush. */ 5489 tlb_flush(CPU(cpu)); 5490 5491 if (tcg_enabled() && ri->type & ARM_CP_SUPPRESS_TB_END) { 5492 /* 5493 * Normally we would always end the TB on an SCTLR write; see the 5494 * comment in ARMCPRegInfo sctlr initialization below for why Xscale 5495 * is special. Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild 5496 * of hflags from the translator, so do it here. 5497 */ 5498 arm_rebuild_hflags(env); 5499 } 5500 } 5501 5502 static void mdcr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri, 5503 uint64_t value) 5504 { 5505 /* 5506 * Some MDCR_EL3 bits affect whether PMU counters are running: 5507 * if we are trying to change any of those then we must 5508 * bracket this update with PMU start/finish calls. 5509 */ 5510 bool pmu_op = (env->cp15.mdcr_el3 ^ value) & MDCR_EL3_PMU_ENABLE_BITS; 5511 5512 if (pmu_op) { 5513 pmu_op_start(env); 5514 } 5515 env->cp15.mdcr_el3 = value; 5516 if (pmu_op) { 5517 pmu_op_finish(env); 5518 } 5519 } 5520 5521 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5522 uint64_t value) 5523 { 5524 /* Not all bits defined for MDCR_EL3 exist in the AArch32 SDCR */ 5525 mdcr_el3_write(env, ri, value & SDCR_VALID_MASK); 5526 } 5527 5528 static void mdcr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 5529 uint64_t value) 5530 { 5531 /* 5532 * Some MDCR_EL2 bits affect whether PMU counters are running: 5533 * if we are trying to change any of those then we must 5534 * bracket this update with PMU start/finish calls. 5535 */ 5536 bool pmu_op = (env->cp15.mdcr_el2 ^ value) & MDCR_EL2_PMU_ENABLE_BITS; 5537 5538 if (pmu_op) { 5539 pmu_op_start(env); 5540 } 5541 env->cp15.mdcr_el2 = value; 5542 if (pmu_op) { 5543 pmu_op_finish(env); 5544 } 5545 } 5546 5547 static CPAccessResult access_nv1(CPUARMState *env, const ARMCPRegInfo *ri, 5548 bool isread) 5549 { 5550 if (arm_current_el(env) == 1) { 5551 uint64_t hcr_nv = arm_hcr_el2_eff(env) & (HCR_NV | HCR_NV1 | HCR_NV2); 5552 5553 if (hcr_nv == (HCR_NV | HCR_NV1)) { 5554 return CP_ACCESS_TRAP_EL2; 5555 } 5556 } 5557 return CP_ACCESS_OK; 5558 } 5559 5560 #ifdef CONFIG_USER_ONLY 5561 /* 5562 * `IC IVAU` is handled to improve compatibility with JITs that dual-map their 5563 * code to get around W^X restrictions, where one region is writable and the 5564 * other is executable. 5565 * 5566 * Since the executable region is never written to we cannot detect code 5567 * changes when running in user mode, and rely on the emulated JIT telling us 5568 * that the code has changed by executing this instruction. 5569 */ 5570 static void ic_ivau_write(CPUARMState *env, const ARMCPRegInfo *ri, 5571 uint64_t value) 5572 { 5573 uint64_t icache_line_mask, start_address, end_address; 5574 const ARMCPU *cpu; 5575 5576 cpu = env_archcpu(env); 5577 5578 icache_line_mask = (4 << extract32(cpu->ctr, 0, 4)) - 1; 5579 start_address = value & ~icache_line_mask; 5580 end_address = value | icache_line_mask; 5581 5582 mmap_lock(); 5583 5584 tb_invalidate_phys_range(start_address, end_address); 5585 5586 mmap_unlock(); 5587 } 5588 #endif 5589 5590 static const ARMCPRegInfo v8_cp_reginfo[] = { 5591 /* 5592 * Minimal set of EL0-visible registers. This will need to be expanded 5593 * significantly for system emulation of AArch64 CPUs. 5594 */ 5595 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 5596 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 5597 .access = PL0_RW, .type = ARM_CP_NZCV }, 5598 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 5599 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 5600 .type = ARM_CP_NO_RAW, 5601 .access = PL0_RW, .accessfn = aa64_daif_access, 5602 .fieldoffset = offsetof(CPUARMState, daif), 5603 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 5604 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 5605 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 5606 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 5607 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 5608 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 5609 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 5610 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 5611 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 5612 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 5613 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 5614 .access = PL0_R, .type = ARM_CP_NO_RAW, 5615 .fgt = FGT_DCZID_EL0, 5616 .readfn = aa64_dczid_read }, 5617 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 5618 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 5619 .access = PL0_W, .type = ARM_CP_DC_ZVA, 5620 #ifndef CONFIG_USER_ONLY 5621 /* Avoid overhead of an access check that always passes in user-mode */ 5622 .accessfn = aa64_zva_access, 5623 .fgt = FGT_DCZVA, 5624 #endif 5625 }, 5626 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 5627 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 5628 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 5629 /* 5630 * Instruction cache ops. All of these except `IC IVAU` NOP because we 5631 * don't emulate caches. 5632 */ 5633 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 5634 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 5635 .access = PL1_W, .type = ARM_CP_NOP, 5636 .fgt = FGT_ICIALLUIS, 5637 .accessfn = access_ticab }, 5638 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 5639 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 5640 .access = PL1_W, .type = ARM_CP_NOP, 5641 .fgt = FGT_ICIALLU, 5642 .accessfn = access_tocu }, 5643 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 5644 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 5645 .access = PL0_W, 5646 .fgt = FGT_ICIVAU, 5647 .accessfn = access_tocu, 5648 #ifdef CONFIG_USER_ONLY 5649 .type = ARM_CP_NO_RAW, 5650 .writefn = ic_ivau_write 5651 #else 5652 .type = ARM_CP_NOP 5653 #endif 5654 }, 5655 /* Cache ops: all NOPs since we don't emulate caches */ 5656 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 5657 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 5658 .access = PL1_W, .accessfn = aa64_cacheop_poc_access, 5659 .fgt = FGT_DCIVAC, 5660 .type = ARM_CP_NOP }, 5661 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 5662 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 5663 .fgt = FGT_DCISW, 5664 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5665 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 5666 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 5667 .access = PL0_W, .type = ARM_CP_NOP, 5668 .fgt = FGT_DCCVAC, 5669 .accessfn = aa64_cacheop_poc_access }, 5670 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 5671 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 5672 .fgt = FGT_DCCSW, 5673 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5674 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 5675 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 5676 .access = PL0_W, .type = ARM_CP_NOP, 5677 .fgt = FGT_DCCVAU, 5678 .accessfn = access_tocu }, 5679 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 5680 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 5681 .access = PL0_W, .type = ARM_CP_NOP, 5682 .fgt = FGT_DCCIVAC, 5683 .accessfn = aa64_cacheop_poc_access }, 5684 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 5685 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 5686 .fgt = FGT_DCCISW, 5687 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5688 /* TLBI operations */ 5689 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 5690 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 5691 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5692 .fgt = FGT_TLBIVMALLE1IS, 5693 .writefn = tlbi_aa64_vmalle1is_write }, 5694 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 5695 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 5696 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5697 .fgt = FGT_TLBIVAE1IS, 5698 .writefn = tlbi_aa64_vae1is_write }, 5699 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 5700 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 5701 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5702 .fgt = FGT_TLBIASIDE1IS, 5703 .writefn = tlbi_aa64_vmalle1is_write }, 5704 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 5705 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 5706 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5707 .fgt = FGT_TLBIVAAE1IS, 5708 .writefn = tlbi_aa64_vae1is_write }, 5709 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 5710 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 5711 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5712 .fgt = FGT_TLBIVALE1IS, 5713 .writefn = tlbi_aa64_vae1is_write }, 5714 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 5715 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 5716 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5717 .fgt = FGT_TLBIVAALE1IS, 5718 .writefn = tlbi_aa64_vae1is_write }, 5719 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 5720 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 5721 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5722 .fgt = FGT_TLBIVMALLE1, 5723 .writefn = tlbi_aa64_vmalle1_write }, 5724 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 5725 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 5726 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5727 .fgt = FGT_TLBIVAE1, 5728 .writefn = tlbi_aa64_vae1_write }, 5729 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 5730 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 5731 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5732 .fgt = FGT_TLBIASIDE1, 5733 .writefn = tlbi_aa64_vmalle1_write }, 5734 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 5735 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 5736 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5737 .fgt = FGT_TLBIVAAE1, 5738 .writefn = tlbi_aa64_vae1_write }, 5739 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 5740 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 5741 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5742 .fgt = FGT_TLBIVALE1, 5743 .writefn = tlbi_aa64_vae1_write }, 5744 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 5745 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 5746 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5747 .fgt = FGT_TLBIVAALE1, 5748 .writefn = tlbi_aa64_vae1_write }, 5749 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 5750 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 5751 .access = PL2_W, .type = ARM_CP_NO_RAW, 5752 .writefn = tlbi_aa64_ipas2e1is_write }, 5753 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 5754 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 5755 .access = PL2_W, .type = ARM_CP_NO_RAW, 5756 .writefn = tlbi_aa64_ipas2e1is_write }, 5757 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 5758 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 5759 .access = PL2_W, .type = ARM_CP_NO_RAW, 5760 .writefn = tlbi_aa64_alle1is_write }, 5761 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 5762 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 5763 .access = PL2_W, .type = ARM_CP_NO_RAW, 5764 .writefn = tlbi_aa64_alle1is_write }, 5765 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 5766 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 5767 .access = PL2_W, .type = ARM_CP_NO_RAW, 5768 .writefn = tlbi_aa64_ipas2e1_write }, 5769 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 5770 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 5771 .access = PL2_W, .type = ARM_CP_NO_RAW, 5772 .writefn = tlbi_aa64_ipas2e1_write }, 5773 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 5774 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 5775 .access = PL2_W, .type = ARM_CP_NO_RAW, 5776 .writefn = tlbi_aa64_alle1_write }, 5777 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 5778 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 5779 .access = PL2_W, .type = ARM_CP_NO_RAW, 5780 .writefn = tlbi_aa64_alle1is_write }, 5781 #ifndef CONFIG_USER_ONLY 5782 /* 64 bit address translation operations */ 5783 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 5784 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 5785 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5786 .fgt = FGT_ATS1E1R, 5787 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 5788 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 5789 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 5790 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5791 .fgt = FGT_ATS1E1W, 5792 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 5793 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 5794 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 5795 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5796 .fgt = FGT_ATS1E0R, 5797 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 5798 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 5799 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 5800 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5801 .fgt = FGT_ATS1E0W, 5802 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 5803 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 5804 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 5805 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5806 .accessfn = at_e012_access, .writefn = ats_write64 }, 5807 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 5808 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 5809 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5810 .accessfn = at_e012_access, .writefn = ats_write64 }, 5811 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 5812 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 5813 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5814 .accessfn = at_e012_access, .writefn = ats_write64 }, 5815 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 5816 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 5817 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5818 .accessfn = at_e012_access, .writefn = ats_write64 }, 5819 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 5820 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 5821 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 5822 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5823 .writefn = ats_write64 }, 5824 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 5825 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 5826 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5827 .writefn = ats_write64 }, 5828 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 5829 .type = ARM_CP_ALIAS, 5830 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 5831 .access = PL1_RW, .resetvalue = 0, 5832 .fgt = FGT_PAR_EL1, 5833 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 5834 .writefn = par_write }, 5835 #endif 5836 /* TLB invalidate last level of translation table walk */ 5837 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 5838 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 5839 .writefn = tlbimva_is_write }, 5840 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 5841 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 5842 .writefn = tlbimvaa_is_write }, 5843 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 5844 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 5845 .writefn = tlbimva_write }, 5846 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 5847 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 5848 .writefn = tlbimvaa_write }, 5849 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 5850 .type = ARM_CP_NO_RAW, .access = PL2_W, 5851 .writefn = tlbimva_hyp_write }, 5852 { .name = "TLBIMVALHIS", 5853 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 5854 .type = ARM_CP_NO_RAW, .access = PL2_W, 5855 .writefn = tlbimva_hyp_is_write }, 5856 { .name = "TLBIIPAS2", 5857 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 5858 .type = ARM_CP_NO_RAW, .access = PL2_W, 5859 .writefn = tlbiipas2_hyp_write }, 5860 { .name = "TLBIIPAS2IS", 5861 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 5862 .type = ARM_CP_NO_RAW, .access = PL2_W, 5863 .writefn = tlbiipas2is_hyp_write }, 5864 { .name = "TLBIIPAS2L", 5865 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 5866 .type = ARM_CP_NO_RAW, .access = PL2_W, 5867 .writefn = tlbiipas2_hyp_write }, 5868 { .name = "TLBIIPAS2LIS", 5869 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 5870 .type = ARM_CP_NO_RAW, .access = PL2_W, 5871 .writefn = tlbiipas2is_hyp_write }, 5872 /* 32 bit cache operations */ 5873 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 5874 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_ticab }, 5875 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 5876 .type = ARM_CP_NOP, .access = PL1_W }, 5877 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 5878 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5879 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 5880 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5881 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 5882 .type = ARM_CP_NOP, .access = PL1_W }, 5883 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 5884 .type = ARM_CP_NOP, .access = PL1_W }, 5885 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 5886 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5887 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 5888 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5889 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 5890 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5891 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 5892 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5893 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 5894 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5895 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 5896 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5897 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 5898 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5899 /* MMU Domain access control / MPU write buffer control */ 5900 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 5901 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 5902 .writefn = dacr_write, .raw_writefn = raw_write, 5903 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 5904 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 5905 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 5906 .type = ARM_CP_ALIAS, 5907 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 5908 .access = PL1_RW, .accessfn = access_nv1, 5909 .nv2_redirect_offset = 0x230 | NV2_REDIR_NV1, 5910 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 5911 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 5912 .type = ARM_CP_ALIAS, 5913 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 5914 .access = PL1_RW, .accessfn = access_nv1, 5915 .nv2_redirect_offset = 0x160 | NV2_REDIR_NV1, 5916 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 5917 /* 5918 * We rely on the access checks not allowing the guest to write to the 5919 * state field when SPSel indicates that it's being used as the stack 5920 * pointer. 5921 */ 5922 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 5923 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 5924 .access = PL1_RW, .accessfn = sp_el0_access, 5925 .type = ARM_CP_ALIAS, 5926 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 5927 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 5928 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 5929 .nv2_redirect_offset = 0x240, 5930 .access = PL2_RW, .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_KEEP, 5931 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 5932 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 5933 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 5934 .type = ARM_CP_NO_RAW, 5935 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 5936 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 5937 .type = ARM_CP_ALIAS, 5938 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 5939 .access = PL2_RW, 5940 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 5941 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 5942 .type = ARM_CP_ALIAS, 5943 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 5944 .access = PL2_RW, 5945 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 5946 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 5947 .type = ARM_CP_ALIAS, 5948 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 5949 .access = PL2_RW, 5950 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 5951 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 5952 .type = ARM_CP_ALIAS, 5953 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 5954 .access = PL2_RW, 5955 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 5956 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 5957 .type = ARM_CP_IO, 5958 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 5959 .resetvalue = 0, 5960 .access = PL3_RW, 5961 .writefn = mdcr_el3_write, 5962 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 5963 { .name = "SDCR", .type = ARM_CP_ALIAS | ARM_CP_IO, 5964 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 5965 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5966 .writefn = sdcr_write, 5967 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 5968 }; 5969 5970 /* These are present only when EL1 supports AArch32 */ 5971 static const ARMCPRegInfo v8_aa32_el1_reginfo[] = { 5972 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 5973 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 5974 .access = PL2_RW, 5975 .type = ARM_CP_ALIAS | ARM_CP_FPU | ARM_CP_EL3_NO_EL2_KEEP, 5976 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]) }, 5977 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 5978 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 5979 .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP, 5980 .writefn = dacr_write, .raw_writefn = raw_write, 5981 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 5982 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 5983 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 5984 .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP, 5985 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 5986 }; 5987 5988 static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask) 5989 { 5990 ARMCPU *cpu = env_archcpu(env); 5991 5992 if (arm_feature(env, ARM_FEATURE_V8)) { 5993 valid_mask |= MAKE_64BIT_MASK(0, 34); /* ARMv8.0 */ 5994 } else { 5995 valid_mask |= MAKE_64BIT_MASK(0, 28); /* ARMv7VE */ 5996 } 5997 5998 if (arm_feature(env, ARM_FEATURE_EL3)) { 5999 valid_mask &= ~HCR_HCD; 6000 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 6001 /* 6002 * Architecturally HCR.TSC is RES0 if EL3 is not implemented. 6003 * However, if we're using the SMC PSCI conduit then QEMU is 6004 * effectively acting like EL3 firmware and so the guest at 6005 * EL2 should retain the ability to prevent EL1 from being 6006 * able to make SMC calls into the ersatz firmware, so in 6007 * that case HCR.TSC should be read/write. 6008 */ 6009 valid_mask &= ~HCR_TSC; 6010 } 6011 6012 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 6013 if (cpu_isar_feature(aa64_vh, cpu)) { 6014 valid_mask |= HCR_E2H; 6015 } 6016 if (cpu_isar_feature(aa64_ras, cpu)) { 6017 valid_mask |= HCR_TERR | HCR_TEA; 6018 } 6019 if (cpu_isar_feature(aa64_lor, cpu)) { 6020 valid_mask |= HCR_TLOR; 6021 } 6022 if (cpu_isar_feature(aa64_pauth, cpu)) { 6023 valid_mask |= HCR_API | HCR_APK; 6024 } 6025 if (cpu_isar_feature(aa64_mte, cpu)) { 6026 valid_mask |= HCR_ATA | HCR_DCT | HCR_TID5; 6027 } 6028 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 6029 valid_mask |= HCR_ENSCXT; 6030 } 6031 if (cpu_isar_feature(aa64_fwb, cpu)) { 6032 valid_mask |= HCR_FWB; 6033 } 6034 if (cpu_isar_feature(aa64_rme, cpu)) { 6035 valid_mask |= HCR_GPF; 6036 } 6037 if (cpu_isar_feature(aa64_nv, cpu)) { 6038 valid_mask |= HCR_NV | HCR_NV1 | HCR_AT; 6039 } 6040 if (cpu_isar_feature(aa64_nv2, cpu)) { 6041 valid_mask |= HCR_NV2; 6042 } 6043 } 6044 6045 if (cpu_isar_feature(any_evt, cpu)) { 6046 valid_mask |= HCR_TTLBIS | HCR_TTLBOS | HCR_TICAB | HCR_TOCU | HCR_TID4; 6047 } else if (cpu_isar_feature(any_half_evt, cpu)) { 6048 valid_mask |= HCR_TICAB | HCR_TOCU | HCR_TID4; 6049 } 6050 6051 /* Clear RES0 bits. */ 6052 value &= valid_mask; 6053 6054 /* 6055 * These bits change the MMU setup: 6056 * HCR_VM enables stage 2 translation 6057 * HCR_PTW forbids certain page-table setups 6058 * HCR_DC disables stage1 and enables stage2 translation 6059 * HCR_DCT enables tagging on (disabled) stage1 translation 6060 * HCR_FWB changes the interpretation of stage2 descriptor bits 6061 * HCR_NV and HCR_NV1 affect interpretation of descriptor bits 6062 */ 6063 if ((env->cp15.hcr_el2 ^ value) & 6064 (HCR_VM | HCR_PTW | HCR_DC | HCR_DCT | HCR_FWB | HCR_NV | HCR_NV1)) { 6065 tlb_flush(CPU(cpu)); 6066 } 6067 env->cp15.hcr_el2 = value; 6068 6069 /* 6070 * Updates to VI and VF require us to update the status of 6071 * virtual interrupts, which are the logical OR of these bits 6072 * and the state of the input lines from the GIC. (This requires 6073 * that we have the BQL, which is done by marking the 6074 * reginfo structs as ARM_CP_IO.) 6075 * Note that if a write to HCR pends a VIRQ or VFIQ or VINMI or 6076 * VFNMI, it is never possible for it to be taken immediately 6077 * because VIRQ, VFIQ, VINMI and VFNMI are masked unless running 6078 * at EL0 or EL1, and HCR can only be written at EL2. 6079 */ 6080 g_assert(bql_locked()); 6081 arm_cpu_update_virq(cpu); 6082 arm_cpu_update_vfiq(cpu); 6083 arm_cpu_update_vserr(cpu); 6084 if (cpu_isar_feature(aa64_nmi, cpu)) { 6085 arm_cpu_update_vinmi(cpu); 6086 arm_cpu_update_vfnmi(cpu); 6087 } 6088 } 6089 6090 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 6091 { 6092 do_hcr_write(env, value, 0); 6093 } 6094 6095 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 6096 uint64_t value) 6097 { 6098 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 6099 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 6100 do_hcr_write(env, value, MAKE_64BIT_MASK(0, 32)); 6101 } 6102 6103 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 6104 uint64_t value) 6105 { 6106 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 6107 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 6108 do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32)); 6109 } 6110 6111 /* 6112 * Return the effective value of HCR_EL2, at the given security state. 6113 * Bits that are not included here: 6114 * RW (read from SCR_EL3.RW as needed) 6115 */ 6116 uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space) 6117 { 6118 uint64_t ret = env->cp15.hcr_el2; 6119 6120 assert(space != ARMSS_Root); 6121 6122 if (!arm_is_el2_enabled_secstate(env, space)) { 6123 /* 6124 * "This register has no effect if EL2 is not enabled in the 6125 * current Security state". This is ARMv8.4-SecEL2 speak for 6126 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 6127 * 6128 * Prior to that, the language was "In an implementation that 6129 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 6130 * as if this field is 0 for all purposes other than a direct 6131 * read or write access of HCR_EL2". With lots of enumeration 6132 * on a per-field basis. In current QEMU, this is condition 6133 * is arm_is_secure_below_el3. 6134 * 6135 * Since the v8.4 language applies to the entire register, and 6136 * appears to be backward compatible, use that. 6137 */ 6138 return 0; 6139 } 6140 6141 /* 6142 * For a cpu that supports both aarch64 and aarch32, we can set bits 6143 * in HCR_EL2 (e.g. via EL3) that are RES0 when we enter EL2 as aa32. 6144 * Ignore all of the bits in HCR+HCR2 that are not valid for aarch32. 6145 */ 6146 if (!arm_el_is_aa64(env, 2)) { 6147 uint64_t aa32_valid; 6148 6149 /* 6150 * These bits are up-to-date as of ARMv8.6. 6151 * For HCR, it's easiest to list just the 2 bits that are invalid. 6152 * For HCR2, list those that are valid. 6153 */ 6154 aa32_valid = MAKE_64BIT_MASK(0, 32) & ~(HCR_RW | HCR_TDZ); 6155 aa32_valid |= (HCR_CD | HCR_ID | HCR_TERR | HCR_TEA | HCR_MIOCNCE | 6156 HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_TTLBIS); 6157 ret &= aa32_valid; 6158 } 6159 6160 if (ret & HCR_TGE) { 6161 /* These bits are up-to-date as of ARMv8.6. */ 6162 if (ret & HCR_E2H) { 6163 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 6164 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 6165 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 6166 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE | 6167 HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_ENSCXT | 6168 HCR_TTLBIS | HCR_TTLBOS | HCR_TID5); 6169 } else { 6170 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 6171 } 6172 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 6173 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 6174 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 6175 HCR_TLOR); 6176 } 6177 6178 return ret; 6179 } 6180 6181 uint64_t arm_hcr_el2_eff(CPUARMState *env) 6182 { 6183 if (arm_feature(env, ARM_FEATURE_M)) { 6184 return 0; 6185 } 6186 return arm_hcr_el2_eff_secstate(env, arm_security_space_below_el3(env)); 6187 } 6188 6189 /* 6190 * Corresponds to ARM pseudocode function ELIsInHost(). 6191 */ 6192 bool el_is_in_host(CPUARMState *env, int el) 6193 { 6194 uint64_t mask; 6195 6196 /* 6197 * Since we only care about E2H and TGE, we can skip arm_hcr_el2_eff(). 6198 * Perform the simplest bit tests first, and validate EL2 afterward. 6199 */ 6200 if (el & 1) { 6201 return false; /* EL1 or EL3 */ 6202 } 6203 6204 /* 6205 * Note that hcr_write() checks isar_feature_aa64_vh(), 6206 * aka HaveVirtHostExt(), in allowing HCR_E2H to be set. 6207 */ 6208 mask = el ? HCR_E2H : HCR_E2H | HCR_TGE; 6209 if ((env->cp15.hcr_el2 & mask) != mask) { 6210 return false; 6211 } 6212 6213 /* TGE and/or E2H set: double check those bits are currently legal. */ 6214 return arm_is_el2_enabled(env) && arm_el_is_aa64(env, 2); 6215 } 6216 6217 static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri, 6218 uint64_t value) 6219 { 6220 ARMCPU *cpu = env_archcpu(env); 6221 uint64_t valid_mask = 0; 6222 6223 /* FEAT_MOPS adds MSCEn and MCE2 */ 6224 if (cpu_isar_feature(aa64_mops, cpu)) { 6225 valid_mask |= HCRX_MSCEN | HCRX_MCE2; 6226 } 6227 6228 /* FEAT_NMI adds TALLINT, VINMI and VFNMI */ 6229 if (cpu_isar_feature(aa64_nmi, cpu)) { 6230 valid_mask |= HCRX_TALLINT | HCRX_VINMI | HCRX_VFNMI; 6231 } 6232 6233 /* Clear RES0 bits. */ 6234 env->cp15.hcrx_el2 = value & valid_mask; 6235 6236 /* 6237 * Updates to VINMI and VFNMI require us to update the status of 6238 * virtual NMI, which are the logical OR of these bits 6239 * and the state of the input lines from the GIC. (This requires 6240 * that we have the BQL, which is done by marking the 6241 * reginfo structs as ARM_CP_IO.) 6242 * Note that if a write to HCRX pends a VINMI or VFNMI it is never 6243 * possible for it to be taken immediately, because VINMI and 6244 * VFNMI are masked unless running at EL0 or EL1, and HCRX 6245 * can only be written at EL2. 6246 */ 6247 if (cpu_isar_feature(aa64_nmi, cpu)) { 6248 g_assert(bql_locked()); 6249 arm_cpu_update_vinmi(cpu); 6250 arm_cpu_update_vfnmi(cpu); 6251 } 6252 } 6253 6254 static CPAccessResult access_hxen(CPUARMState *env, const ARMCPRegInfo *ri, 6255 bool isread) 6256 { 6257 if (arm_current_el(env) == 2 6258 && arm_feature(env, ARM_FEATURE_EL3) 6259 && !(env->cp15.scr_el3 & SCR_HXEN)) { 6260 return CP_ACCESS_TRAP_EL3; 6261 } 6262 return CP_ACCESS_OK; 6263 } 6264 6265 static const ARMCPRegInfo hcrx_el2_reginfo = { 6266 .name = "HCRX_EL2", .state = ARM_CP_STATE_AA64, 6267 .type = ARM_CP_IO, 6268 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 2, 6269 .access = PL2_RW, .writefn = hcrx_write, .accessfn = access_hxen, 6270 .nv2_redirect_offset = 0xa0, 6271 .fieldoffset = offsetof(CPUARMState, cp15.hcrx_el2), 6272 }; 6273 6274 /* Return the effective value of HCRX_EL2. */ 6275 uint64_t arm_hcrx_el2_eff(CPUARMState *env) 6276 { 6277 /* 6278 * The bits in this register behave as 0 for all purposes other than 6279 * direct reads of the register if SCR_EL3.HXEn is 0. 6280 * If EL2 is not enabled in the current security state, then the 6281 * bit may behave as if 0, or as if 1, depending on the bit. 6282 * For the moment, we treat the EL2-disabled case as taking 6283 * priority over the HXEn-disabled case. This is true for the only 6284 * bit for a feature which we implement where the answer is different 6285 * for the two cases (MSCEn for FEAT_MOPS). 6286 * This may need to be revisited for future bits. 6287 */ 6288 if (!arm_is_el2_enabled(env)) { 6289 uint64_t hcrx = 0; 6290 if (cpu_isar_feature(aa64_mops, env_archcpu(env))) { 6291 /* MSCEn behaves as 1 if EL2 is not enabled */ 6292 hcrx |= HCRX_MSCEN; 6293 } 6294 return hcrx; 6295 } 6296 if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_HXEN)) { 6297 return 0; 6298 } 6299 return env->cp15.hcrx_el2; 6300 } 6301 6302 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 6303 uint64_t value) 6304 { 6305 /* 6306 * For A-profile AArch32 EL3, if NSACR.CP10 6307 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 6308 */ 6309 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 6310 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 6311 uint64_t mask = R_HCPTR_TCP11_MASK | R_HCPTR_TCP10_MASK; 6312 value = (value & ~mask) | (env->cp15.cptr_el[2] & mask); 6313 } 6314 env->cp15.cptr_el[2] = value; 6315 } 6316 6317 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri) 6318 { 6319 /* 6320 * For A-profile AArch32 EL3, if NSACR.CP10 6321 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 6322 */ 6323 uint64_t value = env->cp15.cptr_el[2]; 6324 6325 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 6326 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 6327 value |= R_HCPTR_TCP11_MASK | R_HCPTR_TCP10_MASK; 6328 } 6329 return value; 6330 } 6331 6332 static const ARMCPRegInfo el2_cp_reginfo[] = { 6333 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 6334 .type = ARM_CP_IO, 6335 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 6336 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 6337 .nv2_redirect_offset = 0x78, 6338 .writefn = hcr_write, .raw_writefn = raw_write }, 6339 { .name = "HCR", .state = ARM_CP_STATE_AA32, 6340 .type = ARM_CP_ALIAS | ARM_CP_IO, 6341 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 6342 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 6343 .writefn = hcr_writelow }, 6344 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 6345 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 6346 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 6347 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 6348 .type = ARM_CP_ALIAS | ARM_CP_NV2_REDIRECT, 6349 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 6350 .access = PL2_RW, 6351 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 6352 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 6353 .type = ARM_CP_NV2_REDIRECT, 6354 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 6355 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 6356 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 6357 .type = ARM_CP_NV2_REDIRECT, 6358 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 6359 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 6360 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 6361 .type = ARM_CP_ALIAS, 6362 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 6363 .access = PL2_RW, 6364 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 6365 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 6366 .type = ARM_CP_ALIAS | ARM_CP_NV2_REDIRECT, 6367 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 6368 .access = PL2_RW, 6369 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 6370 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 6371 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 6372 .access = PL2_RW, .writefn = vbar_write, 6373 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 6374 .resetvalue = 0 }, 6375 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 6376 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 6377 .access = PL3_RW, .type = ARM_CP_ALIAS, 6378 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 6379 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 6380 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 6381 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 6382 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]), 6383 .readfn = cptr_el2_read, .writefn = cptr_el2_write }, 6384 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 6385 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 6386 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 6387 .resetvalue = 0 }, 6388 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 6389 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 6390 .access = PL2_RW, .type = ARM_CP_ALIAS, 6391 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 6392 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 6393 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 6394 .access = PL2_RW, .type = ARM_CP_CONST, 6395 .resetvalue = 0 }, 6396 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 6397 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 6398 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 6399 .access = PL2_RW, .type = ARM_CP_CONST, 6400 .resetvalue = 0 }, 6401 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 6402 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 6403 .access = PL2_RW, .type = ARM_CP_CONST, 6404 .resetvalue = 0 }, 6405 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 6406 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 6407 .access = PL2_RW, .type = ARM_CP_CONST, 6408 .resetvalue = 0 }, 6409 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 6410 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 6411 .access = PL2_RW, .writefn = vmsa_tcr_el12_write, 6412 .raw_writefn = raw_write, 6413 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 6414 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 6415 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 6416 .type = ARM_CP_ALIAS, 6417 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6418 .fieldoffset = offsetoflow32(CPUARMState, cp15.vtcr_el2) }, 6419 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 6420 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 6421 .access = PL2_RW, 6422 .nv2_redirect_offset = 0x40, 6423 /* no .writefn needed as this can't cause an ASID change */ 6424 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 6425 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 6426 .cp = 15, .opc1 = 6, .crm = 2, 6427 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 6428 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6429 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 6430 .writefn = vttbr_write, .raw_writefn = raw_write }, 6431 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 6432 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 6433 .access = PL2_RW, .writefn = vttbr_write, .raw_writefn = raw_write, 6434 .nv2_redirect_offset = 0x20, 6435 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 6436 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 6437 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 6438 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 6439 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 6440 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 6441 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 6442 .access = PL2_RW, .resetvalue = 0, 6443 .nv2_redirect_offset = 0x90, 6444 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 6445 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 6446 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 6447 .access = PL2_RW, .resetvalue = 0, 6448 .writefn = vmsa_tcr_ttbr_el2_write, .raw_writefn = raw_write, 6449 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 6450 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 6451 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 6452 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 6453 { .name = "TLBIALLNSNH", 6454 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 6455 .type = ARM_CP_NO_RAW, .access = PL2_W, 6456 .writefn = tlbiall_nsnh_write }, 6457 { .name = "TLBIALLNSNHIS", 6458 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 6459 .type = ARM_CP_NO_RAW, .access = PL2_W, 6460 .writefn = tlbiall_nsnh_is_write }, 6461 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 6462 .type = ARM_CP_NO_RAW, .access = PL2_W, 6463 .writefn = tlbiall_hyp_write }, 6464 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 6465 .type = ARM_CP_NO_RAW, .access = PL2_W, 6466 .writefn = tlbiall_hyp_is_write }, 6467 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 6468 .type = ARM_CP_NO_RAW, .access = PL2_W, 6469 .writefn = tlbimva_hyp_write }, 6470 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 6471 .type = ARM_CP_NO_RAW, .access = PL2_W, 6472 .writefn = tlbimva_hyp_is_write }, 6473 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 6474 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 6475 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 6476 .writefn = tlbi_aa64_alle2_write }, 6477 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 6478 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 6479 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 6480 .writefn = tlbi_aa64_vae2_write }, 6481 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 6482 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 6483 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 6484 .writefn = tlbi_aa64_vae2_write }, 6485 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 6486 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 6487 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 6488 .writefn = tlbi_aa64_alle2is_write }, 6489 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 6490 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 6491 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 6492 .writefn = tlbi_aa64_vae2is_write }, 6493 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 6494 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 6495 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 6496 .writefn = tlbi_aa64_vae2is_write }, 6497 #ifndef CONFIG_USER_ONLY 6498 /* 6499 * Unlike the other EL2-related AT operations, these must 6500 * UNDEF from EL3 if EL2 is not implemented, which is why we 6501 * define them here rather than with the rest of the AT ops. 6502 */ 6503 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 6504 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 6505 .access = PL2_W, .accessfn = at_s1e2_access, 6506 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF, 6507 .writefn = ats_write64 }, 6508 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 6509 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 6510 .access = PL2_W, .accessfn = at_s1e2_access, 6511 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF, 6512 .writefn = ats_write64 }, 6513 /* 6514 * The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 6515 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 6516 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 6517 * to behave as if SCR.NS was 1. 6518 */ 6519 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 6520 .access = PL2_W, 6521 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 6522 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 6523 .access = PL2_W, 6524 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 6525 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 6526 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 6527 /* 6528 * ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 6529 * reset values as IMPDEF. We choose to reset to 3 to comply with 6530 * both ARMv7 and ARMv8. 6531 */ 6532 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 3, 6533 .writefn = gt_cnthctl_write, .raw_writefn = raw_write, 6534 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 6535 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 6536 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 6537 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 6538 .writefn = gt_cntvoff_write, 6539 .nv2_redirect_offset = 0x60, 6540 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 6541 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 6542 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 6543 .writefn = gt_cntvoff_write, 6544 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 6545 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 6546 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 6547 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 6548 .type = ARM_CP_IO, .access = PL2_RW, 6549 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 6550 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 6551 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 6552 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 6553 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 6554 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 6555 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 6556 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 6557 .resetfn = gt_hyp_timer_reset, 6558 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 6559 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 6560 .type = ARM_CP_IO, 6561 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 6562 .access = PL2_RW, 6563 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 6564 .resetvalue = 0, 6565 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 6566 #endif 6567 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 6568 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 6569 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6570 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 6571 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 6572 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 6573 .access = PL2_RW, 6574 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 6575 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 6576 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 6577 .access = PL2_RW, 6578 .nv2_redirect_offset = 0x80, 6579 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 6580 }; 6581 6582 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 6583 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 6584 .type = ARM_CP_ALIAS | ARM_CP_IO, 6585 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 6586 .access = PL2_RW, 6587 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 6588 .writefn = hcr_writehigh }, 6589 }; 6590 6591 static CPAccessResult sel2_access(CPUARMState *env, const ARMCPRegInfo *ri, 6592 bool isread) 6593 { 6594 if (arm_current_el(env) == 3 || arm_is_secure_below_el3(env)) { 6595 return CP_ACCESS_OK; 6596 } 6597 return CP_ACCESS_TRAP_UNCATEGORIZED; 6598 } 6599 6600 static const ARMCPRegInfo el2_sec_cp_reginfo[] = { 6601 { .name = "VSTTBR_EL2", .state = ARM_CP_STATE_AA64, 6602 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 0, 6603 .access = PL2_RW, .accessfn = sel2_access, 6604 .nv2_redirect_offset = 0x30, 6605 .fieldoffset = offsetof(CPUARMState, cp15.vsttbr_el2) }, 6606 { .name = "VSTCR_EL2", .state = ARM_CP_STATE_AA64, 6607 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2, 6608 .access = PL2_RW, .accessfn = sel2_access, 6609 .nv2_redirect_offset = 0x48, 6610 .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) }, 6611 }; 6612 6613 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 6614 bool isread) 6615 { 6616 /* 6617 * The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 6618 * At Secure EL1 it traps to EL3 or EL2. 6619 */ 6620 if (arm_current_el(env) == 3) { 6621 return CP_ACCESS_OK; 6622 } 6623 if (arm_is_secure_below_el3(env)) { 6624 if (env->cp15.scr_el3 & SCR_EEL2) { 6625 return CP_ACCESS_TRAP_EL2; 6626 } 6627 return CP_ACCESS_TRAP_EL3; 6628 } 6629 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 6630 if (isread) { 6631 return CP_ACCESS_OK; 6632 } 6633 return CP_ACCESS_TRAP_UNCATEGORIZED; 6634 } 6635 6636 static const ARMCPRegInfo el3_cp_reginfo[] = { 6637 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 6638 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 6639 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 6640 .resetfn = scr_reset, .writefn = scr_write, .raw_writefn = raw_write }, 6641 { .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL, 6642 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 6643 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 6644 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 6645 .writefn = scr_write, .raw_writefn = raw_write }, 6646 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 6647 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 6648 .access = PL3_RW, .resetvalue = 0, 6649 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 6650 { .name = "SDER", 6651 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 6652 .access = PL3_RW, .resetvalue = 0, 6653 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 6654 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 6655 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 6656 .writefn = vbar_write, .resetvalue = 0, 6657 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 6658 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 6659 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 6660 .access = PL3_RW, .resetvalue = 0, 6661 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 6662 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 6663 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 6664 .access = PL3_RW, 6665 /* no .writefn needed as this can't cause an ASID change */ 6666 .resetvalue = 0, 6667 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 6668 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 6669 .type = ARM_CP_ALIAS, 6670 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 6671 .access = PL3_RW, 6672 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 6673 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 6674 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 6675 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 6676 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 6677 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 6678 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 6679 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 6680 .type = ARM_CP_ALIAS, 6681 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 6682 .access = PL3_RW, 6683 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 6684 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 6685 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 6686 .access = PL3_RW, .writefn = vbar_write, 6687 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 6688 .resetvalue = 0 }, 6689 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 6690 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 6691 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 6692 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 6693 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 6694 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 6695 .access = PL3_RW, .resetvalue = 0, 6696 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 6697 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 6698 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 6699 .access = PL3_RW, .type = ARM_CP_CONST, 6700 .resetvalue = 0 }, 6701 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 6702 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 6703 .access = PL3_RW, .type = ARM_CP_CONST, 6704 .resetvalue = 0 }, 6705 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 6706 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 6707 .access = PL3_RW, .type = ARM_CP_CONST, 6708 .resetvalue = 0 }, 6709 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 6710 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 6711 .access = PL3_W, .type = ARM_CP_NO_RAW, 6712 .writefn = tlbi_aa64_alle3is_write }, 6713 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 6714 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 6715 .access = PL3_W, .type = ARM_CP_NO_RAW, 6716 .writefn = tlbi_aa64_vae3is_write }, 6717 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 6718 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 6719 .access = PL3_W, .type = ARM_CP_NO_RAW, 6720 .writefn = tlbi_aa64_vae3is_write }, 6721 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 6722 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 6723 .access = PL3_W, .type = ARM_CP_NO_RAW, 6724 .writefn = tlbi_aa64_alle3_write }, 6725 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 6726 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 6727 .access = PL3_W, .type = ARM_CP_NO_RAW, 6728 .writefn = tlbi_aa64_vae3_write }, 6729 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 6730 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 6731 .access = PL3_W, .type = ARM_CP_NO_RAW, 6732 .writefn = tlbi_aa64_vae3_write }, 6733 }; 6734 6735 #ifndef CONFIG_USER_ONLY 6736 6737 static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri, 6738 bool isread) 6739 { 6740 if (arm_current_el(env) == 1) { 6741 /* This must be a FEAT_NV access */ 6742 return CP_ACCESS_OK; 6743 } 6744 if (!(arm_hcr_el2_eff(env) & HCR_E2H)) { 6745 return CP_ACCESS_TRAP_UNCATEGORIZED; 6746 } 6747 return CP_ACCESS_OK; 6748 } 6749 6750 static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri, 6751 bool isread) 6752 { 6753 if (arm_current_el(env) == 1) { 6754 /* This must be a FEAT_NV access with NVx == 101 */ 6755 if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) { 6756 return CP_ACCESS_TRAP_EL2; 6757 } 6758 } 6759 return e2h_access(env, ri, isread); 6760 } 6761 6762 static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri, 6763 bool isread) 6764 { 6765 if (arm_current_el(env) == 1) { 6766 /* This must be a FEAT_NV access with NVx == 101 */ 6767 if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) { 6768 return CP_ACCESS_TRAP_EL2; 6769 } 6770 } 6771 return e2h_access(env, ri, isread); 6772 } 6773 6774 /* Test if system register redirection is to occur in the current state. */ 6775 static bool redirect_for_e2h(CPUARMState *env) 6776 { 6777 return arm_current_el(env) == 2 && (arm_hcr_el2_eff(env) & HCR_E2H); 6778 } 6779 6780 static uint64_t el2_e2h_read(CPUARMState *env, const ARMCPRegInfo *ri) 6781 { 6782 CPReadFn *readfn; 6783 6784 if (redirect_for_e2h(env)) { 6785 /* Switch to the saved EL2 version of the register. */ 6786 ri = ri->opaque; 6787 readfn = ri->readfn; 6788 } else { 6789 readfn = ri->orig_readfn; 6790 } 6791 if (readfn == NULL) { 6792 readfn = raw_read; 6793 } 6794 return readfn(env, ri); 6795 } 6796 6797 static void el2_e2h_write(CPUARMState *env, const ARMCPRegInfo *ri, 6798 uint64_t value) 6799 { 6800 CPWriteFn *writefn; 6801 6802 if (redirect_for_e2h(env)) { 6803 /* Switch to the saved EL2 version of the register. */ 6804 ri = ri->opaque; 6805 writefn = ri->writefn; 6806 } else { 6807 writefn = ri->orig_writefn; 6808 } 6809 if (writefn == NULL) { 6810 writefn = raw_write; 6811 } 6812 writefn(env, ri, value); 6813 } 6814 6815 static uint64_t el2_e2h_e12_read(CPUARMState *env, const ARMCPRegInfo *ri) 6816 { 6817 /* Pass the EL1 register accessor its ri, not the EL12 alias ri */ 6818 return ri->orig_readfn(env, ri->opaque); 6819 } 6820 6821 static void el2_e2h_e12_write(CPUARMState *env, const ARMCPRegInfo *ri, 6822 uint64_t value) 6823 { 6824 /* Pass the EL1 register accessor its ri, not the EL12 alias ri */ 6825 return ri->orig_writefn(env, ri->opaque, value); 6826 } 6827 6828 static CPAccessResult el2_e2h_e12_access(CPUARMState *env, 6829 const ARMCPRegInfo *ri, 6830 bool isread) 6831 { 6832 if (arm_current_el(env) == 1) { 6833 /* 6834 * This must be a FEAT_NV access (will either trap or redirect 6835 * to memory). None of the registers with _EL12 aliases want to 6836 * apply their trap controls for this kind of access, so don't 6837 * call the orig_accessfn or do the "UNDEF when E2H is 0" check. 6838 */ 6839 return CP_ACCESS_OK; 6840 } 6841 /* FOO_EL12 aliases only exist when E2H is 1; otherwise they UNDEF */ 6842 if (!(arm_hcr_el2_eff(env) & HCR_E2H)) { 6843 return CP_ACCESS_TRAP_UNCATEGORIZED; 6844 } 6845 if (ri->orig_accessfn) { 6846 return ri->orig_accessfn(env, ri->opaque, isread); 6847 } 6848 return CP_ACCESS_OK; 6849 } 6850 6851 static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu) 6852 { 6853 struct E2HAlias { 6854 uint32_t src_key, dst_key, new_key; 6855 const char *src_name, *dst_name, *new_name; 6856 bool (*feature)(const ARMISARegisters *id); 6857 }; 6858 6859 #define K(op0, op1, crn, crm, op2) \ 6860 ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2) 6861 6862 static const struct E2HAlias aliases[] = { 6863 { K(3, 0, 1, 0, 0), K(3, 4, 1, 0, 0), K(3, 5, 1, 0, 0), 6864 "SCTLR", "SCTLR_EL2", "SCTLR_EL12" }, 6865 { K(3, 0, 1, 0, 2), K(3, 4, 1, 1, 2), K(3, 5, 1, 0, 2), 6866 "CPACR", "CPTR_EL2", "CPACR_EL12" }, 6867 { K(3, 0, 2, 0, 0), K(3, 4, 2, 0, 0), K(3, 5, 2, 0, 0), 6868 "TTBR0_EL1", "TTBR0_EL2", "TTBR0_EL12" }, 6869 { K(3, 0, 2, 0, 1), K(3, 4, 2, 0, 1), K(3, 5, 2, 0, 1), 6870 "TTBR1_EL1", "TTBR1_EL2", "TTBR1_EL12" }, 6871 { K(3, 0, 2, 0, 2), K(3, 4, 2, 0, 2), K(3, 5, 2, 0, 2), 6872 "TCR_EL1", "TCR_EL2", "TCR_EL12" }, 6873 { K(3, 0, 4, 0, 0), K(3, 4, 4, 0, 0), K(3, 5, 4, 0, 0), 6874 "SPSR_EL1", "SPSR_EL2", "SPSR_EL12" }, 6875 { K(3, 0, 4, 0, 1), K(3, 4, 4, 0, 1), K(3, 5, 4, 0, 1), 6876 "ELR_EL1", "ELR_EL2", "ELR_EL12" }, 6877 { K(3, 0, 5, 1, 0), K(3, 4, 5, 1, 0), K(3, 5, 5, 1, 0), 6878 "AFSR0_EL1", "AFSR0_EL2", "AFSR0_EL12" }, 6879 { K(3, 0, 5, 1, 1), K(3, 4, 5, 1, 1), K(3, 5, 5, 1, 1), 6880 "AFSR1_EL1", "AFSR1_EL2", "AFSR1_EL12" }, 6881 { K(3, 0, 5, 2, 0), K(3, 4, 5, 2, 0), K(3, 5, 5, 2, 0), 6882 "ESR_EL1", "ESR_EL2", "ESR_EL12" }, 6883 { K(3, 0, 6, 0, 0), K(3, 4, 6, 0, 0), K(3, 5, 6, 0, 0), 6884 "FAR_EL1", "FAR_EL2", "FAR_EL12" }, 6885 { K(3, 0, 10, 2, 0), K(3, 4, 10, 2, 0), K(3, 5, 10, 2, 0), 6886 "MAIR_EL1", "MAIR_EL2", "MAIR_EL12" }, 6887 { K(3, 0, 10, 3, 0), K(3, 4, 10, 3, 0), K(3, 5, 10, 3, 0), 6888 "AMAIR0", "AMAIR_EL2", "AMAIR_EL12" }, 6889 { K(3, 0, 12, 0, 0), K(3, 4, 12, 0, 0), K(3, 5, 12, 0, 0), 6890 "VBAR", "VBAR_EL2", "VBAR_EL12" }, 6891 { K(3, 0, 13, 0, 1), K(3, 4, 13, 0, 1), K(3, 5, 13, 0, 1), 6892 "CONTEXTIDR_EL1", "CONTEXTIDR_EL2", "CONTEXTIDR_EL12" }, 6893 { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0), 6894 "CNTKCTL", "CNTHCTL_EL2", "CNTKCTL_EL12" }, 6895 6896 /* 6897 * Note that redirection of ZCR is mentioned in the description 6898 * of ZCR_EL2, and aliasing in the description of ZCR_EL1, but 6899 * not in the summary table. 6900 */ 6901 { K(3, 0, 1, 2, 0), K(3, 4, 1, 2, 0), K(3, 5, 1, 2, 0), 6902 "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve }, 6903 { K(3, 0, 1, 2, 6), K(3, 4, 1, 2, 6), K(3, 5, 1, 2, 6), 6904 "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme }, 6905 6906 { K(3, 0, 5, 6, 0), K(3, 4, 5, 6, 0), K(3, 5, 5, 6, 0), 6907 "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte }, 6908 6909 { K(3, 0, 13, 0, 7), K(3, 4, 13, 0, 7), K(3, 5, 13, 0, 7), 6910 "SCXTNUM_EL1", "SCXTNUM_EL2", "SCXTNUM_EL12", 6911 isar_feature_aa64_scxtnum }, 6912 6913 /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */ 6914 /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */ 6915 }; 6916 #undef K 6917 6918 size_t i; 6919 6920 for (i = 0; i < ARRAY_SIZE(aliases); i++) { 6921 const struct E2HAlias *a = &aliases[i]; 6922 ARMCPRegInfo *src_reg, *dst_reg, *new_reg; 6923 bool ok; 6924 6925 if (a->feature && !a->feature(&cpu->isar)) { 6926 continue; 6927 } 6928 6929 src_reg = g_hash_table_lookup(cpu->cp_regs, 6930 (gpointer)(uintptr_t)a->src_key); 6931 dst_reg = g_hash_table_lookup(cpu->cp_regs, 6932 (gpointer)(uintptr_t)a->dst_key); 6933 g_assert(src_reg != NULL); 6934 g_assert(dst_reg != NULL); 6935 6936 /* Cross-compare names to detect typos in the keys. */ 6937 g_assert(strcmp(src_reg->name, a->src_name) == 0); 6938 g_assert(strcmp(dst_reg->name, a->dst_name) == 0); 6939 6940 /* None of the core system registers use opaque; we will. */ 6941 g_assert(src_reg->opaque == NULL); 6942 6943 /* Create alias before redirection so we dup the right data. */ 6944 new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo)); 6945 6946 new_reg->name = a->new_name; 6947 new_reg->type |= ARM_CP_ALIAS; 6948 /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place. */ 6949 new_reg->access &= PL2_RW | PL3_RW; 6950 /* The new_reg op fields are as per new_key, not the target reg */ 6951 new_reg->crn = (a->new_key & CP_REG_ARM64_SYSREG_CRN_MASK) 6952 >> CP_REG_ARM64_SYSREG_CRN_SHIFT; 6953 new_reg->crm = (a->new_key & CP_REG_ARM64_SYSREG_CRM_MASK) 6954 >> CP_REG_ARM64_SYSREG_CRM_SHIFT; 6955 new_reg->opc0 = (a->new_key & CP_REG_ARM64_SYSREG_OP0_MASK) 6956 >> CP_REG_ARM64_SYSREG_OP0_SHIFT; 6957 new_reg->opc1 = (a->new_key & CP_REG_ARM64_SYSREG_OP1_MASK) 6958 >> CP_REG_ARM64_SYSREG_OP1_SHIFT; 6959 new_reg->opc2 = (a->new_key & CP_REG_ARM64_SYSREG_OP2_MASK) 6960 >> CP_REG_ARM64_SYSREG_OP2_SHIFT; 6961 new_reg->opaque = src_reg; 6962 new_reg->orig_readfn = src_reg->readfn ?: raw_read; 6963 new_reg->orig_writefn = src_reg->writefn ?: raw_write; 6964 new_reg->orig_accessfn = src_reg->accessfn; 6965 if (!new_reg->raw_readfn) { 6966 new_reg->raw_readfn = raw_read; 6967 } 6968 if (!new_reg->raw_writefn) { 6969 new_reg->raw_writefn = raw_write; 6970 } 6971 new_reg->readfn = el2_e2h_e12_read; 6972 new_reg->writefn = el2_e2h_e12_write; 6973 new_reg->accessfn = el2_e2h_e12_access; 6974 6975 /* 6976 * If the _EL1 register is redirected to memory by FEAT_NV2, 6977 * then it shares the offset with the _EL12 register, 6978 * and which one is redirected depends on HCR_EL2.NV1. 6979 */ 6980 if (new_reg->nv2_redirect_offset) { 6981 assert(new_reg->nv2_redirect_offset & NV2_REDIR_NV1); 6982 new_reg->nv2_redirect_offset &= ~NV2_REDIR_NV1; 6983 new_reg->nv2_redirect_offset |= NV2_REDIR_NO_NV1; 6984 } 6985 6986 ok = g_hash_table_insert(cpu->cp_regs, 6987 (gpointer)(uintptr_t)a->new_key, new_reg); 6988 g_assert(ok); 6989 6990 src_reg->opaque = dst_reg; 6991 src_reg->orig_readfn = src_reg->readfn ?: raw_read; 6992 src_reg->orig_writefn = src_reg->writefn ?: raw_write; 6993 if (!src_reg->raw_readfn) { 6994 src_reg->raw_readfn = raw_read; 6995 } 6996 if (!src_reg->raw_writefn) { 6997 src_reg->raw_writefn = raw_write; 6998 } 6999 src_reg->readfn = el2_e2h_read; 7000 src_reg->writefn = el2_e2h_write; 7001 } 7002 } 7003 #endif 7004 7005 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 7006 bool isread) 7007 { 7008 int cur_el = arm_current_el(env); 7009 7010 if (cur_el < 2) { 7011 uint64_t hcr = arm_hcr_el2_eff(env); 7012 7013 if (cur_el == 0) { 7014 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 7015 if (!(env->cp15.sctlr_el[2] & SCTLR_UCT)) { 7016 return CP_ACCESS_TRAP_EL2; 7017 } 7018 } else { 7019 if (!(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 7020 return CP_ACCESS_TRAP; 7021 } 7022 if (hcr & HCR_TID2) { 7023 return CP_ACCESS_TRAP_EL2; 7024 } 7025 } 7026 } else if (hcr & HCR_TID2) { 7027 return CP_ACCESS_TRAP_EL2; 7028 } 7029 } 7030 7031 if (arm_current_el(env) < 2 && arm_hcr_el2_eff(env) & HCR_TID2) { 7032 return CP_ACCESS_TRAP_EL2; 7033 } 7034 7035 return CP_ACCESS_OK; 7036 } 7037 7038 /* 7039 * Check for traps to RAS registers, which are controlled 7040 * by HCR_EL2.TERR and SCR_EL3.TERR. 7041 */ 7042 static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri, 7043 bool isread) 7044 { 7045 int el = arm_current_el(env); 7046 7047 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) { 7048 return CP_ACCESS_TRAP_EL2; 7049 } 7050 if (el < 3 && (env->cp15.scr_el3 & SCR_TERR)) { 7051 return CP_ACCESS_TRAP_EL3; 7052 } 7053 return CP_ACCESS_OK; 7054 } 7055 7056 static uint64_t disr_read(CPUARMState *env, const ARMCPRegInfo *ri) 7057 { 7058 int el = arm_current_el(env); 7059 7060 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) { 7061 return env->cp15.vdisr_el2; 7062 } 7063 if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) { 7064 return 0; /* RAZ/WI */ 7065 } 7066 return env->cp15.disr_el1; 7067 } 7068 7069 static void disr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 7070 { 7071 int el = arm_current_el(env); 7072 7073 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) { 7074 env->cp15.vdisr_el2 = val; 7075 return; 7076 } 7077 if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) { 7078 return; /* RAZ/WI */ 7079 } 7080 env->cp15.disr_el1 = val; 7081 } 7082 7083 /* 7084 * Minimal RAS implementation with no Error Records. 7085 * Which means that all of the Error Record registers: 7086 * ERXADDR_EL1 7087 * ERXCTLR_EL1 7088 * ERXFR_EL1 7089 * ERXMISC0_EL1 7090 * ERXMISC1_EL1 7091 * ERXMISC2_EL1 7092 * ERXMISC3_EL1 7093 * ERXPFGCDN_EL1 (RASv1p1) 7094 * ERXPFGCTL_EL1 (RASv1p1) 7095 * ERXPFGF_EL1 (RASv1p1) 7096 * ERXSTATUS_EL1 7097 * and 7098 * ERRSELR_EL1 7099 * may generate UNDEFINED, which is the effect we get by not 7100 * listing them at all. 7101 * 7102 * These registers have fine-grained trap bits, but UNDEF-to-EL1 7103 * is higher priority than FGT-to-EL2 so we do not need to list them 7104 * in order to check for an FGT. 7105 */ 7106 static const ARMCPRegInfo minimal_ras_reginfo[] = { 7107 { .name = "DISR_EL1", .state = ARM_CP_STATE_BOTH, 7108 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 1, 7109 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.disr_el1), 7110 .readfn = disr_read, .writefn = disr_write, .raw_writefn = raw_write }, 7111 { .name = "ERRIDR_EL1", .state = ARM_CP_STATE_BOTH, 7112 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 3, .opc2 = 0, 7113 .access = PL1_R, .accessfn = access_terr, 7114 .fgt = FGT_ERRIDR_EL1, 7115 .type = ARM_CP_CONST, .resetvalue = 0 }, 7116 { .name = "VDISR_EL2", .state = ARM_CP_STATE_BOTH, 7117 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 1, .opc2 = 1, 7118 .nv2_redirect_offset = 0x500, 7119 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vdisr_el2) }, 7120 { .name = "VSESR_EL2", .state = ARM_CP_STATE_BOTH, 7121 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 3, 7122 .nv2_redirect_offset = 0x508, 7123 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vsesr_el2) }, 7124 }; 7125 7126 /* 7127 * Return the exception level to which exceptions should be taken 7128 * via SVEAccessTrap. This excludes the check for whether the exception 7129 * should be routed through AArch64.AdvSIMDFPAccessTrap. That can easily 7130 * be found by testing 0 < fp_exception_el < sve_exception_el. 7131 * 7132 * C.f. the ARM pseudocode function CheckSVEEnabled. Note that the 7133 * pseudocode does *not* separate out the FP trap checks, but has them 7134 * all in one function. 7135 */ 7136 int sve_exception_el(CPUARMState *env, int el) 7137 { 7138 #ifndef CONFIG_USER_ONLY 7139 if (el <= 1 && !el_is_in_host(env, el)) { 7140 switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, ZEN)) { 7141 case 1: 7142 if (el != 0) { 7143 break; 7144 } 7145 /* fall through */ 7146 case 0: 7147 case 2: 7148 return 1; 7149 } 7150 } 7151 7152 if (el <= 2 && arm_is_el2_enabled(env)) { 7153 /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */ 7154 if (env->cp15.hcr_el2 & HCR_E2H) { 7155 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, ZEN)) { 7156 case 1: 7157 if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) { 7158 break; 7159 } 7160 /* fall through */ 7161 case 0: 7162 case 2: 7163 return 2; 7164 } 7165 } else { 7166 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TZ)) { 7167 return 2; 7168 } 7169 } 7170 } 7171 7172 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 7173 if (arm_feature(env, ARM_FEATURE_EL3) 7174 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, EZ)) { 7175 return 3; 7176 } 7177 #endif 7178 return 0; 7179 } 7180 7181 /* 7182 * Return the exception level to which exceptions should be taken for SME. 7183 * C.f. the ARM pseudocode function CheckSMEAccess. 7184 */ 7185 int sme_exception_el(CPUARMState *env, int el) 7186 { 7187 #ifndef CONFIG_USER_ONLY 7188 if (el <= 1 && !el_is_in_host(env, el)) { 7189 switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) { 7190 case 1: 7191 if (el != 0) { 7192 break; 7193 } 7194 /* fall through */ 7195 case 0: 7196 case 2: 7197 return 1; 7198 } 7199 } 7200 7201 if (el <= 2 && arm_is_el2_enabled(env)) { 7202 /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */ 7203 if (env->cp15.hcr_el2 & HCR_E2H) { 7204 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) { 7205 case 1: 7206 if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) { 7207 break; 7208 } 7209 /* fall through */ 7210 case 0: 7211 case 2: 7212 return 2; 7213 } 7214 } else { 7215 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) { 7216 return 2; 7217 } 7218 } 7219 } 7220 7221 /* CPTR_EL3. Since ESM is negative we must check for EL3. */ 7222 if (arm_feature(env, ARM_FEATURE_EL3) 7223 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) { 7224 return 3; 7225 } 7226 #endif 7227 return 0; 7228 } 7229 7230 /* 7231 * Given that SVE is enabled, return the vector length for EL. 7232 */ 7233 uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm) 7234 { 7235 ARMCPU *cpu = env_archcpu(env); 7236 uint64_t *cr = env->vfp.zcr_el; 7237 uint32_t map = cpu->sve_vq.map; 7238 uint32_t len = ARM_MAX_VQ - 1; 7239 7240 if (sm) { 7241 cr = env->vfp.smcr_el; 7242 map = cpu->sme_vq.map; 7243 } 7244 7245 if (el <= 1 && !el_is_in_host(env, el)) { 7246 len = MIN(len, 0xf & (uint32_t)cr[1]); 7247 } 7248 if (el <= 2 && arm_is_el2_enabled(env)) { 7249 len = MIN(len, 0xf & (uint32_t)cr[2]); 7250 } 7251 if (arm_feature(env, ARM_FEATURE_EL3)) { 7252 len = MIN(len, 0xf & (uint32_t)cr[3]); 7253 } 7254 7255 map &= MAKE_64BIT_MASK(0, len + 1); 7256 if (map != 0) { 7257 return 31 - clz32(map); 7258 } 7259 7260 /* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */ 7261 assert(sm); 7262 return ctz32(cpu->sme_vq.map); 7263 } 7264 7265 uint32_t sve_vqm1_for_el(CPUARMState *env, int el) 7266 { 7267 return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM)); 7268 } 7269 7270 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 7271 uint64_t value) 7272 { 7273 int cur_el = arm_current_el(env); 7274 int old_len = sve_vqm1_for_el(env, cur_el); 7275 int new_len; 7276 7277 /* Bits other than [3:0] are RAZ/WI. */ 7278 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16); 7279 raw_write(env, ri, value & 0xf); 7280 7281 /* 7282 * Because we arrived here, we know both FP and SVE are enabled; 7283 * otherwise we would have trapped access to the ZCR_ELn register. 7284 */ 7285 new_len = sve_vqm1_for_el(env, cur_el); 7286 if (new_len < old_len) { 7287 aarch64_sve_narrow_vq(env, new_len + 1); 7288 } 7289 } 7290 7291 static const ARMCPRegInfo zcr_reginfo[] = { 7292 { .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 7293 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 7294 .nv2_redirect_offset = 0x1e0 | NV2_REDIR_NV1, 7295 .access = PL1_RW, .type = ARM_CP_SVE, 7296 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 7297 .writefn = zcr_write, .raw_writefn = raw_write }, 7298 { .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 7299 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 7300 .access = PL2_RW, .type = ARM_CP_SVE, 7301 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 7302 .writefn = zcr_write, .raw_writefn = raw_write }, 7303 { .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 7304 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 7305 .access = PL3_RW, .type = ARM_CP_SVE, 7306 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 7307 .writefn = zcr_write, .raw_writefn = raw_write }, 7308 }; 7309 7310 #ifdef TARGET_AARCH64 7311 static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri, 7312 bool isread) 7313 { 7314 int el = arm_current_el(env); 7315 7316 if (el == 0) { 7317 uint64_t sctlr = arm_sctlr(env, el); 7318 if (!(sctlr & SCTLR_EnTP2)) { 7319 return CP_ACCESS_TRAP; 7320 } 7321 } 7322 /* TODO: FEAT_FGT */ 7323 if (el < 3 7324 && arm_feature(env, ARM_FEATURE_EL3) 7325 && !(env->cp15.scr_el3 & SCR_ENTP2)) { 7326 return CP_ACCESS_TRAP_EL3; 7327 } 7328 return CP_ACCESS_OK; 7329 } 7330 7331 static CPAccessResult access_smprimap(CPUARMState *env, const ARMCPRegInfo *ri, 7332 bool isread) 7333 { 7334 /* If EL1 this is a FEAT_NV access and CPTR_EL3.ESM doesn't apply */ 7335 if (arm_current_el(env) == 2 7336 && arm_feature(env, ARM_FEATURE_EL3) 7337 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) { 7338 return CP_ACCESS_TRAP_EL3; 7339 } 7340 return CP_ACCESS_OK; 7341 } 7342 7343 static CPAccessResult access_smpri(CPUARMState *env, const ARMCPRegInfo *ri, 7344 bool isread) 7345 { 7346 if (arm_current_el(env) < 3 7347 && arm_feature(env, ARM_FEATURE_EL3) 7348 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) { 7349 return CP_ACCESS_TRAP_EL3; 7350 } 7351 return CP_ACCESS_OK; 7352 } 7353 7354 /* ResetSVEState */ 7355 static void arm_reset_sve_state(CPUARMState *env) 7356 { 7357 memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs)); 7358 /* Recall that FFR is stored as pregs[16]. */ 7359 memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs)); 7360 vfp_set_fpcr(env, 0x0800009f); 7361 } 7362 7363 void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask) 7364 { 7365 uint64_t change = (env->svcr ^ new) & mask; 7366 7367 if (change == 0) { 7368 return; 7369 } 7370 env->svcr ^= change; 7371 7372 if (change & R_SVCR_SM_MASK) { 7373 arm_reset_sve_state(env); 7374 } 7375 7376 /* 7377 * ResetSMEState. 7378 * 7379 * SetPSTATE_ZA zeros on enable and disable. We can zero this only 7380 * on enable: while disabled, the storage is inaccessible and the 7381 * value does not matter. We're not saving the storage in vmstate 7382 * when disabled either. 7383 */ 7384 if (change & new & R_SVCR_ZA_MASK) { 7385 memset(env->zarray, 0, sizeof(env->zarray)); 7386 } 7387 7388 if (tcg_enabled()) { 7389 arm_rebuild_hflags(env); 7390 } 7391 } 7392 7393 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 7394 uint64_t value) 7395 { 7396 aarch64_set_svcr(env, value, -1); 7397 } 7398 7399 static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 7400 uint64_t value) 7401 { 7402 int cur_el = arm_current_el(env); 7403 int old_len = sve_vqm1_for_el(env, cur_el); 7404 int new_len; 7405 7406 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1); 7407 value &= R_SMCR_LEN_MASK | R_SMCR_FA64_MASK; 7408 raw_write(env, ri, value); 7409 7410 /* 7411 * Note that it is CONSTRAINED UNPREDICTABLE what happens to ZA storage 7412 * when SVL is widened (old values kept, or zeros). Choose to keep the 7413 * current values for simplicity. But for QEMU internals, we must still 7414 * apply the narrower SVL to the Zregs and Pregs -- see the comment 7415 * above aarch64_sve_narrow_vq. 7416 */ 7417 new_len = sve_vqm1_for_el(env, cur_el); 7418 if (new_len < old_len) { 7419 aarch64_sve_narrow_vq(env, new_len + 1); 7420 } 7421 } 7422 7423 static const ARMCPRegInfo sme_reginfo[] = { 7424 { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64, 7425 .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5, 7426 .access = PL0_RW, .accessfn = access_tpidr2, 7427 .fgt = FGT_NTPIDR2_EL0, 7428 .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) }, 7429 { .name = "SVCR", .state = ARM_CP_STATE_AA64, 7430 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 2, 7431 .access = PL0_RW, .type = ARM_CP_SME, 7432 .fieldoffset = offsetof(CPUARMState, svcr), 7433 .writefn = svcr_write, .raw_writefn = raw_write }, 7434 { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64, 7435 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6, 7436 .nv2_redirect_offset = 0x1f0 | NV2_REDIR_NV1, 7437 .access = PL1_RW, .type = ARM_CP_SME, 7438 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]), 7439 .writefn = smcr_write, .raw_writefn = raw_write }, 7440 { .name = "SMCR_EL2", .state = ARM_CP_STATE_AA64, 7441 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 6, 7442 .access = PL2_RW, .type = ARM_CP_SME, 7443 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[2]), 7444 .writefn = smcr_write, .raw_writefn = raw_write }, 7445 { .name = "SMCR_EL3", .state = ARM_CP_STATE_AA64, 7446 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 6, 7447 .access = PL3_RW, .type = ARM_CP_SME, 7448 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]), 7449 .writefn = smcr_write, .raw_writefn = raw_write }, 7450 { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64, 7451 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6, 7452 .access = PL1_R, .accessfn = access_aa64_tid1, 7453 /* 7454 * IMPLEMENTOR = 0 (software) 7455 * REVISION = 0 (implementation defined) 7456 * SMPS = 0 (no streaming execution priority in QEMU) 7457 * AFFINITY = 0 (streaming sve mode not shared with other PEs) 7458 */ 7459 .type = ARM_CP_CONST, .resetvalue = 0, }, 7460 /* 7461 * Because SMIDR_EL1.SMPS is 0, SMPRI_EL1 and SMPRIMAP_EL2 are RES 0. 7462 */ 7463 { .name = "SMPRI_EL1", .state = ARM_CP_STATE_AA64, 7464 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 4, 7465 .access = PL1_RW, .accessfn = access_smpri, 7466 .fgt = FGT_NSMPRI_EL1, 7467 .type = ARM_CP_CONST, .resetvalue = 0 }, 7468 { .name = "SMPRIMAP_EL2", .state = ARM_CP_STATE_AA64, 7469 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 5, 7470 .nv2_redirect_offset = 0x1f8, 7471 .access = PL2_RW, .accessfn = access_smprimap, 7472 .type = ARM_CP_CONST, .resetvalue = 0 }, 7473 }; 7474 7475 static void tlbi_aa64_paall_write(CPUARMState *env, const ARMCPRegInfo *ri, 7476 uint64_t value) 7477 { 7478 CPUState *cs = env_cpu(env); 7479 7480 tlb_flush(cs); 7481 } 7482 7483 static void gpccr_write(CPUARMState *env, const ARMCPRegInfo *ri, 7484 uint64_t value) 7485 { 7486 /* L0GPTSZ is RO; other bits not mentioned are RES0. */ 7487 uint64_t rw_mask = R_GPCCR_PPS_MASK | R_GPCCR_IRGN_MASK | 7488 R_GPCCR_ORGN_MASK | R_GPCCR_SH_MASK | R_GPCCR_PGS_MASK | 7489 R_GPCCR_GPC_MASK | R_GPCCR_GPCP_MASK; 7490 7491 env->cp15.gpccr_el3 = (value & rw_mask) | (env->cp15.gpccr_el3 & ~rw_mask); 7492 } 7493 7494 static void gpccr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 7495 { 7496 env->cp15.gpccr_el3 = FIELD_DP64(0, GPCCR, L0GPTSZ, 7497 env_archcpu(env)->reset_l0gptsz); 7498 } 7499 7500 static void tlbi_aa64_paallos_write(CPUARMState *env, const ARMCPRegInfo *ri, 7501 uint64_t value) 7502 { 7503 CPUState *cs = env_cpu(env); 7504 7505 tlb_flush_all_cpus_synced(cs); 7506 } 7507 7508 static const ARMCPRegInfo rme_reginfo[] = { 7509 { .name = "GPCCR_EL3", .state = ARM_CP_STATE_AA64, 7510 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 6, 7511 .access = PL3_RW, .writefn = gpccr_write, .resetfn = gpccr_reset, 7512 .fieldoffset = offsetof(CPUARMState, cp15.gpccr_el3) }, 7513 { .name = "GPTBR_EL3", .state = ARM_CP_STATE_AA64, 7514 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 4, 7515 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.gptbr_el3) }, 7516 { .name = "MFAR_EL3", .state = ARM_CP_STATE_AA64, 7517 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 5, 7518 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mfar_el3) }, 7519 { .name = "TLBI_PAALL", .state = ARM_CP_STATE_AA64, 7520 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 4, 7521 .access = PL3_W, .type = ARM_CP_NO_RAW, 7522 .writefn = tlbi_aa64_paall_write }, 7523 { .name = "TLBI_PAALLOS", .state = ARM_CP_STATE_AA64, 7524 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 4, 7525 .access = PL3_W, .type = ARM_CP_NO_RAW, 7526 .writefn = tlbi_aa64_paallos_write }, 7527 /* 7528 * QEMU does not have a way to invalidate by physical address, thus 7529 * invalidating a range of physical addresses is accomplished by 7530 * flushing all tlb entries in the outer shareable domain, 7531 * just like PAALLOS. 7532 */ 7533 { .name = "TLBI_RPALOS", .state = ARM_CP_STATE_AA64, 7534 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 7, 7535 .access = PL3_W, .type = ARM_CP_NO_RAW, 7536 .writefn = tlbi_aa64_paallos_write }, 7537 { .name = "TLBI_RPAOS", .state = ARM_CP_STATE_AA64, 7538 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 3, 7539 .access = PL3_W, .type = ARM_CP_NO_RAW, 7540 .writefn = tlbi_aa64_paallos_write }, 7541 { .name = "DC_CIPAPA", .state = ARM_CP_STATE_AA64, 7542 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 1, 7543 .access = PL3_W, .type = ARM_CP_NOP }, 7544 }; 7545 7546 static const ARMCPRegInfo rme_mte_reginfo[] = { 7547 { .name = "DC_CIGDPAPA", .state = ARM_CP_STATE_AA64, 7548 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 5, 7549 .access = PL3_W, .type = ARM_CP_NOP }, 7550 }; 7551 7552 static void aa64_allint_write(CPUARMState *env, const ARMCPRegInfo *ri, 7553 uint64_t value) 7554 { 7555 env->pstate = (env->pstate & ~PSTATE_ALLINT) | (value & PSTATE_ALLINT); 7556 } 7557 7558 static uint64_t aa64_allint_read(CPUARMState *env, const ARMCPRegInfo *ri) 7559 { 7560 return env->pstate & PSTATE_ALLINT; 7561 } 7562 7563 static CPAccessResult aa64_allint_access(CPUARMState *env, 7564 const ARMCPRegInfo *ri, bool isread) 7565 { 7566 if (!isread && arm_current_el(env) == 1 && 7567 (arm_hcrx_el2_eff(env) & HCRX_TALLINT)) { 7568 return CP_ACCESS_TRAP_EL2; 7569 } 7570 return CP_ACCESS_OK; 7571 } 7572 7573 static const ARMCPRegInfo nmi_reginfo[] = { 7574 { .name = "ALLINT", .state = ARM_CP_STATE_AA64, 7575 .opc0 = 3, .opc1 = 0, .opc2 = 0, .crn = 4, .crm = 3, 7576 .type = ARM_CP_NO_RAW, 7577 .access = PL1_RW, .accessfn = aa64_allint_access, 7578 .fieldoffset = offsetof(CPUARMState, pstate), 7579 .writefn = aa64_allint_write, .readfn = aa64_allint_read, 7580 .resetfn = arm_cp_reset_ignore }, 7581 }; 7582 #endif /* TARGET_AARCH64 */ 7583 7584 static void define_pmu_regs(ARMCPU *cpu) 7585 { 7586 /* 7587 * v7 performance monitor control register: same implementor 7588 * field as main ID register, and we implement four counters in 7589 * addition to the cycle count register. 7590 */ 7591 unsigned int i, pmcrn = pmu_num_counters(&cpu->env); 7592 ARMCPRegInfo pmcr = { 7593 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 7594 .access = PL0_RW, 7595 .fgt = FGT_PMCR_EL0, 7596 .type = ARM_CP_IO | ARM_CP_ALIAS, 7597 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 7598 .accessfn = pmreg_access, 7599 .readfn = pmcr_read, .raw_readfn = raw_read, 7600 .writefn = pmcr_write, .raw_writefn = raw_write, 7601 }; 7602 ARMCPRegInfo pmcr64 = { 7603 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 7604 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 7605 .access = PL0_RW, .accessfn = pmreg_access, 7606 .fgt = FGT_PMCR_EL0, 7607 .type = ARM_CP_IO, 7608 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 7609 .resetvalue = cpu->isar.reset_pmcr_el0, 7610 .readfn = pmcr_read, .raw_readfn = raw_read, 7611 .writefn = pmcr_write, .raw_writefn = raw_write, 7612 }; 7613 7614 define_one_arm_cp_reg(cpu, &pmcr); 7615 define_one_arm_cp_reg(cpu, &pmcr64); 7616 for (i = 0; i < pmcrn; i++) { 7617 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 7618 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 7619 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 7620 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 7621 ARMCPRegInfo pmev_regs[] = { 7622 { .name = pmevcntr_name, .cp = 15, .crn = 14, 7623 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 7624 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 7625 .fgt = FGT_PMEVCNTRN_EL0, 7626 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 7627 .accessfn = pmreg_access_xevcntr }, 7628 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 7629 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)), 7630 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access_xevcntr, 7631 .type = ARM_CP_IO, 7632 .fgt = FGT_PMEVCNTRN_EL0, 7633 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 7634 .raw_readfn = pmevcntr_rawread, 7635 .raw_writefn = pmevcntr_rawwrite }, 7636 { .name = pmevtyper_name, .cp = 15, .crn = 14, 7637 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 7638 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 7639 .fgt = FGT_PMEVTYPERN_EL0, 7640 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 7641 .accessfn = pmreg_access }, 7642 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 7643 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)), 7644 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 7645 .fgt = FGT_PMEVTYPERN_EL0, 7646 .type = ARM_CP_IO, 7647 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 7648 .raw_writefn = pmevtyper_rawwrite }, 7649 }; 7650 define_arm_cp_regs(cpu, pmev_regs); 7651 g_free(pmevcntr_name); 7652 g_free(pmevcntr_el0_name); 7653 g_free(pmevtyper_name); 7654 g_free(pmevtyper_el0_name); 7655 } 7656 if (cpu_isar_feature(aa32_pmuv3p1, cpu)) { 7657 ARMCPRegInfo v81_pmu_regs[] = { 7658 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 7659 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 7660 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7661 .fgt = FGT_PMCEIDN_EL0, 7662 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 7663 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 7664 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 7665 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7666 .fgt = FGT_PMCEIDN_EL0, 7667 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 7668 }; 7669 define_arm_cp_regs(cpu, v81_pmu_regs); 7670 } 7671 if (cpu_isar_feature(any_pmuv3p4, cpu)) { 7672 static const ARMCPRegInfo v84_pmmir = { 7673 .name = "PMMIR_EL1", .state = ARM_CP_STATE_BOTH, 7674 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 6, 7675 .access = PL1_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7676 .fgt = FGT_PMMIR_EL1, 7677 .resetvalue = 0 7678 }; 7679 define_one_arm_cp_reg(cpu, &v84_pmmir); 7680 } 7681 } 7682 7683 #ifndef CONFIG_USER_ONLY 7684 /* 7685 * We don't know until after realize whether there's a GICv3 7686 * attached, and that is what registers the gicv3 sysregs. 7687 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 7688 * at runtime. 7689 */ 7690 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 7691 { 7692 ARMCPU *cpu = env_archcpu(env); 7693 uint64_t pfr1 = cpu->isar.id_pfr1; 7694 7695 if (env->gicv3state) { 7696 pfr1 |= 1 << 28; 7697 } 7698 return pfr1; 7699 } 7700 7701 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 7702 { 7703 ARMCPU *cpu = env_archcpu(env); 7704 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 7705 7706 if (env->gicv3state) { 7707 pfr0 |= 1 << 24; 7708 } 7709 return pfr0; 7710 } 7711 #endif 7712 7713 /* 7714 * Shared logic between LORID and the rest of the LOR* registers. 7715 * Secure state exclusion has already been dealt with. 7716 */ 7717 static CPAccessResult access_lor_ns(CPUARMState *env, 7718 const ARMCPRegInfo *ri, bool isread) 7719 { 7720 int el = arm_current_el(env); 7721 7722 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 7723 return CP_ACCESS_TRAP_EL2; 7724 } 7725 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 7726 return CP_ACCESS_TRAP_EL3; 7727 } 7728 return CP_ACCESS_OK; 7729 } 7730 7731 static CPAccessResult access_lor_other(CPUARMState *env, 7732 const ARMCPRegInfo *ri, bool isread) 7733 { 7734 if (arm_is_secure_below_el3(env)) { 7735 /* Access denied in secure mode. */ 7736 return CP_ACCESS_TRAP; 7737 } 7738 return access_lor_ns(env, ri, isread); 7739 } 7740 7741 /* 7742 * A trivial implementation of ARMv8.1-LOR leaves all of these 7743 * registers fixed at 0, which indicates that there are zero 7744 * supported Limited Ordering regions. 7745 */ 7746 static const ARMCPRegInfo lor_reginfo[] = { 7747 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 7748 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 7749 .access = PL1_RW, .accessfn = access_lor_other, 7750 .fgt = FGT_LORSA_EL1, 7751 .type = ARM_CP_CONST, .resetvalue = 0 }, 7752 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 7753 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 7754 .access = PL1_RW, .accessfn = access_lor_other, 7755 .fgt = FGT_LOREA_EL1, 7756 .type = ARM_CP_CONST, .resetvalue = 0 }, 7757 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 7758 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 7759 .access = PL1_RW, .accessfn = access_lor_other, 7760 .fgt = FGT_LORN_EL1, 7761 .type = ARM_CP_CONST, .resetvalue = 0 }, 7762 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 7763 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 7764 .access = PL1_RW, .accessfn = access_lor_other, 7765 .fgt = FGT_LORC_EL1, 7766 .type = ARM_CP_CONST, .resetvalue = 0 }, 7767 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 7768 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 7769 .access = PL1_R, .accessfn = access_lor_ns, 7770 .fgt = FGT_LORID_EL1, 7771 .type = ARM_CP_CONST, .resetvalue = 0 }, 7772 }; 7773 7774 #ifdef TARGET_AARCH64 7775 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 7776 bool isread) 7777 { 7778 int el = arm_current_el(env); 7779 7780 if (el < 2 && 7781 arm_is_el2_enabled(env) && 7782 !(arm_hcr_el2_eff(env) & HCR_APK)) { 7783 return CP_ACCESS_TRAP_EL2; 7784 } 7785 if (el < 3 && 7786 arm_feature(env, ARM_FEATURE_EL3) && 7787 !(env->cp15.scr_el3 & SCR_APK)) { 7788 return CP_ACCESS_TRAP_EL3; 7789 } 7790 return CP_ACCESS_OK; 7791 } 7792 7793 static const ARMCPRegInfo pauth_reginfo[] = { 7794 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7795 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 7796 .access = PL1_RW, .accessfn = access_pauth, 7797 .fgt = FGT_APDAKEY, 7798 .fieldoffset = offsetof(CPUARMState, keys.apda.lo) }, 7799 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7800 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 7801 .access = PL1_RW, .accessfn = access_pauth, 7802 .fgt = FGT_APDAKEY, 7803 .fieldoffset = offsetof(CPUARMState, keys.apda.hi) }, 7804 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7805 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 7806 .access = PL1_RW, .accessfn = access_pauth, 7807 .fgt = FGT_APDBKEY, 7808 .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) }, 7809 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7810 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 7811 .access = PL1_RW, .accessfn = access_pauth, 7812 .fgt = FGT_APDBKEY, 7813 .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) }, 7814 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7815 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 7816 .access = PL1_RW, .accessfn = access_pauth, 7817 .fgt = FGT_APGAKEY, 7818 .fieldoffset = offsetof(CPUARMState, keys.apga.lo) }, 7819 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7820 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 7821 .access = PL1_RW, .accessfn = access_pauth, 7822 .fgt = FGT_APGAKEY, 7823 .fieldoffset = offsetof(CPUARMState, keys.apga.hi) }, 7824 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7825 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 7826 .access = PL1_RW, .accessfn = access_pauth, 7827 .fgt = FGT_APIAKEY, 7828 .fieldoffset = offsetof(CPUARMState, keys.apia.lo) }, 7829 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7830 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 7831 .access = PL1_RW, .accessfn = access_pauth, 7832 .fgt = FGT_APIAKEY, 7833 .fieldoffset = offsetof(CPUARMState, keys.apia.hi) }, 7834 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7835 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 7836 .access = PL1_RW, .accessfn = access_pauth, 7837 .fgt = FGT_APIBKEY, 7838 .fieldoffset = offsetof(CPUARMState, keys.apib.lo) }, 7839 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7840 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 7841 .access = PL1_RW, .accessfn = access_pauth, 7842 .fgt = FGT_APIBKEY, 7843 .fieldoffset = offsetof(CPUARMState, keys.apib.hi) }, 7844 }; 7845 7846 static const ARMCPRegInfo tlbirange_reginfo[] = { 7847 { .name = "TLBI_RVAE1IS", .state = ARM_CP_STATE_AA64, 7848 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 1, 7849 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 7850 .fgt = FGT_TLBIRVAE1IS, 7851 .writefn = tlbi_aa64_rvae1is_write }, 7852 { .name = "TLBI_RVAAE1IS", .state = ARM_CP_STATE_AA64, 7853 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 3, 7854 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 7855 .fgt = FGT_TLBIRVAAE1IS, 7856 .writefn = tlbi_aa64_rvae1is_write }, 7857 { .name = "TLBI_RVALE1IS", .state = ARM_CP_STATE_AA64, 7858 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 5, 7859 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 7860 .fgt = FGT_TLBIRVALE1IS, 7861 .writefn = tlbi_aa64_rvae1is_write }, 7862 { .name = "TLBI_RVAALE1IS", .state = ARM_CP_STATE_AA64, 7863 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 7, 7864 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 7865 .fgt = FGT_TLBIRVAALE1IS, 7866 .writefn = tlbi_aa64_rvae1is_write }, 7867 { .name = "TLBI_RVAE1OS", .state = ARM_CP_STATE_AA64, 7868 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 7869 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7870 .fgt = FGT_TLBIRVAE1OS, 7871 .writefn = tlbi_aa64_rvae1is_write }, 7872 { .name = "TLBI_RVAAE1OS", .state = ARM_CP_STATE_AA64, 7873 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 3, 7874 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7875 .fgt = FGT_TLBIRVAAE1OS, 7876 .writefn = tlbi_aa64_rvae1is_write }, 7877 { .name = "TLBI_RVALE1OS", .state = ARM_CP_STATE_AA64, 7878 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 5, 7879 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7880 .fgt = FGT_TLBIRVALE1OS, 7881 .writefn = tlbi_aa64_rvae1is_write }, 7882 { .name = "TLBI_RVAALE1OS", .state = ARM_CP_STATE_AA64, 7883 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 7, 7884 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7885 .fgt = FGT_TLBIRVAALE1OS, 7886 .writefn = tlbi_aa64_rvae1is_write }, 7887 { .name = "TLBI_RVAE1", .state = ARM_CP_STATE_AA64, 7888 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 7889 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 7890 .fgt = FGT_TLBIRVAE1, 7891 .writefn = tlbi_aa64_rvae1_write }, 7892 { .name = "TLBI_RVAAE1", .state = ARM_CP_STATE_AA64, 7893 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 3, 7894 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 7895 .fgt = FGT_TLBIRVAAE1, 7896 .writefn = tlbi_aa64_rvae1_write }, 7897 { .name = "TLBI_RVALE1", .state = ARM_CP_STATE_AA64, 7898 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 5, 7899 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 7900 .fgt = FGT_TLBIRVALE1, 7901 .writefn = tlbi_aa64_rvae1_write }, 7902 { .name = "TLBI_RVAALE1", .state = ARM_CP_STATE_AA64, 7903 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 7, 7904 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 7905 .fgt = FGT_TLBIRVAALE1, 7906 .writefn = tlbi_aa64_rvae1_write }, 7907 { .name = "TLBI_RIPAS2E1IS", .state = ARM_CP_STATE_AA64, 7908 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 2, 7909 .access = PL2_W, .type = ARM_CP_NO_RAW, 7910 .writefn = tlbi_aa64_ripas2e1is_write }, 7911 { .name = "TLBI_RIPAS2LE1IS", .state = ARM_CP_STATE_AA64, 7912 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 6, 7913 .access = PL2_W, .type = ARM_CP_NO_RAW, 7914 .writefn = tlbi_aa64_ripas2e1is_write }, 7915 { .name = "TLBI_RVAE2IS", .state = ARM_CP_STATE_AA64, 7916 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 1, 7917 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7918 .writefn = tlbi_aa64_rvae2is_write }, 7919 { .name = "TLBI_RVALE2IS", .state = ARM_CP_STATE_AA64, 7920 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 5, 7921 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7922 .writefn = tlbi_aa64_rvae2is_write }, 7923 { .name = "TLBI_RIPAS2E1", .state = ARM_CP_STATE_AA64, 7924 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 2, 7925 .access = PL2_W, .type = ARM_CP_NO_RAW, 7926 .writefn = tlbi_aa64_ripas2e1_write }, 7927 { .name = "TLBI_RIPAS2LE1", .state = ARM_CP_STATE_AA64, 7928 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 6, 7929 .access = PL2_W, .type = ARM_CP_NO_RAW, 7930 .writefn = tlbi_aa64_ripas2e1_write }, 7931 { .name = "TLBI_RVAE2OS", .state = ARM_CP_STATE_AA64, 7932 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 1, 7933 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7934 .writefn = tlbi_aa64_rvae2is_write }, 7935 { .name = "TLBI_RVALE2OS", .state = ARM_CP_STATE_AA64, 7936 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 5, 7937 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7938 .writefn = tlbi_aa64_rvae2is_write }, 7939 { .name = "TLBI_RVAE2", .state = ARM_CP_STATE_AA64, 7940 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 1, 7941 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7942 .writefn = tlbi_aa64_rvae2_write }, 7943 { .name = "TLBI_RVALE2", .state = ARM_CP_STATE_AA64, 7944 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 5, 7945 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7946 .writefn = tlbi_aa64_rvae2_write }, 7947 { .name = "TLBI_RVAE3IS", .state = ARM_CP_STATE_AA64, 7948 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 1, 7949 .access = PL3_W, .type = ARM_CP_NO_RAW, 7950 .writefn = tlbi_aa64_rvae3is_write }, 7951 { .name = "TLBI_RVALE3IS", .state = ARM_CP_STATE_AA64, 7952 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 5, 7953 .access = PL3_W, .type = ARM_CP_NO_RAW, 7954 .writefn = tlbi_aa64_rvae3is_write }, 7955 { .name = "TLBI_RVAE3OS", .state = ARM_CP_STATE_AA64, 7956 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 5, .opc2 = 1, 7957 .access = PL3_W, .type = ARM_CP_NO_RAW, 7958 .writefn = tlbi_aa64_rvae3is_write }, 7959 { .name = "TLBI_RVALE3OS", .state = ARM_CP_STATE_AA64, 7960 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 5, .opc2 = 5, 7961 .access = PL3_W, .type = ARM_CP_NO_RAW, 7962 .writefn = tlbi_aa64_rvae3is_write }, 7963 { .name = "TLBI_RVAE3", .state = ARM_CP_STATE_AA64, 7964 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 1, 7965 .access = PL3_W, .type = ARM_CP_NO_RAW, 7966 .writefn = tlbi_aa64_rvae3_write }, 7967 { .name = "TLBI_RVALE3", .state = ARM_CP_STATE_AA64, 7968 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 5, 7969 .access = PL3_W, .type = ARM_CP_NO_RAW, 7970 .writefn = tlbi_aa64_rvae3_write }, 7971 }; 7972 7973 static const ARMCPRegInfo tlbios_reginfo[] = { 7974 { .name = "TLBI_VMALLE1OS", .state = ARM_CP_STATE_AA64, 7975 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 0, 7976 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7977 .fgt = FGT_TLBIVMALLE1OS, 7978 .writefn = tlbi_aa64_vmalle1is_write }, 7979 { .name = "TLBI_VAE1OS", .state = ARM_CP_STATE_AA64, 7980 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 1, 7981 .fgt = FGT_TLBIVAE1OS, 7982 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7983 .writefn = tlbi_aa64_vae1is_write }, 7984 { .name = "TLBI_ASIDE1OS", .state = ARM_CP_STATE_AA64, 7985 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 2, 7986 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7987 .fgt = FGT_TLBIASIDE1OS, 7988 .writefn = tlbi_aa64_vmalle1is_write }, 7989 { .name = "TLBI_VAAE1OS", .state = ARM_CP_STATE_AA64, 7990 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 3, 7991 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7992 .fgt = FGT_TLBIVAAE1OS, 7993 .writefn = tlbi_aa64_vae1is_write }, 7994 { .name = "TLBI_VALE1OS", .state = ARM_CP_STATE_AA64, 7995 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 5, 7996 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7997 .fgt = FGT_TLBIVALE1OS, 7998 .writefn = tlbi_aa64_vae1is_write }, 7999 { .name = "TLBI_VAALE1OS", .state = ARM_CP_STATE_AA64, 8000 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 7, 8001 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 8002 .fgt = FGT_TLBIVAALE1OS, 8003 .writefn = tlbi_aa64_vae1is_write }, 8004 { .name = "TLBI_ALLE2OS", .state = ARM_CP_STATE_AA64, 8005 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 0, 8006 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 8007 .writefn = tlbi_aa64_alle2is_write }, 8008 { .name = "TLBI_VAE2OS", .state = ARM_CP_STATE_AA64, 8009 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 1, 8010 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 8011 .writefn = tlbi_aa64_vae2is_write }, 8012 { .name = "TLBI_ALLE1OS", .state = ARM_CP_STATE_AA64, 8013 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 4, 8014 .access = PL2_W, .type = ARM_CP_NO_RAW, 8015 .writefn = tlbi_aa64_alle1is_write }, 8016 { .name = "TLBI_VALE2OS", .state = ARM_CP_STATE_AA64, 8017 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 5, 8018 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 8019 .writefn = tlbi_aa64_vae2is_write }, 8020 { .name = "TLBI_VMALLS12E1OS", .state = ARM_CP_STATE_AA64, 8021 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 6, 8022 .access = PL2_W, .type = ARM_CP_NO_RAW, 8023 .writefn = tlbi_aa64_alle1is_write }, 8024 { .name = "TLBI_IPAS2E1OS", .state = ARM_CP_STATE_AA64, 8025 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 0, 8026 .access = PL2_W, .type = ARM_CP_NOP }, 8027 { .name = "TLBI_RIPAS2E1OS", .state = ARM_CP_STATE_AA64, 8028 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 3, 8029 .access = PL2_W, .type = ARM_CP_NOP }, 8030 { .name = "TLBI_IPAS2LE1OS", .state = ARM_CP_STATE_AA64, 8031 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 4, 8032 .access = PL2_W, .type = ARM_CP_NOP }, 8033 { .name = "TLBI_RIPAS2LE1OS", .state = ARM_CP_STATE_AA64, 8034 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 7, 8035 .access = PL2_W, .type = ARM_CP_NOP }, 8036 { .name = "TLBI_ALLE3OS", .state = ARM_CP_STATE_AA64, 8037 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 0, 8038 .access = PL3_W, .type = ARM_CP_NO_RAW, 8039 .writefn = tlbi_aa64_alle3is_write }, 8040 { .name = "TLBI_VAE3OS", .state = ARM_CP_STATE_AA64, 8041 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 1, 8042 .access = PL3_W, .type = ARM_CP_NO_RAW, 8043 .writefn = tlbi_aa64_vae3is_write }, 8044 { .name = "TLBI_VALE3OS", .state = ARM_CP_STATE_AA64, 8045 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 5, 8046 .access = PL3_W, .type = ARM_CP_NO_RAW, 8047 .writefn = tlbi_aa64_vae3is_write }, 8048 }; 8049 8050 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 8051 { 8052 Error *err = NULL; 8053 uint64_t ret; 8054 8055 /* Success sets NZCV = 0000. */ 8056 env->NF = env->CF = env->VF = 0, env->ZF = 1; 8057 8058 if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) { 8059 /* 8060 * ??? Failed, for unknown reasons in the crypto subsystem. 8061 * The best we can do is log the reason and return the 8062 * timed-out indication to the guest. There is no reason 8063 * we know to expect this failure to be transitory, so the 8064 * guest may well hang retrying the operation. 8065 */ 8066 qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s", 8067 ri->name, error_get_pretty(err)); 8068 error_free(err); 8069 8070 env->ZF = 0; /* NZCF = 0100 */ 8071 return 0; 8072 } 8073 return ret; 8074 } 8075 8076 /* We do not support re-seeding, so the two registers operate the same. */ 8077 static const ARMCPRegInfo rndr_reginfo[] = { 8078 { .name = "RNDR", .state = ARM_CP_STATE_AA64, 8079 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 8080 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0, 8081 .access = PL0_R, .readfn = rndr_readfn }, 8082 { .name = "RNDRRS", .state = ARM_CP_STATE_AA64, 8083 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 8084 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1, 8085 .access = PL0_R, .readfn = rndr_readfn }, 8086 }; 8087 8088 static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque, 8089 uint64_t value) 8090 { 8091 #ifdef CONFIG_TCG 8092 ARMCPU *cpu = env_archcpu(env); 8093 /* CTR_EL0 System register -> DminLine, bits [19:16] */ 8094 uint64_t dline_size = 4 << ((cpu->ctr >> 16) & 0xF); 8095 uint64_t vaddr_in = (uint64_t) value; 8096 uint64_t vaddr = vaddr_in & ~(dline_size - 1); 8097 void *haddr; 8098 int mem_idx = arm_env_mmu_index(env); 8099 8100 /* This won't be crossing page boundaries */ 8101 haddr = probe_read(env, vaddr, dline_size, mem_idx, GETPC()); 8102 if (haddr) { 8103 #ifndef CONFIG_USER_ONLY 8104 8105 ram_addr_t offset; 8106 MemoryRegion *mr; 8107 8108 /* RCU lock is already being held */ 8109 mr = memory_region_from_host(haddr, &offset); 8110 8111 if (mr) { 8112 memory_region_writeback(mr, offset, dline_size); 8113 } 8114 #endif /*CONFIG_USER_ONLY*/ 8115 } 8116 #else 8117 /* Handled by hardware accelerator. */ 8118 g_assert_not_reached(); 8119 #endif /* CONFIG_TCG */ 8120 } 8121 8122 static const ARMCPRegInfo dcpop_reg[] = { 8123 { .name = "DC_CVAP", .state = ARM_CP_STATE_AA64, 8124 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1, 8125 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 8126 .fgt = FGT_DCCVAP, 8127 .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn }, 8128 }; 8129 8130 static const ARMCPRegInfo dcpodp_reg[] = { 8131 { .name = "DC_CVADP", .state = ARM_CP_STATE_AA64, 8132 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1, 8133 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 8134 .fgt = FGT_DCCVADP, 8135 .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn }, 8136 }; 8137 8138 static CPAccessResult access_aa64_tid5(CPUARMState *env, const ARMCPRegInfo *ri, 8139 bool isread) 8140 { 8141 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID5)) { 8142 return CP_ACCESS_TRAP_EL2; 8143 } 8144 8145 return CP_ACCESS_OK; 8146 } 8147 8148 static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri, 8149 bool isread) 8150 { 8151 int el = arm_current_el(env); 8152 if (el < 2 && arm_is_el2_enabled(env)) { 8153 uint64_t hcr = arm_hcr_el2_eff(env); 8154 if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) { 8155 return CP_ACCESS_TRAP_EL2; 8156 } 8157 } 8158 if (el < 3 && 8159 arm_feature(env, ARM_FEATURE_EL3) && 8160 !(env->cp15.scr_el3 & SCR_ATA)) { 8161 return CP_ACCESS_TRAP_EL3; 8162 } 8163 return CP_ACCESS_OK; 8164 } 8165 8166 static CPAccessResult access_tfsr_el1(CPUARMState *env, const ARMCPRegInfo *ri, 8167 bool isread) 8168 { 8169 CPAccessResult nv1 = access_nv1(env, ri, isread); 8170 8171 if (nv1 != CP_ACCESS_OK) { 8172 return nv1; 8173 } 8174 return access_mte(env, ri, isread); 8175 } 8176 8177 static CPAccessResult access_tfsr_el2(CPUARMState *env, const ARMCPRegInfo *ri, 8178 bool isread) 8179 { 8180 /* 8181 * TFSR_EL2: similar to generic access_mte(), but we need to 8182 * account for FEAT_NV. At EL1 this must be a FEAT_NV access; 8183 * if NV2 is enabled then we will redirect this to TFSR_EL1 8184 * after doing the HCR and SCR ATA traps; otherwise this will 8185 * be a trap to EL2 and the HCR/SCR traps do not apply. 8186 */ 8187 int el = arm_current_el(env); 8188 8189 if (el == 1 && (arm_hcr_el2_eff(env) & HCR_NV2)) { 8190 return CP_ACCESS_OK; 8191 } 8192 if (el < 2 && arm_is_el2_enabled(env)) { 8193 uint64_t hcr = arm_hcr_el2_eff(env); 8194 if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) { 8195 return CP_ACCESS_TRAP_EL2; 8196 } 8197 } 8198 if (el < 3 && 8199 arm_feature(env, ARM_FEATURE_EL3) && 8200 !(env->cp15.scr_el3 & SCR_ATA)) { 8201 return CP_ACCESS_TRAP_EL3; 8202 } 8203 return CP_ACCESS_OK; 8204 } 8205 8206 static uint64_t tco_read(CPUARMState *env, const ARMCPRegInfo *ri) 8207 { 8208 return env->pstate & PSTATE_TCO; 8209 } 8210 8211 static void tco_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 8212 { 8213 env->pstate = (env->pstate & ~PSTATE_TCO) | (val & PSTATE_TCO); 8214 } 8215 8216 static const ARMCPRegInfo mte_reginfo[] = { 8217 { .name = "TFSRE0_EL1", .state = ARM_CP_STATE_AA64, 8218 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 1, 8219 .access = PL1_RW, .accessfn = access_mte, 8220 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[0]) }, 8221 { .name = "TFSR_EL1", .state = ARM_CP_STATE_AA64, 8222 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 0, 8223 .access = PL1_RW, .accessfn = access_tfsr_el1, 8224 .nv2_redirect_offset = 0x190 | NV2_REDIR_NV1, 8225 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[1]) }, 8226 { .name = "TFSR_EL2", .state = ARM_CP_STATE_AA64, 8227 .type = ARM_CP_NV2_REDIRECT, 8228 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 6, .opc2 = 0, 8229 .access = PL2_RW, .accessfn = access_tfsr_el2, 8230 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[2]) }, 8231 { .name = "TFSR_EL3", .state = ARM_CP_STATE_AA64, 8232 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 6, .opc2 = 0, 8233 .access = PL3_RW, 8234 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[3]) }, 8235 { .name = "RGSR_EL1", .state = ARM_CP_STATE_AA64, 8236 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 5, 8237 .access = PL1_RW, .accessfn = access_mte, 8238 .fieldoffset = offsetof(CPUARMState, cp15.rgsr_el1) }, 8239 { .name = "GCR_EL1", .state = ARM_CP_STATE_AA64, 8240 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 6, 8241 .access = PL1_RW, .accessfn = access_mte, 8242 .fieldoffset = offsetof(CPUARMState, cp15.gcr_el1) }, 8243 { .name = "TCO", .state = ARM_CP_STATE_AA64, 8244 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7, 8245 .type = ARM_CP_NO_RAW, 8246 .access = PL0_RW, .readfn = tco_read, .writefn = tco_write }, 8247 { .name = "DC_IGVAC", .state = ARM_CP_STATE_AA64, 8248 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 3, 8249 .type = ARM_CP_NOP, .access = PL1_W, 8250 .fgt = FGT_DCIVAC, 8251 .accessfn = aa64_cacheop_poc_access }, 8252 { .name = "DC_IGSW", .state = ARM_CP_STATE_AA64, 8253 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 4, 8254 .fgt = FGT_DCISW, 8255 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 8256 { .name = "DC_IGDVAC", .state = ARM_CP_STATE_AA64, 8257 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 5, 8258 .type = ARM_CP_NOP, .access = PL1_W, 8259 .fgt = FGT_DCIVAC, 8260 .accessfn = aa64_cacheop_poc_access }, 8261 { .name = "DC_IGDSW", .state = ARM_CP_STATE_AA64, 8262 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 6, 8263 .fgt = FGT_DCISW, 8264 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 8265 { .name = "DC_CGSW", .state = ARM_CP_STATE_AA64, 8266 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 4, 8267 .fgt = FGT_DCCSW, 8268 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 8269 { .name = "DC_CGDSW", .state = ARM_CP_STATE_AA64, 8270 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 6, 8271 .fgt = FGT_DCCSW, 8272 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 8273 { .name = "DC_CIGSW", .state = ARM_CP_STATE_AA64, 8274 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 4, 8275 .fgt = FGT_DCCISW, 8276 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 8277 { .name = "DC_CIGDSW", .state = ARM_CP_STATE_AA64, 8278 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 6, 8279 .fgt = FGT_DCCISW, 8280 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 8281 }; 8282 8283 static const ARMCPRegInfo mte_tco_ro_reginfo[] = { 8284 { .name = "TCO", .state = ARM_CP_STATE_AA64, 8285 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7, 8286 .type = ARM_CP_CONST, .access = PL0_RW, }, 8287 }; 8288 8289 static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = { 8290 { .name = "DC_CGVAC", .state = ARM_CP_STATE_AA64, 8291 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 3, 8292 .type = ARM_CP_NOP, .access = PL0_W, 8293 .fgt = FGT_DCCVAC, 8294 .accessfn = aa64_cacheop_poc_access }, 8295 { .name = "DC_CGDVAC", .state = ARM_CP_STATE_AA64, 8296 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 5, 8297 .type = ARM_CP_NOP, .access = PL0_W, 8298 .fgt = FGT_DCCVAC, 8299 .accessfn = aa64_cacheop_poc_access }, 8300 { .name = "DC_CGVAP", .state = ARM_CP_STATE_AA64, 8301 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 3, 8302 .type = ARM_CP_NOP, .access = PL0_W, 8303 .fgt = FGT_DCCVAP, 8304 .accessfn = aa64_cacheop_poc_access }, 8305 { .name = "DC_CGDVAP", .state = ARM_CP_STATE_AA64, 8306 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 5, 8307 .type = ARM_CP_NOP, .access = PL0_W, 8308 .fgt = FGT_DCCVAP, 8309 .accessfn = aa64_cacheop_poc_access }, 8310 { .name = "DC_CGVADP", .state = ARM_CP_STATE_AA64, 8311 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 3, 8312 .type = ARM_CP_NOP, .access = PL0_W, 8313 .fgt = FGT_DCCVADP, 8314 .accessfn = aa64_cacheop_poc_access }, 8315 { .name = "DC_CGDVADP", .state = ARM_CP_STATE_AA64, 8316 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 5, 8317 .type = ARM_CP_NOP, .access = PL0_W, 8318 .fgt = FGT_DCCVADP, 8319 .accessfn = aa64_cacheop_poc_access }, 8320 { .name = "DC_CIGVAC", .state = ARM_CP_STATE_AA64, 8321 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 3, 8322 .type = ARM_CP_NOP, .access = PL0_W, 8323 .fgt = FGT_DCCIVAC, 8324 .accessfn = aa64_cacheop_poc_access }, 8325 { .name = "DC_CIGDVAC", .state = ARM_CP_STATE_AA64, 8326 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 5, 8327 .type = ARM_CP_NOP, .access = PL0_W, 8328 .fgt = FGT_DCCIVAC, 8329 .accessfn = aa64_cacheop_poc_access }, 8330 { .name = "DC_GVA", .state = ARM_CP_STATE_AA64, 8331 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 3, 8332 .access = PL0_W, .type = ARM_CP_DC_GVA, 8333 #ifndef CONFIG_USER_ONLY 8334 /* Avoid overhead of an access check that always passes in user-mode */ 8335 .accessfn = aa64_zva_access, 8336 .fgt = FGT_DCZVA, 8337 #endif 8338 }, 8339 { .name = "DC_GZVA", .state = ARM_CP_STATE_AA64, 8340 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 4, 8341 .access = PL0_W, .type = ARM_CP_DC_GZVA, 8342 #ifndef CONFIG_USER_ONLY 8343 /* Avoid overhead of an access check that always passes in user-mode */ 8344 .accessfn = aa64_zva_access, 8345 .fgt = FGT_DCZVA, 8346 #endif 8347 }, 8348 }; 8349 8350 static CPAccessResult access_scxtnum(CPUARMState *env, const ARMCPRegInfo *ri, 8351 bool isread) 8352 { 8353 uint64_t hcr = arm_hcr_el2_eff(env); 8354 int el = arm_current_el(env); 8355 8356 if (el == 0 && !((hcr & HCR_E2H) && (hcr & HCR_TGE))) { 8357 if (env->cp15.sctlr_el[1] & SCTLR_TSCXT) { 8358 if (hcr & HCR_TGE) { 8359 return CP_ACCESS_TRAP_EL2; 8360 } 8361 return CP_ACCESS_TRAP; 8362 } 8363 } else if (el < 2 && (env->cp15.sctlr_el[2] & SCTLR_TSCXT)) { 8364 return CP_ACCESS_TRAP_EL2; 8365 } 8366 if (el < 2 && arm_is_el2_enabled(env) && !(hcr & HCR_ENSCXT)) { 8367 return CP_ACCESS_TRAP_EL2; 8368 } 8369 if (el < 3 8370 && arm_feature(env, ARM_FEATURE_EL3) 8371 && !(env->cp15.scr_el3 & SCR_ENSCXT)) { 8372 return CP_ACCESS_TRAP_EL3; 8373 } 8374 return CP_ACCESS_OK; 8375 } 8376 8377 static CPAccessResult access_scxtnum_el1(CPUARMState *env, 8378 const ARMCPRegInfo *ri, 8379 bool isread) 8380 { 8381 CPAccessResult nv1 = access_nv1(env, ri, isread); 8382 8383 if (nv1 != CP_ACCESS_OK) { 8384 return nv1; 8385 } 8386 return access_scxtnum(env, ri, isread); 8387 } 8388 8389 static const ARMCPRegInfo scxtnum_reginfo[] = { 8390 { .name = "SCXTNUM_EL0", .state = ARM_CP_STATE_AA64, 8391 .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 7, 8392 .access = PL0_RW, .accessfn = access_scxtnum, 8393 .fgt = FGT_SCXTNUM_EL0, 8394 .fieldoffset = offsetof(CPUARMState, scxtnum_el[0]) }, 8395 { .name = "SCXTNUM_EL1", .state = ARM_CP_STATE_AA64, 8396 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 7, 8397 .access = PL1_RW, .accessfn = access_scxtnum_el1, 8398 .fgt = FGT_SCXTNUM_EL1, 8399 .nv2_redirect_offset = 0x188 | NV2_REDIR_NV1, 8400 .fieldoffset = offsetof(CPUARMState, scxtnum_el[1]) }, 8401 { .name = "SCXTNUM_EL2", .state = ARM_CP_STATE_AA64, 8402 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 7, 8403 .access = PL2_RW, .accessfn = access_scxtnum, 8404 .fieldoffset = offsetof(CPUARMState, scxtnum_el[2]) }, 8405 { .name = "SCXTNUM_EL3", .state = ARM_CP_STATE_AA64, 8406 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 7, 8407 .access = PL3_RW, 8408 .fieldoffset = offsetof(CPUARMState, scxtnum_el[3]) }, 8409 }; 8410 8411 static CPAccessResult access_fgt(CPUARMState *env, const ARMCPRegInfo *ri, 8412 bool isread) 8413 { 8414 if (arm_current_el(env) == 2 && 8415 arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_FGTEN)) { 8416 return CP_ACCESS_TRAP_EL3; 8417 } 8418 return CP_ACCESS_OK; 8419 } 8420 8421 static const ARMCPRegInfo fgt_reginfo[] = { 8422 { .name = "HFGRTR_EL2", .state = ARM_CP_STATE_AA64, 8423 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 8424 .nv2_redirect_offset = 0x1b8, 8425 .access = PL2_RW, .accessfn = access_fgt, 8426 .fieldoffset = offsetof(CPUARMState, cp15.fgt_read[FGTREG_HFGRTR]) }, 8427 { .name = "HFGWTR_EL2", .state = ARM_CP_STATE_AA64, 8428 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 5, 8429 .nv2_redirect_offset = 0x1c0, 8430 .access = PL2_RW, .accessfn = access_fgt, 8431 .fieldoffset = offsetof(CPUARMState, cp15.fgt_write[FGTREG_HFGWTR]) }, 8432 { .name = "HDFGRTR_EL2", .state = ARM_CP_STATE_AA64, 8433 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 1, .opc2 = 4, 8434 .nv2_redirect_offset = 0x1d0, 8435 .access = PL2_RW, .accessfn = access_fgt, 8436 .fieldoffset = offsetof(CPUARMState, cp15.fgt_read[FGTREG_HDFGRTR]) }, 8437 { .name = "HDFGWTR_EL2", .state = ARM_CP_STATE_AA64, 8438 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 1, .opc2 = 5, 8439 .nv2_redirect_offset = 0x1d8, 8440 .access = PL2_RW, .accessfn = access_fgt, 8441 .fieldoffset = offsetof(CPUARMState, cp15.fgt_write[FGTREG_HDFGWTR]) }, 8442 { .name = "HFGITR_EL2", .state = ARM_CP_STATE_AA64, 8443 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 6, 8444 .nv2_redirect_offset = 0x1c8, 8445 .access = PL2_RW, .accessfn = access_fgt, 8446 .fieldoffset = offsetof(CPUARMState, cp15.fgt_exec[FGTREG_HFGITR]) }, 8447 }; 8448 8449 static void vncr_write(CPUARMState *env, const ARMCPRegInfo *ri, 8450 uint64_t value) 8451 { 8452 /* 8453 * Clear the RES0 bottom 12 bits; this means at runtime we can guarantee 8454 * that VNCR_EL2 + offset is 64-bit aligned. We don't need to do anything 8455 * about the RESS bits at the top -- we choose the "generate an EL2 8456 * translation abort on use" CONSTRAINED UNPREDICTABLE option (i.e. let 8457 * the ptw.c code detect the resulting invalid address). 8458 */ 8459 env->cp15.vncr_el2 = value & ~0xfffULL; 8460 } 8461 8462 static const ARMCPRegInfo nv2_reginfo[] = { 8463 { .name = "VNCR_EL2", .state = ARM_CP_STATE_AA64, 8464 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 2, .opc2 = 0, 8465 .access = PL2_RW, 8466 .writefn = vncr_write, 8467 .nv2_redirect_offset = 0xb0, 8468 .fieldoffset = offsetof(CPUARMState, cp15.vncr_el2) }, 8469 }; 8470 8471 #endif /* TARGET_AARCH64 */ 8472 8473 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri, 8474 bool isread) 8475 { 8476 int el = arm_current_el(env); 8477 8478 if (el == 0) { 8479 uint64_t sctlr = arm_sctlr(env, el); 8480 if (!(sctlr & SCTLR_EnRCTX)) { 8481 return CP_ACCESS_TRAP; 8482 } 8483 } else if (el == 1) { 8484 uint64_t hcr = arm_hcr_el2_eff(env); 8485 if (hcr & HCR_NV) { 8486 return CP_ACCESS_TRAP_EL2; 8487 } 8488 } 8489 return CP_ACCESS_OK; 8490 } 8491 8492 static const ARMCPRegInfo predinv_reginfo[] = { 8493 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64, 8494 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4, 8495 .fgt = FGT_CFPRCTX, 8496 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 8497 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64, 8498 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5, 8499 .fgt = FGT_DVPRCTX, 8500 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 8501 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64, 8502 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7, 8503 .fgt = FGT_CPPRCTX, 8504 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 8505 /* 8506 * Note the AArch32 opcodes have a different OPC1. 8507 */ 8508 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32, 8509 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4, 8510 .fgt = FGT_CFPRCTX, 8511 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 8512 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32, 8513 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5, 8514 .fgt = FGT_DVPRCTX, 8515 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 8516 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32, 8517 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7, 8518 .fgt = FGT_CPPRCTX, 8519 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 8520 }; 8521 8522 static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri) 8523 { 8524 /* Read the high 32 bits of the current CCSIDR */ 8525 return extract64(ccsidr_read(env, ri), 32, 32); 8526 } 8527 8528 static const ARMCPRegInfo ccsidr2_reginfo[] = { 8529 { .name = "CCSIDR2", .state = ARM_CP_STATE_BOTH, 8530 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 2, 8531 .access = PL1_R, 8532 .accessfn = access_tid4, 8533 .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW }, 8534 }; 8535 8536 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 8537 bool isread) 8538 { 8539 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) { 8540 return CP_ACCESS_TRAP_EL2; 8541 } 8542 8543 return CP_ACCESS_OK; 8544 } 8545 8546 static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 8547 bool isread) 8548 { 8549 if (arm_feature(env, ARM_FEATURE_V8)) { 8550 return access_aa64_tid3(env, ri, isread); 8551 } 8552 8553 return CP_ACCESS_OK; 8554 } 8555 8556 static CPAccessResult access_jazelle(CPUARMState *env, const ARMCPRegInfo *ri, 8557 bool isread) 8558 { 8559 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID0)) { 8560 return CP_ACCESS_TRAP_EL2; 8561 } 8562 8563 return CP_ACCESS_OK; 8564 } 8565 8566 static CPAccessResult access_joscr_jmcr(CPUARMState *env, 8567 const ARMCPRegInfo *ri, bool isread) 8568 { 8569 /* 8570 * HSTR.TJDBX traps JOSCR and JMCR accesses, but it exists only 8571 * in v7A, not in v8A. 8572 */ 8573 if (!arm_feature(env, ARM_FEATURE_V8) && 8574 arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) && 8575 (env->cp15.hstr_el2 & HSTR_TJDBX)) { 8576 return CP_ACCESS_TRAP_EL2; 8577 } 8578 return CP_ACCESS_OK; 8579 } 8580 8581 static const ARMCPRegInfo jazelle_regs[] = { 8582 { .name = "JIDR", 8583 .cp = 14, .crn = 0, .crm = 0, .opc1 = 7, .opc2 = 0, 8584 .access = PL1_R, .accessfn = access_jazelle, 8585 .type = ARM_CP_CONST, .resetvalue = 0 }, 8586 { .name = "JOSCR", 8587 .cp = 14, .crn = 1, .crm = 0, .opc1 = 7, .opc2 = 0, 8588 .accessfn = access_joscr_jmcr, 8589 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 8590 { .name = "JMCR", 8591 .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0, 8592 .accessfn = access_joscr_jmcr, 8593 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 8594 }; 8595 8596 static const ARMCPRegInfo contextidr_el2 = { 8597 .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64, 8598 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1, 8599 .access = PL2_RW, 8600 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2]) 8601 }; 8602 8603 static const ARMCPRegInfo vhe_reginfo[] = { 8604 { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64, 8605 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1, 8606 .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write, 8607 .raw_writefn = raw_write, 8608 .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) }, 8609 #ifndef CONFIG_USER_ONLY 8610 { .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64, 8611 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 2, 8612 .fieldoffset = 8613 offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].cval), 8614 .type = ARM_CP_IO, .access = PL2_RW, 8615 .writefn = gt_hv_cval_write, .raw_writefn = raw_write }, 8616 { .name = "CNTHV_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 8617 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 0, 8618 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 8619 .resetfn = gt_hv_timer_reset, 8620 .readfn = gt_hv_tval_read, .writefn = gt_hv_tval_write }, 8621 { .name = "CNTHV_CTL_EL2", .state = ARM_CP_STATE_BOTH, 8622 .type = ARM_CP_IO, 8623 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 1, 8624 .access = PL2_RW, 8625 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].ctl), 8626 .writefn = gt_hv_ctl_write, .raw_writefn = raw_write }, 8627 { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64, 8628 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1, 8629 .type = ARM_CP_IO | ARM_CP_ALIAS, 8630 .access = PL2_RW, .accessfn = access_el1nvpct, 8631 .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1, 8632 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 8633 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write }, 8634 { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64, 8635 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1, 8636 .type = ARM_CP_IO | ARM_CP_ALIAS, 8637 .access = PL2_RW, .accessfn = access_el1nvvct, 8638 .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1, 8639 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 8640 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write }, 8641 { .name = "CNTP_TVAL_EL02", .state = ARM_CP_STATE_AA64, 8642 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 0, 8643 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 8644 .access = PL2_RW, .accessfn = e2h_access, 8645 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write }, 8646 { .name = "CNTV_TVAL_EL02", .state = ARM_CP_STATE_AA64, 8647 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 0, 8648 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 8649 .access = PL2_RW, .accessfn = e2h_access, 8650 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write }, 8651 { .name = "CNTP_CVAL_EL02", .state = ARM_CP_STATE_AA64, 8652 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 2, 8653 .type = ARM_CP_IO | ARM_CP_ALIAS, 8654 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 8655 .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1, 8656 .access = PL2_RW, .accessfn = access_el1nvpct, 8657 .writefn = gt_phys_cval_write, .raw_writefn = raw_write }, 8658 { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64, 8659 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2, 8660 .type = ARM_CP_IO | ARM_CP_ALIAS, 8661 .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1, 8662 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 8663 .access = PL2_RW, .accessfn = access_el1nvvct, 8664 .writefn = gt_virt_cval_write, .raw_writefn = raw_write }, 8665 #endif 8666 }; 8667 8668 #ifndef CONFIG_USER_ONLY 8669 static const ARMCPRegInfo ats1e1_reginfo[] = { 8670 { .name = "AT_S1E1RP", .state = ARM_CP_STATE_AA64, 8671 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0, 8672 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 8673 .fgt = FGT_ATS1E1RP, 8674 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 8675 { .name = "AT_S1E1WP", .state = ARM_CP_STATE_AA64, 8676 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1, 8677 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 8678 .fgt = FGT_ATS1E1WP, 8679 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 8680 }; 8681 8682 static const ARMCPRegInfo ats1cp_reginfo[] = { 8683 { .name = "ATS1CPRP", 8684 .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0, 8685 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 8686 .writefn = ats_write }, 8687 { .name = "ATS1CPWP", 8688 .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1, 8689 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 8690 .writefn = ats_write }, 8691 }; 8692 #endif 8693 8694 /* 8695 * ACTLR2 and HACTLR2 map to ACTLR_EL1[63:32] and 8696 * ACTLR_EL2[63:32]. They exist only if the ID_MMFR4.AC2 field 8697 * is non-zero, which is never for ARMv7, optionally in ARMv8 8698 * and mandatorily for ARMv8.2 and up. 8699 * ACTLR2 is banked for S and NS if EL3 is AArch32. Since QEMU's 8700 * implementation is RAZ/WI we can ignore this detail, as we 8701 * do for ACTLR. 8702 */ 8703 static const ARMCPRegInfo actlr2_hactlr2_reginfo[] = { 8704 { .name = "ACTLR2", .state = ARM_CP_STATE_AA32, 8705 .cp = 15, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 3, 8706 .access = PL1_RW, .accessfn = access_tacr, 8707 .type = ARM_CP_CONST, .resetvalue = 0 }, 8708 { .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 8709 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 8710 .access = PL2_RW, .type = ARM_CP_CONST, 8711 .resetvalue = 0 }, 8712 }; 8713 8714 void register_cp_regs_for_features(ARMCPU *cpu) 8715 { 8716 /* Register all the coprocessor registers based on feature bits */ 8717 CPUARMState *env = &cpu->env; 8718 if (arm_feature(env, ARM_FEATURE_M)) { 8719 /* M profile has no coprocessor registers */ 8720 return; 8721 } 8722 8723 define_arm_cp_regs(cpu, cp_reginfo); 8724 if (!arm_feature(env, ARM_FEATURE_V8)) { 8725 /* 8726 * Must go early as it is full of wildcards that may be 8727 * overridden by later definitions. 8728 */ 8729 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 8730 } 8731 8732 if (arm_feature(env, ARM_FEATURE_V6)) { 8733 /* The ID registers all have impdef reset values */ 8734 ARMCPRegInfo v6_idregs[] = { 8735 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 8736 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 8737 .access = PL1_R, .type = ARM_CP_CONST, 8738 .accessfn = access_aa32_tid3, 8739 .resetvalue = cpu->isar.id_pfr0 }, 8740 /* 8741 * ID_PFR1 is not a plain ARM_CP_CONST because we don't know 8742 * the value of the GIC field until after we define these regs. 8743 */ 8744 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 8745 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 8746 .access = PL1_R, .type = ARM_CP_NO_RAW, 8747 .accessfn = access_aa32_tid3, 8748 #ifdef CONFIG_USER_ONLY 8749 .type = ARM_CP_CONST, 8750 .resetvalue = cpu->isar.id_pfr1, 8751 #else 8752 .type = ARM_CP_NO_RAW, 8753 .accessfn = access_aa32_tid3, 8754 .readfn = id_pfr1_read, 8755 .writefn = arm_cp_write_ignore 8756 #endif 8757 }, 8758 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 8759 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 8760 .access = PL1_R, .type = ARM_CP_CONST, 8761 .accessfn = access_aa32_tid3, 8762 .resetvalue = cpu->isar.id_dfr0 }, 8763 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 8764 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 8765 .access = PL1_R, .type = ARM_CP_CONST, 8766 .accessfn = access_aa32_tid3, 8767 .resetvalue = cpu->id_afr0 }, 8768 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 8769 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 8770 .access = PL1_R, .type = ARM_CP_CONST, 8771 .accessfn = access_aa32_tid3, 8772 .resetvalue = cpu->isar.id_mmfr0 }, 8773 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 8774 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 8775 .access = PL1_R, .type = ARM_CP_CONST, 8776 .accessfn = access_aa32_tid3, 8777 .resetvalue = cpu->isar.id_mmfr1 }, 8778 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 8779 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 8780 .access = PL1_R, .type = ARM_CP_CONST, 8781 .accessfn = access_aa32_tid3, 8782 .resetvalue = cpu->isar.id_mmfr2 }, 8783 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 8784 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 8785 .access = PL1_R, .type = ARM_CP_CONST, 8786 .accessfn = access_aa32_tid3, 8787 .resetvalue = cpu->isar.id_mmfr3 }, 8788 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 8789 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 8790 .access = PL1_R, .type = ARM_CP_CONST, 8791 .accessfn = access_aa32_tid3, 8792 .resetvalue = cpu->isar.id_isar0 }, 8793 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 8794 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 8795 .access = PL1_R, .type = ARM_CP_CONST, 8796 .accessfn = access_aa32_tid3, 8797 .resetvalue = cpu->isar.id_isar1 }, 8798 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 8799 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 8800 .access = PL1_R, .type = ARM_CP_CONST, 8801 .accessfn = access_aa32_tid3, 8802 .resetvalue = cpu->isar.id_isar2 }, 8803 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 8804 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 8805 .access = PL1_R, .type = ARM_CP_CONST, 8806 .accessfn = access_aa32_tid3, 8807 .resetvalue = cpu->isar.id_isar3 }, 8808 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 8809 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 8810 .access = PL1_R, .type = ARM_CP_CONST, 8811 .accessfn = access_aa32_tid3, 8812 .resetvalue = cpu->isar.id_isar4 }, 8813 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 8814 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 8815 .access = PL1_R, .type = ARM_CP_CONST, 8816 .accessfn = access_aa32_tid3, 8817 .resetvalue = cpu->isar.id_isar5 }, 8818 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 8819 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 8820 .access = PL1_R, .type = ARM_CP_CONST, 8821 .accessfn = access_aa32_tid3, 8822 .resetvalue = cpu->isar.id_mmfr4 }, 8823 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 8824 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 8825 .access = PL1_R, .type = ARM_CP_CONST, 8826 .accessfn = access_aa32_tid3, 8827 .resetvalue = cpu->isar.id_isar6 }, 8828 }; 8829 define_arm_cp_regs(cpu, v6_idregs); 8830 define_arm_cp_regs(cpu, v6_cp_reginfo); 8831 } else { 8832 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 8833 } 8834 if (arm_feature(env, ARM_FEATURE_V6K)) { 8835 define_arm_cp_regs(cpu, v6k_cp_reginfo); 8836 } 8837 if (arm_feature(env, ARM_FEATURE_V7MP) && 8838 !arm_feature(env, ARM_FEATURE_PMSA)) { 8839 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 8840 } 8841 if (arm_feature(env, ARM_FEATURE_V7VE)) { 8842 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 8843 } 8844 if (arm_feature(env, ARM_FEATURE_V7)) { 8845 ARMCPRegInfo clidr = { 8846 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 8847 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 8848 .access = PL1_R, .type = ARM_CP_CONST, 8849 .accessfn = access_tid4, 8850 .fgt = FGT_CLIDR_EL1, 8851 .resetvalue = cpu->clidr 8852 }; 8853 define_one_arm_cp_reg(cpu, &clidr); 8854 define_arm_cp_regs(cpu, v7_cp_reginfo); 8855 define_debug_regs(cpu); 8856 define_pmu_regs(cpu); 8857 } else { 8858 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 8859 } 8860 if (arm_feature(env, ARM_FEATURE_V8)) { 8861 /* 8862 * v8 ID registers, which all have impdef reset values. 8863 * Note that within the ID register ranges the unused slots 8864 * must all RAZ, not UNDEF; future architecture versions may 8865 * define new registers here. 8866 * ID registers which are AArch64 views of the AArch32 ID registers 8867 * which already existed in v6 and v7 are handled elsewhere, 8868 * in v6_idregs[]. 8869 */ 8870 int i; 8871 ARMCPRegInfo v8_idregs[] = { 8872 /* 8873 * ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST in system 8874 * emulation because we don't know the right value for the 8875 * GIC field until after we define these regs. 8876 */ 8877 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 8878 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 8879 .access = PL1_R, 8880 #ifdef CONFIG_USER_ONLY 8881 .type = ARM_CP_CONST, 8882 .resetvalue = cpu->isar.id_aa64pfr0 8883 #else 8884 .type = ARM_CP_NO_RAW, 8885 .accessfn = access_aa64_tid3, 8886 .readfn = id_aa64pfr0_read, 8887 .writefn = arm_cp_write_ignore 8888 #endif 8889 }, 8890 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 8891 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 8892 .access = PL1_R, .type = ARM_CP_CONST, 8893 .accessfn = access_aa64_tid3, 8894 .resetvalue = cpu->isar.id_aa64pfr1}, 8895 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8896 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 8897 .access = PL1_R, .type = ARM_CP_CONST, 8898 .accessfn = access_aa64_tid3, 8899 .resetvalue = 0 }, 8900 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8901 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 8902 .access = PL1_R, .type = ARM_CP_CONST, 8903 .accessfn = access_aa64_tid3, 8904 .resetvalue = 0 }, 8905 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 8906 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 8907 .access = PL1_R, .type = ARM_CP_CONST, 8908 .accessfn = access_aa64_tid3, 8909 .resetvalue = cpu->isar.id_aa64zfr0 }, 8910 { .name = "ID_AA64SMFR0_EL1", .state = ARM_CP_STATE_AA64, 8911 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 8912 .access = PL1_R, .type = ARM_CP_CONST, 8913 .accessfn = access_aa64_tid3, 8914 .resetvalue = cpu->isar.id_aa64smfr0 }, 8915 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8916 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 8917 .access = PL1_R, .type = ARM_CP_CONST, 8918 .accessfn = access_aa64_tid3, 8919 .resetvalue = 0 }, 8920 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8921 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 8922 .access = PL1_R, .type = ARM_CP_CONST, 8923 .accessfn = access_aa64_tid3, 8924 .resetvalue = 0 }, 8925 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 8926 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 8927 .access = PL1_R, .type = ARM_CP_CONST, 8928 .accessfn = access_aa64_tid3, 8929 .resetvalue = cpu->isar.id_aa64dfr0 }, 8930 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 8931 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 8932 .access = PL1_R, .type = ARM_CP_CONST, 8933 .accessfn = access_aa64_tid3, 8934 .resetvalue = cpu->isar.id_aa64dfr1 }, 8935 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8936 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 8937 .access = PL1_R, .type = ARM_CP_CONST, 8938 .accessfn = access_aa64_tid3, 8939 .resetvalue = 0 }, 8940 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8941 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 8942 .access = PL1_R, .type = ARM_CP_CONST, 8943 .accessfn = access_aa64_tid3, 8944 .resetvalue = 0 }, 8945 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 8946 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 8947 .access = PL1_R, .type = ARM_CP_CONST, 8948 .accessfn = access_aa64_tid3, 8949 .resetvalue = cpu->id_aa64afr0 }, 8950 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 8951 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 8952 .access = PL1_R, .type = ARM_CP_CONST, 8953 .accessfn = access_aa64_tid3, 8954 .resetvalue = cpu->id_aa64afr1 }, 8955 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8956 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 8957 .access = PL1_R, .type = ARM_CP_CONST, 8958 .accessfn = access_aa64_tid3, 8959 .resetvalue = 0 }, 8960 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8961 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 8962 .access = PL1_R, .type = ARM_CP_CONST, 8963 .accessfn = access_aa64_tid3, 8964 .resetvalue = 0 }, 8965 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 8966 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 8967 .access = PL1_R, .type = ARM_CP_CONST, 8968 .accessfn = access_aa64_tid3, 8969 .resetvalue = cpu->isar.id_aa64isar0 }, 8970 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 8971 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 8972 .access = PL1_R, .type = ARM_CP_CONST, 8973 .accessfn = access_aa64_tid3, 8974 .resetvalue = cpu->isar.id_aa64isar1 }, 8975 { .name = "ID_AA64ISAR2_EL1", .state = ARM_CP_STATE_AA64, 8976 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 8977 .access = PL1_R, .type = ARM_CP_CONST, 8978 .accessfn = access_aa64_tid3, 8979 .resetvalue = cpu->isar.id_aa64isar2 }, 8980 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8981 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 8982 .access = PL1_R, .type = ARM_CP_CONST, 8983 .accessfn = access_aa64_tid3, 8984 .resetvalue = 0 }, 8985 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8986 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 8987 .access = PL1_R, .type = ARM_CP_CONST, 8988 .accessfn = access_aa64_tid3, 8989 .resetvalue = 0 }, 8990 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8991 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 8992 .access = PL1_R, .type = ARM_CP_CONST, 8993 .accessfn = access_aa64_tid3, 8994 .resetvalue = 0 }, 8995 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8996 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 8997 .access = PL1_R, .type = ARM_CP_CONST, 8998 .accessfn = access_aa64_tid3, 8999 .resetvalue = 0 }, 9000 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 9001 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 9002 .access = PL1_R, .type = ARM_CP_CONST, 9003 .accessfn = access_aa64_tid3, 9004 .resetvalue = 0 }, 9005 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 9006 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 9007 .access = PL1_R, .type = ARM_CP_CONST, 9008 .accessfn = access_aa64_tid3, 9009 .resetvalue = cpu->isar.id_aa64mmfr0 }, 9010 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 9011 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 9012 .access = PL1_R, .type = ARM_CP_CONST, 9013 .accessfn = access_aa64_tid3, 9014 .resetvalue = cpu->isar.id_aa64mmfr1 }, 9015 { .name = "ID_AA64MMFR2_EL1", .state = ARM_CP_STATE_AA64, 9016 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 9017 .access = PL1_R, .type = ARM_CP_CONST, 9018 .accessfn = access_aa64_tid3, 9019 .resetvalue = cpu->isar.id_aa64mmfr2 }, 9020 { .name = "ID_AA64MMFR3_EL1", .state = ARM_CP_STATE_AA64, 9021 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 9022 .access = PL1_R, .type = ARM_CP_CONST, 9023 .accessfn = access_aa64_tid3, 9024 .resetvalue = cpu->isar.id_aa64mmfr3 }, 9025 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 9026 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 9027 .access = PL1_R, .type = ARM_CP_CONST, 9028 .accessfn = access_aa64_tid3, 9029 .resetvalue = 0 }, 9030 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 9031 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 9032 .access = PL1_R, .type = ARM_CP_CONST, 9033 .accessfn = access_aa64_tid3, 9034 .resetvalue = 0 }, 9035 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 9036 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 9037 .access = PL1_R, .type = ARM_CP_CONST, 9038 .accessfn = access_aa64_tid3, 9039 .resetvalue = 0 }, 9040 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 9041 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 9042 .access = PL1_R, .type = ARM_CP_CONST, 9043 .accessfn = access_aa64_tid3, 9044 .resetvalue = 0 }, 9045 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 9046 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 9047 .access = PL1_R, .type = ARM_CP_CONST, 9048 .accessfn = access_aa64_tid3, 9049 .resetvalue = cpu->isar.mvfr0 }, 9050 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 9051 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 9052 .access = PL1_R, .type = ARM_CP_CONST, 9053 .accessfn = access_aa64_tid3, 9054 .resetvalue = cpu->isar.mvfr1 }, 9055 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 9056 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 9057 .access = PL1_R, .type = ARM_CP_CONST, 9058 .accessfn = access_aa64_tid3, 9059 .resetvalue = cpu->isar.mvfr2 }, 9060 /* 9061 * "0, c0, c3, {0,1,2}" are the encodings corresponding to 9062 * AArch64 MVFR[012]_EL1. Define the STATE_AA32 encoding 9063 * as RAZ, since it is in the "reserved for future ID 9064 * registers, RAZ" part of the AArch32 encoding space. 9065 */ 9066 { .name = "RES_0_C0_C3_0", .state = ARM_CP_STATE_AA32, 9067 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 9068 .access = PL1_R, .type = ARM_CP_CONST, 9069 .accessfn = access_aa64_tid3, 9070 .resetvalue = 0 }, 9071 { .name = "RES_0_C0_C3_1", .state = ARM_CP_STATE_AA32, 9072 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 9073 .access = PL1_R, .type = ARM_CP_CONST, 9074 .accessfn = access_aa64_tid3, 9075 .resetvalue = 0 }, 9076 { .name = "RES_0_C0_C3_2", .state = ARM_CP_STATE_AA32, 9077 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 9078 .access = PL1_R, .type = ARM_CP_CONST, 9079 .accessfn = access_aa64_tid3, 9080 .resetvalue = 0 }, 9081 /* 9082 * Other encodings in "0, c0, c3, ..." are STATE_BOTH because 9083 * they're also RAZ for AArch64, and in v8 are gradually 9084 * being filled with AArch64-view-of-AArch32-ID-register 9085 * for new ID registers. 9086 */ 9087 { .name = "RES_0_C0_C3_3", .state = ARM_CP_STATE_BOTH, 9088 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 9089 .access = PL1_R, .type = ARM_CP_CONST, 9090 .accessfn = access_aa64_tid3, 9091 .resetvalue = 0 }, 9092 { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH, 9093 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 9094 .access = PL1_R, .type = ARM_CP_CONST, 9095 .accessfn = access_aa64_tid3, 9096 .resetvalue = cpu->isar.id_pfr2 }, 9097 { .name = "ID_DFR1", .state = ARM_CP_STATE_BOTH, 9098 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 9099 .access = PL1_R, .type = ARM_CP_CONST, 9100 .accessfn = access_aa64_tid3, 9101 .resetvalue = cpu->isar.id_dfr1 }, 9102 { .name = "ID_MMFR5", .state = ARM_CP_STATE_BOTH, 9103 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 9104 .access = PL1_R, .type = ARM_CP_CONST, 9105 .accessfn = access_aa64_tid3, 9106 .resetvalue = cpu->isar.id_mmfr5 }, 9107 { .name = "RES_0_C0_C3_7", .state = ARM_CP_STATE_BOTH, 9108 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 9109 .access = PL1_R, .type = ARM_CP_CONST, 9110 .accessfn = access_aa64_tid3, 9111 .resetvalue = 0 }, 9112 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 9113 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 9114 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 9115 .fgt = FGT_PMCEIDN_EL0, 9116 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 9117 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 9118 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 9119 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 9120 .fgt = FGT_PMCEIDN_EL0, 9121 .resetvalue = cpu->pmceid0 }, 9122 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 9123 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 9124 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 9125 .fgt = FGT_PMCEIDN_EL0, 9126 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 9127 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 9128 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 9129 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 9130 .fgt = FGT_PMCEIDN_EL0, 9131 .resetvalue = cpu->pmceid1 }, 9132 }; 9133 #ifdef CONFIG_USER_ONLY 9134 static const ARMCPRegUserSpaceInfo v8_user_idregs[] = { 9135 { .name = "ID_AA64PFR0_EL1", 9136 .exported_bits = R_ID_AA64PFR0_FP_MASK | 9137 R_ID_AA64PFR0_ADVSIMD_MASK | 9138 R_ID_AA64PFR0_SVE_MASK | 9139 R_ID_AA64PFR0_DIT_MASK, 9140 .fixed_bits = (0x1u << R_ID_AA64PFR0_EL0_SHIFT) | 9141 (0x1u << R_ID_AA64PFR0_EL1_SHIFT) }, 9142 { .name = "ID_AA64PFR1_EL1", 9143 .exported_bits = R_ID_AA64PFR1_BT_MASK | 9144 R_ID_AA64PFR1_SSBS_MASK | 9145 R_ID_AA64PFR1_MTE_MASK | 9146 R_ID_AA64PFR1_SME_MASK }, 9147 { .name = "ID_AA64PFR*_EL1_RESERVED", 9148 .is_glob = true }, 9149 { .name = "ID_AA64ZFR0_EL1", 9150 .exported_bits = R_ID_AA64ZFR0_SVEVER_MASK | 9151 R_ID_AA64ZFR0_AES_MASK | 9152 R_ID_AA64ZFR0_BITPERM_MASK | 9153 R_ID_AA64ZFR0_BFLOAT16_MASK | 9154 R_ID_AA64ZFR0_B16B16_MASK | 9155 R_ID_AA64ZFR0_SHA3_MASK | 9156 R_ID_AA64ZFR0_SM4_MASK | 9157 R_ID_AA64ZFR0_I8MM_MASK | 9158 R_ID_AA64ZFR0_F32MM_MASK | 9159 R_ID_AA64ZFR0_F64MM_MASK }, 9160 { .name = "ID_AA64SMFR0_EL1", 9161 .exported_bits = R_ID_AA64SMFR0_F32F32_MASK | 9162 R_ID_AA64SMFR0_BI32I32_MASK | 9163 R_ID_AA64SMFR0_B16F32_MASK | 9164 R_ID_AA64SMFR0_F16F32_MASK | 9165 R_ID_AA64SMFR0_I8I32_MASK | 9166 R_ID_AA64SMFR0_F16F16_MASK | 9167 R_ID_AA64SMFR0_B16B16_MASK | 9168 R_ID_AA64SMFR0_I16I32_MASK | 9169 R_ID_AA64SMFR0_F64F64_MASK | 9170 R_ID_AA64SMFR0_I16I64_MASK | 9171 R_ID_AA64SMFR0_SMEVER_MASK | 9172 R_ID_AA64SMFR0_FA64_MASK }, 9173 { .name = "ID_AA64MMFR0_EL1", 9174 .exported_bits = R_ID_AA64MMFR0_ECV_MASK, 9175 .fixed_bits = (0xfu << R_ID_AA64MMFR0_TGRAN64_SHIFT) | 9176 (0xfu << R_ID_AA64MMFR0_TGRAN4_SHIFT) }, 9177 { .name = "ID_AA64MMFR1_EL1", 9178 .exported_bits = R_ID_AA64MMFR1_AFP_MASK }, 9179 { .name = "ID_AA64MMFR2_EL1", 9180 .exported_bits = R_ID_AA64MMFR2_AT_MASK }, 9181 { .name = "ID_AA64MMFR3_EL1", 9182 .exported_bits = 0 }, 9183 { .name = "ID_AA64MMFR*_EL1_RESERVED", 9184 .is_glob = true }, 9185 { .name = "ID_AA64DFR0_EL1", 9186 .fixed_bits = (0x6u << R_ID_AA64DFR0_DEBUGVER_SHIFT) }, 9187 { .name = "ID_AA64DFR1_EL1" }, 9188 { .name = "ID_AA64DFR*_EL1_RESERVED", 9189 .is_glob = true }, 9190 { .name = "ID_AA64AFR*", 9191 .is_glob = true }, 9192 { .name = "ID_AA64ISAR0_EL1", 9193 .exported_bits = R_ID_AA64ISAR0_AES_MASK | 9194 R_ID_AA64ISAR0_SHA1_MASK | 9195 R_ID_AA64ISAR0_SHA2_MASK | 9196 R_ID_AA64ISAR0_CRC32_MASK | 9197 R_ID_AA64ISAR0_ATOMIC_MASK | 9198 R_ID_AA64ISAR0_RDM_MASK | 9199 R_ID_AA64ISAR0_SHA3_MASK | 9200 R_ID_AA64ISAR0_SM3_MASK | 9201 R_ID_AA64ISAR0_SM4_MASK | 9202 R_ID_AA64ISAR0_DP_MASK | 9203 R_ID_AA64ISAR0_FHM_MASK | 9204 R_ID_AA64ISAR0_TS_MASK | 9205 R_ID_AA64ISAR0_RNDR_MASK }, 9206 { .name = "ID_AA64ISAR1_EL1", 9207 .exported_bits = R_ID_AA64ISAR1_DPB_MASK | 9208 R_ID_AA64ISAR1_APA_MASK | 9209 R_ID_AA64ISAR1_API_MASK | 9210 R_ID_AA64ISAR1_JSCVT_MASK | 9211 R_ID_AA64ISAR1_FCMA_MASK | 9212 R_ID_AA64ISAR1_LRCPC_MASK | 9213 R_ID_AA64ISAR1_GPA_MASK | 9214 R_ID_AA64ISAR1_GPI_MASK | 9215 R_ID_AA64ISAR1_FRINTTS_MASK | 9216 R_ID_AA64ISAR1_SB_MASK | 9217 R_ID_AA64ISAR1_BF16_MASK | 9218 R_ID_AA64ISAR1_DGH_MASK | 9219 R_ID_AA64ISAR1_I8MM_MASK }, 9220 { .name = "ID_AA64ISAR2_EL1", 9221 .exported_bits = R_ID_AA64ISAR2_WFXT_MASK | 9222 R_ID_AA64ISAR2_RPRES_MASK | 9223 R_ID_AA64ISAR2_GPA3_MASK | 9224 R_ID_AA64ISAR2_APA3_MASK | 9225 R_ID_AA64ISAR2_MOPS_MASK | 9226 R_ID_AA64ISAR2_BC_MASK | 9227 R_ID_AA64ISAR2_RPRFM_MASK | 9228 R_ID_AA64ISAR2_CSSC_MASK }, 9229 { .name = "ID_AA64ISAR*_EL1_RESERVED", 9230 .is_glob = true }, 9231 }; 9232 modify_arm_cp_regs(v8_idregs, v8_user_idregs); 9233 #endif 9234 /* 9235 * RVBAR_EL1 and RMR_EL1 only implemented if EL1 is the highest EL. 9236 * TODO: For RMR, a write with bit 1 set should do something with 9237 * cpu_reset(). In the meantime, "the bit is strictly a request", 9238 * so we are in spec just ignoring writes. 9239 */ 9240 if (!arm_feature(env, ARM_FEATURE_EL3) && 9241 !arm_feature(env, ARM_FEATURE_EL2)) { 9242 ARMCPRegInfo el1_reset_regs[] = { 9243 { .name = "RVBAR_EL1", .state = ARM_CP_STATE_BOTH, 9244 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 9245 .access = PL1_R, 9246 .fieldoffset = offsetof(CPUARMState, cp15.rvbar) }, 9247 { .name = "RMR_EL1", .state = ARM_CP_STATE_BOTH, 9248 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2, 9249 .access = PL1_RW, .type = ARM_CP_CONST, 9250 .resetvalue = arm_feature(env, ARM_FEATURE_AARCH64) } 9251 }; 9252 define_arm_cp_regs(cpu, el1_reset_regs); 9253 } 9254 define_arm_cp_regs(cpu, v8_idregs); 9255 define_arm_cp_regs(cpu, v8_cp_reginfo); 9256 if (cpu_isar_feature(aa64_aa32_el1, cpu)) { 9257 define_arm_cp_regs(cpu, v8_aa32_el1_reginfo); 9258 } 9259 9260 for (i = 4; i < 16; i++) { 9261 /* 9262 * Encodings in "0, c0, {c4-c7}, {0-7}" are RAZ for AArch32. 9263 * For pre-v8 cores there are RAZ patterns for these in 9264 * id_pre_v8_midr_cp_reginfo[]; for v8 we do that here. 9265 * v8 extends the "must RAZ" part of the ID register space 9266 * to also cover c0, 0, c{8-15}, {0-7}. 9267 * These are STATE_AA32 because in the AArch64 sysreg space 9268 * c4-c7 is where the AArch64 ID registers live (and we've 9269 * already defined those in v8_idregs[]), and c8-c15 are not 9270 * "must RAZ" for AArch64. 9271 */ 9272 g_autofree char *name = g_strdup_printf("RES_0_C0_C%d_X", i); 9273 ARMCPRegInfo v8_aa32_raz_idregs = { 9274 .name = name, 9275 .state = ARM_CP_STATE_AA32, 9276 .cp = 15, .opc1 = 0, .crn = 0, .crm = i, .opc2 = CP_ANY, 9277 .access = PL1_R, .type = ARM_CP_CONST, 9278 .accessfn = access_aa64_tid3, 9279 .resetvalue = 0 }; 9280 define_one_arm_cp_reg(cpu, &v8_aa32_raz_idregs); 9281 } 9282 } 9283 9284 /* 9285 * Register the base EL2 cpregs. 9286 * Pre v8, these registers are implemented only as part of the 9287 * Virtualization Extensions (EL2 present). Beginning with v8, 9288 * if EL2 is missing but EL3 is enabled, mostly these become 9289 * RES0 from EL3, with some specific exceptions. 9290 */ 9291 if (arm_feature(env, ARM_FEATURE_EL2) 9292 || (arm_feature(env, ARM_FEATURE_EL3) 9293 && arm_feature(env, ARM_FEATURE_V8))) { 9294 uint64_t vmpidr_def = mpidr_read_val(env); 9295 ARMCPRegInfo vpidr_regs[] = { 9296 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 9297 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 9298 .access = PL2_RW, .accessfn = access_el3_aa32ns, 9299 .resetvalue = cpu->midr, 9300 .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ, 9301 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 9302 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 9303 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 9304 .access = PL2_RW, .resetvalue = cpu->midr, 9305 .type = ARM_CP_EL3_NO_EL2_C_NZ, 9306 .nv2_redirect_offset = 0x88, 9307 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 9308 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 9309 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 9310 .access = PL2_RW, .accessfn = access_el3_aa32ns, 9311 .resetvalue = vmpidr_def, 9312 .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ, 9313 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 9314 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 9315 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 9316 .access = PL2_RW, .resetvalue = vmpidr_def, 9317 .type = ARM_CP_EL3_NO_EL2_C_NZ, 9318 .nv2_redirect_offset = 0x50, 9319 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 9320 }; 9321 /* 9322 * The only field of MDCR_EL2 that has a defined architectural reset 9323 * value is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N. 9324 */ 9325 ARMCPRegInfo mdcr_el2 = { 9326 .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, .type = ARM_CP_IO, 9327 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 9328 .writefn = mdcr_el2_write, 9329 .access = PL2_RW, .resetvalue = pmu_num_counters(env), 9330 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), 9331 }; 9332 define_one_arm_cp_reg(cpu, &mdcr_el2); 9333 define_arm_cp_regs(cpu, vpidr_regs); 9334 define_arm_cp_regs(cpu, el2_cp_reginfo); 9335 if (arm_feature(env, ARM_FEATURE_V8)) { 9336 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 9337 } 9338 if (cpu_isar_feature(aa64_sel2, cpu)) { 9339 define_arm_cp_regs(cpu, el2_sec_cp_reginfo); 9340 } 9341 /* 9342 * RVBAR_EL2 and RMR_EL2 only implemented if EL2 is the highest EL. 9343 * See commentary near RMR_EL1. 9344 */ 9345 if (!arm_feature(env, ARM_FEATURE_EL3)) { 9346 static const ARMCPRegInfo el2_reset_regs[] = { 9347 { .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 9348 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 9349 .access = PL2_R, 9350 .fieldoffset = offsetof(CPUARMState, cp15.rvbar) }, 9351 { .name = "RVBAR", .type = ARM_CP_ALIAS, 9352 .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 9353 .access = PL2_R, 9354 .fieldoffset = offsetof(CPUARMState, cp15.rvbar) }, 9355 { .name = "RMR_EL2", .state = ARM_CP_STATE_AA64, 9356 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 2, 9357 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 1 }, 9358 }; 9359 define_arm_cp_regs(cpu, el2_reset_regs); 9360 } 9361 } 9362 9363 /* Register the base EL3 cpregs. */ 9364 if (arm_feature(env, ARM_FEATURE_EL3)) { 9365 define_arm_cp_regs(cpu, el3_cp_reginfo); 9366 ARMCPRegInfo el3_regs[] = { 9367 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 9368 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 9369 .access = PL3_R, 9370 .fieldoffset = offsetof(CPUARMState, cp15.rvbar), }, 9371 { .name = "RMR_EL3", .state = ARM_CP_STATE_AA64, 9372 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 2, 9373 .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 1 }, 9374 { .name = "RMR", .state = ARM_CP_STATE_AA32, 9375 .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2, 9376 .access = PL3_RW, .type = ARM_CP_CONST, 9377 .resetvalue = arm_feature(env, ARM_FEATURE_AARCH64) }, 9378 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 9379 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 9380 .access = PL3_RW, 9381 .raw_writefn = raw_write, .writefn = sctlr_write, 9382 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 9383 .resetvalue = cpu->reset_sctlr }, 9384 }; 9385 9386 define_arm_cp_regs(cpu, el3_regs); 9387 } 9388 /* 9389 * The behaviour of NSACR is sufficiently various that we don't 9390 * try to describe it in a single reginfo: 9391 * if EL3 is 64 bit, then trap to EL3 from S EL1, 9392 * reads as constant 0xc00 from NS EL1 and NS EL2 9393 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 9394 * if v7 without EL3, register doesn't exist 9395 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 9396 */ 9397 if (arm_feature(env, ARM_FEATURE_EL3)) { 9398 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 9399 static const ARMCPRegInfo nsacr = { 9400 .name = "NSACR", .type = ARM_CP_CONST, 9401 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 9402 .access = PL1_RW, .accessfn = nsacr_access, 9403 .resetvalue = 0xc00 9404 }; 9405 define_one_arm_cp_reg(cpu, &nsacr); 9406 } else { 9407 static const ARMCPRegInfo nsacr = { 9408 .name = "NSACR", 9409 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 9410 .access = PL3_RW | PL1_R, 9411 .resetvalue = 0, 9412 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 9413 }; 9414 define_one_arm_cp_reg(cpu, &nsacr); 9415 } 9416 } else { 9417 if (arm_feature(env, ARM_FEATURE_V8)) { 9418 static const ARMCPRegInfo nsacr = { 9419 .name = "NSACR", .type = ARM_CP_CONST, 9420 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 9421 .access = PL1_R, 9422 .resetvalue = 0xc00 9423 }; 9424 define_one_arm_cp_reg(cpu, &nsacr); 9425 } 9426 } 9427 9428 if (arm_feature(env, ARM_FEATURE_PMSA)) { 9429 if (arm_feature(env, ARM_FEATURE_V6)) { 9430 /* PMSAv6 not implemented */ 9431 assert(arm_feature(env, ARM_FEATURE_V7)); 9432 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 9433 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 9434 } else { 9435 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 9436 } 9437 } else { 9438 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 9439 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 9440 /* TTCBR2 is introduced with ARMv8.2-AA32HPD. */ 9441 if (cpu_isar_feature(aa32_hpd, cpu)) { 9442 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 9443 } 9444 } 9445 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 9446 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 9447 } 9448 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 9449 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 9450 } 9451 if (cpu_isar_feature(aa64_ecv_traps, cpu)) { 9452 define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo); 9453 } 9454 #ifndef CONFIG_USER_ONLY 9455 if (cpu_isar_feature(aa64_ecv, cpu)) { 9456 define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo); 9457 } 9458 #endif 9459 if (arm_feature(env, ARM_FEATURE_VAPA)) { 9460 ARMCPRegInfo vapa_cp_reginfo[] = { 9461 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 9462 .access = PL1_RW, .resetvalue = 0, 9463 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 9464 offsetoflow32(CPUARMState, cp15.par_ns) }, 9465 .writefn = par_write}, 9466 #ifndef CONFIG_USER_ONLY 9467 /* This underdecoding is safe because the reginfo is NO_RAW. */ 9468 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 9469 .access = PL1_W, .accessfn = ats_access, 9470 .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 9471 #endif 9472 }; 9473 9474 /* 9475 * When LPAE exists this 32-bit PAR register is an alias of the 9476 * 64-bit AArch32 PAR register defined in lpae_cp_reginfo[] 9477 */ 9478 if (arm_feature(env, ARM_FEATURE_LPAE)) { 9479 vapa_cp_reginfo[0].type = ARM_CP_ALIAS | ARM_CP_NO_GDB; 9480 } 9481 define_arm_cp_regs(cpu, vapa_cp_reginfo); 9482 } 9483 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 9484 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 9485 } 9486 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 9487 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 9488 } 9489 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 9490 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 9491 } 9492 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 9493 define_arm_cp_regs(cpu, omap_cp_reginfo); 9494 } 9495 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 9496 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 9497 } 9498 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 9499 define_arm_cp_regs(cpu, xscale_cp_reginfo); 9500 } 9501 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 9502 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 9503 } 9504 if (arm_feature(env, ARM_FEATURE_LPAE)) { 9505 define_arm_cp_regs(cpu, lpae_cp_reginfo); 9506 } 9507 if (cpu_isar_feature(aa32_jazelle, cpu)) { 9508 define_arm_cp_regs(cpu, jazelle_regs); 9509 } 9510 /* 9511 * Slightly awkwardly, the OMAP and StrongARM cores need all of 9512 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 9513 * be read-only (ie write causes UNDEF exception). 9514 */ 9515 { 9516 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 9517 /* 9518 * Pre-v8 MIDR space. 9519 * Note that the MIDR isn't a simple constant register because 9520 * of the TI925 behaviour where writes to another register can 9521 * cause the MIDR value to change. 9522 * 9523 * Unimplemented registers in the c15 0 0 0 space default to 9524 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 9525 * and friends override accordingly. 9526 */ 9527 { .name = "MIDR", 9528 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 9529 .access = PL1_R, .resetvalue = cpu->midr, 9530 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 9531 .readfn = midr_read, 9532 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 9533 .type = ARM_CP_OVERRIDE }, 9534 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 9535 { .name = "DUMMY", 9536 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 9537 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 9538 { .name = "DUMMY", 9539 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 9540 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 9541 { .name = "DUMMY", 9542 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 9543 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 9544 { .name = "DUMMY", 9545 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 9546 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 9547 { .name = "DUMMY", 9548 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 9549 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 9550 }; 9551 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 9552 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 9553 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 9554 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 9555 .fgt = FGT_MIDR_EL1, 9556 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 9557 .readfn = midr_read }, 9558 /* crn = 0 op1 = 0 crm = 0 op2 = 7 : AArch32 aliases of MIDR */ 9559 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 9560 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 9561 .access = PL1_R, .resetvalue = cpu->midr }, 9562 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 9563 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 9564 .access = PL1_R, 9565 .accessfn = access_aa64_tid1, 9566 .fgt = FGT_REVIDR_EL1, 9567 .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 9568 }; 9569 ARMCPRegInfo id_v8_midr_alias_cp_reginfo = { 9570 .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST | ARM_CP_NO_GDB, 9571 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 9572 .access = PL1_R, .resetvalue = cpu->midr 9573 }; 9574 ARMCPRegInfo id_cp_reginfo[] = { 9575 /* These are common to v8 and pre-v8 */ 9576 { .name = "CTR", 9577 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 9578 .access = PL1_R, .accessfn = ctr_el0_access, 9579 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 9580 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 9581 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 9582 .access = PL0_R, .accessfn = ctr_el0_access, 9583 .fgt = FGT_CTR_EL0, 9584 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 9585 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 9586 { .name = "TCMTR", 9587 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 9588 .access = PL1_R, 9589 .accessfn = access_aa32_tid1, 9590 .type = ARM_CP_CONST, .resetvalue = 0 }, 9591 }; 9592 /* TLBTR is specific to VMSA */ 9593 ARMCPRegInfo id_tlbtr_reginfo = { 9594 .name = "TLBTR", 9595 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 9596 .access = PL1_R, 9597 .accessfn = access_aa32_tid1, 9598 .type = ARM_CP_CONST, .resetvalue = 0, 9599 }; 9600 /* MPUIR is specific to PMSA V6+ */ 9601 ARMCPRegInfo id_mpuir_reginfo = { 9602 .name = "MPUIR", 9603 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 9604 .access = PL1_R, .type = ARM_CP_CONST, 9605 .resetvalue = cpu->pmsav7_dregion << 8 9606 }; 9607 /* HMPUIR is specific to PMSA V8 */ 9608 ARMCPRegInfo id_hmpuir_reginfo = { 9609 .name = "HMPUIR", 9610 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 4, 9611 .access = PL2_R, .type = ARM_CP_CONST, 9612 .resetvalue = cpu->pmsav8r_hdregion 9613 }; 9614 static const ARMCPRegInfo crn0_wi_reginfo = { 9615 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 9616 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 9617 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 9618 }; 9619 #ifdef CONFIG_USER_ONLY 9620 static const ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = { 9621 { .name = "MIDR_EL1", 9622 .exported_bits = R_MIDR_EL1_REVISION_MASK | 9623 R_MIDR_EL1_PARTNUM_MASK | 9624 R_MIDR_EL1_ARCHITECTURE_MASK | 9625 R_MIDR_EL1_VARIANT_MASK | 9626 R_MIDR_EL1_IMPLEMENTER_MASK }, 9627 { .name = "REVIDR_EL1" }, 9628 }; 9629 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo); 9630 #endif 9631 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 9632 arm_feature(env, ARM_FEATURE_STRONGARM)) { 9633 size_t i; 9634 /* 9635 * Register the blanket "writes ignored" value first to cover the 9636 * whole space. Then update the specific ID registers to allow write 9637 * access, so that they ignore writes rather than causing them to 9638 * UNDEF. 9639 */ 9640 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 9641 for (i = 0; i < ARRAY_SIZE(id_pre_v8_midr_cp_reginfo); ++i) { 9642 id_pre_v8_midr_cp_reginfo[i].access = PL1_RW; 9643 } 9644 for (i = 0; i < ARRAY_SIZE(id_cp_reginfo); ++i) { 9645 id_cp_reginfo[i].access = PL1_RW; 9646 } 9647 id_mpuir_reginfo.access = PL1_RW; 9648 id_tlbtr_reginfo.access = PL1_RW; 9649 } 9650 if (arm_feature(env, ARM_FEATURE_V8)) { 9651 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 9652 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 9653 define_one_arm_cp_reg(cpu, &id_v8_midr_alias_cp_reginfo); 9654 } 9655 } else { 9656 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 9657 } 9658 define_arm_cp_regs(cpu, id_cp_reginfo); 9659 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 9660 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 9661 } else if (arm_feature(env, ARM_FEATURE_PMSA) && 9662 arm_feature(env, ARM_FEATURE_V8)) { 9663 uint32_t i = 0; 9664 char *tmp_string; 9665 9666 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 9667 define_one_arm_cp_reg(cpu, &id_hmpuir_reginfo); 9668 define_arm_cp_regs(cpu, pmsav8r_cp_reginfo); 9669 9670 /* Register alias is only valid for first 32 indexes */ 9671 for (i = 0; i < MIN(cpu->pmsav7_dregion, 32); ++i) { 9672 uint8_t crm = 0b1000 | extract32(i, 1, 3); 9673 uint8_t opc1 = extract32(i, 4, 1); 9674 uint8_t opc2 = extract32(i, 0, 1) << 2; 9675 9676 tmp_string = g_strdup_printf("PRBAR%u", i); 9677 ARMCPRegInfo tmp_prbarn_reginfo = { 9678 .name = tmp_string, .type = ARM_CP_ALIAS | ARM_CP_NO_RAW, 9679 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 9680 .access = PL1_RW, .resetvalue = 0, 9681 .accessfn = access_tvm_trvm, 9682 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 9683 }; 9684 define_one_arm_cp_reg(cpu, &tmp_prbarn_reginfo); 9685 g_free(tmp_string); 9686 9687 opc2 = extract32(i, 0, 1) << 2 | 0x1; 9688 tmp_string = g_strdup_printf("PRLAR%u", i); 9689 ARMCPRegInfo tmp_prlarn_reginfo = { 9690 .name = tmp_string, .type = ARM_CP_ALIAS | ARM_CP_NO_RAW, 9691 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 9692 .access = PL1_RW, .resetvalue = 0, 9693 .accessfn = access_tvm_trvm, 9694 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 9695 }; 9696 define_one_arm_cp_reg(cpu, &tmp_prlarn_reginfo); 9697 g_free(tmp_string); 9698 } 9699 9700 /* Register alias is only valid for first 32 indexes */ 9701 for (i = 0; i < MIN(cpu->pmsav8r_hdregion, 32); ++i) { 9702 uint8_t crm = 0b1000 | extract32(i, 1, 3); 9703 uint8_t opc1 = 0b100 | extract32(i, 4, 1); 9704 uint8_t opc2 = extract32(i, 0, 1) << 2; 9705 9706 tmp_string = g_strdup_printf("HPRBAR%u", i); 9707 ARMCPRegInfo tmp_hprbarn_reginfo = { 9708 .name = tmp_string, 9709 .type = ARM_CP_NO_RAW, 9710 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 9711 .access = PL2_RW, .resetvalue = 0, 9712 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 9713 }; 9714 define_one_arm_cp_reg(cpu, &tmp_hprbarn_reginfo); 9715 g_free(tmp_string); 9716 9717 opc2 = extract32(i, 0, 1) << 2 | 0x1; 9718 tmp_string = g_strdup_printf("HPRLAR%u", i); 9719 ARMCPRegInfo tmp_hprlarn_reginfo = { 9720 .name = tmp_string, 9721 .type = ARM_CP_NO_RAW, 9722 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 9723 .access = PL2_RW, .resetvalue = 0, 9724 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 9725 }; 9726 define_one_arm_cp_reg(cpu, &tmp_hprlarn_reginfo); 9727 g_free(tmp_string); 9728 } 9729 } else if (arm_feature(env, ARM_FEATURE_V7)) { 9730 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 9731 } 9732 } 9733 9734 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 9735 ARMCPRegInfo mpidr_cp_reginfo[] = { 9736 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH, 9737 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 9738 .fgt = FGT_MPIDR_EL1, 9739 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 9740 }; 9741 #ifdef CONFIG_USER_ONLY 9742 static const ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = { 9743 { .name = "MPIDR_EL1", 9744 .fixed_bits = 0x0000000080000000 }, 9745 }; 9746 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo); 9747 #endif 9748 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 9749 } 9750 9751 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 9752 ARMCPRegInfo auxcr_reginfo[] = { 9753 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 9754 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 9755 .access = PL1_RW, .accessfn = access_tacr, 9756 .nv2_redirect_offset = 0x118, 9757 .type = ARM_CP_CONST, .resetvalue = cpu->reset_auxcr }, 9758 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 9759 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 9760 .access = PL2_RW, .type = ARM_CP_CONST, 9761 .resetvalue = 0 }, 9762 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 9763 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 9764 .access = PL3_RW, .type = ARM_CP_CONST, 9765 .resetvalue = 0 }, 9766 }; 9767 define_arm_cp_regs(cpu, auxcr_reginfo); 9768 if (cpu_isar_feature(aa32_ac2, cpu)) { 9769 define_arm_cp_regs(cpu, actlr2_hactlr2_reginfo); 9770 } 9771 } 9772 9773 if (arm_feature(env, ARM_FEATURE_CBAR)) { 9774 /* 9775 * CBAR is IMPDEF, but common on Arm Cortex-A implementations. 9776 * There are two flavours: 9777 * (1) older 32-bit only cores have a simple 32-bit CBAR 9778 * (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a 9779 * 32-bit register visible to AArch32 at a different encoding 9780 * to the "flavour 1" register and with the bits rearranged to 9781 * be able to squash a 64-bit address into the 32-bit view. 9782 * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but 9783 * in future if we support AArch32-only configs of some of the 9784 * AArch64 cores we might need to add a specific feature flag 9785 * to indicate cores with "flavour 2" CBAR. 9786 */ 9787 if (arm_feature(env, ARM_FEATURE_V8)) { 9788 /* 32 bit view is [31:18] 0...0 [43:32]. */ 9789 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 9790 | extract64(cpu->reset_cbar, 32, 12); 9791 ARMCPRegInfo cbar_reginfo[] = { 9792 { .name = "CBAR", 9793 .type = ARM_CP_CONST, 9794 .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0, 9795 .access = PL1_R, .resetvalue = cbar32 }, 9796 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 9797 .type = ARM_CP_CONST, 9798 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 9799 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 9800 }; 9801 /* We don't implement a r/w 64 bit CBAR currently */ 9802 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 9803 define_arm_cp_regs(cpu, cbar_reginfo); 9804 } else { 9805 ARMCPRegInfo cbar = { 9806 .name = "CBAR", 9807 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 9808 .access = PL1_R | PL3_W, .resetvalue = cpu->reset_cbar, 9809 .fieldoffset = offsetof(CPUARMState, 9810 cp15.c15_config_base_address) 9811 }; 9812 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 9813 cbar.access = PL1_R; 9814 cbar.fieldoffset = 0; 9815 cbar.type = ARM_CP_CONST; 9816 } 9817 define_one_arm_cp_reg(cpu, &cbar); 9818 } 9819 } 9820 9821 if (arm_feature(env, ARM_FEATURE_VBAR)) { 9822 static const ARMCPRegInfo vbar_cp_reginfo[] = { 9823 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 9824 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 9825 .access = PL1_RW, .writefn = vbar_write, 9826 .accessfn = access_nv1, 9827 .fgt = FGT_VBAR_EL1, 9828 .nv2_redirect_offset = 0x250 | NV2_REDIR_NV1, 9829 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 9830 offsetof(CPUARMState, cp15.vbar_ns) }, 9831 .resetvalue = 0 }, 9832 }; 9833 define_arm_cp_regs(cpu, vbar_cp_reginfo); 9834 } 9835 9836 /* Generic registers whose values depend on the implementation */ 9837 { 9838 ARMCPRegInfo sctlr = { 9839 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 9840 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 9841 .access = PL1_RW, .accessfn = access_tvm_trvm, 9842 .fgt = FGT_SCTLR_EL1, 9843 .nv2_redirect_offset = 0x110 | NV2_REDIR_NV1, 9844 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 9845 offsetof(CPUARMState, cp15.sctlr_ns) }, 9846 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 9847 .raw_writefn = raw_write, 9848 }; 9849 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 9850 /* 9851 * Normally we would always end the TB on an SCTLR write, but Linux 9852 * arch/arm/mach-pxa/sleep.S expects two instructions following 9853 * an MMU enable to execute from cache. Imitate this behaviour. 9854 */ 9855 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 9856 } 9857 define_one_arm_cp_reg(cpu, &sctlr); 9858 9859 if (arm_feature(env, ARM_FEATURE_PMSA) && 9860 arm_feature(env, ARM_FEATURE_V8)) { 9861 ARMCPRegInfo vsctlr = { 9862 .name = "VSCTLR", .state = ARM_CP_STATE_AA32, 9863 .cp = 15, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 9864 .access = PL2_RW, .resetvalue = 0x0, 9865 .fieldoffset = offsetoflow32(CPUARMState, cp15.vsctlr), 9866 }; 9867 define_one_arm_cp_reg(cpu, &vsctlr); 9868 } 9869 } 9870 9871 if (cpu_isar_feature(aa64_lor, cpu)) { 9872 define_arm_cp_regs(cpu, lor_reginfo); 9873 } 9874 if (cpu_isar_feature(aa64_pan, cpu)) { 9875 define_one_arm_cp_reg(cpu, &pan_reginfo); 9876 } 9877 #ifndef CONFIG_USER_ONLY 9878 if (cpu_isar_feature(aa64_ats1e1, cpu)) { 9879 define_arm_cp_regs(cpu, ats1e1_reginfo); 9880 } 9881 if (cpu_isar_feature(aa32_ats1e1, cpu)) { 9882 define_arm_cp_regs(cpu, ats1cp_reginfo); 9883 } 9884 #endif 9885 if (cpu_isar_feature(aa64_uao, cpu)) { 9886 define_one_arm_cp_reg(cpu, &uao_reginfo); 9887 } 9888 9889 if (cpu_isar_feature(aa64_dit, cpu)) { 9890 define_one_arm_cp_reg(cpu, &dit_reginfo); 9891 } 9892 if (cpu_isar_feature(aa64_ssbs, cpu)) { 9893 define_one_arm_cp_reg(cpu, &ssbs_reginfo); 9894 } 9895 if (cpu_isar_feature(any_ras, cpu)) { 9896 define_arm_cp_regs(cpu, minimal_ras_reginfo); 9897 } 9898 9899 if (cpu_isar_feature(aa64_vh, cpu) || 9900 cpu_isar_feature(aa64_debugv8p2, cpu)) { 9901 define_one_arm_cp_reg(cpu, &contextidr_el2); 9902 } 9903 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 9904 define_arm_cp_regs(cpu, vhe_reginfo); 9905 } 9906 9907 if (cpu_isar_feature(aa64_sve, cpu)) { 9908 define_arm_cp_regs(cpu, zcr_reginfo); 9909 } 9910 9911 if (cpu_isar_feature(aa64_hcx, cpu)) { 9912 define_one_arm_cp_reg(cpu, &hcrx_el2_reginfo); 9913 } 9914 9915 #ifdef TARGET_AARCH64 9916 if (cpu_isar_feature(aa64_sme, cpu)) { 9917 define_arm_cp_regs(cpu, sme_reginfo); 9918 } 9919 if (cpu_isar_feature(aa64_pauth, cpu)) { 9920 define_arm_cp_regs(cpu, pauth_reginfo); 9921 } 9922 if (cpu_isar_feature(aa64_rndr, cpu)) { 9923 define_arm_cp_regs(cpu, rndr_reginfo); 9924 } 9925 if (cpu_isar_feature(aa64_tlbirange, cpu)) { 9926 define_arm_cp_regs(cpu, tlbirange_reginfo); 9927 } 9928 if (cpu_isar_feature(aa64_tlbios, cpu)) { 9929 define_arm_cp_regs(cpu, tlbios_reginfo); 9930 } 9931 /* Data Cache clean instructions up to PoP */ 9932 if (cpu_isar_feature(aa64_dcpop, cpu)) { 9933 define_one_arm_cp_reg(cpu, dcpop_reg); 9934 9935 if (cpu_isar_feature(aa64_dcpodp, cpu)) { 9936 define_one_arm_cp_reg(cpu, dcpodp_reg); 9937 } 9938 } 9939 9940 /* 9941 * If full MTE is enabled, add all of the system registers. 9942 * If only "instructions available at EL0" are enabled, 9943 * then define only a RAZ/WI version of PSTATE.TCO. 9944 */ 9945 if (cpu_isar_feature(aa64_mte, cpu)) { 9946 ARMCPRegInfo gmid_reginfo = { 9947 .name = "GMID_EL1", .state = ARM_CP_STATE_AA64, 9948 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 4, 9949 .access = PL1_R, .accessfn = access_aa64_tid5, 9950 .type = ARM_CP_CONST, .resetvalue = cpu->gm_blocksize, 9951 }; 9952 define_one_arm_cp_reg(cpu, &gmid_reginfo); 9953 define_arm_cp_regs(cpu, mte_reginfo); 9954 define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo); 9955 } else if (cpu_isar_feature(aa64_mte_insn_reg, cpu)) { 9956 define_arm_cp_regs(cpu, mte_tco_ro_reginfo); 9957 define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo); 9958 } 9959 9960 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 9961 define_arm_cp_regs(cpu, scxtnum_reginfo); 9962 } 9963 9964 if (cpu_isar_feature(aa64_fgt, cpu)) { 9965 define_arm_cp_regs(cpu, fgt_reginfo); 9966 } 9967 9968 if (cpu_isar_feature(aa64_rme, cpu)) { 9969 define_arm_cp_regs(cpu, rme_reginfo); 9970 if (cpu_isar_feature(aa64_mte, cpu)) { 9971 define_arm_cp_regs(cpu, rme_mte_reginfo); 9972 } 9973 } 9974 9975 if (cpu_isar_feature(aa64_nv2, cpu)) { 9976 define_arm_cp_regs(cpu, nv2_reginfo); 9977 } 9978 9979 if (cpu_isar_feature(aa64_nmi, cpu)) { 9980 define_arm_cp_regs(cpu, nmi_reginfo); 9981 } 9982 #endif 9983 9984 if (cpu_isar_feature(any_predinv, cpu)) { 9985 define_arm_cp_regs(cpu, predinv_reginfo); 9986 } 9987 9988 if (cpu_isar_feature(any_ccidx, cpu)) { 9989 define_arm_cp_regs(cpu, ccsidr2_reginfo); 9990 } 9991 9992 #ifndef CONFIG_USER_ONLY 9993 /* 9994 * Register redirections and aliases must be done last, 9995 * after the registers from the other extensions have been defined. 9996 */ 9997 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 9998 define_arm_vh_e2h_redirects_aliases(cpu); 9999 } 10000 #endif 10001 } 10002 10003 /* 10004 * Private utility function for define_one_arm_cp_reg_with_opaque(): 10005 * add a single reginfo struct to the hash table. 10006 */ 10007 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 10008 void *opaque, CPState state, 10009 CPSecureState secstate, 10010 int crm, int opc1, int opc2, 10011 const char *name) 10012 { 10013 CPUARMState *env = &cpu->env; 10014 uint32_t key; 10015 ARMCPRegInfo *r2; 10016 bool is64 = r->type & ARM_CP_64BIT; 10017 bool ns = secstate & ARM_CP_SECSTATE_NS; 10018 int cp = r->cp; 10019 size_t name_len; 10020 bool make_const; 10021 10022 switch (state) { 10023 case ARM_CP_STATE_AA32: 10024 /* We assume it is a cp15 register if the .cp field is left unset. */ 10025 if (cp == 0 && r->state == ARM_CP_STATE_BOTH) { 10026 cp = 15; 10027 } 10028 key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2); 10029 break; 10030 case ARM_CP_STATE_AA64: 10031 /* 10032 * To allow abbreviation of ARMCPRegInfo definitions, we treat 10033 * cp == 0 as equivalent to the value for "standard guest-visible 10034 * sysreg". STATE_BOTH definitions are also always "standard sysreg" 10035 * in their AArch64 view (the .cp value may be non-zero for the 10036 * benefit of the AArch32 view). 10037 */ 10038 if (cp == 0 || r->state == ARM_CP_STATE_BOTH) { 10039 cp = CP_REG_ARM64_SYSREG_CP; 10040 } 10041 key = ENCODE_AA64_CP_REG(cp, r->crn, crm, r->opc0, opc1, opc2); 10042 break; 10043 default: 10044 g_assert_not_reached(); 10045 } 10046 10047 /* Overriding of an existing definition must be explicitly requested. */ 10048 if (!(r->type & ARM_CP_OVERRIDE)) { 10049 const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key); 10050 if (oldreg) { 10051 assert(oldreg->type & ARM_CP_OVERRIDE); 10052 } 10053 } 10054 10055 /* 10056 * Eliminate registers that are not present because the EL is missing. 10057 * Doing this here makes it easier to put all registers for a given 10058 * feature into the same ARMCPRegInfo array and define them all at once. 10059 */ 10060 make_const = false; 10061 if (arm_feature(env, ARM_FEATURE_EL3)) { 10062 /* 10063 * An EL2 register without EL2 but with EL3 is (usually) RES0. 10064 * See rule RJFFP in section D1.1.3 of DDI0487H.a. 10065 */ 10066 int min_el = ctz32(r->access) / 2; 10067 if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) { 10068 if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) { 10069 return; 10070 } 10071 make_const = !(r->type & ARM_CP_EL3_NO_EL2_KEEP); 10072 } 10073 } else { 10074 CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2) 10075 ? PL2_RW : PL1_RW); 10076 if ((r->access & max_el) == 0) { 10077 return; 10078 } 10079 } 10080 10081 /* Combine cpreg and name into one allocation. */ 10082 name_len = strlen(name) + 1; 10083 r2 = g_malloc(sizeof(*r2) + name_len); 10084 *r2 = *r; 10085 r2->name = memcpy(r2 + 1, name, name_len); 10086 10087 /* 10088 * Update fields to match the instantiation, overwiting wildcards 10089 * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH. 10090 */ 10091 r2->cp = cp; 10092 r2->crm = crm; 10093 r2->opc1 = opc1; 10094 r2->opc2 = opc2; 10095 r2->state = state; 10096 r2->secure = secstate; 10097 if (opaque) { 10098 r2->opaque = opaque; 10099 } 10100 10101 if (make_const) { 10102 /* This should not have been a very special register to begin. */ 10103 int old_special = r2->type & ARM_CP_SPECIAL_MASK; 10104 assert(old_special == 0 || old_special == ARM_CP_NOP); 10105 /* 10106 * Set the special function to CONST, retaining the other flags. 10107 * This is important for e.g. ARM_CP_SVE so that we still 10108 * take the SVE trap if CPTR_EL3.EZ == 0. 10109 */ 10110 r2->type = (r2->type & ~ARM_CP_SPECIAL_MASK) | ARM_CP_CONST; 10111 /* 10112 * Usually, these registers become RES0, but there are a few 10113 * special cases like VPIDR_EL2 which have a constant non-zero 10114 * value with writes ignored. 10115 */ 10116 if (!(r->type & ARM_CP_EL3_NO_EL2_C_NZ)) { 10117 r2->resetvalue = 0; 10118 } 10119 /* 10120 * ARM_CP_CONST has precedence, so removing the callbacks and 10121 * offsets are not strictly necessary, but it is potentially 10122 * less confusing to debug later. 10123 */ 10124 r2->readfn = NULL; 10125 r2->writefn = NULL; 10126 r2->raw_readfn = NULL; 10127 r2->raw_writefn = NULL; 10128 r2->resetfn = NULL; 10129 r2->fieldoffset = 0; 10130 r2->bank_fieldoffsets[0] = 0; 10131 r2->bank_fieldoffsets[1] = 0; 10132 } else { 10133 bool isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]; 10134 10135 if (isbanked) { 10136 /* 10137 * Register is banked (using both entries in array). 10138 * Overwriting fieldoffset as the array is only used to define 10139 * banked registers but later only fieldoffset is used. 10140 */ 10141 r2->fieldoffset = r->bank_fieldoffsets[ns]; 10142 } 10143 if (state == ARM_CP_STATE_AA32) { 10144 if (isbanked) { 10145 /* 10146 * If the register is banked then we don't need to migrate or 10147 * reset the 32-bit instance in certain cases: 10148 * 10149 * 1) If the register has both 32-bit and 64-bit instances 10150 * then we can count on the 64-bit instance taking care 10151 * of the non-secure bank. 10152 * 2) If ARMv8 is enabled then we can count on a 64-bit 10153 * version taking care of the secure bank. This requires 10154 * that separate 32 and 64-bit definitions are provided. 10155 */ 10156 if ((r->state == ARM_CP_STATE_BOTH && ns) || 10157 (arm_feature(env, ARM_FEATURE_V8) && !ns)) { 10158 r2->type |= ARM_CP_ALIAS; 10159 } 10160 } else if ((secstate != r->secure) && !ns) { 10161 /* 10162 * The register is not banked so we only want to allow 10163 * migration of the non-secure instance. 10164 */ 10165 r2->type |= ARM_CP_ALIAS; 10166 } 10167 10168 if (HOST_BIG_ENDIAN && 10169 r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) { 10170 r2->fieldoffset += sizeof(uint32_t); 10171 } 10172 } 10173 } 10174 10175 /* 10176 * By convention, for wildcarded registers only the first 10177 * entry is used for migration; the others are marked as 10178 * ALIAS so we don't try to transfer the register 10179 * multiple times. Special registers (ie NOP/WFI) are 10180 * never migratable and not even raw-accessible. 10181 */ 10182 if (r2->type & ARM_CP_SPECIAL_MASK) { 10183 r2->type |= ARM_CP_NO_RAW; 10184 } 10185 if (((r->crm == CP_ANY) && crm != 0) || 10186 ((r->opc1 == CP_ANY) && opc1 != 0) || 10187 ((r->opc2 == CP_ANY) && opc2 != 0)) { 10188 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 10189 } 10190 10191 /* 10192 * Check that raw accesses are either forbidden or handled. Note that 10193 * we can't assert this earlier because the setup of fieldoffset for 10194 * banked registers has to be done first. 10195 */ 10196 if (!(r2->type & ARM_CP_NO_RAW)) { 10197 assert(!raw_accessors_invalid(r2)); 10198 } 10199 10200 g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2); 10201 } 10202 10203 10204 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 10205 const ARMCPRegInfo *r, void *opaque) 10206 { 10207 /* 10208 * Define implementations of coprocessor registers. 10209 * We store these in a hashtable because typically 10210 * there are less than 150 registers in a space which 10211 * is 16*16*16*8*8 = 262144 in size. 10212 * Wildcarding is supported for the crm, opc1 and opc2 fields. 10213 * If a register is defined twice then the second definition is 10214 * used, so this can be used to define some generic registers and 10215 * then override them with implementation specific variations. 10216 * At least one of the original and the second definition should 10217 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 10218 * against accidental use. 10219 * 10220 * The state field defines whether the register is to be 10221 * visible in the AArch32 or AArch64 execution state. If the 10222 * state is set to ARM_CP_STATE_BOTH then we synthesise a 10223 * reginfo structure for the AArch32 view, which sees the lower 10224 * 32 bits of the 64 bit register. 10225 * 10226 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 10227 * be wildcarded. AArch64 registers are always considered to be 64 10228 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 10229 * the register, if any. 10230 */ 10231 int crm, opc1, opc2; 10232 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 10233 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 10234 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 10235 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 10236 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 10237 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 10238 CPState state; 10239 10240 /* 64 bit registers have only CRm and Opc1 fields */ 10241 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 10242 /* op0 only exists in the AArch64 encodings */ 10243 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 10244 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 10245 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 10246 /* 10247 * This API is only for Arm's system coprocessors (14 and 15) or 10248 * (M-profile or v7A-and-earlier only) for implementation defined 10249 * coprocessors in the range 0..7. Our decode assumes this, since 10250 * 8..13 can be used for other insns including VFP and Neon. See 10251 * valid_cp() in translate.c. Assert here that we haven't tried 10252 * to use an invalid coprocessor number. 10253 */ 10254 switch (r->state) { 10255 case ARM_CP_STATE_BOTH: 10256 /* 0 has a special meaning, but otherwise the same rules as AA32. */ 10257 if (r->cp == 0) { 10258 break; 10259 } 10260 /* fall through */ 10261 case ARM_CP_STATE_AA32: 10262 if (arm_feature(&cpu->env, ARM_FEATURE_V8) && 10263 !arm_feature(&cpu->env, ARM_FEATURE_M)) { 10264 assert(r->cp >= 14 && r->cp <= 15); 10265 } else { 10266 assert(r->cp < 8 || (r->cp >= 14 && r->cp <= 15)); 10267 } 10268 break; 10269 case ARM_CP_STATE_AA64: 10270 assert(r->cp == 0 || r->cp == CP_REG_ARM64_SYSREG_CP); 10271 break; 10272 default: 10273 g_assert_not_reached(); 10274 } 10275 /* 10276 * The AArch64 pseudocode CheckSystemAccess() specifies that op1 10277 * encodes a minimum access level for the register. We roll this 10278 * runtime check into our general permission check code, so check 10279 * here that the reginfo's specified permissions are strict enough 10280 * to encompass the generic architectural permission check. 10281 */ 10282 if (r->state != ARM_CP_STATE_AA32) { 10283 CPAccessRights mask; 10284 switch (r->opc1) { 10285 case 0: 10286 /* min_EL EL1, but some accessible to EL0 via kernel ABI */ 10287 mask = PL0U_R | PL1_RW; 10288 break; 10289 case 1: case 2: 10290 /* min_EL EL1 */ 10291 mask = PL1_RW; 10292 break; 10293 case 3: 10294 /* min_EL EL0 */ 10295 mask = PL0_RW; 10296 break; 10297 case 4: 10298 case 5: 10299 /* min_EL EL2 */ 10300 mask = PL2_RW; 10301 break; 10302 case 6: 10303 /* min_EL EL3 */ 10304 mask = PL3_RW; 10305 break; 10306 case 7: 10307 /* min_EL EL1, secure mode only (we don't check the latter) */ 10308 mask = PL1_RW; 10309 break; 10310 default: 10311 /* broken reginfo with out-of-range opc1 */ 10312 g_assert_not_reached(); 10313 } 10314 /* assert our permissions are not too lax (stricter is fine) */ 10315 assert((r->access & ~mask) == 0); 10316 } 10317 10318 /* 10319 * Check that the register definition has enough info to handle 10320 * reads and writes if they are permitted. 10321 */ 10322 if (!(r->type & (ARM_CP_SPECIAL_MASK | ARM_CP_CONST))) { 10323 if (r->access & PL3_R) { 10324 assert((r->fieldoffset || 10325 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 10326 r->readfn); 10327 } 10328 if (r->access & PL3_W) { 10329 assert((r->fieldoffset || 10330 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 10331 r->writefn); 10332 } 10333 } 10334 10335 for (crm = crmmin; crm <= crmmax; crm++) { 10336 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 10337 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 10338 for (state = ARM_CP_STATE_AA32; 10339 state <= ARM_CP_STATE_AA64; state++) { 10340 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 10341 continue; 10342 } 10343 if (state == ARM_CP_STATE_AA32) { 10344 /* 10345 * Under AArch32 CP registers can be common 10346 * (same for secure and non-secure world) or banked. 10347 */ 10348 char *name; 10349 10350 switch (r->secure) { 10351 case ARM_CP_SECSTATE_S: 10352 case ARM_CP_SECSTATE_NS: 10353 add_cpreg_to_hashtable(cpu, r, opaque, state, 10354 r->secure, crm, opc1, opc2, 10355 r->name); 10356 break; 10357 case ARM_CP_SECSTATE_BOTH: 10358 name = g_strdup_printf("%s_S", r->name); 10359 add_cpreg_to_hashtable(cpu, r, opaque, state, 10360 ARM_CP_SECSTATE_S, 10361 crm, opc1, opc2, name); 10362 g_free(name); 10363 add_cpreg_to_hashtable(cpu, r, opaque, state, 10364 ARM_CP_SECSTATE_NS, 10365 crm, opc1, opc2, r->name); 10366 break; 10367 default: 10368 g_assert_not_reached(); 10369 } 10370 } else { 10371 /* 10372 * AArch64 registers get mapped to non-secure instance 10373 * of AArch32 10374 */ 10375 add_cpreg_to_hashtable(cpu, r, opaque, state, 10376 ARM_CP_SECSTATE_NS, 10377 crm, opc1, opc2, r->name); 10378 } 10379 } 10380 } 10381 } 10382 } 10383 } 10384 10385 /* Define a whole list of registers */ 10386 void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs, 10387 void *opaque, size_t len) 10388 { 10389 size_t i; 10390 for (i = 0; i < len; ++i) { 10391 define_one_arm_cp_reg_with_opaque(cpu, regs + i, opaque); 10392 } 10393 } 10394 10395 /* 10396 * Modify ARMCPRegInfo for access from userspace. 10397 * 10398 * This is a data driven modification directed by 10399 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as 10400 * user-space cannot alter any values and dynamic values pertaining to 10401 * execution state are hidden from user space view anyway. 10402 */ 10403 void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len, 10404 const ARMCPRegUserSpaceInfo *mods, 10405 size_t mods_len) 10406 { 10407 for (size_t mi = 0; mi < mods_len; ++mi) { 10408 const ARMCPRegUserSpaceInfo *m = mods + mi; 10409 GPatternSpec *pat = NULL; 10410 10411 if (m->is_glob) { 10412 pat = g_pattern_spec_new(m->name); 10413 } 10414 for (size_t ri = 0; ri < regs_len; ++ri) { 10415 ARMCPRegInfo *r = regs + ri; 10416 10417 if (pat && g_pattern_match_string(pat, r->name)) { 10418 r->type = ARM_CP_CONST; 10419 r->access = PL0U_R; 10420 r->resetvalue = 0; 10421 /* continue */ 10422 } else if (strcmp(r->name, m->name) == 0) { 10423 r->type = ARM_CP_CONST; 10424 r->access = PL0U_R; 10425 r->resetvalue &= m->exported_bits; 10426 r->resetvalue |= m->fixed_bits; 10427 break; 10428 } 10429 } 10430 if (pat) { 10431 g_pattern_spec_free(pat); 10432 } 10433 } 10434 } 10435 10436 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 10437 { 10438 return g_hash_table_lookup(cpregs, (gpointer)(uintptr_t)encoded_cp); 10439 } 10440 10441 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 10442 uint64_t value) 10443 { 10444 /* Helper coprocessor write function for write-ignore registers */ 10445 } 10446 10447 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 10448 { 10449 /* Helper coprocessor write function for read-as-zero registers */ 10450 return 0; 10451 } 10452 10453 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 10454 { 10455 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 10456 } 10457 10458 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 10459 { 10460 /* 10461 * Return true if it is not valid for us to switch to 10462 * this CPU mode (ie all the UNPREDICTABLE cases in 10463 * the ARM ARM CPSRWriteByInstr pseudocode). 10464 */ 10465 10466 /* Changes to or from Hyp via MSR and CPS are illegal. */ 10467 if (write_type == CPSRWriteByInstr && 10468 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 10469 mode == ARM_CPU_MODE_HYP)) { 10470 return 1; 10471 } 10472 10473 switch (mode) { 10474 case ARM_CPU_MODE_USR: 10475 return 0; 10476 case ARM_CPU_MODE_SYS: 10477 case ARM_CPU_MODE_SVC: 10478 case ARM_CPU_MODE_ABT: 10479 case ARM_CPU_MODE_UND: 10480 case ARM_CPU_MODE_IRQ: 10481 case ARM_CPU_MODE_FIQ: 10482 /* 10483 * Note that we don't implement the IMPDEF NSACR.RFR which in v7 10484 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 10485 */ 10486 /* 10487 * If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 10488 * and CPS are treated as illegal mode changes. 10489 */ 10490 if (write_type == CPSRWriteByInstr && 10491 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 10492 (arm_hcr_el2_eff(env) & HCR_TGE)) { 10493 return 1; 10494 } 10495 return 0; 10496 case ARM_CPU_MODE_HYP: 10497 return !arm_is_el2_enabled(env) || arm_current_el(env) < 2; 10498 case ARM_CPU_MODE_MON: 10499 return arm_current_el(env) < 3; 10500 default: 10501 return 1; 10502 } 10503 } 10504 10505 uint32_t cpsr_read(CPUARMState *env) 10506 { 10507 int ZF; 10508 ZF = (env->ZF == 0); 10509 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 10510 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 10511 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 10512 | ((env->condexec_bits & 0xfc) << 8) 10513 | (env->GE << 16) | (env->daif & CPSR_AIF); 10514 } 10515 10516 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 10517 CPSRWriteType write_type) 10518 { 10519 uint32_t changed_daif; 10520 bool rebuild_hflags = (write_type != CPSRWriteRaw) && 10521 (mask & (CPSR_M | CPSR_E | CPSR_IL)); 10522 10523 if (mask & CPSR_NZCV) { 10524 env->ZF = (~val) & CPSR_Z; 10525 env->NF = val; 10526 env->CF = (val >> 29) & 1; 10527 env->VF = (val << 3) & 0x80000000; 10528 } 10529 if (mask & CPSR_Q) { 10530 env->QF = ((val & CPSR_Q) != 0); 10531 } 10532 if (mask & CPSR_T) { 10533 env->thumb = ((val & CPSR_T) != 0); 10534 } 10535 if (mask & CPSR_IT_0_1) { 10536 env->condexec_bits &= ~3; 10537 env->condexec_bits |= (val >> 25) & 3; 10538 } 10539 if (mask & CPSR_IT_2_7) { 10540 env->condexec_bits &= 3; 10541 env->condexec_bits |= (val >> 8) & 0xfc; 10542 } 10543 if (mask & CPSR_GE) { 10544 env->GE = (val >> 16) & 0xf; 10545 } 10546 10547 /* 10548 * In a V7 implementation that includes the security extensions but does 10549 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 10550 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 10551 * bits respectively. 10552 * 10553 * In a V8 implementation, it is permitted for privileged software to 10554 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 10555 */ 10556 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 10557 arm_feature(env, ARM_FEATURE_EL3) && 10558 !arm_feature(env, ARM_FEATURE_EL2) && 10559 !arm_is_secure(env)) { 10560 10561 changed_daif = (env->daif ^ val) & mask; 10562 10563 if (changed_daif & CPSR_A) { 10564 /* 10565 * Check to see if we are allowed to change the masking of async 10566 * abort exceptions from a non-secure state. 10567 */ 10568 if (!(env->cp15.scr_el3 & SCR_AW)) { 10569 qemu_log_mask(LOG_GUEST_ERROR, 10570 "Ignoring attempt to switch CPSR_A flag from " 10571 "non-secure world with SCR.AW bit clear\n"); 10572 mask &= ~CPSR_A; 10573 } 10574 } 10575 10576 if (changed_daif & CPSR_F) { 10577 /* 10578 * Check to see if we are allowed to change the masking of FIQ 10579 * exceptions from a non-secure state. 10580 */ 10581 if (!(env->cp15.scr_el3 & SCR_FW)) { 10582 qemu_log_mask(LOG_GUEST_ERROR, 10583 "Ignoring attempt to switch CPSR_F flag from " 10584 "non-secure world with SCR.FW bit clear\n"); 10585 mask &= ~CPSR_F; 10586 } 10587 10588 /* 10589 * Check whether non-maskable FIQ (NMFI) support is enabled. 10590 * If this bit is set software is not allowed to mask 10591 * FIQs, but is allowed to set CPSR_F to 0. 10592 */ 10593 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 10594 (val & CPSR_F)) { 10595 qemu_log_mask(LOG_GUEST_ERROR, 10596 "Ignoring attempt to enable CPSR_F flag " 10597 "(non-maskable FIQ [NMFI] support enabled)\n"); 10598 mask &= ~CPSR_F; 10599 } 10600 } 10601 } 10602 10603 env->daif &= ~(CPSR_AIF & mask); 10604 env->daif |= val & CPSR_AIF & mask; 10605 10606 if (write_type != CPSRWriteRaw && 10607 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 10608 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 10609 /* 10610 * Note that we can only get here in USR mode if this is a 10611 * gdb stub write; for this case we follow the architectural 10612 * behaviour for guest writes in USR mode of ignoring an attempt 10613 * to switch mode. (Those are caught by translate.c for writes 10614 * triggered by guest instructions.) 10615 */ 10616 mask &= ~CPSR_M; 10617 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 10618 /* 10619 * Attempt to switch to an invalid mode: this is UNPREDICTABLE in 10620 * v7, and has defined behaviour in v8: 10621 * + leave CPSR.M untouched 10622 * + allow changes to the other CPSR fields 10623 * + set PSTATE.IL 10624 * For user changes via the GDB stub, we don't set PSTATE.IL, 10625 * as this would be unnecessarily harsh for a user error. 10626 */ 10627 mask &= ~CPSR_M; 10628 if (write_type != CPSRWriteByGDBStub && 10629 arm_feature(env, ARM_FEATURE_V8)) { 10630 mask |= CPSR_IL; 10631 val |= CPSR_IL; 10632 } 10633 qemu_log_mask(LOG_GUEST_ERROR, 10634 "Illegal AArch32 mode switch attempt from %s to %s\n", 10635 aarch32_mode_name(env->uncached_cpsr), 10636 aarch32_mode_name(val)); 10637 } else { 10638 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 10639 write_type == CPSRWriteExceptionReturn ? 10640 "Exception return from AArch32" : 10641 "AArch32 mode switch from", 10642 aarch32_mode_name(env->uncached_cpsr), 10643 aarch32_mode_name(val), env->regs[15]); 10644 switch_mode(env, val & CPSR_M); 10645 } 10646 } 10647 mask &= ~CACHED_CPSR_BITS; 10648 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 10649 if (tcg_enabled() && rebuild_hflags) { 10650 arm_rebuild_hflags(env); 10651 } 10652 } 10653 10654 #ifdef CONFIG_USER_ONLY 10655 10656 static void switch_mode(CPUARMState *env, int mode) 10657 { 10658 ARMCPU *cpu = env_archcpu(env); 10659 10660 if (mode != ARM_CPU_MODE_USR) { 10661 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 10662 } 10663 } 10664 10665 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 10666 uint32_t cur_el, bool secure) 10667 { 10668 return 1; 10669 } 10670 10671 void aarch64_sync_64_to_32(CPUARMState *env) 10672 { 10673 g_assert_not_reached(); 10674 } 10675 10676 #else 10677 10678 static void switch_mode(CPUARMState *env, int mode) 10679 { 10680 int old_mode; 10681 int i; 10682 10683 old_mode = env->uncached_cpsr & CPSR_M; 10684 if (mode == old_mode) { 10685 return; 10686 } 10687 10688 if (old_mode == ARM_CPU_MODE_FIQ) { 10689 memcpy(env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 10690 memcpy(env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 10691 } else if (mode == ARM_CPU_MODE_FIQ) { 10692 memcpy(env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 10693 memcpy(env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 10694 } 10695 10696 i = bank_number(old_mode); 10697 env->banked_r13[i] = env->regs[13]; 10698 env->banked_spsr[i] = env->spsr; 10699 10700 i = bank_number(mode); 10701 env->regs[13] = env->banked_r13[i]; 10702 env->spsr = env->banked_spsr[i]; 10703 10704 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 10705 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 10706 } 10707 10708 /* 10709 * Physical Interrupt Target EL Lookup Table 10710 * 10711 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 10712 * 10713 * The below multi-dimensional table is used for looking up the target 10714 * exception level given numerous condition criteria. Specifically, the 10715 * target EL is based on SCR and HCR routing controls as well as the 10716 * currently executing EL and secure state. 10717 * 10718 * Dimensions: 10719 * target_el_table[2][2][2][2][2][4] 10720 * | | | | | +--- Current EL 10721 * | | | | +------ Non-secure(0)/Secure(1) 10722 * | | | +--------- HCR mask override 10723 * | | +------------ SCR exec state control 10724 * | +--------------- SCR mask override 10725 * +------------------ 32-bit(0)/64-bit(1) EL3 10726 * 10727 * The table values are as such: 10728 * 0-3 = EL0-EL3 10729 * -1 = Cannot occur 10730 * 10731 * The ARM ARM target EL table includes entries indicating that an "exception 10732 * is not taken". The two cases where this is applicable are: 10733 * 1) An exception is taken from EL3 but the SCR does not have the exception 10734 * routed to EL3. 10735 * 2) An exception is taken from EL2 but the HCR does not have the exception 10736 * routed to EL2. 10737 * In these two cases, the below table contain a target of EL1. This value is 10738 * returned as it is expected that the consumer of the table data will check 10739 * for "target EL >= current EL" to ensure the exception is not taken. 10740 * 10741 * SCR HCR 10742 * 64 EA AMO From 10743 * BIT IRQ IMO Non-secure Secure 10744 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 10745 */ 10746 static const int8_t target_el_table[2][2][2][2][2][4] = { 10747 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 10748 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 10749 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 10750 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 10751 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 10752 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 10753 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 10754 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 10755 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 10756 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 2, 2, -1, 1 },},}, 10757 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, 1, 1 },}, 10758 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 2, 2, 2, 1 },},},}, 10759 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 10760 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 10761 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, 3, 3 },}, 10762 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, 3, 3 },},},},}, 10763 }; 10764 10765 /* 10766 * Determine the target EL for physical exceptions 10767 */ 10768 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 10769 uint32_t cur_el, bool secure) 10770 { 10771 CPUARMState *env = cpu_env(cs); 10772 bool rw; 10773 bool scr; 10774 bool hcr; 10775 int target_el; 10776 /* Is the highest EL AArch64? */ 10777 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 10778 uint64_t hcr_el2; 10779 10780 if (arm_feature(env, ARM_FEATURE_EL3)) { 10781 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 10782 } else { 10783 /* 10784 * Either EL2 is the highest EL (and so the EL2 register width 10785 * is given by is64); or there is no EL2 or EL3, in which case 10786 * the value of 'rw' does not affect the table lookup anyway. 10787 */ 10788 rw = is64; 10789 } 10790 10791 hcr_el2 = arm_hcr_el2_eff(env); 10792 switch (excp_idx) { 10793 case EXCP_IRQ: 10794 case EXCP_NMI: 10795 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 10796 hcr = hcr_el2 & HCR_IMO; 10797 break; 10798 case EXCP_FIQ: 10799 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 10800 hcr = hcr_el2 & HCR_FMO; 10801 break; 10802 default: 10803 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 10804 hcr = hcr_el2 & HCR_AMO; 10805 break; 10806 }; 10807 10808 /* 10809 * For these purposes, TGE and AMO/IMO/FMO both force the 10810 * interrupt to EL2. Fold TGE into the bit extracted above. 10811 */ 10812 hcr |= (hcr_el2 & HCR_TGE) != 0; 10813 10814 /* Perform a table-lookup for the target EL given the current state */ 10815 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 10816 10817 assert(target_el > 0); 10818 10819 return target_el; 10820 } 10821 10822 void arm_log_exception(CPUState *cs) 10823 { 10824 int idx = cs->exception_index; 10825 10826 if (qemu_loglevel_mask(CPU_LOG_INT)) { 10827 const char *exc = NULL; 10828 static const char * const excnames[] = { 10829 [EXCP_UDEF] = "Undefined Instruction", 10830 [EXCP_SWI] = "SVC", 10831 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 10832 [EXCP_DATA_ABORT] = "Data Abort", 10833 [EXCP_IRQ] = "IRQ", 10834 [EXCP_FIQ] = "FIQ", 10835 [EXCP_BKPT] = "Breakpoint", 10836 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 10837 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 10838 [EXCP_HVC] = "Hypervisor Call", 10839 [EXCP_HYP_TRAP] = "Hypervisor Trap", 10840 [EXCP_SMC] = "Secure Monitor Call", 10841 [EXCP_VIRQ] = "Virtual IRQ", 10842 [EXCP_VFIQ] = "Virtual FIQ", 10843 [EXCP_SEMIHOST] = "Semihosting call", 10844 [EXCP_NOCP] = "v7M NOCP UsageFault", 10845 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 10846 [EXCP_STKOF] = "v8M STKOF UsageFault", 10847 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking", 10848 [EXCP_LSERR] = "v8M LSERR UsageFault", 10849 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault", 10850 [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault", 10851 [EXCP_VSERR] = "Virtual SERR", 10852 [EXCP_GPC] = "Granule Protection Check", 10853 [EXCP_NMI] = "NMI", 10854 [EXCP_VINMI] = "Virtual IRQ NMI", 10855 [EXCP_VFNMI] = "Virtual FIQ NMI", 10856 }; 10857 10858 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 10859 exc = excnames[idx]; 10860 } 10861 if (!exc) { 10862 exc = "unknown"; 10863 } 10864 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s] on CPU %d\n", 10865 idx, exc, cs->cpu_index); 10866 } 10867 } 10868 10869 /* 10870 * Function used to synchronize QEMU's AArch64 register set with AArch32 10871 * register set. This is necessary when switching between AArch32 and AArch64 10872 * execution state. 10873 */ 10874 void aarch64_sync_32_to_64(CPUARMState *env) 10875 { 10876 int i; 10877 uint32_t mode = env->uncached_cpsr & CPSR_M; 10878 10879 /* We can blanket copy R[0:7] to X[0:7] */ 10880 for (i = 0; i < 8; i++) { 10881 env->xregs[i] = env->regs[i]; 10882 } 10883 10884 /* 10885 * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 10886 * Otherwise, they come from the banked user regs. 10887 */ 10888 if (mode == ARM_CPU_MODE_FIQ) { 10889 for (i = 8; i < 13; i++) { 10890 env->xregs[i] = env->usr_regs[i - 8]; 10891 } 10892 } else { 10893 for (i = 8; i < 13; i++) { 10894 env->xregs[i] = env->regs[i]; 10895 } 10896 } 10897 10898 /* 10899 * Registers x13-x23 are the various mode SP and FP registers. Registers 10900 * r13 and r14 are only copied if we are in that mode, otherwise we copy 10901 * from the mode banked register. 10902 */ 10903 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 10904 env->xregs[13] = env->regs[13]; 10905 env->xregs[14] = env->regs[14]; 10906 } else { 10907 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 10908 /* HYP is an exception in that it is copied from r14 */ 10909 if (mode == ARM_CPU_MODE_HYP) { 10910 env->xregs[14] = env->regs[14]; 10911 } else { 10912 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 10913 } 10914 } 10915 10916 if (mode == ARM_CPU_MODE_HYP) { 10917 env->xregs[15] = env->regs[13]; 10918 } else { 10919 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 10920 } 10921 10922 if (mode == ARM_CPU_MODE_IRQ) { 10923 env->xregs[16] = env->regs[14]; 10924 env->xregs[17] = env->regs[13]; 10925 } else { 10926 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 10927 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 10928 } 10929 10930 if (mode == ARM_CPU_MODE_SVC) { 10931 env->xregs[18] = env->regs[14]; 10932 env->xregs[19] = env->regs[13]; 10933 } else { 10934 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 10935 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 10936 } 10937 10938 if (mode == ARM_CPU_MODE_ABT) { 10939 env->xregs[20] = env->regs[14]; 10940 env->xregs[21] = env->regs[13]; 10941 } else { 10942 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 10943 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 10944 } 10945 10946 if (mode == ARM_CPU_MODE_UND) { 10947 env->xregs[22] = env->regs[14]; 10948 env->xregs[23] = env->regs[13]; 10949 } else { 10950 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 10951 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 10952 } 10953 10954 /* 10955 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 10956 * mode, then we can copy from r8-r14. Otherwise, we copy from the 10957 * FIQ bank for r8-r14. 10958 */ 10959 if (mode == ARM_CPU_MODE_FIQ) { 10960 for (i = 24; i < 31; i++) { 10961 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 10962 } 10963 } else { 10964 for (i = 24; i < 29; i++) { 10965 env->xregs[i] = env->fiq_regs[i - 24]; 10966 } 10967 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 10968 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 10969 } 10970 10971 env->pc = env->regs[15]; 10972 } 10973 10974 /* 10975 * Function used to synchronize QEMU's AArch32 register set with AArch64 10976 * register set. This is necessary when switching between AArch32 and AArch64 10977 * execution state. 10978 */ 10979 void aarch64_sync_64_to_32(CPUARMState *env) 10980 { 10981 int i; 10982 uint32_t mode = env->uncached_cpsr & CPSR_M; 10983 10984 /* We can blanket copy X[0:7] to R[0:7] */ 10985 for (i = 0; i < 8; i++) { 10986 env->regs[i] = env->xregs[i]; 10987 } 10988 10989 /* 10990 * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 10991 * Otherwise, we copy x8-x12 into the banked user regs. 10992 */ 10993 if (mode == ARM_CPU_MODE_FIQ) { 10994 for (i = 8; i < 13; i++) { 10995 env->usr_regs[i - 8] = env->xregs[i]; 10996 } 10997 } else { 10998 for (i = 8; i < 13; i++) { 10999 env->regs[i] = env->xregs[i]; 11000 } 11001 } 11002 11003 /* 11004 * Registers r13 & r14 depend on the current mode. 11005 * If we are in a given mode, we copy the corresponding x registers to r13 11006 * and r14. Otherwise, we copy the x register to the banked r13 and r14 11007 * for the mode. 11008 */ 11009 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 11010 env->regs[13] = env->xregs[13]; 11011 env->regs[14] = env->xregs[14]; 11012 } else { 11013 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 11014 11015 /* 11016 * HYP is an exception in that it does not have its own banked r14 but 11017 * shares the USR r14 11018 */ 11019 if (mode == ARM_CPU_MODE_HYP) { 11020 env->regs[14] = env->xregs[14]; 11021 } else { 11022 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 11023 } 11024 } 11025 11026 if (mode == ARM_CPU_MODE_HYP) { 11027 env->regs[13] = env->xregs[15]; 11028 } else { 11029 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 11030 } 11031 11032 if (mode == ARM_CPU_MODE_IRQ) { 11033 env->regs[14] = env->xregs[16]; 11034 env->regs[13] = env->xregs[17]; 11035 } else { 11036 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 11037 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 11038 } 11039 11040 if (mode == ARM_CPU_MODE_SVC) { 11041 env->regs[14] = env->xregs[18]; 11042 env->regs[13] = env->xregs[19]; 11043 } else { 11044 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 11045 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 11046 } 11047 11048 if (mode == ARM_CPU_MODE_ABT) { 11049 env->regs[14] = env->xregs[20]; 11050 env->regs[13] = env->xregs[21]; 11051 } else { 11052 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 11053 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 11054 } 11055 11056 if (mode == ARM_CPU_MODE_UND) { 11057 env->regs[14] = env->xregs[22]; 11058 env->regs[13] = env->xregs[23]; 11059 } else { 11060 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 11061 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 11062 } 11063 11064 /* 11065 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 11066 * mode, then we can copy to r8-r14. Otherwise, we copy to the 11067 * FIQ bank for r8-r14. 11068 */ 11069 if (mode == ARM_CPU_MODE_FIQ) { 11070 for (i = 24; i < 31; i++) { 11071 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 11072 } 11073 } else { 11074 for (i = 24; i < 29; i++) { 11075 env->fiq_regs[i - 24] = env->xregs[i]; 11076 } 11077 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 11078 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 11079 } 11080 11081 env->regs[15] = env->pc; 11082 } 11083 11084 static void take_aarch32_exception(CPUARMState *env, int new_mode, 11085 uint32_t mask, uint32_t offset, 11086 uint32_t newpc) 11087 { 11088 int new_el; 11089 11090 /* Change the CPU state so as to actually take the exception. */ 11091 switch_mode(env, new_mode); 11092 11093 /* 11094 * For exceptions taken to AArch32 we must clear the SS bit in both 11095 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 11096 */ 11097 env->pstate &= ~PSTATE_SS; 11098 env->spsr = cpsr_read(env); 11099 /* Clear IT bits. */ 11100 env->condexec_bits = 0; 11101 /* Switch to the new mode, and to the correct instruction set. */ 11102 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 11103 11104 /* This must be after mode switching. */ 11105 new_el = arm_current_el(env); 11106 11107 /* Set new mode endianness */ 11108 env->uncached_cpsr &= ~CPSR_E; 11109 if (env->cp15.sctlr_el[new_el] & SCTLR_EE) { 11110 env->uncached_cpsr |= CPSR_E; 11111 } 11112 /* J and IL must always be cleared for exception entry */ 11113 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 11114 env->daif |= mask; 11115 11116 if (cpu_isar_feature(aa32_ssbs, env_archcpu(env))) { 11117 if (env->cp15.sctlr_el[new_el] & SCTLR_DSSBS_32) { 11118 env->uncached_cpsr |= CPSR_SSBS; 11119 } else { 11120 env->uncached_cpsr &= ~CPSR_SSBS; 11121 } 11122 } 11123 11124 if (new_mode == ARM_CPU_MODE_HYP) { 11125 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 11126 env->elr_el[2] = env->regs[15]; 11127 } else { 11128 /* CPSR.PAN is normally preserved preserved unless... */ 11129 if (cpu_isar_feature(aa32_pan, env_archcpu(env))) { 11130 switch (new_el) { 11131 case 3: 11132 if (!arm_is_secure_below_el3(env)) { 11133 /* ... the target is EL3, from non-secure state. */ 11134 env->uncached_cpsr &= ~CPSR_PAN; 11135 break; 11136 } 11137 /* ... the target is EL3, from secure state ... */ 11138 /* fall through */ 11139 case 1: 11140 /* ... the target is EL1 and SCTLR.SPAN is 0. */ 11141 if (!(env->cp15.sctlr_el[new_el] & SCTLR_SPAN)) { 11142 env->uncached_cpsr |= CPSR_PAN; 11143 } 11144 break; 11145 } 11146 } 11147 /* 11148 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 11149 * and we should just guard the thumb mode on V4 11150 */ 11151 if (arm_feature(env, ARM_FEATURE_V4T)) { 11152 env->thumb = 11153 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 11154 } 11155 env->regs[14] = env->regs[15] + offset; 11156 } 11157 env->regs[15] = newpc; 11158 11159 if (tcg_enabled()) { 11160 arm_rebuild_hflags(env); 11161 } 11162 } 11163 11164 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 11165 { 11166 /* 11167 * Handle exception entry to Hyp mode; this is sufficiently 11168 * different to entry to other AArch32 modes that we handle it 11169 * separately here. 11170 * 11171 * The vector table entry used is always the 0x14 Hyp mode entry point, 11172 * unless this is an UNDEF/SVC/HVC/abort taken from Hyp to Hyp. 11173 * The offset applied to the preferred return address is always zero 11174 * (see DDI0487C.a section G1.12.3). 11175 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 11176 */ 11177 uint32_t addr, mask; 11178 ARMCPU *cpu = ARM_CPU(cs); 11179 CPUARMState *env = &cpu->env; 11180 11181 switch (cs->exception_index) { 11182 case EXCP_UDEF: 11183 addr = 0x04; 11184 break; 11185 case EXCP_SWI: 11186 addr = 0x08; 11187 break; 11188 case EXCP_BKPT: 11189 /* Fall through to prefetch abort. */ 11190 case EXCP_PREFETCH_ABORT: 11191 env->cp15.ifar_s = env->exception.vaddress; 11192 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 11193 (uint32_t)env->exception.vaddress); 11194 addr = 0x0c; 11195 break; 11196 case EXCP_DATA_ABORT: 11197 env->cp15.dfar_s = env->exception.vaddress; 11198 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 11199 (uint32_t)env->exception.vaddress); 11200 addr = 0x10; 11201 break; 11202 case EXCP_IRQ: 11203 addr = 0x18; 11204 break; 11205 case EXCP_FIQ: 11206 addr = 0x1c; 11207 break; 11208 case EXCP_HVC: 11209 addr = 0x08; 11210 break; 11211 case EXCP_HYP_TRAP: 11212 addr = 0x14; 11213 break; 11214 default: 11215 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 11216 } 11217 11218 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 11219 if (!arm_feature(env, ARM_FEATURE_V8)) { 11220 /* 11221 * QEMU syndrome values are v8-style. v7 has the IL bit 11222 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 11223 * If this is a v7 CPU, squash the IL bit in those cases. 11224 */ 11225 if (cs->exception_index == EXCP_PREFETCH_ABORT || 11226 (cs->exception_index == EXCP_DATA_ABORT && 11227 !(env->exception.syndrome & ARM_EL_ISV)) || 11228 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 11229 env->exception.syndrome &= ~ARM_EL_IL; 11230 } 11231 } 11232 env->cp15.esr_el[2] = env->exception.syndrome; 11233 } 11234 11235 if (arm_current_el(env) != 2 && addr < 0x14) { 11236 addr = 0x14; 11237 } 11238 11239 mask = 0; 11240 if (!(env->cp15.scr_el3 & SCR_EA)) { 11241 mask |= CPSR_A; 11242 } 11243 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 11244 mask |= CPSR_I; 11245 } 11246 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 11247 mask |= CPSR_F; 11248 } 11249 11250 addr += env->cp15.hvbar; 11251 11252 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 11253 } 11254 11255 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 11256 { 11257 ARMCPU *cpu = ARM_CPU(cs); 11258 CPUARMState *env = &cpu->env; 11259 uint32_t addr; 11260 uint32_t mask; 11261 int new_mode; 11262 uint32_t offset; 11263 uint32_t moe; 11264 11265 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 11266 switch (syn_get_ec(env->exception.syndrome)) { 11267 case EC_BREAKPOINT: 11268 case EC_BREAKPOINT_SAME_EL: 11269 moe = 1; 11270 break; 11271 case EC_WATCHPOINT: 11272 case EC_WATCHPOINT_SAME_EL: 11273 moe = 10; 11274 break; 11275 case EC_AA32_BKPT: 11276 moe = 3; 11277 break; 11278 case EC_VECTORCATCH: 11279 moe = 5; 11280 break; 11281 default: 11282 moe = 0; 11283 break; 11284 } 11285 11286 if (moe) { 11287 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 11288 } 11289 11290 if (env->exception.target_el == 2) { 11291 /* Debug exceptions are reported differently on AArch32 */ 11292 switch (syn_get_ec(env->exception.syndrome)) { 11293 case EC_BREAKPOINT: 11294 case EC_BREAKPOINT_SAME_EL: 11295 case EC_AA32_BKPT: 11296 case EC_VECTORCATCH: 11297 env->exception.syndrome = syn_insn_abort(arm_current_el(env) == 2, 11298 0, 0, 0x22); 11299 break; 11300 case EC_WATCHPOINT: 11301 env->exception.syndrome = syn_set_ec(env->exception.syndrome, 11302 EC_DATAABORT); 11303 break; 11304 case EC_WATCHPOINT_SAME_EL: 11305 env->exception.syndrome = syn_set_ec(env->exception.syndrome, 11306 EC_DATAABORT_SAME_EL); 11307 break; 11308 } 11309 arm_cpu_do_interrupt_aarch32_hyp(cs); 11310 return; 11311 } 11312 11313 switch (cs->exception_index) { 11314 case EXCP_UDEF: 11315 new_mode = ARM_CPU_MODE_UND; 11316 addr = 0x04; 11317 mask = CPSR_I; 11318 if (env->thumb) { 11319 offset = 2; 11320 } else { 11321 offset = 4; 11322 } 11323 break; 11324 case EXCP_SWI: 11325 new_mode = ARM_CPU_MODE_SVC; 11326 addr = 0x08; 11327 mask = CPSR_I; 11328 /* The PC already points to the next instruction. */ 11329 offset = 0; 11330 break; 11331 case EXCP_BKPT: 11332 /* Fall through to prefetch abort. */ 11333 case EXCP_PREFETCH_ABORT: 11334 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 11335 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 11336 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 11337 env->exception.fsr, (uint32_t)env->exception.vaddress); 11338 new_mode = ARM_CPU_MODE_ABT; 11339 addr = 0x0c; 11340 mask = CPSR_A | CPSR_I; 11341 offset = 4; 11342 break; 11343 case EXCP_DATA_ABORT: 11344 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 11345 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 11346 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 11347 env->exception.fsr, 11348 (uint32_t)env->exception.vaddress); 11349 new_mode = ARM_CPU_MODE_ABT; 11350 addr = 0x10; 11351 mask = CPSR_A | CPSR_I; 11352 offset = 8; 11353 break; 11354 case EXCP_IRQ: 11355 new_mode = ARM_CPU_MODE_IRQ; 11356 addr = 0x18; 11357 /* Disable IRQ and imprecise data aborts. */ 11358 mask = CPSR_A | CPSR_I; 11359 offset = 4; 11360 if (env->cp15.scr_el3 & SCR_IRQ) { 11361 /* IRQ routed to monitor mode */ 11362 new_mode = ARM_CPU_MODE_MON; 11363 mask |= CPSR_F; 11364 } 11365 break; 11366 case EXCP_FIQ: 11367 new_mode = ARM_CPU_MODE_FIQ; 11368 addr = 0x1c; 11369 /* Disable FIQ, IRQ and imprecise data aborts. */ 11370 mask = CPSR_A | CPSR_I | CPSR_F; 11371 if (env->cp15.scr_el3 & SCR_FIQ) { 11372 /* FIQ routed to monitor mode */ 11373 new_mode = ARM_CPU_MODE_MON; 11374 } 11375 offset = 4; 11376 break; 11377 case EXCP_VIRQ: 11378 new_mode = ARM_CPU_MODE_IRQ; 11379 addr = 0x18; 11380 /* Disable IRQ and imprecise data aborts. */ 11381 mask = CPSR_A | CPSR_I; 11382 offset = 4; 11383 break; 11384 case EXCP_VFIQ: 11385 new_mode = ARM_CPU_MODE_FIQ; 11386 addr = 0x1c; 11387 /* Disable FIQ, IRQ and imprecise data aborts. */ 11388 mask = CPSR_A | CPSR_I | CPSR_F; 11389 offset = 4; 11390 break; 11391 case EXCP_VSERR: 11392 { 11393 /* 11394 * Note that this is reported as a data abort, but the DFAR 11395 * has an UNKNOWN value. Construct the SError syndrome from 11396 * AET and ExT fields. 11397 */ 11398 ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal, }; 11399 11400 if (extended_addresses_enabled(env)) { 11401 env->exception.fsr = arm_fi_to_lfsc(&fi); 11402 } else { 11403 env->exception.fsr = arm_fi_to_sfsc(&fi); 11404 } 11405 env->exception.fsr |= env->cp15.vsesr_el2 & 0xd000; 11406 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 11407 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x\n", 11408 env->exception.fsr); 11409 11410 new_mode = ARM_CPU_MODE_ABT; 11411 addr = 0x10; 11412 mask = CPSR_A | CPSR_I; 11413 offset = 8; 11414 } 11415 break; 11416 case EXCP_SMC: 11417 new_mode = ARM_CPU_MODE_MON; 11418 addr = 0x08; 11419 mask = CPSR_A | CPSR_I | CPSR_F; 11420 offset = 0; 11421 break; 11422 default: 11423 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 11424 return; /* Never happens. Keep compiler happy. */ 11425 } 11426 11427 if (new_mode == ARM_CPU_MODE_MON) { 11428 addr += env->cp15.mvbar; 11429 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 11430 /* High vectors. When enabled, base address cannot be remapped. */ 11431 addr += 0xffff0000; 11432 } else { 11433 /* 11434 * ARM v7 architectures provide a vector base address register to remap 11435 * the interrupt vector table. 11436 * This register is only followed in non-monitor mode, and is banked. 11437 * Note: only bits 31:5 are valid. 11438 */ 11439 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 11440 } 11441 11442 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 11443 env->cp15.scr_el3 &= ~SCR_NS; 11444 } 11445 11446 take_aarch32_exception(env, new_mode, mask, offset, addr); 11447 } 11448 11449 static int aarch64_regnum(CPUARMState *env, int aarch32_reg) 11450 { 11451 /* 11452 * Return the register number of the AArch64 view of the AArch32 11453 * register @aarch32_reg. The CPUARMState CPSR is assumed to still 11454 * be that of the AArch32 mode the exception came from. 11455 */ 11456 int mode = env->uncached_cpsr & CPSR_M; 11457 11458 switch (aarch32_reg) { 11459 case 0 ... 7: 11460 return aarch32_reg; 11461 case 8 ... 12: 11462 return mode == ARM_CPU_MODE_FIQ ? aarch32_reg + 16 : aarch32_reg; 11463 case 13: 11464 switch (mode) { 11465 case ARM_CPU_MODE_USR: 11466 case ARM_CPU_MODE_SYS: 11467 return 13; 11468 case ARM_CPU_MODE_HYP: 11469 return 15; 11470 case ARM_CPU_MODE_IRQ: 11471 return 17; 11472 case ARM_CPU_MODE_SVC: 11473 return 19; 11474 case ARM_CPU_MODE_ABT: 11475 return 21; 11476 case ARM_CPU_MODE_UND: 11477 return 23; 11478 case ARM_CPU_MODE_FIQ: 11479 return 29; 11480 default: 11481 g_assert_not_reached(); 11482 } 11483 case 14: 11484 switch (mode) { 11485 case ARM_CPU_MODE_USR: 11486 case ARM_CPU_MODE_SYS: 11487 case ARM_CPU_MODE_HYP: 11488 return 14; 11489 case ARM_CPU_MODE_IRQ: 11490 return 16; 11491 case ARM_CPU_MODE_SVC: 11492 return 18; 11493 case ARM_CPU_MODE_ABT: 11494 return 20; 11495 case ARM_CPU_MODE_UND: 11496 return 22; 11497 case ARM_CPU_MODE_FIQ: 11498 return 30; 11499 default: 11500 g_assert_not_reached(); 11501 } 11502 case 15: 11503 return 31; 11504 default: 11505 g_assert_not_reached(); 11506 } 11507 } 11508 11509 static uint32_t cpsr_read_for_spsr_elx(CPUARMState *env) 11510 { 11511 uint32_t ret = cpsr_read(env); 11512 11513 /* Move DIT to the correct location for SPSR_ELx */ 11514 if (ret & CPSR_DIT) { 11515 ret &= ~CPSR_DIT; 11516 ret |= PSTATE_DIT; 11517 } 11518 /* Merge PSTATE.SS into SPSR_ELx */ 11519 ret |= env->pstate & PSTATE_SS; 11520 11521 return ret; 11522 } 11523 11524 static bool syndrome_is_sync_extabt(uint32_t syndrome) 11525 { 11526 /* Return true if this syndrome value is a synchronous external abort */ 11527 switch (syn_get_ec(syndrome)) { 11528 case EC_INSNABORT: 11529 case EC_INSNABORT_SAME_EL: 11530 case EC_DATAABORT: 11531 case EC_DATAABORT_SAME_EL: 11532 /* Look at fault status code for all the synchronous ext abort cases */ 11533 switch (syndrome & 0x3f) { 11534 case 0x10: 11535 case 0x13: 11536 case 0x14: 11537 case 0x15: 11538 case 0x16: 11539 case 0x17: 11540 return true; 11541 default: 11542 return false; 11543 } 11544 default: 11545 return false; 11546 } 11547 } 11548 11549 /* Handle exception entry to a target EL which is using AArch64 */ 11550 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 11551 { 11552 ARMCPU *cpu = ARM_CPU(cs); 11553 CPUARMState *env = &cpu->env; 11554 unsigned int new_el = env->exception.target_el; 11555 target_ulong addr = env->cp15.vbar_el[new_el]; 11556 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 11557 unsigned int old_mode; 11558 unsigned int cur_el = arm_current_el(env); 11559 int rt; 11560 11561 if (tcg_enabled()) { 11562 /* 11563 * Note that new_el can never be 0. If cur_el is 0, then 11564 * el0_a64 is is_a64(), else el0_a64 is ignored. 11565 */ 11566 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 11567 } 11568 11569 if (cur_el < new_el) { 11570 /* 11571 * Entry vector offset depends on whether the implemented EL 11572 * immediately lower than the target level is using AArch32 or AArch64 11573 */ 11574 bool is_aa64; 11575 uint64_t hcr; 11576 11577 switch (new_el) { 11578 case 3: 11579 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 11580 break; 11581 case 2: 11582 hcr = arm_hcr_el2_eff(env); 11583 if ((hcr & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 11584 is_aa64 = (hcr & HCR_RW) != 0; 11585 break; 11586 } 11587 /* fall through */ 11588 case 1: 11589 is_aa64 = is_a64(env); 11590 break; 11591 default: 11592 g_assert_not_reached(); 11593 } 11594 11595 if (is_aa64) { 11596 addr += 0x400; 11597 } else { 11598 addr += 0x600; 11599 } 11600 } else if (pstate_read(env) & PSTATE_SP) { 11601 addr += 0x200; 11602 } 11603 11604 switch (cs->exception_index) { 11605 case EXCP_GPC: 11606 qemu_log_mask(CPU_LOG_INT, "...with MFAR 0x%" PRIx64 "\n", 11607 env->cp15.mfar_el3); 11608 /* fall through */ 11609 case EXCP_PREFETCH_ABORT: 11610 case EXCP_DATA_ABORT: 11611 /* 11612 * FEAT_DoubleFault allows synchronous external aborts taken to EL3 11613 * to be taken to the SError vector entrypoint. 11614 */ 11615 if (new_el == 3 && (env->cp15.scr_el3 & SCR_EASE) && 11616 syndrome_is_sync_extabt(env->exception.syndrome)) { 11617 addr += 0x180; 11618 } 11619 env->cp15.far_el[new_el] = env->exception.vaddress; 11620 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 11621 env->cp15.far_el[new_el]); 11622 /* fall through */ 11623 case EXCP_BKPT: 11624 case EXCP_UDEF: 11625 case EXCP_SWI: 11626 case EXCP_HVC: 11627 case EXCP_HYP_TRAP: 11628 case EXCP_SMC: 11629 switch (syn_get_ec(env->exception.syndrome)) { 11630 case EC_ADVSIMDFPACCESSTRAP: 11631 /* 11632 * QEMU internal FP/SIMD syndromes from AArch32 include the 11633 * TA and coproc fields which are only exposed if the exception 11634 * is taken to AArch32 Hyp mode. Mask them out to get a valid 11635 * AArch64 format syndrome. 11636 */ 11637 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 11638 break; 11639 case EC_CP14RTTRAP: 11640 case EC_CP15RTTRAP: 11641 case EC_CP14DTTRAP: 11642 /* 11643 * For a trap on AArch32 MRC/MCR/LDC/STC the Rt field is currently 11644 * the raw register field from the insn; when taking this to 11645 * AArch64 we must convert it to the AArch64 view of the register 11646 * number. Notice that we read a 4-bit AArch32 register number and 11647 * write back a 5-bit AArch64 one. 11648 */ 11649 rt = extract32(env->exception.syndrome, 5, 4); 11650 rt = aarch64_regnum(env, rt); 11651 env->exception.syndrome = deposit32(env->exception.syndrome, 11652 5, 5, rt); 11653 break; 11654 case EC_CP15RRTTRAP: 11655 case EC_CP14RRTTRAP: 11656 /* Similarly for MRRC/MCRR traps for Rt and Rt2 fields */ 11657 rt = extract32(env->exception.syndrome, 5, 4); 11658 rt = aarch64_regnum(env, rt); 11659 env->exception.syndrome = deposit32(env->exception.syndrome, 11660 5, 5, rt); 11661 rt = extract32(env->exception.syndrome, 10, 4); 11662 rt = aarch64_regnum(env, rt); 11663 env->exception.syndrome = deposit32(env->exception.syndrome, 11664 10, 5, rt); 11665 break; 11666 } 11667 env->cp15.esr_el[new_el] = env->exception.syndrome; 11668 break; 11669 case EXCP_IRQ: 11670 case EXCP_VIRQ: 11671 case EXCP_NMI: 11672 case EXCP_VINMI: 11673 addr += 0x80; 11674 break; 11675 case EXCP_FIQ: 11676 case EXCP_VFIQ: 11677 case EXCP_VFNMI: 11678 addr += 0x100; 11679 break; 11680 case EXCP_VSERR: 11681 addr += 0x180; 11682 /* Construct the SError syndrome from IDS and ISS fields. */ 11683 env->exception.syndrome = syn_serror(env->cp15.vsesr_el2 & 0x1ffffff); 11684 env->cp15.esr_el[new_el] = env->exception.syndrome; 11685 break; 11686 default: 11687 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 11688 } 11689 11690 if (is_a64(env)) { 11691 old_mode = pstate_read(env); 11692 aarch64_save_sp(env, arm_current_el(env)); 11693 env->elr_el[new_el] = env->pc; 11694 11695 if (cur_el == 1 && new_el == 1) { 11696 uint64_t hcr = arm_hcr_el2_eff(env); 11697 if ((hcr & (HCR_NV | HCR_NV1 | HCR_NV2)) == HCR_NV || 11698 (hcr & (HCR_NV | HCR_NV2)) == (HCR_NV | HCR_NV2)) { 11699 /* 11700 * FEAT_NV, FEAT_NV2 may need to report EL2 in the SPSR 11701 * by setting M[3:2] to 0b10. 11702 * If NV2 is disabled, change SPSR when NV,NV1 == 1,0 (I_ZJRNN) 11703 * If NV2 is enabled, change SPSR when NV is 1 (I_DBTLM) 11704 */ 11705 old_mode = deposit32(old_mode, 2, 2, 2); 11706 } 11707 } 11708 } else { 11709 old_mode = cpsr_read_for_spsr_elx(env); 11710 env->elr_el[new_el] = env->regs[15]; 11711 11712 aarch64_sync_32_to_64(env); 11713 11714 env->condexec_bits = 0; 11715 } 11716 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = old_mode; 11717 11718 qemu_log_mask(CPU_LOG_INT, "...with SPSR 0x%x\n", old_mode); 11719 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 11720 env->elr_el[new_el]); 11721 11722 if (cpu_isar_feature(aa64_pan, cpu)) { 11723 /* The value of PSTATE.PAN is normally preserved, except when ... */ 11724 new_mode |= old_mode & PSTATE_PAN; 11725 switch (new_el) { 11726 case 2: 11727 /* ... the target is EL2 with HCR_EL2.{E2H,TGE} == '11' ... */ 11728 if ((arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) 11729 != (HCR_E2H | HCR_TGE)) { 11730 break; 11731 } 11732 /* fall through */ 11733 case 1: 11734 /* ... the target is EL1 ... */ 11735 /* ... and SCTLR_ELx.SPAN == 0, then set to 1. */ 11736 if ((env->cp15.sctlr_el[new_el] & SCTLR_SPAN) == 0) { 11737 new_mode |= PSTATE_PAN; 11738 } 11739 break; 11740 } 11741 } 11742 if (cpu_isar_feature(aa64_mte, cpu)) { 11743 new_mode |= PSTATE_TCO; 11744 } 11745 11746 if (cpu_isar_feature(aa64_ssbs, cpu)) { 11747 if (env->cp15.sctlr_el[new_el] & SCTLR_DSSBS_64) { 11748 new_mode |= PSTATE_SSBS; 11749 } else { 11750 new_mode &= ~PSTATE_SSBS; 11751 } 11752 } 11753 11754 if (cpu_isar_feature(aa64_nmi, cpu)) { 11755 if (!(env->cp15.sctlr_el[new_el] & SCTLR_SPINTMASK)) { 11756 new_mode |= PSTATE_ALLINT; 11757 } else { 11758 new_mode &= ~PSTATE_ALLINT; 11759 } 11760 } 11761 11762 pstate_write(env, PSTATE_DAIF | new_mode); 11763 env->aarch64 = true; 11764 aarch64_restore_sp(env, new_el); 11765 11766 if (tcg_enabled()) { 11767 helper_rebuild_hflags_a64(env, new_el); 11768 } 11769 11770 env->pc = addr; 11771 11772 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 11773 new_el, env->pc, pstate_read(env)); 11774 } 11775 11776 /* 11777 * Do semihosting call and set the appropriate return value. All the 11778 * permission and validity checks have been done at translate time. 11779 * 11780 * We only see semihosting exceptions in TCG only as they are not 11781 * trapped to the hypervisor in KVM. 11782 */ 11783 #ifdef CONFIG_TCG 11784 static void tcg_handle_semihosting(CPUState *cs) 11785 { 11786 ARMCPU *cpu = ARM_CPU(cs); 11787 CPUARMState *env = &cpu->env; 11788 11789 if (is_a64(env)) { 11790 qemu_log_mask(CPU_LOG_INT, 11791 "...handling as semihosting call 0x%" PRIx64 "\n", 11792 env->xregs[0]); 11793 do_common_semihosting(cs); 11794 env->pc += 4; 11795 } else { 11796 qemu_log_mask(CPU_LOG_INT, 11797 "...handling as semihosting call 0x%x\n", 11798 env->regs[0]); 11799 do_common_semihosting(cs); 11800 env->regs[15] += env->thumb ? 2 : 4; 11801 } 11802 } 11803 #endif 11804 11805 /* 11806 * Handle a CPU exception for A and R profile CPUs. 11807 * Do any appropriate logging, handle PSCI calls, and then hand off 11808 * to the AArch64-entry or AArch32-entry function depending on the 11809 * target exception level's register width. 11810 * 11811 * Note: this is used for both TCG (as the do_interrupt tcg op), 11812 * and KVM to re-inject guest debug exceptions, and to 11813 * inject a Synchronous-External-Abort. 11814 */ 11815 void arm_cpu_do_interrupt(CPUState *cs) 11816 { 11817 ARMCPU *cpu = ARM_CPU(cs); 11818 CPUARMState *env = &cpu->env; 11819 unsigned int new_el = env->exception.target_el; 11820 11821 assert(!arm_feature(env, ARM_FEATURE_M)); 11822 11823 arm_log_exception(cs); 11824 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 11825 new_el); 11826 if (qemu_loglevel_mask(CPU_LOG_INT) 11827 && !excp_is_internal(cs->exception_index)) { 11828 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 11829 syn_get_ec(env->exception.syndrome), 11830 env->exception.syndrome); 11831 } 11832 11833 if (tcg_enabled() && arm_is_psci_call(cpu, cs->exception_index)) { 11834 arm_handle_psci_call(cpu); 11835 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 11836 return; 11837 } 11838 11839 /* 11840 * Semihosting semantics depend on the register width of the code 11841 * that caused the exception, not the target exception level, so 11842 * must be handled here. 11843 */ 11844 #ifdef CONFIG_TCG 11845 if (cs->exception_index == EXCP_SEMIHOST) { 11846 tcg_handle_semihosting(cs); 11847 return; 11848 } 11849 #endif 11850 11851 /* 11852 * Hooks may change global state so BQL should be held, also the 11853 * BQL needs to be held for any modification of 11854 * cs->interrupt_request. 11855 */ 11856 g_assert(bql_locked()); 11857 11858 arm_call_pre_el_change_hook(cpu); 11859 11860 assert(!excp_is_internal(cs->exception_index)); 11861 if (arm_el_is_aa64(env, new_el)) { 11862 arm_cpu_do_interrupt_aarch64(cs); 11863 } else { 11864 arm_cpu_do_interrupt_aarch32(cs); 11865 } 11866 11867 arm_call_el_change_hook(cpu); 11868 11869 if (!kvm_enabled()) { 11870 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 11871 } 11872 } 11873 #endif /* !CONFIG_USER_ONLY */ 11874 11875 uint64_t arm_sctlr(CPUARMState *env, int el) 11876 { 11877 /* Only EL0 needs to be adjusted for EL1&0 or EL2&0 or EL3&0 */ 11878 if (el == 0) { 11879 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0); 11880 switch (mmu_idx) { 11881 case ARMMMUIdx_E20_0: 11882 el = 2; 11883 break; 11884 case ARMMMUIdx_E30_0: 11885 el = 3; 11886 break; 11887 default: 11888 el = 1; 11889 break; 11890 } 11891 } 11892 return env->cp15.sctlr_el[el]; 11893 } 11894 11895 int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx) 11896 { 11897 if (regime_has_2_ranges(mmu_idx)) { 11898 return extract64(tcr, 37, 2); 11899 } else if (regime_is_stage2(mmu_idx)) { 11900 return 0; /* VTCR_EL2 */ 11901 } else { 11902 /* Replicate the single TBI bit so we always have 2 bits. */ 11903 return extract32(tcr, 20, 1) * 3; 11904 } 11905 } 11906 11907 int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx) 11908 { 11909 if (regime_has_2_ranges(mmu_idx)) { 11910 return extract64(tcr, 51, 2); 11911 } else if (regime_is_stage2(mmu_idx)) { 11912 return 0; /* VTCR_EL2 */ 11913 } else { 11914 /* Replicate the single TBID bit so we always have 2 bits. */ 11915 return extract32(tcr, 29, 1) * 3; 11916 } 11917 } 11918 11919 int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx) 11920 { 11921 if (regime_has_2_ranges(mmu_idx)) { 11922 return extract64(tcr, 57, 2); 11923 } else { 11924 /* Replicate the single TCMA bit so we always have 2 bits. */ 11925 return extract32(tcr, 30, 1) * 3; 11926 } 11927 } 11928 11929 static ARMGranuleSize tg0_to_gran_size(int tg) 11930 { 11931 switch (tg) { 11932 case 0: 11933 return Gran4K; 11934 case 1: 11935 return Gran64K; 11936 case 2: 11937 return Gran16K; 11938 default: 11939 return GranInvalid; 11940 } 11941 } 11942 11943 static ARMGranuleSize tg1_to_gran_size(int tg) 11944 { 11945 switch (tg) { 11946 case 1: 11947 return Gran16K; 11948 case 2: 11949 return Gran4K; 11950 case 3: 11951 return Gran64K; 11952 default: 11953 return GranInvalid; 11954 } 11955 } 11956 11957 static inline bool have4k(ARMCPU *cpu, bool stage2) 11958 { 11959 return stage2 ? cpu_isar_feature(aa64_tgran4_2, cpu) 11960 : cpu_isar_feature(aa64_tgran4, cpu); 11961 } 11962 11963 static inline bool have16k(ARMCPU *cpu, bool stage2) 11964 { 11965 return stage2 ? cpu_isar_feature(aa64_tgran16_2, cpu) 11966 : cpu_isar_feature(aa64_tgran16, cpu); 11967 } 11968 11969 static inline bool have64k(ARMCPU *cpu, bool stage2) 11970 { 11971 return stage2 ? cpu_isar_feature(aa64_tgran64_2, cpu) 11972 : cpu_isar_feature(aa64_tgran64, cpu); 11973 } 11974 11975 static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran, 11976 bool stage2) 11977 { 11978 switch (gran) { 11979 case Gran4K: 11980 if (have4k(cpu, stage2)) { 11981 return gran; 11982 } 11983 break; 11984 case Gran16K: 11985 if (have16k(cpu, stage2)) { 11986 return gran; 11987 } 11988 break; 11989 case Gran64K: 11990 if (have64k(cpu, stage2)) { 11991 return gran; 11992 } 11993 break; 11994 case GranInvalid: 11995 break; 11996 } 11997 /* 11998 * If the guest selects a granule size that isn't implemented, 11999 * the architecture requires that we behave as if it selected one 12000 * that is (with an IMPDEF choice of which one to pick). We choose 12001 * to implement the smallest supported granule size. 12002 */ 12003 if (have4k(cpu, stage2)) { 12004 return Gran4K; 12005 } 12006 if (have16k(cpu, stage2)) { 12007 return Gran16K; 12008 } 12009 assert(have64k(cpu, stage2)); 12010 return Gran64K; 12011 } 12012 12013 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 12014 ARMMMUIdx mmu_idx, bool data, 12015 bool el1_is_aa32) 12016 { 12017 uint64_t tcr = regime_tcr(env, mmu_idx); 12018 bool epd, hpd, tsz_oob, ds, ha, hd; 12019 int select, tsz, tbi, max_tsz, min_tsz, ps, sh; 12020 ARMGranuleSize gran; 12021 ARMCPU *cpu = env_archcpu(env); 12022 bool stage2 = regime_is_stage2(mmu_idx); 12023 12024 if (!regime_has_2_ranges(mmu_idx)) { 12025 select = 0; 12026 tsz = extract32(tcr, 0, 6); 12027 gran = tg0_to_gran_size(extract32(tcr, 14, 2)); 12028 if (stage2) { 12029 /* VTCR_EL2 */ 12030 hpd = false; 12031 } else { 12032 hpd = extract32(tcr, 24, 1); 12033 } 12034 epd = false; 12035 sh = extract32(tcr, 12, 2); 12036 ps = extract32(tcr, 16, 3); 12037 ha = extract32(tcr, 21, 1) && cpu_isar_feature(aa64_hafs, cpu); 12038 hd = extract32(tcr, 22, 1) && cpu_isar_feature(aa64_hdbs, cpu); 12039 ds = extract64(tcr, 32, 1); 12040 } else { 12041 bool e0pd; 12042 12043 /* 12044 * Bit 55 is always between the two regions, and is canonical for 12045 * determining if address tagging is enabled. 12046 */ 12047 select = extract64(va, 55, 1); 12048 if (!select) { 12049 tsz = extract32(tcr, 0, 6); 12050 gran = tg0_to_gran_size(extract32(tcr, 14, 2)); 12051 epd = extract32(tcr, 7, 1); 12052 sh = extract32(tcr, 12, 2); 12053 hpd = extract64(tcr, 41, 1); 12054 e0pd = extract64(tcr, 55, 1); 12055 } else { 12056 tsz = extract32(tcr, 16, 6); 12057 gran = tg1_to_gran_size(extract32(tcr, 30, 2)); 12058 epd = extract32(tcr, 23, 1); 12059 sh = extract32(tcr, 28, 2); 12060 hpd = extract64(tcr, 42, 1); 12061 e0pd = extract64(tcr, 56, 1); 12062 } 12063 ps = extract64(tcr, 32, 3); 12064 ha = extract64(tcr, 39, 1) && cpu_isar_feature(aa64_hafs, cpu); 12065 hd = extract64(tcr, 40, 1) && cpu_isar_feature(aa64_hdbs, cpu); 12066 ds = extract64(tcr, 59, 1); 12067 12068 if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) && 12069 regime_is_user(env, mmu_idx)) { 12070 epd = true; 12071 } 12072 } 12073 12074 gran = sanitize_gran_size(cpu, gran, stage2); 12075 12076 if (cpu_isar_feature(aa64_st, cpu)) { 12077 max_tsz = 48 - (gran == Gran64K); 12078 } else { 12079 max_tsz = 39; 12080 } 12081 12082 /* 12083 * DS is RES0 unless FEAT_LPA2 is supported for the given page size; 12084 * adjust the effective value of DS, as documented. 12085 */ 12086 min_tsz = 16; 12087 if (gran == Gran64K) { 12088 if (cpu_isar_feature(aa64_lva, cpu)) { 12089 min_tsz = 12; 12090 } 12091 ds = false; 12092 } else if (ds) { 12093 if (regime_is_stage2(mmu_idx)) { 12094 if (gran == Gran16K) { 12095 ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu); 12096 } else { 12097 ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu); 12098 } 12099 } else { 12100 if (gran == Gran16K) { 12101 ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu); 12102 } else { 12103 ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu); 12104 } 12105 } 12106 if (ds) { 12107 min_tsz = 12; 12108 } 12109 } 12110 12111 if (stage2 && el1_is_aa32) { 12112 /* 12113 * For AArch32 EL1 the min txsz (and thus max IPA size) requirements 12114 * are loosened: a configured IPA of 40 bits is permitted even if 12115 * the implemented PA is less than that (and so a 40 bit IPA would 12116 * fault for an AArch64 EL1). See R_DTLMN. 12117 */ 12118 min_tsz = MIN(min_tsz, 24); 12119 } 12120 12121 if (tsz > max_tsz) { 12122 tsz = max_tsz; 12123 tsz_oob = true; 12124 } else if (tsz < min_tsz) { 12125 tsz = min_tsz; 12126 tsz_oob = true; 12127 } else { 12128 tsz_oob = false; 12129 } 12130 12131 /* Present TBI as a composite with TBID. */ 12132 tbi = aa64_va_parameter_tbi(tcr, mmu_idx); 12133 if (!data) { 12134 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx); 12135 } 12136 tbi = (tbi >> select) & 1; 12137 12138 return (ARMVAParameters) { 12139 .tsz = tsz, 12140 .ps = ps, 12141 .sh = sh, 12142 .select = select, 12143 .tbi = tbi, 12144 .epd = epd, 12145 .hpd = hpd, 12146 .tsz_oob = tsz_oob, 12147 .ds = ds, 12148 .ha = ha, 12149 .hd = ha && hd, 12150 .gran = gran, 12151 }; 12152 } 12153 12154 /* 12155 * Note that signed overflow is undefined in C. The following routines are 12156 * careful to use unsigned types where modulo arithmetic is required. 12157 * Failure to do so _will_ break on newer gcc. 12158 */ 12159 12160 /* Signed saturating arithmetic. */ 12161 12162 /* Perform 16-bit signed saturating addition. */ 12163 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 12164 { 12165 uint16_t res; 12166 12167 res = a + b; 12168 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 12169 if (a & 0x8000) { 12170 res = 0x8000; 12171 } else { 12172 res = 0x7fff; 12173 } 12174 } 12175 return res; 12176 } 12177 12178 /* Perform 8-bit signed saturating addition. */ 12179 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 12180 { 12181 uint8_t res; 12182 12183 res = a + b; 12184 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 12185 if (a & 0x80) { 12186 res = 0x80; 12187 } else { 12188 res = 0x7f; 12189 } 12190 } 12191 return res; 12192 } 12193 12194 /* Perform 16-bit signed saturating subtraction. */ 12195 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 12196 { 12197 uint16_t res; 12198 12199 res = a - b; 12200 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 12201 if (a & 0x8000) { 12202 res = 0x8000; 12203 } else { 12204 res = 0x7fff; 12205 } 12206 } 12207 return res; 12208 } 12209 12210 /* Perform 8-bit signed saturating subtraction. */ 12211 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 12212 { 12213 uint8_t res; 12214 12215 res = a - b; 12216 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 12217 if (a & 0x80) { 12218 res = 0x80; 12219 } else { 12220 res = 0x7f; 12221 } 12222 } 12223 return res; 12224 } 12225 12226 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 12227 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 12228 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 12229 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 12230 #define PFX q 12231 12232 #include "op_addsub.h" 12233 12234 /* Unsigned saturating arithmetic. */ 12235 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 12236 { 12237 uint16_t res; 12238 res = a + b; 12239 if (res < a) { 12240 res = 0xffff; 12241 } 12242 return res; 12243 } 12244 12245 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 12246 { 12247 if (a > b) { 12248 return a - b; 12249 } else { 12250 return 0; 12251 } 12252 } 12253 12254 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 12255 { 12256 uint8_t res; 12257 res = a + b; 12258 if (res < a) { 12259 res = 0xff; 12260 } 12261 return res; 12262 } 12263 12264 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 12265 { 12266 if (a > b) { 12267 return a - b; 12268 } else { 12269 return 0; 12270 } 12271 } 12272 12273 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 12274 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 12275 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 12276 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 12277 #define PFX uq 12278 12279 #include "op_addsub.h" 12280 12281 /* Signed modulo arithmetic. */ 12282 #define SARITH16(a, b, n, op) do { \ 12283 int32_t sum; \ 12284 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 12285 RESULT(sum, n, 16); \ 12286 if (sum >= 0) \ 12287 ge |= 3 << (n * 2); \ 12288 } while (0) 12289 12290 #define SARITH8(a, b, n, op) do { \ 12291 int32_t sum; \ 12292 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 12293 RESULT(sum, n, 8); \ 12294 if (sum >= 0) \ 12295 ge |= 1 << n; \ 12296 } while (0) 12297 12298 12299 #define ADD16(a, b, n) SARITH16(a, b, n, +) 12300 #define SUB16(a, b, n) SARITH16(a, b, n, -) 12301 #define ADD8(a, b, n) SARITH8(a, b, n, +) 12302 #define SUB8(a, b, n) SARITH8(a, b, n, -) 12303 #define PFX s 12304 #define ARITH_GE 12305 12306 #include "op_addsub.h" 12307 12308 /* Unsigned modulo arithmetic. */ 12309 #define ADD16(a, b, n) do { \ 12310 uint32_t sum; \ 12311 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 12312 RESULT(sum, n, 16); \ 12313 if ((sum >> 16) == 1) \ 12314 ge |= 3 << (n * 2); \ 12315 } while (0) 12316 12317 #define ADD8(a, b, n) do { \ 12318 uint32_t sum; \ 12319 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 12320 RESULT(sum, n, 8); \ 12321 if ((sum >> 8) == 1) \ 12322 ge |= 1 << n; \ 12323 } while (0) 12324 12325 #define SUB16(a, b, n) do { \ 12326 uint32_t sum; \ 12327 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 12328 RESULT(sum, n, 16); \ 12329 if ((sum >> 16) == 0) \ 12330 ge |= 3 << (n * 2); \ 12331 } while (0) 12332 12333 #define SUB8(a, b, n) do { \ 12334 uint32_t sum; \ 12335 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 12336 RESULT(sum, n, 8); \ 12337 if ((sum >> 8) == 0) \ 12338 ge |= 1 << n; \ 12339 } while (0) 12340 12341 #define PFX u 12342 #define ARITH_GE 12343 12344 #include "op_addsub.h" 12345 12346 /* Halved signed arithmetic. */ 12347 #define ADD16(a, b, n) \ 12348 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 12349 #define SUB16(a, b, n) \ 12350 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 12351 #define ADD8(a, b, n) \ 12352 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 12353 #define SUB8(a, b, n) \ 12354 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 12355 #define PFX sh 12356 12357 #include "op_addsub.h" 12358 12359 /* Halved unsigned arithmetic. */ 12360 #define ADD16(a, b, n) \ 12361 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 12362 #define SUB16(a, b, n) \ 12363 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 12364 #define ADD8(a, b, n) \ 12365 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 12366 #define SUB8(a, b, n) \ 12367 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 12368 #define PFX uh 12369 12370 #include "op_addsub.h" 12371 12372 static inline uint8_t do_usad(uint8_t a, uint8_t b) 12373 { 12374 if (a > b) { 12375 return a - b; 12376 } else { 12377 return b - a; 12378 } 12379 } 12380 12381 /* Unsigned sum of absolute byte differences. */ 12382 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 12383 { 12384 uint32_t sum; 12385 sum = do_usad(a, b); 12386 sum += do_usad(a >> 8, b >> 8); 12387 sum += do_usad(a >> 16, b >> 16); 12388 sum += do_usad(a >> 24, b >> 24); 12389 return sum; 12390 } 12391 12392 /* For ARMv6 SEL instruction. */ 12393 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 12394 { 12395 uint32_t mask; 12396 12397 mask = 0; 12398 if (flags & 1) { 12399 mask |= 0xff; 12400 } 12401 if (flags & 2) { 12402 mask |= 0xff00; 12403 } 12404 if (flags & 4) { 12405 mask |= 0xff0000; 12406 } 12407 if (flags & 8) { 12408 mask |= 0xff000000; 12409 } 12410 return (a & mask) | (b & ~mask); 12411 } 12412 12413 /* 12414 * CRC helpers. 12415 * The upper bytes of val (above the number specified by 'bytes') must have 12416 * been zeroed out by the caller. 12417 */ 12418 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 12419 { 12420 uint8_t buf[4]; 12421 12422 stl_le_p(buf, val); 12423 12424 /* zlib crc32 converts the accumulator and output to one's complement. */ 12425 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 12426 } 12427 12428 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 12429 { 12430 uint8_t buf[4]; 12431 12432 stl_le_p(buf, val); 12433 12434 /* Linux crc32c converts the output to one's complement. */ 12435 return crc32c(acc, buf, bytes) ^ 0xffffffff; 12436 } 12437 12438 /* 12439 * Return the exception level to which FP-disabled exceptions should 12440 * be taken, or 0 if FP is enabled. 12441 */ 12442 int fp_exception_el(CPUARMState *env, int cur_el) 12443 { 12444 #ifndef CONFIG_USER_ONLY 12445 uint64_t hcr_el2; 12446 12447 /* 12448 * CPACR and the CPTR registers don't exist before v6, so FP is 12449 * always accessible 12450 */ 12451 if (!arm_feature(env, ARM_FEATURE_V6)) { 12452 return 0; 12453 } 12454 12455 if (arm_feature(env, ARM_FEATURE_M)) { 12456 /* CPACR can cause a NOCP UsageFault taken to current security state */ 12457 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) { 12458 return 1; 12459 } 12460 12461 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) { 12462 if (!extract32(env->v7m.nsacr, 10, 1)) { 12463 /* FP insns cause a NOCP UsageFault taken to Secure */ 12464 return 3; 12465 } 12466 } 12467 12468 return 0; 12469 } 12470 12471 hcr_el2 = arm_hcr_el2_eff(env); 12472 12473 /* 12474 * The CPACR controls traps to EL1, or PL1 if we're 32 bit: 12475 * 0, 2 : trap EL0 and EL1/PL1 accesses 12476 * 1 : trap only EL0 accesses 12477 * 3 : trap no accesses 12478 * This register is ignored if E2H+TGE are both set. 12479 */ 12480 if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 12481 int fpen = FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, FPEN); 12482 12483 switch (fpen) { 12484 case 1: 12485 if (cur_el != 0) { 12486 break; 12487 } 12488 /* fall through */ 12489 case 0: 12490 case 2: 12491 /* Trap from Secure PL0 or PL1 to Secure PL1. */ 12492 if (!arm_el_is_aa64(env, 3) 12493 && (cur_el == 3 || arm_is_secure_below_el3(env))) { 12494 return 3; 12495 } 12496 if (cur_el <= 1) { 12497 return 1; 12498 } 12499 break; 12500 } 12501 } 12502 12503 /* 12504 * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode 12505 * to control non-secure access to the FPU. It doesn't have any 12506 * effect if EL3 is AArch64 or if EL3 doesn't exist at all. 12507 */ 12508 if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 12509 cur_el <= 2 && !arm_is_secure_below_el3(env))) { 12510 if (!extract32(env->cp15.nsacr, 10, 1)) { 12511 /* FP insns act as UNDEF */ 12512 return cur_el == 2 ? 2 : 1; 12513 } 12514 } 12515 12516 /* 12517 * CPTR_EL2 is present in v7VE or v8, and changes format 12518 * with HCR_EL2.E2H (regardless of TGE). 12519 */ 12520 if (cur_el <= 2) { 12521 if (hcr_el2 & HCR_E2H) { 12522 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, FPEN)) { 12523 case 1: 12524 if (cur_el != 0 || !(hcr_el2 & HCR_TGE)) { 12525 break; 12526 } 12527 /* fall through */ 12528 case 0: 12529 case 2: 12530 return 2; 12531 } 12532 } else if (arm_is_el2_enabled(env)) { 12533 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TFP)) { 12534 return 2; 12535 } 12536 } 12537 } 12538 12539 /* CPTR_EL3 : present in v8 */ 12540 if (FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TFP)) { 12541 /* Trap all FP ops to EL3 */ 12542 return 3; 12543 } 12544 #endif 12545 return 0; 12546 } 12547 12548 /* Return the exception level we're running at if this is our mmu_idx */ 12549 int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx) 12550 { 12551 if (mmu_idx & ARM_MMU_IDX_M) { 12552 return mmu_idx & ARM_MMU_IDX_M_PRIV; 12553 } 12554 12555 switch (mmu_idx) { 12556 case ARMMMUIdx_E10_0: 12557 case ARMMMUIdx_E20_0: 12558 case ARMMMUIdx_E30_0: 12559 return 0; 12560 case ARMMMUIdx_E10_1: 12561 case ARMMMUIdx_E10_1_PAN: 12562 return 1; 12563 case ARMMMUIdx_E2: 12564 case ARMMMUIdx_E20_2: 12565 case ARMMMUIdx_E20_2_PAN: 12566 return 2; 12567 case ARMMMUIdx_E3: 12568 case ARMMMUIdx_E30_3_PAN: 12569 return 3; 12570 default: 12571 g_assert_not_reached(); 12572 } 12573 } 12574 12575 #ifndef CONFIG_TCG 12576 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 12577 { 12578 g_assert_not_reached(); 12579 } 12580 #endif 12581 12582 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el) 12583 { 12584 ARMMMUIdx idx; 12585 uint64_t hcr; 12586 12587 if (arm_feature(env, ARM_FEATURE_M)) { 12588 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 12589 } 12590 12591 /* See ARM pseudo-function ELIsInHost. */ 12592 switch (el) { 12593 case 0: 12594 hcr = arm_hcr_el2_eff(env); 12595 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 12596 idx = ARMMMUIdx_E20_0; 12597 } else if (arm_is_secure_below_el3(env) && 12598 !arm_el_is_aa64(env, 3)) { 12599 idx = ARMMMUIdx_E30_0; 12600 } else { 12601 idx = ARMMMUIdx_E10_0; 12602 } 12603 break; 12604 case 1: 12605 if (arm_pan_enabled(env)) { 12606 idx = ARMMMUIdx_E10_1_PAN; 12607 } else { 12608 idx = ARMMMUIdx_E10_1; 12609 } 12610 break; 12611 case 2: 12612 /* Note that TGE does not apply at EL2. */ 12613 if (arm_hcr_el2_eff(env) & HCR_E2H) { 12614 if (arm_pan_enabled(env)) { 12615 idx = ARMMMUIdx_E20_2_PAN; 12616 } else { 12617 idx = ARMMMUIdx_E20_2; 12618 } 12619 } else { 12620 idx = ARMMMUIdx_E2; 12621 } 12622 break; 12623 case 3: 12624 if (!arm_el_is_aa64(env, 3) && arm_pan_enabled(env)) { 12625 return ARMMMUIdx_E30_3_PAN; 12626 } 12627 return ARMMMUIdx_E3; 12628 default: 12629 g_assert_not_reached(); 12630 } 12631 12632 return idx; 12633 } 12634 12635 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 12636 { 12637 return arm_mmu_idx_el(env, arm_current_el(env)); 12638 } 12639 12640 static bool mve_no_pred(CPUARMState *env) 12641 { 12642 /* 12643 * Return true if there is definitely no predication of MVE 12644 * instructions by VPR or LTPSIZE. (Returning false even if there 12645 * isn't any predication is OK; generated code will just be 12646 * a little worse.) 12647 * If the CPU does not implement MVE then this TB flag is always 0. 12648 * 12649 * NOTE: if you change this logic, the "recalculate s->mve_no_pred" 12650 * logic in gen_update_fp_context() needs to be updated to match. 12651 * 12652 * We do not include the effect of the ECI bits here -- they are 12653 * tracked in other TB flags. This simplifies the logic for 12654 * "when did we emit code that changes the MVE_NO_PRED TB flag 12655 * and thus need to end the TB?". 12656 */ 12657 if (cpu_isar_feature(aa32_mve, env_archcpu(env))) { 12658 return false; 12659 } 12660 if (env->v7m.vpr) { 12661 return false; 12662 } 12663 if (env->v7m.ltpsize < 4) { 12664 return false; 12665 } 12666 return true; 12667 } 12668 12669 void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc, 12670 uint64_t *cs_base, uint32_t *pflags) 12671 { 12672 CPUARMTBFlags flags; 12673 12674 assert_hflags_rebuild_correctly(env); 12675 flags = env->hflags; 12676 12677 if (EX_TBFLAG_ANY(flags, AARCH64_STATE)) { 12678 *pc = env->pc; 12679 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) { 12680 DP_TBFLAG_A64(flags, BTYPE, env->btype); 12681 } 12682 } else { 12683 *pc = env->regs[15]; 12684 12685 if (arm_feature(env, ARM_FEATURE_M)) { 12686 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 12687 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) 12688 != env->v7m.secure) { 12689 DP_TBFLAG_M32(flags, FPCCR_S_WRONG, 1); 12690 } 12691 12692 if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) && 12693 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) || 12694 (env->v7m.secure && 12695 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) { 12696 /* 12697 * ASPEN is set, but FPCA/SFPA indicate that there is no 12698 * active FP context; we must create a new FP context before 12699 * executing any FP insn. 12700 */ 12701 DP_TBFLAG_M32(flags, NEW_FP_CTXT_NEEDED, 1); 12702 } 12703 12704 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 12705 if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) { 12706 DP_TBFLAG_M32(flags, LSPACT, 1); 12707 } 12708 12709 if (mve_no_pred(env)) { 12710 DP_TBFLAG_M32(flags, MVE_NO_PRED, 1); 12711 } 12712 } else { 12713 /* 12714 * Note that XSCALE_CPAR shares bits with VECSTRIDE. 12715 * Note that VECLEN+VECSTRIDE are RES0 for M-profile. 12716 */ 12717 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 12718 DP_TBFLAG_A32(flags, XSCALE_CPAR, env->cp15.c15_cpar); 12719 } else { 12720 DP_TBFLAG_A32(flags, VECLEN, env->vfp.vec_len); 12721 DP_TBFLAG_A32(flags, VECSTRIDE, env->vfp.vec_stride); 12722 } 12723 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) { 12724 DP_TBFLAG_A32(flags, VFPEN, 1); 12725 } 12726 } 12727 12728 DP_TBFLAG_AM32(flags, THUMB, env->thumb); 12729 DP_TBFLAG_AM32(flags, CONDEXEC, env->condexec_bits); 12730 } 12731 12732 /* 12733 * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 12734 * states defined in the ARM ARM for software singlestep: 12735 * SS_ACTIVE PSTATE.SS State 12736 * 0 x Inactive (the TB flag for SS is always 0) 12737 * 1 0 Active-pending 12738 * 1 1 Active-not-pending 12739 * SS_ACTIVE is set in hflags; PSTATE__SS is computed every TB. 12740 */ 12741 if (EX_TBFLAG_ANY(flags, SS_ACTIVE) && (env->pstate & PSTATE_SS)) { 12742 DP_TBFLAG_ANY(flags, PSTATE__SS, 1); 12743 } 12744 12745 *pflags = flags.flags; 12746 *cs_base = flags.flags2; 12747 } 12748 12749 #ifdef TARGET_AARCH64 12750 /* 12751 * The manual says that when SVE is enabled and VQ is widened the 12752 * implementation is allowed to zero the previously inaccessible 12753 * portion of the registers. The corollary to that is that when 12754 * SVE is enabled and VQ is narrowed we are also allowed to zero 12755 * the now inaccessible portion of the registers. 12756 * 12757 * The intent of this is that no predicate bit beyond VQ is ever set. 12758 * Which means that some operations on predicate registers themselves 12759 * may operate on full uint64_t or even unrolled across the maximum 12760 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 12761 * may well be cheaper than conditionals to restrict the operation 12762 * to the relevant portion of a uint16_t[16]. 12763 */ 12764 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 12765 { 12766 int i, j; 12767 uint64_t pmask; 12768 12769 assert(vq >= 1 && vq <= ARM_MAX_VQ); 12770 assert(vq <= env_archcpu(env)->sve_max_vq); 12771 12772 /* Zap the high bits of the zregs. */ 12773 for (i = 0; i < 32; i++) { 12774 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 12775 } 12776 12777 /* Zap the high bits of the pregs and ffr. */ 12778 pmask = 0; 12779 if (vq & 3) { 12780 pmask = ~(-1ULL << (16 * (vq & 3))); 12781 } 12782 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 12783 for (i = 0; i < 17; ++i) { 12784 env->vfp.pregs[i].p[j] &= pmask; 12785 } 12786 pmask = 0; 12787 } 12788 } 12789 12790 static uint32_t sve_vqm1_for_el_sm_ena(CPUARMState *env, int el, bool sm) 12791 { 12792 int exc_el; 12793 12794 if (sm) { 12795 exc_el = sme_exception_el(env, el); 12796 } else { 12797 exc_el = sve_exception_el(env, el); 12798 } 12799 if (exc_el) { 12800 return 0; /* disabled */ 12801 } 12802 return sve_vqm1_for_el_sm(env, el, sm); 12803 } 12804 12805 /* 12806 * Notice a change in SVE vector size when changing EL. 12807 */ 12808 void aarch64_sve_change_el(CPUARMState *env, int old_el, 12809 int new_el, bool el0_a64) 12810 { 12811 ARMCPU *cpu = env_archcpu(env); 12812 int old_len, new_len; 12813 bool old_a64, new_a64, sm; 12814 12815 /* Nothing to do if no SVE. */ 12816 if (!cpu_isar_feature(aa64_sve, cpu)) { 12817 return; 12818 } 12819 12820 /* Nothing to do if FP is disabled in either EL. */ 12821 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 12822 return; 12823 } 12824 12825 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 12826 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 12827 12828 /* 12829 * Both AArch64.TakeException and AArch64.ExceptionReturn 12830 * invoke ResetSVEState when taking an exception from, or 12831 * returning to, AArch32 state when PSTATE.SM is enabled. 12832 */ 12833 sm = FIELD_EX64(env->svcr, SVCR, SM); 12834 if (old_a64 != new_a64 && sm) { 12835 arm_reset_sve_state(env); 12836 return; 12837 } 12838 12839 /* 12840 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 12841 * at ELx, or not available because the EL is in AArch32 state, then 12842 * for all purposes other than a direct read, the ZCR_ELx.LEN field 12843 * has an effective value of 0". 12844 * 12845 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 12846 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 12847 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 12848 * we already have the correct register contents when encountering the 12849 * vq0->vq0 transition between EL0->EL1. 12850 */ 12851 old_len = new_len = 0; 12852 if (old_a64) { 12853 old_len = sve_vqm1_for_el_sm_ena(env, old_el, sm); 12854 } 12855 if (new_a64) { 12856 new_len = sve_vqm1_for_el_sm_ena(env, new_el, sm); 12857 } 12858 12859 /* When changing vector length, clear inaccessible state. */ 12860 if (new_len < old_len) { 12861 aarch64_sve_narrow_vq(env, new_len + 1); 12862 } 12863 } 12864 #endif 12865 12866 #ifndef CONFIG_USER_ONLY 12867 ARMSecuritySpace arm_security_space(CPUARMState *env) 12868 { 12869 if (arm_feature(env, ARM_FEATURE_M)) { 12870 return arm_secure_to_space(env->v7m.secure); 12871 } 12872 12873 /* 12874 * If EL3 is not supported then the secure state is implementation 12875 * defined, in which case QEMU defaults to non-secure. 12876 */ 12877 if (!arm_feature(env, ARM_FEATURE_EL3)) { 12878 return ARMSS_NonSecure; 12879 } 12880 12881 /* Check for AArch64 EL3 or AArch32 Mon. */ 12882 if (is_a64(env)) { 12883 if (extract32(env->pstate, 2, 2) == 3) { 12884 if (cpu_isar_feature(aa64_rme, env_archcpu(env))) { 12885 return ARMSS_Root; 12886 } else { 12887 return ARMSS_Secure; 12888 } 12889 } 12890 } else { 12891 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 12892 return ARMSS_Secure; 12893 } 12894 } 12895 12896 return arm_security_space_below_el3(env); 12897 } 12898 12899 ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env) 12900 { 12901 assert(!arm_feature(env, ARM_FEATURE_M)); 12902 12903 /* 12904 * If EL3 is not supported then the secure state is implementation 12905 * defined, in which case QEMU defaults to non-secure. 12906 */ 12907 if (!arm_feature(env, ARM_FEATURE_EL3)) { 12908 return ARMSS_NonSecure; 12909 } 12910 12911 /* 12912 * Note NSE cannot be set without RME, and NSE & !NS is Reserved. 12913 * Ignoring NSE when !NS retains consistency without having to 12914 * modify other predicates. 12915 */ 12916 if (!(env->cp15.scr_el3 & SCR_NS)) { 12917 return ARMSS_Secure; 12918 } else if (env->cp15.scr_el3 & SCR_NSE) { 12919 return ARMSS_Realm; 12920 } else { 12921 return ARMSS_NonSecure; 12922 } 12923 } 12924 #endif /* !CONFIG_USER_ONLY */ 12925