1 /* 2 * ARM generic helpers. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qemu/units.h" 11 #include "target/arm/idau.h" 12 #include "trace.h" 13 #include "cpu.h" 14 #include "internals.h" 15 #include "exec/gdbstub.h" 16 #include "exec/helper-proto.h" 17 #include "qemu/host-utils.h" 18 #include "qemu/main-loop.h" 19 #include "qemu/bitops.h" 20 #include "qemu/crc32c.h" 21 #include "qemu/qemu-print.h" 22 #include "exec/exec-all.h" 23 #include <zlib.h> /* For crc32 */ 24 #include "hw/irq.h" 25 #include "hw/semihosting/semihost.h" 26 #include "sysemu/cpus.h" 27 #include "sysemu/kvm.h" 28 #include "qemu/range.h" 29 #include "qapi/qapi-commands-machine-target.h" 30 #include "qapi/error.h" 31 #include "qemu/guest-random.h" 32 #ifdef CONFIG_TCG 33 #include "arm_ldst.h" 34 #include "exec/cpu_ldst.h" 35 #endif 36 37 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 38 39 #ifndef CONFIG_USER_ONLY 40 41 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 42 MMUAccessType access_type, ARMMMUIdx mmu_idx, 43 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 44 target_ulong *page_size_ptr, 45 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs); 46 #endif 47 48 static void switch_mode(CPUARMState *env, int mode); 49 50 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 51 { 52 int nregs; 53 54 /* VFP data registers are always little-endian. */ 55 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 56 if (reg < nregs) { 57 stq_le_p(buf, *aa32_vfp_dreg(env, reg)); 58 return 8; 59 } 60 if (arm_feature(env, ARM_FEATURE_NEON)) { 61 /* Aliases for Q regs. */ 62 nregs += 16; 63 if (reg < nregs) { 64 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 65 stq_le_p(buf, q[0]); 66 stq_le_p(buf + 8, q[1]); 67 return 16; 68 } 69 } 70 switch (reg - nregs) { 71 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4; 72 case 1: stl_p(buf, vfp_get_fpscr(env)); return 4; 73 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4; 74 } 75 return 0; 76 } 77 78 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 79 { 80 int nregs; 81 82 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16; 83 if (reg < nregs) { 84 *aa32_vfp_dreg(env, reg) = ldq_le_p(buf); 85 return 8; 86 } 87 if (arm_feature(env, ARM_FEATURE_NEON)) { 88 nregs += 16; 89 if (reg < nregs) { 90 uint64_t *q = aa32_vfp_qreg(env, reg - 32); 91 q[0] = ldq_le_p(buf); 92 q[1] = ldq_le_p(buf + 8); 93 return 16; 94 } 95 } 96 switch (reg - nregs) { 97 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4; 98 case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4; 99 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4; 100 } 101 return 0; 102 } 103 104 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg) 105 { 106 switch (reg) { 107 case 0 ... 31: 108 /* 128 bit FP register */ 109 { 110 uint64_t *q = aa64_vfp_qreg(env, reg); 111 stq_le_p(buf, q[0]); 112 stq_le_p(buf + 8, q[1]); 113 return 16; 114 } 115 case 32: 116 /* FPSR */ 117 stl_p(buf, vfp_get_fpsr(env)); 118 return 4; 119 case 33: 120 /* FPCR */ 121 stl_p(buf, vfp_get_fpcr(env)); 122 return 4; 123 default: 124 return 0; 125 } 126 } 127 128 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg) 129 { 130 switch (reg) { 131 case 0 ... 31: 132 /* 128 bit FP register */ 133 { 134 uint64_t *q = aa64_vfp_qreg(env, reg); 135 q[0] = ldq_le_p(buf); 136 q[1] = ldq_le_p(buf + 8); 137 return 16; 138 } 139 case 32: 140 /* FPSR */ 141 vfp_set_fpsr(env, ldl_p(buf)); 142 return 4; 143 case 33: 144 /* FPCR */ 145 vfp_set_fpcr(env, ldl_p(buf)); 146 return 4; 147 default: 148 return 0; 149 } 150 } 151 152 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 153 { 154 assert(ri->fieldoffset); 155 if (cpreg_field_is_64bit(ri)) { 156 return CPREG_FIELD64(env, ri); 157 } else { 158 return CPREG_FIELD32(env, ri); 159 } 160 } 161 162 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 163 uint64_t value) 164 { 165 assert(ri->fieldoffset); 166 if (cpreg_field_is_64bit(ri)) { 167 CPREG_FIELD64(env, ri) = value; 168 } else { 169 CPREG_FIELD32(env, ri) = value; 170 } 171 } 172 173 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 174 { 175 return (char *)env + ri->fieldoffset; 176 } 177 178 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 179 { 180 /* Raw read of a coprocessor register (as needed for migration, etc). */ 181 if (ri->type & ARM_CP_CONST) { 182 return ri->resetvalue; 183 } else if (ri->raw_readfn) { 184 return ri->raw_readfn(env, ri); 185 } else if (ri->readfn) { 186 return ri->readfn(env, ri); 187 } else { 188 return raw_read(env, ri); 189 } 190 } 191 192 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 193 uint64_t v) 194 { 195 /* Raw write of a coprocessor register (as needed for migration, etc). 196 * Note that constant registers are treated as write-ignored; the 197 * caller should check for success by whether a readback gives the 198 * value written. 199 */ 200 if (ri->type & ARM_CP_CONST) { 201 return; 202 } else if (ri->raw_writefn) { 203 ri->raw_writefn(env, ri, v); 204 } else if (ri->writefn) { 205 ri->writefn(env, ri, v); 206 } else { 207 raw_write(env, ri, v); 208 } 209 } 210 211 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg) 212 { 213 ARMCPU *cpu = env_archcpu(env); 214 const ARMCPRegInfo *ri; 215 uint32_t key; 216 217 key = cpu->dyn_xml.cpregs_keys[reg]; 218 ri = get_arm_cp_reginfo(cpu->cp_regs, key); 219 if (ri) { 220 if (cpreg_field_is_64bit(ri)) { 221 return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri)); 222 } else { 223 return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri)); 224 } 225 } 226 return 0; 227 } 228 229 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg) 230 { 231 return 0; 232 } 233 234 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 235 { 236 /* Return true if the regdef would cause an assertion if you called 237 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 238 * program bug for it not to have the NO_RAW flag). 239 * NB that returning false here doesn't necessarily mean that calling 240 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 241 * read/write access functions which are safe for raw use" from "has 242 * read/write access functions which have side effects but has forgotten 243 * to provide raw access functions". 244 * The tests here line up with the conditions in read/write_raw_cp_reg() 245 * and assertions in raw_read()/raw_write(). 246 */ 247 if ((ri->type & ARM_CP_CONST) || 248 ri->fieldoffset || 249 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 250 return false; 251 } 252 return true; 253 } 254 255 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync) 256 { 257 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 258 int i; 259 bool ok = true; 260 261 for (i = 0; i < cpu->cpreg_array_len; i++) { 262 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 263 const ARMCPRegInfo *ri; 264 uint64_t newval; 265 266 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 267 if (!ri) { 268 ok = false; 269 continue; 270 } 271 if (ri->type & ARM_CP_NO_RAW) { 272 continue; 273 } 274 275 newval = read_raw_cp_reg(&cpu->env, ri); 276 if (kvm_sync) { 277 /* 278 * Only sync if the previous list->cpustate sync succeeded. 279 * Rather than tracking the success/failure state for every 280 * item in the list, we just recheck "does the raw write we must 281 * have made in write_list_to_cpustate() read back OK" here. 282 */ 283 uint64_t oldval = cpu->cpreg_values[i]; 284 285 if (oldval == newval) { 286 continue; 287 } 288 289 write_raw_cp_reg(&cpu->env, ri, oldval); 290 if (read_raw_cp_reg(&cpu->env, ri) != oldval) { 291 continue; 292 } 293 294 write_raw_cp_reg(&cpu->env, ri, newval); 295 } 296 cpu->cpreg_values[i] = newval; 297 } 298 return ok; 299 } 300 301 bool write_list_to_cpustate(ARMCPU *cpu) 302 { 303 int i; 304 bool ok = true; 305 306 for (i = 0; i < cpu->cpreg_array_len; i++) { 307 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 308 uint64_t v = cpu->cpreg_values[i]; 309 const ARMCPRegInfo *ri; 310 311 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 312 if (!ri) { 313 ok = false; 314 continue; 315 } 316 if (ri->type & ARM_CP_NO_RAW) { 317 continue; 318 } 319 /* Write value and confirm it reads back as written 320 * (to catch read-only registers and partially read-only 321 * registers where the incoming migration value doesn't match) 322 */ 323 write_raw_cp_reg(&cpu->env, ri, v); 324 if (read_raw_cp_reg(&cpu->env, ri) != v) { 325 ok = false; 326 } 327 } 328 return ok; 329 } 330 331 static void add_cpreg_to_list(gpointer key, gpointer opaque) 332 { 333 ARMCPU *cpu = opaque; 334 uint64_t regidx; 335 const ARMCPRegInfo *ri; 336 337 regidx = *(uint32_t *)key; 338 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 339 340 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 341 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 342 /* The value array need not be initialized at this point */ 343 cpu->cpreg_array_len++; 344 } 345 } 346 347 static void count_cpreg(gpointer key, gpointer opaque) 348 { 349 ARMCPU *cpu = opaque; 350 uint64_t regidx; 351 const ARMCPRegInfo *ri; 352 353 regidx = *(uint32_t *)key; 354 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 355 356 if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) { 357 cpu->cpreg_array_len++; 358 } 359 } 360 361 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 362 { 363 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a); 364 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b); 365 366 if (aidx > bidx) { 367 return 1; 368 } 369 if (aidx < bidx) { 370 return -1; 371 } 372 return 0; 373 } 374 375 void init_cpreg_list(ARMCPU *cpu) 376 { 377 /* Initialise the cpreg_tuples[] array based on the cp_regs hash. 378 * Note that we require cpreg_tuples[] to be sorted by key ID. 379 */ 380 GList *keys; 381 int arraylen; 382 383 keys = g_hash_table_get_keys(cpu->cp_regs); 384 keys = g_list_sort(keys, cpreg_key_compare); 385 386 cpu->cpreg_array_len = 0; 387 388 g_list_foreach(keys, count_cpreg, cpu); 389 390 arraylen = cpu->cpreg_array_len; 391 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 392 cpu->cpreg_values = g_new(uint64_t, arraylen); 393 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 394 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 395 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 396 cpu->cpreg_array_len = 0; 397 398 g_list_foreach(keys, add_cpreg_to_list, cpu); 399 400 assert(cpu->cpreg_array_len == arraylen); 401 402 g_list_free(keys); 403 } 404 405 /* 406 * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but 407 * they are accessible when EL3 is using AArch64 regardless of EL3.NS. 408 * 409 * access_el3_aa32ns: Used to check AArch32 register views. 410 * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views. 411 */ 412 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 413 const ARMCPRegInfo *ri, 414 bool isread) 415 { 416 bool secure = arm_is_secure_below_el3(env); 417 418 assert(!arm_el_is_aa64(env, 3)); 419 if (secure) { 420 return CP_ACCESS_TRAP_UNCATEGORIZED; 421 } 422 return CP_ACCESS_OK; 423 } 424 425 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env, 426 const ARMCPRegInfo *ri, 427 bool isread) 428 { 429 if (!arm_el_is_aa64(env, 3)) { 430 return access_el3_aa32ns(env, ri, isread); 431 } 432 return CP_ACCESS_OK; 433 } 434 435 /* Some secure-only AArch32 registers trap to EL3 if used from 436 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 437 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 438 * We assume that the .access field is set to PL1_RW. 439 */ 440 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 441 const ARMCPRegInfo *ri, 442 bool isread) 443 { 444 if (arm_current_el(env) == 3) { 445 return CP_ACCESS_OK; 446 } 447 if (arm_is_secure_below_el3(env)) { 448 return CP_ACCESS_TRAP_EL3; 449 } 450 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 451 return CP_ACCESS_TRAP_UNCATEGORIZED; 452 } 453 454 /* Check for traps to "powerdown debug" registers, which are controlled 455 * by MDCR.TDOSA 456 */ 457 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, 458 bool isread) 459 { 460 int el = arm_current_el(env); 461 bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) || 462 (env->cp15.mdcr_el2 & MDCR_TDE) || 463 (arm_hcr_el2_eff(env) & HCR_TGE); 464 465 if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) { 466 return CP_ACCESS_TRAP_EL2; 467 } 468 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { 469 return CP_ACCESS_TRAP_EL3; 470 } 471 return CP_ACCESS_OK; 472 } 473 474 /* Check for traps to "debug ROM" registers, which are controlled 475 * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. 476 */ 477 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, 478 bool isread) 479 { 480 int el = arm_current_el(env); 481 bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) || 482 (env->cp15.mdcr_el2 & MDCR_TDE) || 483 (arm_hcr_el2_eff(env) & HCR_TGE); 484 485 if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) { 486 return CP_ACCESS_TRAP_EL2; 487 } 488 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 489 return CP_ACCESS_TRAP_EL3; 490 } 491 return CP_ACCESS_OK; 492 } 493 494 /* Check for traps to general debug registers, which are controlled 495 * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. 496 */ 497 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, 498 bool isread) 499 { 500 int el = arm_current_el(env); 501 bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) || 502 (env->cp15.mdcr_el2 & MDCR_TDE) || 503 (arm_hcr_el2_eff(env) & HCR_TGE); 504 505 if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) { 506 return CP_ACCESS_TRAP_EL2; 507 } 508 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { 509 return CP_ACCESS_TRAP_EL3; 510 } 511 return CP_ACCESS_OK; 512 } 513 514 /* Check for traps to performance monitor registers, which are controlled 515 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 516 */ 517 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 518 bool isread) 519 { 520 int el = arm_current_el(env); 521 522 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 523 && !arm_is_secure_below_el3(env)) { 524 return CP_ACCESS_TRAP_EL2; 525 } 526 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 527 return CP_ACCESS_TRAP_EL3; 528 } 529 return CP_ACCESS_OK; 530 } 531 532 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 533 { 534 ARMCPU *cpu = env_archcpu(env); 535 536 raw_write(env, ri, value); 537 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 538 } 539 540 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 541 { 542 ARMCPU *cpu = env_archcpu(env); 543 544 if (raw_read(env, ri) != value) { 545 /* Unlike real hardware the qemu TLB uses virtual addresses, 546 * not modified virtual addresses, so this causes a TLB flush. 547 */ 548 tlb_flush(CPU(cpu)); 549 raw_write(env, ri, value); 550 } 551 } 552 553 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 554 uint64_t value) 555 { 556 ARMCPU *cpu = env_archcpu(env); 557 558 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 559 && !extended_addresses_enabled(env)) { 560 /* For VMSA (when not using the LPAE long descriptor page table 561 * format) this register includes the ASID, so do a TLB flush. 562 * For PMSA it is purely a process ID and no action is needed. 563 */ 564 tlb_flush(CPU(cpu)); 565 } 566 raw_write(env, ri, value); 567 } 568 569 /* IS variants of TLB operations must affect all cores */ 570 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 571 uint64_t value) 572 { 573 CPUState *cs = env_cpu(env); 574 575 tlb_flush_all_cpus_synced(cs); 576 } 577 578 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 579 uint64_t value) 580 { 581 CPUState *cs = env_cpu(env); 582 583 tlb_flush_all_cpus_synced(cs); 584 } 585 586 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 587 uint64_t value) 588 { 589 CPUState *cs = env_cpu(env); 590 591 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 592 } 593 594 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 595 uint64_t value) 596 { 597 CPUState *cs = env_cpu(env); 598 599 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 600 } 601 602 /* 603 * Non-IS variants of TLB operations are upgraded to 604 * IS versions if we are at NS EL1 and HCR_EL2.FB is set to 605 * force broadcast of these operations. 606 */ 607 static bool tlb_force_broadcast(CPUARMState *env) 608 { 609 return (env->cp15.hcr_el2 & HCR_FB) && 610 arm_current_el(env) == 1 && arm_is_secure_below_el3(env); 611 } 612 613 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 614 uint64_t value) 615 { 616 /* Invalidate all (TLBIALL) */ 617 CPUState *cs = env_cpu(env); 618 619 if (tlb_force_broadcast(env)) { 620 tlb_flush_all_cpus_synced(cs); 621 } else { 622 tlb_flush(cs); 623 } 624 } 625 626 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 627 uint64_t value) 628 { 629 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 630 CPUState *cs = env_cpu(env); 631 632 value &= TARGET_PAGE_MASK; 633 if (tlb_force_broadcast(env)) { 634 tlb_flush_page_all_cpus_synced(cs, value); 635 } else { 636 tlb_flush_page(cs, value); 637 } 638 } 639 640 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 641 uint64_t value) 642 { 643 /* Invalidate by ASID (TLBIASID) */ 644 CPUState *cs = env_cpu(env); 645 646 if (tlb_force_broadcast(env)) { 647 tlb_flush_all_cpus_synced(cs); 648 } else { 649 tlb_flush(cs); 650 } 651 } 652 653 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 654 uint64_t value) 655 { 656 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 657 CPUState *cs = env_cpu(env); 658 659 value &= TARGET_PAGE_MASK; 660 if (tlb_force_broadcast(env)) { 661 tlb_flush_page_all_cpus_synced(cs, value); 662 } else { 663 tlb_flush_page(cs, value); 664 } 665 } 666 667 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 668 uint64_t value) 669 { 670 CPUState *cs = env_cpu(env); 671 672 tlb_flush_by_mmuidx(cs, 673 ARMMMUIdxBit_E10_1 | 674 ARMMMUIdxBit_E10_1_PAN | 675 ARMMMUIdxBit_E10_0 | 676 ARMMMUIdxBit_Stage2); 677 } 678 679 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 680 uint64_t value) 681 { 682 CPUState *cs = env_cpu(env); 683 684 tlb_flush_by_mmuidx_all_cpus_synced(cs, 685 ARMMMUIdxBit_E10_1 | 686 ARMMMUIdxBit_E10_1_PAN | 687 ARMMMUIdxBit_E10_0 | 688 ARMMMUIdxBit_Stage2); 689 } 690 691 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri, 692 uint64_t value) 693 { 694 /* Invalidate by IPA. This has to invalidate any structures that 695 * contain only stage 2 translation information, but does not need 696 * to apply to structures that contain combined stage 1 and stage 2 697 * translation information. 698 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 699 */ 700 CPUState *cs = env_cpu(env); 701 uint64_t pageaddr; 702 703 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 704 return; 705 } 706 707 pageaddr = sextract64(value << 12, 0, 40); 708 709 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2); 710 } 711 712 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 713 uint64_t value) 714 { 715 CPUState *cs = env_cpu(env); 716 uint64_t pageaddr; 717 718 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 719 return; 720 } 721 722 pageaddr = sextract64(value << 12, 0, 40); 723 724 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 725 ARMMMUIdxBit_Stage2); 726 } 727 728 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 729 uint64_t value) 730 { 731 CPUState *cs = env_cpu(env); 732 733 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2); 734 } 735 736 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 737 uint64_t value) 738 { 739 CPUState *cs = env_cpu(env); 740 741 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E2); 742 } 743 744 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 745 uint64_t value) 746 { 747 CPUState *cs = env_cpu(env); 748 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 749 750 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E2); 751 } 752 753 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 754 uint64_t value) 755 { 756 CPUState *cs = env_cpu(env); 757 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 758 759 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 760 ARMMMUIdxBit_E2); 761 } 762 763 static const ARMCPRegInfo cp_reginfo[] = { 764 /* Define the secure and non-secure FCSE identifier CP registers 765 * separately because there is no secure bank in V8 (no _EL3). This allows 766 * the secure register to be properly reset and migrated. There is also no 767 * v8 EL1 version of the register so the non-secure instance stands alone. 768 */ 769 { .name = "FCSEIDR", 770 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 771 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 772 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 773 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 774 { .name = "FCSEIDR_S", 775 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 776 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 777 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 778 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 779 /* Define the secure and non-secure context identifier CP registers 780 * separately because there is no secure bank in V8 (no _EL3). This allows 781 * the secure register to be properly reset and migrated. In the 782 * non-secure case, the 32-bit register will have reset and migration 783 * disabled during registration as it is handled by the 64-bit instance. 784 */ 785 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 786 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 787 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 788 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 789 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 790 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 791 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 792 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 793 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 794 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 795 REGINFO_SENTINEL 796 }; 797 798 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 799 /* NB: Some of these registers exist in v8 but with more precise 800 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 801 */ 802 /* MMU Domain access control / MPU write buffer control */ 803 { .name = "DACR", 804 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 805 .access = PL1_RW, .resetvalue = 0, 806 .writefn = dacr_write, .raw_writefn = raw_write, 807 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 808 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 809 /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 810 * For v6 and v5, these mappings are overly broad. 811 */ 812 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 813 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 814 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 815 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 816 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 817 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 818 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 819 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 820 /* Cache maintenance ops; some of this space may be overridden later. */ 821 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 822 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 823 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 824 REGINFO_SENTINEL 825 }; 826 827 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 828 /* Not all pre-v6 cores implemented this WFI, so this is slightly 829 * over-broad. 830 */ 831 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 832 .access = PL1_W, .type = ARM_CP_WFI }, 833 REGINFO_SENTINEL 834 }; 835 836 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 837 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 838 * is UNPREDICTABLE; we choose to NOP as most implementations do). 839 */ 840 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 841 .access = PL1_W, .type = ARM_CP_WFI }, 842 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice 843 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 844 * OMAPCP will override this space. 845 */ 846 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 847 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 848 .resetvalue = 0 }, 849 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 850 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 851 .resetvalue = 0 }, 852 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 853 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 854 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 855 .resetvalue = 0 }, 856 /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 857 * implementing it as RAZ means the "debug architecture version" bits 858 * will read as a reserved value, which should cause Linux to not try 859 * to use the debug hardware. 860 */ 861 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 862 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 863 /* MMU TLB control. Note that the wildcarding means we cover not just 864 * the unified TLB ops but also the dside/iside/inner-shareable variants. 865 */ 866 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 867 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 868 .type = ARM_CP_NO_RAW }, 869 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 870 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 871 .type = ARM_CP_NO_RAW }, 872 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 873 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 874 .type = ARM_CP_NO_RAW }, 875 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 876 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 877 .type = ARM_CP_NO_RAW }, 878 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 879 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 880 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 881 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 882 REGINFO_SENTINEL 883 }; 884 885 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 886 uint64_t value) 887 { 888 uint32_t mask = 0; 889 890 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 891 if (!arm_feature(env, ARM_FEATURE_V8)) { 892 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 893 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 894 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 895 */ 896 if (arm_feature(env, ARM_FEATURE_VFP)) { 897 /* VFP coprocessor: cp10 & cp11 [23:20] */ 898 mask |= (1 << 31) | (1 << 30) | (0xf << 20); 899 900 if (!arm_feature(env, ARM_FEATURE_NEON)) { 901 /* ASEDIS [31] bit is RAO/WI */ 902 value |= (1 << 31); 903 } 904 905 /* VFPv3 and upwards with NEON implement 32 double precision 906 * registers (D0-D31). 907 */ 908 if (!arm_feature(env, ARM_FEATURE_NEON) || 909 !arm_feature(env, ARM_FEATURE_VFP3)) { 910 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 911 value |= (1 << 30); 912 } 913 } 914 value &= mask; 915 } 916 917 /* 918 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 919 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 920 */ 921 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 922 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 923 value &= ~(0xf << 20); 924 value |= env->cp15.cpacr_el1 & (0xf << 20); 925 } 926 927 env->cp15.cpacr_el1 = value; 928 } 929 930 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri) 931 { 932 /* 933 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 934 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 935 */ 936 uint64_t value = env->cp15.cpacr_el1; 937 938 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 939 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 940 value &= ~(0xf << 20); 941 } 942 return value; 943 } 944 945 946 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 947 { 948 /* Call cpacr_write() so that we reset with the correct RAO bits set 949 * for our CPU features. 950 */ 951 cpacr_write(env, ri, 0); 952 } 953 954 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 955 bool isread) 956 { 957 if (arm_feature(env, ARM_FEATURE_V8)) { 958 /* Check if CPACR accesses are to be trapped to EL2 */ 959 if (arm_current_el(env) == 1 && 960 (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) { 961 return CP_ACCESS_TRAP_EL2; 962 /* Check if CPACR accesses are to be trapped to EL3 */ 963 } else if (arm_current_el(env) < 3 && 964 (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 965 return CP_ACCESS_TRAP_EL3; 966 } 967 } 968 969 return CP_ACCESS_OK; 970 } 971 972 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 973 bool isread) 974 { 975 /* Check if CPTR accesses are set to trap to EL3 */ 976 if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) { 977 return CP_ACCESS_TRAP_EL3; 978 } 979 980 return CP_ACCESS_OK; 981 } 982 983 static const ARMCPRegInfo v6_cp_reginfo[] = { 984 /* prefetch by MVA in v6, NOP in v7 */ 985 { .name = "MVA_prefetch", 986 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 987 .access = PL1_W, .type = ARM_CP_NOP }, 988 /* We need to break the TB after ISB to execute self-modifying code 989 * correctly and also to take any pending interrupts immediately. 990 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 991 */ 992 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 993 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 994 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 995 .access = PL0_W, .type = ARM_CP_NOP }, 996 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 997 .access = PL0_W, .type = ARM_CP_NOP }, 998 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 999 .access = PL1_RW, 1000 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 1001 offsetof(CPUARMState, cp15.ifar_ns) }, 1002 .resetvalue = 0, }, 1003 /* Watchpoint Fault Address Register : should actually only be present 1004 * for 1136, 1176, 11MPCore. 1005 */ 1006 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 1007 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 1008 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 1009 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 1010 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 1011 .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read }, 1012 REGINFO_SENTINEL 1013 }; 1014 1015 /* Definitions for the PMU registers */ 1016 #define PMCRN_MASK 0xf800 1017 #define PMCRN_SHIFT 11 1018 #define PMCRLC 0x40 1019 #define PMCRDP 0x10 1020 #define PMCRD 0x8 1021 #define PMCRC 0x4 1022 #define PMCRP 0x2 1023 #define PMCRE 0x1 1024 1025 #define PMXEVTYPER_P 0x80000000 1026 #define PMXEVTYPER_U 0x40000000 1027 #define PMXEVTYPER_NSK 0x20000000 1028 #define PMXEVTYPER_NSU 0x10000000 1029 #define PMXEVTYPER_NSH 0x08000000 1030 #define PMXEVTYPER_M 0x04000000 1031 #define PMXEVTYPER_MT 0x02000000 1032 #define PMXEVTYPER_EVTCOUNT 0x0000ffff 1033 #define PMXEVTYPER_MASK (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \ 1034 PMXEVTYPER_NSU | PMXEVTYPER_NSH | \ 1035 PMXEVTYPER_M | PMXEVTYPER_MT | \ 1036 PMXEVTYPER_EVTCOUNT) 1037 1038 #define PMCCFILTR 0xf8000000 1039 #define PMCCFILTR_M PMXEVTYPER_M 1040 #define PMCCFILTR_EL0 (PMCCFILTR | PMCCFILTR_M) 1041 1042 static inline uint32_t pmu_num_counters(CPUARMState *env) 1043 { 1044 return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT; 1045 } 1046 1047 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */ 1048 static inline uint64_t pmu_counter_mask(CPUARMState *env) 1049 { 1050 return (1 << 31) | ((1 << pmu_num_counters(env)) - 1); 1051 } 1052 1053 typedef struct pm_event { 1054 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 1055 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 1056 bool (*supported)(CPUARMState *); 1057 /* 1058 * Retrieve the current count of the underlying event. The programmed 1059 * counters hold a difference from the return value from this function 1060 */ 1061 uint64_t (*get_count)(CPUARMState *); 1062 /* 1063 * Return how many nanoseconds it will take (at a minimum) for count events 1064 * to occur. A negative value indicates the counter will never overflow, or 1065 * that the counter has otherwise arranged for the overflow bit to be set 1066 * and the PMU interrupt to be raised on overflow. 1067 */ 1068 int64_t (*ns_per_count)(uint64_t); 1069 } pm_event; 1070 1071 static bool event_always_supported(CPUARMState *env) 1072 { 1073 return true; 1074 } 1075 1076 static uint64_t swinc_get_count(CPUARMState *env) 1077 { 1078 /* 1079 * SW_INCR events are written directly to the pmevcntr's by writes to 1080 * PMSWINC, so there is no underlying count maintained by the PMU itself 1081 */ 1082 return 0; 1083 } 1084 1085 static int64_t swinc_ns_per(uint64_t ignored) 1086 { 1087 return -1; 1088 } 1089 1090 /* 1091 * Return the underlying cycle count for the PMU cycle counters. If we're in 1092 * usermode, simply return 0. 1093 */ 1094 static uint64_t cycles_get_count(CPUARMState *env) 1095 { 1096 #ifndef CONFIG_USER_ONLY 1097 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1098 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 1099 #else 1100 return cpu_get_host_ticks(); 1101 #endif 1102 } 1103 1104 #ifndef CONFIG_USER_ONLY 1105 static int64_t cycles_ns_per(uint64_t cycles) 1106 { 1107 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 1108 } 1109 1110 static bool instructions_supported(CPUARMState *env) 1111 { 1112 return use_icount == 1 /* Precise instruction counting */; 1113 } 1114 1115 static uint64_t instructions_get_count(CPUARMState *env) 1116 { 1117 return (uint64_t)cpu_get_icount_raw(); 1118 } 1119 1120 static int64_t instructions_ns_per(uint64_t icount) 1121 { 1122 return cpu_icount_to_ns((int64_t)icount); 1123 } 1124 #endif 1125 1126 static const pm_event pm_events[] = { 1127 { .number = 0x000, /* SW_INCR */ 1128 .supported = event_always_supported, 1129 .get_count = swinc_get_count, 1130 .ns_per_count = swinc_ns_per, 1131 }, 1132 #ifndef CONFIG_USER_ONLY 1133 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 1134 .supported = instructions_supported, 1135 .get_count = instructions_get_count, 1136 .ns_per_count = instructions_ns_per, 1137 }, 1138 { .number = 0x011, /* CPU_CYCLES, Cycle */ 1139 .supported = event_always_supported, 1140 .get_count = cycles_get_count, 1141 .ns_per_count = cycles_ns_per, 1142 } 1143 #endif 1144 }; 1145 1146 /* 1147 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1148 * events (i.e. the statistical profiling extension), this implementation 1149 * should first be updated to something sparse instead of the current 1150 * supported_event_map[] array. 1151 */ 1152 #define MAX_EVENT_ID 0x11 1153 #define UNSUPPORTED_EVENT UINT16_MAX 1154 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1155 1156 /* 1157 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 1158 * of ARM event numbers to indices in our pm_events array. 1159 * 1160 * Note: Events in the 0x40XX range are not currently supported. 1161 */ 1162 void pmu_init(ARMCPU *cpu) 1163 { 1164 unsigned int i; 1165 1166 /* 1167 * Empty supported_event_map and cpu->pmceid[01] before adding supported 1168 * events to them 1169 */ 1170 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1171 supported_event_map[i] = UNSUPPORTED_EVENT; 1172 } 1173 cpu->pmceid0 = 0; 1174 cpu->pmceid1 = 0; 1175 1176 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1177 const pm_event *cnt = &pm_events[i]; 1178 assert(cnt->number <= MAX_EVENT_ID); 1179 /* We do not currently support events in the 0x40xx range */ 1180 assert(cnt->number <= 0x3f); 1181 1182 if (cnt->supported(&cpu->env)) { 1183 supported_event_map[cnt->number] = i; 1184 uint64_t event_mask = 1ULL << (cnt->number & 0x1f); 1185 if (cnt->number & 0x20) { 1186 cpu->pmceid1 |= event_mask; 1187 } else { 1188 cpu->pmceid0 |= event_mask; 1189 } 1190 } 1191 } 1192 } 1193 1194 /* 1195 * Check at runtime whether a PMU event is supported for the current machine 1196 */ 1197 static bool event_supported(uint16_t number) 1198 { 1199 if (number > MAX_EVENT_ID) { 1200 return false; 1201 } 1202 return supported_event_map[number] != UNSUPPORTED_EVENT; 1203 } 1204 1205 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1206 bool isread) 1207 { 1208 /* Performance monitor registers user accessibility is controlled 1209 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1210 * trapping to EL2 or EL3 for other accesses. 1211 */ 1212 int el = arm_current_el(env); 1213 1214 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1215 return CP_ACCESS_TRAP; 1216 } 1217 if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM) 1218 && !arm_is_secure_below_el3(env)) { 1219 return CP_ACCESS_TRAP_EL2; 1220 } 1221 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1222 return CP_ACCESS_TRAP_EL3; 1223 } 1224 1225 return CP_ACCESS_OK; 1226 } 1227 1228 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1229 const ARMCPRegInfo *ri, 1230 bool isread) 1231 { 1232 /* ER: event counter read trap control */ 1233 if (arm_feature(env, ARM_FEATURE_V8) 1234 && arm_current_el(env) == 0 1235 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1236 && isread) { 1237 return CP_ACCESS_OK; 1238 } 1239 1240 return pmreg_access(env, ri, isread); 1241 } 1242 1243 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1244 const ARMCPRegInfo *ri, 1245 bool isread) 1246 { 1247 /* SW: software increment write trap control */ 1248 if (arm_feature(env, ARM_FEATURE_V8) 1249 && arm_current_el(env) == 0 1250 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1251 && !isread) { 1252 return CP_ACCESS_OK; 1253 } 1254 1255 return pmreg_access(env, ri, isread); 1256 } 1257 1258 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1259 const ARMCPRegInfo *ri, 1260 bool isread) 1261 { 1262 /* ER: event counter read trap control */ 1263 if (arm_feature(env, ARM_FEATURE_V8) 1264 && arm_current_el(env) == 0 1265 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1266 return CP_ACCESS_OK; 1267 } 1268 1269 return pmreg_access(env, ri, isread); 1270 } 1271 1272 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1273 const ARMCPRegInfo *ri, 1274 bool isread) 1275 { 1276 /* CR: cycle counter read trap control */ 1277 if (arm_feature(env, ARM_FEATURE_V8) 1278 && arm_current_el(env) == 0 1279 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1280 && isread) { 1281 return CP_ACCESS_OK; 1282 } 1283 1284 return pmreg_access(env, ri, isread); 1285 } 1286 1287 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using 1288 * the current EL, security state, and register configuration. 1289 */ 1290 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1291 { 1292 uint64_t filter; 1293 bool e, p, u, nsk, nsu, nsh, m; 1294 bool enabled, prohibited, filtered; 1295 bool secure = arm_is_secure(env); 1296 int el = arm_current_el(env); 1297 uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1298 1299 if (!arm_feature(env, ARM_FEATURE_PMU)) { 1300 return false; 1301 } 1302 1303 if (!arm_feature(env, ARM_FEATURE_EL2) || 1304 (counter < hpmn || counter == 31)) { 1305 e = env->cp15.c9_pmcr & PMCRE; 1306 } else { 1307 e = env->cp15.mdcr_el2 & MDCR_HPME; 1308 } 1309 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1310 1311 if (!secure) { 1312 if (el == 2 && (counter < hpmn || counter == 31)) { 1313 prohibited = env->cp15.mdcr_el2 & MDCR_HPMD; 1314 } else { 1315 prohibited = false; 1316 } 1317 } else { 1318 prohibited = arm_feature(env, ARM_FEATURE_EL3) && 1319 (env->cp15.mdcr_el3 & MDCR_SPME); 1320 } 1321 1322 if (prohibited && counter == 31) { 1323 prohibited = env->cp15.c9_pmcr & PMCRDP; 1324 } 1325 1326 if (counter == 31) { 1327 filter = env->cp15.pmccfiltr_el0; 1328 } else { 1329 filter = env->cp15.c14_pmevtyper[counter]; 1330 } 1331 1332 p = filter & PMXEVTYPER_P; 1333 u = filter & PMXEVTYPER_U; 1334 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1335 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1336 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1337 m = arm_el_is_aa64(env, 1) && 1338 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1339 1340 if (el == 0) { 1341 filtered = secure ? u : u != nsu; 1342 } else if (el == 1) { 1343 filtered = secure ? p : p != nsk; 1344 } else if (el == 2) { 1345 filtered = !nsh; 1346 } else { /* EL3 */ 1347 filtered = m != p; 1348 } 1349 1350 if (counter != 31) { 1351 /* 1352 * If not checking PMCCNTR, ensure the counter is setup to an event we 1353 * support 1354 */ 1355 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1356 if (!event_supported(event)) { 1357 return false; 1358 } 1359 } 1360 1361 return enabled && !prohibited && !filtered; 1362 } 1363 1364 static void pmu_update_irq(CPUARMState *env) 1365 { 1366 ARMCPU *cpu = env_archcpu(env); 1367 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1368 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1369 } 1370 1371 /* 1372 * Ensure c15_ccnt is the guest-visible count so that operations such as 1373 * enabling/disabling the counter or filtering, modifying the count itself, 1374 * etc. can be done logically. This is essentially a no-op if the counter is 1375 * not enabled at the time of the call. 1376 */ 1377 static void pmccntr_op_start(CPUARMState *env) 1378 { 1379 uint64_t cycles = cycles_get_count(env); 1380 1381 if (pmu_counter_enabled(env, 31)) { 1382 uint64_t eff_cycles = cycles; 1383 if (env->cp15.c9_pmcr & PMCRD) { 1384 /* Increment once every 64 processor clock cycles */ 1385 eff_cycles /= 64; 1386 } 1387 1388 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1389 1390 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1391 1ull << 63 : 1ull << 31; 1392 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1393 env->cp15.c9_pmovsr |= (1 << 31); 1394 pmu_update_irq(env); 1395 } 1396 1397 env->cp15.c15_ccnt = new_pmccntr; 1398 } 1399 env->cp15.c15_ccnt_delta = cycles; 1400 } 1401 1402 /* 1403 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1404 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1405 * pmccntr_op_start. 1406 */ 1407 static void pmccntr_op_finish(CPUARMState *env) 1408 { 1409 if (pmu_counter_enabled(env, 31)) { 1410 #ifndef CONFIG_USER_ONLY 1411 /* Calculate when the counter will next overflow */ 1412 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1413 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1414 remaining_cycles = (uint32_t)remaining_cycles; 1415 } 1416 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1417 1418 if (overflow_in > 0) { 1419 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1420 overflow_in; 1421 ARMCPU *cpu = env_archcpu(env); 1422 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1423 } 1424 #endif 1425 1426 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1427 if (env->cp15.c9_pmcr & PMCRD) { 1428 /* Increment once every 64 processor clock cycles */ 1429 prev_cycles /= 64; 1430 } 1431 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1432 } 1433 } 1434 1435 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1436 { 1437 1438 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1439 uint64_t count = 0; 1440 if (event_supported(event)) { 1441 uint16_t event_idx = supported_event_map[event]; 1442 count = pm_events[event_idx].get_count(env); 1443 } 1444 1445 if (pmu_counter_enabled(env, counter)) { 1446 uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1447 1448 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) { 1449 env->cp15.c9_pmovsr |= (1 << counter); 1450 pmu_update_irq(env); 1451 } 1452 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1453 } 1454 env->cp15.c14_pmevcntr_delta[counter] = count; 1455 } 1456 1457 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1458 { 1459 if (pmu_counter_enabled(env, counter)) { 1460 #ifndef CONFIG_USER_ONLY 1461 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1462 uint16_t event_idx = supported_event_map[event]; 1463 uint64_t delta = UINT32_MAX - 1464 (uint32_t)env->cp15.c14_pmevcntr[counter] + 1; 1465 int64_t overflow_in = pm_events[event_idx].ns_per_count(delta); 1466 1467 if (overflow_in > 0) { 1468 int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1469 overflow_in; 1470 ARMCPU *cpu = env_archcpu(env); 1471 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1472 } 1473 #endif 1474 1475 env->cp15.c14_pmevcntr_delta[counter] -= 1476 env->cp15.c14_pmevcntr[counter]; 1477 } 1478 } 1479 1480 void pmu_op_start(CPUARMState *env) 1481 { 1482 unsigned int i; 1483 pmccntr_op_start(env); 1484 for (i = 0; i < pmu_num_counters(env); i++) { 1485 pmevcntr_op_start(env, i); 1486 } 1487 } 1488 1489 void pmu_op_finish(CPUARMState *env) 1490 { 1491 unsigned int i; 1492 pmccntr_op_finish(env); 1493 for (i = 0; i < pmu_num_counters(env); i++) { 1494 pmevcntr_op_finish(env, i); 1495 } 1496 } 1497 1498 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1499 { 1500 pmu_op_start(&cpu->env); 1501 } 1502 1503 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1504 { 1505 pmu_op_finish(&cpu->env); 1506 } 1507 1508 void arm_pmu_timer_cb(void *opaque) 1509 { 1510 ARMCPU *cpu = opaque; 1511 1512 /* 1513 * Update all the counter values based on the current underlying counts, 1514 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1515 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1516 * counter may expire. 1517 */ 1518 pmu_op_start(&cpu->env); 1519 pmu_op_finish(&cpu->env); 1520 } 1521 1522 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1523 uint64_t value) 1524 { 1525 pmu_op_start(env); 1526 1527 if (value & PMCRC) { 1528 /* The counter has been reset */ 1529 env->cp15.c15_ccnt = 0; 1530 } 1531 1532 if (value & PMCRP) { 1533 unsigned int i; 1534 for (i = 0; i < pmu_num_counters(env); i++) { 1535 env->cp15.c14_pmevcntr[i] = 0; 1536 } 1537 } 1538 1539 /* only the DP, X, D and E bits are writable */ 1540 env->cp15.c9_pmcr &= ~0x39; 1541 env->cp15.c9_pmcr |= (value & 0x39); 1542 1543 pmu_op_finish(env); 1544 } 1545 1546 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1547 uint64_t value) 1548 { 1549 unsigned int i; 1550 for (i = 0; i < pmu_num_counters(env); i++) { 1551 /* Increment a counter's count iff: */ 1552 if ((value & (1 << i)) && /* counter's bit is set */ 1553 /* counter is enabled and not filtered */ 1554 pmu_counter_enabled(env, i) && 1555 /* counter is SW_INCR */ 1556 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1557 pmevcntr_op_start(env, i); 1558 1559 /* 1560 * Detect if this write causes an overflow since we can't predict 1561 * PMSWINC overflows like we can for other events 1562 */ 1563 uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1564 1565 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) { 1566 env->cp15.c9_pmovsr |= (1 << i); 1567 pmu_update_irq(env); 1568 } 1569 1570 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1571 1572 pmevcntr_op_finish(env, i); 1573 } 1574 } 1575 } 1576 1577 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1578 { 1579 uint64_t ret; 1580 pmccntr_op_start(env); 1581 ret = env->cp15.c15_ccnt; 1582 pmccntr_op_finish(env); 1583 return ret; 1584 } 1585 1586 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1587 uint64_t value) 1588 { 1589 /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1590 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1591 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1592 * accessed. 1593 */ 1594 env->cp15.c9_pmselr = value & 0x1f; 1595 } 1596 1597 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1598 uint64_t value) 1599 { 1600 pmccntr_op_start(env); 1601 env->cp15.c15_ccnt = value; 1602 pmccntr_op_finish(env); 1603 } 1604 1605 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1606 uint64_t value) 1607 { 1608 uint64_t cur_val = pmccntr_read(env, NULL); 1609 1610 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1611 } 1612 1613 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1614 uint64_t value) 1615 { 1616 pmccntr_op_start(env); 1617 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1618 pmccntr_op_finish(env); 1619 } 1620 1621 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1622 uint64_t value) 1623 { 1624 pmccntr_op_start(env); 1625 /* M is not accessible from AArch32 */ 1626 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1627 (value & PMCCFILTR); 1628 pmccntr_op_finish(env); 1629 } 1630 1631 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1632 { 1633 /* M is not visible in AArch32 */ 1634 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1635 } 1636 1637 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1638 uint64_t value) 1639 { 1640 value &= pmu_counter_mask(env); 1641 env->cp15.c9_pmcnten |= value; 1642 } 1643 1644 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1645 uint64_t value) 1646 { 1647 value &= pmu_counter_mask(env); 1648 env->cp15.c9_pmcnten &= ~value; 1649 } 1650 1651 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1652 uint64_t value) 1653 { 1654 value &= pmu_counter_mask(env); 1655 env->cp15.c9_pmovsr &= ~value; 1656 pmu_update_irq(env); 1657 } 1658 1659 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1660 uint64_t value) 1661 { 1662 value &= pmu_counter_mask(env); 1663 env->cp15.c9_pmovsr |= value; 1664 pmu_update_irq(env); 1665 } 1666 1667 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1668 uint64_t value, const uint8_t counter) 1669 { 1670 if (counter == 31) { 1671 pmccfiltr_write(env, ri, value); 1672 } else if (counter < pmu_num_counters(env)) { 1673 pmevcntr_op_start(env, counter); 1674 1675 /* 1676 * If this counter's event type is changing, store the current 1677 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1678 * pmevcntr_op_finish has the correct baseline when it converts back to 1679 * a delta. 1680 */ 1681 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1682 PMXEVTYPER_EVTCOUNT; 1683 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1684 if (old_event != new_event) { 1685 uint64_t count = 0; 1686 if (event_supported(new_event)) { 1687 uint16_t event_idx = supported_event_map[new_event]; 1688 count = pm_events[event_idx].get_count(env); 1689 } 1690 env->cp15.c14_pmevcntr_delta[counter] = count; 1691 } 1692 1693 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1694 pmevcntr_op_finish(env, counter); 1695 } 1696 /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1697 * PMSELR value is equal to or greater than the number of implemented 1698 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1699 */ 1700 } 1701 1702 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1703 const uint8_t counter) 1704 { 1705 if (counter == 31) { 1706 return env->cp15.pmccfiltr_el0; 1707 } else if (counter < pmu_num_counters(env)) { 1708 return env->cp15.c14_pmevtyper[counter]; 1709 } else { 1710 /* 1711 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1712 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1713 */ 1714 return 0; 1715 } 1716 } 1717 1718 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1719 uint64_t value) 1720 { 1721 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1722 pmevtyper_write(env, ri, value, counter); 1723 } 1724 1725 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1726 uint64_t value) 1727 { 1728 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1729 env->cp15.c14_pmevtyper[counter] = value; 1730 1731 /* 1732 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1733 * pmu_op_finish calls when loading saved state for a migration. Because 1734 * we're potentially updating the type of event here, the value written to 1735 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a 1736 * different counter type. Therefore, we need to set this value to the 1737 * current count for the counter type we're writing so that pmu_op_finish 1738 * has the correct count for its calculation. 1739 */ 1740 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1741 if (event_supported(event)) { 1742 uint16_t event_idx = supported_event_map[event]; 1743 env->cp15.c14_pmevcntr_delta[counter] = 1744 pm_events[event_idx].get_count(env); 1745 } 1746 } 1747 1748 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1749 { 1750 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1751 return pmevtyper_read(env, ri, counter); 1752 } 1753 1754 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1755 uint64_t value) 1756 { 1757 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1758 } 1759 1760 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1761 { 1762 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1763 } 1764 1765 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1766 uint64_t value, uint8_t counter) 1767 { 1768 if (counter < pmu_num_counters(env)) { 1769 pmevcntr_op_start(env, counter); 1770 env->cp15.c14_pmevcntr[counter] = value; 1771 pmevcntr_op_finish(env, counter); 1772 } 1773 /* 1774 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1775 * are CONSTRAINED UNPREDICTABLE. 1776 */ 1777 } 1778 1779 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1780 uint8_t counter) 1781 { 1782 if (counter < pmu_num_counters(env)) { 1783 uint64_t ret; 1784 pmevcntr_op_start(env, counter); 1785 ret = env->cp15.c14_pmevcntr[counter]; 1786 pmevcntr_op_finish(env, counter); 1787 return ret; 1788 } else { 1789 /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1790 * are CONSTRAINED UNPREDICTABLE. */ 1791 return 0; 1792 } 1793 } 1794 1795 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1796 uint64_t value) 1797 { 1798 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1799 pmevcntr_write(env, ri, value, counter); 1800 } 1801 1802 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1803 { 1804 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1805 return pmevcntr_read(env, ri, counter); 1806 } 1807 1808 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1809 uint64_t value) 1810 { 1811 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1812 assert(counter < pmu_num_counters(env)); 1813 env->cp15.c14_pmevcntr[counter] = value; 1814 pmevcntr_write(env, ri, value, counter); 1815 } 1816 1817 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1818 { 1819 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1820 assert(counter < pmu_num_counters(env)); 1821 return env->cp15.c14_pmevcntr[counter]; 1822 } 1823 1824 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1825 uint64_t value) 1826 { 1827 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1828 } 1829 1830 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1831 { 1832 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1833 } 1834 1835 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1836 uint64_t value) 1837 { 1838 if (arm_feature(env, ARM_FEATURE_V8)) { 1839 env->cp15.c9_pmuserenr = value & 0xf; 1840 } else { 1841 env->cp15.c9_pmuserenr = value & 1; 1842 } 1843 } 1844 1845 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1846 uint64_t value) 1847 { 1848 /* We have no event counters so only the C bit can be changed */ 1849 value &= pmu_counter_mask(env); 1850 env->cp15.c9_pminten |= value; 1851 pmu_update_irq(env); 1852 } 1853 1854 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1855 uint64_t value) 1856 { 1857 value &= pmu_counter_mask(env); 1858 env->cp15.c9_pminten &= ~value; 1859 pmu_update_irq(env); 1860 } 1861 1862 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1863 uint64_t value) 1864 { 1865 /* Note that even though the AArch64 view of this register has bits 1866 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1867 * architectural requirements for bits which are RES0 only in some 1868 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1869 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1870 */ 1871 raw_write(env, ri, value & ~0x1FULL); 1872 } 1873 1874 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1875 { 1876 /* Begin with base v8.0 state. */ 1877 uint32_t valid_mask = 0x3fff; 1878 ARMCPU *cpu = env_archcpu(env); 1879 1880 if (arm_el_is_aa64(env, 3)) { 1881 value |= SCR_FW | SCR_AW; /* these two bits are RES1. */ 1882 valid_mask &= ~SCR_NET; 1883 } else { 1884 valid_mask &= ~(SCR_RW | SCR_ST); 1885 } 1886 1887 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1888 valid_mask &= ~SCR_HCE; 1889 1890 /* On ARMv7, SMD (or SCD as it is called in v7) is only 1891 * supported if EL2 exists. The bit is UNK/SBZP when 1892 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1893 * when EL2 is unavailable. 1894 * On ARMv8, this bit is always available. 1895 */ 1896 if (arm_feature(env, ARM_FEATURE_V7) && 1897 !arm_feature(env, ARM_FEATURE_V8)) { 1898 valid_mask &= ~SCR_SMD; 1899 } 1900 } 1901 if (cpu_isar_feature(aa64_lor, cpu)) { 1902 valid_mask |= SCR_TLOR; 1903 } 1904 if (cpu_isar_feature(aa64_pauth, cpu)) { 1905 valid_mask |= SCR_API | SCR_APK; 1906 } 1907 1908 /* Clear all-context RES0 bits. */ 1909 value &= valid_mask; 1910 raw_write(env, ri, value); 1911 } 1912 1913 static CPAccessResult access_aa64_tid2(CPUARMState *env, 1914 const ARMCPRegInfo *ri, 1915 bool isread) 1916 { 1917 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID2)) { 1918 return CP_ACCESS_TRAP_EL2; 1919 } 1920 1921 return CP_ACCESS_OK; 1922 } 1923 1924 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1925 { 1926 ARMCPU *cpu = env_archcpu(env); 1927 1928 /* Acquire the CSSELR index from the bank corresponding to the CCSIDR 1929 * bank 1930 */ 1931 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1932 ri->secure & ARM_CP_SECSTATE_S); 1933 1934 return cpu->ccsidr[index]; 1935 } 1936 1937 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1938 uint64_t value) 1939 { 1940 raw_write(env, ri, value & 0xf); 1941 } 1942 1943 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1944 { 1945 CPUState *cs = env_cpu(env); 1946 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 1947 uint64_t ret = 0; 1948 bool allow_virt = (arm_current_el(env) == 1 && 1949 (!arm_is_secure_below_el3(env) || 1950 (env->cp15.scr_el3 & SCR_EEL2))); 1951 1952 if (allow_virt && (hcr_el2 & HCR_IMO)) { 1953 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1954 ret |= CPSR_I; 1955 } 1956 } else { 1957 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1958 ret |= CPSR_I; 1959 } 1960 } 1961 1962 if (allow_virt && (hcr_el2 & HCR_FMO)) { 1963 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1964 ret |= CPSR_F; 1965 } 1966 } else { 1967 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1968 ret |= CPSR_F; 1969 } 1970 } 1971 1972 /* External aborts are not possible in QEMU so A bit is always clear */ 1973 return ret; 1974 } 1975 1976 static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 1977 bool isread) 1978 { 1979 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) { 1980 return CP_ACCESS_TRAP_EL2; 1981 } 1982 1983 return CP_ACCESS_OK; 1984 } 1985 1986 static CPAccessResult access_aa32_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 1987 bool isread) 1988 { 1989 if (arm_feature(env, ARM_FEATURE_V8)) { 1990 return access_aa64_tid1(env, ri, isread); 1991 } 1992 1993 return CP_ACCESS_OK; 1994 } 1995 1996 static const ARMCPRegInfo v7_cp_reginfo[] = { 1997 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 1998 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 1999 .access = PL1_W, .type = ARM_CP_NOP }, 2000 /* Performance monitors are implementation defined in v7, 2001 * but with an ARM recommended set of registers, which we 2002 * follow. 2003 * 2004 * Performance registers fall into three categories: 2005 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 2006 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 2007 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 2008 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 2009 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 2010 */ 2011 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 2012 .access = PL0_RW, .type = ARM_CP_ALIAS, 2013 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 2014 .writefn = pmcntenset_write, 2015 .accessfn = pmreg_access, 2016 .raw_writefn = raw_write }, 2017 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, 2018 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 2019 .access = PL0_RW, .accessfn = pmreg_access, 2020 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 2021 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 2022 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 2023 .access = PL0_RW, 2024 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 2025 .accessfn = pmreg_access, 2026 .writefn = pmcntenclr_write, 2027 .type = ARM_CP_ALIAS }, 2028 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 2029 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 2030 .access = PL0_RW, .accessfn = pmreg_access, 2031 .type = ARM_CP_ALIAS, 2032 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 2033 .writefn = pmcntenclr_write }, 2034 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 2035 .access = PL0_RW, .type = ARM_CP_IO, 2036 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2037 .accessfn = pmreg_access, 2038 .writefn = pmovsr_write, 2039 .raw_writefn = raw_write }, 2040 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 2041 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 2042 .access = PL0_RW, .accessfn = pmreg_access, 2043 .type = ARM_CP_ALIAS | ARM_CP_IO, 2044 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2045 .writefn = pmovsr_write, 2046 .raw_writefn = raw_write }, 2047 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 2048 .access = PL0_W, .accessfn = pmreg_access_swinc, 2049 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2050 .writefn = pmswinc_write }, 2051 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 2052 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 2053 .access = PL0_W, .accessfn = pmreg_access_swinc, 2054 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2055 .writefn = pmswinc_write }, 2056 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 2057 .access = PL0_RW, .type = ARM_CP_ALIAS, 2058 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 2059 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 2060 .raw_writefn = raw_write}, 2061 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 2062 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 2063 .access = PL0_RW, .accessfn = pmreg_access_selr, 2064 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 2065 .writefn = pmselr_write, .raw_writefn = raw_write, }, 2066 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 2067 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 2068 .readfn = pmccntr_read, .writefn = pmccntr_write32, 2069 .accessfn = pmreg_access_ccntr }, 2070 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 2071 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 2072 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 2073 .type = ARM_CP_IO, 2074 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 2075 .readfn = pmccntr_read, .writefn = pmccntr_write, 2076 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 2077 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 2078 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 2079 .access = PL0_RW, .accessfn = pmreg_access, 2080 .type = ARM_CP_ALIAS | ARM_CP_IO, 2081 .resetvalue = 0, }, 2082 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 2083 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 2084 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 2085 .access = PL0_RW, .accessfn = pmreg_access, 2086 .type = ARM_CP_IO, 2087 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 2088 .resetvalue = 0, }, 2089 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 2090 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2091 .accessfn = pmreg_access, 2092 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2093 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 2094 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 2095 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2096 .accessfn = pmreg_access, 2097 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2098 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 2099 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2100 .accessfn = pmreg_access_xevcntr, 2101 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2102 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 2103 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 2104 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2105 .accessfn = pmreg_access_xevcntr, 2106 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2107 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2108 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2109 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2110 .resetvalue = 0, 2111 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2112 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2113 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2114 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2115 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2116 .resetvalue = 0, 2117 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2118 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2119 .access = PL1_RW, .accessfn = access_tpm, 2120 .type = ARM_CP_ALIAS | ARM_CP_IO, 2121 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2122 .resetvalue = 0, 2123 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2124 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2125 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2126 .access = PL1_RW, .accessfn = access_tpm, 2127 .type = ARM_CP_IO, 2128 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2129 .writefn = pmintenset_write, .raw_writefn = raw_write, 2130 .resetvalue = 0x0 }, 2131 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2132 .access = PL1_RW, .accessfn = access_tpm, 2133 .type = ARM_CP_ALIAS | ARM_CP_IO, 2134 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2135 .writefn = pmintenclr_write, }, 2136 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2137 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2138 .access = PL1_RW, .accessfn = access_tpm, 2139 .type = ARM_CP_ALIAS | ARM_CP_IO, 2140 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2141 .writefn = pmintenclr_write }, 2142 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2143 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2144 .access = PL1_R, 2145 .accessfn = access_aa64_tid2, 2146 .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2147 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2148 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2149 .access = PL1_RW, 2150 .accessfn = access_aa64_tid2, 2151 .writefn = csselr_write, .resetvalue = 0, 2152 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2153 offsetof(CPUARMState, cp15.csselr_ns) } }, 2154 /* Auxiliary ID register: this actually has an IMPDEF value but for now 2155 * just RAZ for all cores: 2156 */ 2157 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2158 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2159 .access = PL1_R, .type = ARM_CP_CONST, 2160 .accessfn = access_aa64_tid1, 2161 .resetvalue = 0 }, 2162 /* Auxiliary fault status registers: these also are IMPDEF, and we 2163 * choose to RAZ/WI for all cores. 2164 */ 2165 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2166 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2167 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2168 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2169 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2170 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 2171 /* MAIR can just read-as-written because we don't implement caches 2172 * and so don't need to care about memory attributes. 2173 */ 2174 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2175 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2176 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2177 .resetvalue = 0 }, 2178 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2179 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2180 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2181 .resetvalue = 0 }, 2182 /* For non-long-descriptor page tables these are PRRR and NMRR; 2183 * regardless they still act as reads-as-written for QEMU. 2184 */ 2185 /* MAIR0/1 are defined separately from their 64-bit counterpart which 2186 * allows them to assign the correct fieldoffset based on the endianness 2187 * handled in the field definitions. 2188 */ 2189 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2190 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW, 2191 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2192 offsetof(CPUARMState, cp15.mair0_ns) }, 2193 .resetfn = arm_cp_reset_ignore }, 2194 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2195 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW, 2196 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2197 offsetof(CPUARMState, cp15.mair1_ns) }, 2198 .resetfn = arm_cp_reset_ignore }, 2199 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2200 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2201 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2202 /* 32 bit ITLB invalidates */ 2203 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2204 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2205 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2206 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2207 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2208 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2209 /* 32 bit DTLB invalidates */ 2210 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2211 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2212 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2213 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2214 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2215 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2216 /* 32 bit TLB invalidates */ 2217 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2218 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write }, 2219 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2220 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 2221 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2222 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write }, 2223 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2224 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 2225 REGINFO_SENTINEL 2226 }; 2227 2228 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2229 /* 32 bit TLB invalidates, Inner Shareable */ 2230 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2231 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write }, 2232 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2233 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 2234 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2235 .type = ARM_CP_NO_RAW, .access = PL1_W, 2236 .writefn = tlbiasid_is_write }, 2237 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2238 .type = ARM_CP_NO_RAW, .access = PL1_W, 2239 .writefn = tlbimvaa_is_write }, 2240 REGINFO_SENTINEL 2241 }; 2242 2243 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2244 /* PMOVSSET is not implemented in v7 before v7ve */ 2245 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2246 .access = PL0_RW, .accessfn = pmreg_access, 2247 .type = ARM_CP_ALIAS | ARM_CP_IO, 2248 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2249 .writefn = pmovsset_write, 2250 .raw_writefn = raw_write }, 2251 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2252 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2253 .access = PL0_RW, .accessfn = pmreg_access, 2254 .type = ARM_CP_ALIAS | ARM_CP_IO, 2255 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2256 .writefn = pmovsset_write, 2257 .raw_writefn = raw_write }, 2258 REGINFO_SENTINEL 2259 }; 2260 2261 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2262 uint64_t value) 2263 { 2264 value &= 1; 2265 env->teecr = value; 2266 } 2267 2268 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2269 bool isread) 2270 { 2271 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2272 return CP_ACCESS_TRAP; 2273 } 2274 return CP_ACCESS_OK; 2275 } 2276 2277 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2278 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2279 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2280 .resetvalue = 0, 2281 .writefn = teecr_write }, 2282 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2283 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2284 .accessfn = teehbr_access, .resetvalue = 0 }, 2285 REGINFO_SENTINEL 2286 }; 2287 2288 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2289 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2290 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2291 .access = PL0_RW, 2292 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2293 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2294 .access = PL0_RW, 2295 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2296 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2297 .resetfn = arm_cp_reset_ignore }, 2298 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2299 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2300 .access = PL0_R|PL1_W, 2301 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2302 .resetvalue = 0}, 2303 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2304 .access = PL0_R|PL1_W, 2305 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2306 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2307 .resetfn = arm_cp_reset_ignore }, 2308 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2309 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2310 .access = PL1_RW, 2311 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2312 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2313 .access = PL1_RW, 2314 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2315 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2316 .resetvalue = 0 }, 2317 REGINFO_SENTINEL 2318 }; 2319 2320 #ifndef CONFIG_USER_ONLY 2321 2322 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2323 bool isread) 2324 { 2325 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2326 * Writable only at the highest implemented exception level. 2327 */ 2328 int el = arm_current_el(env); 2329 uint64_t hcr; 2330 uint32_t cntkctl; 2331 2332 switch (el) { 2333 case 0: 2334 hcr = arm_hcr_el2_eff(env); 2335 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2336 cntkctl = env->cp15.cnthctl_el2; 2337 } else { 2338 cntkctl = env->cp15.c14_cntkctl; 2339 } 2340 if (!extract32(cntkctl, 0, 2)) { 2341 return CP_ACCESS_TRAP; 2342 } 2343 break; 2344 case 1: 2345 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2346 arm_is_secure_below_el3(env)) { 2347 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2348 return CP_ACCESS_TRAP_UNCATEGORIZED; 2349 } 2350 break; 2351 case 2: 2352 case 3: 2353 break; 2354 } 2355 2356 if (!isread && el < arm_highest_el(env)) { 2357 return CP_ACCESS_TRAP_UNCATEGORIZED; 2358 } 2359 2360 return CP_ACCESS_OK; 2361 } 2362 2363 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2364 bool isread) 2365 { 2366 unsigned int cur_el = arm_current_el(env); 2367 bool secure = arm_is_secure(env); 2368 uint64_t hcr = arm_hcr_el2_eff(env); 2369 2370 switch (cur_el) { 2371 case 0: 2372 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]CTEN. */ 2373 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2374 return (extract32(env->cp15.cnthctl_el2, timeridx, 1) 2375 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2376 } 2377 2378 /* CNT[PV]CT: not visible from PL0 if EL0[PV]CTEN is zero */ 2379 if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2380 return CP_ACCESS_TRAP; 2381 } 2382 2383 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PCTEN. */ 2384 if (hcr & HCR_E2H) { 2385 if (timeridx == GTIMER_PHYS && 2386 !extract32(env->cp15.cnthctl_el2, 10, 1)) { 2387 return CP_ACCESS_TRAP_EL2; 2388 } 2389 } else { 2390 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ 2391 if (arm_feature(env, ARM_FEATURE_EL2) && 2392 timeridx == GTIMER_PHYS && !secure && 2393 !extract32(env->cp15.cnthctl_el2, 1, 1)) { 2394 return CP_ACCESS_TRAP_EL2; 2395 } 2396 } 2397 break; 2398 2399 case 1: 2400 /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */ 2401 if (arm_feature(env, ARM_FEATURE_EL2) && 2402 timeridx == GTIMER_PHYS && !secure && 2403 (hcr & HCR_E2H 2404 ? !extract32(env->cp15.cnthctl_el2, 10, 1) 2405 : !extract32(env->cp15.cnthctl_el2, 0, 1))) { 2406 return CP_ACCESS_TRAP_EL2; 2407 } 2408 break; 2409 } 2410 return CP_ACCESS_OK; 2411 } 2412 2413 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2414 bool isread) 2415 { 2416 unsigned int cur_el = arm_current_el(env); 2417 bool secure = arm_is_secure(env); 2418 uint64_t hcr = arm_hcr_el2_eff(env); 2419 2420 switch (cur_el) { 2421 case 0: 2422 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2423 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]TEN. */ 2424 return (extract32(env->cp15.cnthctl_el2, 9 - timeridx, 1) 2425 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2426 } 2427 2428 /* 2429 * CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from 2430 * EL0 if EL0[PV]TEN is zero. 2431 */ 2432 if (!extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2433 return CP_ACCESS_TRAP; 2434 } 2435 /* fall through */ 2436 2437 case 1: 2438 if (arm_feature(env, ARM_FEATURE_EL2) && 2439 timeridx == GTIMER_PHYS && !secure) { 2440 if (hcr & HCR_E2H) { 2441 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */ 2442 if (!extract32(env->cp15.cnthctl_el2, 11, 1)) { 2443 return CP_ACCESS_TRAP_EL2; 2444 } 2445 } else { 2446 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ 2447 if (!extract32(env->cp15.cnthctl_el2, 1, 1)) { 2448 return CP_ACCESS_TRAP_EL2; 2449 } 2450 } 2451 } 2452 break; 2453 } 2454 return CP_ACCESS_OK; 2455 } 2456 2457 static CPAccessResult gt_pct_access(CPUARMState *env, 2458 const ARMCPRegInfo *ri, 2459 bool isread) 2460 { 2461 return gt_counter_access(env, GTIMER_PHYS, isread); 2462 } 2463 2464 static CPAccessResult gt_vct_access(CPUARMState *env, 2465 const ARMCPRegInfo *ri, 2466 bool isread) 2467 { 2468 return gt_counter_access(env, GTIMER_VIRT, isread); 2469 } 2470 2471 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2472 bool isread) 2473 { 2474 return gt_timer_access(env, GTIMER_PHYS, isread); 2475 } 2476 2477 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2478 bool isread) 2479 { 2480 return gt_timer_access(env, GTIMER_VIRT, isread); 2481 } 2482 2483 static CPAccessResult gt_stimer_access(CPUARMState *env, 2484 const ARMCPRegInfo *ri, 2485 bool isread) 2486 { 2487 /* The AArch64 register view of the secure physical timer is 2488 * always accessible from EL3, and configurably accessible from 2489 * Secure EL1. 2490 */ 2491 switch (arm_current_el(env)) { 2492 case 1: 2493 if (!arm_is_secure(env)) { 2494 return CP_ACCESS_TRAP; 2495 } 2496 if (!(env->cp15.scr_el3 & SCR_ST)) { 2497 return CP_ACCESS_TRAP_EL3; 2498 } 2499 return CP_ACCESS_OK; 2500 case 0: 2501 case 2: 2502 return CP_ACCESS_TRAP; 2503 case 3: 2504 return CP_ACCESS_OK; 2505 default: 2506 g_assert_not_reached(); 2507 } 2508 } 2509 2510 static uint64_t gt_get_countervalue(CPUARMState *env) 2511 { 2512 ARMCPU *cpu = env_archcpu(env); 2513 2514 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu); 2515 } 2516 2517 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2518 { 2519 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2520 2521 if (gt->ctl & 1) { 2522 /* Timer enabled: calculate and set current ISTATUS, irq, and 2523 * reset timer to when ISTATUS next has to change 2524 */ 2525 uint64_t offset = timeridx == GTIMER_VIRT ? 2526 cpu->env.cp15.cntvoff_el2 : 0; 2527 uint64_t count = gt_get_countervalue(&cpu->env); 2528 /* Note that this must be unsigned 64 bit arithmetic: */ 2529 int istatus = count - offset >= gt->cval; 2530 uint64_t nexttick; 2531 int irqstate; 2532 2533 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2534 2535 irqstate = (istatus && !(gt->ctl & 2)); 2536 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2537 2538 if (istatus) { 2539 /* Next transition is when count rolls back over to zero */ 2540 nexttick = UINT64_MAX; 2541 } else { 2542 /* Next transition is when we hit cval */ 2543 nexttick = gt->cval + offset; 2544 } 2545 /* Note that the desired next expiry time might be beyond the 2546 * signed-64-bit range of a QEMUTimer -- in this case we just 2547 * set the timer for as far in the future as possible. When the 2548 * timer expires we will reset the timer for any remaining period. 2549 */ 2550 if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { 2551 timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX); 2552 } else { 2553 timer_mod(cpu->gt_timer[timeridx], nexttick); 2554 } 2555 trace_arm_gt_recalc(timeridx, irqstate, nexttick); 2556 } else { 2557 /* Timer disabled: ISTATUS and timer output always clear */ 2558 gt->ctl &= ~4; 2559 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0); 2560 timer_del(cpu->gt_timer[timeridx]); 2561 trace_arm_gt_recalc_disabled(timeridx); 2562 } 2563 } 2564 2565 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2566 int timeridx) 2567 { 2568 ARMCPU *cpu = env_archcpu(env); 2569 2570 timer_del(cpu->gt_timer[timeridx]); 2571 } 2572 2573 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2574 { 2575 return gt_get_countervalue(env); 2576 } 2577 2578 static uint64_t gt_virt_cnt_offset(CPUARMState *env) 2579 { 2580 uint64_t hcr; 2581 2582 switch (arm_current_el(env)) { 2583 case 2: 2584 hcr = arm_hcr_el2_eff(env); 2585 if (hcr & HCR_E2H) { 2586 return 0; 2587 } 2588 break; 2589 case 0: 2590 hcr = arm_hcr_el2_eff(env); 2591 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2592 return 0; 2593 } 2594 break; 2595 } 2596 2597 return env->cp15.cntvoff_el2; 2598 } 2599 2600 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2601 { 2602 return gt_get_countervalue(env) - gt_virt_cnt_offset(env); 2603 } 2604 2605 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2606 int timeridx, 2607 uint64_t value) 2608 { 2609 trace_arm_gt_cval_write(timeridx, value); 2610 env->cp15.c14_timer[timeridx].cval = value; 2611 gt_recalc_timer(env_archcpu(env), timeridx); 2612 } 2613 2614 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2615 int timeridx) 2616 { 2617 uint64_t offset = 0; 2618 2619 switch (timeridx) { 2620 case GTIMER_VIRT: 2621 case GTIMER_HYPVIRT: 2622 offset = gt_virt_cnt_offset(env); 2623 break; 2624 } 2625 2626 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2627 (gt_get_countervalue(env) - offset)); 2628 } 2629 2630 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2631 int timeridx, 2632 uint64_t value) 2633 { 2634 uint64_t offset = 0; 2635 2636 switch (timeridx) { 2637 case GTIMER_VIRT: 2638 case GTIMER_HYPVIRT: 2639 offset = gt_virt_cnt_offset(env); 2640 break; 2641 } 2642 2643 trace_arm_gt_tval_write(timeridx, value); 2644 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2645 sextract64(value, 0, 32); 2646 gt_recalc_timer(env_archcpu(env), timeridx); 2647 } 2648 2649 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2650 int timeridx, 2651 uint64_t value) 2652 { 2653 ARMCPU *cpu = env_archcpu(env); 2654 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2655 2656 trace_arm_gt_ctl_write(timeridx, value); 2657 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2658 if ((oldval ^ value) & 1) { 2659 /* Enable toggled */ 2660 gt_recalc_timer(cpu, timeridx); 2661 } else if ((oldval ^ value) & 2) { 2662 /* IMASK toggled: don't need to recalculate, 2663 * just set the interrupt line based on ISTATUS 2664 */ 2665 int irqstate = (oldval & 4) && !(value & 2); 2666 2667 trace_arm_gt_imask_toggle(timeridx, irqstate); 2668 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2669 } 2670 } 2671 2672 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2673 { 2674 gt_timer_reset(env, ri, GTIMER_PHYS); 2675 } 2676 2677 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2678 uint64_t value) 2679 { 2680 gt_cval_write(env, ri, GTIMER_PHYS, value); 2681 } 2682 2683 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2684 { 2685 return gt_tval_read(env, ri, GTIMER_PHYS); 2686 } 2687 2688 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2689 uint64_t value) 2690 { 2691 gt_tval_write(env, ri, GTIMER_PHYS, value); 2692 } 2693 2694 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2695 uint64_t value) 2696 { 2697 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2698 } 2699 2700 static int gt_phys_redir_timeridx(CPUARMState *env) 2701 { 2702 switch (arm_mmu_idx(env)) { 2703 case ARMMMUIdx_E20_0: 2704 case ARMMMUIdx_E20_2: 2705 case ARMMMUIdx_E20_2_PAN: 2706 return GTIMER_HYP; 2707 default: 2708 return GTIMER_PHYS; 2709 } 2710 } 2711 2712 static int gt_virt_redir_timeridx(CPUARMState *env) 2713 { 2714 switch (arm_mmu_idx(env)) { 2715 case ARMMMUIdx_E20_0: 2716 case ARMMMUIdx_E20_2: 2717 case ARMMMUIdx_E20_2_PAN: 2718 return GTIMER_HYPVIRT; 2719 default: 2720 return GTIMER_VIRT; 2721 } 2722 } 2723 2724 static uint64_t gt_phys_redir_cval_read(CPUARMState *env, 2725 const ARMCPRegInfo *ri) 2726 { 2727 int timeridx = gt_phys_redir_timeridx(env); 2728 return env->cp15.c14_timer[timeridx].cval; 2729 } 2730 2731 static void gt_phys_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2732 uint64_t value) 2733 { 2734 int timeridx = gt_phys_redir_timeridx(env); 2735 gt_cval_write(env, ri, timeridx, value); 2736 } 2737 2738 static uint64_t gt_phys_redir_tval_read(CPUARMState *env, 2739 const ARMCPRegInfo *ri) 2740 { 2741 int timeridx = gt_phys_redir_timeridx(env); 2742 return gt_tval_read(env, ri, timeridx); 2743 } 2744 2745 static void gt_phys_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2746 uint64_t value) 2747 { 2748 int timeridx = gt_phys_redir_timeridx(env); 2749 gt_tval_write(env, ri, timeridx, value); 2750 } 2751 2752 static uint64_t gt_phys_redir_ctl_read(CPUARMState *env, 2753 const ARMCPRegInfo *ri) 2754 { 2755 int timeridx = gt_phys_redir_timeridx(env); 2756 return env->cp15.c14_timer[timeridx].ctl; 2757 } 2758 2759 static void gt_phys_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2760 uint64_t value) 2761 { 2762 int timeridx = gt_phys_redir_timeridx(env); 2763 gt_ctl_write(env, ri, timeridx, value); 2764 } 2765 2766 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2767 { 2768 gt_timer_reset(env, ri, GTIMER_VIRT); 2769 } 2770 2771 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2772 uint64_t value) 2773 { 2774 gt_cval_write(env, ri, GTIMER_VIRT, value); 2775 } 2776 2777 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2778 { 2779 return gt_tval_read(env, ri, GTIMER_VIRT); 2780 } 2781 2782 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2783 uint64_t value) 2784 { 2785 gt_tval_write(env, ri, GTIMER_VIRT, value); 2786 } 2787 2788 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2789 uint64_t value) 2790 { 2791 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2792 } 2793 2794 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2795 uint64_t value) 2796 { 2797 ARMCPU *cpu = env_archcpu(env); 2798 2799 trace_arm_gt_cntvoff_write(value); 2800 raw_write(env, ri, value); 2801 gt_recalc_timer(cpu, GTIMER_VIRT); 2802 } 2803 2804 static uint64_t gt_virt_redir_cval_read(CPUARMState *env, 2805 const ARMCPRegInfo *ri) 2806 { 2807 int timeridx = gt_virt_redir_timeridx(env); 2808 return env->cp15.c14_timer[timeridx].cval; 2809 } 2810 2811 static void gt_virt_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2812 uint64_t value) 2813 { 2814 int timeridx = gt_virt_redir_timeridx(env); 2815 gt_cval_write(env, ri, timeridx, value); 2816 } 2817 2818 static uint64_t gt_virt_redir_tval_read(CPUARMState *env, 2819 const ARMCPRegInfo *ri) 2820 { 2821 int timeridx = gt_virt_redir_timeridx(env); 2822 return gt_tval_read(env, ri, timeridx); 2823 } 2824 2825 static void gt_virt_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2826 uint64_t value) 2827 { 2828 int timeridx = gt_virt_redir_timeridx(env); 2829 gt_tval_write(env, ri, timeridx, value); 2830 } 2831 2832 static uint64_t gt_virt_redir_ctl_read(CPUARMState *env, 2833 const ARMCPRegInfo *ri) 2834 { 2835 int timeridx = gt_virt_redir_timeridx(env); 2836 return env->cp15.c14_timer[timeridx].ctl; 2837 } 2838 2839 static void gt_virt_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2840 uint64_t value) 2841 { 2842 int timeridx = gt_virt_redir_timeridx(env); 2843 gt_ctl_write(env, ri, timeridx, value); 2844 } 2845 2846 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2847 { 2848 gt_timer_reset(env, ri, GTIMER_HYP); 2849 } 2850 2851 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2852 uint64_t value) 2853 { 2854 gt_cval_write(env, ri, GTIMER_HYP, value); 2855 } 2856 2857 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2858 { 2859 return gt_tval_read(env, ri, GTIMER_HYP); 2860 } 2861 2862 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2863 uint64_t value) 2864 { 2865 gt_tval_write(env, ri, GTIMER_HYP, value); 2866 } 2867 2868 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2869 uint64_t value) 2870 { 2871 gt_ctl_write(env, ri, GTIMER_HYP, value); 2872 } 2873 2874 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2875 { 2876 gt_timer_reset(env, ri, GTIMER_SEC); 2877 } 2878 2879 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2880 uint64_t value) 2881 { 2882 gt_cval_write(env, ri, GTIMER_SEC, value); 2883 } 2884 2885 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2886 { 2887 return gt_tval_read(env, ri, GTIMER_SEC); 2888 } 2889 2890 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2891 uint64_t value) 2892 { 2893 gt_tval_write(env, ri, GTIMER_SEC, value); 2894 } 2895 2896 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2897 uint64_t value) 2898 { 2899 gt_ctl_write(env, ri, GTIMER_SEC, value); 2900 } 2901 2902 static void gt_hv_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2903 { 2904 gt_timer_reset(env, ri, GTIMER_HYPVIRT); 2905 } 2906 2907 static void gt_hv_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2908 uint64_t value) 2909 { 2910 gt_cval_write(env, ri, GTIMER_HYPVIRT, value); 2911 } 2912 2913 static uint64_t gt_hv_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2914 { 2915 return gt_tval_read(env, ri, GTIMER_HYPVIRT); 2916 } 2917 2918 static void gt_hv_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2919 uint64_t value) 2920 { 2921 gt_tval_write(env, ri, GTIMER_HYPVIRT, value); 2922 } 2923 2924 static void gt_hv_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2925 uint64_t value) 2926 { 2927 gt_ctl_write(env, ri, GTIMER_HYPVIRT, value); 2928 } 2929 2930 void arm_gt_ptimer_cb(void *opaque) 2931 { 2932 ARMCPU *cpu = opaque; 2933 2934 gt_recalc_timer(cpu, GTIMER_PHYS); 2935 } 2936 2937 void arm_gt_vtimer_cb(void *opaque) 2938 { 2939 ARMCPU *cpu = opaque; 2940 2941 gt_recalc_timer(cpu, GTIMER_VIRT); 2942 } 2943 2944 void arm_gt_htimer_cb(void *opaque) 2945 { 2946 ARMCPU *cpu = opaque; 2947 2948 gt_recalc_timer(cpu, GTIMER_HYP); 2949 } 2950 2951 void arm_gt_stimer_cb(void *opaque) 2952 { 2953 ARMCPU *cpu = opaque; 2954 2955 gt_recalc_timer(cpu, GTIMER_SEC); 2956 } 2957 2958 void arm_gt_hvtimer_cb(void *opaque) 2959 { 2960 ARMCPU *cpu = opaque; 2961 2962 gt_recalc_timer(cpu, GTIMER_HYPVIRT); 2963 } 2964 2965 static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque) 2966 { 2967 ARMCPU *cpu = env_archcpu(env); 2968 2969 cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz; 2970 } 2971 2972 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 2973 /* Note that CNTFRQ is purely reads-as-written for the benefit 2974 * of software; writing it doesn't actually change the timer frequency. 2975 * Our reset value matches the fixed frequency we implement the timer at. 2976 */ 2977 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 2978 .type = ARM_CP_ALIAS, 2979 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2980 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 2981 }, 2982 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 2983 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 2984 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 2985 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 2986 .resetfn = arm_gt_cntfrq_reset, 2987 }, 2988 /* overall control: mostly access permissions */ 2989 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 2990 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 2991 .access = PL1_RW, 2992 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 2993 .resetvalue = 0, 2994 }, 2995 /* per-timer control */ 2996 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 2997 .secure = ARM_CP_SECSTATE_NS, 2998 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 2999 .accessfn = gt_ptimer_access, 3000 .fieldoffset = offsetoflow32(CPUARMState, 3001 cp15.c14_timer[GTIMER_PHYS].ctl), 3002 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3003 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3004 }, 3005 { .name = "CNTP_CTL_S", 3006 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 3007 .secure = ARM_CP_SECSTATE_S, 3008 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3009 .accessfn = gt_ptimer_access, 3010 .fieldoffset = offsetoflow32(CPUARMState, 3011 cp15.c14_timer[GTIMER_SEC].ctl), 3012 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3013 }, 3014 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 3015 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 3016 .type = ARM_CP_IO, .access = PL0_RW, 3017 .accessfn = gt_ptimer_access, 3018 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 3019 .resetvalue = 0, 3020 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3021 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3022 }, 3023 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 3024 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3025 .accessfn = gt_vtimer_access, 3026 .fieldoffset = offsetoflow32(CPUARMState, 3027 cp15.c14_timer[GTIMER_VIRT].ctl), 3028 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3029 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3030 }, 3031 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 3032 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 3033 .type = ARM_CP_IO, .access = PL0_RW, 3034 .accessfn = gt_vtimer_access, 3035 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 3036 .resetvalue = 0, 3037 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3038 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3039 }, 3040 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 3041 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3042 .secure = ARM_CP_SECSTATE_NS, 3043 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3044 .accessfn = gt_ptimer_access, 3045 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3046 }, 3047 { .name = "CNTP_TVAL_S", 3048 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3049 .secure = ARM_CP_SECSTATE_S, 3050 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3051 .accessfn = gt_ptimer_access, 3052 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 3053 }, 3054 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3055 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 3056 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3057 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 3058 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3059 }, 3060 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 3061 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3062 .accessfn = gt_vtimer_access, 3063 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3064 }, 3065 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3066 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 3067 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3068 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 3069 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3070 }, 3071 /* The counter itself */ 3072 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 3073 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3074 .accessfn = gt_pct_access, 3075 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 3076 }, 3077 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 3078 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 3079 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3080 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 3081 }, 3082 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 3083 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3084 .accessfn = gt_vct_access, 3085 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 3086 }, 3087 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3088 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3089 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3090 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 3091 }, 3092 /* Comparison value, indicating when the timer goes off */ 3093 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 3094 .secure = ARM_CP_SECSTATE_NS, 3095 .access = PL0_RW, 3096 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3097 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3098 .accessfn = gt_ptimer_access, 3099 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3100 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3101 }, 3102 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 3103 .secure = ARM_CP_SECSTATE_S, 3104 .access = PL0_RW, 3105 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3106 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3107 .accessfn = gt_ptimer_access, 3108 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3109 }, 3110 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3111 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 3112 .access = PL0_RW, 3113 .type = ARM_CP_IO, 3114 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3115 .resetvalue = 0, .accessfn = gt_ptimer_access, 3116 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3117 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3118 }, 3119 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 3120 .access = PL0_RW, 3121 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3122 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3123 .accessfn = gt_vtimer_access, 3124 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3125 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3126 }, 3127 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3128 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 3129 .access = PL0_RW, 3130 .type = ARM_CP_IO, 3131 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3132 .resetvalue = 0, .accessfn = gt_vtimer_access, 3133 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3134 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3135 }, 3136 /* Secure timer -- this is actually restricted to only EL3 3137 * and configurably Secure-EL1 via the accessfn. 3138 */ 3139 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 3140 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 3141 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 3142 .accessfn = gt_stimer_access, 3143 .readfn = gt_sec_tval_read, 3144 .writefn = gt_sec_tval_write, 3145 .resetfn = gt_sec_timer_reset, 3146 }, 3147 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 3148 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 3149 .type = ARM_CP_IO, .access = PL1_RW, 3150 .accessfn = gt_stimer_access, 3151 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 3152 .resetvalue = 0, 3153 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3154 }, 3155 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 3156 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 3157 .type = ARM_CP_IO, .access = PL1_RW, 3158 .accessfn = gt_stimer_access, 3159 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3160 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3161 }, 3162 REGINFO_SENTINEL 3163 }; 3164 3165 static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri, 3166 bool isread) 3167 { 3168 if (!(arm_hcr_el2_eff(env) & HCR_E2H)) { 3169 return CP_ACCESS_TRAP; 3170 } 3171 return CP_ACCESS_OK; 3172 } 3173 3174 #else 3175 3176 /* In user-mode most of the generic timer registers are inaccessible 3177 * however modern kernels (4.12+) allow access to cntvct_el0 3178 */ 3179 3180 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 3181 { 3182 ARMCPU *cpu = env_archcpu(env); 3183 3184 /* Currently we have no support for QEMUTimer in linux-user so we 3185 * can't call gt_get_countervalue(env), instead we directly 3186 * call the lower level functions. 3187 */ 3188 return cpu_get_clock() / gt_cntfrq_period_ns(cpu); 3189 } 3190 3191 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 3192 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 3193 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 3194 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 3195 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 3196 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE, 3197 }, 3198 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3199 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3200 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3201 .readfn = gt_virt_cnt_read, 3202 }, 3203 REGINFO_SENTINEL 3204 }; 3205 3206 #endif 3207 3208 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3209 { 3210 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3211 raw_write(env, ri, value); 3212 } else if (arm_feature(env, ARM_FEATURE_V7)) { 3213 raw_write(env, ri, value & 0xfffff6ff); 3214 } else { 3215 raw_write(env, ri, value & 0xfffff1ff); 3216 } 3217 } 3218 3219 #ifndef CONFIG_USER_ONLY 3220 /* get_phys_addr() isn't present for user-mode-only targets */ 3221 3222 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 3223 bool isread) 3224 { 3225 if (ri->opc2 & 4) { 3226 /* The ATS12NSO* operations must trap to EL3 if executed in 3227 * Secure EL1 (which can only happen if EL3 is AArch64). 3228 * They are simply UNDEF if executed from NS EL1. 3229 * They function normally from EL2 or EL3. 3230 */ 3231 if (arm_current_el(env) == 1) { 3232 if (arm_is_secure_below_el3(env)) { 3233 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3; 3234 } 3235 return CP_ACCESS_TRAP_UNCATEGORIZED; 3236 } 3237 } 3238 return CP_ACCESS_OK; 3239 } 3240 3241 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 3242 MMUAccessType access_type, ARMMMUIdx mmu_idx) 3243 { 3244 hwaddr phys_addr; 3245 target_ulong page_size; 3246 int prot; 3247 bool ret; 3248 uint64_t par64; 3249 bool format64 = false; 3250 MemTxAttrs attrs = {}; 3251 ARMMMUFaultInfo fi = {}; 3252 ARMCacheAttrs cacheattrs = {}; 3253 3254 ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs, 3255 &prot, &page_size, &fi, &cacheattrs); 3256 3257 if (ret) { 3258 /* 3259 * Some kinds of translation fault must cause exceptions rather 3260 * than being reported in the PAR. 3261 */ 3262 int current_el = arm_current_el(env); 3263 int target_el; 3264 uint32_t syn, fsr, fsc; 3265 bool take_exc = false; 3266 3267 if (fi.s1ptw && current_el == 1 && !arm_is_secure(env) 3268 && arm_mmu_idx_is_stage1_of_2(mmu_idx)) { 3269 /* 3270 * Synchronous stage 2 fault on an access made as part of the 3271 * translation table walk for AT S1E0* or AT S1E1* insn 3272 * executed from NS EL1. If this is a synchronous external abort 3273 * and SCR_EL3.EA == 1, then we take a synchronous external abort 3274 * to EL3. Otherwise the fault is taken as an exception to EL2, 3275 * and HPFAR_EL2 holds the faulting IPA. 3276 */ 3277 if (fi.type == ARMFault_SyncExternalOnWalk && 3278 (env->cp15.scr_el3 & SCR_EA)) { 3279 target_el = 3; 3280 } else { 3281 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4; 3282 target_el = 2; 3283 } 3284 take_exc = true; 3285 } else if (fi.type == ARMFault_SyncExternalOnWalk) { 3286 /* 3287 * Synchronous external aborts during a translation table walk 3288 * are taken as Data Abort exceptions. 3289 */ 3290 if (fi.stage2) { 3291 if (current_el == 3) { 3292 target_el = 3; 3293 } else { 3294 target_el = 2; 3295 } 3296 } else { 3297 target_el = exception_target_el(env); 3298 } 3299 take_exc = true; 3300 } 3301 3302 if (take_exc) { 3303 /* Construct FSR and FSC using same logic as arm_deliver_fault() */ 3304 if (target_el == 2 || arm_el_is_aa64(env, target_el) || 3305 arm_s1_regime_using_lpae_format(env, mmu_idx)) { 3306 fsr = arm_fi_to_lfsc(&fi); 3307 fsc = extract32(fsr, 0, 6); 3308 } else { 3309 fsr = arm_fi_to_sfsc(&fi); 3310 fsc = 0x3f; 3311 } 3312 /* 3313 * Report exception with ESR indicating a fault due to a 3314 * translation table walk for a cache maintenance instruction. 3315 */ 3316 syn = syn_data_abort_no_iss(current_el == target_el, 3317 fi.ea, 1, fi.s1ptw, 1, fsc); 3318 env->exception.vaddress = value; 3319 env->exception.fsr = fsr; 3320 raise_exception(env, EXCP_DATA_ABORT, syn, target_el); 3321 } 3322 } 3323 3324 if (is_a64(env)) { 3325 format64 = true; 3326 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 3327 /* 3328 * ATS1Cxx: 3329 * * TTBCR.EAE determines whether the result is returned using the 3330 * 32-bit or the 64-bit PAR format 3331 * * Instructions executed in Hyp mode always use the 64bit format 3332 * 3333 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 3334 * * The Non-secure TTBCR.EAE bit is set to 1 3335 * * The implementation includes EL2, and the value of HCR.VM is 1 3336 * 3337 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 3338 * 3339 * ATS1Hx always uses the 64bit format. 3340 */ 3341 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 3342 3343 if (arm_feature(env, ARM_FEATURE_EL2)) { 3344 if (mmu_idx == ARMMMUIdx_E10_0 || 3345 mmu_idx == ARMMMUIdx_E10_1 || 3346 mmu_idx == ARMMMUIdx_E10_1_PAN) { 3347 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 3348 } else { 3349 format64 |= arm_current_el(env) == 2; 3350 } 3351 } 3352 } 3353 3354 if (format64) { 3355 /* Create a 64-bit PAR */ 3356 par64 = (1 << 11); /* LPAE bit always set */ 3357 if (!ret) { 3358 par64 |= phys_addr & ~0xfffULL; 3359 if (!attrs.secure) { 3360 par64 |= (1 << 9); /* NS */ 3361 } 3362 par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */ 3363 par64 |= cacheattrs.shareability << 7; /* SH */ 3364 } else { 3365 uint32_t fsr = arm_fi_to_lfsc(&fi); 3366 3367 par64 |= 1; /* F */ 3368 par64 |= (fsr & 0x3f) << 1; /* FS */ 3369 if (fi.stage2) { 3370 par64 |= (1 << 9); /* S */ 3371 } 3372 if (fi.s1ptw) { 3373 par64 |= (1 << 8); /* PTW */ 3374 } 3375 } 3376 } else { 3377 /* fsr is a DFSR/IFSR value for the short descriptor 3378 * translation table format (with WnR always clear). 3379 * Convert it to a 32-bit PAR. 3380 */ 3381 if (!ret) { 3382 /* We do not set any attribute bits in the PAR */ 3383 if (page_size == (1 << 24) 3384 && arm_feature(env, ARM_FEATURE_V7)) { 3385 par64 = (phys_addr & 0xff000000) | (1 << 1); 3386 } else { 3387 par64 = phys_addr & 0xfffff000; 3388 } 3389 if (!attrs.secure) { 3390 par64 |= (1 << 9); /* NS */ 3391 } 3392 } else { 3393 uint32_t fsr = arm_fi_to_sfsc(&fi); 3394 3395 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 3396 ((fsr & 0xf) << 1) | 1; 3397 } 3398 } 3399 return par64; 3400 } 3401 3402 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3403 { 3404 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3405 uint64_t par64; 3406 ARMMMUIdx mmu_idx; 3407 int el = arm_current_el(env); 3408 bool secure = arm_is_secure_below_el3(env); 3409 3410 switch (ri->opc2 & 6) { 3411 case 0: 3412 /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */ 3413 switch (el) { 3414 case 3: 3415 mmu_idx = ARMMMUIdx_SE3; 3416 break; 3417 case 2: 3418 g_assert(!secure); /* TODO: ARMv8.4-SecEL2 */ 3419 /* fall through */ 3420 case 1: 3421 if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) { 3422 mmu_idx = (secure ? ARMMMUIdx_SE10_1_PAN 3423 : ARMMMUIdx_Stage1_E1_PAN); 3424 } else { 3425 mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_Stage1_E1; 3426 } 3427 break; 3428 default: 3429 g_assert_not_reached(); 3430 } 3431 break; 3432 case 2: 3433 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3434 switch (el) { 3435 case 3: 3436 mmu_idx = ARMMMUIdx_SE10_0; 3437 break; 3438 case 2: 3439 mmu_idx = ARMMMUIdx_Stage1_E0; 3440 break; 3441 case 1: 3442 mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_Stage1_E0; 3443 break; 3444 default: 3445 g_assert_not_reached(); 3446 } 3447 break; 3448 case 4: 3449 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3450 mmu_idx = ARMMMUIdx_E10_1; 3451 break; 3452 case 6: 3453 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3454 mmu_idx = ARMMMUIdx_E10_0; 3455 break; 3456 default: 3457 g_assert_not_reached(); 3458 } 3459 3460 par64 = do_ats_write(env, value, access_type, mmu_idx); 3461 3462 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3463 } 3464 3465 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3466 uint64_t value) 3467 { 3468 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3469 uint64_t par64; 3470 3471 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2); 3472 3473 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3474 } 3475 3476 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3477 bool isread) 3478 { 3479 if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) { 3480 return CP_ACCESS_TRAP; 3481 } 3482 return CP_ACCESS_OK; 3483 } 3484 3485 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3486 uint64_t value) 3487 { 3488 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3489 ARMMMUIdx mmu_idx; 3490 int secure = arm_is_secure_below_el3(env); 3491 3492 switch (ri->opc2 & 6) { 3493 case 0: 3494 switch (ri->opc1) { 3495 case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */ 3496 if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) { 3497 mmu_idx = (secure ? ARMMMUIdx_SE10_1_PAN 3498 : ARMMMUIdx_Stage1_E1_PAN); 3499 } else { 3500 mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_Stage1_E1; 3501 } 3502 break; 3503 case 4: /* AT S1E2R, AT S1E2W */ 3504 mmu_idx = ARMMMUIdx_E2; 3505 break; 3506 case 6: /* AT S1E3R, AT S1E3W */ 3507 mmu_idx = ARMMMUIdx_SE3; 3508 break; 3509 default: 3510 g_assert_not_reached(); 3511 } 3512 break; 3513 case 2: /* AT S1E0R, AT S1E0W */ 3514 mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_Stage1_E0; 3515 break; 3516 case 4: /* AT S12E1R, AT S12E1W */ 3517 mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1; 3518 break; 3519 case 6: /* AT S12E0R, AT S12E0W */ 3520 mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_E10_0; 3521 break; 3522 default: 3523 g_assert_not_reached(); 3524 } 3525 3526 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx); 3527 } 3528 #endif 3529 3530 static const ARMCPRegInfo vapa_cp_reginfo[] = { 3531 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 3532 .access = PL1_RW, .resetvalue = 0, 3533 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 3534 offsetoflow32(CPUARMState, cp15.par_ns) }, 3535 .writefn = par_write }, 3536 #ifndef CONFIG_USER_ONLY 3537 /* This underdecoding is safe because the reginfo is NO_RAW. */ 3538 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 3539 .access = PL1_W, .accessfn = ats_access, 3540 .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 3541 #endif 3542 REGINFO_SENTINEL 3543 }; 3544 3545 /* Return basic MPU access permission bits. */ 3546 static uint32_t simple_mpu_ap_bits(uint32_t val) 3547 { 3548 uint32_t ret; 3549 uint32_t mask; 3550 int i; 3551 ret = 0; 3552 mask = 3; 3553 for (i = 0; i < 16; i += 2) { 3554 ret |= (val >> i) & mask; 3555 mask <<= 2; 3556 } 3557 return ret; 3558 } 3559 3560 /* Pad basic MPU access permission bits to extended format. */ 3561 static uint32_t extended_mpu_ap_bits(uint32_t val) 3562 { 3563 uint32_t ret; 3564 uint32_t mask; 3565 int i; 3566 ret = 0; 3567 mask = 3; 3568 for (i = 0; i < 16; i += 2) { 3569 ret |= (val & mask) << i; 3570 mask <<= 2; 3571 } 3572 return ret; 3573 } 3574 3575 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3576 uint64_t value) 3577 { 3578 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3579 } 3580 3581 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3582 { 3583 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3584 } 3585 3586 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3587 uint64_t value) 3588 { 3589 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3590 } 3591 3592 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3593 { 3594 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3595 } 3596 3597 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3598 { 3599 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3600 3601 if (!u32p) { 3602 return 0; 3603 } 3604 3605 u32p += env->pmsav7.rnr[M_REG_NS]; 3606 return *u32p; 3607 } 3608 3609 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3610 uint64_t value) 3611 { 3612 ARMCPU *cpu = env_archcpu(env); 3613 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3614 3615 if (!u32p) { 3616 return; 3617 } 3618 3619 u32p += env->pmsav7.rnr[M_REG_NS]; 3620 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3621 *u32p = value; 3622 } 3623 3624 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3625 uint64_t value) 3626 { 3627 ARMCPU *cpu = env_archcpu(env); 3628 uint32_t nrgs = cpu->pmsav7_dregion; 3629 3630 if (value >= nrgs) { 3631 qemu_log_mask(LOG_GUEST_ERROR, 3632 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3633 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3634 return; 3635 } 3636 3637 raw_write(env, ri, value); 3638 } 3639 3640 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 3641 /* Reset for all these registers is handled in arm_cpu_reset(), 3642 * because the PMSAv7 is also used by M-profile CPUs, which do 3643 * not register cpregs but still need the state to be reset. 3644 */ 3645 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 3646 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3647 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 3648 .readfn = pmsav7_read, .writefn = pmsav7_write, 3649 .resetfn = arm_cp_reset_ignore }, 3650 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 3651 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3652 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 3653 .readfn = pmsav7_read, .writefn = pmsav7_write, 3654 .resetfn = arm_cp_reset_ignore }, 3655 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 3656 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3657 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 3658 .readfn = pmsav7_read, .writefn = pmsav7_write, 3659 .resetfn = arm_cp_reset_ignore }, 3660 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 3661 .access = PL1_RW, 3662 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 3663 .writefn = pmsav7_rgnr_write, 3664 .resetfn = arm_cp_reset_ignore }, 3665 REGINFO_SENTINEL 3666 }; 3667 3668 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 3669 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3670 .access = PL1_RW, .type = ARM_CP_ALIAS, 3671 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3672 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 3673 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3674 .access = PL1_RW, .type = ARM_CP_ALIAS, 3675 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3676 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 3677 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 3678 .access = PL1_RW, 3679 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3680 .resetvalue = 0, }, 3681 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 3682 .access = PL1_RW, 3683 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3684 .resetvalue = 0, }, 3685 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 3686 .access = PL1_RW, 3687 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 3688 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 3689 .access = PL1_RW, 3690 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 3691 /* Protection region base and size registers */ 3692 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 3693 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3694 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 3695 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 3696 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3697 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 3698 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 3699 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3700 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 3701 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 3702 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3703 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 3704 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 3705 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3706 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 3707 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 3708 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3709 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 3710 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 3711 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3712 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 3713 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 3714 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3715 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 3716 REGINFO_SENTINEL 3717 }; 3718 3719 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri, 3720 uint64_t value) 3721 { 3722 TCR *tcr = raw_ptr(env, ri); 3723 int maskshift = extract32(value, 0, 3); 3724 3725 if (!arm_feature(env, ARM_FEATURE_V8)) { 3726 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 3727 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 3728 * using Long-desciptor translation table format */ 3729 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 3730 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 3731 /* In an implementation that includes the Security Extensions 3732 * TTBCR has additional fields PD0 [4] and PD1 [5] for 3733 * Short-descriptor translation table format. 3734 */ 3735 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 3736 } else { 3737 value &= TTBCR_N; 3738 } 3739 } 3740 3741 /* Update the masks corresponding to the TCR bank being written 3742 * Note that we always calculate mask and base_mask, but 3743 * they are only used for short-descriptor tables (ie if EAE is 0); 3744 * for long-descriptor tables the TCR fields are used differently 3745 * and the mask and base_mask values are meaningless. 3746 */ 3747 tcr->raw_tcr = value; 3748 tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift); 3749 tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift); 3750 } 3751 3752 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3753 uint64_t value) 3754 { 3755 ARMCPU *cpu = env_archcpu(env); 3756 TCR *tcr = raw_ptr(env, ri); 3757 3758 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3759 /* With LPAE the TTBCR could result in a change of ASID 3760 * via the TTBCR.A1 bit, so do a TLB flush. 3761 */ 3762 tlb_flush(CPU(cpu)); 3763 } 3764 /* Preserve the high half of TCR_EL1, set via TTBCR2. */ 3765 value = deposit64(tcr->raw_tcr, 0, 32, value); 3766 vmsa_ttbcr_raw_write(env, ri, value); 3767 } 3768 3769 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3770 { 3771 TCR *tcr = raw_ptr(env, ri); 3772 3773 /* Reset both the TCR as well as the masks corresponding to the bank of 3774 * the TCR being reset. 3775 */ 3776 tcr->raw_tcr = 0; 3777 tcr->mask = 0; 3778 tcr->base_mask = 0xffffc000u; 3779 } 3780 3781 static void vmsa_tcr_el12_write(CPUARMState *env, const ARMCPRegInfo *ri, 3782 uint64_t value) 3783 { 3784 ARMCPU *cpu = env_archcpu(env); 3785 TCR *tcr = raw_ptr(env, ri); 3786 3787 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 3788 tlb_flush(CPU(cpu)); 3789 tcr->raw_tcr = value; 3790 } 3791 3792 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3793 uint64_t value) 3794 { 3795 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 3796 if (cpreg_field_is_64bit(ri) && 3797 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 3798 ARMCPU *cpu = env_archcpu(env); 3799 tlb_flush(CPU(cpu)); 3800 } 3801 raw_write(env, ri, value); 3802 } 3803 3804 static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 3805 uint64_t value) 3806 { 3807 /* 3808 * If we are running with E2&0 regime, then an ASID is active. 3809 * Flush if that might be changing. Note we're not checking 3810 * TCR_EL2.A1 to know if this is really the TTBRx_EL2 that 3811 * holds the active ASID, only checking the field that might. 3812 */ 3813 if (extract64(raw_read(env, ri) ^ value, 48, 16) && 3814 (arm_hcr_el2_eff(env) & HCR_E2H)) { 3815 tlb_flush_by_mmuidx(env_cpu(env), 3816 ARMMMUIdxBit_E20_2 | 3817 ARMMMUIdxBit_E20_2_PAN | 3818 ARMMMUIdxBit_E20_0); 3819 } 3820 raw_write(env, ri, value); 3821 } 3822 3823 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3824 uint64_t value) 3825 { 3826 ARMCPU *cpu = env_archcpu(env); 3827 CPUState *cs = CPU(cpu); 3828 3829 /* 3830 * A change in VMID to the stage2 page table (Stage2) invalidates 3831 * the combined stage 1&2 tlbs (EL10_1 and EL10_0). 3832 */ 3833 if (raw_read(env, ri) != value) { 3834 tlb_flush_by_mmuidx(cs, 3835 ARMMMUIdxBit_E10_1 | 3836 ARMMMUIdxBit_E10_1_PAN | 3837 ARMMMUIdxBit_E10_0 | 3838 ARMMMUIdxBit_Stage2); 3839 raw_write(env, ri, value); 3840 } 3841 } 3842 3843 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 3844 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3845 .access = PL1_RW, .type = ARM_CP_ALIAS, 3846 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 3847 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 3848 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3849 .access = PL1_RW, .resetvalue = 0, 3850 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 3851 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 3852 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 3853 .access = PL1_RW, .resetvalue = 0, 3854 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 3855 offsetof(CPUARMState, cp15.dfar_ns) } }, 3856 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 3857 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 3858 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 3859 .resetvalue = 0, }, 3860 REGINFO_SENTINEL 3861 }; 3862 3863 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 3864 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 3865 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 3866 .access = PL1_RW, 3867 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 3868 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 3869 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 3870 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3871 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 3872 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 3873 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 3874 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 3875 .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0, 3876 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 3877 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 3878 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 3879 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3880 .access = PL1_RW, .writefn = vmsa_tcr_el12_write, 3881 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write, 3882 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 3883 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 3884 .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 3885 .raw_writefn = vmsa_ttbcr_raw_write, 3886 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 3887 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 3888 REGINFO_SENTINEL 3889 }; 3890 3891 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing 3892 * qemu tlbs nor adjusting cached masks. 3893 */ 3894 static const ARMCPRegInfo ttbcr2_reginfo = { 3895 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 3896 .access = PL1_RW, .type = ARM_CP_ALIAS, 3897 .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 3898 offsetofhigh32(CPUARMState, cp15.tcr_el[1]) }, 3899 }; 3900 3901 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 3902 uint64_t value) 3903 { 3904 env->cp15.c15_ticonfig = value & 0xe7; 3905 /* The OS_TYPE bit in this register changes the reported CPUID! */ 3906 env->cp15.c0_cpuid = (value & (1 << 5)) ? 3907 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 3908 } 3909 3910 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 3911 uint64_t value) 3912 { 3913 env->cp15.c15_threadid = value & 0xffff; 3914 } 3915 3916 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 3917 uint64_t value) 3918 { 3919 /* Wait-for-interrupt (deprecated) */ 3920 cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT); 3921 } 3922 3923 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 3924 uint64_t value) 3925 { 3926 /* On OMAP there are registers indicating the max/min index of dcache lines 3927 * containing a dirty line; cache flush operations have to reset these. 3928 */ 3929 env->cp15.c15_i_max = 0x000; 3930 env->cp15.c15_i_min = 0xff0; 3931 } 3932 3933 static const ARMCPRegInfo omap_cp_reginfo[] = { 3934 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 3935 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 3936 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 3937 .resetvalue = 0, }, 3938 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 3939 .access = PL1_RW, .type = ARM_CP_NOP }, 3940 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 3941 .access = PL1_RW, 3942 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 3943 .writefn = omap_ticonfig_write }, 3944 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 3945 .access = PL1_RW, 3946 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 3947 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 3948 .access = PL1_RW, .resetvalue = 0xff0, 3949 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 3950 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 3951 .access = PL1_RW, 3952 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 3953 .writefn = omap_threadid_write }, 3954 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 3955 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3956 .type = ARM_CP_NO_RAW, 3957 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 3958 /* TODO: Peripheral port remap register: 3959 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 3960 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 3961 * when MMU is off. 3962 */ 3963 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 3964 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 3965 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 3966 .writefn = omap_cachemaint_write }, 3967 { .name = "C9", .cp = 15, .crn = 9, 3968 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 3969 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 3970 REGINFO_SENTINEL 3971 }; 3972 3973 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3974 uint64_t value) 3975 { 3976 env->cp15.c15_cpar = value & 0x3fff; 3977 } 3978 3979 static const ARMCPRegInfo xscale_cp_reginfo[] = { 3980 { .name = "XSCALE_CPAR", 3981 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 3982 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 3983 .writefn = xscale_cpar_write, }, 3984 { .name = "XSCALE_AUXCR", 3985 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 3986 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 3987 .resetvalue = 0, }, 3988 /* XScale specific cache-lockdown: since we have no cache we NOP these 3989 * and hope the guest does not really rely on cache behaviour. 3990 */ 3991 { .name = "XSCALE_LOCK_ICACHE_LINE", 3992 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 3993 .access = PL1_W, .type = ARM_CP_NOP }, 3994 { .name = "XSCALE_UNLOCK_ICACHE", 3995 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 3996 .access = PL1_W, .type = ARM_CP_NOP }, 3997 { .name = "XSCALE_DCACHE_LOCK", 3998 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 3999 .access = PL1_RW, .type = ARM_CP_NOP }, 4000 { .name = "XSCALE_UNLOCK_DCACHE", 4001 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 4002 .access = PL1_W, .type = ARM_CP_NOP }, 4003 REGINFO_SENTINEL 4004 }; 4005 4006 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 4007 /* RAZ/WI the whole crn=15 space, when we don't have a more specific 4008 * implementation of this implementation-defined space. 4009 * Ideally this should eventually disappear in favour of actually 4010 * implementing the correct behaviour for all cores. 4011 */ 4012 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 4013 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4014 .access = PL1_RW, 4015 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 4016 .resetvalue = 0 }, 4017 REGINFO_SENTINEL 4018 }; 4019 4020 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 4021 /* Cache status: RAZ because we have no cache so it's always clean */ 4022 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 4023 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4024 .resetvalue = 0 }, 4025 REGINFO_SENTINEL 4026 }; 4027 4028 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 4029 /* We never have a a block transfer operation in progress */ 4030 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 4031 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4032 .resetvalue = 0 }, 4033 /* The cache ops themselves: these all NOP for QEMU */ 4034 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 4035 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4036 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 4037 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4038 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 4039 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4040 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 4041 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4042 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 4043 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4044 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 4045 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT }, 4046 REGINFO_SENTINEL 4047 }; 4048 4049 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 4050 /* The cache test-and-clean instructions always return (1 << 30) 4051 * to indicate that there are no dirty cache lines. 4052 */ 4053 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 4054 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4055 .resetvalue = (1 << 30) }, 4056 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 4057 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4058 .resetvalue = (1 << 30) }, 4059 REGINFO_SENTINEL 4060 }; 4061 4062 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 4063 /* Ignore ReadBuffer accesses */ 4064 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 4065 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4066 .access = PL1_RW, .resetvalue = 0, 4067 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 4068 REGINFO_SENTINEL 4069 }; 4070 4071 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4072 { 4073 ARMCPU *cpu = env_archcpu(env); 4074 unsigned int cur_el = arm_current_el(env); 4075 bool secure = arm_is_secure(env); 4076 4077 if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 4078 return env->cp15.vpidr_el2; 4079 } 4080 return raw_read(env, ri); 4081 } 4082 4083 static uint64_t mpidr_read_val(CPUARMState *env) 4084 { 4085 ARMCPU *cpu = env_archcpu(env); 4086 uint64_t mpidr = cpu->mp_affinity; 4087 4088 if (arm_feature(env, ARM_FEATURE_V7MP)) { 4089 mpidr |= (1U << 31); 4090 /* Cores which are uniprocessor (non-coherent) 4091 * but still implement the MP extensions set 4092 * bit 30. (For instance, Cortex-R5). 4093 */ 4094 if (cpu->mp_is_up) { 4095 mpidr |= (1u << 30); 4096 } 4097 } 4098 return mpidr; 4099 } 4100 4101 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4102 { 4103 unsigned int cur_el = arm_current_el(env); 4104 bool secure = arm_is_secure(env); 4105 4106 if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) { 4107 return env->cp15.vmpidr_el2; 4108 } 4109 return mpidr_read_val(env); 4110 } 4111 4112 static const ARMCPRegInfo lpae_cp_reginfo[] = { 4113 /* NOP AMAIR0/1 */ 4114 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 4115 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 4116 .access = PL1_RW, .type = ARM_CP_CONST, 4117 .resetvalue = 0 }, 4118 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 4119 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 4120 .access = PL1_RW, .type = ARM_CP_CONST, 4121 .resetvalue = 0 }, 4122 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 4123 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 4124 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 4125 offsetof(CPUARMState, cp15.par_ns)} }, 4126 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 4127 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4128 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 4129 offsetof(CPUARMState, cp15.ttbr0_ns) }, 4130 .writefn = vmsa_ttbr_write, }, 4131 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 4132 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4133 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 4134 offsetof(CPUARMState, cp15.ttbr1_ns) }, 4135 .writefn = vmsa_ttbr_write, }, 4136 REGINFO_SENTINEL 4137 }; 4138 4139 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4140 { 4141 return vfp_get_fpcr(env); 4142 } 4143 4144 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4145 uint64_t value) 4146 { 4147 vfp_set_fpcr(env, value); 4148 } 4149 4150 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4151 { 4152 return vfp_get_fpsr(env); 4153 } 4154 4155 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4156 uint64_t value) 4157 { 4158 vfp_set_fpsr(env, value); 4159 } 4160 4161 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 4162 bool isread) 4163 { 4164 if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UMA)) { 4165 return CP_ACCESS_TRAP; 4166 } 4167 return CP_ACCESS_OK; 4168 } 4169 4170 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 4171 uint64_t value) 4172 { 4173 env->daif = value & PSTATE_DAIF; 4174 } 4175 4176 static uint64_t aa64_pan_read(CPUARMState *env, const ARMCPRegInfo *ri) 4177 { 4178 return env->pstate & PSTATE_PAN; 4179 } 4180 4181 static void aa64_pan_write(CPUARMState *env, const ARMCPRegInfo *ri, 4182 uint64_t value) 4183 { 4184 env->pstate = (env->pstate & ~PSTATE_PAN) | (value & PSTATE_PAN); 4185 } 4186 4187 static const ARMCPRegInfo pan_reginfo = { 4188 .name = "PAN", .state = ARM_CP_STATE_AA64, 4189 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 3, 4190 .type = ARM_CP_NO_RAW, .access = PL1_RW, 4191 .readfn = aa64_pan_read, .writefn = aa64_pan_write 4192 }; 4193 4194 static uint64_t aa64_uao_read(CPUARMState *env, const ARMCPRegInfo *ri) 4195 { 4196 return env->pstate & PSTATE_UAO; 4197 } 4198 4199 static void aa64_uao_write(CPUARMState *env, const ARMCPRegInfo *ri, 4200 uint64_t value) 4201 { 4202 env->pstate = (env->pstate & ~PSTATE_UAO) | (value & PSTATE_UAO); 4203 } 4204 4205 static const ARMCPRegInfo uao_reginfo = { 4206 .name = "UAO", .state = ARM_CP_STATE_AA64, 4207 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 4, 4208 .type = ARM_CP_NO_RAW, .access = PL1_RW, 4209 .readfn = aa64_uao_read, .writefn = aa64_uao_write 4210 }; 4211 4212 static CPAccessResult aa64_cacheop_access(CPUARMState *env, 4213 const ARMCPRegInfo *ri, 4214 bool isread) 4215 { 4216 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless 4217 * SCTLR_EL1.UCI is set. 4218 */ 4219 if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UCI)) { 4220 return CP_ACCESS_TRAP; 4221 } 4222 return CP_ACCESS_OK; 4223 } 4224 4225 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 4226 * Page D4-1736 (DDI0487A.b) 4227 */ 4228 4229 static int vae1_tlbmask(CPUARMState *env) 4230 { 4231 /* Since we exclude secure first, we may read HCR_EL2 directly. */ 4232 if (arm_is_secure_below_el3(env)) { 4233 return ARMMMUIdxBit_SE10_1 | 4234 ARMMMUIdxBit_SE10_1_PAN | 4235 ARMMMUIdxBit_SE10_0; 4236 } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE)) 4237 == (HCR_E2H | HCR_TGE)) { 4238 return ARMMMUIdxBit_E20_2 | 4239 ARMMMUIdxBit_E20_2_PAN | 4240 ARMMMUIdxBit_E20_0; 4241 } else { 4242 return ARMMMUIdxBit_E10_1 | 4243 ARMMMUIdxBit_E10_1_PAN | 4244 ARMMMUIdxBit_E10_0; 4245 } 4246 } 4247 4248 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4249 uint64_t value) 4250 { 4251 CPUState *cs = env_cpu(env); 4252 int mask = vae1_tlbmask(env); 4253 4254 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4255 } 4256 4257 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4258 uint64_t value) 4259 { 4260 CPUState *cs = env_cpu(env); 4261 int mask = vae1_tlbmask(env); 4262 4263 if (tlb_force_broadcast(env)) { 4264 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4265 } else { 4266 tlb_flush_by_mmuidx(cs, mask); 4267 } 4268 } 4269 4270 static int alle1_tlbmask(CPUARMState *env) 4271 { 4272 /* 4273 * Note that the 'ALL' scope must invalidate both stage 1 and 4274 * stage 2 translations, whereas most other scopes only invalidate 4275 * stage 1 translations. 4276 */ 4277 if (arm_is_secure_below_el3(env)) { 4278 return ARMMMUIdxBit_SE10_1 | 4279 ARMMMUIdxBit_SE10_1_PAN | 4280 ARMMMUIdxBit_SE10_0; 4281 } else if (arm_feature(env, ARM_FEATURE_EL2)) { 4282 return ARMMMUIdxBit_E10_1 | 4283 ARMMMUIdxBit_E10_1_PAN | 4284 ARMMMUIdxBit_E10_0 | 4285 ARMMMUIdxBit_Stage2; 4286 } else { 4287 return ARMMMUIdxBit_E10_1 | 4288 ARMMMUIdxBit_E10_1_PAN | 4289 ARMMMUIdxBit_E10_0; 4290 } 4291 } 4292 4293 static int e2_tlbmask(CPUARMState *env) 4294 { 4295 /* TODO: ARMv8.4-SecEL2 */ 4296 return ARMMMUIdxBit_E20_0 | 4297 ARMMMUIdxBit_E20_2 | 4298 ARMMMUIdxBit_E20_2_PAN | 4299 ARMMMUIdxBit_E2; 4300 } 4301 4302 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4303 uint64_t value) 4304 { 4305 CPUState *cs = env_cpu(env); 4306 int mask = alle1_tlbmask(env); 4307 4308 tlb_flush_by_mmuidx(cs, mask); 4309 } 4310 4311 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4312 uint64_t value) 4313 { 4314 CPUState *cs = env_cpu(env); 4315 int mask = e2_tlbmask(env); 4316 4317 tlb_flush_by_mmuidx(cs, mask); 4318 } 4319 4320 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 4321 uint64_t value) 4322 { 4323 ARMCPU *cpu = env_archcpu(env); 4324 CPUState *cs = CPU(cpu); 4325 4326 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_SE3); 4327 } 4328 4329 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4330 uint64_t value) 4331 { 4332 CPUState *cs = env_cpu(env); 4333 int mask = alle1_tlbmask(env); 4334 4335 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4336 } 4337 4338 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4339 uint64_t value) 4340 { 4341 CPUState *cs = env_cpu(env); 4342 int mask = e2_tlbmask(env); 4343 4344 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4345 } 4346 4347 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4348 uint64_t value) 4349 { 4350 CPUState *cs = env_cpu(env); 4351 4352 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_SE3); 4353 } 4354 4355 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4356 uint64_t value) 4357 { 4358 /* Invalidate by VA, EL2 4359 * Currently handles both VAE2 and VALE2, since we don't support 4360 * flush-last-level-only. 4361 */ 4362 CPUState *cs = env_cpu(env); 4363 int mask = e2_tlbmask(env); 4364 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4365 4366 tlb_flush_page_by_mmuidx(cs, pageaddr, mask); 4367 } 4368 4369 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 4370 uint64_t value) 4371 { 4372 /* Invalidate by VA, EL3 4373 * Currently handles both VAE3 and VALE3, since we don't support 4374 * flush-last-level-only. 4375 */ 4376 ARMCPU *cpu = env_archcpu(env); 4377 CPUState *cs = CPU(cpu); 4378 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4379 4380 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_SE3); 4381 } 4382 4383 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4384 uint64_t value) 4385 { 4386 CPUState *cs = env_cpu(env); 4387 int mask = vae1_tlbmask(env); 4388 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4389 4390 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask); 4391 } 4392 4393 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4394 uint64_t value) 4395 { 4396 /* Invalidate by VA, EL1&0 (AArch64 version). 4397 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 4398 * since we don't support flush-for-specific-ASID-only or 4399 * flush-last-level-only. 4400 */ 4401 CPUState *cs = env_cpu(env); 4402 int mask = vae1_tlbmask(env); 4403 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4404 4405 if (tlb_force_broadcast(env)) { 4406 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask); 4407 } else { 4408 tlb_flush_page_by_mmuidx(cs, pageaddr, mask); 4409 } 4410 } 4411 4412 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4413 uint64_t value) 4414 { 4415 CPUState *cs = env_cpu(env); 4416 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4417 4418 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4419 ARMMMUIdxBit_E2); 4420 } 4421 4422 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4423 uint64_t value) 4424 { 4425 CPUState *cs = env_cpu(env); 4426 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4427 4428 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4429 ARMMMUIdxBit_SE3); 4430 } 4431 4432 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4433 uint64_t value) 4434 { 4435 /* Invalidate by IPA. This has to invalidate any structures that 4436 * contain only stage 2 translation information, but does not need 4437 * to apply to structures that contain combined stage 1 and stage 2 4438 * translation information. 4439 * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero. 4440 */ 4441 ARMCPU *cpu = env_archcpu(env); 4442 CPUState *cs = CPU(cpu); 4443 uint64_t pageaddr; 4444 4445 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 4446 return; 4447 } 4448 4449 pageaddr = sextract64(value << 12, 0, 48); 4450 4451 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2); 4452 } 4453 4454 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4455 uint64_t value) 4456 { 4457 CPUState *cs = env_cpu(env); 4458 uint64_t pageaddr; 4459 4460 if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) { 4461 return; 4462 } 4463 4464 pageaddr = sextract64(value << 12, 0, 48); 4465 4466 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 4467 ARMMMUIdxBit_Stage2); 4468 } 4469 4470 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 4471 bool isread) 4472 { 4473 int cur_el = arm_current_el(env); 4474 4475 if (cur_el < 2) { 4476 uint64_t hcr = arm_hcr_el2_eff(env); 4477 4478 if (cur_el == 0) { 4479 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 4480 if (!(env->cp15.sctlr_el[2] & SCTLR_DZE)) { 4481 return CP_ACCESS_TRAP_EL2; 4482 } 4483 } else { 4484 if (!(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 4485 return CP_ACCESS_TRAP; 4486 } 4487 if (hcr & HCR_TDZ) { 4488 return CP_ACCESS_TRAP_EL2; 4489 } 4490 } 4491 } else if (hcr & HCR_TDZ) { 4492 return CP_ACCESS_TRAP_EL2; 4493 } 4494 } 4495 return CP_ACCESS_OK; 4496 } 4497 4498 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 4499 { 4500 ARMCPU *cpu = env_archcpu(env); 4501 int dzp_bit = 1 << 4; 4502 4503 /* DZP indicates whether DC ZVA access is allowed */ 4504 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 4505 dzp_bit = 0; 4506 } 4507 return cpu->dcz_blocksize | dzp_bit; 4508 } 4509 4510 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 4511 bool isread) 4512 { 4513 if (!(env->pstate & PSTATE_SP)) { 4514 /* Access to SP_EL0 is undefined if it's being used as 4515 * the stack pointer. 4516 */ 4517 return CP_ACCESS_TRAP_UNCATEGORIZED; 4518 } 4519 return CP_ACCESS_OK; 4520 } 4521 4522 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 4523 { 4524 return env->pstate & PSTATE_SP; 4525 } 4526 4527 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 4528 { 4529 update_spsel(env, val); 4530 } 4531 4532 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4533 uint64_t value) 4534 { 4535 ARMCPU *cpu = env_archcpu(env); 4536 4537 if (raw_read(env, ri) == value) { 4538 /* Skip the TLB flush if nothing actually changed; Linux likes 4539 * to do a lot of pointless SCTLR writes. 4540 */ 4541 return; 4542 } 4543 4544 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 4545 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 4546 value &= ~SCTLR_M; 4547 } 4548 4549 raw_write(env, ri, value); 4550 /* ??? Lots of these bits are not implemented. */ 4551 /* This may enable/disable the MMU, so do a TLB flush. */ 4552 tlb_flush(CPU(cpu)); 4553 4554 if (ri->type & ARM_CP_SUPPRESS_TB_END) { 4555 /* 4556 * Normally we would always end the TB on an SCTLR write; see the 4557 * comment in ARMCPRegInfo sctlr initialization below for why Xscale 4558 * is special. Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild 4559 * of hflags from the translator, so do it here. 4560 */ 4561 arm_rebuild_hflags(env); 4562 } 4563 } 4564 4565 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri, 4566 bool isread) 4567 { 4568 if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) { 4569 return CP_ACCESS_TRAP_FP_EL2; 4570 } 4571 if (env->cp15.cptr_el[3] & CPTR_TFP) { 4572 return CP_ACCESS_TRAP_FP_EL3; 4573 } 4574 return CP_ACCESS_OK; 4575 } 4576 4577 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4578 uint64_t value) 4579 { 4580 env->cp15.mdcr_el3 = value & SDCR_VALID_MASK; 4581 } 4582 4583 static const ARMCPRegInfo v8_cp_reginfo[] = { 4584 /* Minimal set of EL0-visible registers. This will need to be expanded 4585 * significantly for system emulation of AArch64 CPUs. 4586 */ 4587 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 4588 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 4589 .access = PL0_RW, .type = ARM_CP_NZCV }, 4590 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 4591 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 4592 .type = ARM_CP_NO_RAW, 4593 .access = PL0_RW, .accessfn = aa64_daif_access, 4594 .fieldoffset = offsetof(CPUARMState, daif), 4595 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 4596 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 4597 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 4598 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4599 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 4600 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 4601 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 4602 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 4603 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 4604 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 4605 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 4606 .access = PL0_R, .type = ARM_CP_NO_RAW, 4607 .readfn = aa64_dczid_read }, 4608 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 4609 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 4610 .access = PL0_W, .type = ARM_CP_DC_ZVA, 4611 #ifndef CONFIG_USER_ONLY 4612 /* Avoid overhead of an access check that always passes in user-mode */ 4613 .accessfn = aa64_zva_access, 4614 #endif 4615 }, 4616 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 4617 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 4618 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 4619 /* Cache ops: all NOPs since we don't emulate caches */ 4620 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 4621 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4622 .access = PL1_W, .type = ARM_CP_NOP }, 4623 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 4624 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4625 .access = PL1_W, .type = ARM_CP_NOP }, 4626 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 4627 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 4628 .access = PL0_W, .type = ARM_CP_NOP, 4629 .accessfn = aa64_cacheop_access }, 4630 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 4631 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4632 .access = PL1_W, .type = ARM_CP_NOP }, 4633 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 4634 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4635 .access = PL1_W, .type = ARM_CP_NOP }, 4636 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 4637 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 4638 .access = PL0_W, .type = ARM_CP_NOP, 4639 .accessfn = aa64_cacheop_access }, 4640 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 4641 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4642 .access = PL1_W, .type = ARM_CP_NOP }, 4643 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 4644 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 4645 .access = PL0_W, .type = ARM_CP_NOP, 4646 .accessfn = aa64_cacheop_access }, 4647 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 4648 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 4649 .access = PL0_W, .type = ARM_CP_NOP, 4650 .accessfn = aa64_cacheop_access }, 4651 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 4652 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4653 .access = PL1_W, .type = ARM_CP_NOP }, 4654 /* TLBI operations */ 4655 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 4656 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 4657 .access = PL1_W, .type = ARM_CP_NO_RAW, 4658 .writefn = tlbi_aa64_vmalle1is_write }, 4659 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 4660 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 4661 .access = PL1_W, .type = ARM_CP_NO_RAW, 4662 .writefn = tlbi_aa64_vae1is_write }, 4663 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 4664 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 4665 .access = PL1_W, .type = ARM_CP_NO_RAW, 4666 .writefn = tlbi_aa64_vmalle1is_write }, 4667 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 4668 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 4669 .access = PL1_W, .type = ARM_CP_NO_RAW, 4670 .writefn = tlbi_aa64_vae1is_write }, 4671 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 4672 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4673 .access = PL1_W, .type = ARM_CP_NO_RAW, 4674 .writefn = tlbi_aa64_vae1is_write }, 4675 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 4676 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4677 .access = PL1_W, .type = ARM_CP_NO_RAW, 4678 .writefn = tlbi_aa64_vae1is_write }, 4679 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 4680 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 4681 .access = PL1_W, .type = ARM_CP_NO_RAW, 4682 .writefn = tlbi_aa64_vmalle1_write }, 4683 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 4684 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 4685 .access = PL1_W, .type = ARM_CP_NO_RAW, 4686 .writefn = tlbi_aa64_vae1_write }, 4687 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 4688 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 4689 .access = PL1_W, .type = ARM_CP_NO_RAW, 4690 .writefn = tlbi_aa64_vmalle1_write }, 4691 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 4692 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 4693 .access = PL1_W, .type = ARM_CP_NO_RAW, 4694 .writefn = tlbi_aa64_vae1_write }, 4695 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 4696 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4697 .access = PL1_W, .type = ARM_CP_NO_RAW, 4698 .writefn = tlbi_aa64_vae1_write }, 4699 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 4700 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4701 .access = PL1_W, .type = ARM_CP_NO_RAW, 4702 .writefn = tlbi_aa64_vae1_write }, 4703 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 4704 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4705 .access = PL2_W, .type = ARM_CP_NO_RAW, 4706 .writefn = tlbi_aa64_ipas2e1is_write }, 4707 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 4708 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4709 .access = PL2_W, .type = ARM_CP_NO_RAW, 4710 .writefn = tlbi_aa64_ipas2e1is_write }, 4711 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 4712 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 4713 .access = PL2_W, .type = ARM_CP_NO_RAW, 4714 .writefn = tlbi_aa64_alle1is_write }, 4715 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 4716 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 4717 .access = PL2_W, .type = ARM_CP_NO_RAW, 4718 .writefn = tlbi_aa64_alle1is_write }, 4719 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 4720 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4721 .access = PL2_W, .type = ARM_CP_NO_RAW, 4722 .writefn = tlbi_aa64_ipas2e1_write }, 4723 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 4724 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4725 .access = PL2_W, .type = ARM_CP_NO_RAW, 4726 .writefn = tlbi_aa64_ipas2e1_write }, 4727 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 4728 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 4729 .access = PL2_W, .type = ARM_CP_NO_RAW, 4730 .writefn = tlbi_aa64_alle1_write }, 4731 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 4732 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 4733 .access = PL2_W, .type = ARM_CP_NO_RAW, 4734 .writefn = tlbi_aa64_alle1is_write }, 4735 #ifndef CONFIG_USER_ONLY 4736 /* 64 bit address translation operations */ 4737 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 4738 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 4739 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4740 .writefn = ats_write64 }, 4741 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 4742 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 4743 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4744 .writefn = ats_write64 }, 4745 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 4746 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 4747 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4748 .writefn = ats_write64 }, 4749 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 4750 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 4751 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4752 .writefn = ats_write64 }, 4753 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 4754 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 4755 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4756 .writefn = ats_write64 }, 4757 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 4758 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 4759 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4760 .writefn = ats_write64 }, 4761 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 4762 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 4763 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4764 .writefn = ats_write64 }, 4765 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 4766 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 4767 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4768 .writefn = ats_write64 }, 4769 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 4770 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 4771 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 4772 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4773 .writefn = ats_write64 }, 4774 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 4775 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 4776 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 4777 .writefn = ats_write64 }, 4778 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 4779 .type = ARM_CP_ALIAS, 4780 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 4781 .access = PL1_RW, .resetvalue = 0, 4782 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 4783 .writefn = par_write }, 4784 #endif 4785 /* TLB invalidate last level of translation table walk */ 4786 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 4787 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write }, 4788 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 4789 .type = ARM_CP_NO_RAW, .access = PL1_W, 4790 .writefn = tlbimvaa_is_write }, 4791 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 4792 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write }, 4793 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 4794 .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write }, 4795 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 4796 .type = ARM_CP_NO_RAW, .access = PL2_W, 4797 .writefn = tlbimva_hyp_write }, 4798 { .name = "TLBIMVALHIS", 4799 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 4800 .type = ARM_CP_NO_RAW, .access = PL2_W, 4801 .writefn = tlbimva_hyp_is_write }, 4802 { .name = "TLBIIPAS2", 4803 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 4804 .type = ARM_CP_NO_RAW, .access = PL2_W, 4805 .writefn = tlbiipas2_write }, 4806 { .name = "TLBIIPAS2IS", 4807 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 4808 .type = ARM_CP_NO_RAW, .access = PL2_W, 4809 .writefn = tlbiipas2_is_write }, 4810 { .name = "TLBIIPAS2L", 4811 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 4812 .type = ARM_CP_NO_RAW, .access = PL2_W, 4813 .writefn = tlbiipas2_write }, 4814 { .name = "TLBIIPAS2LIS", 4815 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 4816 .type = ARM_CP_NO_RAW, .access = PL2_W, 4817 .writefn = tlbiipas2_is_write }, 4818 /* 32 bit cache operations */ 4819 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 4820 .type = ARM_CP_NOP, .access = PL1_W }, 4821 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 4822 .type = ARM_CP_NOP, .access = PL1_W }, 4823 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 4824 .type = ARM_CP_NOP, .access = PL1_W }, 4825 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 4826 .type = ARM_CP_NOP, .access = PL1_W }, 4827 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 4828 .type = ARM_CP_NOP, .access = PL1_W }, 4829 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 4830 .type = ARM_CP_NOP, .access = PL1_W }, 4831 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 4832 .type = ARM_CP_NOP, .access = PL1_W }, 4833 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 4834 .type = ARM_CP_NOP, .access = PL1_W }, 4835 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 4836 .type = ARM_CP_NOP, .access = PL1_W }, 4837 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 4838 .type = ARM_CP_NOP, .access = PL1_W }, 4839 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 4840 .type = ARM_CP_NOP, .access = PL1_W }, 4841 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 4842 .type = ARM_CP_NOP, .access = PL1_W }, 4843 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 4844 .type = ARM_CP_NOP, .access = PL1_W }, 4845 /* MMU Domain access control / MPU write buffer control */ 4846 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 4847 .access = PL1_RW, .resetvalue = 0, 4848 .writefn = dacr_write, .raw_writefn = raw_write, 4849 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 4850 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 4851 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 4852 .type = ARM_CP_ALIAS, 4853 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 4854 .access = PL1_RW, 4855 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 4856 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 4857 .type = ARM_CP_ALIAS, 4858 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 4859 .access = PL1_RW, 4860 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 4861 /* We rely on the access checks not allowing the guest to write to the 4862 * state field when SPSel indicates that it's being used as the stack 4863 * pointer. 4864 */ 4865 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 4866 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 4867 .access = PL1_RW, .accessfn = sp_el0_access, 4868 .type = ARM_CP_ALIAS, 4869 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 4870 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 4871 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 4872 .access = PL2_RW, .type = ARM_CP_ALIAS, 4873 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 4874 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 4875 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 4876 .type = ARM_CP_NO_RAW, 4877 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 4878 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 4879 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 4880 .type = ARM_CP_ALIAS, 4881 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]), 4882 .access = PL2_RW, .accessfn = fpexc32_access }, 4883 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 4884 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 4885 .access = PL2_RW, .resetvalue = 0, 4886 .writefn = dacr_write, .raw_writefn = raw_write, 4887 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 4888 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 4889 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 4890 .access = PL2_RW, .resetvalue = 0, 4891 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 4892 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 4893 .type = ARM_CP_ALIAS, 4894 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 4895 .access = PL2_RW, 4896 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 4897 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 4898 .type = ARM_CP_ALIAS, 4899 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 4900 .access = PL2_RW, 4901 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 4902 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 4903 .type = ARM_CP_ALIAS, 4904 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 4905 .access = PL2_RW, 4906 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 4907 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 4908 .type = ARM_CP_ALIAS, 4909 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 4910 .access = PL2_RW, 4911 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 4912 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 4913 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 4914 .resetvalue = 0, 4915 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 4916 { .name = "SDCR", .type = ARM_CP_ALIAS, 4917 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 4918 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 4919 .writefn = sdcr_write, 4920 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 4921 REGINFO_SENTINEL 4922 }; 4923 4924 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */ 4925 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = { 4926 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 4927 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 4928 .access = PL2_RW, 4929 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore }, 4930 { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH, 4931 .type = ARM_CP_NO_RAW, 4932 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 4933 .access = PL2_RW, 4934 .type = ARM_CP_CONST, .resetvalue = 0 }, 4935 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 4936 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 4937 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4938 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 4939 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 4940 .access = PL2_RW, 4941 .type = ARM_CP_CONST, .resetvalue = 0 }, 4942 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 4943 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 4944 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4945 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 4946 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 4947 .access = PL2_RW, .type = ARM_CP_CONST, 4948 .resetvalue = 0 }, 4949 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 4950 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 4951 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4952 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 4953 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 4954 .access = PL2_RW, .type = ARM_CP_CONST, 4955 .resetvalue = 0 }, 4956 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 4957 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 4958 .access = PL2_RW, .type = ARM_CP_CONST, 4959 .resetvalue = 0 }, 4960 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 4961 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 4962 .access = PL2_RW, .type = ARM_CP_CONST, 4963 .resetvalue = 0 }, 4964 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 4965 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 4966 .access = PL2_RW, .type = ARM_CP_CONST, 4967 .resetvalue = 0 }, 4968 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 4969 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 4970 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4971 { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH, 4972 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 4973 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 4974 .type = ARM_CP_CONST, .resetvalue = 0 }, 4975 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 4976 .cp = 15, .opc1 = 6, .crm = 2, 4977 .access = PL2_RW, .accessfn = access_el3_aa32ns, 4978 .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 }, 4979 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 4980 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 4981 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4982 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 4983 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 4984 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4985 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 4986 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 4987 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4988 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 4989 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 4990 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4991 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 4992 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 4993 .resetvalue = 0 }, 4994 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 4995 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 4996 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 4997 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 4998 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 4999 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5000 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 5001 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 5002 .resetvalue = 0 }, 5003 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 5004 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 5005 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5006 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 5007 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST, 5008 .resetvalue = 0 }, 5009 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 5010 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 5011 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5012 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 5013 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 5014 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5015 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 5016 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 5017 .access = PL2_RW, .accessfn = access_tda, 5018 .type = ARM_CP_CONST, .resetvalue = 0 }, 5019 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH, 5020 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 5021 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 5022 .type = ARM_CP_CONST, .resetvalue = 0 }, 5023 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 5024 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 5025 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5026 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 5027 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 5028 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5029 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 5030 .type = ARM_CP_CONST, 5031 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 5032 .access = PL2_RW, .resetvalue = 0 }, 5033 REGINFO_SENTINEL 5034 }; 5035 5036 /* Ditto, but for registers which exist in ARMv8 but not v7 */ 5037 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = { 5038 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 5039 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 5040 .access = PL2_RW, 5041 .type = ARM_CP_CONST, .resetvalue = 0 }, 5042 REGINFO_SENTINEL 5043 }; 5044 5045 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 5046 { 5047 ARMCPU *cpu = env_archcpu(env); 5048 /* Begin with bits defined in base ARMv8.0. */ 5049 uint64_t valid_mask = MAKE_64BIT_MASK(0, 34); 5050 5051 if (arm_feature(env, ARM_FEATURE_EL3)) { 5052 valid_mask &= ~HCR_HCD; 5053 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 5054 /* Architecturally HCR.TSC is RES0 if EL3 is not implemented. 5055 * However, if we're using the SMC PSCI conduit then QEMU is 5056 * effectively acting like EL3 firmware and so the guest at 5057 * EL2 should retain the ability to prevent EL1 from being 5058 * able to make SMC calls into the ersatz firmware, so in 5059 * that case HCR.TSC should be read/write. 5060 */ 5061 valid_mask &= ~HCR_TSC; 5062 } 5063 if (cpu_isar_feature(aa64_vh, cpu)) { 5064 valid_mask |= HCR_E2H; 5065 } 5066 if (cpu_isar_feature(aa64_lor, cpu)) { 5067 valid_mask |= HCR_TLOR; 5068 } 5069 if (cpu_isar_feature(aa64_pauth, cpu)) { 5070 valid_mask |= HCR_API | HCR_APK; 5071 } 5072 5073 /* Clear RES0 bits. */ 5074 value &= valid_mask; 5075 5076 /* These bits change the MMU setup: 5077 * HCR_VM enables stage 2 translation 5078 * HCR_PTW forbids certain page-table setups 5079 * HCR_DC Disables stage1 and enables stage2 translation 5080 */ 5081 if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) { 5082 tlb_flush(CPU(cpu)); 5083 } 5084 env->cp15.hcr_el2 = value; 5085 5086 /* 5087 * Updates to VI and VF require us to update the status of 5088 * virtual interrupts, which are the logical OR of these bits 5089 * and the state of the input lines from the GIC. (This requires 5090 * that we have the iothread lock, which is done by marking the 5091 * reginfo structs as ARM_CP_IO.) 5092 * Note that if a write to HCR pends a VIRQ or VFIQ it is never 5093 * possible for it to be taken immediately, because VIRQ and 5094 * VFIQ are masked unless running at EL0 or EL1, and HCR 5095 * can only be written at EL2. 5096 */ 5097 g_assert(qemu_mutex_iothread_locked()); 5098 arm_cpu_update_virq(cpu); 5099 arm_cpu_update_vfiq(cpu); 5100 } 5101 5102 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 5103 uint64_t value) 5104 { 5105 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 5106 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 5107 hcr_write(env, NULL, value); 5108 } 5109 5110 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 5111 uint64_t value) 5112 { 5113 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 5114 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 5115 hcr_write(env, NULL, value); 5116 } 5117 5118 /* 5119 * Return the effective value of HCR_EL2. 5120 * Bits that are not included here: 5121 * RW (read from SCR_EL3.RW as needed) 5122 */ 5123 uint64_t arm_hcr_el2_eff(CPUARMState *env) 5124 { 5125 uint64_t ret = env->cp15.hcr_el2; 5126 5127 if (arm_is_secure_below_el3(env)) { 5128 /* 5129 * "This register has no effect if EL2 is not enabled in the 5130 * current Security state". This is ARMv8.4-SecEL2 speak for 5131 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 5132 * 5133 * Prior to that, the language was "In an implementation that 5134 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 5135 * as if this field is 0 for all purposes other than a direct 5136 * read or write access of HCR_EL2". With lots of enumeration 5137 * on a per-field basis. In current QEMU, this is condition 5138 * is arm_is_secure_below_el3. 5139 * 5140 * Since the v8.4 language applies to the entire register, and 5141 * appears to be backward compatible, use that. 5142 */ 5143 ret = 0; 5144 } else if (ret & HCR_TGE) { 5145 /* These bits are up-to-date as of ARMv8.4. */ 5146 if (ret & HCR_E2H) { 5147 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 5148 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 5149 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 5150 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE); 5151 } else { 5152 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 5153 } 5154 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 5155 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 5156 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 5157 HCR_TLOR); 5158 } 5159 5160 return ret; 5161 } 5162 5163 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 5164 uint64_t value) 5165 { 5166 /* 5167 * For A-profile AArch32 EL3, if NSACR.CP10 5168 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 5169 */ 5170 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 5171 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 5172 value &= ~(0x3 << 10); 5173 value |= env->cp15.cptr_el[2] & (0x3 << 10); 5174 } 5175 env->cp15.cptr_el[2] = value; 5176 } 5177 5178 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri) 5179 { 5180 /* 5181 * For A-profile AArch32 EL3, if NSACR.CP10 5182 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 5183 */ 5184 uint64_t value = env->cp15.cptr_el[2]; 5185 5186 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 5187 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 5188 value |= 0x3 << 10; 5189 } 5190 return value; 5191 } 5192 5193 static const ARMCPRegInfo el2_cp_reginfo[] = { 5194 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 5195 .type = ARM_CP_IO, 5196 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 5197 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 5198 .writefn = hcr_write }, 5199 { .name = "HCR", .state = ARM_CP_STATE_AA32, 5200 .type = ARM_CP_ALIAS | ARM_CP_IO, 5201 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 5202 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 5203 .writefn = hcr_writelow }, 5204 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 5205 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 5206 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5207 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 5208 .type = ARM_CP_ALIAS, 5209 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 5210 .access = PL2_RW, 5211 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 5212 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 5213 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 5214 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 5215 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 5216 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 5217 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 5218 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 5219 .type = ARM_CP_ALIAS, 5220 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 5221 .access = PL2_RW, 5222 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 5223 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 5224 .type = ARM_CP_ALIAS, 5225 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 5226 .access = PL2_RW, 5227 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 5228 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 5229 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 5230 .access = PL2_RW, .writefn = vbar_write, 5231 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 5232 .resetvalue = 0 }, 5233 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 5234 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 5235 .access = PL3_RW, .type = ARM_CP_ALIAS, 5236 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 5237 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 5238 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 5239 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 5240 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]), 5241 .readfn = cptr_el2_read, .writefn = cptr_el2_write }, 5242 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 5243 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 5244 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 5245 .resetvalue = 0 }, 5246 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 5247 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 5248 .access = PL2_RW, .type = ARM_CP_ALIAS, 5249 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 5250 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 5251 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 5252 .access = PL2_RW, .type = ARM_CP_CONST, 5253 .resetvalue = 0 }, 5254 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 5255 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 5256 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 5257 .access = PL2_RW, .type = ARM_CP_CONST, 5258 .resetvalue = 0 }, 5259 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 5260 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 5261 .access = PL2_RW, .type = ARM_CP_CONST, 5262 .resetvalue = 0 }, 5263 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 5264 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 5265 .access = PL2_RW, .type = ARM_CP_CONST, 5266 .resetvalue = 0 }, 5267 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 5268 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 5269 .access = PL2_RW, .writefn = vmsa_tcr_el12_write, 5270 /* no .raw_writefn or .resetfn needed as we never use mask/base_mask */ 5271 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 5272 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 5273 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 5274 .type = ARM_CP_ALIAS, 5275 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5276 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 5277 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 5278 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 5279 .access = PL2_RW, 5280 /* no .writefn needed as this can't cause an ASID change; 5281 * no .raw_writefn or .resetfn needed as we never use mask/base_mask 5282 */ 5283 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 5284 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 5285 .cp = 15, .opc1 = 6, .crm = 2, 5286 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 5287 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5288 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 5289 .writefn = vttbr_write }, 5290 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 5291 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 5292 .access = PL2_RW, .writefn = vttbr_write, 5293 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 5294 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 5295 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 5296 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 5297 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 5298 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 5299 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 5300 .access = PL2_RW, .resetvalue = 0, 5301 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 5302 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 5303 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 5304 .access = PL2_RW, .resetvalue = 0, .writefn = vmsa_tcr_ttbr_el2_write, 5305 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 5306 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 5307 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 5308 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 5309 { .name = "TLBIALLNSNH", 5310 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 5311 .type = ARM_CP_NO_RAW, .access = PL2_W, 5312 .writefn = tlbiall_nsnh_write }, 5313 { .name = "TLBIALLNSNHIS", 5314 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 5315 .type = ARM_CP_NO_RAW, .access = PL2_W, 5316 .writefn = tlbiall_nsnh_is_write }, 5317 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 5318 .type = ARM_CP_NO_RAW, .access = PL2_W, 5319 .writefn = tlbiall_hyp_write }, 5320 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 5321 .type = ARM_CP_NO_RAW, .access = PL2_W, 5322 .writefn = tlbiall_hyp_is_write }, 5323 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 5324 .type = ARM_CP_NO_RAW, .access = PL2_W, 5325 .writefn = tlbimva_hyp_write }, 5326 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 5327 .type = ARM_CP_NO_RAW, .access = PL2_W, 5328 .writefn = tlbimva_hyp_is_write }, 5329 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 5330 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 5331 .type = ARM_CP_NO_RAW, .access = PL2_W, 5332 .writefn = tlbi_aa64_alle2_write }, 5333 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 5334 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 5335 .type = ARM_CP_NO_RAW, .access = PL2_W, 5336 .writefn = tlbi_aa64_vae2_write }, 5337 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 5338 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 5339 .access = PL2_W, .type = ARM_CP_NO_RAW, 5340 .writefn = tlbi_aa64_vae2_write }, 5341 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 5342 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 5343 .access = PL2_W, .type = ARM_CP_NO_RAW, 5344 .writefn = tlbi_aa64_alle2is_write }, 5345 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 5346 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 5347 .type = ARM_CP_NO_RAW, .access = PL2_W, 5348 .writefn = tlbi_aa64_vae2is_write }, 5349 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 5350 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 5351 .access = PL2_W, .type = ARM_CP_NO_RAW, 5352 .writefn = tlbi_aa64_vae2is_write }, 5353 #ifndef CONFIG_USER_ONLY 5354 /* Unlike the other EL2-related AT operations, these must 5355 * UNDEF from EL3 if EL2 is not implemented, which is why we 5356 * define them here rather than with the rest of the AT ops. 5357 */ 5358 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 5359 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 5360 .access = PL2_W, .accessfn = at_s1e2_access, 5361 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 }, 5362 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 5363 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 5364 .access = PL2_W, .accessfn = at_s1e2_access, 5365 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 }, 5366 /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 5367 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 5368 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 5369 * to behave as if SCR.NS was 1. 5370 */ 5371 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 5372 .access = PL2_W, 5373 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 5374 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 5375 .access = PL2_W, 5376 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 5377 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 5378 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 5379 /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 5380 * reset values as IMPDEF. We choose to reset to 3 to comply with 5381 * both ARMv7 and ARMv8. 5382 */ 5383 .access = PL2_RW, .resetvalue = 3, 5384 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 5385 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 5386 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 5387 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 5388 .writefn = gt_cntvoff_write, 5389 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 5390 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 5391 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 5392 .writefn = gt_cntvoff_write, 5393 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 5394 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 5395 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 5396 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 5397 .type = ARM_CP_IO, .access = PL2_RW, 5398 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 5399 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 5400 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 5401 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 5402 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 5403 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 5404 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 5405 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 5406 .resetfn = gt_hyp_timer_reset, 5407 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 5408 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 5409 .type = ARM_CP_IO, 5410 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 5411 .access = PL2_RW, 5412 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 5413 .resetvalue = 0, 5414 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 5415 #endif 5416 /* The only field of MDCR_EL2 that has a defined architectural reset value 5417 * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we 5418 * don't implement any PMU event counters, so using zero as a reset 5419 * value for MDCR_EL2 is okay 5420 */ 5421 { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, 5422 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 5423 .access = PL2_RW, .resetvalue = 0, 5424 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), }, 5425 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 5426 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 5427 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5428 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 5429 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 5430 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 5431 .access = PL2_RW, 5432 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 5433 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 5434 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 5435 .access = PL2_RW, 5436 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 5437 REGINFO_SENTINEL 5438 }; 5439 5440 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 5441 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 5442 .type = ARM_CP_ALIAS | ARM_CP_IO, 5443 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 5444 .access = PL2_RW, 5445 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 5446 .writefn = hcr_writehigh }, 5447 REGINFO_SENTINEL 5448 }; 5449 5450 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 5451 bool isread) 5452 { 5453 /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 5454 * At Secure EL1 it traps to EL3. 5455 */ 5456 if (arm_current_el(env) == 3) { 5457 return CP_ACCESS_OK; 5458 } 5459 if (arm_is_secure_below_el3(env)) { 5460 return CP_ACCESS_TRAP_EL3; 5461 } 5462 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 5463 if (isread) { 5464 return CP_ACCESS_OK; 5465 } 5466 return CP_ACCESS_TRAP_UNCATEGORIZED; 5467 } 5468 5469 static const ARMCPRegInfo el3_cp_reginfo[] = { 5470 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 5471 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 5472 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 5473 .resetvalue = 0, .writefn = scr_write }, 5474 { .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL, 5475 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 5476 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5477 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 5478 .writefn = scr_write }, 5479 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 5480 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 5481 .access = PL3_RW, .resetvalue = 0, 5482 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 5483 { .name = "SDER", 5484 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 5485 .access = PL3_RW, .resetvalue = 0, 5486 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 5487 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 5488 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5489 .writefn = vbar_write, .resetvalue = 0, 5490 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 5491 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 5492 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 5493 .access = PL3_RW, .resetvalue = 0, 5494 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 5495 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 5496 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 5497 .access = PL3_RW, 5498 /* no .writefn needed as this can't cause an ASID change; 5499 * we must provide a .raw_writefn and .resetfn because we handle 5500 * reset and migration for the AArch32 TTBCR(S), which might be 5501 * using mask and base_mask. 5502 */ 5503 .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write, 5504 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 5505 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 5506 .type = ARM_CP_ALIAS, 5507 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 5508 .access = PL3_RW, 5509 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 5510 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 5511 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 5512 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 5513 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 5514 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 5515 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 5516 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 5517 .type = ARM_CP_ALIAS, 5518 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 5519 .access = PL3_RW, 5520 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 5521 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 5522 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 5523 .access = PL3_RW, .writefn = vbar_write, 5524 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 5525 .resetvalue = 0 }, 5526 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 5527 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 5528 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 5529 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 5530 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 5531 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 5532 .access = PL3_RW, .resetvalue = 0, 5533 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 5534 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 5535 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 5536 .access = PL3_RW, .type = ARM_CP_CONST, 5537 .resetvalue = 0 }, 5538 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 5539 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 5540 .access = PL3_RW, .type = ARM_CP_CONST, 5541 .resetvalue = 0 }, 5542 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 5543 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 5544 .access = PL3_RW, .type = ARM_CP_CONST, 5545 .resetvalue = 0 }, 5546 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 5547 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 5548 .access = PL3_W, .type = ARM_CP_NO_RAW, 5549 .writefn = tlbi_aa64_alle3is_write }, 5550 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 5551 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 5552 .access = PL3_W, .type = ARM_CP_NO_RAW, 5553 .writefn = tlbi_aa64_vae3is_write }, 5554 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 5555 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 5556 .access = PL3_W, .type = ARM_CP_NO_RAW, 5557 .writefn = tlbi_aa64_vae3is_write }, 5558 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 5559 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 5560 .access = PL3_W, .type = ARM_CP_NO_RAW, 5561 .writefn = tlbi_aa64_alle3_write }, 5562 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 5563 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 5564 .access = PL3_W, .type = ARM_CP_NO_RAW, 5565 .writefn = tlbi_aa64_vae3_write }, 5566 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 5567 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 5568 .access = PL3_W, .type = ARM_CP_NO_RAW, 5569 .writefn = tlbi_aa64_vae3_write }, 5570 REGINFO_SENTINEL 5571 }; 5572 5573 #ifndef CONFIG_USER_ONLY 5574 /* Test if system register redirection is to occur in the current state. */ 5575 static bool redirect_for_e2h(CPUARMState *env) 5576 { 5577 return arm_current_el(env) == 2 && (arm_hcr_el2_eff(env) & HCR_E2H); 5578 } 5579 5580 static uint64_t el2_e2h_read(CPUARMState *env, const ARMCPRegInfo *ri) 5581 { 5582 CPReadFn *readfn; 5583 5584 if (redirect_for_e2h(env)) { 5585 /* Switch to the saved EL2 version of the register. */ 5586 ri = ri->opaque; 5587 readfn = ri->readfn; 5588 } else { 5589 readfn = ri->orig_readfn; 5590 } 5591 if (readfn == NULL) { 5592 readfn = raw_read; 5593 } 5594 return readfn(env, ri); 5595 } 5596 5597 static void el2_e2h_write(CPUARMState *env, const ARMCPRegInfo *ri, 5598 uint64_t value) 5599 { 5600 CPWriteFn *writefn; 5601 5602 if (redirect_for_e2h(env)) { 5603 /* Switch to the saved EL2 version of the register. */ 5604 ri = ri->opaque; 5605 writefn = ri->writefn; 5606 } else { 5607 writefn = ri->orig_writefn; 5608 } 5609 if (writefn == NULL) { 5610 writefn = raw_write; 5611 } 5612 writefn(env, ri, value); 5613 } 5614 5615 static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu) 5616 { 5617 struct E2HAlias { 5618 uint32_t src_key, dst_key, new_key; 5619 const char *src_name, *dst_name, *new_name; 5620 bool (*feature)(const ARMISARegisters *id); 5621 }; 5622 5623 #define K(op0, op1, crn, crm, op2) \ 5624 ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2) 5625 5626 static const struct E2HAlias aliases[] = { 5627 { K(3, 0, 1, 0, 0), K(3, 4, 1, 0, 0), K(3, 5, 1, 0, 0), 5628 "SCTLR", "SCTLR_EL2", "SCTLR_EL12" }, 5629 { K(3, 0, 1, 0, 2), K(3, 4, 1, 1, 2), K(3, 5, 1, 0, 2), 5630 "CPACR", "CPTR_EL2", "CPACR_EL12" }, 5631 { K(3, 0, 2, 0, 0), K(3, 4, 2, 0, 0), K(3, 5, 2, 0, 0), 5632 "TTBR0_EL1", "TTBR0_EL2", "TTBR0_EL12" }, 5633 { K(3, 0, 2, 0, 1), K(3, 4, 2, 0, 1), K(3, 5, 2, 0, 1), 5634 "TTBR1_EL1", "TTBR1_EL2", "TTBR1_EL12" }, 5635 { K(3, 0, 2, 0, 2), K(3, 4, 2, 0, 2), K(3, 5, 2, 0, 2), 5636 "TCR_EL1", "TCR_EL2", "TCR_EL12" }, 5637 { K(3, 0, 4, 0, 0), K(3, 4, 4, 0, 0), K(3, 5, 4, 0, 0), 5638 "SPSR_EL1", "SPSR_EL2", "SPSR_EL12" }, 5639 { K(3, 0, 4, 0, 1), K(3, 4, 4, 0, 1), K(3, 5, 4, 0, 1), 5640 "ELR_EL1", "ELR_EL2", "ELR_EL12" }, 5641 { K(3, 0, 5, 1, 0), K(3, 4, 5, 1, 0), K(3, 5, 5, 1, 0), 5642 "AFSR0_EL1", "AFSR0_EL2", "AFSR0_EL12" }, 5643 { K(3, 0, 5, 1, 1), K(3, 4, 5, 1, 1), K(3, 5, 5, 1, 1), 5644 "AFSR1_EL1", "AFSR1_EL2", "AFSR1_EL12" }, 5645 { K(3, 0, 5, 2, 0), K(3, 4, 5, 2, 0), K(3, 5, 5, 2, 0), 5646 "ESR_EL1", "ESR_EL2", "ESR_EL12" }, 5647 { K(3, 0, 6, 0, 0), K(3, 4, 6, 0, 0), K(3, 5, 6, 0, 0), 5648 "FAR_EL1", "FAR_EL2", "FAR_EL12" }, 5649 { K(3, 0, 10, 2, 0), K(3, 4, 10, 2, 0), K(3, 5, 10, 2, 0), 5650 "MAIR_EL1", "MAIR_EL2", "MAIR_EL12" }, 5651 { K(3, 0, 10, 3, 0), K(3, 4, 10, 3, 0), K(3, 5, 10, 3, 0), 5652 "AMAIR0", "AMAIR_EL2", "AMAIR_EL12" }, 5653 { K(3, 0, 12, 0, 0), K(3, 4, 12, 0, 0), K(3, 5, 12, 0, 0), 5654 "VBAR", "VBAR_EL2", "VBAR_EL12" }, 5655 { K(3, 0, 13, 0, 1), K(3, 4, 13, 0, 1), K(3, 5, 13, 0, 1), 5656 "CONTEXTIDR_EL1", "CONTEXTIDR_EL2", "CONTEXTIDR_EL12" }, 5657 { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0), 5658 "CNTKCTL", "CNTHCTL_EL2", "CNTKCTL_EL12" }, 5659 5660 /* 5661 * Note that redirection of ZCR is mentioned in the description 5662 * of ZCR_EL2, and aliasing in the description of ZCR_EL1, but 5663 * not in the summary table. 5664 */ 5665 { K(3, 0, 1, 2, 0), K(3, 4, 1, 2, 0), K(3, 5, 1, 2, 0), 5666 "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve }, 5667 5668 /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */ 5669 /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */ 5670 }; 5671 #undef K 5672 5673 size_t i; 5674 5675 for (i = 0; i < ARRAY_SIZE(aliases); i++) { 5676 const struct E2HAlias *a = &aliases[i]; 5677 ARMCPRegInfo *src_reg, *dst_reg; 5678 5679 if (a->feature && !a->feature(&cpu->isar)) { 5680 continue; 5681 } 5682 5683 src_reg = g_hash_table_lookup(cpu->cp_regs, &a->src_key); 5684 dst_reg = g_hash_table_lookup(cpu->cp_regs, &a->dst_key); 5685 g_assert(src_reg != NULL); 5686 g_assert(dst_reg != NULL); 5687 5688 /* Cross-compare names to detect typos in the keys. */ 5689 g_assert(strcmp(src_reg->name, a->src_name) == 0); 5690 g_assert(strcmp(dst_reg->name, a->dst_name) == 0); 5691 5692 /* None of the core system registers use opaque; we will. */ 5693 g_assert(src_reg->opaque == NULL); 5694 5695 /* Create alias before redirection so we dup the right data. */ 5696 if (a->new_key) { 5697 ARMCPRegInfo *new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo)); 5698 uint32_t *new_key = g_memdup(&a->new_key, sizeof(uint32_t)); 5699 bool ok; 5700 5701 new_reg->name = a->new_name; 5702 new_reg->type |= ARM_CP_ALIAS; 5703 /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place. */ 5704 new_reg->access &= PL2_RW | PL3_RW; 5705 5706 ok = g_hash_table_insert(cpu->cp_regs, new_key, new_reg); 5707 g_assert(ok); 5708 } 5709 5710 src_reg->opaque = dst_reg; 5711 src_reg->orig_readfn = src_reg->readfn ?: raw_read; 5712 src_reg->orig_writefn = src_reg->writefn ?: raw_write; 5713 if (!src_reg->raw_readfn) { 5714 src_reg->raw_readfn = raw_read; 5715 } 5716 if (!src_reg->raw_writefn) { 5717 src_reg->raw_writefn = raw_write; 5718 } 5719 src_reg->readfn = el2_e2h_read; 5720 src_reg->writefn = el2_e2h_write; 5721 } 5722 } 5723 #endif 5724 5725 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 5726 bool isread) 5727 { 5728 int cur_el = arm_current_el(env); 5729 5730 if (cur_el < 2) { 5731 uint64_t hcr = arm_hcr_el2_eff(env); 5732 5733 if (cur_el == 0) { 5734 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 5735 if (!(env->cp15.sctlr_el[2] & SCTLR_UCT)) { 5736 return CP_ACCESS_TRAP_EL2; 5737 } 5738 } else { 5739 if (!(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 5740 return CP_ACCESS_TRAP; 5741 } 5742 if (hcr & HCR_TID2) { 5743 return CP_ACCESS_TRAP_EL2; 5744 } 5745 } 5746 } else if (hcr & HCR_TID2) { 5747 return CP_ACCESS_TRAP_EL2; 5748 } 5749 } 5750 5751 if (arm_current_el(env) < 2 && arm_hcr_el2_eff(env) & HCR_TID2) { 5752 return CP_ACCESS_TRAP_EL2; 5753 } 5754 5755 return CP_ACCESS_OK; 5756 } 5757 5758 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri, 5759 uint64_t value) 5760 { 5761 /* Writes to OSLAR_EL1 may update the OS lock status, which can be 5762 * read via a bit in OSLSR_EL1. 5763 */ 5764 int oslock; 5765 5766 if (ri->state == ARM_CP_STATE_AA32) { 5767 oslock = (value == 0xC5ACCE55); 5768 } else { 5769 oslock = value & 1; 5770 } 5771 5772 env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock); 5773 } 5774 5775 static const ARMCPRegInfo debug_cp_reginfo[] = { 5776 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped 5777 * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1; 5778 * unlike DBGDRAR it is never accessible from EL0. 5779 * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64 5780 * accessor. 5781 */ 5782 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, 5783 .access = PL0_R, .accessfn = access_tdra, 5784 .type = ARM_CP_CONST, .resetvalue = 0 }, 5785 { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, 5786 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 5787 .access = PL1_R, .accessfn = access_tdra, 5788 .type = ARM_CP_CONST, .resetvalue = 0 }, 5789 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 5790 .access = PL0_R, .accessfn = access_tdra, 5791 .type = ARM_CP_CONST, .resetvalue = 0 }, 5792 /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ 5793 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, 5794 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 5795 .access = PL1_RW, .accessfn = access_tda, 5796 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), 5797 .resetvalue = 0 }, 5798 /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1. 5799 * We don't implement the configurable EL0 access. 5800 */ 5801 { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH, 5802 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 5803 .type = ARM_CP_ALIAS, 5804 .access = PL1_R, .accessfn = access_tda, 5805 .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, 5806 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, 5807 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, 5808 .access = PL1_W, .type = ARM_CP_NO_RAW, 5809 .accessfn = access_tdosa, 5810 .writefn = oslar_write }, 5811 { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, 5812 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, 5813 .access = PL1_R, .resetvalue = 10, 5814 .accessfn = access_tdosa, 5815 .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, 5816 /* Dummy OSDLR_EL1: 32-bit Linux will read this */ 5817 { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, 5818 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, 5819 .access = PL1_RW, .accessfn = access_tdosa, 5820 .type = ARM_CP_NOP }, 5821 /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't 5822 * implement vector catch debug events yet. 5823 */ 5824 { .name = "DBGVCR", 5825 .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 5826 .access = PL1_RW, .accessfn = access_tda, 5827 .type = ARM_CP_NOP }, 5828 /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor 5829 * to save and restore a 32-bit guest's DBGVCR) 5830 */ 5831 { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64, 5832 .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0, 5833 .access = PL2_RW, .accessfn = access_tda, 5834 .type = ARM_CP_NOP }, 5835 /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications 5836 * Channel but Linux may try to access this register. The 32-bit 5837 * alias is DBGDCCINT. 5838 */ 5839 { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH, 5840 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 5841 .access = PL1_RW, .accessfn = access_tda, 5842 .type = ARM_CP_NOP }, 5843 REGINFO_SENTINEL 5844 }; 5845 5846 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = { 5847 /* 64 bit access versions of the (dummy) debug registers */ 5848 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0, 5849 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5850 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0, 5851 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 }, 5852 REGINFO_SENTINEL 5853 }; 5854 5855 /* Return the exception level to which exceptions should be taken 5856 * via SVEAccessTrap. If an exception should be routed through 5857 * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should 5858 * take care of raising that exception. 5859 * C.f. the ARM pseudocode function CheckSVEEnabled. 5860 */ 5861 int sve_exception_el(CPUARMState *env, int el) 5862 { 5863 #ifndef CONFIG_USER_ONLY 5864 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 5865 5866 if (el <= 1 && (hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 5867 bool disabled = false; 5868 5869 /* The CPACR.ZEN controls traps to EL1: 5870 * 0, 2 : trap EL0 and EL1 accesses 5871 * 1 : trap only EL0 accesses 5872 * 3 : trap no accesses 5873 */ 5874 if (!extract32(env->cp15.cpacr_el1, 16, 1)) { 5875 disabled = true; 5876 } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) { 5877 disabled = el == 0; 5878 } 5879 if (disabled) { 5880 /* route_to_el2 */ 5881 return hcr_el2 & HCR_TGE ? 2 : 1; 5882 } 5883 5884 /* Check CPACR.FPEN. */ 5885 if (!extract32(env->cp15.cpacr_el1, 20, 1)) { 5886 disabled = true; 5887 } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) { 5888 disabled = el == 0; 5889 } 5890 if (disabled) { 5891 return 0; 5892 } 5893 } 5894 5895 /* CPTR_EL2. Since TZ and TFP are positive, 5896 * they will be zero when EL2 is not present. 5897 */ 5898 if (el <= 2 && !arm_is_secure_below_el3(env)) { 5899 if (env->cp15.cptr_el[2] & CPTR_TZ) { 5900 return 2; 5901 } 5902 if (env->cp15.cptr_el[2] & CPTR_TFP) { 5903 return 0; 5904 } 5905 } 5906 5907 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 5908 if (arm_feature(env, ARM_FEATURE_EL3) 5909 && !(env->cp15.cptr_el[3] & CPTR_EZ)) { 5910 return 3; 5911 } 5912 #endif 5913 return 0; 5914 } 5915 5916 static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) 5917 { 5918 uint32_t end_len; 5919 5920 end_len = start_len &= 0xf; 5921 if (!test_bit(start_len, cpu->sve_vq_map)) { 5922 end_len = find_last_bit(cpu->sve_vq_map, start_len); 5923 assert(end_len < start_len); 5924 } 5925 return end_len; 5926 } 5927 5928 /* 5929 * Given that SVE is enabled, return the vector length for EL. 5930 */ 5931 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) 5932 { 5933 ARMCPU *cpu = env_archcpu(env); 5934 uint32_t zcr_len = cpu->sve_max_vq - 1; 5935 5936 if (el <= 1) { 5937 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]); 5938 } 5939 if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) { 5940 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]); 5941 } 5942 if (arm_feature(env, ARM_FEATURE_EL3)) { 5943 zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); 5944 } 5945 5946 return sve_zcr_get_valid_len(cpu, zcr_len); 5947 } 5948 5949 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5950 uint64_t value) 5951 { 5952 int cur_el = arm_current_el(env); 5953 int old_len = sve_zcr_len_for_el(env, cur_el); 5954 int new_len; 5955 5956 /* Bits other than [3:0] are RAZ/WI. */ 5957 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16); 5958 raw_write(env, ri, value & 0xf); 5959 5960 /* 5961 * Because we arrived here, we know both FP and SVE are enabled; 5962 * otherwise we would have trapped access to the ZCR_ELn register. 5963 */ 5964 new_len = sve_zcr_len_for_el(env, cur_el); 5965 if (new_len < old_len) { 5966 aarch64_sve_narrow_vq(env, new_len + 1); 5967 } 5968 } 5969 5970 static const ARMCPRegInfo zcr_el1_reginfo = { 5971 .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 5972 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 5973 .access = PL1_RW, .type = ARM_CP_SVE, 5974 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 5975 .writefn = zcr_write, .raw_writefn = raw_write 5976 }; 5977 5978 static const ARMCPRegInfo zcr_el2_reginfo = { 5979 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5980 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5981 .access = PL2_RW, .type = ARM_CP_SVE, 5982 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 5983 .writefn = zcr_write, .raw_writefn = raw_write 5984 }; 5985 5986 static const ARMCPRegInfo zcr_no_el2_reginfo = { 5987 .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 5988 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 5989 .access = PL2_RW, .type = ARM_CP_SVE, 5990 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore 5991 }; 5992 5993 static const ARMCPRegInfo zcr_el3_reginfo = { 5994 .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 5995 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 5996 .access = PL3_RW, .type = ARM_CP_SVE, 5997 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 5998 .writefn = zcr_write, .raw_writefn = raw_write 5999 }; 6000 6001 void hw_watchpoint_update(ARMCPU *cpu, int n) 6002 { 6003 CPUARMState *env = &cpu->env; 6004 vaddr len = 0; 6005 vaddr wvr = env->cp15.dbgwvr[n]; 6006 uint64_t wcr = env->cp15.dbgwcr[n]; 6007 int mask; 6008 int flags = BP_CPU | BP_STOP_BEFORE_ACCESS; 6009 6010 if (env->cpu_watchpoint[n]) { 6011 cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]); 6012 env->cpu_watchpoint[n] = NULL; 6013 } 6014 6015 if (!extract64(wcr, 0, 1)) { 6016 /* E bit clear : watchpoint disabled */ 6017 return; 6018 } 6019 6020 switch (extract64(wcr, 3, 2)) { 6021 case 0: 6022 /* LSC 00 is reserved and must behave as if the wp is disabled */ 6023 return; 6024 case 1: 6025 flags |= BP_MEM_READ; 6026 break; 6027 case 2: 6028 flags |= BP_MEM_WRITE; 6029 break; 6030 case 3: 6031 flags |= BP_MEM_ACCESS; 6032 break; 6033 } 6034 6035 /* Attempts to use both MASK and BAS fields simultaneously are 6036 * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case, 6037 * thus generating a watchpoint for every byte in the masked region. 6038 */ 6039 mask = extract64(wcr, 24, 4); 6040 if (mask == 1 || mask == 2) { 6041 /* Reserved values of MASK; we must act as if the mask value was 6042 * some non-reserved value, or as if the watchpoint were disabled. 6043 * We choose the latter. 6044 */ 6045 return; 6046 } else if (mask) { 6047 /* Watchpoint covers an aligned area up to 2GB in size */ 6048 len = 1ULL << mask; 6049 /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE 6050 * whether the watchpoint fires when the unmasked bits match; we opt 6051 * to generate the exceptions. 6052 */ 6053 wvr &= ~(len - 1); 6054 } else { 6055 /* Watchpoint covers bytes defined by the byte address select bits */ 6056 int bas = extract64(wcr, 5, 8); 6057 int basstart; 6058 6059 if (bas == 0) { 6060 /* This must act as if the watchpoint is disabled */ 6061 return; 6062 } 6063 6064 if (extract64(wvr, 2, 1)) { 6065 /* Deprecated case of an only 4-aligned address. BAS[7:4] are 6066 * ignored, and BAS[3:0] define which bytes to watch. 6067 */ 6068 bas &= 0xf; 6069 } 6070 /* The BAS bits are supposed to be programmed to indicate a contiguous 6071 * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether 6072 * we fire for each byte in the word/doubleword addressed by the WVR. 6073 * We choose to ignore any non-zero bits after the first range of 1s. 6074 */ 6075 basstart = ctz32(bas); 6076 len = cto32(bas >> basstart); 6077 wvr += basstart; 6078 } 6079 6080 cpu_watchpoint_insert(CPU(cpu), wvr, len, flags, 6081 &env->cpu_watchpoint[n]); 6082 } 6083 6084 void hw_watchpoint_update_all(ARMCPU *cpu) 6085 { 6086 int i; 6087 CPUARMState *env = &cpu->env; 6088 6089 /* Completely clear out existing QEMU watchpoints and our array, to 6090 * avoid possible stale entries following migration load. 6091 */ 6092 cpu_watchpoint_remove_all(CPU(cpu), BP_CPU); 6093 memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint)); 6094 6095 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) { 6096 hw_watchpoint_update(cpu, i); 6097 } 6098 } 6099 6100 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6101 uint64_t value) 6102 { 6103 ARMCPU *cpu = env_archcpu(env); 6104 int i = ri->crm; 6105 6106 /* Bits [63:49] are hardwired to the value of bit [48]; that is, the 6107 * register reads and behaves as if values written are sign extended. 6108 * Bits [1:0] are RES0. 6109 */ 6110 value = sextract64(value, 0, 49) & ~3ULL; 6111 6112 raw_write(env, ri, value); 6113 hw_watchpoint_update(cpu, i); 6114 } 6115 6116 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6117 uint64_t value) 6118 { 6119 ARMCPU *cpu = env_archcpu(env); 6120 int i = ri->crm; 6121 6122 raw_write(env, ri, value); 6123 hw_watchpoint_update(cpu, i); 6124 } 6125 6126 void hw_breakpoint_update(ARMCPU *cpu, int n) 6127 { 6128 CPUARMState *env = &cpu->env; 6129 uint64_t bvr = env->cp15.dbgbvr[n]; 6130 uint64_t bcr = env->cp15.dbgbcr[n]; 6131 vaddr addr; 6132 int bt; 6133 int flags = BP_CPU; 6134 6135 if (env->cpu_breakpoint[n]) { 6136 cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]); 6137 env->cpu_breakpoint[n] = NULL; 6138 } 6139 6140 if (!extract64(bcr, 0, 1)) { 6141 /* E bit clear : watchpoint disabled */ 6142 return; 6143 } 6144 6145 bt = extract64(bcr, 20, 4); 6146 6147 switch (bt) { 6148 case 4: /* unlinked address mismatch (reserved if AArch64) */ 6149 case 5: /* linked address mismatch (reserved if AArch64) */ 6150 qemu_log_mask(LOG_UNIMP, 6151 "arm: address mismatch breakpoint types not implemented\n"); 6152 return; 6153 case 0: /* unlinked address match */ 6154 case 1: /* linked address match */ 6155 { 6156 /* Bits [63:49] are hardwired to the value of bit [48]; that is, 6157 * we behave as if the register was sign extended. Bits [1:0] are 6158 * RES0. The BAS field is used to allow setting breakpoints on 16 6159 * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether 6160 * a bp will fire if the addresses covered by the bp and the addresses 6161 * covered by the insn overlap but the insn doesn't start at the 6162 * start of the bp address range. We choose to require the insn and 6163 * the bp to have the same address. The constraints on writing to 6164 * BAS enforced in dbgbcr_write mean we have only four cases: 6165 * 0b0000 => no breakpoint 6166 * 0b0011 => breakpoint on addr 6167 * 0b1100 => breakpoint on addr + 2 6168 * 0b1111 => breakpoint on addr 6169 * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c). 6170 */ 6171 int bas = extract64(bcr, 5, 4); 6172 addr = sextract64(bvr, 0, 49) & ~3ULL; 6173 if (bas == 0) { 6174 return; 6175 } 6176 if (bas == 0xc) { 6177 addr += 2; 6178 } 6179 break; 6180 } 6181 case 2: /* unlinked context ID match */ 6182 case 8: /* unlinked VMID match (reserved if no EL2) */ 6183 case 10: /* unlinked context ID and VMID match (reserved if no EL2) */ 6184 qemu_log_mask(LOG_UNIMP, 6185 "arm: unlinked context breakpoint types not implemented\n"); 6186 return; 6187 case 9: /* linked VMID match (reserved if no EL2) */ 6188 case 11: /* linked context ID and VMID match (reserved if no EL2) */ 6189 case 3: /* linked context ID match */ 6190 default: 6191 /* We must generate no events for Linked context matches (unless 6192 * they are linked to by some other bp/wp, which is handled in 6193 * updates for the linking bp/wp). We choose to also generate no events 6194 * for reserved values. 6195 */ 6196 return; 6197 } 6198 6199 cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]); 6200 } 6201 6202 void hw_breakpoint_update_all(ARMCPU *cpu) 6203 { 6204 int i; 6205 CPUARMState *env = &cpu->env; 6206 6207 /* Completely clear out existing QEMU breakpoints and our array, to 6208 * avoid possible stale entries following migration load. 6209 */ 6210 cpu_breakpoint_remove_all(CPU(cpu), BP_CPU); 6211 memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint)); 6212 6213 for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) { 6214 hw_breakpoint_update(cpu, i); 6215 } 6216 } 6217 6218 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6219 uint64_t value) 6220 { 6221 ARMCPU *cpu = env_archcpu(env); 6222 int i = ri->crm; 6223 6224 raw_write(env, ri, value); 6225 hw_breakpoint_update(cpu, i); 6226 } 6227 6228 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6229 uint64_t value) 6230 { 6231 ARMCPU *cpu = env_archcpu(env); 6232 int i = ri->crm; 6233 6234 /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only 6235 * copy of BAS[0]. 6236 */ 6237 value = deposit64(value, 6, 1, extract64(value, 5, 1)); 6238 value = deposit64(value, 8, 1, extract64(value, 7, 1)); 6239 6240 raw_write(env, ri, value); 6241 hw_breakpoint_update(cpu, i); 6242 } 6243 6244 static void define_debug_regs(ARMCPU *cpu) 6245 { 6246 /* Define v7 and v8 architectural debug registers. 6247 * These are just dummy implementations for now. 6248 */ 6249 int i; 6250 int wrps, brps, ctx_cmps; 6251 ARMCPRegInfo dbgdidr = { 6252 .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 6253 .access = PL0_R, .accessfn = access_tda, 6254 .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, 6255 }; 6256 6257 /* Note that all these register fields hold "number of Xs minus 1". */ 6258 brps = extract32(cpu->dbgdidr, 24, 4); 6259 wrps = extract32(cpu->dbgdidr, 28, 4); 6260 ctx_cmps = extract32(cpu->dbgdidr, 20, 4); 6261 6262 assert(ctx_cmps <= brps); 6263 6264 /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties 6265 * of the debug registers such as number of breakpoints; 6266 * check that if they both exist then they agree. 6267 */ 6268 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { 6269 assert(FIELD_EX64(cpu->id_aa64dfr0, ID_AA64DFR0, BRPS) == brps); 6270 assert(FIELD_EX64(cpu->id_aa64dfr0, ID_AA64DFR0, WRPS) == wrps); 6271 assert(FIELD_EX64(cpu->id_aa64dfr0, ID_AA64DFR0, CTX_CMPS) == ctx_cmps); 6272 } 6273 6274 define_one_arm_cp_reg(cpu, &dbgdidr); 6275 define_arm_cp_regs(cpu, debug_cp_reginfo); 6276 6277 if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) { 6278 define_arm_cp_regs(cpu, debug_lpae_cp_reginfo); 6279 } 6280 6281 for (i = 0; i < brps + 1; i++) { 6282 ARMCPRegInfo dbgregs[] = { 6283 { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH, 6284 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, 6285 .access = PL1_RW, .accessfn = access_tda, 6286 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), 6287 .writefn = dbgbvr_write, .raw_writefn = raw_write 6288 }, 6289 { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH, 6290 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, 6291 .access = PL1_RW, .accessfn = access_tda, 6292 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), 6293 .writefn = dbgbcr_write, .raw_writefn = raw_write 6294 }, 6295 REGINFO_SENTINEL 6296 }; 6297 define_arm_cp_regs(cpu, dbgregs); 6298 } 6299 6300 for (i = 0; i < wrps + 1; i++) { 6301 ARMCPRegInfo dbgregs[] = { 6302 { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH, 6303 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, 6304 .access = PL1_RW, .accessfn = access_tda, 6305 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), 6306 .writefn = dbgwvr_write, .raw_writefn = raw_write 6307 }, 6308 { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH, 6309 .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, 6310 .access = PL1_RW, .accessfn = access_tda, 6311 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), 6312 .writefn = dbgwcr_write, .raw_writefn = raw_write 6313 }, 6314 REGINFO_SENTINEL 6315 }; 6316 define_arm_cp_regs(cpu, dbgregs); 6317 } 6318 } 6319 6320 static void define_pmu_regs(ARMCPU *cpu) 6321 { 6322 /* 6323 * v7 performance monitor control register: same implementor 6324 * field as main ID register, and we implement four counters in 6325 * addition to the cycle count register. 6326 */ 6327 unsigned int i, pmcrn = 4; 6328 ARMCPRegInfo pmcr = { 6329 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 6330 .access = PL0_RW, 6331 .type = ARM_CP_IO | ARM_CP_ALIAS, 6332 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 6333 .accessfn = pmreg_access, .writefn = pmcr_write, 6334 .raw_writefn = raw_write, 6335 }; 6336 ARMCPRegInfo pmcr64 = { 6337 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 6338 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 6339 .access = PL0_RW, .accessfn = pmreg_access, 6340 .type = ARM_CP_IO, 6341 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 6342 .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT), 6343 .writefn = pmcr_write, .raw_writefn = raw_write, 6344 }; 6345 define_one_arm_cp_reg(cpu, &pmcr); 6346 define_one_arm_cp_reg(cpu, &pmcr64); 6347 for (i = 0; i < pmcrn; i++) { 6348 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 6349 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 6350 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 6351 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 6352 ARMCPRegInfo pmev_regs[] = { 6353 { .name = pmevcntr_name, .cp = 15, .crn = 14, 6354 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6355 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6356 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6357 .accessfn = pmreg_access }, 6358 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 6359 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)), 6360 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 6361 .type = ARM_CP_IO, 6362 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6363 .raw_readfn = pmevcntr_rawread, 6364 .raw_writefn = pmevcntr_rawwrite }, 6365 { .name = pmevtyper_name, .cp = 15, .crn = 14, 6366 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6367 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6368 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6369 .accessfn = pmreg_access }, 6370 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 6371 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)), 6372 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 6373 .type = ARM_CP_IO, 6374 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6375 .raw_writefn = pmevtyper_rawwrite }, 6376 REGINFO_SENTINEL 6377 }; 6378 define_arm_cp_regs(cpu, pmev_regs); 6379 g_free(pmevcntr_name); 6380 g_free(pmevcntr_el0_name); 6381 g_free(pmevtyper_name); 6382 g_free(pmevtyper_el0_name); 6383 } 6384 if (cpu_isar_feature(aa32_pmu_8_1, cpu)) { 6385 ARMCPRegInfo v81_pmu_regs[] = { 6386 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 6387 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 6388 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6389 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 6390 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 6391 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 6392 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6393 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 6394 REGINFO_SENTINEL 6395 }; 6396 define_arm_cp_regs(cpu, v81_pmu_regs); 6397 } 6398 } 6399 6400 /* We don't know until after realize whether there's a GICv3 6401 * attached, and that is what registers the gicv3 sysregs. 6402 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 6403 * at runtime. 6404 */ 6405 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 6406 { 6407 ARMCPU *cpu = env_archcpu(env); 6408 uint64_t pfr1 = cpu->id_pfr1; 6409 6410 if (env->gicv3state) { 6411 pfr1 |= 1 << 28; 6412 } 6413 return pfr1; 6414 } 6415 6416 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 6417 { 6418 ARMCPU *cpu = env_archcpu(env); 6419 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 6420 6421 if (env->gicv3state) { 6422 pfr0 |= 1 << 24; 6423 } 6424 return pfr0; 6425 } 6426 6427 /* Shared logic between LORID and the rest of the LOR* registers. 6428 * Secure state has already been delt with. 6429 */ 6430 static CPAccessResult access_lor_ns(CPUARMState *env) 6431 { 6432 int el = arm_current_el(env); 6433 6434 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 6435 return CP_ACCESS_TRAP_EL2; 6436 } 6437 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 6438 return CP_ACCESS_TRAP_EL3; 6439 } 6440 return CP_ACCESS_OK; 6441 } 6442 6443 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri, 6444 bool isread) 6445 { 6446 if (arm_is_secure_below_el3(env)) { 6447 /* Access ok in secure mode. */ 6448 return CP_ACCESS_OK; 6449 } 6450 return access_lor_ns(env); 6451 } 6452 6453 static CPAccessResult access_lor_other(CPUARMState *env, 6454 const ARMCPRegInfo *ri, bool isread) 6455 { 6456 if (arm_is_secure_below_el3(env)) { 6457 /* Access denied in secure mode. */ 6458 return CP_ACCESS_TRAP; 6459 } 6460 return access_lor_ns(env); 6461 } 6462 6463 /* 6464 * A trivial implementation of ARMv8.1-LOR leaves all of these 6465 * registers fixed at 0, which indicates that there are zero 6466 * supported Limited Ordering regions. 6467 */ 6468 static const ARMCPRegInfo lor_reginfo[] = { 6469 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 6470 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 6471 .access = PL1_RW, .accessfn = access_lor_other, 6472 .type = ARM_CP_CONST, .resetvalue = 0 }, 6473 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 6474 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 6475 .access = PL1_RW, .accessfn = access_lor_other, 6476 .type = ARM_CP_CONST, .resetvalue = 0 }, 6477 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 6478 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 6479 .access = PL1_RW, .accessfn = access_lor_other, 6480 .type = ARM_CP_CONST, .resetvalue = 0 }, 6481 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 6482 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 6483 .access = PL1_RW, .accessfn = access_lor_other, 6484 .type = ARM_CP_CONST, .resetvalue = 0 }, 6485 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 6486 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 6487 .access = PL1_R, .accessfn = access_lorid, 6488 .type = ARM_CP_CONST, .resetvalue = 0 }, 6489 REGINFO_SENTINEL 6490 }; 6491 6492 #ifdef TARGET_AARCH64 6493 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 6494 bool isread) 6495 { 6496 int el = arm_current_el(env); 6497 6498 if (el < 2 && 6499 arm_feature(env, ARM_FEATURE_EL2) && 6500 !(arm_hcr_el2_eff(env) & HCR_APK)) { 6501 return CP_ACCESS_TRAP_EL2; 6502 } 6503 if (el < 3 && 6504 arm_feature(env, ARM_FEATURE_EL3) && 6505 !(env->cp15.scr_el3 & SCR_APK)) { 6506 return CP_ACCESS_TRAP_EL3; 6507 } 6508 return CP_ACCESS_OK; 6509 } 6510 6511 static const ARMCPRegInfo pauth_reginfo[] = { 6512 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6513 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 6514 .access = PL1_RW, .accessfn = access_pauth, 6515 .fieldoffset = offsetof(CPUARMState, keys.apda.lo) }, 6516 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6517 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 6518 .access = PL1_RW, .accessfn = access_pauth, 6519 .fieldoffset = offsetof(CPUARMState, keys.apda.hi) }, 6520 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6521 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 6522 .access = PL1_RW, .accessfn = access_pauth, 6523 .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) }, 6524 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6525 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 6526 .access = PL1_RW, .accessfn = access_pauth, 6527 .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) }, 6528 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6529 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 6530 .access = PL1_RW, .accessfn = access_pauth, 6531 .fieldoffset = offsetof(CPUARMState, keys.apga.lo) }, 6532 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6533 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 6534 .access = PL1_RW, .accessfn = access_pauth, 6535 .fieldoffset = offsetof(CPUARMState, keys.apga.hi) }, 6536 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6537 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 6538 .access = PL1_RW, .accessfn = access_pauth, 6539 .fieldoffset = offsetof(CPUARMState, keys.apia.lo) }, 6540 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6541 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 6542 .access = PL1_RW, .accessfn = access_pauth, 6543 .fieldoffset = offsetof(CPUARMState, keys.apia.hi) }, 6544 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 6545 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 6546 .access = PL1_RW, .accessfn = access_pauth, 6547 .fieldoffset = offsetof(CPUARMState, keys.apib.lo) }, 6548 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 6549 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 6550 .access = PL1_RW, .accessfn = access_pauth, 6551 .fieldoffset = offsetof(CPUARMState, keys.apib.hi) }, 6552 REGINFO_SENTINEL 6553 }; 6554 6555 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 6556 { 6557 Error *err = NULL; 6558 uint64_t ret; 6559 6560 /* Success sets NZCV = 0000. */ 6561 env->NF = env->CF = env->VF = 0, env->ZF = 1; 6562 6563 if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) { 6564 /* 6565 * ??? Failed, for unknown reasons in the crypto subsystem. 6566 * The best we can do is log the reason and return the 6567 * timed-out indication to the guest. There is no reason 6568 * we know to expect this failure to be transitory, so the 6569 * guest may well hang retrying the operation. 6570 */ 6571 qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s", 6572 ri->name, error_get_pretty(err)); 6573 error_free(err); 6574 6575 env->ZF = 0; /* NZCF = 0100 */ 6576 return 0; 6577 } 6578 return ret; 6579 } 6580 6581 /* We do not support re-seeding, so the two registers operate the same. */ 6582 static const ARMCPRegInfo rndr_reginfo[] = { 6583 { .name = "RNDR", .state = ARM_CP_STATE_AA64, 6584 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 6585 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0, 6586 .access = PL0_R, .readfn = rndr_readfn }, 6587 { .name = "RNDRRS", .state = ARM_CP_STATE_AA64, 6588 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 6589 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1, 6590 .access = PL0_R, .readfn = rndr_readfn }, 6591 REGINFO_SENTINEL 6592 }; 6593 6594 #ifndef CONFIG_USER_ONLY 6595 static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque, 6596 uint64_t value) 6597 { 6598 ARMCPU *cpu = env_archcpu(env); 6599 /* CTR_EL0 System register -> DminLine, bits [19:16] */ 6600 uint64_t dline_size = 4 << ((cpu->ctr >> 16) & 0xF); 6601 uint64_t vaddr_in = (uint64_t) value; 6602 uint64_t vaddr = vaddr_in & ~(dline_size - 1); 6603 void *haddr; 6604 int mem_idx = cpu_mmu_index(env, false); 6605 6606 /* This won't be crossing page boundaries */ 6607 haddr = probe_read(env, vaddr, dline_size, mem_idx, GETPC()); 6608 if (haddr) { 6609 6610 ram_addr_t offset; 6611 MemoryRegion *mr; 6612 6613 /* RCU lock is already being held */ 6614 mr = memory_region_from_host(haddr, &offset); 6615 6616 if (mr) { 6617 memory_region_do_writeback(mr, offset, dline_size); 6618 } 6619 } 6620 } 6621 6622 static const ARMCPRegInfo dcpop_reg[] = { 6623 { .name = "DC_CVAP", .state = ARM_CP_STATE_AA64, 6624 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1, 6625 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 6626 .accessfn = aa64_cacheop_access, .writefn = dccvap_writefn }, 6627 REGINFO_SENTINEL 6628 }; 6629 6630 static const ARMCPRegInfo dcpodp_reg[] = { 6631 { .name = "DC_CVADP", .state = ARM_CP_STATE_AA64, 6632 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1, 6633 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 6634 .accessfn = aa64_cacheop_access, .writefn = dccvap_writefn }, 6635 REGINFO_SENTINEL 6636 }; 6637 #endif /*CONFIG_USER_ONLY*/ 6638 6639 #endif 6640 6641 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri, 6642 bool isread) 6643 { 6644 int el = arm_current_el(env); 6645 6646 if (el == 0) { 6647 uint64_t sctlr = arm_sctlr(env, el); 6648 if (!(sctlr & SCTLR_EnRCTX)) { 6649 return CP_ACCESS_TRAP; 6650 } 6651 } else if (el == 1) { 6652 uint64_t hcr = arm_hcr_el2_eff(env); 6653 if (hcr & HCR_NV) { 6654 return CP_ACCESS_TRAP_EL2; 6655 } 6656 } 6657 return CP_ACCESS_OK; 6658 } 6659 6660 static const ARMCPRegInfo predinv_reginfo[] = { 6661 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64, 6662 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4, 6663 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6664 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64, 6665 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5, 6666 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6667 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64, 6668 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7, 6669 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6670 /* 6671 * Note the AArch32 opcodes have a different OPC1. 6672 */ 6673 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32, 6674 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4, 6675 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6676 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32, 6677 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5, 6678 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6679 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32, 6680 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7, 6681 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 6682 REGINFO_SENTINEL 6683 }; 6684 6685 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 6686 bool isread) 6687 { 6688 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) { 6689 return CP_ACCESS_TRAP_EL2; 6690 } 6691 6692 return CP_ACCESS_OK; 6693 } 6694 6695 static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 6696 bool isread) 6697 { 6698 if (arm_feature(env, ARM_FEATURE_V8)) { 6699 return access_aa64_tid3(env, ri, isread); 6700 } 6701 6702 return CP_ACCESS_OK; 6703 } 6704 6705 static CPAccessResult access_jazelle(CPUARMState *env, const ARMCPRegInfo *ri, 6706 bool isread) 6707 { 6708 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID0)) { 6709 return CP_ACCESS_TRAP_EL2; 6710 } 6711 6712 return CP_ACCESS_OK; 6713 } 6714 6715 static const ARMCPRegInfo jazelle_regs[] = { 6716 { .name = "JIDR", 6717 .cp = 14, .crn = 0, .crm = 0, .opc1 = 7, .opc2 = 0, 6718 .access = PL1_R, .accessfn = access_jazelle, 6719 .type = ARM_CP_CONST, .resetvalue = 0 }, 6720 { .name = "JOSCR", 6721 .cp = 14, .crn = 1, .crm = 0, .opc1 = 7, .opc2 = 0, 6722 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 6723 { .name = "JMCR", 6724 .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0, 6725 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 6726 REGINFO_SENTINEL 6727 }; 6728 6729 static const ARMCPRegInfo vhe_reginfo[] = { 6730 { .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64, 6731 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1, 6732 .access = PL2_RW, 6733 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2]) }, 6734 { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64, 6735 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1, 6736 .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write, 6737 .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) }, 6738 #ifndef CONFIG_USER_ONLY 6739 { .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64, 6740 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 2, 6741 .fieldoffset = 6742 offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].cval), 6743 .type = ARM_CP_IO, .access = PL2_RW, 6744 .writefn = gt_hv_cval_write, .raw_writefn = raw_write }, 6745 { .name = "CNTHV_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 6746 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 0, 6747 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 6748 .resetfn = gt_hv_timer_reset, 6749 .readfn = gt_hv_tval_read, .writefn = gt_hv_tval_write }, 6750 { .name = "CNTHV_CTL_EL2", .state = ARM_CP_STATE_BOTH, 6751 .type = ARM_CP_IO, 6752 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 1, 6753 .access = PL2_RW, 6754 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].ctl), 6755 .writefn = gt_hv_ctl_write, .raw_writefn = raw_write }, 6756 { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64, 6757 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1, 6758 .type = ARM_CP_IO | ARM_CP_ALIAS, 6759 .access = PL2_RW, .accessfn = e2h_access, 6760 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 6761 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write }, 6762 { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64, 6763 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1, 6764 .type = ARM_CP_IO | ARM_CP_ALIAS, 6765 .access = PL2_RW, .accessfn = e2h_access, 6766 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 6767 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write }, 6768 { .name = "CNTP_TVAL_EL02", .state = ARM_CP_STATE_AA64, 6769 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 0, 6770 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 6771 .access = PL2_RW, .accessfn = e2h_access, 6772 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write }, 6773 { .name = "CNTV_TVAL_EL02", .state = ARM_CP_STATE_AA64, 6774 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 0, 6775 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 6776 .access = PL2_RW, .accessfn = e2h_access, 6777 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write }, 6778 { .name = "CNTP_CVAL_EL02", .state = ARM_CP_STATE_AA64, 6779 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 2, 6780 .type = ARM_CP_IO | ARM_CP_ALIAS, 6781 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 6782 .access = PL2_RW, .accessfn = e2h_access, 6783 .writefn = gt_phys_cval_write, .raw_writefn = raw_write }, 6784 { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64, 6785 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2, 6786 .type = ARM_CP_IO | ARM_CP_ALIAS, 6787 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 6788 .access = PL2_RW, .accessfn = e2h_access, 6789 .writefn = gt_virt_cval_write, .raw_writefn = raw_write }, 6790 #endif 6791 REGINFO_SENTINEL 6792 }; 6793 6794 #ifndef CONFIG_USER_ONLY 6795 static const ARMCPRegInfo ats1e1_reginfo[] = { 6796 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 6797 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0, 6798 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 6799 .writefn = ats_write64 }, 6800 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 6801 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1, 6802 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 6803 .writefn = ats_write64 }, 6804 REGINFO_SENTINEL 6805 }; 6806 6807 static const ARMCPRegInfo ats1cp_reginfo[] = { 6808 { .name = "ATS1CPRP", 6809 .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0, 6810 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 6811 .writefn = ats_write }, 6812 { .name = "ATS1CPWP", 6813 .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1, 6814 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 6815 .writefn = ats_write }, 6816 REGINFO_SENTINEL 6817 }; 6818 #endif 6819 6820 void register_cp_regs_for_features(ARMCPU *cpu) 6821 { 6822 /* Register all the coprocessor registers based on feature bits */ 6823 CPUARMState *env = &cpu->env; 6824 if (arm_feature(env, ARM_FEATURE_M)) { 6825 /* M profile has no coprocessor registers */ 6826 return; 6827 } 6828 6829 define_arm_cp_regs(cpu, cp_reginfo); 6830 if (!arm_feature(env, ARM_FEATURE_V8)) { 6831 /* Must go early as it is full of wildcards that may be 6832 * overridden by later definitions. 6833 */ 6834 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 6835 } 6836 6837 if (arm_feature(env, ARM_FEATURE_V6)) { 6838 /* The ID registers all have impdef reset values */ 6839 ARMCPRegInfo v6_idregs[] = { 6840 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 6841 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 6842 .access = PL1_R, .type = ARM_CP_CONST, 6843 .accessfn = access_aa32_tid3, 6844 .resetvalue = cpu->id_pfr0 }, 6845 /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know 6846 * the value of the GIC field until after we define these regs. 6847 */ 6848 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 6849 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 6850 .access = PL1_R, .type = ARM_CP_NO_RAW, 6851 .accessfn = access_aa32_tid3, 6852 .readfn = id_pfr1_read, 6853 .writefn = arm_cp_write_ignore }, 6854 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 6855 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 6856 .access = PL1_R, .type = ARM_CP_CONST, 6857 .accessfn = access_aa32_tid3, 6858 .resetvalue = cpu->isar.id_dfr0 }, 6859 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 6860 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 6861 .access = PL1_R, .type = ARM_CP_CONST, 6862 .accessfn = access_aa32_tid3, 6863 .resetvalue = cpu->id_afr0 }, 6864 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 6865 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 6866 .access = PL1_R, .type = ARM_CP_CONST, 6867 .accessfn = access_aa32_tid3, 6868 .resetvalue = cpu->id_mmfr0 }, 6869 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 6870 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 6871 .access = PL1_R, .type = ARM_CP_CONST, 6872 .accessfn = access_aa32_tid3, 6873 .resetvalue = cpu->id_mmfr1 }, 6874 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 6875 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 6876 .access = PL1_R, .type = ARM_CP_CONST, 6877 .accessfn = access_aa32_tid3, 6878 .resetvalue = cpu->id_mmfr2 }, 6879 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 6880 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 6881 .access = PL1_R, .type = ARM_CP_CONST, 6882 .accessfn = access_aa32_tid3, 6883 .resetvalue = cpu->id_mmfr3 }, 6884 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 6885 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 6886 .access = PL1_R, .type = ARM_CP_CONST, 6887 .accessfn = access_aa32_tid3, 6888 .resetvalue = cpu->isar.id_isar0 }, 6889 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 6890 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 6891 .access = PL1_R, .type = ARM_CP_CONST, 6892 .accessfn = access_aa32_tid3, 6893 .resetvalue = cpu->isar.id_isar1 }, 6894 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 6895 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 6896 .access = PL1_R, .type = ARM_CP_CONST, 6897 .accessfn = access_aa32_tid3, 6898 .resetvalue = cpu->isar.id_isar2 }, 6899 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 6900 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 6901 .access = PL1_R, .type = ARM_CP_CONST, 6902 .accessfn = access_aa32_tid3, 6903 .resetvalue = cpu->isar.id_isar3 }, 6904 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 6905 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 6906 .access = PL1_R, .type = ARM_CP_CONST, 6907 .accessfn = access_aa32_tid3, 6908 .resetvalue = cpu->isar.id_isar4 }, 6909 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 6910 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 6911 .access = PL1_R, .type = ARM_CP_CONST, 6912 .accessfn = access_aa32_tid3, 6913 .resetvalue = cpu->isar.id_isar5 }, 6914 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 6915 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 6916 .access = PL1_R, .type = ARM_CP_CONST, 6917 .accessfn = access_aa32_tid3, 6918 .resetvalue = cpu->id_mmfr4 }, 6919 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 6920 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 6921 .access = PL1_R, .type = ARM_CP_CONST, 6922 .accessfn = access_aa32_tid3, 6923 .resetvalue = cpu->isar.id_isar6 }, 6924 REGINFO_SENTINEL 6925 }; 6926 define_arm_cp_regs(cpu, v6_idregs); 6927 define_arm_cp_regs(cpu, v6_cp_reginfo); 6928 } else { 6929 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 6930 } 6931 if (arm_feature(env, ARM_FEATURE_V6K)) { 6932 define_arm_cp_regs(cpu, v6k_cp_reginfo); 6933 } 6934 if (arm_feature(env, ARM_FEATURE_V7MP) && 6935 !arm_feature(env, ARM_FEATURE_PMSA)) { 6936 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 6937 } 6938 if (arm_feature(env, ARM_FEATURE_V7VE)) { 6939 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 6940 } 6941 if (arm_feature(env, ARM_FEATURE_V7)) { 6942 ARMCPRegInfo clidr = { 6943 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 6944 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 6945 .access = PL1_R, .type = ARM_CP_CONST, 6946 .accessfn = access_aa64_tid2, 6947 .resetvalue = cpu->clidr 6948 }; 6949 define_one_arm_cp_reg(cpu, &clidr); 6950 define_arm_cp_regs(cpu, v7_cp_reginfo); 6951 define_debug_regs(cpu); 6952 define_pmu_regs(cpu); 6953 } else { 6954 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 6955 } 6956 if (arm_feature(env, ARM_FEATURE_V8)) { 6957 /* AArch64 ID registers, which all have impdef reset values. 6958 * Note that within the ID register ranges the unused slots 6959 * must all RAZ, not UNDEF; future architecture versions may 6960 * define new registers here. 6961 */ 6962 ARMCPRegInfo v8_idregs[] = { 6963 /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't 6964 * know the right value for the GIC field until after we 6965 * define these regs. 6966 */ 6967 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 6968 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 6969 .access = PL1_R, .type = ARM_CP_NO_RAW, 6970 .accessfn = access_aa64_tid3, 6971 .readfn = id_aa64pfr0_read, 6972 .writefn = arm_cp_write_ignore }, 6973 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 6974 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 6975 .access = PL1_R, .type = ARM_CP_CONST, 6976 .accessfn = access_aa64_tid3, 6977 .resetvalue = cpu->isar.id_aa64pfr1}, 6978 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6979 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 6980 .access = PL1_R, .type = ARM_CP_CONST, 6981 .accessfn = access_aa64_tid3, 6982 .resetvalue = 0 }, 6983 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6984 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 6985 .access = PL1_R, .type = ARM_CP_CONST, 6986 .accessfn = access_aa64_tid3, 6987 .resetvalue = 0 }, 6988 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 6989 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 6990 .access = PL1_R, .type = ARM_CP_CONST, 6991 .accessfn = access_aa64_tid3, 6992 /* At present, only SVEver == 0 is defined anyway. */ 6993 .resetvalue = 0 }, 6994 { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 6995 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 6996 .access = PL1_R, .type = ARM_CP_CONST, 6997 .accessfn = access_aa64_tid3, 6998 .resetvalue = 0 }, 6999 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7000 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 7001 .access = PL1_R, .type = ARM_CP_CONST, 7002 .accessfn = access_aa64_tid3, 7003 .resetvalue = 0 }, 7004 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7005 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 7006 .access = PL1_R, .type = ARM_CP_CONST, 7007 .accessfn = access_aa64_tid3, 7008 .resetvalue = 0 }, 7009 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 7010 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 7011 .access = PL1_R, .type = ARM_CP_CONST, 7012 .accessfn = access_aa64_tid3, 7013 .resetvalue = cpu->id_aa64dfr0 }, 7014 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 7015 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 7016 .access = PL1_R, .type = ARM_CP_CONST, 7017 .accessfn = access_aa64_tid3, 7018 .resetvalue = cpu->id_aa64dfr1 }, 7019 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7020 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 7021 .access = PL1_R, .type = ARM_CP_CONST, 7022 .accessfn = access_aa64_tid3, 7023 .resetvalue = 0 }, 7024 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7025 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 7026 .access = PL1_R, .type = ARM_CP_CONST, 7027 .accessfn = access_aa64_tid3, 7028 .resetvalue = 0 }, 7029 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 7030 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 7031 .access = PL1_R, .type = ARM_CP_CONST, 7032 .accessfn = access_aa64_tid3, 7033 .resetvalue = cpu->id_aa64afr0 }, 7034 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 7035 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 7036 .access = PL1_R, .type = ARM_CP_CONST, 7037 .accessfn = access_aa64_tid3, 7038 .resetvalue = cpu->id_aa64afr1 }, 7039 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7040 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 7041 .access = PL1_R, .type = ARM_CP_CONST, 7042 .accessfn = access_aa64_tid3, 7043 .resetvalue = 0 }, 7044 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7045 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 7046 .access = PL1_R, .type = ARM_CP_CONST, 7047 .accessfn = access_aa64_tid3, 7048 .resetvalue = 0 }, 7049 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 7050 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 7051 .access = PL1_R, .type = ARM_CP_CONST, 7052 .accessfn = access_aa64_tid3, 7053 .resetvalue = cpu->isar.id_aa64isar0 }, 7054 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 7055 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 7056 .access = PL1_R, .type = ARM_CP_CONST, 7057 .accessfn = access_aa64_tid3, 7058 .resetvalue = cpu->isar.id_aa64isar1 }, 7059 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7060 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 7061 .access = PL1_R, .type = ARM_CP_CONST, 7062 .accessfn = access_aa64_tid3, 7063 .resetvalue = 0 }, 7064 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7065 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 7066 .access = PL1_R, .type = ARM_CP_CONST, 7067 .accessfn = access_aa64_tid3, 7068 .resetvalue = 0 }, 7069 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7070 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 7071 .access = PL1_R, .type = ARM_CP_CONST, 7072 .accessfn = access_aa64_tid3, 7073 .resetvalue = 0 }, 7074 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7075 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 7076 .access = PL1_R, .type = ARM_CP_CONST, 7077 .accessfn = access_aa64_tid3, 7078 .resetvalue = 0 }, 7079 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7080 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 7081 .access = PL1_R, .type = ARM_CP_CONST, 7082 .accessfn = access_aa64_tid3, 7083 .resetvalue = 0 }, 7084 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7085 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 7086 .access = PL1_R, .type = ARM_CP_CONST, 7087 .accessfn = access_aa64_tid3, 7088 .resetvalue = 0 }, 7089 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 7090 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 7091 .access = PL1_R, .type = ARM_CP_CONST, 7092 .accessfn = access_aa64_tid3, 7093 .resetvalue = cpu->isar.id_aa64mmfr0 }, 7094 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 7095 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 7096 .access = PL1_R, .type = ARM_CP_CONST, 7097 .accessfn = access_aa64_tid3, 7098 .resetvalue = cpu->isar.id_aa64mmfr1 }, 7099 { .name = "ID_AA64MMFR2_EL1", .state = ARM_CP_STATE_AA64, 7100 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 7101 .access = PL1_R, .type = ARM_CP_CONST, 7102 .accessfn = access_aa64_tid3, 7103 .resetvalue = cpu->isar.id_aa64mmfr2 }, 7104 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7105 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 7106 .access = PL1_R, .type = ARM_CP_CONST, 7107 .accessfn = access_aa64_tid3, 7108 .resetvalue = 0 }, 7109 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7110 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 7111 .access = PL1_R, .type = ARM_CP_CONST, 7112 .accessfn = access_aa64_tid3, 7113 .resetvalue = 0 }, 7114 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7115 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 7116 .access = PL1_R, .type = ARM_CP_CONST, 7117 .accessfn = access_aa64_tid3, 7118 .resetvalue = 0 }, 7119 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7120 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 7121 .access = PL1_R, .type = ARM_CP_CONST, 7122 .accessfn = access_aa64_tid3, 7123 .resetvalue = 0 }, 7124 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7125 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 7126 .access = PL1_R, .type = ARM_CP_CONST, 7127 .accessfn = access_aa64_tid3, 7128 .resetvalue = 0 }, 7129 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 7130 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 7131 .access = PL1_R, .type = ARM_CP_CONST, 7132 .accessfn = access_aa64_tid3, 7133 .resetvalue = cpu->isar.mvfr0 }, 7134 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 7135 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 7136 .access = PL1_R, .type = ARM_CP_CONST, 7137 .accessfn = access_aa64_tid3, 7138 .resetvalue = cpu->isar.mvfr1 }, 7139 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 7140 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 7141 .access = PL1_R, .type = ARM_CP_CONST, 7142 .accessfn = access_aa64_tid3, 7143 .resetvalue = cpu->isar.mvfr2 }, 7144 { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7145 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 7146 .access = PL1_R, .type = ARM_CP_CONST, 7147 .accessfn = access_aa64_tid3, 7148 .resetvalue = 0 }, 7149 { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7150 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 7151 .access = PL1_R, .type = ARM_CP_CONST, 7152 .accessfn = access_aa64_tid3, 7153 .resetvalue = 0 }, 7154 { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7155 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 7156 .access = PL1_R, .type = ARM_CP_CONST, 7157 .accessfn = access_aa64_tid3, 7158 .resetvalue = 0 }, 7159 { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7160 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 7161 .access = PL1_R, .type = ARM_CP_CONST, 7162 .accessfn = access_aa64_tid3, 7163 .resetvalue = 0 }, 7164 { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7165 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 7166 .access = PL1_R, .type = ARM_CP_CONST, 7167 .accessfn = access_aa64_tid3, 7168 .resetvalue = 0 }, 7169 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 7170 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 7171 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7172 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 7173 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 7174 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 7175 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7176 .resetvalue = cpu->pmceid0 }, 7177 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 7178 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 7179 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7180 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 7181 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 7182 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 7183 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 7184 .resetvalue = cpu->pmceid1 }, 7185 REGINFO_SENTINEL 7186 }; 7187 #ifdef CONFIG_USER_ONLY 7188 ARMCPRegUserSpaceInfo v8_user_idregs[] = { 7189 { .name = "ID_AA64PFR0_EL1", 7190 .exported_bits = 0x000f000f00ff0000, 7191 .fixed_bits = 0x0000000000000011 }, 7192 { .name = "ID_AA64PFR1_EL1", 7193 .exported_bits = 0x00000000000000f0 }, 7194 { .name = "ID_AA64PFR*_EL1_RESERVED", 7195 .is_glob = true }, 7196 { .name = "ID_AA64ZFR0_EL1" }, 7197 { .name = "ID_AA64MMFR0_EL1", 7198 .fixed_bits = 0x00000000ff000000 }, 7199 { .name = "ID_AA64MMFR1_EL1" }, 7200 { .name = "ID_AA64MMFR*_EL1_RESERVED", 7201 .is_glob = true }, 7202 { .name = "ID_AA64DFR0_EL1", 7203 .fixed_bits = 0x0000000000000006 }, 7204 { .name = "ID_AA64DFR1_EL1" }, 7205 { .name = "ID_AA64DFR*_EL1_RESERVED", 7206 .is_glob = true }, 7207 { .name = "ID_AA64AFR*", 7208 .is_glob = true }, 7209 { .name = "ID_AA64ISAR0_EL1", 7210 .exported_bits = 0x00fffffff0fffff0 }, 7211 { .name = "ID_AA64ISAR1_EL1", 7212 .exported_bits = 0x000000f0ffffffff }, 7213 { .name = "ID_AA64ISAR*_EL1_RESERVED", 7214 .is_glob = true }, 7215 REGUSERINFO_SENTINEL 7216 }; 7217 modify_arm_cp_regs(v8_idregs, v8_user_idregs); 7218 #endif 7219 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ 7220 if (!arm_feature(env, ARM_FEATURE_EL3) && 7221 !arm_feature(env, ARM_FEATURE_EL2)) { 7222 ARMCPRegInfo rvbar = { 7223 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64, 7224 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 7225 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar 7226 }; 7227 define_one_arm_cp_reg(cpu, &rvbar); 7228 } 7229 define_arm_cp_regs(cpu, v8_idregs); 7230 define_arm_cp_regs(cpu, v8_cp_reginfo); 7231 } 7232 if (arm_feature(env, ARM_FEATURE_EL2)) { 7233 uint64_t vmpidr_def = mpidr_read_val(env); 7234 ARMCPRegInfo vpidr_regs[] = { 7235 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 7236 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 7237 .access = PL2_RW, .accessfn = access_el3_aa32ns, 7238 .resetvalue = cpu->midr, .type = ARM_CP_ALIAS, 7239 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 7240 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 7241 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 7242 .access = PL2_RW, .resetvalue = cpu->midr, 7243 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 7244 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 7245 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 7246 .access = PL2_RW, .accessfn = access_el3_aa32ns, 7247 .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS, 7248 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 7249 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 7250 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 7251 .access = PL2_RW, 7252 .resetvalue = vmpidr_def, 7253 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 7254 REGINFO_SENTINEL 7255 }; 7256 define_arm_cp_regs(cpu, vpidr_regs); 7257 define_arm_cp_regs(cpu, el2_cp_reginfo); 7258 if (arm_feature(env, ARM_FEATURE_V8)) { 7259 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 7260 } 7261 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */ 7262 if (!arm_feature(env, ARM_FEATURE_EL3)) { 7263 ARMCPRegInfo rvbar = { 7264 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 7265 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 7266 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar 7267 }; 7268 define_one_arm_cp_reg(cpu, &rvbar); 7269 } 7270 } else { 7271 /* If EL2 is missing but higher ELs are enabled, we need to 7272 * register the no_el2 reginfos. 7273 */ 7274 if (arm_feature(env, ARM_FEATURE_EL3)) { 7275 /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value 7276 * of MIDR_EL1 and MPIDR_EL1. 7277 */ 7278 ARMCPRegInfo vpidr_regs[] = { 7279 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH, 7280 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 7281 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 7282 .type = ARM_CP_CONST, .resetvalue = cpu->midr, 7283 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 7284 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH, 7285 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 7286 .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, 7287 .type = ARM_CP_NO_RAW, 7288 .writefn = arm_cp_write_ignore, .readfn = mpidr_read }, 7289 REGINFO_SENTINEL 7290 }; 7291 define_arm_cp_regs(cpu, vpidr_regs); 7292 define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo); 7293 if (arm_feature(env, ARM_FEATURE_V8)) { 7294 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo); 7295 } 7296 } 7297 } 7298 if (arm_feature(env, ARM_FEATURE_EL3)) { 7299 define_arm_cp_regs(cpu, el3_cp_reginfo); 7300 ARMCPRegInfo el3_regs[] = { 7301 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 7302 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 7303 .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar }, 7304 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 7305 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 7306 .access = PL3_RW, 7307 .raw_writefn = raw_write, .writefn = sctlr_write, 7308 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 7309 .resetvalue = cpu->reset_sctlr }, 7310 REGINFO_SENTINEL 7311 }; 7312 7313 define_arm_cp_regs(cpu, el3_regs); 7314 } 7315 /* The behaviour of NSACR is sufficiently various that we don't 7316 * try to describe it in a single reginfo: 7317 * if EL3 is 64 bit, then trap to EL3 from S EL1, 7318 * reads as constant 0xc00 from NS EL1 and NS EL2 7319 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 7320 * if v7 without EL3, register doesn't exist 7321 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 7322 */ 7323 if (arm_feature(env, ARM_FEATURE_EL3)) { 7324 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 7325 ARMCPRegInfo nsacr = { 7326 .name = "NSACR", .type = ARM_CP_CONST, 7327 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 7328 .access = PL1_RW, .accessfn = nsacr_access, 7329 .resetvalue = 0xc00 7330 }; 7331 define_one_arm_cp_reg(cpu, &nsacr); 7332 } else { 7333 ARMCPRegInfo nsacr = { 7334 .name = "NSACR", 7335 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 7336 .access = PL3_RW | PL1_R, 7337 .resetvalue = 0, 7338 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 7339 }; 7340 define_one_arm_cp_reg(cpu, &nsacr); 7341 } 7342 } else { 7343 if (arm_feature(env, ARM_FEATURE_V8)) { 7344 ARMCPRegInfo nsacr = { 7345 .name = "NSACR", .type = ARM_CP_CONST, 7346 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 7347 .access = PL1_R, 7348 .resetvalue = 0xc00 7349 }; 7350 define_one_arm_cp_reg(cpu, &nsacr); 7351 } 7352 } 7353 7354 if (arm_feature(env, ARM_FEATURE_PMSA)) { 7355 if (arm_feature(env, ARM_FEATURE_V6)) { 7356 /* PMSAv6 not implemented */ 7357 assert(arm_feature(env, ARM_FEATURE_V7)); 7358 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 7359 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 7360 } else { 7361 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 7362 } 7363 } else { 7364 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 7365 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 7366 /* TTCBR2 is introduced with ARMv8.2-A32HPD. */ 7367 if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) { 7368 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 7369 } 7370 } 7371 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 7372 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 7373 } 7374 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 7375 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 7376 } 7377 if (arm_feature(env, ARM_FEATURE_VAPA)) { 7378 define_arm_cp_regs(cpu, vapa_cp_reginfo); 7379 } 7380 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 7381 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 7382 } 7383 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 7384 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 7385 } 7386 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 7387 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 7388 } 7389 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 7390 define_arm_cp_regs(cpu, omap_cp_reginfo); 7391 } 7392 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 7393 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 7394 } 7395 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 7396 define_arm_cp_regs(cpu, xscale_cp_reginfo); 7397 } 7398 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 7399 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 7400 } 7401 if (arm_feature(env, ARM_FEATURE_LPAE)) { 7402 define_arm_cp_regs(cpu, lpae_cp_reginfo); 7403 } 7404 if (cpu_isar_feature(aa32_jazelle, cpu)) { 7405 define_arm_cp_regs(cpu, jazelle_regs); 7406 } 7407 /* Slightly awkwardly, the OMAP and StrongARM cores need all of 7408 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 7409 * be read-only (ie write causes UNDEF exception). 7410 */ 7411 { 7412 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 7413 /* Pre-v8 MIDR space. 7414 * Note that the MIDR isn't a simple constant register because 7415 * of the TI925 behaviour where writes to another register can 7416 * cause the MIDR value to change. 7417 * 7418 * Unimplemented registers in the c15 0 0 0 space default to 7419 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 7420 * and friends override accordingly. 7421 */ 7422 { .name = "MIDR", 7423 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 7424 .access = PL1_R, .resetvalue = cpu->midr, 7425 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 7426 .readfn = midr_read, 7427 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 7428 .type = ARM_CP_OVERRIDE }, 7429 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 7430 { .name = "DUMMY", 7431 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 7432 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7433 { .name = "DUMMY", 7434 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 7435 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7436 { .name = "DUMMY", 7437 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 7438 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7439 { .name = "DUMMY", 7440 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 7441 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7442 { .name = "DUMMY", 7443 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 7444 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 7445 REGINFO_SENTINEL 7446 }; 7447 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 7448 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 7449 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 7450 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 7451 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 7452 .readfn = midr_read }, 7453 /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */ 7454 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 7455 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 7456 .access = PL1_R, .resetvalue = cpu->midr }, 7457 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 7458 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 7459 .access = PL1_R, .resetvalue = cpu->midr }, 7460 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 7461 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 7462 .access = PL1_R, 7463 .accessfn = access_aa64_tid1, 7464 .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 7465 REGINFO_SENTINEL 7466 }; 7467 ARMCPRegInfo id_cp_reginfo[] = { 7468 /* These are common to v8 and pre-v8 */ 7469 { .name = "CTR", 7470 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 7471 .access = PL1_R, .accessfn = ctr_el0_access, 7472 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 7473 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 7474 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 7475 .access = PL0_R, .accessfn = ctr_el0_access, 7476 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 7477 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 7478 { .name = "TCMTR", 7479 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 7480 .access = PL1_R, 7481 .accessfn = access_aa32_tid1, 7482 .type = ARM_CP_CONST, .resetvalue = 0 }, 7483 REGINFO_SENTINEL 7484 }; 7485 /* TLBTR is specific to VMSA */ 7486 ARMCPRegInfo id_tlbtr_reginfo = { 7487 .name = "TLBTR", 7488 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 7489 .access = PL1_R, 7490 .accessfn = access_aa32_tid1, 7491 .type = ARM_CP_CONST, .resetvalue = 0, 7492 }; 7493 /* MPUIR is specific to PMSA V6+ */ 7494 ARMCPRegInfo id_mpuir_reginfo = { 7495 .name = "MPUIR", 7496 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 7497 .access = PL1_R, .type = ARM_CP_CONST, 7498 .resetvalue = cpu->pmsav7_dregion << 8 7499 }; 7500 ARMCPRegInfo crn0_wi_reginfo = { 7501 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 7502 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 7503 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 7504 }; 7505 #ifdef CONFIG_USER_ONLY 7506 ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = { 7507 { .name = "MIDR_EL1", 7508 .exported_bits = 0x00000000ffffffff }, 7509 { .name = "REVIDR_EL1" }, 7510 REGUSERINFO_SENTINEL 7511 }; 7512 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo); 7513 #endif 7514 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 7515 arm_feature(env, ARM_FEATURE_STRONGARM)) { 7516 ARMCPRegInfo *r; 7517 /* Register the blanket "writes ignored" value first to cover the 7518 * whole space. Then update the specific ID registers to allow write 7519 * access, so that they ignore writes rather than causing them to 7520 * UNDEF. 7521 */ 7522 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 7523 for (r = id_pre_v8_midr_cp_reginfo; 7524 r->type != ARM_CP_SENTINEL; r++) { 7525 r->access = PL1_RW; 7526 } 7527 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) { 7528 r->access = PL1_RW; 7529 } 7530 id_mpuir_reginfo.access = PL1_RW; 7531 id_tlbtr_reginfo.access = PL1_RW; 7532 } 7533 if (arm_feature(env, ARM_FEATURE_V8)) { 7534 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 7535 } else { 7536 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 7537 } 7538 define_arm_cp_regs(cpu, id_cp_reginfo); 7539 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 7540 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 7541 } else if (arm_feature(env, ARM_FEATURE_V7)) { 7542 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 7543 } 7544 } 7545 7546 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 7547 ARMCPRegInfo mpidr_cp_reginfo[] = { 7548 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH, 7549 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 7550 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 7551 REGINFO_SENTINEL 7552 }; 7553 #ifdef CONFIG_USER_ONLY 7554 ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = { 7555 { .name = "MPIDR_EL1", 7556 .fixed_bits = 0x0000000080000000 }, 7557 REGUSERINFO_SENTINEL 7558 }; 7559 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo); 7560 #endif 7561 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 7562 } 7563 7564 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 7565 ARMCPRegInfo auxcr_reginfo[] = { 7566 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 7567 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 7568 .access = PL1_RW, .type = ARM_CP_CONST, 7569 .resetvalue = cpu->reset_auxcr }, 7570 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 7571 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 7572 .access = PL2_RW, .type = ARM_CP_CONST, 7573 .resetvalue = 0 }, 7574 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 7575 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 7576 .access = PL3_RW, .type = ARM_CP_CONST, 7577 .resetvalue = 0 }, 7578 REGINFO_SENTINEL 7579 }; 7580 define_arm_cp_regs(cpu, auxcr_reginfo); 7581 if (arm_feature(env, ARM_FEATURE_V8)) { 7582 /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */ 7583 ARMCPRegInfo hactlr2_reginfo = { 7584 .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 7585 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 7586 .access = PL2_RW, .type = ARM_CP_CONST, 7587 .resetvalue = 0 7588 }; 7589 define_one_arm_cp_reg(cpu, &hactlr2_reginfo); 7590 } 7591 } 7592 7593 if (arm_feature(env, ARM_FEATURE_CBAR)) { 7594 /* 7595 * CBAR is IMPDEF, but common on Arm Cortex-A implementations. 7596 * There are two flavours: 7597 * (1) older 32-bit only cores have a simple 32-bit CBAR 7598 * (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a 7599 * 32-bit register visible to AArch32 at a different encoding 7600 * to the "flavour 1" register and with the bits rearranged to 7601 * be able to squash a 64-bit address into the 32-bit view. 7602 * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but 7603 * in future if we support AArch32-only configs of some of the 7604 * AArch64 cores we might need to add a specific feature flag 7605 * to indicate cores with "flavour 2" CBAR. 7606 */ 7607 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 7608 /* 32 bit view is [31:18] 0...0 [43:32]. */ 7609 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 7610 | extract64(cpu->reset_cbar, 32, 12); 7611 ARMCPRegInfo cbar_reginfo[] = { 7612 { .name = "CBAR", 7613 .type = ARM_CP_CONST, 7614 .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0, 7615 .access = PL1_R, .resetvalue = cbar32 }, 7616 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 7617 .type = ARM_CP_CONST, 7618 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 7619 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 7620 REGINFO_SENTINEL 7621 }; 7622 /* We don't implement a r/w 64 bit CBAR currently */ 7623 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 7624 define_arm_cp_regs(cpu, cbar_reginfo); 7625 } else { 7626 ARMCPRegInfo cbar = { 7627 .name = "CBAR", 7628 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 7629 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar, 7630 .fieldoffset = offsetof(CPUARMState, 7631 cp15.c15_config_base_address) 7632 }; 7633 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 7634 cbar.access = PL1_R; 7635 cbar.fieldoffset = 0; 7636 cbar.type = ARM_CP_CONST; 7637 } 7638 define_one_arm_cp_reg(cpu, &cbar); 7639 } 7640 } 7641 7642 if (arm_feature(env, ARM_FEATURE_VBAR)) { 7643 ARMCPRegInfo vbar_cp_reginfo[] = { 7644 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 7645 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 7646 .access = PL1_RW, .writefn = vbar_write, 7647 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 7648 offsetof(CPUARMState, cp15.vbar_ns) }, 7649 .resetvalue = 0 }, 7650 REGINFO_SENTINEL 7651 }; 7652 define_arm_cp_regs(cpu, vbar_cp_reginfo); 7653 } 7654 7655 /* Generic registers whose values depend on the implementation */ 7656 { 7657 ARMCPRegInfo sctlr = { 7658 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 7659 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 7660 .access = PL1_RW, 7661 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 7662 offsetof(CPUARMState, cp15.sctlr_ns) }, 7663 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 7664 .raw_writefn = raw_write, 7665 }; 7666 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 7667 /* Normally we would always end the TB on an SCTLR write, but Linux 7668 * arch/arm/mach-pxa/sleep.S expects two instructions following 7669 * an MMU enable to execute from cache. Imitate this behaviour. 7670 */ 7671 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 7672 } 7673 define_one_arm_cp_reg(cpu, &sctlr); 7674 } 7675 7676 if (cpu_isar_feature(aa64_lor, cpu)) { 7677 define_arm_cp_regs(cpu, lor_reginfo); 7678 } 7679 if (cpu_isar_feature(aa64_pan, cpu)) { 7680 define_one_arm_cp_reg(cpu, &pan_reginfo); 7681 } 7682 #ifndef CONFIG_USER_ONLY 7683 if (cpu_isar_feature(aa64_ats1e1, cpu)) { 7684 define_arm_cp_regs(cpu, ats1e1_reginfo); 7685 } 7686 if (cpu_isar_feature(aa32_ats1e1, cpu)) { 7687 define_arm_cp_regs(cpu, ats1cp_reginfo); 7688 } 7689 #endif 7690 if (cpu_isar_feature(aa64_uao, cpu)) { 7691 define_one_arm_cp_reg(cpu, &uao_reginfo); 7692 } 7693 7694 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 7695 define_arm_cp_regs(cpu, vhe_reginfo); 7696 } 7697 7698 if (cpu_isar_feature(aa64_sve, cpu)) { 7699 define_one_arm_cp_reg(cpu, &zcr_el1_reginfo); 7700 if (arm_feature(env, ARM_FEATURE_EL2)) { 7701 define_one_arm_cp_reg(cpu, &zcr_el2_reginfo); 7702 } else { 7703 define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo); 7704 } 7705 if (arm_feature(env, ARM_FEATURE_EL3)) { 7706 define_one_arm_cp_reg(cpu, &zcr_el3_reginfo); 7707 } 7708 } 7709 7710 #ifdef TARGET_AARCH64 7711 if (cpu_isar_feature(aa64_pauth, cpu)) { 7712 define_arm_cp_regs(cpu, pauth_reginfo); 7713 } 7714 if (cpu_isar_feature(aa64_rndr, cpu)) { 7715 define_arm_cp_regs(cpu, rndr_reginfo); 7716 } 7717 #ifndef CONFIG_USER_ONLY 7718 /* Data Cache clean instructions up to PoP */ 7719 if (cpu_isar_feature(aa64_dcpop, cpu)) { 7720 define_one_arm_cp_reg(cpu, dcpop_reg); 7721 7722 if (cpu_isar_feature(aa64_dcpodp, cpu)) { 7723 define_one_arm_cp_reg(cpu, dcpodp_reg); 7724 } 7725 } 7726 #endif /*CONFIG_USER_ONLY*/ 7727 #endif 7728 7729 if (cpu_isar_feature(any_predinv, cpu)) { 7730 define_arm_cp_regs(cpu, predinv_reginfo); 7731 } 7732 7733 #ifndef CONFIG_USER_ONLY 7734 /* 7735 * Register redirections and aliases must be done last, 7736 * after the registers from the other extensions have been defined. 7737 */ 7738 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 7739 define_arm_vh_e2h_redirects_aliases(cpu); 7740 } 7741 #endif 7742 } 7743 7744 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) 7745 { 7746 CPUState *cs = CPU(cpu); 7747 CPUARMState *env = &cpu->env; 7748 7749 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 7750 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg, 7751 aarch64_fpu_gdb_set_reg, 7752 34, "aarch64-fpu.xml", 0); 7753 } else if (arm_feature(env, ARM_FEATURE_NEON)) { 7754 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 7755 51, "arm-neon.xml", 0); 7756 } else if (arm_feature(env, ARM_FEATURE_VFP3)) { 7757 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 7758 35, "arm-vfp3.xml", 0); 7759 } else if (arm_feature(env, ARM_FEATURE_VFP)) { 7760 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg, 7761 19, "arm-vfp.xml", 0); 7762 } 7763 gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg, 7764 arm_gen_dynamic_xml(cs), 7765 "system-registers.xml", 0); 7766 } 7767 7768 /* Sort alphabetically by type name, except for "any". */ 7769 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b) 7770 { 7771 ObjectClass *class_a = (ObjectClass *)a; 7772 ObjectClass *class_b = (ObjectClass *)b; 7773 const char *name_a, *name_b; 7774 7775 name_a = object_class_get_name(class_a); 7776 name_b = object_class_get_name(class_b); 7777 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) { 7778 return 1; 7779 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) { 7780 return -1; 7781 } else { 7782 return strcmp(name_a, name_b); 7783 } 7784 } 7785 7786 static void arm_cpu_list_entry(gpointer data, gpointer user_data) 7787 { 7788 ObjectClass *oc = data; 7789 const char *typename; 7790 char *name; 7791 7792 typename = object_class_get_name(oc); 7793 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU)); 7794 qemu_printf(" %s\n", name); 7795 g_free(name); 7796 } 7797 7798 void arm_cpu_list(void) 7799 { 7800 GSList *list; 7801 7802 list = object_class_get_list(TYPE_ARM_CPU, false); 7803 list = g_slist_sort(list, arm_cpu_list_compare); 7804 qemu_printf("Available CPUs:\n"); 7805 g_slist_foreach(list, arm_cpu_list_entry, NULL); 7806 g_slist_free(list); 7807 } 7808 7809 static void arm_cpu_add_definition(gpointer data, gpointer user_data) 7810 { 7811 ObjectClass *oc = data; 7812 CpuDefinitionInfoList **cpu_list = user_data; 7813 CpuDefinitionInfoList *entry; 7814 CpuDefinitionInfo *info; 7815 const char *typename; 7816 7817 typename = object_class_get_name(oc); 7818 info = g_malloc0(sizeof(*info)); 7819 info->name = g_strndup(typename, 7820 strlen(typename) - strlen("-" TYPE_ARM_CPU)); 7821 info->q_typename = g_strdup(typename); 7822 7823 entry = g_malloc0(sizeof(*entry)); 7824 entry->value = info; 7825 entry->next = *cpu_list; 7826 *cpu_list = entry; 7827 } 7828 7829 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp) 7830 { 7831 CpuDefinitionInfoList *cpu_list = NULL; 7832 GSList *list; 7833 7834 list = object_class_get_list(TYPE_ARM_CPU, false); 7835 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list); 7836 g_slist_free(list); 7837 7838 return cpu_list; 7839 } 7840 7841 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 7842 void *opaque, int state, int secstate, 7843 int crm, int opc1, int opc2, 7844 const char *name) 7845 { 7846 /* Private utility function for define_one_arm_cp_reg_with_opaque(): 7847 * add a single reginfo struct to the hash table. 7848 */ 7849 uint32_t *key = g_new(uint32_t, 1); 7850 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo)); 7851 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0; 7852 int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0; 7853 7854 r2->name = g_strdup(name); 7855 /* Reset the secure state to the specific incoming state. This is 7856 * necessary as the register may have been defined with both states. 7857 */ 7858 r2->secure = secstate; 7859 7860 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 7861 /* Register is banked (using both entries in array). 7862 * Overwriting fieldoffset as the array is only used to define 7863 * banked registers but later only fieldoffset is used. 7864 */ 7865 r2->fieldoffset = r->bank_fieldoffsets[ns]; 7866 } 7867 7868 if (state == ARM_CP_STATE_AA32) { 7869 if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) { 7870 /* If the register is banked then we don't need to migrate or 7871 * reset the 32-bit instance in certain cases: 7872 * 7873 * 1) If the register has both 32-bit and 64-bit instances then we 7874 * can count on the 64-bit instance taking care of the 7875 * non-secure bank. 7876 * 2) If ARMv8 is enabled then we can count on a 64-bit version 7877 * taking care of the secure bank. This requires that separate 7878 * 32 and 64-bit definitions are provided. 7879 */ 7880 if ((r->state == ARM_CP_STATE_BOTH && ns) || 7881 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) { 7882 r2->type |= ARM_CP_ALIAS; 7883 } 7884 } else if ((secstate != r->secure) && !ns) { 7885 /* The register is not banked so we only want to allow migration of 7886 * the non-secure instance. 7887 */ 7888 r2->type |= ARM_CP_ALIAS; 7889 } 7890 7891 if (r->state == ARM_CP_STATE_BOTH) { 7892 /* We assume it is a cp15 register if the .cp field is left unset. 7893 */ 7894 if (r2->cp == 0) { 7895 r2->cp = 15; 7896 } 7897 7898 #ifdef HOST_WORDS_BIGENDIAN 7899 if (r2->fieldoffset) { 7900 r2->fieldoffset += sizeof(uint32_t); 7901 } 7902 #endif 7903 } 7904 } 7905 if (state == ARM_CP_STATE_AA64) { 7906 /* To allow abbreviation of ARMCPRegInfo 7907 * definitions, we treat cp == 0 as equivalent to 7908 * the value for "standard guest-visible sysreg". 7909 * STATE_BOTH definitions are also always "standard 7910 * sysreg" in their AArch64 view (the .cp value may 7911 * be non-zero for the benefit of the AArch32 view). 7912 */ 7913 if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) { 7914 r2->cp = CP_REG_ARM64_SYSREG_CP; 7915 } 7916 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm, 7917 r2->opc0, opc1, opc2); 7918 } else { 7919 *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2); 7920 } 7921 if (opaque) { 7922 r2->opaque = opaque; 7923 } 7924 /* reginfo passed to helpers is correct for the actual access, 7925 * and is never ARM_CP_STATE_BOTH: 7926 */ 7927 r2->state = state; 7928 /* Make sure reginfo passed to helpers for wildcarded regs 7929 * has the correct crm/opc1/opc2 for this reg, not CP_ANY: 7930 */ 7931 r2->crm = crm; 7932 r2->opc1 = opc1; 7933 r2->opc2 = opc2; 7934 /* By convention, for wildcarded registers only the first 7935 * entry is used for migration; the others are marked as 7936 * ALIAS so we don't try to transfer the register 7937 * multiple times. Special registers (ie NOP/WFI) are 7938 * never migratable and not even raw-accessible. 7939 */ 7940 if ((r->type & ARM_CP_SPECIAL)) { 7941 r2->type |= ARM_CP_NO_RAW; 7942 } 7943 if (((r->crm == CP_ANY) && crm != 0) || 7944 ((r->opc1 == CP_ANY) && opc1 != 0) || 7945 ((r->opc2 == CP_ANY) && opc2 != 0)) { 7946 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 7947 } 7948 7949 /* Check that raw accesses are either forbidden or handled. Note that 7950 * we can't assert this earlier because the setup of fieldoffset for 7951 * banked registers has to be done first. 7952 */ 7953 if (!(r2->type & ARM_CP_NO_RAW)) { 7954 assert(!raw_accessors_invalid(r2)); 7955 } 7956 7957 /* Overriding of an existing definition must be explicitly 7958 * requested. 7959 */ 7960 if (!(r->type & ARM_CP_OVERRIDE)) { 7961 ARMCPRegInfo *oldreg; 7962 oldreg = g_hash_table_lookup(cpu->cp_regs, key); 7963 if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) { 7964 fprintf(stderr, "Register redefined: cp=%d %d bit " 7965 "crn=%d crm=%d opc1=%d opc2=%d, " 7966 "was %s, now %s\n", r2->cp, 32 + 32 * is64, 7967 r2->crn, r2->crm, r2->opc1, r2->opc2, 7968 oldreg->name, r2->name); 7969 g_assert_not_reached(); 7970 } 7971 } 7972 g_hash_table_insert(cpu->cp_regs, key, r2); 7973 } 7974 7975 7976 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 7977 const ARMCPRegInfo *r, void *opaque) 7978 { 7979 /* Define implementations of coprocessor registers. 7980 * We store these in a hashtable because typically 7981 * there are less than 150 registers in a space which 7982 * is 16*16*16*8*8 = 262144 in size. 7983 * Wildcarding is supported for the crm, opc1 and opc2 fields. 7984 * If a register is defined twice then the second definition is 7985 * used, so this can be used to define some generic registers and 7986 * then override them with implementation specific variations. 7987 * At least one of the original and the second definition should 7988 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 7989 * against accidental use. 7990 * 7991 * The state field defines whether the register is to be 7992 * visible in the AArch32 or AArch64 execution state. If the 7993 * state is set to ARM_CP_STATE_BOTH then we synthesise a 7994 * reginfo structure for the AArch32 view, which sees the lower 7995 * 32 bits of the 64 bit register. 7996 * 7997 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 7998 * be wildcarded. AArch64 registers are always considered to be 64 7999 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 8000 * the register, if any. 8001 */ 8002 int crm, opc1, opc2, state; 8003 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 8004 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 8005 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 8006 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 8007 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 8008 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 8009 /* 64 bit registers have only CRm and Opc1 fields */ 8010 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 8011 /* op0 only exists in the AArch64 encodings */ 8012 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 8013 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 8014 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 8015 /* The AArch64 pseudocode CheckSystemAccess() specifies that op1 8016 * encodes a minimum access level for the register. We roll this 8017 * runtime check into our general permission check code, so check 8018 * here that the reginfo's specified permissions are strict enough 8019 * to encompass the generic architectural permission check. 8020 */ 8021 if (r->state != ARM_CP_STATE_AA32) { 8022 int mask = 0; 8023 switch (r->opc1) { 8024 case 0: 8025 /* min_EL EL1, but some accessible to EL0 via kernel ABI */ 8026 mask = PL0U_R | PL1_RW; 8027 break; 8028 case 1: case 2: 8029 /* min_EL EL1 */ 8030 mask = PL1_RW; 8031 break; 8032 case 3: 8033 /* min_EL EL0 */ 8034 mask = PL0_RW; 8035 break; 8036 case 4: 8037 case 5: 8038 /* min_EL EL2 */ 8039 mask = PL2_RW; 8040 break; 8041 case 6: 8042 /* min_EL EL3 */ 8043 mask = PL3_RW; 8044 break; 8045 case 7: 8046 /* min_EL EL1, secure mode only (we don't check the latter) */ 8047 mask = PL1_RW; 8048 break; 8049 default: 8050 /* broken reginfo with out-of-range opc1 */ 8051 assert(false); 8052 break; 8053 } 8054 /* assert our permissions are not too lax (stricter is fine) */ 8055 assert((r->access & ~mask) == 0); 8056 } 8057 8058 /* Check that the register definition has enough info to handle 8059 * reads and writes if they are permitted. 8060 */ 8061 if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) { 8062 if (r->access & PL3_R) { 8063 assert((r->fieldoffset || 8064 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 8065 r->readfn); 8066 } 8067 if (r->access & PL3_W) { 8068 assert((r->fieldoffset || 8069 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 8070 r->writefn); 8071 } 8072 } 8073 /* Bad type field probably means missing sentinel at end of reg list */ 8074 assert(cptype_valid(r->type)); 8075 for (crm = crmmin; crm <= crmmax; crm++) { 8076 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 8077 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 8078 for (state = ARM_CP_STATE_AA32; 8079 state <= ARM_CP_STATE_AA64; state++) { 8080 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 8081 continue; 8082 } 8083 if (state == ARM_CP_STATE_AA32) { 8084 /* Under AArch32 CP registers can be common 8085 * (same for secure and non-secure world) or banked. 8086 */ 8087 char *name; 8088 8089 switch (r->secure) { 8090 case ARM_CP_SECSTATE_S: 8091 case ARM_CP_SECSTATE_NS: 8092 add_cpreg_to_hashtable(cpu, r, opaque, state, 8093 r->secure, crm, opc1, opc2, 8094 r->name); 8095 break; 8096 default: 8097 name = g_strdup_printf("%s_S", r->name); 8098 add_cpreg_to_hashtable(cpu, r, opaque, state, 8099 ARM_CP_SECSTATE_S, 8100 crm, opc1, opc2, name); 8101 g_free(name); 8102 add_cpreg_to_hashtable(cpu, r, opaque, state, 8103 ARM_CP_SECSTATE_NS, 8104 crm, opc1, opc2, r->name); 8105 break; 8106 } 8107 } else { 8108 /* AArch64 registers get mapped to non-secure instance 8109 * of AArch32 */ 8110 add_cpreg_to_hashtable(cpu, r, opaque, state, 8111 ARM_CP_SECSTATE_NS, 8112 crm, opc1, opc2, r->name); 8113 } 8114 } 8115 } 8116 } 8117 } 8118 } 8119 8120 void define_arm_cp_regs_with_opaque(ARMCPU *cpu, 8121 const ARMCPRegInfo *regs, void *opaque) 8122 { 8123 /* Define a whole list of registers */ 8124 const ARMCPRegInfo *r; 8125 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 8126 define_one_arm_cp_reg_with_opaque(cpu, r, opaque); 8127 } 8128 } 8129 8130 /* 8131 * Modify ARMCPRegInfo for access from userspace. 8132 * 8133 * This is a data driven modification directed by 8134 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as 8135 * user-space cannot alter any values and dynamic values pertaining to 8136 * execution state are hidden from user space view anyway. 8137 */ 8138 void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods) 8139 { 8140 const ARMCPRegUserSpaceInfo *m; 8141 ARMCPRegInfo *r; 8142 8143 for (m = mods; m->name; m++) { 8144 GPatternSpec *pat = NULL; 8145 if (m->is_glob) { 8146 pat = g_pattern_spec_new(m->name); 8147 } 8148 for (r = regs; r->type != ARM_CP_SENTINEL; r++) { 8149 if (pat && g_pattern_match_string(pat, r->name)) { 8150 r->type = ARM_CP_CONST; 8151 r->access = PL0U_R; 8152 r->resetvalue = 0; 8153 /* continue */ 8154 } else if (strcmp(r->name, m->name) == 0) { 8155 r->type = ARM_CP_CONST; 8156 r->access = PL0U_R; 8157 r->resetvalue &= m->exported_bits; 8158 r->resetvalue |= m->fixed_bits; 8159 break; 8160 } 8161 } 8162 if (pat) { 8163 g_pattern_spec_free(pat); 8164 } 8165 } 8166 } 8167 8168 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 8169 { 8170 return g_hash_table_lookup(cpregs, &encoded_cp); 8171 } 8172 8173 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 8174 uint64_t value) 8175 { 8176 /* Helper coprocessor write function for write-ignore registers */ 8177 } 8178 8179 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 8180 { 8181 /* Helper coprocessor write function for read-as-zero registers */ 8182 return 0; 8183 } 8184 8185 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 8186 { 8187 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 8188 } 8189 8190 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 8191 { 8192 /* Return true if it is not valid for us to switch to 8193 * this CPU mode (ie all the UNPREDICTABLE cases in 8194 * the ARM ARM CPSRWriteByInstr pseudocode). 8195 */ 8196 8197 /* Changes to or from Hyp via MSR and CPS are illegal. */ 8198 if (write_type == CPSRWriteByInstr && 8199 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 8200 mode == ARM_CPU_MODE_HYP)) { 8201 return 1; 8202 } 8203 8204 switch (mode) { 8205 case ARM_CPU_MODE_USR: 8206 return 0; 8207 case ARM_CPU_MODE_SYS: 8208 case ARM_CPU_MODE_SVC: 8209 case ARM_CPU_MODE_ABT: 8210 case ARM_CPU_MODE_UND: 8211 case ARM_CPU_MODE_IRQ: 8212 case ARM_CPU_MODE_FIQ: 8213 /* Note that we don't implement the IMPDEF NSACR.RFR which in v7 8214 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 8215 */ 8216 /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 8217 * and CPS are treated as illegal mode changes. 8218 */ 8219 if (write_type == CPSRWriteByInstr && 8220 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 8221 (arm_hcr_el2_eff(env) & HCR_TGE)) { 8222 return 1; 8223 } 8224 return 0; 8225 case ARM_CPU_MODE_HYP: 8226 return !arm_feature(env, ARM_FEATURE_EL2) 8227 || arm_current_el(env) < 2 || arm_is_secure_below_el3(env); 8228 case ARM_CPU_MODE_MON: 8229 return arm_current_el(env) < 3; 8230 default: 8231 return 1; 8232 } 8233 } 8234 8235 uint32_t cpsr_read(CPUARMState *env) 8236 { 8237 int ZF; 8238 ZF = (env->ZF == 0); 8239 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 8240 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 8241 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 8242 | ((env->condexec_bits & 0xfc) << 8) 8243 | (env->GE << 16) | (env->daif & CPSR_AIF); 8244 } 8245 8246 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 8247 CPSRWriteType write_type) 8248 { 8249 uint32_t changed_daif; 8250 8251 if (mask & CPSR_NZCV) { 8252 env->ZF = (~val) & CPSR_Z; 8253 env->NF = val; 8254 env->CF = (val >> 29) & 1; 8255 env->VF = (val << 3) & 0x80000000; 8256 } 8257 if (mask & CPSR_Q) 8258 env->QF = ((val & CPSR_Q) != 0); 8259 if (mask & CPSR_T) 8260 env->thumb = ((val & CPSR_T) != 0); 8261 if (mask & CPSR_IT_0_1) { 8262 env->condexec_bits &= ~3; 8263 env->condexec_bits |= (val >> 25) & 3; 8264 } 8265 if (mask & CPSR_IT_2_7) { 8266 env->condexec_bits &= 3; 8267 env->condexec_bits |= (val >> 8) & 0xfc; 8268 } 8269 if (mask & CPSR_GE) { 8270 env->GE = (val >> 16) & 0xf; 8271 } 8272 8273 /* In a V7 implementation that includes the security extensions but does 8274 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 8275 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 8276 * bits respectively. 8277 * 8278 * In a V8 implementation, it is permitted for privileged software to 8279 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 8280 */ 8281 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 8282 arm_feature(env, ARM_FEATURE_EL3) && 8283 !arm_feature(env, ARM_FEATURE_EL2) && 8284 !arm_is_secure(env)) { 8285 8286 changed_daif = (env->daif ^ val) & mask; 8287 8288 if (changed_daif & CPSR_A) { 8289 /* Check to see if we are allowed to change the masking of async 8290 * abort exceptions from a non-secure state. 8291 */ 8292 if (!(env->cp15.scr_el3 & SCR_AW)) { 8293 qemu_log_mask(LOG_GUEST_ERROR, 8294 "Ignoring attempt to switch CPSR_A flag from " 8295 "non-secure world with SCR.AW bit clear\n"); 8296 mask &= ~CPSR_A; 8297 } 8298 } 8299 8300 if (changed_daif & CPSR_F) { 8301 /* Check to see if we are allowed to change the masking of FIQ 8302 * exceptions from a non-secure state. 8303 */ 8304 if (!(env->cp15.scr_el3 & SCR_FW)) { 8305 qemu_log_mask(LOG_GUEST_ERROR, 8306 "Ignoring attempt to switch CPSR_F flag from " 8307 "non-secure world with SCR.FW bit clear\n"); 8308 mask &= ~CPSR_F; 8309 } 8310 8311 /* Check whether non-maskable FIQ (NMFI) support is enabled. 8312 * If this bit is set software is not allowed to mask 8313 * FIQs, but is allowed to set CPSR_F to 0. 8314 */ 8315 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 8316 (val & CPSR_F)) { 8317 qemu_log_mask(LOG_GUEST_ERROR, 8318 "Ignoring attempt to enable CPSR_F flag " 8319 "(non-maskable FIQ [NMFI] support enabled)\n"); 8320 mask &= ~CPSR_F; 8321 } 8322 } 8323 } 8324 8325 env->daif &= ~(CPSR_AIF & mask); 8326 env->daif |= val & CPSR_AIF & mask; 8327 8328 if (write_type != CPSRWriteRaw && 8329 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 8330 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 8331 /* Note that we can only get here in USR mode if this is a 8332 * gdb stub write; for this case we follow the architectural 8333 * behaviour for guest writes in USR mode of ignoring an attempt 8334 * to switch mode. (Those are caught by translate.c for writes 8335 * triggered by guest instructions.) 8336 */ 8337 mask &= ~CPSR_M; 8338 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 8339 /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in 8340 * v7, and has defined behaviour in v8: 8341 * + leave CPSR.M untouched 8342 * + allow changes to the other CPSR fields 8343 * + set PSTATE.IL 8344 * For user changes via the GDB stub, we don't set PSTATE.IL, 8345 * as this would be unnecessarily harsh for a user error. 8346 */ 8347 mask &= ~CPSR_M; 8348 if (write_type != CPSRWriteByGDBStub && 8349 arm_feature(env, ARM_FEATURE_V8)) { 8350 mask |= CPSR_IL; 8351 val |= CPSR_IL; 8352 } 8353 qemu_log_mask(LOG_GUEST_ERROR, 8354 "Illegal AArch32 mode switch attempt from %s to %s\n", 8355 aarch32_mode_name(env->uncached_cpsr), 8356 aarch32_mode_name(val)); 8357 } else { 8358 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 8359 write_type == CPSRWriteExceptionReturn ? 8360 "Exception return from AArch32" : 8361 "AArch32 mode switch from", 8362 aarch32_mode_name(env->uncached_cpsr), 8363 aarch32_mode_name(val), env->regs[15]); 8364 switch_mode(env, val & CPSR_M); 8365 } 8366 } 8367 mask &= ~CACHED_CPSR_BITS; 8368 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 8369 } 8370 8371 /* Sign/zero extend */ 8372 uint32_t HELPER(sxtb16)(uint32_t x) 8373 { 8374 uint32_t res; 8375 res = (uint16_t)(int8_t)x; 8376 res |= (uint32_t)(int8_t)(x >> 16) << 16; 8377 return res; 8378 } 8379 8380 uint32_t HELPER(uxtb16)(uint32_t x) 8381 { 8382 uint32_t res; 8383 res = (uint16_t)(uint8_t)x; 8384 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 8385 return res; 8386 } 8387 8388 int32_t HELPER(sdiv)(int32_t num, int32_t den) 8389 { 8390 if (den == 0) 8391 return 0; 8392 if (num == INT_MIN && den == -1) 8393 return INT_MIN; 8394 return num / den; 8395 } 8396 8397 uint32_t HELPER(udiv)(uint32_t num, uint32_t den) 8398 { 8399 if (den == 0) 8400 return 0; 8401 return num / den; 8402 } 8403 8404 uint32_t HELPER(rbit)(uint32_t x) 8405 { 8406 return revbit32(x); 8407 } 8408 8409 #ifdef CONFIG_USER_ONLY 8410 8411 static void switch_mode(CPUARMState *env, int mode) 8412 { 8413 ARMCPU *cpu = env_archcpu(env); 8414 8415 if (mode != ARM_CPU_MODE_USR) { 8416 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 8417 } 8418 } 8419 8420 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 8421 uint32_t cur_el, bool secure) 8422 { 8423 return 1; 8424 } 8425 8426 void aarch64_sync_64_to_32(CPUARMState *env) 8427 { 8428 g_assert_not_reached(); 8429 } 8430 8431 #else 8432 8433 static void switch_mode(CPUARMState *env, int mode) 8434 { 8435 int old_mode; 8436 int i; 8437 8438 old_mode = env->uncached_cpsr & CPSR_M; 8439 if (mode == old_mode) 8440 return; 8441 8442 if (old_mode == ARM_CPU_MODE_FIQ) { 8443 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 8444 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 8445 } else if (mode == ARM_CPU_MODE_FIQ) { 8446 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 8447 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 8448 } 8449 8450 i = bank_number(old_mode); 8451 env->banked_r13[i] = env->regs[13]; 8452 env->banked_spsr[i] = env->spsr; 8453 8454 i = bank_number(mode); 8455 env->regs[13] = env->banked_r13[i]; 8456 env->spsr = env->banked_spsr[i]; 8457 8458 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 8459 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 8460 } 8461 8462 /* Physical Interrupt Target EL Lookup Table 8463 * 8464 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 8465 * 8466 * The below multi-dimensional table is used for looking up the target 8467 * exception level given numerous condition criteria. Specifically, the 8468 * target EL is based on SCR and HCR routing controls as well as the 8469 * currently executing EL and secure state. 8470 * 8471 * Dimensions: 8472 * target_el_table[2][2][2][2][2][4] 8473 * | | | | | +--- Current EL 8474 * | | | | +------ Non-secure(0)/Secure(1) 8475 * | | | +--------- HCR mask override 8476 * | | +------------ SCR exec state control 8477 * | +--------------- SCR mask override 8478 * +------------------ 32-bit(0)/64-bit(1) EL3 8479 * 8480 * The table values are as such: 8481 * 0-3 = EL0-EL3 8482 * -1 = Cannot occur 8483 * 8484 * The ARM ARM target EL table includes entries indicating that an "exception 8485 * is not taken". The two cases where this is applicable are: 8486 * 1) An exception is taken from EL3 but the SCR does not have the exception 8487 * routed to EL3. 8488 * 2) An exception is taken from EL2 but the HCR does not have the exception 8489 * routed to EL2. 8490 * In these two cases, the below table contain a target of EL1. This value is 8491 * returned as it is expected that the consumer of the table data will check 8492 * for "target EL >= current EL" to ensure the exception is not taken. 8493 * 8494 * SCR HCR 8495 * 64 EA AMO From 8496 * BIT IRQ IMO Non-secure Secure 8497 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 8498 */ 8499 static const int8_t target_el_table[2][2][2][2][2][4] = { 8500 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 8501 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 8502 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 8503 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 8504 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 8505 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 8506 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 8507 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 8508 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 8509 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},}, 8510 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, -1, 1 },}, 8511 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 1, 1, -1, 1 },},},}, 8512 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 8513 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 8514 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 8515 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},},},}, 8516 }; 8517 8518 /* 8519 * Determine the target EL for physical exceptions 8520 */ 8521 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 8522 uint32_t cur_el, bool secure) 8523 { 8524 CPUARMState *env = cs->env_ptr; 8525 bool rw; 8526 bool scr; 8527 bool hcr; 8528 int target_el; 8529 /* Is the highest EL AArch64? */ 8530 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 8531 uint64_t hcr_el2; 8532 8533 if (arm_feature(env, ARM_FEATURE_EL3)) { 8534 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 8535 } else { 8536 /* Either EL2 is the highest EL (and so the EL2 register width 8537 * is given by is64); or there is no EL2 or EL3, in which case 8538 * the value of 'rw' does not affect the table lookup anyway. 8539 */ 8540 rw = is64; 8541 } 8542 8543 hcr_el2 = arm_hcr_el2_eff(env); 8544 switch (excp_idx) { 8545 case EXCP_IRQ: 8546 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 8547 hcr = hcr_el2 & HCR_IMO; 8548 break; 8549 case EXCP_FIQ: 8550 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 8551 hcr = hcr_el2 & HCR_FMO; 8552 break; 8553 default: 8554 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 8555 hcr = hcr_el2 & HCR_AMO; 8556 break; 8557 }; 8558 8559 /* 8560 * For these purposes, TGE and AMO/IMO/FMO both force the 8561 * interrupt to EL2. Fold TGE into the bit extracted above. 8562 */ 8563 hcr |= (hcr_el2 & HCR_TGE) != 0; 8564 8565 /* Perform a table-lookup for the target EL given the current state */ 8566 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 8567 8568 assert(target_el > 0); 8569 8570 return target_el; 8571 } 8572 8573 void arm_log_exception(int idx) 8574 { 8575 if (qemu_loglevel_mask(CPU_LOG_INT)) { 8576 const char *exc = NULL; 8577 static const char * const excnames[] = { 8578 [EXCP_UDEF] = "Undefined Instruction", 8579 [EXCP_SWI] = "SVC", 8580 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 8581 [EXCP_DATA_ABORT] = "Data Abort", 8582 [EXCP_IRQ] = "IRQ", 8583 [EXCP_FIQ] = "FIQ", 8584 [EXCP_BKPT] = "Breakpoint", 8585 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 8586 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 8587 [EXCP_HVC] = "Hypervisor Call", 8588 [EXCP_HYP_TRAP] = "Hypervisor Trap", 8589 [EXCP_SMC] = "Secure Monitor Call", 8590 [EXCP_VIRQ] = "Virtual IRQ", 8591 [EXCP_VFIQ] = "Virtual FIQ", 8592 [EXCP_SEMIHOST] = "Semihosting call", 8593 [EXCP_NOCP] = "v7M NOCP UsageFault", 8594 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 8595 [EXCP_STKOF] = "v8M STKOF UsageFault", 8596 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking", 8597 [EXCP_LSERR] = "v8M LSERR UsageFault", 8598 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault", 8599 }; 8600 8601 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 8602 exc = excnames[idx]; 8603 } 8604 if (!exc) { 8605 exc = "unknown"; 8606 } 8607 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc); 8608 } 8609 } 8610 8611 /* 8612 * Function used to synchronize QEMU's AArch64 register set with AArch32 8613 * register set. This is necessary when switching between AArch32 and AArch64 8614 * execution state. 8615 */ 8616 void aarch64_sync_32_to_64(CPUARMState *env) 8617 { 8618 int i; 8619 uint32_t mode = env->uncached_cpsr & CPSR_M; 8620 8621 /* We can blanket copy R[0:7] to X[0:7] */ 8622 for (i = 0; i < 8; i++) { 8623 env->xregs[i] = env->regs[i]; 8624 } 8625 8626 /* 8627 * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 8628 * Otherwise, they come from the banked user regs. 8629 */ 8630 if (mode == ARM_CPU_MODE_FIQ) { 8631 for (i = 8; i < 13; i++) { 8632 env->xregs[i] = env->usr_regs[i - 8]; 8633 } 8634 } else { 8635 for (i = 8; i < 13; i++) { 8636 env->xregs[i] = env->regs[i]; 8637 } 8638 } 8639 8640 /* 8641 * Registers x13-x23 are the various mode SP and FP registers. Registers 8642 * r13 and r14 are only copied if we are in that mode, otherwise we copy 8643 * from the mode banked register. 8644 */ 8645 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 8646 env->xregs[13] = env->regs[13]; 8647 env->xregs[14] = env->regs[14]; 8648 } else { 8649 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 8650 /* HYP is an exception in that it is copied from r14 */ 8651 if (mode == ARM_CPU_MODE_HYP) { 8652 env->xregs[14] = env->regs[14]; 8653 } else { 8654 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 8655 } 8656 } 8657 8658 if (mode == ARM_CPU_MODE_HYP) { 8659 env->xregs[15] = env->regs[13]; 8660 } else { 8661 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 8662 } 8663 8664 if (mode == ARM_CPU_MODE_IRQ) { 8665 env->xregs[16] = env->regs[14]; 8666 env->xregs[17] = env->regs[13]; 8667 } else { 8668 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 8669 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 8670 } 8671 8672 if (mode == ARM_CPU_MODE_SVC) { 8673 env->xregs[18] = env->regs[14]; 8674 env->xregs[19] = env->regs[13]; 8675 } else { 8676 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 8677 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 8678 } 8679 8680 if (mode == ARM_CPU_MODE_ABT) { 8681 env->xregs[20] = env->regs[14]; 8682 env->xregs[21] = env->regs[13]; 8683 } else { 8684 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 8685 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 8686 } 8687 8688 if (mode == ARM_CPU_MODE_UND) { 8689 env->xregs[22] = env->regs[14]; 8690 env->xregs[23] = env->regs[13]; 8691 } else { 8692 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 8693 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 8694 } 8695 8696 /* 8697 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 8698 * mode, then we can copy from r8-r14. Otherwise, we copy from the 8699 * FIQ bank for r8-r14. 8700 */ 8701 if (mode == ARM_CPU_MODE_FIQ) { 8702 for (i = 24; i < 31; i++) { 8703 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 8704 } 8705 } else { 8706 for (i = 24; i < 29; i++) { 8707 env->xregs[i] = env->fiq_regs[i - 24]; 8708 } 8709 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 8710 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 8711 } 8712 8713 env->pc = env->regs[15]; 8714 } 8715 8716 /* 8717 * Function used to synchronize QEMU's AArch32 register set with AArch64 8718 * register set. This is necessary when switching between AArch32 and AArch64 8719 * execution state. 8720 */ 8721 void aarch64_sync_64_to_32(CPUARMState *env) 8722 { 8723 int i; 8724 uint32_t mode = env->uncached_cpsr & CPSR_M; 8725 8726 /* We can blanket copy X[0:7] to R[0:7] */ 8727 for (i = 0; i < 8; i++) { 8728 env->regs[i] = env->xregs[i]; 8729 } 8730 8731 /* 8732 * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 8733 * Otherwise, we copy x8-x12 into the banked user regs. 8734 */ 8735 if (mode == ARM_CPU_MODE_FIQ) { 8736 for (i = 8; i < 13; i++) { 8737 env->usr_regs[i - 8] = env->xregs[i]; 8738 } 8739 } else { 8740 for (i = 8; i < 13; i++) { 8741 env->regs[i] = env->xregs[i]; 8742 } 8743 } 8744 8745 /* 8746 * Registers r13 & r14 depend on the current mode. 8747 * If we are in a given mode, we copy the corresponding x registers to r13 8748 * and r14. Otherwise, we copy the x register to the banked r13 and r14 8749 * for the mode. 8750 */ 8751 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 8752 env->regs[13] = env->xregs[13]; 8753 env->regs[14] = env->xregs[14]; 8754 } else { 8755 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 8756 8757 /* 8758 * HYP is an exception in that it does not have its own banked r14 but 8759 * shares the USR r14 8760 */ 8761 if (mode == ARM_CPU_MODE_HYP) { 8762 env->regs[14] = env->xregs[14]; 8763 } else { 8764 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 8765 } 8766 } 8767 8768 if (mode == ARM_CPU_MODE_HYP) { 8769 env->regs[13] = env->xregs[15]; 8770 } else { 8771 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 8772 } 8773 8774 if (mode == ARM_CPU_MODE_IRQ) { 8775 env->regs[14] = env->xregs[16]; 8776 env->regs[13] = env->xregs[17]; 8777 } else { 8778 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 8779 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 8780 } 8781 8782 if (mode == ARM_CPU_MODE_SVC) { 8783 env->regs[14] = env->xregs[18]; 8784 env->regs[13] = env->xregs[19]; 8785 } else { 8786 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 8787 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 8788 } 8789 8790 if (mode == ARM_CPU_MODE_ABT) { 8791 env->regs[14] = env->xregs[20]; 8792 env->regs[13] = env->xregs[21]; 8793 } else { 8794 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 8795 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 8796 } 8797 8798 if (mode == ARM_CPU_MODE_UND) { 8799 env->regs[14] = env->xregs[22]; 8800 env->regs[13] = env->xregs[23]; 8801 } else { 8802 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 8803 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 8804 } 8805 8806 /* Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 8807 * mode, then we can copy to r8-r14. Otherwise, we copy to the 8808 * FIQ bank for r8-r14. 8809 */ 8810 if (mode == ARM_CPU_MODE_FIQ) { 8811 for (i = 24; i < 31; i++) { 8812 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 8813 } 8814 } else { 8815 for (i = 24; i < 29; i++) { 8816 env->fiq_regs[i - 24] = env->xregs[i]; 8817 } 8818 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 8819 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 8820 } 8821 8822 env->regs[15] = env->pc; 8823 } 8824 8825 static void take_aarch32_exception(CPUARMState *env, int new_mode, 8826 uint32_t mask, uint32_t offset, 8827 uint32_t newpc) 8828 { 8829 int new_el; 8830 8831 /* Change the CPU state so as to actually take the exception. */ 8832 switch_mode(env, new_mode); 8833 new_el = arm_current_el(env); 8834 8835 /* 8836 * For exceptions taken to AArch32 we must clear the SS bit in both 8837 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 8838 */ 8839 env->uncached_cpsr &= ~PSTATE_SS; 8840 env->spsr = cpsr_read(env); 8841 /* Clear IT bits. */ 8842 env->condexec_bits = 0; 8843 /* Switch to the new mode, and to the correct instruction set. */ 8844 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 8845 /* Set new mode endianness */ 8846 env->uncached_cpsr &= ~CPSR_E; 8847 if (env->cp15.sctlr_el[new_el] & SCTLR_EE) { 8848 env->uncached_cpsr |= CPSR_E; 8849 } 8850 /* J and IL must always be cleared for exception entry */ 8851 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 8852 env->daif |= mask; 8853 8854 if (new_mode == ARM_CPU_MODE_HYP) { 8855 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 8856 env->elr_el[2] = env->regs[15]; 8857 } else { 8858 /* CPSR.PAN is normally preserved preserved unless... */ 8859 if (cpu_isar_feature(aa32_pan, env_archcpu(env))) { 8860 switch (new_el) { 8861 case 3: 8862 if (!arm_is_secure_below_el3(env)) { 8863 /* ... the target is EL3, from non-secure state. */ 8864 env->uncached_cpsr &= ~CPSR_PAN; 8865 break; 8866 } 8867 /* ... the target is EL3, from secure state ... */ 8868 /* fall through */ 8869 case 1: 8870 /* ... the target is EL1 and SCTLR.SPAN is 0. */ 8871 if (!(env->cp15.sctlr_el[new_el] & SCTLR_SPAN)) { 8872 env->uncached_cpsr |= CPSR_PAN; 8873 } 8874 break; 8875 } 8876 } 8877 /* 8878 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 8879 * and we should just guard the thumb mode on V4 8880 */ 8881 if (arm_feature(env, ARM_FEATURE_V4T)) { 8882 env->thumb = 8883 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 8884 } 8885 env->regs[14] = env->regs[15] + offset; 8886 } 8887 env->regs[15] = newpc; 8888 arm_rebuild_hflags(env); 8889 } 8890 8891 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 8892 { 8893 /* 8894 * Handle exception entry to Hyp mode; this is sufficiently 8895 * different to entry to other AArch32 modes that we handle it 8896 * separately here. 8897 * 8898 * The vector table entry used is always the 0x14 Hyp mode entry point, 8899 * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp. 8900 * The offset applied to the preferred return address is always zero 8901 * (see DDI0487C.a section G1.12.3). 8902 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 8903 */ 8904 uint32_t addr, mask; 8905 ARMCPU *cpu = ARM_CPU(cs); 8906 CPUARMState *env = &cpu->env; 8907 8908 switch (cs->exception_index) { 8909 case EXCP_UDEF: 8910 addr = 0x04; 8911 break; 8912 case EXCP_SWI: 8913 addr = 0x14; 8914 break; 8915 case EXCP_BKPT: 8916 /* Fall through to prefetch abort. */ 8917 case EXCP_PREFETCH_ABORT: 8918 env->cp15.ifar_s = env->exception.vaddress; 8919 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 8920 (uint32_t)env->exception.vaddress); 8921 addr = 0x0c; 8922 break; 8923 case EXCP_DATA_ABORT: 8924 env->cp15.dfar_s = env->exception.vaddress; 8925 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 8926 (uint32_t)env->exception.vaddress); 8927 addr = 0x10; 8928 break; 8929 case EXCP_IRQ: 8930 addr = 0x18; 8931 break; 8932 case EXCP_FIQ: 8933 addr = 0x1c; 8934 break; 8935 case EXCP_HVC: 8936 addr = 0x08; 8937 break; 8938 case EXCP_HYP_TRAP: 8939 addr = 0x14; 8940 break; 8941 default: 8942 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 8943 } 8944 8945 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 8946 if (!arm_feature(env, ARM_FEATURE_V8)) { 8947 /* 8948 * QEMU syndrome values are v8-style. v7 has the IL bit 8949 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 8950 * If this is a v7 CPU, squash the IL bit in those cases. 8951 */ 8952 if (cs->exception_index == EXCP_PREFETCH_ABORT || 8953 (cs->exception_index == EXCP_DATA_ABORT && 8954 !(env->exception.syndrome & ARM_EL_ISV)) || 8955 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 8956 env->exception.syndrome &= ~ARM_EL_IL; 8957 } 8958 } 8959 env->cp15.esr_el[2] = env->exception.syndrome; 8960 } 8961 8962 if (arm_current_el(env) != 2 && addr < 0x14) { 8963 addr = 0x14; 8964 } 8965 8966 mask = 0; 8967 if (!(env->cp15.scr_el3 & SCR_EA)) { 8968 mask |= CPSR_A; 8969 } 8970 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 8971 mask |= CPSR_I; 8972 } 8973 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 8974 mask |= CPSR_F; 8975 } 8976 8977 addr += env->cp15.hvbar; 8978 8979 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 8980 } 8981 8982 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 8983 { 8984 ARMCPU *cpu = ARM_CPU(cs); 8985 CPUARMState *env = &cpu->env; 8986 uint32_t addr; 8987 uint32_t mask; 8988 int new_mode; 8989 uint32_t offset; 8990 uint32_t moe; 8991 8992 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 8993 switch (syn_get_ec(env->exception.syndrome)) { 8994 case EC_BREAKPOINT: 8995 case EC_BREAKPOINT_SAME_EL: 8996 moe = 1; 8997 break; 8998 case EC_WATCHPOINT: 8999 case EC_WATCHPOINT_SAME_EL: 9000 moe = 10; 9001 break; 9002 case EC_AA32_BKPT: 9003 moe = 3; 9004 break; 9005 case EC_VECTORCATCH: 9006 moe = 5; 9007 break; 9008 default: 9009 moe = 0; 9010 break; 9011 } 9012 9013 if (moe) { 9014 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 9015 } 9016 9017 if (env->exception.target_el == 2) { 9018 arm_cpu_do_interrupt_aarch32_hyp(cs); 9019 return; 9020 } 9021 9022 switch (cs->exception_index) { 9023 case EXCP_UDEF: 9024 new_mode = ARM_CPU_MODE_UND; 9025 addr = 0x04; 9026 mask = CPSR_I; 9027 if (env->thumb) 9028 offset = 2; 9029 else 9030 offset = 4; 9031 break; 9032 case EXCP_SWI: 9033 new_mode = ARM_CPU_MODE_SVC; 9034 addr = 0x08; 9035 mask = CPSR_I; 9036 /* The PC already points to the next instruction. */ 9037 offset = 0; 9038 break; 9039 case EXCP_BKPT: 9040 /* Fall through to prefetch abort. */ 9041 case EXCP_PREFETCH_ABORT: 9042 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 9043 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 9044 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 9045 env->exception.fsr, (uint32_t)env->exception.vaddress); 9046 new_mode = ARM_CPU_MODE_ABT; 9047 addr = 0x0c; 9048 mask = CPSR_A | CPSR_I; 9049 offset = 4; 9050 break; 9051 case EXCP_DATA_ABORT: 9052 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 9053 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 9054 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 9055 env->exception.fsr, 9056 (uint32_t)env->exception.vaddress); 9057 new_mode = ARM_CPU_MODE_ABT; 9058 addr = 0x10; 9059 mask = CPSR_A | CPSR_I; 9060 offset = 8; 9061 break; 9062 case EXCP_IRQ: 9063 new_mode = ARM_CPU_MODE_IRQ; 9064 addr = 0x18; 9065 /* Disable IRQ and imprecise data aborts. */ 9066 mask = CPSR_A | CPSR_I; 9067 offset = 4; 9068 if (env->cp15.scr_el3 & SCR_IRQ) { 9069 /* IRQ routed to monitor mode */ 9070 new_mode = ARM_CPU_MODE_MON; 9071 mask |= CPSR_F; 9072 } 9073 break; 9074 case EXCP_FIQ: 9075 new_mode = ARM_CPU_MODE_FIQ; 9076 addr = 0x1c; 9077 /* Disable FIQ, IRQ and imprecise data aborts. */ 9078 mask = CPSR_A | CPSR_I | CPSR_F; 9079 if (env->cp15.scr_el3 & SCR_FIQ) { 9080 /* FIQ routed to monitor mode */ 9081 new_mode = ARM_CPU_MODE_MON; 9082 } 9083 offset = 4; 9084 break; 9085 case EXCP_VIRQ: 9086 new_mode = ARM_CPU_MODE_IRQ; 9087 addr = 0x18; 9088 /* Disable IRQ and imprecise data aborts. */ 9089 mask = CPSR_A | CPSR_I; 9090 offset = 4; 9091 break; 9092 case EXCP_VFIQ: 9093 new_mode = ARM_CPU_MODE_FIQ; 9094 addr = 0x1c; 9095 /* Disable FIQ, IRQ and imprecise data aborts. */ 9096 mask = CPSR_A | CPSR_I | CPSR_F; 9097 offset = 4; 9098 break; 9099 case EXCP_SMC: 9100 new_mode = ARM_CPU_MODE_MON; 9101 addr = 0x08; 9102 mask = CPSR_A | CPSR_I | CPSR_F; 9103 offset = 0; 9104 break; 9105 default: 9106 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9107 return; /* Never happens. Keep compiler happy. */ 9108 } 9109 9110 if (new_mode == ARM_CPU_MODE_MON) { 9111 addr += env->cp15.mvbar; 9112 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 9113 /* High vectors. When enabled, base address cannot be remapped. */ 9114 addr += 0xffff0000; 9115 } else { 9116 /* ARM v7 architectures provide a vector base address register to remap 9117 * the interrupt vector table. 9118 * This register is only followed in non-monitor mode, and is banked. 9119 * Note: only bits 31:5 are valid. 9120 */ 9121 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 9122 } 9123 9124 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 9125 env->cp15.scr_el3 &= ~SCR_NS; 9126 } 9127 9128 take_aarch32_exception(env, new_mode, mask, offset, addr); 9129 } 9130 9131 /* Handle exception entry to a target EL which is using AArch64 */ 9132 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 9133 { 9134 ARMCPU *cpu = ARM_CPU(cs); 9135 CPUARMState *env = &cpu->env; 9136 unsigned int new_el = env->exception.target_el; 9137 target_ulong addr = env->cp15.vbar_el[new_el]; 9138 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 9139 unsigned int old_mode; 9140 unsigned int cur_el = arm_current_el(env); 9141 9142 /* 9143 * Note that new_el can never be 0. If cur_el is 0, then 9144 * el0_a64 is is_a64(), else el0_a64 is ignored. 9145 */ 9146 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 9147 9148 if (cur_el < new_el) { 9149 /* Entry vector offset depends on whether the implemented EL 9150 * immediately lower than the target level is using AArch32 or AArch64 9151 */ 9152 bool is_aa64; 9153 uint64_t hcr; 9154 9155 switch (new_el) { 9156 case 3: 9157 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 9158 break; 9159 case 2: 9160 hcr = arm_hcr_el2_eff(env); 9161 if ((hcr & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 9162 is_aa64 = (hcr & HCR_RW) != 0; 9163 break; 9164 } 9165 /* fall through */ 9166 case 1: 9167 is_aa64 = is_a64(env); 9168 break; 9169 default: 9170 g_assert_not_reached(); 9171 } 9172 9173 if (is_aa64) { 9174 addr += 0x400; 9175 } else { 9176 addr += 0x600; 9177 } 9178 } else if (pstate_read(env) & PSTATE_SP) { 9179 addr += 0x200; 9180 } 9181 9182 switch (cs->exception_index) { 9183 case EXCP_PREFETCH_ABORT: 9184 case EXCP_DATA_ABORT: 9185 env->cp15.far_el[new_el] = env->exception.vaddress; 9186 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 9187 env->cp15.far_el[new_el]); 9188 /* fall through */ 9189 case EXCP_BKPT: 9190 case EXCP_UDEF: 9191 case EXCP_SWI: 9192 case EXCP_HVC: 9193 case EXCP_HYP_TRAP: 9194 case EXCP_SMC: 9195 if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) { 9196 /* 9197 * QEMU internal FP/SIMD syndromes from AArch32 include the 9198 * TA and coproc fields which are only exposed if the exception 9199 * is taken to AArch32 Hyp mode. Mask them out to get a valid 9200 * AArch64 format syndrome. 9201 */ 9202 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 9203 } 9204 env->cp15.esr_el[new_el] = env->exception.syndrome; 9205 break; 9206 case EXCP_IRQ: 9207 case EXCP_VIRQ: 9208 addr += 0x80; 9209 break; 9210 case EXCP_FIQ: 9211 case EXCP_VFIQ: 9212 addr += 0x100; 9213 break; 9214 default: 9215 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 9216 } 9217 9218 if (is_a64(env)) { 9219 old_mode = pstate_read(env); 9220 aarch64_save_sp(env, arm_current_el(env)); 9221 env->elr_el[new_el] = env->pc; 9222 } else { 9223 old_mode = cpsr_read(env); 9224 env->elr_el[new_el] = env->regs[15]; 9225 9226 aarch64_sync_32_to_64(env); 9227 9228 env->condexec_bits = 0; 9229 } 9230 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = old_mode; 9231 9232 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 9233 env->elr_el[new_el]); 9234 9235 if (cpu_isar_feature(aa64_pan, cpu)) { 9236 /* The value of PSTATE.PAN is normally preserved, except when ... */ 9237 new_mode |= old_mode & PSTATE_PAN; 9238 switch (new_el) { 9239 case 2: 9240 /* ... the target is EL2 with HCR_EL2.{E2H,TGE} == '11' ... */ 9241 if ((arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) 9242 != (HCR_E2H | HCR_TGE)) { 9243 break; 9244 } 9245 /* fall through */ 9246 case 1: 9247 /* ... the target is EL1 ... */ 9248 /* ... and SCTLR_ELx.SPAN == 0, then set to 1. */ 9249 if ((env->cp15.sctlr_el[new_el] & SCTLR_SPAN) == 0) { 9250 new_mode |= PSTATE_PAN; 9251 } 9252 break; 9253 } 9254 } 9255 9256 pstate_write(env, PSTATE_DAIF | new_mode); 9257 env->aarch64 = 1; 9258 aarch64_restore_sp(env, new_el); 9259 helper_rebuild_hflags_a64(env, new_el); 9260 9261 env->pc = addr; 9262 9263 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 9264 new_el, env->pc, pstate_read(env)); 9265 } 9266 9267 /* 9268 * Do semihosting call and set the appropriate return value. All the 9269 * permission and validity checks have been done at translate time. 9270 * 9271 * We only see semihosting exceptions in TCG only as they are not 9272 * trapped to the hypervisor in KVM. 9273 */ 9274 #ifdef CONFIG_TCG 9275 static void handle_semihosting(CPUState *cs) 9276 { 9277 ARMCPU *cpu = ARM_CPU(cs); 9278 CPUARMState *env = &cpu->env; 9279 9280 if (is_a64(env)) { 9281 qemu_log_mask(CPU_LOG_INT, 9282 "...handling as semihosting call 0x%" PRIx64 "\n", 9283 env->xregs[0]); 9284 env->xregs[0] = do_arm_semihosting(env); 9285 env->pc += 4; 9286 } else { 9287 qemu_log_mask(CPU_LOG_INT, 9288 "...handling as semihosting call 0x%x\n", 9289 env->regs[0]); 9290 env->regs[0] = do_arm_semihosting(env); 9291 env->regs[15] += env->thumb ? 2 : 4; 9292 } 9293 } 9294 #endif 9295 9296 /* Handle a CPU exception for A and R profile CPUs. 9297 * Do any appropriate logging, handle PSCI calls, and then hand off 9298 * to the AArch64-entry or AArch32-entry function depending on the 9299 * target exception level's register width. 9300 */ 9301 void arm_cpu_do_interrupt(CPUState *cs) 9302 { 9303 ARMCPU *cpu = ARM_CPU(cs); 9304 CPUARMState *env = &cpu->env; 9305 unsigned int new_el = env->exception.target_el; 9306 9307 assert(!arm_feature(env, ARM_FEATURE_M)); 9308 9309 arm_log_exception(cs->exception_index); 9310 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 9311 new_el); 9312 if (qemu_loglevel_mask(CPU_LOG_INT) 9313 && !excp_is_internal(cs->exception_index)) { 9314 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 9315 syn_get_ec(env->exception.syndrome), 9316 env->exception.syndrome); 9317 } 9318 9319 if (arm_is_psci_call(cpu, cs->exception_index)) { 9320 arm_handle_psci_call(cpu); 9321 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 9322 return; 9323 } 9324 9325 /* 9326 * Semihosting semantics depend on the register width of the code 9327 * that caused the exception, not the target exception level, so 9328 * must be handled here. 9329 */ 9330 #ifdef CONFIG_TCG 9331 if (cs->exception_index == EXCP_SEMIHOST) { 9332 handle_semihosting(cs); 9333 return; 9334 } 9335 #endif 9336 9337 /* Hooks may change global state so BQL should be held, also the 9338 * BQL needs to be held for any modification of 9339 * cs->interrupt_request. 9340 */ 9341 g_assert(qemu_mutex_iothread_locked()); 9342 9343 arm_call_pre_el_change_hook(cpu); 9344 9345 assert(!excp_is_internal(cs->exception_index)); 9346 if (arm_el_is_aa64(env, new_el)) { 9347 arm_cpu_do_interrupt_aarch64(cs); 9348 } else { 9349 arm_cpu_do_interrupt_aarch32(cs); 9350 } 9351 9352 arm_call_el_change_hook(cpu); 9353 9354 if (!kvm_enabled()) { 9355 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 9356 } 9357 } 9358 #endif /* !CONFIG_USER_ONLY */ 9359 9360 /* Return the exception level which controls this address translation regime */ 9361 static uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx) 9362 { 9363 switch (mmu_idx) { 9364 case ARMMMUIdx_E20_0: 9365 case ARMMMUIdx_E20_2: 9366 case ARMMMUIdx_E20_2_PAN: 9367 case ARMMMUIdx_Stage2: 9368 case ARMMMUIdx_E2: 9369 return 2; 9370 case ARMMMUIdx_SE3: 9371 return 3; 9372 case ARMMMUIdx_SE10_0: 9373 return arm_el_is_aa64(env, 3) ? 1 : 3; 9374 case ARMMMUIdx_SE10_1: 9375 case ARMMMUIdx_SE10_1_PAN: 9376 case ARMMMUIdx_Stage1_E0: 9377 case ARMMMUIdx_Stage1_E1: 9378 case ARMMMUIdx_Stage1_E1_PAN: 9379 case ARMMMUIdx_E10_0: 9380 case ARMMMUIdx_E10_1: 9381 case ARMMMUIdx_E10_1_PAN: 9382 case ARMMMUIdx_MPrivNegPri: 9383 case ARMMMUIdx_MUserNegPri: 9384 case ARMMMUIdx_MPriv: 9385 case ARMMMUIdx_MUser: 9386 case ARMMMUIdx_MSPrivNegPri: 9387 case ARMMMUIdx_MSUserNegPri: 9388 case ARMMMUIdx_MSPriv: 9389 case ARMMMUIdx_MSUser: 9390 return 1; 9391 default: 9392 g_assert_not_reached(); 9393 } 9394 } 9395 9396 uint64_t arm_sctlr(CPUARMState *env, int el) 9397 { 9398 /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */ 9399 if (el == 0) { 9400 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0); 9401 el = (mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1); 9402 } 9403 return env->cp15.sctlr_el[el]; 9404 } 9405 9406 /* Return the SCTLR value which controls this address translation regime */ 9407 static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx) 9408 { 9409 return env->cp15.sctlr_el[regime_el(env, mmu_idx)]; 9410 } 9411 9412 #ifndef CONFIG_USER_ONLY 9413 9414 /* Return true if the specified stage of address translation is disabled */ 9415 static inline bool regime_translation_disabled(CPUARMState *env, 9416 ARMMMUIdx mmu_idx) 9417 { 9418 if (arm_feature(env, ARM_FEATURE_M)) { 9419 switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] & 9420 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) { 9421 case R_V7M_MPU_CTRL_ENABLE_MASK: 9422 /* Enabled, but not for HardFault and NMI */ 9423 return mmu_idx & ARM_MMU_IDX_M_NEGPRI; 9424 case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK: 9425 /* Enabled for all cases */ 9426 return false; 9427 case 0: 9428 default: 9429 /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but 9430 * we warned about that in armv7m_nvic.c when the guest set it. 9431 */ 9432 return true; 9433 } 9434 } 9435 9436 if (mmu_idx == ARMMMUIdx_Stage2) { 9437 /* HCR.DC means HCR.VM behaves as 1 */ 9438 return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0; 9439 } 9440 9441 if (env->cp15.hcr_el2 & HCR_TGE) { 9442 /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */ 9443 if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) { 9444 return true; 9445 } 9446 } 9447 9448 if ((env->cp15.hcr_el2 & HCR_DC) && arm_mmu_idx_is_stage1_of_2(mmu_idx)) { 9449 /* HCR.DC means SCTLR_EL1.M behaves as 0 */ 9450 return true; 9451 } 9452 9453 return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0; 9454 } 9455 9456 static inline bool regime_translation_big_endian(CPUARMState *env, 9457 ARMMMUIdx mmu_idx) 9458 { 9459 return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; 9460 } 9461 9462 /* Return the TTBR associated with this translation regime */ 9463 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, 9464 int ttbrn) 9465 { 9466 if (mmu_idx == ARMMMUIdx_Stage2) { 9467 return env->cp15.vttbr_el2; 9468 } 9469 if (ttbrn == 0) { 9470 return env->cp15.ttbr0_el[regime_el(env, mmu_idx)]; 9471 } else { 9472 return env->cp15.ttbr1_el[regime_el(env, mmu_idx)]; 9473 } 9474 } 9475 9476 #endif /* !CONFIG_USER_ONLY */ 9477 9478 /* Return the TCR controlling this translation regime */ 9479 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx) 9480 { 9481 if (mmu_idx == ARMMMUIdx_Stage2) { 9482 return &env->cp15.vtcr_el2; 9483 } 9484 return &env->cp15.tcr_el[regime_el(env, mmu_idx)]; 9485 } 9486 9487 /* Convert a possible stage1+2 MMU index into the appropriate 9488 * stage 1 MMU index 9489 */ 9490 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx) 9491 { 9492 switch (mmu_idx) { 9493 case ARMMMUIdx_E10_0: 9494 return ARMMMUIdx_Stage1_E0; 9495 case ARMMMUIdx_E10_1: 9496 return ARMMMUIdx_Stage1_E1; 9497 case ARMMMUIdx_E10_1_PAN: 9498 return ARMMMUIdx_Stage1_E1_PAN; 9499 default: 9500 return mmu_idx; 9501 } 9502 } 9503 9504 /* Return true if the translation regime is using LPAE format page tables */ 9505 static inline bool regime_using_lpae_format(CPUARMState *env, 9506 ARMMMUIdx mmu_idx) 9507 { 9508 int el = regime_el(env, mmu_idx); 9509 if (el == 2 || arm_el_is_aa64(env, el)) { 9510 return true; 9511 } 9512 if (arm_feature(env, ARM_FEATURE_LPAE) 9513 && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) { 9514 return true; 9515 } 9516 return false; 9517 } 9518 9519 /* Returns true if the stage 1 translation regime is using LPAE format page 9520 * tables. Used when raising alignment exceptions, whose FSR changes depending 9521 * on whether the long or short descriptor format is in use. */ 9522 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx) 9523 { 9524 mmu_idx = stage_1_mmu_idx(mmu_idx); 9525 9526 return regime_using_lpae_format(env, mmu_idx); 9527 } 9528 9529 #ifndef CONFIG_USER_ONLY 9530 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx) 9531 { 9532 switch (mmu_idx) { 9533 case ARMMMUIdx_SE10_0: 9534 case ARMMMUIdx_E20_0: 9535 case ARMMMUIdx_Stage1_E0: 9536 case ARMMMUIdx_MUser: 9537 case ARMMMUIdx_MSUser: 9538 case ARMMMUIdx_MUserNegPri: 9539 case ARMMMUIdx_MSUserNegPri: 9540 return true; 9541 default: 9542 return false; 9543 case ARMMMUIdx_E10_0: 9544 case ARMMMUIdx_E10_1: 9545 case ARMMMUIdx_E10_1_PAN: 9546 g_assert_not_reached(); 9547 } 9548 } 9549 9550 /* Translate section/page access permissions to page 9551 * R/W protection flags 9552 * 9553 * @env: CPUARMState 9554 * @mmu_idx: MMU index indicating required translation regime 9555 * @ap: The 3-bit access permissions (AP[2:0]) 9556 * @domain_prot: The 2-bit domain access permissions 9557 */ 9558 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, 9559 int ap, int domain_prot) 9560 { 9561 bool is_user = regime_is_user(env, mmu_idx); 9562 9563 if (domain_prot == 3) { 9564 return PAGE_READ | PAGE_WRITE; 9565 } 9566 9567 switch (ap) { 9568 case 0: 9569 if (arm_feature(env, ARM_FEATURE_V7)) { 9570 return 0; 9571 } 9572 switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) { 9573 case SCTLR_S: 9574 return is_user ? 0 : PAGE_READ; 9575 case SCTLR_R: 9576 return PAGE_READ; 9577 default: 9578 return 0; 9579 } 9580 case 1: 9581 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 9582 case 2: 9583 if (is_user) { 9584 return PAGE_READ; 9585 } else { 9586 return PAGE_READ | PAGE_WRITE; 9587 } 9588 case 3: 9589 return PAGE_READ | PAGE_WRITE; 9590 case 4: /* Reserved. */ 9591 return 0; 9592 case 5: 9593 return is_user ? 0 : PAGE_READ; 9594 case 6: 9595 return PAGE_READ; 9596 case 7: 9597 if (!arm_feature(env, ARM_FEATURE_V6K)) { 9598 return 0; 9599 } 9600 return PAGE_READ; 9601 default: 9602 g_assert_not_reached(); 9603 } 9604 } 9605 9606 /* Translate section/page access permissions to page 9607 * R/W protection flags. 9608 * 9609 * @ap: The 2-bit simple AP (AP[2:1]) 9610 * @is_user: TRUE if accessing from PL0 9611 */ 9612 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user) 9613 { 9614 switch (ap) { 9615 case 0: 9616 return is_user ? 0 : PAGE_READ | PAGE_WRITE; 9617 case 1: 9618 return PAGE_READ | PAGE_WRITE; 9619 case 2: 9620 return is_user ? 0 : PAGE_READ; 9621 case 3: 9622 return PAGE_READ; 9623 default: 9624 g_assert_not_reached(); 9625 } 9626 } 9627 9628 static inline int 9629 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap) 9630 { 9631 return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx)); 9632 } 9633 9634 /* Translate S2 section/page access permissions to protection flags 9635 * 9636 * @env: CPUARMState 9637 * @s2ap: The 2-bit stage2 access permissions (S2AP) 9638 * @xn: XN (execute-never) bit 9639 */ 9640 static int get_S2prot(CPUARMState *env, int s2ap, int xn) 9641 { 9642 int prot = 0; 9643 9644 if (s2ap & 1) { 9645 prot |= PAGE_READ; 9646 } 9647 if (s2ap & 2) { 9648 prot |= PAGE_WRITE; 9649 } 9650 if (!xn) { 9651 if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) { 9652 prot |= PAGE_EXEC; 9653 } 9654 } 9655 return prot; 9656 } 9657 9658 /* Translate section/page access permissions to protection flags 9659 * 9660 * @env: CPUARMState 9661 * @mmu_idx: MMU index indicating required translation regime 9662 * @is_aa64: TRUE if AArch64 9663 * @ap: The 2-bit simple AP (AP[2:1]) 9664 * @ns: NS (non-secure) bit 9665 * @xn: XN (execute-never) bit 9666 * @pxn: PXN (privileged execute-never) bit 9667 */ 9668 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64, 9669 int ap, int ns, int xn, int pxn) 9670 { 9671 bool is_user = regime_is_user(env, mmu_idx); 9672 int prot_rw, user_rw; 9673 bool have_wxn; 9674 int wxn = 0; 9675 9676 assert(mmu_idx != ARMMMUIdx_Stage2); 9677 9678 user_rw = simple_ap_to_rw_prot_is_user(ap, true); 9679 if (is_user) { 9680 prot_rw = user_rw; 9681 } else { 9682 if (user_rw && regime_is_pan(env, mmu_idx)) { 9683 return 0; 9684 } 9685 prot_rw = simple_ap_to_rw_prot_is_user(ap, false); 9686 } 9687 9688 if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) { 9689 return prot_rw; 9690 } 9691 9692 /* TODO have_wxn should be replaced with 9693 * ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2) 9694 * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE 9695 * compatible processors have EL2, which is required for [U]WXN. 9696 */ 9697 have_wxn = arm_feature(env, ARM_FEATURE_LPAE); 9698 9699 if (have_wxn) { 9700 wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN; 9701 } 9702 9703 if (is_aa64) { 9704 if (regime_has_2_ranges(mmu_idx) && !is_user) { 9705 xn = pxn || (user_rw & PAGE_WRITE); 9706 } 9707 } else if (arm_feature(env, ARM_FEATURE_V7)) { 9708 switch (regime_el(env, mmu_idx)) { 9709 case 1: 9710 case 3: 9711 if (is_user) { 9712 xn = xn || !(user_rw & PAGE_READ); 9713 } else { 9714 int uwxn = 0; 9715 if (have_wxn) { 9716 uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN; 9717 } 9718 xn = xn || !(prot_rw & PAGE_READ) || pxn || 9719 (uwxn && (user_rw & PAGE_WRITE)); 9720 } 9721 break; 9722 case 2: 9723 break; 9724 } 9725 } else { 9726 xn = wxn = 0; 9727 } 9728 9729 if (xn || (wxn && (prot_rw & PAGE_WRITE))) { 9730 return prot_rw; 9731 } 9732 return prot_rw | PAGE_EXEC; 9733 } 9734 9735 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx, 9736 uint32_t *table, uint32_t address) 9737 { 9738 /* Note that we can only get here for an AArch32 PL0/PL1 lookup */ 9739 TCR *tcr = regime_tcr(env, mmu_idx); 9740 9741 if (address & tcr->mask) { 9742 if (tcr->raw_tcr & TTBCR_PD1) { 9743 /* Translation table walk disabled for TTBR1 */ 9744 return false; 9745 } 9746 *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000; 9747 } else { 9748 if (tcr->raw_tcr & TTBCR_PD0) { 9749 /* Translation table walk disabled for TTBR0 */ 9750 return false; 9751 } 9752 *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask; 9753 } 9754 *table |= (address >> 18) & 0x3ffc; 9755 return true; 9756 } 9757 9758 /* Translate a S1 pagetable walk through S2 if needed. */ 9759 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx, 9760 hwaddr addr, MemTxAttrs txattrs, 9761 ARMMMUFaultInfo *fi) 9762 { 9763 if (arm_mmu_idx_is_stage1_of_2(mmu_idx) && 9764 !regime_translation_disabled(env, ARMMMUIdx_Stage2)) { 9765 target_ulong s2size; 9766 hwaddr s2pa; 9767 int s2prot; 9768 int ret; 9769 ARMCacheAttrs cacheattrs = {}; 9770 ARMCacheAttrs *pcacheattrs = NULL; 9771 9772 if (env->cp15.hcr_el2 & HCR_PTW) { 9773 /* 9774 * PTW means we must fault if this S1 walk touches S2 Device 9775 * memory; otherwise we don't care about the attributes and can 9776 * save the S2 translation the effort of computing them. 9777 */ 9778 pcacheattrs = &cacheattrs; 9779 } 9780 9781 ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_Stage2, &s2pa, 9782 &txattrs, &s2prot, &s2size, fi, pcacheattrs); 9783 if (ret) { 9784 assert(fi->type != ARMFault_None); 9785 fi->s2addr = addr; 9786 fi->stage2 = true; 9787 fi->s1ptw = true; 9788 return ~0; 9789 } 9790 if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) { 9791 /* Access was to Device memory: generate Permission fault */ 9792 fi->type = ARMFault_Permission; 9793 fi->s2addr = addr; 9794 fi->stage2 = true; 9795 fi->s1ptw = true; 9796 return ~0; 9797 } 9798 addr = s2pa; 9799 } 9800 return addr; 9801 } 9802 9803 /* All loads done in the course of a page table walk go through here. */ 9804 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure, 9805 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 9806 { 9807 ARMCPU *cpu = ARM_CPU(cs); 9808 CPUARMState *env = &cpu->env; 9809 MemTxAttrs attrs = {}; 9810 MemTxResult result = MEMTX_OK; 9811 AddressSpace *as; 9812 uint32_t data; 9813 9814 attrs.secure = is_secure; 9815 as = arm_addressspace(cs, attrs); 9816 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 9817 if (fi->s1ptw) { 9818 return 0; 9819 } 9820 if (regime_translation_big_endian(env, mmu_idx)) { 9821 data = address_space_ldl_be(as, addr, attrs, &result); 9822 } else { 9823 data = address_space_ldl_le(as, addr, attrs, &result); 9824 } 9825 if (result == MEMTX_OK) { 9826 return data; 9827 } 9828 fi->type = ARMFault_SyncExternalOnWalk; 9829 fi->ea = arm_extabort_type(result); 9830 return 0; 9831 } 9832 9833 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, 9834 ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi) 9835 { 9836 ARMCPU *cpu = ARM_CPU(cs); 9837 CPUARMState *env = &cpu->env; 9838 MemTxAttrs attrs = {}; 9839 MemTxResult result = MEMTX_OK; 9840 AddressSpace *as; 9841 uint64_t data; 9842 9843 attrs.secure = is_secure; 9844 as = arm_addressspace(cs, attrs); 9845 addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi); 9846 if (fi->s1ptw) { 9847 return 0; 9848 } 9849 if (regime_translation_big_endian(env, mmu_idx)) { 9850 data = address_space_ldq_be(as, addr, attrs, &result); 9851 } else { 9852 data = address_space_ldq_le(as, addr, attrs, &result); 9853 } 9854 if (result == MEMTX_OK) { 9855 return data; 9856 } 9857 fi->type = ARMFault_SyncExternalOnWalk; 9858 fi->ea = arm_extabort_type(result); 9859 return 0; 9860 } 9861 9862 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address, 9863 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9864 hwaddr *phys_ptr, int *prot, 9865 target_ulong *page_size, 9866 ARMMMUFaultInfo *fi) 9867 { 9868 CPUState *cs = env_cpu(env); 9869 int level = 1; 9870 uint32_t table; 9871 uint32_t desc; 9872 int type; 9873 int ap; 9874 int domain = 0; 9875 int domain_prot; 9876 hwaddr phys_addr; 9877 uint32_t dacr; 9878 9879 /* Pagetable walk. */ 9880 /* Lookup l1 descriptor. */ 9881 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 9882 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 9883 fi->type = ARMFault_Translation; 9884 goto do_fault; 9885 } 9886 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9887 mmu_idx, fi); 9888 if (fi->type != ARMFault_None) { 9889 goto do_fault; 9890 } 9891 type = (desc & 3); 9892 domain = (desc >> 5) & 0x0f; 9893 if (regime_el(env, mmu_idx) == 1) { 9894 dacr = env->cp15.dacr_ns; 9895 } else { 9896 dacr = env->cp15.dacr_s; 9897 } 9898 domain_prot = (dacr >> (domain * 2)) & 3; 9899 if (type == 0) { 9900 /* Section translation fault. */ 9901 fi->type = ARMFault_Translation; 9902 goto do_fault; 9903 } 9904 if (type != 2) { 9905 level = 2; 9906 } 9907 if (domain_prot == 0 || domain_prot == 2) { 9908 fi->type = ARMFault_Domain; 9909 goto do_fault; 9910 } 9911 if (type == 2) { 9912 /* 1Mb section. */ 9913 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 9914 ap = (desc >> 10) & 3; 9915 *page_size = 1024 * 1024; 9916 } else { 9917 /* Lookup l2 entry. */ 9918 if (type == 1) { 9919 /* Coarse pagetable. */ 9920 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 9921 } else { 9922 /* Fine pagetable. */ 9923 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc); 9924 } 9925 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 9926 mmu_idx, fi); 9927 if (fi->type != ARMFault_None) { 9928 goto do_fault; 9929 } 9930 switch (desc & 3) { 9931 case 0: /* Page translation fault. */ 9932 fi->type = ARMFault_Translation; 9933 goto do_fault; 9934 case 1: /* 64k page. */ 9935 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 9936 ap = (desc >> (4 + ((address >> 13) & 6))) & 3; 9937 *page_size = 0x10000; 9938 break; 9939 case 2: /* 4k page. */ 9940 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 9941 ap = (desc >> (4 + ((address >> 9) & 6))) & 3; 9942 *page_size = 0x1000; 9943 break; 9944 case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */ 9945 if (type == 1) { 9946 /* ARMv6/XScale extended small page format */ 9947 if (arm_feature(env, ARM_FEATURE_XSCALE) 9948 || arm_feature(env, ARM_FEATURE_V6)) { 9949 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 9950 *page_size = 0x1000; 9951 } else { 9952 /* UNPREDICTABLE in ARMv5; we choose to take a 9953 * page translation fault. 9954 */ 9955 fi->type = ARMFault_Translation; 9956 goto do_fault; 9957 } 9958 } else { 9959 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff); 9960 *page_size = 0x400; 9961 } 9962 ap = (desc >> 4) & 3; 9963 break; 9964 default: 9965 /* Never happens, but compiler isn't smart enough to tell. */ 9966 abort(); 9967 } 9968 } 9969 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 9970 *prot |= *prot ? PAGE_EXEC : 0; 9971 if (!(*prot & (1 << access_type))) { 9972 /* Access permission fault. */ 9973 fi->type = ARMFault_Permission; 9974 goto do_fault; 9975 } 9976 *phys_ptr = phys_addr; 9977 return false; 9978 do_fault: 9979 fi->domain = domain; 9980 fi->level = level; 9981 return true; 9982 } 9983 9984 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, 9985 MMUAccessType access_type, ARMMMUIdx mmu_idx, 9986 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 9987 target_ulong *page_size, ARMMMUFaultInfo *fi) 9988 { 9989 CPUState *cs = env_cpu(env); 9990 int level = 1; 9991 uint32_t table; 9992 uint32_t desc; 9993 uint32_t xn; 9994 uint32_t pxn = 0; 9995 int type; 9996 int ap; 9997 int domain = 0; 9998 int domain_prot; 9999 hwaddr phys_addr; 10000 uint32_t dacr; 10001 bool ns; 10002 10003 /* Pagetable walk. */ 10004 /* Lookup l1 descriptor. */ 10005 if (!get_level1_table_address(env, mmu_idx, &table, address)) { 10006 /* Section translation fault if page walk is disabled by PD0 or PD1 */ 10007 fi->type = ARMFault_Translation; 10008 goto do_fault; 10009 } 10010 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10011 mmu_idx, fi); 10012 if (fi->type != ARMFault_None) { 10013 goto do_fault; 10014 } 10015 type = (desc & 3); 10016 if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) { 10017 /* Section translation fault, or attempt to use the encoding 10018 * which is Reserved on implementations without PXN. 10019 */ 10020 fi->type = ARMFault_Translation; 10021 goto do_fault; 10022 } 10023 if ((type == 1) || !(desc & (1 << 18))) { 10024 /* Page or Section. */ 10025 domain = (desc >> 5) & 0x0f; 10026 } 10027 if (regime_el(env, mmu_idx) == 1) { 10028 dacr = env->cp15.dacr_ns; 10029 } else { 10030 dacr = env->cp15.dacr_s; 10031 } 10032 if (type == 1) { 10033 level = 2; 10034 } 10035 domain_prot = (dacr >> (domain * 2)) & 3; 10036 if (domain_prot == 0 || domain_prot == 2) { 10037 /* Section or Page domain fault */ 10038 fi->type = ARMFault_Domain; 10039 goto do_fault; 10040 } 10041 if (type != 1) { 10042 if (desc & (1 << 18)) { 10043 /* Supersection. */ 10044 phys_addr = (desc & 0xff000000) | (address & 0x00ffffff); 10045 phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32; 10046 phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36; 10047 *page_size = 0x1000000; 10048 } else { 10049 /* Section. */ 10050 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff); 10051 *page_size = 0x100000; 10052 } 10053 ap = ((desc >> 10) & 3) | ((desc >> 13) & 4); 10054 xn = desc & (1 << 4); 10055 pxn = desc & 1; 10056 ns = extract32(desc, 19, 1); 10057 } else { 10058 if (arm_feature(env, ARM_FEATURE_PXN)) { 10059 pxn = (desc >> 2) & 1; 10060 } 10061 ns = extract32(desc, 3, 1); 10062 /* Lookup l2 entry. */ 10063 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc); 10064 desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx), 10065 mmu_idx, fi); 10066 if (fi->type != ARMFault_None) { 10067 goto do_fault; 10068 } 10069 ap = ((desc >> 4) & 3) | ((desc >> 7) & 4); 10070 switch (desc & 3) { 10071 case 0: /* Page translation fault. */ 10072 fi->type = ARMFault_Translation; 10073 goto do_fault; 10074 case 1: /* 64k page. */ 10075 phys_addr = (desc & 0xffff0000) | (address & 0xffff); 10076 xn = desc & (1 << 15); 10077 *page_size = 0x10000; 10078 break; 10079 case 2: case 3: /* 4k page. */ 10080 phys_addr = (desc & 0xfffff000) | (address & 0xfff); 10081 xn = desc & 1; 10082 *page_size = 0x1000; 10083 break; 10084 default: 10085 /* Never happens, but compiler isn't smart enough to tell. */ 10086 abort(); 10087 } 10088 } 10089 if (domain_prot == 3) { 10090 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10091 } else { 10092 if (pxn && !regime_is_user(env, mmu_idx)) { 10093 xn = 1; 10094 } 10095 if (xn && access_type == MMU_INST_FETCH) { 10096 fi->type = ARMFault_Permission; 10097 goto do_fault; 10098 } 10099 10100 if (arm_feature(env, ARM_FEATURE_V6K) && 10101 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) { 10102 /* The simplified model uses AP[0] as an access control bit. */ 10103 if ((ap & 1) == 0) { 10104 /* Access flag fault. */ 10105 fi->type = ARMFault_AccessFlag; 10106 goto do_fault; 10107 } 10108 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1); 10109 } else { 10110 *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot); 10111 } 10112 if (*prot && !xn) { 10113 *prot |= PAGE_EXEC; 10114 } 10115 if (!(*prot & (1 << access_type))) { 10116 /* Access permission fault. */ 10117 fi->type = ARMFault_Permission; 10118 goto do_fault; 10119 } 10120 } 10121 if (ns) { 10122 /* The NS bit will (as required by the architecture) have no effect if 10123 * the CPU doesn't support TZ or this is a non-secure translation 10124 * regime, because the attribute will already be non-secure. 10125 */ 10126 attrs->secure = false; 10127 } 10128 *phys_ptr = phys_addr; 10129 return false; 10130 do_fault: 10131 fi->domain = domain; 10132 fi->level = level; 10133 return true; 10134 } 10135 10136 /* 10137 * check_s2_mmu_setup 10138 * @cpu: ARMCPU 10139 * @is_aa64: True if the translation regime is in AArch64 state 10140 * @startlevel: Suggested starting level 10141 * @inputsize: Bitsize of IPAs 10142 * @stride: Page-table stride (See the ARM ARM) 10143 * 10144 * Returns true if the suggested S2 translation parameters are OK and 10145 * false otherwise. 10146 */ 10147 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, 10148 int inputsize, int stride) 10149 { 10150 const int grainsize = stride + 3; 10151 int startsizecheck; 10152 10153 /* Negative levels are never allowed. */ 10154 if (level < 0) { 10155 return false; 10156 } 10157 10158 startsizecheck = inputsize - ((3 - level) * stride + grainsize); 10159 if (startsizecheck < 1 || startsizecheck > stride + 4) { 10160 return false; 10161 } 10162 10163 if (is_aa64) { 10164 CPUARMState *env = &cpu->env; 10165 unsigned int pamax = arm_pamax(cpu); 10166 10167 switch (stride) { 10168 case 13: /* 64KB Pages. */ 10169 if (level == 0 || (level == 1 && pamax <= 42)) { 10170 return false; 10171 } 10172 break; 10173 case 11: /* 16KB Pages. */ 10174 if (level == 0 || (level == 1 && pamax <= 40)) { 10175 return false; 10176 } 10177 break; 10178 case 9: /* 4KB Pages. */ 10179 if (level == 0 && pamax <= 42) { 10180 return false; 10181 } 10182 break; 10183 default: 10184 g_assert_not_reached(); 10185 } 10186 10187 /* Inputsize checks. */ 10188 if (inputsize > pamax && 10189 (arm_el_is_aa64(env, 1) || inputsize > 40)) { 10190 /* This is CONSTRAINED UNPREDICTABLE and we choose to fault. */ 10191 return false; 10192 } 10193 } else { 10194 /* AArch32 only supports 4KB pages. Assert on that. */ 10195 assert(stride == 9); 10196 10197 if (level == 0) { 10198 return false; 10199 } 10200 } 10201 return true; 10202 } 10203 10204 /* Translate from the 4-bit stage 2 representation of 10205 * memory attributes (without cache-allocation hints) to 10206 * the 8-bit representation of the stage 1 MAIR registers 10207 * (which includes allocation hints). 10208 * 10209 * ref: shared/translation/attrs/S2AttrDecode() 10210 * .../S2ConvertAttrsHints() 10211 */ 10212 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs) 10213 { 10214 uint8_t hiattr = extract32(s2attrs, 2, 2); 10215 uint8_t loattr = extract32(s2attrs, 0, 2); 10216 uint8_t hihint = 0, lohint = 0; 10217 10218 if (hiattr != 0) { /* normal memory */ 10219 if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */ 10220 hiattr = loattr = 1; /* non-cacheable */ 10221 } else { 10222 if (hiattr != 1) { /* Write-through or write-back */ 10223 hihint = 3; /* RW allocate */ 10224 } 10225 if (loattr != 1) { /* Write-through or write-back */ 10226 lohint = 3; /* RW allocate */ 10227 } 10228 } 10229 } 10230 10231 return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint; 10232 } 10233 #endif /* !CONFIG_USER_ONLY */ 10234 10235 static int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx) 10236 { 10237 if (regime_has_2_ranges(mmu_idx)) { 10238 return extract64(tcr, 37, 2); 10239 } else if (mmu_idx == ARMMMUIdx_Stage2) { 10240 return 0; /* VTCR_EL2 */ 10241 } else { 10242 return extract32(tcr, 20, 1); 10243 } 10244 } 10245 10246 static int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx) 10247 { 10248 if (regime_has_2_ranges(mmu_idx)) { 10249 return extract64(tcr, 51, 2); 10250 } else if (mmu_idx == ARMMMUIdx_Stage2) { 10251 return 0; /* VTCR_EL2 */ 10252 } else { 10253 return extract32(tcr, 29, 1); 10254 } 10255 } 10256 10257 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 10258 ARMMMUIdx mmu_idx, bool data) 10259 { 10260 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10261 bool epd, hpd, using16k, using64k; 10262 int select, tsz, tbi; 10263 10264 if (!regime_has_2_ranges(mmu_idx)) { 10265 select = 0; 10266 tsz = extract32(tcr, 0, 6); 10267 using64k = extract32(tcr, 14, 1); 10268 using16k = extract32(tcr, 15, 1); 10269 if (mmu_idx == ARMMMUIdx_Stage2) { 10270 /* VTCR_EL2 */ 10271 hpd = false; 10272 } else { 10273 hpd = extract32(tcr, 24, 1); 10274 } 10275 epd = false; 10276 } else { 10277 /* 10278 * Bit 55 is always between the two regions, and is canonical for 10279 * determining if address tagging is enabled. 10280 */ 10281 select = extract64(va, 55, 1); 10282 if (!select) { 10283 tsz = extract32(tcr, 0, 6); 10284 epd = extract32(tcr, 7, 1); 10285 using64k = extract32(tcr, 14, 1); 10286 using16k = extract32(tcr, 15, 1); 10287 hpd = extract64(tcr, 41, 1); 10288 } else { 10289 int tg = extract32(tcr, 30, 2); 10290 using16k = tg == 1; 10291 using64k = tg == 3; 10292 tsz = extract32(tcr, 16, 6); 10293 epd = extract32(tcr, 23, 1); 10294 hpd = extract64(tcr, 42, 1); 10295 } 10296 } 10297 tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */ 10298 tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */ 10299 10300 /* Present TBI as a composite with TBID. */ 10301 tbi = aa64_va_parameter_tbi(tcr, mmu_idx); 10302 if (!data) { 10303 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx); 10304 } 10305 tbi = (tbi >> select) & 1; 10306 10307 return (ARMVAParameters) { 10308 .tsz = tsz, 10309 .select = select, 10310 .tbi = tbi, 10311 .epd = epd, 10312 .hpd = hpd, 10313 .using16k = using16k, 10314 .using64k = using64k, 10315 }; 10316 } 10317 10318 #ifndef CONFIG_USER_ONLY 10319 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va, 10320 ARMMMUIdx mmu_idx) 10321 { 10322 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 10323 uint32_t el = regime_el(env, mmu_idx); 10324 int select, tsz; 10325 bool epd, hpd; 10326 10327 if (mmu_idx == ARMMMUIdx_Stage2) { 10328 /* VTCR */ 10329 bool sext = extract32(tcr, 4, 1); 10330 bool sign = extract32(tcr, 3, 1); 10331 10332 /* 10333 * If the sign-extend bit is not the same as t0sz[3], the result 10334 * is unpredictable. Flag this as a guest error. 10335 */ 10336 if (sign != sext) { 10337 qemu_log_mask(LOG_GUEST_ERROR, 10338 "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n"); 10339 } 10340 tsz = sextract32(tcr, 0, 4) + 8; 10341 select = 0; 10342 hpd = false; 10343 epd = false; 10344 } else if (el == 2) { 10345 /* HTCR */ 10346 tsz = extract32(tcr, 0, 3); 10347 select = 0; 10348 hpd = extract64(tcr, 24, 1); 10349 epd = false; 10350 } else { 10351 int t0sz = extract32(tcr, 0, 3); 10352 int t1sz = extract32(tcr, 16, 3); 10353 10354 if (t1sz == 0) { 10355 select = va > (0xffffffffu >> t0sz); 10356 } else { 10357 /* Note that we will detect errors later. */ 10358 select = va >= ~(0xffffffffu >> t1sz); 10359 } 10360 if (!select) { 10361 tsz = t0sz; 10362 epd = extract32(tcr, 7, 1); 10363 hpd = extract64(tcr, 41, 1); 10364 } else { 10365 tsz = t1sz; 10366 epd = extract32(tcr, 23, 1); 10367 hpd = extract64(tcr, 42, 1); 10368 } 10369 /* For aarch32, hpd0 is not enabled without t2e as well. */ 10370 hpd &= extract32(tcr, 6, 1); 10371 } 10372 10373 return (ARMVAParameters) { 10374 .tsz = tsz, 10375 .select = select, 10376 .epd = epd, 10377 .hpd = hpd, 10378 }; 10379 } 10380 10381 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, 10382 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10383 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, 10384 target_ulong *page_size_ptr, 10385 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 10386 { 10387 ARMCPU *cpu = env_archcpu(env); 10388 CPUState *cs = CPU(cpu); 10389 /* Read an LPAE long-descriptor translation table. */ 10390 ARMFaultType fault_type = ARMFault_Translation; 10391 uint32_t level; 10392 ARMVAParameters param; 10393 uint64_t ttbr; 10394 hwaddr descaddr, indexmask, indexmask_grainsize; 10395 uint32_t tableattrs; 10396 target_ulong page_size; 10397 uint32_t attrs; 10398 int32_t stride; 10399 int addrsize, inputsize; 10400 TCR *tcr = regime_tcr(env, mmu_idx); 10401 int ap, ns, xn, pxn; 10402 uint32_t el = regime_el(env, mmu_idx); 10403 uint64_t descaddrmask; 10404 bool aarch64 = arm_el_is_aa64(env, el); 10405 bool guarded = false; 10406 10407 /* TODO: 10408 * This code does not handle the different format TCR for VTCR_EL2. 10409 * This code also does not support shareability levels. 10410 * Attribute and permission bit handling should also be checked when adding 10411 * support for those page table walks. 10412 */ 10413 if (aarch64) { 10414 param = aa64_va_parameters(env, address, mmu_idx, 10415 access_type != MMU_INST_FETCH); 10416 level = 0; 10417 addrsize = 64 - 8 * param.tbi; 10418 inputsize = 64 - param.tsz; 10419 } else { 10420 param = aa32_va_parameters(env, address, mmu_idx); 10421 level = 1; 10422 addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32); 10423 inputsize = addrsize - param.tsz; 10424 } 10425 10426 /* 10427 * We determined the region when collecting the parameters, but we 10428 * have not yet validated that the address is valid for the region. 10429 * Extract the top bits and verify that they all match select. 10430 * 10431 * For aa32, if inputsize == addrsize, then we have selected the 10432 * region by exclusion in aa32_va_parameters and there is no more 10433 * validation to do here. 10434 */ 10435 if (inputsize < addrsize) { 10436 target_ulong top_bits = sextract64(address, inputsize, 10437 addrsize - inputsize); 10438 if (-top_bits != param.select) { 10439 /* The gap between the two regions is a Translation fault */ 10440 fault_type = ARMFault_Translation; 10441 goto do_fault; 10442 } 10443 } 10444 10445 if (param.using64k) { 10446 stride = 13; 10447 } else if (param.using16k) { 10448 stride = 11; 10449 } else { 10450 stride = 9; 10451 } 10452 10453 /* Note that QEMU ignores shareability and cacheability attributes, 10454 * so we don't need to do anything with the SH, ORGN, IRGN fields 10455 * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the 10456 * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently 10457 * implement any ASID-like capability so we can ignore it (instead 10458 * we will always flush the TLB any time the ASID is changed). 10459 */ 10460 ttbr = regime_ttbr(env, mmu_idx, param.select); 10461 10462 /* Here we should have set up all the parameters for the translation: 10463 * inputsize, ttbr, epd, stride, tbi 10464 */ 10465 10466 if (param.epd) { 10467 /* Translation table walk disabled => Translation fault on TLB miss 10468 * Note: This is always 0 on 64-bit EL2 and EL3. 10469 */ 10470 goto do_fault; 10471 } 10472 10473 if (mmu_idx != ARMMMUIdx_Stage2) { 10474 /* The starting level depends on the virtual address size (which can 10475 * be up to 48 bits) and the translation granule size. It indicates 10476 * the number of strides (stride bits at a time) needed to 10477 * consume the bits of the input address. In the pseudocode this is: 10478 * level = 4 - RoundUp((inputsize - grainsize) / stride) 10479 * where their 'inputsize' is our 'inputsize', 'grainsize' is 10480 * our 'stride + 3' and 'stride' is our 'stride'. 10481 * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying: 10482 * = 4 - (inputsize - stride - 3 + stride - 1) / stride 10483 * = 4 - (inputsize - 4) / stride; 10484 */ 10485 level = 4 - (inputsize - 4) / stride; 10486 } else { 10487 /* For stage 2 translations the starting level is specified by the 10488 * VTCR_EL2.SL0 field (whose interpretation depends on the page size) 10489 */ 10490 uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2); 10491 uint32_t startlevel; 10492 bool ok; 10493 10494 if (!aarch64 || stride == 9) { 10495 /* AArch32 or 4KB pages */ 10496 startlevel = 2 - sl0; 10497 } else { 10498 /* 16KB or 64KB pages */ 10499 startlevel = 3 - sl0; 10500 } 10501 10502 /* Check that the starting level is valid. */ 10503 ok = check_s2_mmu_setup(cpu, aarch64, startlevel, 10504 inputsize, stride); 10505 if (!ok) { 10506 fault_type = ARMFault_Translation; 10507 goto do_fault; 10508 } 10509 level = startlevel; 10510 } 10511 10512 indexmask_grainsize = (1ULL << (stride + 3)) - 1; 10513 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1; 10514 10515 /* Now we can extract the actual base address from the TTBR */ 10516 descaddr = extract64(ttbr, 0, 48); 10517 descaddr &= ~indexmask; 10518 10519 /* The address field in the descriptor goes up to bit 39 for ARMv7 10520 * but up to bit 47 for ARMv8, but we use the descaddrmask 10521 * up to bit 39 for AArch32, because we don't need other bits in that case 10522 * to construct next descriptor address (anyway they should be all zeroes). 10523 */ 10524 descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) & 10525 ~indexmask_grainsize; 10526 10527 /* Secure accesses start with the page table in secure memory and 10528 * can be downgraded to non-secure at any step. Non-secure accesses 10529 * remain non-secure. We implement this by just ORing in the NSTable/NS 10530 * bits at each step. 10531 */ 10532 tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4); 10533 for (;;) { 10534 uint64_t descriptor; 10535 bool nstable; 10536 10537 descaddr |= (address >> (stride * (4 - level))) & indexmask; 10538 descaddr &= ~7ULL; 10539 nstable = extract32(tableattrs, 4, 1); 10540 descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi); 10541 if (fi->type != ARMFault_None) { 10542 goto do_fault; 10543 } 10544 10545 if (!(descriptor & 1) || 10546 (!(descriptor & 2) && (level == 3))) { 10547 /* Invalid, or the Reserved level 3 encoding */ 10548 goto do_fault; 10549 } 10550 descaddr = descriptor & descaddrmask; 10551 10552 if ((descriptor & 2) && (level < 3)) { 10553 /* Table entry. The top five bits are attributes which may 10554 * propagate down through lower levels of the table (and 10555 * which are all arranged so that 0 means "no effect", so 10556 * we can gather them up by ORing in the bits at each level). 10557 */ 10558 tableattrs |= extract64(descriptor, 59, 5); 10559 level++; 10560 indexmask = indexmask_grainsize; 10561 continue; 10562 } 10563 /* Block entry at level 1 or 2, or page entry at level 3. 10564 * These are basically the same thing, although the number 10565 * of bits we pull in from the vaddr varies. 10566 */ 10567 page_size = (1ULL << ((stride * (4 - level)) + 3)); 10568 descaddr |= (address & (page_size - 1)); 10569 /* Extract attributes from the descriptor */ 10570 attrs = extract64(descriptor, 2, 10) 10571 | (extract64(descriptor, 52, 12) << 10); 10572 10573 if (mmu_idx == ARMMMUIdx_Stage2) { 10574 /* Stage 2 table descriptors do not include any attribute fields */ 10575 break; 10576 } 10577 /* Merge in attributes from table descriptors */ 10578 attrs |= nstable << 3; /* NS */ 10579 guarded = extract64(descriptor, 50, 1); /* GP */ 10580 if (param.hpd) { 10581 /* HPD disables all the table attributes except NSTable. */ 10582 break; 10583 } 10584 attrs |= extract32(tableattrs, 0, 2) << 11; /* XN, PXN */ 10585 /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1 10586 * means "force PL1 access only", which means forcing AP[1] to 0. 10587 */ 10588 attrs &= ~(extract32(tableattrs, 2, 1) << 4); /* !APT[0] => AP[1] */ 10589 attrs |= extract32(tableattrs, 3, 1) << 5; /* APT[1] => AP[2] */ 10590 break; 10591 } 10592 /* Here descaddr is the final physical address, and attributes 10593 * are all in attrs. 10594 */ 10595 fault_type = ARMFault_AccessFlag; 10596 if ((attrs & (1 << 8)) == 0) { 10597 /* Access flag */ 10598 goto do_fault; 10599 } 10600 10601 ap = extract32(attrs, 4, 2); 10602 xn = extract32(attrs, 12, 1); 10603 10604 if (mmu_idx == ARMMMUIdx_Stage2) { 10605 ns = true; 10606 *prot = get_S2prot(env, ap, xn); 10607 } else { 10608 ns = extract32(attrs, 3, 1); 10609 pxn = extract32(attrs, 11, 1); 10610 *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn); 10611 } 10612 10613 fault_type = ARMFault_Permission; 10614 if (!(*prot & (1 << access_type))) { 10615 goto do_fault; 10616 } 10617 10618 if (ns) { 10619 /* The NS bit will (as required by the architecture) have no effect if 10620 * the CPU doesn't support TZ or this is a non-secure translation 10621 * regime, because the attribute will already be non-secure. 10622 */ 10623 txattrs->secure = false; 10624 } 10625 /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB. */ 10626 if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) { 10627 txattrs->target_tlb_bit0 = true; 10628 } 10629 10630 if (cacheattrs != NULL) { 10631 if (mmu_idx == ARMMMUIdx_Stage2) { 10632 cacheattrs->attrs = convert_stage2_attrs(env, 10633 extract32(attrs, 0, 4)); 10634 } else { 10635 /* Index into MAIR registers for cache attributes */ 10636 uint8_t attrindx = extract32(attrs, 0, 3); 10637 uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)]; 10638 assert(attrindx <= 7); 10639 cacheattrs->attrs = extract64(mair, attrindx * 8, 8); 10640 } 10641 cacheattrs->shareability = extract32(attrs, 6, 2); 10642 } 10643 10644 *phys_ptr = descaddr; 10645 *page_size_ptr = page_size; 10646 return false; 10647 10648 do_fault: 10649 fi->type = fault_type; 10650 fi->level = level; 10651 /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2. */ 10652 fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2); 10653 return true; 10654 } 10655 10656 static inline void get_phys_addr_pmsav7_default(CPUARMState *env, 10657 ARMMMUIdx mmu_idx, 10658 int32_t address, int *prot) 10659 { 10660 if (!arm_feature(env, ARM_FEATURE_M)) { 10661 *prot = PAGE_READ | PAGE_WRITE; 10662 switch (address) { 10663 case 0xF0000000 ... 0xFFFFFFFF: 10664 if (regime_sctlr(env, mmu_idx) & SCTLR_V) { 10665 /* hivecs execing is ok */ 10666 *prot |= PAGE_EXEC; 10667 } 10668 break; 10669 case 0x00000000 ... 0x7FFFFFFF: 10670 *prot |= PAGE_EXEC; 10671 break; 10672 } 10673 } else { 10674 /* Default system address map for M profile cores. 10675 * The architecture specifies which regions are execute-never; 10676 * at the MPU level no other checks are defined. 10677 */ 10678 switch (address) { 10679 case 0x00000000 ... 0x1fffffff: /* ROM */ 10680 case 0x20000000 ... 0x3fffffff: /* SRAM */ 10681 case 0x60000000 ... 0x7fffffff: /* RAM */ 10682 case 0x80000000 ... 0x9fffffff: /* RAM */ 10683 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 10684 break; 10685 case 0x40000000 ... 0x5fffffff: /* Peripheral */ 10686 case 0xa0000000 ... 0xbfffffff: /* Device */ 10687 case 0xc0000000 ... 0xdfffffff: /* Device */ 10688 case 0xe0000000 ... 0xffffffff: /* System */ 10689 *prot = PAGE_READ | PAGE_WRITE; 10690 break; 10691 default: 10692 g_assert_not_reached(); 10693 } 10694 } 10695 } 10696 10697 static bool pmsav7_use_background_region(ARMCPU *cpu, 10698 ARMMMUIdx mmu_idx, bool is_user) 10699 { 10700 /* Return true if we should use the default memory map as a 10701 * "background" region if there are no hits against any MPU regions. 10702 */ 10703 CPUARMState *env = &cpu->env; 10704 10705 if (is_user) { 10706 return false; 10707 } 10708 10709 if (arm_feature(env, ARM_FEATURE_M)) { 10710 return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] 10711 & R_V7M_MPU_CTRL_PRIVDEFENA_MASK; 10712 } else { 10713 return regime_sctlr(env, mmu_idx) & SCTLR_BR; 10714 } 10715 } 10716 10717 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address) 10718 { 10719 /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */ 10720 return arm_feature(env, ARM_FEATURE_M) && 10721 extract32(address, 20, 12) == 0xe00; 10722 } 10723 10724 static inline bool m_is_system_region(CPUARMState *env, uint32_t address) 10725 { 10726 /* True if address is in the M profile system region 10727 * 0xe0000000 - 0xffffffff 10728 */ 10729 return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7; 10730 } 10731 10732 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, 10733 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10734 hwaddr *phys_ptr, int *prot, 10735 target_ulong *page_size, 10736 ARMMMUFaultInfo *fi) 10737 { 10738 ARMCPU *cpu = env_archcpu(env); 10739 int n; 10740 bool is_user = regime_is_user(env, mmu_idx); 10741 10742 *phys_ptr = address; 10743 *page_size = TARGET_PAGE_SIZE; 10744 *prot = 0; 10745 10746 if (regime_translation_disabled(env, mmu_idx) || 10747 m_is_ppb_region(env, address)) { 10748 /* MPU disabled or M profile PPB access: use default memory map. 10749 * The other case which uses the default memory map in the 10750 * v7M ARM ARM pseudocode is exception vector reads from the vector 10751 * table. In QEMU those accesses are done in arm_v7m_load_vector(), 10752 * which always does a direct read using address_space_ldl(), rather 10753 * than going via this function, so we don't need to check that here. 10754 */ 10755 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10756 } else { /* MPU enabled */ 10757 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 10758 /* region search */ 10759 uint32_t base = env->pmsav7.drbar[n]; 10760 uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5); 10761 uint32_t rmask; 10762 bool srdis = false; 10763 10764 if (!(env->pmsav7.drsr[n] & 0x1)) { 10765 continue; 10766 } 10767 10768 if (!rsize) { 10769 qemu_log_mask(LOG_GUEST_ERROR, 10770 "DRSR[%d]: Rsize field cannot be 0\n", n); 10771 continue; 10772 } 10773 rsize++; 10774 rmask = (1ull << rsize) - 1; 10775 10776 if (base & rmask) { 10777 qemu_log_mask(LOG_GUEST_ERROR, 10778 "DRBAR[%d]: 0x%" PRIx32 " misaligned " 10779 "to DRSR region size, mask = 0x%" PRIx32 "\n", 10780 n, base, rmask); 10781 continue; 10782 } 10783 10784 if (address < base || address > base + rmask) { 10785 /* 10786 * Address not in this region. We must check whether the 10787 * region covers addresses in the same page as our address. 10788 * In that case we must not report a size that covers the 10789 * whole page for a subsequent hit against a different MPU 10790 * region or the background region, because it would result in 10791 * incorrect TLB hits for subsequent accesses to addresses that 10792 * are in this MPU region. 10793 */ 10794 if (ranges_overlap(base, rmask, 10795 address & TARGET_PAGE_MASK, 10796 TARGET_PAGE_SIZE)) { 10797 *page_size = 1; 10798 } 10799 continue; 10800 } 10801 10802 /* Region matched */ 10803 10804 if (rsize >= 8) { /* no subregions for regions < 256 bytes */ 10805 int i, snd; 10806 uint32_t srdis_mask; 10807 10808 rsize -= 3; /* sub region size (power of 2) */ 10809 snd = ((address - base) >> rsize) & 0x7; 10810 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1); 10811 10812 srdis_mask = srdis ? 0x3 : 0x0; 10813 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) { 10814 /* This will check in groups of 2, 4 and then 8, whether 10815 * the subregion bits are consistent. rsize is incremented 10816 * back up to give the region size, considering consistent 10817 * adjacent subregions as one region. Stop testing if rsize 10818 * is already big enough for an entire QEMU page. 10819 */ 10820 int snd_rounded = snd & ~(i - 1); 10821 uint32_t srdis_multi = extract32(env->pmsav7.drsr[n], 10822 snd_rounded + 8, i); 10823 if (srdis_mask ^ srdis_multi) { 10824 break; 10825 } 10826 srdis_mask = (srdis_mask << i) | srdis_mask; 10827 rsize++; 10828 } 10829 } 10830 if (srdis) { 10831 continue; 10832 } 10833 if (rsize < TARGET_PAGE_BITS) { 10834 *page_size = 1 << rsize; 10835 } 10836 break; 10837 } 10838 10839 if (n == -1) { /* no hits */ 10840 if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 10841 /* background fault */ 10842 fi->type = ARMFault_Background; 10843 return true; 10844 } 10845 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 10846 } else { /* a MPU hit! */ 10847 uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3); 10848 uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1); 10849 10850 if (m_is_system_region(env, address)) { 10851 /* System space is always execute never */ 10852 xn = 1; 10853 } 10854 10855 if (is_user) { /* User mode AP bit decoding */ 10856 switch (ap) { 10857 case 0: 10858 case 1: 10859 case 5: 10860 break; /* no access */ 10861 case 3: 10862 *prot |= PAGE_WRITE; 10863 /* fall through */ 10864 case 2: 10865 case 6: 10866 *prot |= PAGE_READ | PAGE_EXEC; 10867 break; 10868 case 7: 10869 /* for v7M, same as 6; for R profile a reserved value */ 10870 if (arm_feature(env, ARM_FEATURE_M)) { 10871 *prot |= PAGE_READ | PAGE_EXEC; 10872 break; 10873 } 10874 /* fall through */ 10875 default: 10876 qemu_log_mask(LOG_GUEST_ERROR, 10877 "DRACR[%d]: Bad value for AP bits: 0x%" 10878 PRIx32 "\n", n, ap); 10879 } 10880 } else { /* Priv. mode AP bits decoding */ 10881 switch (ap) { 10882 case 0: 10883 break; /* no access */ 10884 case 1: 10885 case 2: 10886 case 3: 10887 *prot |= PAGE_WRITE; 10888 /* fall through */ 10889 case 5: 10890 case 6: 10891 *prot |= PAGE_READ | PAGE_EXEC; 10892 break; 10893 case 7: 10894 /* for v7M, same as 6; for R profile a reserved value */ 10895 if (arm_feature(env, ARM_FEATURE_M)) { 10896 *prot |= PAGE_READ | PAGE_EXEC; 10897 break; 10898 } 10899 /* fall through */ 10900 default: 10901 qemu_log_mask(LOG_GUEST_ERROR, 10902 "DRACR[%d]: Bad value for AP bits: 0x%" 10903 PRIx32 "\n", n, ap); 10904 } 10905 } 10906 10907 /* execute never */ 10908 if (xn) { 10909 *prot &= ~PAGE_EXEC; 10910 } 10911 } 10912 } 10913 10914 fi->type = ARMFault_Permission; 10915 fi->level = 1; 10916 return !(*prot & (1 << access_type)); 10917 } 10918 10919 static bool v8m_is_sau_exempt(CPUARMState *env, 10920 uint32_t address, MMUAccessType access_type) 10921 { 10922 /* The architecture specifies that certain address ranges are 10923 * exempt from v8M SAU/IDAU checks. 10924 */ 10925 return 10926 (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) || 10927 (address >= 0xe0000000 && address <= 0xe0002fff) || 10928 (address >= 0xe000e000 && address <= 0xe000efff) || 10929 (address >= 0xe002e000 && address <= 0xe002efff) || 10930 (address >= 0xe0040000 && address <= 0xe0041fff) || 10931 (address >= 0xe00ff000 && address <= 0xe00fffff); 10932 } 10933 10934 void v8m_security_lookup(CPUARMState *env, uint32_t address, 10935 MMUAccessType access_type, ARMMMUIdx mmu_idx, 10936 V8M_SAttributes *sattrs) 10937 { 10938 /* Look up the security attributes for this address. Compare the 10939 * pseudocode SecurityCheck() function. 10940 * We assume the caller has zero-initialized *sattrs. 10941 */ 10942 ARMCPU *cpu = env_archcpu(env); 10943 int r; 10944 bool idau_exempt = false, idau_ns = true, idau_nsc = true; 10945 int idau_region = IREGION_NOTVALID; 10946 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 10947 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 10948 10949 if (cpu->idau) { 10950 IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau); 10951 IDAUInterface *ii = IDAU_INTERFACE(cpu->idau); 10952 10953 iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns, 10954 &idau_nsc); 10955 } 10956 10957 if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) { 10958 /* 0xf0000000..0xffffffff is always S for insn fetches */ 10959 return; 10960 } 10961 10962 if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) { 10963 sattrs->ns = !regime_is_secure(env, mmu_idx); 10964 return; 10965 } 10966 10967 if (idau_region != IREGION_NOTVALID) { 10968 sattrs->irvalid = true; 10969 sattrs->iregion = idau_region; 10970 } 10971 10972 switch (env->sau.ctrl & 3) { 10973 case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */ 10974 break; 10975 case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */ 10976 sattrs->ns = true; 10977 break; 10978 default: /* SAU.ENABLE == 1 */ 10979 for (r = 0; r < cpu->sau_sregion; r++) { 10980 if (env->sau.rlar[r] & 1) { 10981 uint32_t base = env->sau.rbar[r] & ~0x1f; 10982 uint32_t limit = env->sau.rlar[r] | 0x1f; 10983 10984 if (base <= address && limit >= address) { 10985 if (base > addr_page_base || limit < addr_page_limit) { 10986 sattrs->subpage = true; 10987 } 10988 if (sattrs->srvalid) { 10989 /* If we hit in more than one region then we must report 10990 * as Secure, not NS-Callable, with no valid region 10991 * number info. 10992 */ 10993 sattrs->ns = false; 10994 sattrs->nsc = false; 10995 sattrs->sregion = 0; 10996 sattrs->srvalid = false; 10997 break; 10998 } else { 10999 if (env->sau.rlar[r] & 2) { 11000 sattrs->nsc = true; 11001 } else { 11002 sattrs->ns = true; 11003 } 11004 sattrs->srvalid = true; 11005 sattrs->sregion = r; 11006 } 11007 } else { 11008 /* 11009 * Address not in this region. We must check whether the 11010 * region covers addresses in the same page as our address. 11011 * In that case we must not report a size that covers the 11012 * whole page for a subsequent hit against a different MPU 11013 * region or the background region, because it would result 11014 * in incorrect TLB hits for subsequent accesses to 11015 * addresses that are in this MPU region. 11016 */ 11017 if (limit >= base && 11018 ranges_overlap(base, limit - base + 1, 11019 addr_page_base, 11020 TARGET_PAGE_SIZE)) { 11021 sattrs->subpage = true; 11022 } 11023 } 11024 } 11025 } 11026 break; 11027 } 11028 11029 /* 11030 * The IDAU will override the SAU lookup results if it specifies 11031 * higher security than the SAU does. 11032 */ 11033 if (!idau_ns) { 11034 if (sattrs->ns || (!idau_nsc && sattrs->nsc)) { 11035 sattrs->ns = false; 11036 sattrs->nsc = idau_nsc; 11037 } 11038 } 11039 } 11040 11041 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address, 11042 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11043 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11044 int *prot, bool *is_subpage, 11045 ARMMMUFaultInfo *fi, uint32_t *mregion) 11046 { 11047 /* Perform a PMSAv8 MPU lookup (without also doing the SAU check 11048 * that a full phys-to-virt translation does). 11049 * mregion is (if not NULL) set to the region number which matched, 11050 * or -1 if no region number is returned (MPU off, address did not 11051 * hit a region, address hit in multiple regions). 11052 * We set is_subpage to true if the region hit doesn't cover the 11053 * entire TARGET_PAGE the address is within. 11054 */ 11055 ARMCPU *cpu = env_archcpu(env); 11056 bool is_user = regime_is_user(env, mmu_idx); 11057 uint32_t secure = regime_is_secure(env, mmu_idx); 11058 int n; 11059 int matchregion = -1; 11060 bool hit = false; 11061 uint32_t addr_page_base = address & TARGET_PAGE_MASK; 11062 uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1); 11063 11064 *is_subpage = false; 11065 *phys_ptr = address; 11066 *prot = 0; 11067 if (mregion) { 11068 *mregion = -1; 11069 } 11070 11071 /* Unlike the ARM ARM pseudocode, we don't need to check whether this 11072 * was an exception vector read from the vector table (which is always 11073 * done using the default system address map), because those accesses 11074 * are done in arm_v7m_load_vector(), which always does a direct 11075 * read using address_space_ldl(), rather than going via this function. 11076 */ 11077 if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */ 11078 hit = true; 11079 } else if (m_is_ppb_region(env, address)) { 11080 hit = true; 11081 } else { 11082 if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) { 11083 hit = true; 11084 } 11085 11086 for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) { 11087 /* region search */ 11088 /* Note that the base address is bits [31:5] from the register 11089 * with bits [4:0] all zeroes, but the limit address is bits 11090 * [31:5] from the register with bits [4:0] all ones. 11091 */ 11092 uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f; 11093 uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f; 11094 11095 if (!(env->pmsav8.rlar[secure][n] & 0x1)) { 11096 /* Region disabled */ 11097 continue; 11098 } 11099 11100 if (address < base || address > limit) { 11101 /* 11102 * Address not in this region. We must check whether the 11103 * region covers addresses in the same page as our address. 11104 * In that case we must not report a size that covers the 11105 * whole page for a subsequent hit against a different MPU 11106 * region or the background region, because it would result in 11107 * incorrect TLB hits for subsequent accesses to addresses that 11108 * are in this MPU region. 11109 */ 11110 if (limit >= base && 11111 ranges_overlap(base, limit - base + 1, 11112 addr_page_base, 11113 TARGET_PAGE_SIZE)) { 11114 *is_subpage = true; 11115 } 11116 continue; 11117 } 11118 11119 if (base > addr_page_base || limit < addr_page_limit) { 11120 *is_subpage = true; 11121 } 11122 11123 if (matchregion != -1) { 11124 /* Multiple regions match -- always a failure (unlike 11125 * PMSAv7 where highest-numbered-region wins) 11126 */ 11127 fi->type = ARMFault_Permission; 11128 fi->level = 1; 11129 return true; 11130 } 11131 11132 matchregion = n; 11133 hit = true; 11134 } 11135 } 11136 11137 if (!hit) { 11138 /* background fault */ 11139 fi->type = ARMFault_Background; 11140 return true; 11141 } 11142 11143 if (matchregion == -1) { 11144 /* hit using the background region */ 11145 get_phys_addr_pmsav7_default(env, mmu_idx, address, prot); 11146 } else { 11147 uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2); 11148 uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1); 11149 11150 if (m_is_system_region(env, address)) { 11151 /* System space is always execute never */ 11152 xn = 1; 11153 } 11154 11155 *prot = simple_ap_to_rw_prot(env, mmu_idx, ap); 11156 if (*prot && !xn) { 11157 *prot |= PAGE_EXEC; 11158 } 11159 /* We don't need to look the attribute up in the MAIR0/MAIR1 11160 * registers because that only tells us about cacheability. 11161 */ 11162 if (mregion) { 11163 *mregion = matchregion; 11164 } 11165 } 11166 11167 fi->type = ARMFault_Permission; 11168 fi->level = 1; 11169 return !(*prot & (1 << access_type)); 11170 } 11171 11172 11173 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address, 11174 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11175 hwaddr *phys_ptr, MemTxAttrs *txattrs, 11176 int *prot, target_ulong *page_size, 11177 ARMMMUFaultInfo *fi) 11178 { 11179 uint32_t secure = regime_is_secure(env, mmu_idx); 11180 V8M_SAttributes sattrs = {}; 11181 bool ret; 11182 bool mpu_is_subpage; 11183 11184 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { 11185 v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs); 11186 if (access_type == MMU_INST_FETCH) { 11187 /* Instruction fetches always use the MMU bank and the 11188 * transaction attribute determined by the fetch address, 11189 * regardless of CPU state. This is painful for QEMU 11190 * to handle, because it would mean we need to encode 11191 * into the mmu_idx not just the (user, negpri) information 11192 * for the current security state but also that for the 11193 * other security state, which would balloon the number 11194 * of mmu_idx values needed alarmingly. 11195 * Fortunately we can avoid this because it's not actually 11196 * possible to arbitrarily execute code from memory with 11197 * the wrong security attribute: it will always generate 11198 * an exception of some kind or another, apart from the 11199 * special case of an NS CPU executing an SG instruction 11200 * in S&NSC memory. So we always just fail the translation 11201 * here and sort things out in the exception handler 11202 * (including possibly emulating an SG instruction). 11203 */ 11204 if (sattrs.ns != !secure) { 11205 if (sattrs.nsc) { 11206 fi->type = ARMFault_QEMU_NSCExec; 11207 } else { 11208 fi->type = ARMFault_QEMU_SFault; 11209 } 11210 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11211 *phys_ptr = address; 11212 *prot = 0; 11213 return true; 11214 } 11215 } else { 11216 /* For data accesses we always use the MMU bank indicated 11217 * by the current CPU state, but the security attributes 11218 * might downgrade a secure access to nonsecure. 11219 */ 11220 if (sattrs.ns) { 11221 txattrs->secure = false; 11222 } else if (!secure) { 11223 /* NS access to S memory must fault. 11224 * Architecturally we should first check whether the 11225 * MPU information for this address indicates that we 11226 * are doing an unaligned access to Device memory, which 11227 * should generate a UsageFault instead. QEMU does not 11228 * currently check for that kind of unaligned access though. 11229 * If we added it we would need to do so as a special case 11230 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt(). 11231 */ 11232 fi->type = ARMFault_QEMU_SFault; 11233 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE; 11234 *phys_ptr = address; 11235 *prot = 0; 11236 return true; 11237 } 11238 } 11239 } 11240 11241 ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr, 11242 txattrs, prot, &mpu_is_subpage, fi, NULL); 11243 *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE; 11244 return ret; 11245 } 11246 11247 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, 11248 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11249 hwaddr *phys_ptr, int *prot, 11250 ARMMMUFaultInfo *fi) 11251 { 11252 int n; 11253 uint32_t mask; 11254 uint32_t base; 11255 bool is_user = regime_is_user(env, mmu_idx); 11256 11257 if (regime_translation_disabled(env, mmu_idx)) { 11258 /* MPU disabled. */ 11259 *phys_ptr = address; 11260 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11261 return false; 11262 } 11263 11264 *phys_ptr = address; 11265 for (n = 7; n >= 0; n--) { 11266 base = env->cp15.c6_region[n]; 11267 if ((base & 1) == 0) { 11268 continue; 11269 } 11270 mask = 1 << ((base >> 1) & 0x1f); 11271 /* Keep this shift separate from the above to avoid an 11272 (undefined) << 32. */ 11273 mask = (mask << 1) - 1; 11274 if (((base ^ address) & ~mask) == 0) { 11275 break; 11276 } 11277 } 11278 if (n < 0) { 11279 fi->type = ARMFault_Background; 11280 return true; 11281 } 11282 11283 if (access_type == MMU_INST_FETCH) { 11284 mask = env->cp15.pmsav5_insn_ap; 11285 } else { 11286 mask = env->cp15.pmsav5_data_ap; 11287 } 11288 mask = (mask >> (n * 4)) & 0xf; 11289 switch (mask) { 11290 case 0: 11291 fi->type = ARMFault_Permission; 11292 fi->level = 1; 11293 return true; 11294 case 1: 11295 if (is_user) { 11296 fi->type = ARMFault_Permission; 11297 fi->level = 1; 11298 return true; 11299 } 11300 *prot = PAGE_READ | PAGE_WRITE; 11301 break; 11302 case 2: 11303 *prot = PAGE_READ; 11304 if (!is_user) { 11305 *prot |= PAGE_WRITE; 11306 } 11307 break; 11308 case 3: 11309 *prot = PAGE_READ | PAGE_WRITE; 11310 break; 11311 case 5: 11312 if (is_user) { 11313 fi->type = ARMFault_Permission; 11314 fi->level = 1; 11315 return true; 11316 } 11317 *prot = PAGE_READ; 11318 break; 11319 case 6: 11320 *prot = PAGE_READ; 11321 break; 11322 default: 11323 /* Bad permission. */ 11324 fi->type = ARMFault_Permission; 11325 fi->level = 1; 11326 return true; 11327 } 11328 *prot |= PAGE_EXEC; 11329 return false; 11330 } 11331 11332 /* Combine either inner or outer cacheability attributes for normal 11333 * memory, according to table D4-42 and pseudocode procedure 11334 * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM). 11335 * 11336 * NB: only stage 1 includes allocation hints (RW bits), leading to 11337 * some asymmetry. 11338 */ 11339 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2) 11340 { 11341 if (s1 == 4 || s2 == 4) { 11342 /* non-cacheable has precedence */ 11343 return 4; 11344 } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) { 11345 /* stage 1 write-through takes precedence */ 11346 return s1; 11347 } else if (extract32(s2, 2, 2) == 2) { 11348 /* stage 2 write-through takes precedence, but the allocation hint 11349 * is still taken from stage 1 11350 */ 11351 return (2 << 2) | extract32(s1, 0, 2); 11352 } else { /* write-back */ 11353 return s1; 11354 } 11355 } 11356 11357 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4 11358 * and CombineS1S2Desc() 11359 * 11360 * @s1: Attributes from stage 1 walk 11361 * @s2: Attributes from stage 2 walk 11362 */ 11363 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2) 11364 { 11365 uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4); 11366 uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4); 11367 ARMCacheAttrs ret; 11368 11369 /* Combine shareability attributes (table D4-43) */ 11370 if (s1.shareability == 2 || s2.shareability == 2) { 11371 /* if either are outer-shareable, the result is outer-shareable */ 11372 ret.shareability = 2; 11373 } else if (s1.shareability == 3 || s2.shareability == 3) { 11374 /* if either are inner-shareable, the result is inner-shareable */ 11375 ret.shareability = 3; 11376 } else { 11377 /* both non-shareable */ 11378 ret.shareability = 0; 11379 } 11380 11381 /* Combine memory type and cacheability attributes */ 11382 if (s1hi == 0 || s2hi == 0) { 11383 /* Device has precedence over normal */ 11384 if (s1lo == 0 || s2lo == 0) { 11385 /* nGnRnE has precedence over anything */ 11386 ret.attrs = 0; 11387 } else if (s1lo == 4 || s2lo == 4) { 11388 /* non-Reordering has precedence over Reordering */ 11389 ret.attrs = 4; /* nGnRE */ 11390 } else if (s1lo == 8 || s2lo == 8) { 11391 /* non-Gathering has precedence over Gathering */ 11392 ret.attrs = 8; /* nGRE */ 11393 } else { 11394 ret.attrs = 0xc; /* GRE */ 11395 } 11396 11397 /* Any location for which the resultant memory type is any 11398 * type of Device memory is always treated as Outer Shareable. 11399 */ 11400 ret.shareability = 2; 11401 } else { /* Normal memory */ 11402 /* Outer/inner cacheability combine independently */ 11403 ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4 11404 | combine_cacheattr_nibble(s1lo, s2lo); 11405 11406 if (ret.attrs == 0x44) { 11407 /* Any location for which the resultant memory type is Normal 11408 * Inner Non-cacheable, Outer Non-cacheable is always treated 11409 * as Outer Shareable. 11410 */ 11411 ret.shareability = 2; 11412 } 11413 } 11414 11415 return ret; 11416 } 11417 11418 11419 /* get_phys_addr - get the physical address for this virtual address 11420 * 11421 * Find the physical address corresponding to the given virtual address, 11422 * by doing a translation table walk on MMU based systems or using the 11423 * MPU state on MPU based systems. 11424 * 11425 * Returns false if the translation was successful. Otherwise, phys_ptr, attrs, 11426 * prot and page_size may not be filled in, and the populated fsr value provides 11427 * information on why the translation aborted, in the format of a 11428 * DFSR/IFSR fault register, with the following caveats: 11429 * * we honour the short vs long DFSR format differences. 11430 * * the WnR bit is never set (the caller must do this). 11431 * * for PSMAv5 based systems we don't bother to return a full FSR format 11432 * value. 11433 * 11434 * @env: CPUARMState 11435 * @address: virtual address to get physical address for 11436 * @access_type: 0 for read, 1 for write, 2 for execute 11437 * @mmu_idx: MMU index indicating required translation regime 11438 * @phys_ptr: set to the physical address corresponding to the virtual address 11439 * @attrs: set to the memory transaction attributes to use 11440 * @prot: set to the permissions for the page containing phys_ptr 11441 * @page_size: set to the size of the page containing phys_ptr 11442 * @fi: set to fault info if the translation fails 11443 * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes 11444 */ 11445 bool get_phys_addr(CPUARMState *env, target_ulong address, 11446 MMUAccessType access_type, ARMMMUIdx mmu_idx, 11447 hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, 11448 target_ulong *page_size, 11449 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs) 11450 { 11451 if (mmu_idx == ARMMMUIdx_E10_0 || 11452 mmu_idx == ARMMMUIdx_E10_1 || 11453 mmu_idx == ARMMMUIdx_E10_1_PAN) { 11454 /* Call ourselves recursively to do the stage 1 and then stage 2 11455 * translations. 11456 */ 11457 if (arm_feature(env, ARM_FEATURE_EL2)) { 11458 hwaddr ipa; 11459 int s2_prot; 11460 int ret; 11461 ARMCacheAttrs cacheattrs2 = {}; 11462 11463 ret = get_phys_addr(env, address, access_type, 11464 stage_1_mmu_idx(mmu_idx), &ipa, attrs, 11465 prot, page_size, fi, cacheattrs); 11466 11467 /* If S1 fails or S2 is disabled, return early. */ 11468 if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2)) { 11469 *phys_ptr = ipa; 11470 return ret; 11471 } 11472 11473 /* S1 is done. Now do S2 translation. */ 11474 ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_Stage2, 11475 phys_ptr, attrs, &s2_prot, 11476 page_size, fi, 11477 cacheattrs != NULL ? &cacheattrs2 : NULL); 11478 fi->s2addr = ipa; 11479 /* Combine the S1 and S2 perms. */ 11480 *prot &= s2_prot; 11481 11482 /* Combine the S1 and S2 cache attributes, if needed */ 11483 if (!ret && cacheattrs != NULL) { 11484 if (env->cp15.hcr_el2 & HCR_DC) { 11485 /* 11486 * HCR.DC forces the first stage attributes to 11487 * Normal Non-Shareable, 11488 * Inner Write-Back Read-Allocate Write-Allocate, 11489 * Outer Write-Back Read-Allocate Write-Allocate. 11490 */ 11491 cacheattrs->attrs = 0xff; 11492 cacheattrs->shareability = 0; 11493 } 11494 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2); 11495 } 11496 11497 return ret; 11498 } else { 11499 /* 11500 * For non-EL2 CPUs a stage1+stage2 translation is just stage 1. 11501 */ 11502 mmu_idx = stage_1_mmu_idx(mmu_idx); 11503 } 11504 } 11505 11506 /* The page table entries may downgrade secure to non-secure, but 11507 * cannot upgrade an non-secure translation regime's attributes 11508 * to secure. 11509 */ 11510 attrs->secure = regime_is_secure(env, mmu_idx); 11511 attrs->user = regime_is_user(env, mmu_idx); 11512 11513 /* Fast Context Switch Extension. This doesn't exist at all in v8. 11514 * In v7 and earlier it affects all stage 1 translations. 11515 */ 11516 if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2 11517 && !arm_feature(env, ARM_FEATURE_V8)) { 11518 if (regime_el(env, mmu_idx) == 3) { 11519 address += env->cp15.fcseidr_s; 11520 } else { 11521 address += env->cp15.fcseidr_ns; 11522 } 11523 } 11524 11525 if (arm_feature(env, ARM_FEATURE_PMSA)) { 11526 bool ret; 11527 *page_size = TARGET_PAGE_SIZE; 11528 11529 if (arm_feature(env, ARM_FEATURE_V8)) { 11530 /* PMSAv8 */ 11531 ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx, 11532 phys_ptr, attrs, prot, page_size, fi); 11533 } else if (arm_feature(env, ARM_FEATURE_V7)) { 11534 /* PMSAv7 */ 11535 ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, 11536 phys_ptr, prot, page_size, fi); 11537 } else { 11538 /* Pre-v7 MPU */ 11539 ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, 11540 phys_ptr, prot, fi); 11541 } 11542 qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 11543 " mmu_idx %u -> %s (prot %c%c%c)\n", 11544 access_type == MMU_DATA_LOAD ? "reading" : 11545 (access_type == MMU_DATA_STORE ? "writing" : "execute"), 11546 (uint32_t)address, mmu_idx, 11547 ret ? "Miss" : "Hit", 11548 *prot & PAGE_READ ? 'r' : '-', 11549 *prot & PAGE_WRITE ? 'w' : '-', 11550 *prot & PAGE_EXEC ? 'x' : '-'); 11551 11552 return ret; 11553 } 11554 11555 /* Definitely a real MMU, not an MPU */ 11556 11557 if (regime_translation_disabled(env, mmu_idx)) { 11558 /* MMU disabled. */ 11559 *phys_ptr = address; 11560 *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; 11561 *page_size = TARGET_PAGE_SIZE; 11562 return 0; 11563 } 11564 11565 if (regime_using_lpae_format(env, mmu_idx)) { 11566 return get_phys_addr_lpae(env, address, access_type, mmu_idx, 11567 phys_ptr, attrs, prot, page_size, 11568 fi, cacheattrs); 11569 } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) { 11570 return get_phys_addr_v6(env, address, access_type, mmu_idx, 11571 phys_ptr, attrs, prot, page_size, fi); 11572 } else { 11573 return get_phys_addr_v5(env, address, access_type, mmu_idx, 11574 phys_ptr, prot, page_size, fi); 11575 } 11576 } 11577 11578 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, 11579 MemTxAttrs *attrs) 11580 { 11581 ARMCPU *cpu = ARM_CPU(cs); 11582 CPUARMState *env = &cpu->env; 11583 hwaddr phys_addr; 11584 target_ulong page_size; 11585 int prot; 11586 bool ret; 11587 ARMMMUFaultInfo fi = {}; 11588 ARMMMUIdx mmu_idx = arm_mmu_idx(env); 11589 11590 *attrs = (MemTxAttrs) {}; 11591 11592 ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr, 11593 attrs, &prot, &page_size, &fi, NULL); 11594 11595 if (ret) { 11596 return -1; 11597 } 11598 return phys_addr; 11599 } 11600 11601 #endif 11602 11603 /* Note that signed overflow is undefined in C. The following routines are 11604 careful to use unsigned types where modulo arithmetic is required. 11605 Failure to do so _will_ break on newer gcc. */ 11606 11607 /* Signed saturating arithmetic. */ 11608 11609 /* Perform 16-bit signed saturating addition. */ 11610 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 11611 { 11612 uint16_t res; 11613 11614 res = a + b; 11615 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 11616 if (a & 0x8000) 11617 res = 0x8000; 11618 else 11619 res = 0x7fff; 11620 } 11621 return res; 11622 } 11623 11624 /* Perform 8-bit signed saturating addition. */ 11625 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 11626 { 11627 uint8_t res; 11628 11629 res = a + b; 11630 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 11631 if (a & 0x80) 11632 res = 0x80; 11633 else 11634 res = 0x7f; 11635 } 11636 return res; 11637 } 11638 11639 /* Perform 16-bit signed saturating subtraction. */ 11640 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 11641 { 11642 uint16_t res; 11643 11644 res = a - b; 11645 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 11646 if (a & 0x8000) 11647 res = 0x8000; 11648 else 11649 res = 0x7fff; 11650 } 11651 return res; 11652 } 11653 11654 /* Perform 8-bit signed saturating subtraction. */ 11655 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 11656 { 11657 uint8_t res; 11658 11659 res = a - b; 11660 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 11661 if (a & 0x80) 11662 res = 0x80; 11663 else 11664 res = 0x7f; 11665 } 11666 return res; 11667 } 11668 11669 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 11670 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 11671 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 11672 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 11673 #define PFX q 11674 11675 #include "op_addsub.h" 11676 11677 /* Unsigned saturating arithmetic. */ 11678 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 11679 { 11680 uint16_t res; 11681 res = a + b; 11682 if (res < a) 11683 res = 0xffff; 11684 return res; 11685 } 11686 11687 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 11688 { 11689 if (a > b) 11690 return a - b; 11691 else 11692 return 0; 11693 } 11694 11695 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 11696 { 11697 uint8_t res; 11698 res = a + b; 11699 if (res < a) 11700 res = 0xff; 11701 return res; 11702 } 11703 11704 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 11705 { 11706 if (a > b) 11707 return a - b; 11708 else 11709 return 0; 11710 } 11711 11712 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 11713 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 11714 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 11715 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 11716 #define PFX uq 11717 11718 #include "op_addsub.h" 11719 11720 /* Signed modulo arithmetic. */ 11721 #define SARITH16(a, b, n, op) do { \ 11722 int32_t sum; \ 11723 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 11724 RESULT(sum, n, 16); \ 11725 if (sum >= 0) \ 11726 ge |= 3 << (n * 2); \ 11727 } while(0) 11728 11729 #define SARITH8(a, b, n, op) do { \ 11730 int32_t sum; \ 11731 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 11732 RESULT(sum, n, 8); \ 11733 if (sum >= 0) \ 11734 ge |= 1 << n; \ 11735 } while(0) 11736 11737 11738 #define ADD16(a, b, n) SARITH16(a, b, n, +) 11739 #define SUB16(a, b, n) SARITH16(a, b, n, -) 11740 #define ADD8(a, b, n) SARITH8(a, b, n, +) 11741 #define SUB8(a, b, n) SARITH8(a, b, n, -) 11742 #define PFX s 11743 #define ARITH_GE 11744 11745 #include "op_addsub.h" 11746 11747 /* Unsigned modulo arithmetic. */ 11748 #define ADD16(a, b, n) do { \ 11749 uint32_t sum; \ 11750 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 11751 RESULT(sum, n, 16); \ 11752 if ((sum >> 16) == 1) \ 11753 ge |= 3 << (n * 2); \ 11754 } while(0) 11755 11756 #define ADD8(a, b, n) do { \ 11757 uint32_t sum; \ 11758 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 11759 RESULT(sum, n, 8); \ 11760 if ((sum >> 8) == 1) \ 11761 ge |= 1 << n; \ 11762 } while(0) 11763 11764 #define SUB16(a, b, n) do { \ 11765 uint32_t sum; \ 11766 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 11767 RESULT(sum, n, 16); \ 11768 if ((sum >> 16) == 0) \ 11769 ge |= 3 << (n * 2); \ 11770 } while(0) 11771 11772 #define SUB8(a, b, n) do { \ 11773 uint32_t sum; \ 11774 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 11775 RESULT(sum, n, 8); \ 11776 if ((sum >> 8) == 0) \ 11777 ge |= 1 << n; \ 11778 } while(0) 11779 11780 #define PFX u 11781 #define ARITH_GE 11782 11783 #include "op_addsub.h" 11784 11785 /* Halved signed arithmetic. */ 11786 #define ADD16(a, b, n) \ 11787 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 11788 #define SUB16(a, b, n) \ 11789 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 11790 #define ADD8(a, b, n) \ 11791 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 11792 #define SUB8(a, b, n) \ 11793 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 11794 #define PFX sh 11795 11796 #include "op_addsub.h" 11797 11798 /* Halved unsigned arithmetic. */ 11799 #define ADD16(a, b, n) \ 11800 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 11801 #define SUB16(a, b, n) \ 11802 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 11803 #define ADD8(a, b, n) \ 11804 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 11805 #define SUB8(a, b, n) \ 11806 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 11807 #define PFX uh 11808 11809 #include "op_addsub.h" 11810 11811 static inline uint8_t do_usad(uint8_t a, uint8_t b) 11812 { 11813 if (a > b) 11814 return a - b; 11815 else 11816 return b - a; 11817 } 11818 11819 /* Unsigned sum of absolute byte differences. */ 11820 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 11821 { 11822 uint32_t sum; 11823 sum = do_usad(a, b); 11824 sum += do_usad(a >> 8, b >> 8); 11825 sum += do_usad(a >> 16, b >>16); 11826 sum += do_usad(a >> 24, b >> 24); 11827 return sum; 11828 } 11829 11830 /* For ARMv6 SEL instruction. */ 11831 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 11832 { 11833 uint32_t mask; 11834 11835 mask = 0; 11836 if (flags & 1) 11837 mask |= 0xff; 11838 if (flags & 2) 11839 mask |= 0xff00; 11840 if (flags & 4) 11841 mask |= 0xff0000; 11842 if (flags & 8) 11843 mask |= 0xff000000; 11844 return (a & mask) | (b & ~mask); 11845 } 11846 11847 /* CRC helpers. 11848 * The upper bytes of val (above the number specified by 'bytes') must have 11849 * been zeroed out by the caller. 11850 */ 11851 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 11852 { 11853 uint8_t buf[4]; 11854 11855 stl_le_p(buf, val); 11856 11857 /* zlib crc32 converts the accumulator and output to one's complement. */ 11858 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 11859 } 11860 11861 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 11862 { 11863 uint8_t buf[4]; 11864 11865 stl_le_p(buf, val); 11866 11867 /* Linux crc32c converts the output to one's complement. */ 11868 return crc32c(acc, buf, bytes) ^ 0xffffffff; 11869 } 11870 11871 /* Return the exception level to which FP-disabled exceptions should 11872 * be taken, or 0 if FP is enabled. 11873 */ 11874 int fp_exception_el(CPUARMState *env, int cur_el) 11875 { 11876 #ifndef CONFIG_USER_ONLY 11877 /* CPACR and the CPTR registers don't exist before v6, so FP is 11878 * always accessible 11879 */ 11880 if (!arm_feature(env, ARM_FEATURE_V6)) { 11881 return 0; 11882 } 11883 11884 if (arm_feature(env, ARM_FEATURE_M)) { 11885 /* CPACR can cause a NOCP UsageFault taken to current security state */ 11886 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) { 11887 return 1; 11888 } 11889 11890 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) { 11891 if (!extract32(env->v7m.nsacr, 10, 1)) { 11892 /* FP insns cause a NOCP UsageFault taken to Secure */ 11893 return 3; 11894 } 11895 } 11896 11897 return 0; 11898 } 11899 11900 /* The CPACR controls traps to EL1, or PL1 if we're 32 bit: 11901 * 0, 2 : trap EL0 and EL1/PL1 accesses 11902 * 1 : trap only EL0 accesses 11903 * 3 : trap no accesses 11904 * This register is ignored if E2H+TGE are both set. 11905 */ 11906 if ((arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 11907 int fpen = extract32(env->cp15.cpacr_el1, 20, 2); 11908 11909 switch (fpen) { 11910 case 0: 11911 case 2: 11912 if (cur_el == 0 || cur_el == 1) { 11913 /* Trap to PL1, which might be EL1 or EL3 */ 11914 if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) { 11915 return 3; 11916 } 11917 return 1; 11918 } 11919 if (cur_el == 3 && !is_a64(env)) { 11920 /* Secure PL1 running at EL3 */ 11921 return 3; 11922 } 11923 break; 11924 case 1: 11925 if (cur_el == 0) { 11926 return 1; 11927 } 11928 break; 11929 case 3: 11930 break; 11931 } 11932 } 11933 11934 /* 11935 * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode 11936 * to control non-secure access to the FPU. It doesn't have any 11937 * effect if EL3 is AArch64 or if EL3 doesn't exist at all. 11938 */ 11939 if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 11940 cur_el <= 2 && !arm_is_secure_below_el3(env))) { 11941 if (!extract32(env->cp15.nsacr, 10, 1)) { 11942 /* FP insns act as UNDEF */ 11943 return cur_el == 2 ? 2 : 1; 11944 } 11945 } 11946 11947 /* For the CPTR registers we don't need to guard with an ARM_FEATURE 11948 * check because zero bits in the registers mean "don't trap". 11949 */ 11950 11951 /* CPTR_EL2 : present in v7VE or v8 */ 11952 if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1) 11953 && !arm_is_secure_below_el3(env)) { 11954 /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */ 11955 return 2; 11956 } 11957 11958 /* CPTR_EL3 : present in v8 */ 11959 if (extract32(env->cp15.cptr_el[3], 10, 1)) { 11960 /* Trap all FP ops to EL3 */ 11961 return 3; 11962 } 11963 #endif 11964 return 0; 11965 } 11966 11967 /* Return the exception level we're running at if this is our mmu_idx */ 11968 int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx) 11969 { 11970 if (mmu_idx & ARM_MMU_IDX_M) { 11971 return mmu_idx & ARM_MMU_IDX_M_PRIV; 11972 } 11973 11974 switch (mmu_idx) { 11975 case ARMMMUIdx_E10_0: 11976 case ARMMMUIdx_E20_0: 11977 case ARMMMUIdx_SE10_0: 11978 return 0; 11979 case ARMMMUIdx_E10_1: 11980 case ARMMMUIdx_E10_1_PAN: 11981 case ARMMMUIdx_SE10_1: 11982 case ARMMMUIdx_SE10_1_PAN: 11983 return 1; 11984 case ARMMMUIdx_E2: 11985 case ARMMMUIdx_E20_2: 11986 case ARMMMUIdx_E20_2_PAN: 11987 return 2; 11988 case ARMMMUIdx_SE3: 11989 return 3; 11990 default: 11991 g_assert_not_reached(); 11992 } 11993 } 11994 11995 #ifndef CONFIG_TCG 11996 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 11997 { 11998 g_assert_not_reached(); 11999 } 12000 #endif 12001 12002 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el) 12003 { 12004 if (arm_feature(env, ARM_FEATURE_M)) { 12005 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 12006 } 12007 12008 /* See ARM pseudo-function ELIsInHost. */ 12009 switch (el) { 12010 case 0: 12011 if (arm_is_secure_below_el3(env)) { 12012 return ARMMMUIdx_SE10_0; 12013 } 12014 if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE) 12015 && arm_el_is_aa64(env, 2)) { 12016 return ARMMMUIdx_E20_0; 12017 } 12018 return ARMMMUIdx_E10_0; 12019 case 1: 12020 if (arm_is_secure_below_el3(env)) { 12021 if (env->pstate & PSTATE_PAN) { 12022 return ARMMMUIdx_SE10_1_PAN; 12023 } 12024 return ARMMMUIdx_SE10_1; 12025 } 12026 if (env->pstate & PSTATE_PAN) { 12027 return ARMMMUIdx_E10_1_PAN; 12028 } 12029 return ARMMMUIdx_E10_1; 12030 case 2: 12031 /* TODO: ARMv8.4-SecEL2 */ 12032 /* Note that TGE does not apply at EL2. */ 12033 if ((env->cp15.hcr_el2 & HCR_E2H) && arm_el_is_aa64(env, 2)) { 12034 if (env->pstate & PSTATE_PAN) { 12035 return ARMMMUIdx_E20_2_PAN; 12036 } 12037 return ARMMMUIdx_E20_2; 12038 } 12039 return ARMMMUIdx_E2; 12040 case 3: 12041 return ARMMMUIdx_SE3; 12042 default: 12043 g_assert_not_reached(); 12044 } 12045 } 12046 12047 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 12048 { 12049 return arm_mmu_idx_el(env, arm_current_el(env)); 12050 } 12051 12052 int cpu_mmu_index(CPUARMState *env, bool ifetch) 12053 { 12054 return arm_to_core_mmu_idx(arm_mmu_idx(env)); 12055 } 12056 12057 #ifndef CONFIG_USER_ONLY 12058 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) 12059 { 12060 return stage_1_mmu_idx(arm_mmu_idx(env)); 12061 } 12062 #endif 12063 12064 static uint32_t rebuild_hflags_common(CPUARMState *env, int fp_el, 12065 ARMMMUIdx mmu_idx, uint32_t flags) 12066 { 12067 flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el); 12068 flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, 12069 arm_to_core_mmu_idx(mmu_idx)); 12070 12071 if (arm_singlestep_active(env)) { 12072 flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1); 12073 } 12074 return flags; 12075 } 12076 12077 static uint32_t rebuild_hflags_common_32(CPUARMState *env, int fp_el, 12078 ARMMMUIdx mmu_idx, uint32_t flags) 12079 { 12080 bool sctlr_b = arm_sctlr_b(env); 12081 12082 if (sctlr_b) { 12083 flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, 1); 12084 } 12085 if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) { 12086 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 12087 } 12088 flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env)); 12089 12090 return rebuild_hflags_common(env, fp_el, mmu_idx, flags); 12091 } 12092 12093 static uint32_t rebuild_hflags_m32(CPUARMState *env, int fp_el, 12094 ARMMMUIdx mmu_idx) 12095 { 12096 uint32_t flags = 0; 12097 12098 if (arm_v7m_is_handler_mode(env)) { 12099 flags = FIELD_DP32(flags, TBFLAG_M32, HANDLER, 1); 12100 } 12101 12102 /* 12103 * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN 12104 * is suppressing them because the requested execution priority 12105 * is less than 0. 12106 */ 12107 if (arm_feature(env, ARM_FEATURE_V8) && 12108 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) && 12109 (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) { 12110 flags = FIELD_DP32(flags, TBFLAG_M32, STACKCHECK, 1); 12111 } 12112 12113 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags); 12114 } 12115 12116 static uint32_t rebuild_hflags_aprofile(CPUARMState *env) 12117 { 12118 int flags = 0; 12119 12120 flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL, 12121 arm_debug_target_el(env)); 12122 return flags; 12123 } 12124 12125 static uint32_t rebuild_hflags_a32(CPUARMState *env, int fp_el, 12126 ARMMMUIdx mmu_idx) 12127 { 12128 uint32_t flags = rebuild_hflags_aprofile(env); 12129 12130 if (arm_el_is_aa64(env, 1)) { 12131 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 12132 } 12133 12134 if (arm_current_el(env) < 2 && env->cp15.hstr_el2 && 12135 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 12136 flags = FIELD_DP32(flags, TBFLAG_A32, HSTR_ACTIVE, 1); 12137 } 12138 12139 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags); 12140 } 12141 12142 static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el, 12143 ARMMMUIdx mmu_idx) 12144 { 12145 uint32_t flags = rebuild_hflags_aprofile(env); 12146 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx); 12147 uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr; 12148 uint64_t sctlr; 12149 int tbii, tbid; 12150 12151 flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1); 12152 12153 /* Get control bits for tagged addresses. */ 12154 tbid = aa64_va_parameter_tbi(tcr, mmu_idx); 12155 tbii = tbid & ~aa64_va_parameter_tbid(tcr, mmu_idx); 12156 12157 flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii); 12158 flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid); 12159 12160 if (cpu_isar_feature(aa64_sve, env_archcpu(env))) { 12161 int sve_el = sve_exception_el(env, el); 12162 uint32_t zcr_len; 12163 12164 /* 12165 * If SVE is disabled, but FP is enabled, 12166 * then the effective len is 0. 12167 */ 12168 if (sve_el != 0 && fp_el == 0) { 12169 zcr_len = 0; 12170 } else { 12171 zcr_len = sve_zcr_len_for_el(env, el); 12172 } 12173 flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el); 12174 flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len); 12175 } 12176 12177 sctlr = regime_sctlr(env, stage1); 12178 12179 if (arm_cpu_data_is_big_endian_a64(el, sctlr)) { 12180 flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1); 12181 } 12182 12183 if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) { 12184 /* 12185 * In order to save space in flags, we record only whether 12186 * pauth is "inactive", meaning all insns are implemented as 12187 * a nop, or "active" when some action must be performed. 12188 * The decision of which action to take is left to a helper. 12189 */ 12190 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) { 12191 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1); 12192 } 12193 } 12194 12195 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) { 12196 /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */ 12197 if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) { 12198 flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1); 12199 } 12200 } 12201 12202 /* Compute the condition for using AccType_UNPRIV for LDTR et al. */ 12203 if (!(env->pstate & PSTATE_UAO)) { 12204 switch (mmu_idx) { 12205 case ARMMMUIdx_E10_1: 12206 case ARMMMUIdx_E10_1_PAN: 12207 case ARMMMUIdx_SE10_1: 12208 case ARMMMUIdx_SE10_1_PAN: 12209 /* TODO: ARMv8.3-NV */ 12210 flags = FIELD_DP32(flags, TBFLAG_A64, UNPRIV, 1); 12211 break; 12212 case ARMMMUIdx_E20_2: 12213 case ARMMMUIdx_E20_2_PAN: 12214 /* TODO: ARMv8.4-SecEL2 */ 12215 /* 12216 * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is 12217 * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR. 12218 */ 12219 if (env->cp15.hcr_el2 & HCR_TGE) { 12220 flags = FIELD_DP32(flags, TBFLAG_A64, UNPRIV, 1); 12221 } 12222 break; 12223 default: 12224 break; 12225 } 12226 } 12227 12228 return rebuild_hflags_common(env, fp_el, mmu_idx, flags); 12229 } 12230 12231 static uint32_t rebuild_hflags_internal(CPUARMState *env) 12232 { 12233 int el = arm_current_el(env); 12234 int fp_el = fp_exception_el(env, el); 12235 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12236 12237 if (is_a64(env)) { 12238 return rebuild_hflags_a64(env, el, fp_el, mmu_idx); 12239 } else if (arm_feature(env, ARM_FEATURE_M)) { 12240 return rebuild_hflags_m32(env, fp_el, mmu_idx); 12241 } else { 12242 return rebuild_hflags_a32(env, fp_el, mmu_idx); 12243 } 12244 } 12245 12246 void arm_rebuild_hflags(CPUARMState *env) 12247 { 12248 env->hflags = rebuild_hflags_internal(env); 12249 } 12250 12251 void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el) 12252 { 12253 int fp_el = fp_exception_el(env, el); 12254 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12255 12256 env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx); 12257 } 12258 12259 /* 12260 * If we have triggered a EL state change we can't rely on the 12261 * translator having passed it too us, we need to recompute. 12262 */ 12263 void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env) 12264 { 12265 int el = arm_current_el(env); 12266 int fp_el = fp_exception_el(env, el); 12267 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12268 env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx); 12269 } 12270 12271 void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el) 12272 { 12273 int fp_el = fp_exception_el(env, el); 12274 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12275 12276 env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx); 12277 } 12278 12279 void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el) 12280 { 12281 int fp_el = fp_exception_el(env, el); 12282 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 12283 12284 env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx); 12285 } 12286 12287 static inline void assert_hflags_rebuild_correctly(CPUARMState *env) 12288 { 12289 #ifdef CONFIG_DEBUG_TCG 12290 uint32_t env_flags_current = env->hflags; 12291 uint32_t env_flags_rebuilt = rebuild_hflags_internal(env); 12292 12293 if (unlikely(env_flags_current != env_flags_rebuilt)) { 12294 fprintf(stderr, "TCG hflags mismatch (current:0x%08x rebuilt:0x%08x)\n", 12295 env_flags_current, env_flags_rebuilt); 12296 abort(); 12297 } 12298 #endif 12299 } 12300 12301 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 12302 target_ulong *cs_base, uint32_t *pflags) 12303 { 12304 uint32_t flags = env->hflags; 12305 uint32_t pstate_for_ss; 12306 12307 *cs_base = 0; 12308 assert_hflags_rebuild_correctly(env); 12309 12310 if (FIELD_EX32(flags, TBFLAG_ANY, AARCH64_STATE)) { 12311 *pc = env->pc; 12312 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) { 12313 flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype); 12314 } 12315 pstate_for_ss = env->pstate; 12316 } else { 12317 *pc = env->regs[15]; 12318 12319 if (arm_feature(env, ARM_FEATURE_M)) { 12320 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 12321 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) 12322 != env->v7m.secure) { 12323 flags = FIELD_DP32(flags, TBFLAG_M32, FPCCR_S_WRONG, 1); 12324 } 12325 12326 if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) && 12327 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) || 12328 (env->v7m.secure && 12329 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) { 12330 /* 12331 * ASPEN is set, but FPCA/SFPA indicate that there is no 12332 * active FP context; we must create a new FP context before 12333 * executing any FP insn. 12334 */ 12335 flags = FIELD_DP32(flags, TBFLAG_M32, NEW_FP_CTXT_NEEDED, 1); 12336 } 12337 12338 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 12339 if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) { 12340 flags = FIELD_DP32(flags, TBFLAG_M32, LSPACT, 1); 12341 } 12342 } else { 12343 /* 12344 * Note that XSCALE_CPAR shares bits with VECSTRIDE. 12345 * Note that VECLEN+VECSTRIDE are RES0 for M-profile. 12346 */ 12347 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 12348 flags = FIELD_DP32(flags, TBFLAG_A32, 12349 XSCALE_CPAR, env->cp15.c15_cpar); 12350 } else { 12351 flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, 12352 env->vfp.vec_len); 12353 flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, 12354 env->vfp.vec_stride); 12355 } 12356 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) { 12357 flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1); 12358 } 12359 } 12360 12361 flags = FIELD_DP32(flags, TBFLAG_AM32, THUMB, env->thumb); 12362 flags = FIELD_DP32(flags, TBFLAG_AM32, CONDEXEC, env->condexec_bits); 12363 pstate_for_ss = env->uncached_cpsr; 12364 } 12365 12366 /* 12367 * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 12368 * states defined in the ARM ARM for software singlestep: 12369 * SS_ACTIVE PSTATE.SS State 12370 * 0 x Inactive (the TB flag for SS is always 0) 12371 * 1 0 Active-pending 12372 * 1 1 Active-not-pending 12373 * SS_ACTIVE is set in hflags; PSTATE_SS is computed every TB. 12374 */ 12375 if (FIELD_EX32(flags, TBFLAG_ANY, SS_ACTIVE) && 12376 (pstate_for_ss & PSTATE_SS)) { 12377 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1); 12378 } 12379 12380 *pflags = flags; 12381 } 12382 12383 #ifdef TARGET_AARCH64 12384 /* 12385 * The manual says that when SVE is enabled and VQ is widened the 12386 * implementation is allowed to zero the previously inaccessible 12387 * portion of the registers. The corollary to that is that when 12388 * SVE is enabled and VQ is narrowed we are also allowed to zero 12389 * the now inaccessible portion of the registers. 12390 * 12391 * The intent of this is that no predicate bit beyond VQ is ever set. 12392 * Which means that some operations on predicate registers themselves 12393 * may operate on full uint64_t or even unrolled across the maximum 12394 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 12395 * may well be cheaper than conditionals to restrict the operation 12396 * to the relevant portion of a uint16_t[16]. 12397 */ 12398 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 12399 { 12400 int i, j; 12401 uint64_t pmask; 12402 12403 assert(vq >= 1 && vq <= ARM_MAX_VQ); 12404 assert(vq <= env_archcpu(env)->sve_max_vq); 12405 12406 /* Zap the high bits of the zregs. */ 12407 for (i = 0; i < 32; i++) { 12408 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 12409 } 12410 12411 /* Zap the high bits of the pregs and ffr. */ 12412 pmask = 0; 12413 if (vq & 3) { 12414 pmask = ~(-1ULL << (16 * (vq & 3))); 12415 } 12416 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 12417 for (i = 0; i < 17; ++i) { 12418 env->vfp.pregs[i].p[j] &= pmask; 12419 } 12420 pmask = 0; 12421 } 12422 } 12423 12424 /* 12425 * Notice a change in SVE vector size when changing EL. 12426 */ 12427 void aarch64_sve_change_el(CPUARMState *env, int old_el, 12428 int new_el, bool el0_a64) 12429 { 12430 ARMCPU *cpu = env_archcpu(env); 12431 int old_len, new_len; 12432 bool old_a64, new_a64; 12433 12434 /* Nothing to do if no SVE. */ 12435 if (!cpu_isar_feature(aa64_sve, cpu)) { 12436 return; 12437 } 12438 12439 /* Nothing to do if FP is disabled in either EL. */ 12440 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 12441 return; 12442 } 12443 12444 /* 12445 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 12446 * at ELx, or not available because the EL is in AArch32 state, then 12447 * for all purposes other than a direct read, the ZCR_ELx.LEN field 12448 * has an effective value of 0". 12449 * 12450 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 12451 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 12452 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 12453 * we already have the correct register contents when encountering the 12454 * vq0->vq0 transition between EL0->EL1. 12455 */ 12456 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 12457 old_len = (old_a64 && !sve_exception_el(env, old_el) 12458 ? sve_zcr_len_for_el(env, old_el) : 0); 12459 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 12460 new_len = (new_a64 && !sve_exception_el(env, new_el) 12461 ? sve_zcr_len_for_el(env, new_el) : 0); 12462 12463 /* When changing vector length, clear inaccessible state. */ 12464 if (new_len < old_len) { 12465 aarch64_sve_narrow_vq(env, new_len + 1); 12466 } 12467 } 12468 #endif 12469