1 /* 2 * ARM generic helpers. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "trace.h" 12 #include "cpu.h" 13 #include "internals.h" 14 #include "exec/helper-proto.h" 15 #include "qemu/main-loop.h" 16 #include "qemu/timer.h" 17 #include "qemu/bitops.h" 18 #include "qemu/crc32c.h" 19 #include "qemu/qemu-print.h" 20 #include "exec/exec-all.h" 21 #include <zlib.h> /* For crc32 */ 22 #include "hw/irq.h" 23 #include "sysemu/cpu-timers.h" 24 #include "sysemu/kvm.h" 25 #include "qapi/qapi-commands-machine-target.h" 26 #include "qapi/error.h" 27 #include "qemu/guest-random.h" 28 #ifdef CONFIG_TCG 29 #include "semihosting/common-semi.h" 30 #endif 31 #include "cpregs.h" 32 33 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 34 35 static void switch_mode(CPUARMState *env, int mode); 36 37 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 38 { 39 assert(ri->fieldoffset); 40 if (cpreg_field_is_64bit(ri)) { 41 return CPREG_FIELD64(env, ri); 42 } else { 43 return CPREG_FIELD32(env, ri); 44 } 45 } 46 47 void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 48 { 49 assert(ri->fieldoffset); 50 if (cpreg_field_is_64bit(ri)) { 51 CPREG_FIELD64(env, ri) = value; 52 } else { 53 CPREG_FIELD32(env, ri) = value; 54 } 55 } 56 57 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 58 { 59 return (char *)env + ri->fieldoffset; 60 } 61 62 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 63 { 64 /* Raw read of a coprocessor register (as needed for migration, etc). */ 65 if (ri->type & ARM_CP_CONST) { 66 return ri->resetvalue; 67 } else if (ri->raw_readfn) { 68 return ri->raw_readfn(env, ri); 69 } else if (ri->readfn) { 70 return ri->readfn(env, ri); 71 } else { 72 return raw_read(env, ri); 73 } 74 } 75 76 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 77 uint64_t v) 78 { 79 /* 80 * Raw write of a coprocessor register (as needed for migration, etc). 81 * Note that constant registers are treated as write-ignored; the 82 * caller should check for success by whether a readback gives the 83 * value written. 84 */ 85 if (ri->type & ARM_CP_CONST) { 86 return; 87 } else if (ri->raw_writefn) { 88 ri->raw_writefn(env, ri, v); 89 } else if (ri->writefn) { 90 ri->writefn(env, ri, v); 91 } else { 92 raw_write(env, ri, v); 93 } 94 } 95 96 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 97 { 98 /* 99 * Return true if the regdef would cause an assertion if you called 100 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 101 * program bug for it not to have the NO_RAW flag). 102 * NB that returning false here doesn't necessarily mean that calling 103 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 104 * read/write access functions which are safe for raw use" from "has 105 * read/write access functions which have side effects but has forgotten 106 * to provide raw access functions". 107 * The tests here line up with the conditions in read/write_raw_cp_reg() 108 * and assertions in raw_read()/raw_write(). 109 */ 110 if ((ri->type & ARM_CP_CONST) || 111 ri->fieldoffset || 112 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 113 return false; 114 } 115 return true; 116 } 117 118 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync) 119 { 120 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 121 int i; 122 bool ok = true; 123 124 for (i = 0; i < cpu->cpreg_array_len; i++) { 125 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 126 const ARMCPRegInfo *ri; 127 uint64_t newval; 128 129 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 130 if (!ri) { 131 ok = false; 132 continue; 133 } 134 if (ri->type & ARM_CP_NO_RAW) { 135 continue; 136 } 137 138 newval = read_raw_cp_reg(&cpu->env, ri); 139 if (kvm_sync) { 140 /* 141 * Only sync if the previous list->cpustate sync succeeded. 142 * Rather than tracking the success/failure state for every 143 * item in the list, we just recheck "does the raw write we must 144 * have made in write_list_to_cpustate() read back OK" here. 145 */ 146 uint64_t oldval = cpu->cpreg_values[i]; 147 148 if (oldval == newval) { 149 continue; 150 } 151 152 write_raw_cp_reg(&cpu->env, ri, oldval); 153 if (read_raw_cp_reg(&cpu->env, ri) != oldval) { 154 continue; 155 } 156 157 write_raw_cp_reg(&cpu->env, ri, newval); 158 } 159 cpu->cpreg_values[i] = newval; 160 } 161 return ok; 162 } 163 164 bool write_list_to_cpustate(ARMCPU *cpu) 165 { 166 int i; 167 bool ok = true; 168 169 for (i = 0; i < cpu->cpreg_array_len; i++) { 170 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 171 uint64_t v = cpu->cpreg_values[i]; 172 const ARMCPRegInfo *ri; 173 174 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 175 if (!ri) { 176 ok = false; 177 continue; 178 } 179 if (ri->type & ARM_CP_NO_RAW) { 180 continue; 181 } 182 /* 183 * Write value and confirm it reads back as written 184 * (to catch read-only registers and partially read-only 185 * registers where the incoming migration value doesn't match) 186 */ 187 write_raw_cp_reg(&cpu->env, ri, v); 188 if (read_raw_cp_reg(&cpu->env, ri) != v) { 189 ok = false; 190 } 191 } 192 return ok; 193 } 194 195 static void add_cpreg_to_list(gpointer key, gpointer opaque) 196 { 197 ARMCPU *cpu = opaque; 198 uint32_t regidx = (uintptr_t)key; 199 const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 200 201 if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) { 202 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 203 /* The value array need not be initialized at this point */ 204 cpu->cpreg_array_len++; 205 } 206 } 207 208 static void count_cpreg(gpointer key, gpointer opaque) 209 { 210 ARMCPU *cpu = opaque; 211 const ARMCPRegInfo *ri; 212 213 ri = g_hash_table_lookup(cpu->cp_regs, key); 214 215 if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) { 216 cpu->cpreg_array_len++; 217 } 218 } 219 220 static gint cpreg_key_compare(gconstpointer a, gconstpointer b) 221 { 222 uint64_t aidx = cpreg_to_kvm_id((uintptr_t)a); 223 uint64_t bidx = cpreg_to_kvm_id((uintptr_t)b); 224 225 if (aidx > bidx) { 226 return 1; 227 } 228 if (aidx < bidx) { 229 return -1; 230 } 231 return 0; 232 } 233 234 void init_cpreg_list(ARMCPU *cpu) 235 { 236 /* 237 * Initialise the cpreg_tuples[] array based on the cp_regs hash. 238 * Note that we require cpreg_tuples[] to be sorted by key ID. 239 */ 240 GList *keys; 241 int arraylen; 242 243 keys = g_hash_table_get_keys(cpu->cp_regs); 244 keys = g_list_sort(keys, cpreg_key_compare); 245 246 cpu->cpreg_array_len = 0; 247 248 g_list_foreach(keys, count_cpreg, cpu); 249 250 arraylen = cpu->cpreg_array_len; 251 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 252 cpu->cpreg_values = g_new(uint64_t, arraylen); 253 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 254 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 255 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 256 cpu->cpreg_array_len = 0; 257 258 g_list_foreach(keys, add_cpreg_to_list, cpu); 259 260 assert(cpu->cpreg_array_len == arraylen); 261 262 g_list_free(keys); 263 } 264 265 /* 266 * Some registers are not accessible from AArch32 EL3 if SCR.NS == 0. 267 */ 268 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 269 const ARMCPRegInfo *ri, 270 bool isread) 271 { 272 if (!is_a64(env) && arm_current_el(env) == 3 && 273 arm_is_secure_below_el3(env)) { 274 return CP_ACCESS_TRAP_UNCATEGORIZED; 275 } 276 return CP_ACCESS_OK; 277 } 278 279 /* 280 * Some secure-only AArch32 registers trap to EL3 if used from 281 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 282 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 283 * We assume that the .access field is set to PL1_RW. 284 */ 285 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 286 const ARMCPRegInfo *ri, 287 bool isread) 288 { 289 if (arm_current_el(env) == 3) { 290 return CP_ACCESS_OK; 291 } 292 if (arm_is_secure_below_el3(env)) { 293 if (env->cp15.scr_el3 & SCR_EEL2) { 294 return CP_ACCESS_TRAP_EL2; 295 } 296 return CP_ACCESS_TRAP_EL3; 297 } 298 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 299 return CP_ACCESS_TRAP_UNCATEGORIZED; 300 } 301 302 /* 303 * Check for traps to performance monitor registers, which are controlled 304 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 305 */ 306 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 307 bool isread) 308 { 309 int el = arm_current_el(env); 310 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 311 312 if (el < 2 && (mdcr_el2 & MDCR_TPM)) { 313 return CP_ACCESS_TRAP_EL2; 314 } 315 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 316 return CP_ACCESS_TRAP_EL3; 317 } 318 return CP_ACCESS_OK; 319 } 320 321 /* Check for traps from EL1 due to HCR_EL2.TVM and HCR_EL2.TRVM. */ 322 static CPAccessResult access_tvm_trvm(CPUARMState *env, const ARMCPRegInfo *ri, 323 bool isread) 324 { 325 if (arm_current_el(env) == 1) { 326 uint64_t trap = isread ? HCR_TRVM : HCR_TVM; 327 if (arm_hcr_el2_eff(env) & trap) { 328 return CP_ACCESS_TRAP_EL2; 329 } 330 } 331 return CP_ACCESS_OK; 332 } 333 334 /* Check for traps from EL1 due to HCR_EL2.TSW. */ 335 static CPAccessResult access_tsw(CPUARMState *env, const ARMCPRegInfo *ri, 336 bool isread) 337 { 338 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TSW)) { 339 return CP_ACCESS_TRAP_EL2; 340 } 341 return CP_ACCESS_OK; 342 } 343 344 /* Check for traps from EL1 due to HCR_EL2.TACR. */ 345 static CPAccessResult access_tacr(CPUARMState *env, const ARMCPRegInfo *ri, 346 bool isread) 347 { 348 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TACR)) { 349 return CP_ACCESS_TRAP_EL2; 350 } 351 return CP_ACCESS_OK; 352 } 353 354 /* Check for traps from EL1 due to HCR_EL2.TTLB. */ 355 static CPAccessResult access_ttlb(CPUARMState *env, const ARMCPRegInfo *ri, 356 bool isread) 357 { 358 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TTLB)) { 359 return CP_ACCESS_TRAP_EL2; 360 } 361 return CP_ACCESS_OK; 362 } 363 364 /* Check for traps from EL1 due to HCR_EL2.TTLB or TTLBIS. */ 365 static CPAccessResult access_ttlbis(CPUARMState *env, const ARMCPRegInfo *ri, 366 bool isread) 367 { 368 if (arm_current_el(env) == 1 && 369 (arm_hcr_el2_eff(env) & (HCR_TTLB | HCR_TTLBIS))) { 370 return CP_ACCESS_TRAP_EL2; 371 } 372 return CP_ACCESS_OK; 373 } 374 375 #ifdef TARGET_AARCH64 376 /* Check for traps from EL1 due to HCR_EL2.TTLB or TTLBOS. */ 377 static CPAccessResult access_ttlbos(CPUARMState *env, const ARMCPRegInfo *ri, 378 bool isread) 379 { 380 if (arm_current_el(env) == 1 && 381 (arm_hcr_el2_eff(env) & (HCR_TTLB | HCR_TTLBOS))) { 382 return CP_ACCESS_TRAP_EL2; 383 } 384 return CP_ACCESS_OK; 385 } 386 #endif 387 388 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 389 { 390 ARMCPU *cpu = env_archcpu(env); 391 392 raw_write(env, ri, value); 393 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 394 } 395 396 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 397 { 398 ARMCPU *cpu = env_archcpu(env); 399 400 if (raw_read(env, ri) != value) { 401 /* 402 * Unlike real hardware the qemu TLB uses virtual addresses, 403 * not modified virtual addresses, so this causes a TLB flush. 404 */ 405 tlb_flush(CPU(cpu)); 406 raw_write(env, ri, value); 407 } 408 } 409 410 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 411 uint64_t value) 412 { 413 ARMCPU *cpu = env_archcpu(env); 414 415 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 416 && !extended_addresses_enabled(env)) { 417 /* 418 * For VMSA (when not using the LPAE long descriptor page table 419 * format) this register includes the ASID, so do a TLB flush. 420 * For PMSA it is purely a process ID and no action is needed. 421 */ 422 tlb_flush(CPU(cpu)); 423 } 424 raw_write(env, ri, value); 425 } 426 427 static int alle1_tlbmask(CPUARMState *env) 428 { 429 /* 430 * Note that the 'ALL' scope must invalidate both stage 1 and 431 * stage 2 translations, whereas most other scopes only invalidate 432 * stage 1 translations. 433 */ 434 return (ARMMMUIdxBit_E10_1 | 435 ARMMMUIdxBit_E10_1_PAN | 436 ARMMMUIdxBit_E10_0 | 437 ARMMMUIdxBit_Stage2 | 438 ARMMMUIdxBit_Stage2_S); 439 } 440 441 442 /* IS variants of TLB operations must affect all cores */ 443 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 444 uint64_t value) 445 { 446 CPUState *cs = env_cpu(env); 447 448 tlb_flush_all_cpus_synced(cs); 449 } 450 451 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 452 uint64_t value) 453 { 454 CPUState *cs = env_cpu(env); 455 456 tlb_flush_all_cpus_synced(cs); 457 } 458 459 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 460 uint64_t value) 461 { 462 CPUState *cs = env_cpu(env); 463 464 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 465 } 466 467 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 468 uint64_t value) 469 { 470 CPUState *cs = env_cpu(env); 471 472 tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK); 473 } 474 475 /* 476 * Non-IS variants of TLB operations are upgraded to 477 * IS versions if we are at EL1 and HCR_EL2.FB is effectively set to 478 * force broadcast of these operations. 479 */ 480 static bool tlb_force_broadcast(CPUARMState *env) 481 { 482 return arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_FB); 483 } 484 485 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri, 486 uint64_t value) 487 { 488 /* Invalidate all (TLBIALL) */ 489 CPUState *cs = env_cpu(env); 490 491 if (tlb_force_broadcast(env)) { 492 tlb_flush_all_cpus_synced(cs); 493 } else { 494 tlb_flush(cs); 495 } 496 } 497 498 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri, 499 uint64_t value) 500 { 501 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */ 502 CPUState *cs = env_cpu(env); 503 504 value &= TARGET_PAGE_MASK; 505 if (tlb_force_broadcast(env)) { 506 tlb_flush_page_all_cpus_synced(cs, value); 507 } else { 508 tlb_flush_page(cs, value); 509 } 510 } 511 512 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri, 513 uint64_t value) 514 { 515 /* Invalidate by ASID (TLBIASID) */ 516 CPUState *cs = env_cpu(env); 517 518 if (tlb_force_broadcast(env)) { 519 tlb_flush_all_cpus_synced(cs); 520 } else { 521 tlb_flush(cs); 522 } 523 } 524 525 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri, 526 uint64_t value) 527 { 528 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */ 529 CPUState *cs = env_cpu(env); 530 531 value &= TARGET_PAGE_MASK; 532 if (tlb_force_broadcast(env)) { 533 tlb_flush_page_all_cpus_synced(cs, value); 534 } else { 535 tlb_flush_page(cs, value); 536 } 537 } 538 539 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri, 540 uint64_t value) 541 { 542 CPUState *cs = env_cpu(env); 543 544 tlb_flush_by_mmuidx(cs, alle1_tlbmask(env)); 545 } 546 547 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 548 uint64_t value) 549 { 550 CPUState *cs = env_cpu(env); 551 552 tlb_flush_by_mmuidx_all_cpus_synced(cs, alle1_tlbmask(env)); 553 } 554 555 556 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 557 uint64_t value) 558 { 559 CPUState *cs = env_cpu(env); 560 561 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2); 562 } 563 564 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 565 uint64_t value) 566 { 567 CPUState *cs = env_cpu(env); 568 569 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E2); 570 } 571 572 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 573 uint64_t value) 574 { 575 CPUState *cs = env_cpu(env); 576 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 577 578 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E2); 579 } 580 581 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri, 582 uint64_t value) 583 { 584 CPUState *cs = env_cpu(env); 585 uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12); 586 587 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, 588 ARMMMUIdxBit_E2); 589 } 590 591 static void tlbiipas2_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 592 uint64_t value) 593 { 594 CPUState *cs = env_cpu(env); 595 uint64_t pageaddr = (value & MAKE_64BIT_MASK(0, 28)) << 12; 596 597 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2); 598 } 599 600 static void tlbiipas2is_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri, 601 uint64_t value) 602 { 603 CPUState *cs = env_cpu(env); 604 uint64_t pageaddr = (value & MAKE_64BIT_MASK(0, 28)) << 12; 605 606 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, ARMMMUIdxBit_Stage2); 607 } 608 609 static const ARMCPRegInfo cp_reginfo[] = { 610 /* 611 * Define the secure and non-secure FCSE identifier CP registers 612 * separately because there is no secure bank in V8 (no _EL3). This allows 613 * the secure register to be properly reset and migrated. There is also no 614 * v8 EL1 version of the register so the non-secure instance stands alone. 615 */ 616 { .name = "FCSEIDR", 617 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 618 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 619 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 620 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 621 { .name = "FCSEIDR_S", 622 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 623 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 624 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 625 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 626 /* 627 * Define the secure and non-secure context identifier CP registers 628 * separately because there is no secure bank in V8 (no _EL3). This allows 629 * the secure register to be properly reset and migrated. In the 630 * non-secure case, the 32-bit register will have reset and migration 631 * disabled during registration as it is handled by the 64-bit instance. 632 */ 633 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 634 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 635 .access = PL1_RW, .accessfn = access_tvm_trvm, 636 .secure = ARM_CP_SECSTATE_NS, 637 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 638 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 639 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 640 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 641 .access = PL1_RW, .accessfn = access_tvm_trvm, 642 .secure = ARM_CP_SECSTATE_S, 643 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 644 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 645 }; 646 647 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 648 /* 649 * NB: Some of these registers exist in v8 but with more precise 650 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 651 */ 652 /* MMU Domain access control / MPU write buffer control */ 653 { .name = "DACR", 654 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 655 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 656 .writefn = dacr_write, .raw_writefn = raw_write, 657 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 658 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 659 /* 660 * ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 661 * For v6 and v5, these mappings are overly broad. 662 */ 663 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 664 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 665 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 666 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 667 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 668 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 669 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 670 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 671 /* Cache maintenance ops; some of this space may be overridden later. */ 672 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 673 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 674 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 675 }; 676 677 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 678 /* 679 * Not all pre-v6 cores implemented this WFI, so this is slightly 680 * over-broad. 681 */ 682 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 683 .access = PL1_W, .type = ARM_CP_WFI }, 684 }; 685 686 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 687 /* 688 * Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 689 * is UNPREDICTABLE; we choose to NOP as most implementations do). 690 */ 691 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 692 .access = PL1_W, .type = ARM_CP_WFI }, 693 /* 694 * L1 cache lockdown. Not architectural in v6 and earlier but in practice 695 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 696 * OMAPCP will override this space. 697 */ 698 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 699 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 700 .resetvalue = 0 }, 701 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 702 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 703 .resetvalue = 0 }, 704 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 705 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 706 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 707 .resetvalue = 0 }, 708 /* 709 * We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 710 * implementing it as RAZ means the "debug architecture version" bits 711 * will read as a reserved value, which should cause Linux to not try 712 * to use the debug hardware. 713 */ 714 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 715 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 716 /* 717 * MMU TLB control. Note that the wildcarding means we cover not just 718 * the unified TLB ops but also the dside/iside/inner-shareable variants. 719 */ 720 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY, 721 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write, 722 .type = ARM_CP_NO_RAW }, 723 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY, 724 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write, 725 .type = ARM_CP_NO_RAW }, 726 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY, 727 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write, 728 .type = ARM_CP_NO_RAW }, 729 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY, 730 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write, 731 .type = ARM_CP_NO_RAW }, 732 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 733 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 734 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 735 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 736 }; 737 738 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 739 uint64_t value) 740 { 741 uint32_t mask = 0; 742 743 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 744 if (!arm_feature(env, ARM_FEATURE_V8)) { 745 /* 746 * ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 747 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 748 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 749 */ 750 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) { 751 /* VFP coprocessor: cp10 & cp11 [23:20] */ 752 mask |= R_CPACR_ASEDIS_MASK | 753 R_CPACR_D32DIS_MASK | 754 R_CPACR_CP11_MASK | 755 R_CPACR_CP10_MASK; 756 757 if (!arm_feature(env, ARM_FEATURE_NEON)) { 758 /* ASEDIS [31] bit is RAO/WI */ 759 value |= R_CPACR_ASEDIS_MASK; 760 } 761 762 /* 763 * VFPv3 and upwards with NEON implement 32 double precision 764 * registers (D0-D31). 765 */ 766 if (!cpu_isar_feature(aa32_simd_r32, env_archcpu(env))) { 767 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 768 value |= R_CPACR_D32DIS_MASK; 769 } 770 } 771 value &= mask; 772 } 773 774 /* 775 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 776 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 777 */ 778 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 779 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 780 mask = R_CPACR_CP11_MASK | R_CPACR_CP10_MASK; 781 value = (value & ~mask) | (env->cp15.cpacr_el1 & mask); 782 } 783 784 env->cp15.cpacr_el1 = value; 785 } 786 787 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri) 788 { 789 /* 790 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 791 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 792 */ 793 uint64_t value = env->cp15.cpacr_el1; 794 795 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 796 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 797 value = ~(R_CPACR_CP11_MASK | R_CPACR_CP10_MASK); 798 } 799 return value; 800 } 801 802 803 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 804 { 805 /* 806 * Call cpacr_write() so that we reset with the correct RAO bits set 807 * for our CPU features. 808 */ 809 cpacr_write(env, ri, 0); 810 } 811 812 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 813 bool isread) 814 { 815 if (arm_feature(env, ARM_FEATURE_V8)) { 816 /* Check if CPACR accesses are to be trapped to EL2 */ 817 if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) && 818 FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TCPAC)) { 819 return CP_ACCESS_TRAP_EL2; 820 /* Check if CPACR accesses are to be trapped to EL3 */ 821 } else if (arm_current_el(env) < 3 && 822 FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) { 823 return CP_ACCESS_TRAP_EL3; 824 } 825 } 826 827 return CP_ACCESS_OK; 828 } 829 830 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 831 bool isread) 832 { 833 /* Check if CPTR accesses are set to trap to EL3 */ 834 if (arm_current_el(env) == 2 && 835 FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) { 836 return CP_ACCESS_TRAP_EL3; 837 } 838 839 return CP_ACCESS_OK; 840 } 841 842 static const ARMCPRegInfo v6_cp_reginfo[] = { 843 /* prefetch by MVA in v6, NOP in v7 */ 844 { .name = "MVA_prefetch", 845 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 846 .access = PL1_W, .type = ARM_CP_NOP }, 847 /* 848 * We need to break the TB after ISB to execute self-modifying code 849 * correctly and also to take any pending interrupts immediately. 850 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 851 */ 852 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 853 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 854 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 855 .access = PL0_W, .type = ARM_CP_NOP }, 856 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 857 .access = PL0_W, .type = ARM_CP_NOP }, 858 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 859 .access = PL1_RW, .accessfn = access_tvm_trvm, 860 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 861 offsetof(CPUARMState, cp15.ifar_ns) }, 862 .resetvalue = 0, }, 863 /* 864 * Watchpoint Fault Address Register : should actually only be present 865 * for 1136, 1176, 11MPCore. 866 */ 867 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 868 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 869 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 870 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 871 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 872 .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read }, 873 }; 874 875 typedef struct pm_event { 876 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 877 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 878 bool (*supported)(CPUARMState *); 879 /* 880 * Retrieve the current count of the underlying event. The programmed 881 * counters hold a difference from the return value from this function 882 */ 883 uint64_t (*get_count)(CPUARMState *); 884 /* 885 * Return how many nanoseconds it will take (at a minimum) for count events 886 * to occur. A negative value indicates the counter will never overflow, or 887 * that the counter has otherwise arranged for the overflow bit to be set 888 * and the PMU interrupt to be raised on overflow. 889 */ 890 int64_t (*ns_per_count)(uint64_t); 891 } pm_event; 892 893 static bool event_always_supported(CPUARMState *env) 894 { 895 return true; 896 } 897 898 static uint64_t swinc_get_count(CPUARMState *env) 899 { 900 /* 901 * SW_INCR events are written directly to the pmevcntr's by writes to 902 * PMSWINC, so there is no underlying count maintained by the PMU itself 903 */ 904 return 0; 905 } 906 907 static int64_t swinc_ns_per(uint64_t ignored) 908 { 909 return -1; 910 } 911 912 /* 913 * Return the underlying cycle count for the PMU cycle counters. If we're in 914 * usermode, simply return 0. 915 */ 916 static uint64_t cycles_get_count(CPUARMState *env) 917 { 918 #ifndef CONFIG_USER_ONLY 919 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 920 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 921 #else 922 return cpu_get_host_ticks(); 923 #endif 924 } 925 926 #ifndef CONFIG_USER_ONLY 927 static int64_t cycles_ns_per(uint64_t cycles) 928 { 929 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 930 } 931 932 static bool instructions_supported(CPUARMState *env) 933 { 934 return icount_enabled() == 1; /* Precise instruction counting */ 935 } 936 937 static uint64_t instructions_get_count(CPUARMState *env) 938 { 939 return (uint64_t)icount_get_raw(); 940 } 941 942 static int64_t instructions_ns_per(uint64_t icount) 943 { 944 return icount_to_ns((int64_t)icount); 945 } 946 #endif 947 948 static bool pmuv3p1_events_supported(CPUARMState *env) 949 { 950 /* For events which are supported in any v8.1 PMU */ 951 return cpu_isar_feature(any_pmuv3p1, env_archcpu(env)); 952 } 953 954 static bool pmuv3p4_events_supported(CPUARMState *env) 955 { 956 /* For events which are supported in any v8.1 PMU */ 957 return cpu_isar_feature(any_pmuv3p4, env_archcpu(env)); 958 } 959 960 static uint64_t zero_event_get_count(CPUARMState *env) 961 { 962 /* For events which on QEMU never fire, so their count is always zero */ 963 return 0; 964 } 965 966 static int64_t zero_event_ns_per(uint64_t cycles) 967 { 968 /* An event which never fires can never overflow */ 969 return -1; 970 } 971 972 static const pm_event pm_events[] = { 973 { .number = 0x000, /* SW_INCR */ 974 .supported = event_always_supported, 975 .get_count = swinc_get_count, 976 .ns_per_count = swinc_ns_per, 977 }, 978 #ifndef CONFIG_USER_ONLY 979 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 980 .supported = instructions_supported, 981 .get_count = instructions_get_count, 982 .ns_per_count = instructions_ns_per, 983 }, 984 { .number = 0x011, /* CPU_CYCLES, Cycle */ 985 .supported = event_always_supported, 986 .get_count = cycles_get_count, 987 .ns_per_count = cycles_ns_per, 988 }, 989 #endif 990 { .number = 0x023, /* STALL_FRONTEND */ 991 .supported = pmuv3p1_events_supported, 992 .get_count = zero_event_get_count, 993 .ns_per_count = zero_event_ns_per, 994 }, 995 { .number = 0x024, /* STALL_BACKEND */ 996 .supported = pmuv3p1_events_supported, 997 .get_count = zero_event_get_count, 998 .ns_per_count = zero_event_ns_per, 999 }, 1000 { .number = 0x03c, /* STALL */ 1001 .supported = pmuv3p4_events_supported, 1002 .get_count = zero_event_get_count, 1003 .ns_per_count = zero_event_ns_per, 1004 }, 1005 }; 1006 1007 /* 1008 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 1009 * events (i.e. the statistical profiling extension), this implementation 1010 * should first be updated to something sparse instead of the current 1011 * supported_event_map[] array. 1012 */ 1013 #define MAX_EVENT_ID 0x3c 1014 #define UNSUPPORTED_EVENT UINT16_MAX 1015 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 1016 1017 /* 1018 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 1019 * of ARM event numbers to indices in our pm_events array. 1020 * 1021 * Note: Events in the 0x40XX range are not currently supported. 1022 */ 1023 void pmu_init(ARMCPU *cpu) 1024 { 1025 unsigned int i; 1026 1027 /* 1028 * Empty supported_event_map and cpu->pmceid[01] before adding supported 1029 * events to them 1030 */ 1031 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 1032 supported_event_map[i] = UNSUPPORTED_EVENT; 1033 } 1034 cpu->pmceid0 = 0; 1035 cpu->pmceid1 = 0; 1036 1037 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 1038 const pm_event *cnt = &pm_events[i]; 1039 assert(cnt->number <= MAX_EVENT_ID); 1040 /* We do not currently support events in the 0x40xx range */ 1041 assert(cnt->number <= 0x3f); 1042 1043 if (cnt->supported(&cpu->env)) { 1044 supported_event_map[cnt->number] = i; 1045 uint64_t event_mask = 1ULL << (cnt->number & 0x1f); 1046 if (cnt->number & 0x20) { 1047 cpu->pmceid1 |= event_mask; 1048 } else { 1049 cpu->pmceid0 |= event_mask; 1050 } 1051 } 1052 } 1053 } 1054 1055 /* 1056 * Check at runtime whether a PMU event is supported for the current machine 1057 */ 1058 static bool event_supported(uint16_t number) 1059 { 1060 if (number > MAX_EVENT_ID) { 1061 return false; 1062 } 1063 return supported_event_map[number] != UNSUPPORTED_EVENT; 1064 } 1065 1066 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 1067 bool isread) 1068 { 1069 /* 1070 * Performance monitor registers user accessibility is controlled 1071 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 1072 * trapping to EL2 or EL3 for other accesses. 1073 */ 1074 int el = arm_current_el(env); 1075 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 1076 1077 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 1078 return CP_ACCESS_TRAP; 1079 } 1080 if (el < 2 && (mdcr_el2 & MDCR_TPM)) { 1081 return CP_ACCESS_TRAP_EL2; 1082 } 1083 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 1084 return CP_ACCESS_TRAP_EL3; 1085 } 1086 1087 return CP_ACCESS_OK; 1088 } 1089 1090 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 1091 const ARMCPRegInfo *ri, 1092 bool isread) 1093 { 1094 /* ER: event counter read trap control */ 1095 if (arm_feature(env, ARM_FEATURE_V8) 1096 && arm_current_el(env) == 0 1097 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 1098 && isread) { 1099 return CP_ACCESS_OK; 1100 } 1101 1102 return pmreg_access(env, ri, isread); 1103 } 1104 1105 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 1106 const ARMCPRegInfo *ri, 1107 bool isread) 1108 { 1109 /* SW: software increment write trap control */ 1110 if (arm_feature(env, ARM_FEATURE_V8) 1111 && arm_current_el(env) == 0 1112 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 1113 && !isread) { 1114 return CP_ACCESS_OK; 1115 } 1116 1117 return pmreg_access(env, ri, isread); 1118 } 1119 1120 static CPAccessResult pmreg_access_selr(CPUARMState *env, 1121 const ARMCPRegInfo *ri, 1122 bool isread) 1123 { 1124 /* ER: event counter read trap control */ 1125 if (arm_feature(env, ARM_FEATURE_V8) 1126 && arm_current_el(env) == 0 1127 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 1128 return CP_ACCESS_OK; 1129 } 1130 1131 return pmreg_access(env, ri, isread); 1132 } 1133 1134 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 1135 const ARMCPRegInfo *ri, 1136 bool isread) 1137 { 1138 /* CR: cycle counter read trap control */ 1139 if (arm_feature(env, ARM_FEATURE_V8) 1140 && arm_current_el(env) == 0 1141 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 1142 && isread) { 1143 return CP_ACCESS_OK; 1144 } 1145 1146 return pmreg_access(env, ri, isread); 1147 } 1148 1149 /* 1150 * Bits in MDCR_EL2 and MDCR_EL3 which pmu_counter_enabled() looks at. 1151 * We use these to decide whether we need to wrap a write to MDCR_EL2 1152 * or MDCR_EL3 in pmu_op_start()/pmu_op_finish() calls. 1153 */ 1154 #define MDCR_EL2_PMU_ENABLE_BITS \ 1155 (MDCR_HPME | MDCR_HPMD | MDCR_HPMN | MDCR_HCCD | MDCR_HLP) 1156 #define MDCR_EL3_PMU_ENABLE_BITS (MDCR_SPME | MDCR_SCCD) 1157 1158 /* 1159 * Returns true if the counter (pass 31 for PMCCNTR) should count events using 1160 * the current EL, security state, and register configuration. 1161 */ 1162 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 1163 { 1164 uint64_t filter; 1165 bool e, p, u, nsk, nsu, nsh, m; 1166 bool enabled, prohibited = false, filtered; 1167 bool secure = arm_is_secure(env); 1168 int el = arm_current_el(env); 1169 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 1170 uint8_t hpmn = mdcr_el2 & MDCR_HPMN; 1171 1172 if (!arm_feature(env, ARM_FEATURE_PMU)) { 1173 return false; 1174 } 1175 1176 if (!arm_feature(env, ARM_FEATURE_EL2) || 1177 (counter < hpmn || counter == 31)) { 1178 e = env->cp15.c9_pmcr & PMCRE; 1179 } else { 1180 e = mdcr_el2 & MDCR_HPME; 1181 } 1182 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1183 1184 /* Is event counting prohibited? */ 1185 if (el == 2 && (counter < hpmn || counter == 31)) { 1186 prohibited = mdcr_el2 & MDCR_HPMD; 1187 } 1188 if (secure) { 1189 prohibited = prohibited || !(env->cp15.mdcr_el3 & MDCR_SPME); 1190 } 1191 1192 if (counter == 31) { 1193 /* 1194 * The cycle counter defaults to running. PMCR.DP says "disable 1195 * the cycle counter when event counting is prohibited". 1196 * Some MDCR bits disable the cycle counter specifically. 1197 */ 1198 prohibited = prohibited && env->cp15.c9_pmcr & PMCRDP; 1199 if (cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1200 if (secure) { 1201 prohibited = prohibited || (env->cp15.mdcr_el3 & MDCR_SCCD); 1202 } 1203 if (el == 2) { 1204 prohibited = prohibited || (mdcr_el2 & MDCR_HCCD); 1205 } 1206 } 1207 } 1208 1209 if (counter == 31) { 1210 filter = env->cp15.pmccfiltr_el0; 1211 } else { 1212 filter = env->cp15.c14_pmevtyper[counter]; 1213 } 1214 1215 p = filter & PMXEVTYPER_P; 1216 u = filter & PMXEVTYPER_U; 1217 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1218 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1219 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1220 m = arm_el_is_aa64(env, 1) && 1221 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1222 1223 if (el == 0) { 1224 filtered = secure ? u : u != nsu; 1225 } else if (el == 1) { 1226 filtered = secure ? p : p != nsk; 1227 } else if (el == 2) { 1228 filtered = !nsh; 1229 } else { /* EL3 */ 1230 filtered = m != p; 1231 } 1232 1233 if (counter != 31) { 1234 /* 1235 * If not checking PMCCNTR, ensure the counter is setup to an event we 1236 * support 1237 */ 1238 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1239 if (!event_supported(event)) { 1240 return false; 1241 } 1242 } 1243 1244 return enabled && !prohibited && !filtered; 1245 } 1246 1247 static void pmu_update_irq(CPUARMState *env) 1248 { 1249 ARMCPU *cpu = env_archcpu(env); 1250 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1251 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1252 } 1253 1254 static bool pmccntr_clockdiv_enabled(CPUARMState *env) 1255 { 1256 /* 1257 * Return true if the clock divider is enabled and the cycle counter 1258 * is supposed to tick only once every 64 clock cycles. This is 1259 * controlled by PMCR.D, but if PMCR.LC is set to enable the long 1260 * (64-bit) cycle counter PMCR.D has no effect. 1261 */ 1262 return (env->cp15.c9_pmcr & (PMCRD | PMCRLC)) == PMCRD; 1263 } 1264 1265 static bool pmevcntr_is_64_bit(CPUARMState *env, int counter) 1266 { 1267 /* Return true if the specified event counter is configured to be 64 bit */ 1268 1269 /* This isn't intended to be used with the cycle counter */ 1270 assert(counter < 31); 1271 1272 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1273 return false; 1274 } 1275 1276 if (arm_feature(env, ARM_FEATURE_EL2)) { 1277 /* 1278 * MDCR_EL2.HLP still applies even when EL2 is disabled in the 1279 * current security state, so we don't use arm_mdcr_el2_eff() here. 1280 */ 1281 bool hlp = env->cp15.mdcr_el2 & MDCR_HLP; 1282 int hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1283 1284 if (hpmn != 0 && counter >= hpmn) { 1285 return hlp; 1286 } 1287 } 1288 return env->cp15.c9_pmcr & PMCRLP; 1289 } 1290 1291 /* 1292 * Ensure c15_ccnt is the guest-visible count so that operations such as 1293 * enabling/disabling the counter or filtering, modifying the count itself, 1294 * etc. can be done logically. This is essentially a no-op if the counter is 1295 * not enabled at the time of the call. 1296 */ 1297 static void pmccntr_op_start(CPUARMState *env) 1298 { 1299 uint64_t cycles = cycles_get_count(env); 1300 1301 if (pmu_counter_enabled(env, 31)) { 1302 uint64_t eff_cycles = cycles; 1303 if (pmccntr_clockdiv_enabled(env)) { 1304 eff_cycles /= 64; 1305 } 1306 1307 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1308 1309 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1310 1ull << 63 : 1ull << 31; 1311 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1312 env->cp15.c9_pmovsr |= (1ULL << 31); 1313 pmu_update_irq(env); 1314 } 1315 1316 env->cp15.c15_ccnt = new_pmccntr; 1317 } 1318 env->cp15.c15_ccnt_delta = cycles; 1319 } 1320 1321 /* 1322 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1323 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1324 * pmccntr_op_start. 1325 */ 1326 static void pmccntr_op_finish(CPUARMState *env) 1327 { 1328 if (pmu_counter_enabled(env, 31)) { 1329 #ifndef CONFIG_USER_ONLY 1330 /* Calculate when the counter will next overflow */ 1331 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1332 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1333 remaining_cycles = (uint32_t)remaining_cycles; 1334 } 1335 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1336 1337 if (overflow_in > 0) { 1338 int64_t overflow_at; 1339 1340 if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1341 overflow_in, &overflow_at)) { 1342 ARMCPU *cpu = env_archcpu(env); 1343 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1344 } 1345 } 1346 #endif 1347 1348 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1349 if (pmccntr_clockdiv_enabled(env)) { 1350 prev_cycles /= 64; 1351 } 1352 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1353 } 1354 } 1355 1356 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1357 { 1358 1359 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1360 uint64_t count = 0; 1361 if (event_supported(event)) { 1362 uint16_t event_idx = supported_event_map[event]; 1363 count = pm_events[event_idx].get_count(env); 1364 } 1365 1366 if (pmu_counter_enabled(env, counter)) { 1367 uint64_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1368 uint64_t overflow_mask = pmevcntr_is_64_bit(env, counter) ? 1369 1ULL << 63 : 1ULL << 31; 1370 1371 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & overflow_mask) { 1372 env->cp15.c9_pmovsr |= (1 << counter); 1373 pmu_update_irq(env); 1374 } 1375 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1376 } 1377 env->cp15.c14_pmevcntr_delta[counter] = count; 1378 } 1379 1380 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1381 { 1382 if (pmu_counter_enabled(env, counter)) { 1383 #ifndef CONFIG_USER_ONLY 1384 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1385 uint16_t event_idx = supported_event_map[event]; 1386 uint64_t delta = -(env->cp15.c14_pmevcntr[counter] + 1); 1387 int64_t overflow_in; 1388 1389 if (!pmevcntr_is_64_bit(env, counter)) { 1390 delta = (uint32_t)delta; 1391 } 1392 overflow_in = pm_events[event_idx].ns_per_count(delta); 1393 1394 if (overflow_in > 0) { 1395 int64_t overflow_at; 1396 1397 if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1398 overflow_in, &overflow_at)) { 1399 ARMCPU *cpu = env_archcpu(env); 1400 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1401 } 1402 } 1403 #endif 1404 1405 env->cp15.c14_pmevcntr_delta[counter] -= 1406 env->cp15.c14_pmevcntr[counter]; 1407 } 1408 } 1409 1410 void pmu_op_start(CPUARMState *env) 1411 { 1412 unsigned int i; 1413 pmccntr_op_start(env); 1414 for (i = 0; i < pmu_num_counters(env); i++) { 1415 pmevcntr_op_start(env, i); 1416 } 1417 } 1418 1419 void pmu_op_finish(CPUARMState *env) 1420 { 1421 unsigned int i; 1422 pmccntr_op_finish(env); 1423 for (i = 0; i < pmu_num_counters(env); i++) { 1424 pmevcntr_op_finish(env, i); 1425 } 1426 } 1427 1428 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1429 { 1430 pmu_op_start(&cpu->env); 1431 } 1432 1433 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1434 { 1435 pmu_op_finish(&cpu->env); 1436 } 1437 1438 void arm_pmu_timer_cb(void *opaque) 1439 { 1440 ARMCPU *cpu = opaque; 1441 1442 /* 1443 * Update all the counter values based on the current underlying counts, 1444 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1445 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1446 * counter may expire. 1447 */ 1448 pmu_op_start(&cpu->env); 1449 pmu_op_finish(&cpu->env); 1450 } 1451 1452 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1453 uint64_t value) 1454 { 1455 pmu_op_start(env); 1456 1457 if (value & PMCRC) { 1458 /* The counter has been reset */ 1459 env->cp15.c15_ccnt = 0; 1460 } 1461 1462 if (value & PMCRP) { 1463 unsigned int i; 1464 for (i = 0; i < pmu_num_counters(env); i++) { 1465 env->cp15.c14_pmevcntr[i] = 0; 1466 } 1467 } 1468 1469 env->cp15.c9_pmcr &= ~PMCR_WRITABLE_MASK; 1470 env->cp15.c9_pmcr |= (value & PMCR_WRITABLE_MASK); 1471 1472 pmu_op_finish(env); 1473 } 1474 1475 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1476 uint64_t value) 1477 { 1478 unsigned int i; 1479 uint64_t overflow_mask, new_pmswinc; 1480 1481 for (i = 0; i < pmu_num_counters(env); i++) { 1482 /* Increment a counter's count iff: */ 1483 if ((value & (1 << i)) && /* counter's bit is set */ 1484 /* counter is enabled and not filtered */ 1485 pmu_counter_enabled(env, i) && 1486 /* counter is SW_INCR */ 1487 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1488 pmevcntr_op_start(env, i); 1489 1490 /* 1491 * Detect if this write causes an overflow since we can't predict 1492 * PMSWINC overflows like we can for other events 1493 */ 1494 new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1495 1496 overflow_mask = pmevcntr_is_64_bit(env, i) ? 1497 1ULL << 63 : 1ULL << 31; 1498 1499 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & overflow_mask) { 1500 env->cp15.c9_pmovsr |= (1 << i); 1501 pmu_update_irq(env); 1502 } 1503 1504 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1505 1506 pmevcntr_op_finish(env, i); 1507 } 1508 } 1509 } 1510 1511 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1512 { 1513 uint64_t ret; 1514 pmccntr_op_start(env); 1515 ret = env->cp15.c15_ccnt; 1516 pmccntr_op_finish(env); 1517 return ret; 1518 } 1519 1520 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1521 uint64_t value) 1522 { 1523 /* 1524 * The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1525 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1526 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1527 * accessed. 1528 */ 1529 env->cp15.c9_pmselr = value & 0x1f; 1530 } 1531 1532 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1533 uint64_t value) 1534 { 1535 pmccntr_op_start(env); 1536 env->cp15.c15_ccnt = value; 1537 pmccntr_op_finish(env); 1538 } 1539 1540 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1541 uint64_t value) 1542 { 1543 uint64_t cur_val = pmccntr_read(env, NULL); 1544 1545 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1546 } 1547 1548 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1549 uint64_t value) 1550 { 1551 pmccntr_op_start(env); 1552 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1553 pmccntr_op_finish(env); 1554 } 1555 1556 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1557 uint64_t value) 1558 { 1559 pmccntr_op_start(env); 1560 /* M is not accessible from AArch32 */ 1561 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1562 (value & PMCCFILTR); 1563 pmccntr_op_finish(env); 1564 } 1565 1566 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1567 { 1568 /* M is not visible in AArch32 */ 1569 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1570 } 1571 1572 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1573 uint64_t value) 1574 { 1575 pmu_op_start(env); 1576 value &= pmu_counter_mask(env); 1577 env->cp15.c9_pmcnten |= value; 1578 pmu_op_finish(env); 1579 } 1580 1581 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1582 uint64_t value) 1583 { 1584 pmu_op_start(env); 1585 value &= pmu_counter_mask(env); 1586 env->cp15.c9_pmcnten &= ~value; 1587 pmu_op_finish(env); 1588 } 1589 1590 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1591 uint64_t value) 1592 { 1593 value &= pmu_counter_mask(env); 1594 env->cp15.c9_pmovsr &= ~value; 1595 pmu_update_irq(env); 1596 } 1597 1598 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1599 uint64_t value) 1600 { 1601 value &= pmu_counter_mask(env); 1602 env->cp15.c9_pmovsr |= value; 1603 pmu_update_irq(env); 1604 } 1605 1606 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1607 uint64_t value, const uint8_t counter) 1608 { 1609 if (counter == 31) { 1610 pmccfiltr_write(env, ri, value); 1611 } else if (counter < pmu_num_counters(env)) { 1612 pmevcntr_op_start(env, counter); 1613 1614 /* 1615 * If this counter's event type is changing, store the current 1616 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1617 * pmevcntr_op_finish has the correct baseline when it converts back to 1618 * a delta. 1619 */ 1620 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1621 PMXEVTYPER_EVTCOUNT; 1622 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1623 if (old_event != new_event) { 1624 uint64_t count = 0; 1625 if (event_supported(new_event)) { 1626 uint16_t event_idx = supported_event_map[new_event]; 1627 count = pm_events[event_idx].get_count(env); 1628 } 1629 env->cp15.c14_pmevcntr_delta[counter] = count; 1630 } 1631 1632 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1633 pmevcntr_op_finish(env, counter); 1634 } 1635 /* 1636 * Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1637 * PMSELR value is equal to or greater than the number of implemented 1638 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1639 */ 1640 } 1641 1642 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1643 const uint8_t counter) 1644 { 1645 if (counter == 31) { 1646 return env->cp15.pmccfiltr_el0; 1647 } else if (counter < pmu_num_counters(env)) { 1648 return env->cp15.c14_pmevtyper[counter]; 1649 } else { 1650 /* 1651 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1652 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1653 */ 1654 return 0; 1655 } 1656 } 1657 1658 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1659 uint64_t value) 1660 { 1661 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1662 pmevtyper_write(env, ri, value, counter); 1663 } 1664 1665 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1666 uint64_t value) 1667 { 1668 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1669 env->cp15.c14_pmevtyper[counter] = value; 1670 1671 /* 1672 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1673 * pmu_op_finish calls when loading saved state for a migration. Because 1674 * we're potentially updating the type of event here, the value written to 1675 * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a 1676 * different counter type. Therefore, we need to set this value to the 1677 * current count for the counter type we're writing so that pmu_op_finish 1678 * has the correct count for its calculation. 1679 */ 1680 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1681 if (event_supported(event)) { 1682 uint16_t event_idx = supported_event_map[event]; 1683 env->cp15.c14_pmevcntr_delta[counter] = 1684 pm_events[event_idx].get_count(env); 1685 } 1686 } 1687 1688 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1689 { 1690 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1691 return pmevtyper_read(env, ri, counter); 1692 } 1693 1694 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1695 uint64_t value) 1696 { 1697 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1698 } 1699 1700 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1701 { 1702 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1703 } 1704 1705 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1706 uint64_t value, uint8_t counter) 1707 { 1708 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1709 /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */ 1710 value &= MAKE_64BIT_MASK(0, 32); 1711 } 1712 if (counter < pmu_num_counters(env)) { 1713 pmevcntr_op_start(env, counter); 1714 env->cp15.c14_pmevcntr[counter] = value; 1715 pmevcntr_op_finish(env, counter); 1716 } 1717 /* 1718 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1719 * are CONSTRAINED UNPREDICTABLE. 1720 */ 1721 } 1722 1723 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1724 uint8_t counter) 1725 { 1726 if (counter < pmu_num_counters(env)) { 1727 uint64_t ret; 1728 pmevcntr_op_start(env, counter); 1729 ret = env->cp15.c14_pmevcntr[counter]; 1730 pmevcntr_op_finish(env, counter); 1731 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1732 /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */ 1733 ret &= MAKE_64BIT_MASK(0, 32); 1734 } 1735 return ret; 1736 } else { 1737 /* 1738 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1739 * are CONSTRAINED UNPREDICTABLE. 1740 */ 1741 return 0; 1742 } 1743 } 1744 1745 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1746 uint64_t value) 1747 { 1748 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1749 pmevcntr_write(env, ri, value, counter); 1750 } 1751 1752 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1753 { 1754 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1755 return pmevcntr_read(env, ri, counter); 1756 } 1757 1758 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1759 uint64_t value) 1760 { 1761 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1762 assert(counter < pmu_num_counters(env)); 1763 env->cp15.c14_pmevcntr[counter] = value; 1764 pmevcntr_write(env, ri, value, counter); 1765 } 1766 1767 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1768 { 1769 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1770 assert(counter < pmu_num_counters(env)); 1771 return env->cp15.c14_pmevcntr[counter]; 1772 } 1773 1774 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1775 uint64_t value) 1776 { 1777 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1778 } 1779 1780 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1781 { 1782 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1783 } 1784 1785 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1786 uint64_t value) 1787 { 1788 if (arm_feature(env, ARM_FEATURE_V8)) { 1789 env->cp15.c9_pmuserenr = value & 0xf; 1790 } else { 1791 env->cp15.c9_pmuserenr = value & 1; 1792 } 1793 } 1794 1795 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1796 uint64_t value) 1797 { 1798 /* We have no event counters so only the C bit can be changed */ 1799 value &= pmu_counter_mask(env); 1800 env->cp15.c9_pminten |= value; 1801 pmu_update_irq(env); 1802 } 1803 1804 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1805 uint64_t value) 1806 { 1807 value &= pmu_counter_mask(env); 1808 env->cp15.c9_pminten &= ~value; 1809 pmu_update_irq(env); 1810 } 1811 1812 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1813 uint64_t value) 1814 { 1815 /* 1816 * Note that even though the AArch64 view of this register has bits 1817 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1818 * architectural requirements for bits which are RES0 only in some 1819 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1820 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1821 */ 1822 raw_write(env, ri, value & ~0x1FULL); 1823 } 1824 1825 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1826 { 1827 /* Begin with base v8.0 state. */ 1828 uint64_t valid_mask = 0x3fff; 1829 ARMCPU *cpu = env_archcpu(env); 1830 uint64_t changed; 1831 1832 /* 1833 * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always 1834 * passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64. 1835 * Instead, choose the format based on the mode of EL3. 1836 */ 1837 if (arm_el_is_aa64(env, 3)) { 1838 value |= SCR_FW | SCR_AW; /* RES1 */ 1839 valid_mask &= ~SCR_NET; /* RES0 */ 1840 1841 if (!cpu_isar_feature(aa64_aa32_el1, cpu) && 1842 !cpu_isar_feature(aa64_aa32_el2, cpu)) { 1843 value |= SCR_RW; /* RAO/WI */ 1844 } 1845 if (cpu_isar_feature(aa64_ras, cpu)) { 1846 valid_mask |= SCR_TERR; 1847 } 1848 if (cpu_isar_feature(aa64_lor, cpu)) { 1849 valid_mask |= SCR_TLOR; 1850 } 1851 if (cpu_isar_feature(aa64_pauth, cpu)) { 1852 valid_mask |= SCR_API | SCR_APK; 1853 } 1854 if (cpu_isar_feature(aa64_sel2, cpu)) { 1855 valid_mask |= SCR_EEL2; 1856 } 1857 if (cpu_isar_feature(aa64_mte, cpu)) { 1858 valid_mask |= SCR_ATA; 1859 } 1860 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 1861 valid_mask |= SCR_ENSCXT; 1862 } 1863 if (cpu_isar_feature(aa64_doublefault, cpu)) { 1864 valid_mask |= SCR_EASE | SCR_NMEA; 1865 } 1866 if (cpu_isar_feature(aa64_sme, cpu)) { 1867 valid_mask |= SCR_ENTP2; 1868 } 1869 } else { 1870 valid_mask &= ~(SCR_RW | SCR_ST); 1871 if (cpu_isar_feature(aa32_ras, cpu)) { 1872 valid_mask |= SCR_TERR; 1873 } 1874 } 1875 1876 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1877 valid_mask &= ~SCR_HCE; 1878 1879 /* 1880 * On ARMv7, SMD (or SCD as it is called in v7) is only 1881 * supported if EL2 exists. The bit is UNK/SBZP when 1882 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1883 * when EL2 is unavailable. 1884 * On ARMv8, this bit is always available. 1885 */ 1886 if (arm_feature(env, ARM_FEATURE_V7) && 1887 !arm_feature(env, ARM_FEATURE_V8)) { 1888 valid_mask &= ~SCR_SMD; 1889 } 1890 } 1891 1892 /* Clear all-context RES0 bits. */ 1893 value &= valid_mask; 1894 changed = env->cp15.scr_el3 ^ value; 1895 env->cp15.scr_el3 = value; 1896 1897 /* 1898 * If SCR_EL3.NS changes, i.e. arm_is_secure_below_el3, then 1899 * we must invalidate all TLBs below EL3. 1900 */ 1901 if (changed & SCR_NS) { 1902 tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 | 1903 ARMMMUIdxBit_E20_0 | 1904 ARMMMUIdxBit_E10_1 | 1905 ARMMMUIdxBit_E20_2 | 1906 ARMMMUIdxBit_E10_1_PAN | 1907 ARMMMUIdxBit_E20_2_PAN | 1908 ARMMMUIdxBit_E2)); 1909 } 1910 } 1911 1912 static void scr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 1913 { 1914 /* 1915 * scr_write will set the RES1 bits on an AArch64-only CPU. 1916 * The reset value will be 0x30 on an AArch64-only CPU and 0 otherwise. 1917 */ 1918 scr_write(env, ri, 0); 1919 } 1920 1921 static CPAccessResult access_tid4(CPUARMState *env, 1922 const ARMCPRegInfo *ri, 1923 bool isread) 1924 { 1925 if (arm_current_el(env) == 1 && 1926 (arm_hcr_el2_eff(env) & (HCR_TID2 | HCR_TID4))) { 1927 return CP_ACCESS_TRAP_EL2; 1928 } 1929 1930 return CP_ACCESS_OK; 1931 } 1932 1933 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1934 { 1935 ARMCPU *cpu = env_archcpu(env); 1936 1937 /* 1938 * Acquire the CSSELR index from the bank corresponding to the CCSIDR 1939 * bank 1940 */ 1941 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1942 ri->secure & ARM_CP_SECSTATE_S); 1943 1944 return cpu->ccsidr[index]; 1945 } 1946 1947 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1948 uint64_t value) 1949 { 1950 raw_write(env, ri, value & 0xf); 1951 } 1952 1953 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1954 { 1955 CPUState *cs = env_cpu(env); 1956 bool el1 = arm_current_el(env) == 1; 1957 uint64_t hcr_el2 = el1 ? arm_hcr_el2_eff(env) : 0; 1958 uint64_t ret = 0; 1959 1960 if (hcr_el2 & HCR_IMO) { 1961 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1962 ret |= CPSR_I; 1963 } 1964 } else { 1965 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1966 ret |= CPSR_I; 1967 } 1968 } 1969 1970 if (hcr_el2 & HCR_FMO) { 1971 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1972 ret |= CPSR_F; 1973 } 1974 } else { 1975 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1976 ret |= CPSR_F; 1977 } 1978 } 1979 1980 if (hcr_el2 & HCR_AMO) { 1981 if (cs->interrupt_request & CPU_INTERRUPT_VSERR) { 1982 ret |= CPSR_A; 1983 } 1984 } 1985 1986 return ret; 1987 } 1988 1989 static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 1990 bool isread) 1991 { 1992 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) { 1993 return CP_ACCESS_TRAP_EL2; 1994 } 1995 1996 return CP_ACCESS_OK; 1997 } 1998 1999 static CPAccessResult access_aa32_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 2000 bool isread) 2001 { 2002 if (arm_feature(env, ARM_FEATURE_V8)) { 2003 return access_aa64_tid1(env, ri, isread); 2004 } 2005 2006 return CP_ACCESS_OK; 2007 } 2008 2009 static const ARMCPRegInfo v7_cp_reginfo[] = { 2010 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 2011 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 2012 .access = PL1_W, .type = ARM_CP_NOP }, 2013 /* 2014 * Performance monitors are implementation defined in v7, 2015 * but with an ARM recommended set of registers, which we 2016 * follow. 2017 * 2018 * Performance registers fall into three categories: 2019 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 2020 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 2021 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 2022 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 2023 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 2024 */ 2025 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 2026 .access = PL0_RW, .type = ARM_CP_ALIAS | ARM_CP_IO, 2027 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 2028 .writefn = pmcntenset_write, 2029 .accessfn = pmreg_access, 2030 .raw_writefn = raw_write }, 2031 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, .type = ARM_CP_IO, 2032 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 2033 .access = PL0_RW, .accessfn = pmreg_access, 2034 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 2035 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 2036 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 2037 .access = PL0_RW, 2038 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 2039 .accessfn = pmreg_access, 2040 .writefn = pmcntenclr_write, 2041 .type = ARM_CP_ALIAS | ARM_CP_IO }, 2042 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 2043 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 2044 .access = PL0_RW, .accessfn = pmreg_access, 2045 .type = ARM_CP_ALIAS | ARM_CP_IO, 2046 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 2047 .writefn = pmcntenclr_write }, 2048 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 2049 .access = PL0_RW, .type = ARM_CP_IO, 2050 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2051 .accessfn = pmreg_access, 2052 .writefn = pmovsr_write, 2053 .raw_writefn = raw_write }, 2054 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 2055 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 2056 .access = PL0_RW, .accessfn = pmreg_access, 2057 .type = ARM_CP_ALIAS | ARM_CP_IO, 2058 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2059 .writefn = pmovsr_write, 2060 .raw_writefn = raw_write }, 2061 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 2062 .access = PL0_W, .accessfn = pmreg_access_swinc, 2063 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2064 .writefn = pmswinc_write }, 2065 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 2066 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 2067 .access = PL0_W, .accessfn = pmreg_access_swinc, 2068 .type = ARM_CP_NO_RAW | ARM_CP_IO, 2069 .writefn = pmswinc_write }, 2070 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 2071 .access = PL0_RW, .type = ARM_CP_ALIAS, 2072 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 2073 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 2074 .raw_writefn = raw_write}, 2075 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 2076 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 2077 .access = PL0_RW, .accessfn = pmreg_access_selr, 2078 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 2079 .writefn = pmselr_write, .raw_writefn = raw_write, }, 2080 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 2081 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 2082 .readfn = pmccntr_read, .writefn = pmccntr_write32, 2083 .accessfn = pmreg_access_ccntr }, 2084 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 2085 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 2086 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 2087 .type = ARM_CP_IO, 2088 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 2089 .readfn = pmccntr_read, .writefn = pmccntr_write, 2090 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 2091 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 2092 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 2093 .access = PL0_RW, .accessfn = pmreg_access, 2094 .type = ARM_CP_ALIAS | ARM_CP_IO, 2095 .resetvalue = 0, }, 2096 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 2097 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 2098 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 2099 .access = PL0_RW, .accessfn = pmreg_access, 2100 .type = ARM_CP_IO, 2101 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 2102 .resetvalue = 0, }, 2103 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 2104 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2105 .accessfn = pmreg_access, 2106 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2107 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 2108 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 2109 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2110 .accessfn = pmreg_access, 2111 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 2112 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 2113 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2114 .accessfn = pmreg_access_xevcntr, 2115 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2116 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 2117 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 2118 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2119 .accessfn = pmreg_access_xevcntr, 2120 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2121 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2122 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2123 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2124 .resetvalue = 0, 2125 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2126 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2127 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2128 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2129 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2130 .resetvalue = 0, 2131 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2132 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2133 .access = PL1_RW, .accessfn = access_tpm, 2134 .type = ARM_CP_ALIAS | ARM_CP_IO, 2135 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2136 .resetvalue = 0, 2137 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2138 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2139 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2140 .access = PL1_RW, .accessfn = access_tpm, 2141 .type = ARM_CP_IO, 2142 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2143 .writefn = pmintenset_write, .raw_writefn = raw_write, 2144 .resetvalue = 0x0 }, 2145 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2146 .access = PL1_RW, .accessfn = access_tpm, 2147 .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW, 2148 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2149 .writefn = pmintenclr_write, }, 2150 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2151 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2152 .access = PL1_RW, .accessfn = access_tpm, 2153 .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW, 2154 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2155 .writefn = pmintenclr_write }, 2156 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2157 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2158 .access = PL1_R, 2159 .accessfn = access_tid4, 2160 .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2161 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2162 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2163 .access = PL1_RW, 2164 .accessfn = access_tid4, 2165 .writefn = csselr_write, .resetvalue = 0, 2166 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2167 offsetof(CPUARMState, cp15.csselr_ns) } }, 2168 /* 2169 * Auxiliary ID register: this actually has an IMPDEF value but for now 2170 * just RAZ for all cores: 2171 */ 2172 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2173 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2174 .access = PL1_R, .type = ARM_CP_CONST, 2175 .accessfn = access_aa64_tid1, 2176 .resetvalue = 0 }, 2177 /* 2178 * Auxiliary fault status registers: these also are IMPDEF, and we 2179 * choose to RAZ/WI for all cores. 2180 */ 2181 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2182 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2183 .access = PL1_RW, .accessfn = access_tvm_trvm, 2184 .type = ARM_CP_CONST, .resetvalue = 0 }, 2185 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2186 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2187 .access = PL1_RW, .accessfn = access_tvm_trvm, 2188 .type = ARM_CP_CONST, .resetvalue = 0 }, 2189 /* 2190 * MAIR can just read-as-written because we don't implement caches 2191 * and so don't need to care about memory attributes. 2192 */ 2193 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2194 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2195 .access = PL1_RW, .accessfn = access_tvm_trvm, 2196 .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2197 .resetvalue = 0 }, 2198 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2199 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2200 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2201 .resetvalue = 0 }, 2202 /* 2203 * For non-long-descriptor page tables these are PRRR and NMRR; 2204 * regardless they still act as reads-as-written for QEMU. 2205 */ 2206 /* 2207 * MAIR0/1 are defined separately from their 64-bit counterpart which 2208 * allows them to assign the correct fieldoffset based on the endianness 2209 * handled in the field definitions. 2210 */ 2211 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2212 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2213 .access = PL1_RW, .accessfn = access_tvm_trvm, 2214 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2215 offsetof(CPUARMState, cp15.mair0_ns) }, 2216 .resetfn = arm_cp_reset_ignore }, 2217 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2218 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, 2219 .access = PL1_RW, .accessfn = access_tvm_trvm, 2220 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2221 offsetof(CPUARMState, cp15.mair1_ns) }, 2222 .resetfn = arm_cp_reset_ignore }, 2223 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2224 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2225 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2226 /* 32 bit ITLB invalidates */ 2227 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0, 2228 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2229 .writefn = tlbiall_write }, 2230 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 2231 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2232 .writefn = tlbimva_write }, 2233 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2, 2234 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2235 .writefn = tlbiasid_write }, 2236 /* 32 bit DTLB invalidates */ 2237 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0, 2238 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2239 .writefn = tlbiall_write }, 2240 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 2241 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2242 .writefn = tlbimva_write }, 2243 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2, 2244 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2245 .writefn = tlbiasid_write }, 2246 /* 32 bit TLB invalidates */ 2247 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 2248 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2249 .writefn = tlbiall_write }, 2250 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 2251 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2252 .writefn = tlbimva_write }, 2253 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 2254 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2255 .writefn = tlbiasid_write }, 2256 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 2257 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 2258 .writefn = tlbimvaa_write }, 2259 }; 2260 2261 static const ARMCPRegInfo v7mp_cp_reginfo[] = { 2262 /* 32 bit TLB invalidates, Inner Shareable */ 2263 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 2264 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 2265 .writefn = tlbiall_is_write }, 2266 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 2267 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 2268 .writefn = tlbimva_is_write }, 2269 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 2270 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 2271 .writefn = tlbiasid_is_write }, 2272 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 2273 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 2274 .writefn = tlbimvaa_is_write }, 2275 }; 2276 2277 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2278 /* PMOVSSET is not implemented in v7 before v7ve */ 2279 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2280 .access = PL0_RW, .accessfn = pmreg_access, 2281 .type = ARM_CP_ALIAS | ARM_CP_IO, 2282 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2283 .writefn = pmovsset_write, 2284 .raw_writefn = raw_write }, 2285 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2286 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2287 .access = PL0_RW, .accessfn = pmreg_access, 2288 .type = ARM_CP_ALIAS | ARM_CP_IO, 2289 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2290 .writefn = pmovsset_write, 2291 .raw_writefn = raw_write }, 2292 }; 2293 2294 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2295 uint64_t value) 2296 { 2297 value &= 1; 2298 env->teecr = value; 2299 } 2300 2301 static CPAccessResult teecr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2302 bool isread) 2303 { 2304 /* 2305 * HSTR.TTEE only exists in v7A, not v8A, but v8A doesn't have T2EE 2306 * at all, so we don't need to check whether we're v8A. 2307 */ 2308 if (arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) && 2309 (env->cp15.hstr_el2 & HSTR_TTEE)) { 2310 return CP_ACCESS_TRAP_EL2; 2311 } 2312 return CP_ACCESS_OK; 2313 } 2314 2315 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2316 bool isread) 2317 { 2318 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2319 return CP_ACCESS_TRAP; 2320 } 2321 return teecr_access(env, ri, isread); 2322 } 2323 2324 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2325 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2326 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2327 .resetvalue = 0, 2328 .writefn = teecr_write, .accessfn = teecr_access }, 2329 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2330 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2331 .accessfn = teehbr_access, .resetvalue = 0 }, 2332 }; 2333 2334 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2335 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2336 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2337 .access = PL0_RW, 2338 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2339 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2340 .access = PL0_RW, 2341 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2342 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2343 .resetfn = arm_cp_reset_ignore }, 2344 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2345 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2346 .access = PL0_R | PL1_W, 2347 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2348 .resetvalue = 0}, 2349 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2350 .access = PL0_R | PL1_W, 2351 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2352 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2353 .resetfn = arm_cp_reset_ignore }, 2354 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2355 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2356 .access = PL1_RW, 2357 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2358 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2359 .access = PL1_RW, 2360 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2361 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2362 .resetvalue = 0 }, 2363 }; 2364 2365 #ifndef CONFIG_USER_ONLY 2366 2367 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2368 bool isread) 2369 { 2370 /* 2371 * CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2372 * Writable only at the highest implemented exception level. 2373 */ 2374 int el = arm_current_el(env); 2375 uint64_t hcr; 2376 uint32_t cntkctl; 2377 2378 switch (el) { 2379 case 0: 2380 hcr = arm_hcr_el2_eff(env); 2381 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2382 cntkctl = env->cp15.cnthctl_el2; 2383 } else { 2384 cntkctl = env->cp15.c14_cntkctl; 2385 } 2386 if (!extract32(cntkctl, 0, 2)) { 2387 return CP_ACCESS_TRAP; 2388 } 2389 break; 2390 case 1: 2391 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2392 arm_is_secure_below_el3(env)) { 2393 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2394 return CP_ACCESS_TRAP_UNCATEGORIZED; 2395 } 2396 break; 2397 case 2: 2398 case 3: 2399 break; 2400 } 2401 2402 if (!isread && el < arm_highest_el(env)) { 2403 return CP_ACCESS_TRAP_UNCATEGORIZED; 2404 } 2405 2406 return CP_ACCESS_OK; 2407 } 2408 2409 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2410 bool isread) 2411 { 2412 unsigned int cur_el = arm_current_el(env); 2413 bool has_el2 = arm_is_el2_enabled(env); 2414 uint64_t hcr = arm_hcr_el2_eff(env); 2415 2416 switch (cur_el) { 2417 case 0: 2418 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]CTEN. */ 2419 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2420 return (extract32(env->cp15.cnthctl_el2, timeridx, 1) 2421 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2422 } 2423 2424 /* CNT[PV]CT: not visible from PL0 if EL0[PV]CTEN is zero */ 2425 if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2426 return CP_ACCESS_TRAP; 2427 } 2428 2429 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PCTEN. */ 2430 if (hcr & HCR_E2H) { 2431 if (timeridx == GTIMER_PHYS && 2432 !extract32(env->cp15.cnthctl_el2, 10, 1)) { 2433 return CP_ACCESS_TRAP_EL2; 2434 } 2435 } else { 2436 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ 2437 if (has_el2 && timeridx == GTIMER_PHYS && 2438 !extract32(env->cp15.cnthctl_el2, 1, 1)) { 2439 return CP_ACCESS_TRAP_EL2; 2440 } 2441 } 2442 break; 2443 2444 case 1: 2445 /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */ 2446 if (has_el2 && timeridx == GTIMER_PHYS && 2447 (hcr & HCR_E2H 2448 ? !extract32(env->cp15.cnthctl_el2, 10, 1) 2449 : !extract32(env->cp15.cnthctl_el2, 0, 1))) { 2450 return CP_ACCESS_TRAP_EL2; 2451 } 2452 break; 2453 } 2454 return CP_ACCESS_OK; 2455 } 2456 2457 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2458 bool isread) 2459 { 2460 unsigned int cur_el = arm_current_el(env); 2461 bool has_el2 = arm_is_el2_enabled(env); 2462 uint64_t hcr = arm_hcr_el2_eff(env); 2463 2464 switch (cur_el) { 2465 case 0: 2466 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2467 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]TEN. */ 2468 return (extract32(env->cp15.cnthctl_el2, 9 - timeridx, 1) 2469 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2470 } 2471 2472 /* 2473 * CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from 2474 * EL0 if EL0[PV]TEN is zero. 2475 */ 2476 if (!extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2477 return CP_ACCESS_TRAP; 2478 } 2479 /* fall through */ 2480 2481 case 1: 2482 if (has_el2 && timeridx == GTIMER_PHYS) { 2483 if (hcr & HCR_E2H) { 2484 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */ 2485 if (!extract32(env->cp15.cnthctl_el2, 11, 1)) { 2486 return CP_ACCESS_TRAP_EL2; 2487 } 2488 } else { 2489 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ 2490 if (!extract32(env->cp15.cnthctl_el2, 1, 1)) { 2491 return CP_ACCESS_TRAP_EL2; 2492 } 2493 } 2494 } 2495 break; 2496 } 2497 return CP_ACCESS_OK; 2498 } 2499 2500 static CPAccessResult gt_pct_access(CPUARMState *env, 2501 const ARMCPRegInfo *ri, 2502 bool isread) 2503 { 2504 return gt_counter_access(env, GTIMER_PHYS, isread); 2505 } 2506 2507 static CPAccessResult gt_vct_access(CPUARMState *env, 2508 const ARMCPRegInfo *ri, 2509 bool isread) 2510 { 2511 return gt_counter_access(env, GTIMER_VIRT, isread); 2512 } 2513 2514 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2515 bool isread) 2516 { 2517 return gt_timer_access(env, GTIMER_PHYS, isread); 2518 } 2519 2520 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2521 bool isread) 2522 { 2523 return gt_timer_access(env, GTIMER_VIRT, isread); 2524 } 2525 2526 static CPAccessResult gt_stimer_access(CPUARMState *env, 2527 const ARMCPRegInfo *ri, 2528 bool isread) 2529 { 2530 /* 2531 * The AArch64 register view of the secure physical timer is 2532 * always accessible from EL3, and configurably accessible from 2533 * Secure EL1. 2534 */ 2535 switch (arm_current_el(env)) { 2536 case 1: 2537 if (!arm_is_secure(env)) { 2538 return CP_ACCESS_TRAP; 2539 } 2540 if (!(env->cp15.scr_el3 & SCR_ST)) { 2541 return CP_ACCESS_TRAP_EL3; 2542 } 2543 return CP_ACCESS_OK; 2544 case 0: 2545 case 2: 2546 return CP_ACCESS_TRAP; 2547 case 3: 2548 return CP_ACCESS_OK; 2549 default: 2550 g_assert_not_reached(); 2551 } 2552 } 2553 2554 static uint64_t gt_get_countervalue(CPUARMState *env) 2555 { 2556 ARMCPU *cpu = env_archcpu(env); 2557 2558 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu); 2559 } 2560 2561 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2562 { 2563 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2564 2565 if (gt->ctl & 1) { 2566 /* 2567 * Timer enabled: calculate and set current ISTATUS, irq, and 2568 * reset timer to when ISTATUS next has to change 2569 */ 2570 uint64_t offset = timeridx == GTIMER_VIRT ? 2571 cpu->env.cp15.cntvoff_el2 : 0; 2572 uint64_t count = gt_get_countervalue(&cpu->env); 2573 /* Note that this must be unsigned 64 bit arithmetic: */ 2574 int istatus = count - offset >= gt->cval; 2575 uint64_t nexttick; 2576 int irqstate; 2577 2578 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2579 2580 irqstate = (istatus && !(gt->ctl & 2)); 2581 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2582 2583 if (istatus) { 2584 /* Next transition is when count rolls back over to zero */ 2585 nexttick = UINT64_MAX; 2586 } else { 2587 /* Next transition is when we hit cval */ 2588 nexttick = gt->cval + offset; 2589 } 2590 /* 2591 * Note that the desired next expiry time might be beyond the 2592 * signed-64-bit range of a QEMUTimer -- in this case we just 2593 * set the timer for as far in the future as possible. When the 2594 * timer expires we will reset the timer for any remaining period. 2595 */ 2596 if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { 2597 timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX); 2598 } else { 2599 timer_mod(cpu->gt_timer[timeridx], nexttick); 2600 } 2601 trace_arm_gt_recalc(timeridx, irqstate, nexttick); 2602 } else { 2603 /* Timer disabled: ISTATUS and timer output always clear */ 2604 gt->ctl &= ~4; 2605 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0); 2606 timer_del(cpu->gt_timer[timeridx]); 2607 trace_arm_gt_recalc_disabled(timeridx); 2608 } 2609 } 2610 2611 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2612 int timeridx) 2613 { 2614 ARMCPU *cpu = env_archcpu(env); 2615 2616 timer_del(cpu->gt_timer[timeridx]); 2617 } 2618 2619 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2620 { 2621 return gt_get_countervalue(env); 2622 } 2623 2624 static uint64_t gt_virt_cnt_offset(CPUARMState *env) 2625 { 2626 uint64_t hcr; 2627 2628 switch (arm_current_el(env)) { 2629 case 2: 2630 hcr = arm_hcr_el2_eff(env); 2631 if (hcr & HCR_E2H) { 2632 return 0; 2633 } 2634 break; 2635 case 0: 2636 hcr = arm_hcr_el2_eff(env); 2637 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2638 return 0; 2639 } 2640 break; 2641 } 2642 2643 return env->cp15.cntvoff_el2; 2644 } 2645 2646 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2647 { 2648 return gt_get_countervalue(env) - gt_virt_cnt_offset(env); 2649 } 2650 2651 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2652 int timeridx, 2653 uint64_t value) 2654 { 2655 trace_arm_gt_cval_write(timeridx, value); 2656 env->cp15.c14_timer[timeridx].cval = value; 2657 gt_recalc_timer(env_archcpu(env), timeridx); 2658 } 2659 2660 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2661 int timeridx) 2662 { 2663 uint64_t offset = 0; 2664 2665 switch (timeridx) { 2666 case GTIMER_VIRT: 2667 case GTIMER_HYPVIRT: 2668 offset = gt_virt_cnt_offset(env); 2669 break; 2670 } 2671 2672 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2673 (gt_get_countervalue(env) - offset)); 2674 } 2675 2676 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2677 int timeridx, 2678 uint64_t value) 2679 { 2680 uint64_t offset = 0; 2681 2682 switch (timeridx) { 2683 case GTIMER_VIRT: 2684 case GTIMER_HYPVIRT: 2685 offset = gt_virt_cnt_offset(env); 2686 break; 2687 } 2688 2689 trace_arm_gt_tval_write(timeridx, value); 2690 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2691 sextract64(value, 0, 32); 2692 gt_recalc_timer(env_archcpu(env), timeridx); 2693 } 2694 2695 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2696 int timeridx, 2697 uint64_t value) 2698 { 2699 ARMCPU *cpu = env_archcpu(env); 2700 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2701 2702 trace_arm_gt_ctl_write(timeridx, value); 2703 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2704 if ((oldval ^ value) & 1) { 2705 /* Enable toggled */ 2706 gt_recalc_timer(cpu, timeridx); 2707 } else if ((oldval ^ value) & 2) { 2708 /* 2709 * IMASK toggled: don't need to recalculate, 2710 * just set the interrupt line based on ISTATUS 2711 */ 2712 int irqstate = (oldval & 4) && !(value & 2); 2713 2714 trace_arm_gt_imask_toggle(timeridx, irqstate); 2715 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2716 } 2717 } 2718 2719 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2720 { 2721 gt_timer_reset(env, ri, GTIMER_PHYS); 2722 } 2723 2724 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2725 uint64_t value) 2726 { 2727 gt_cval_write(env, ri, GTIMER_PHYS, value); 2728 } 2729 2730 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2731 { 2732 return gt_tval_read(env, ri, GTIMER_PHYS); 2733 } 2734 2735 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2736 uint64_t value) 2737 { 2738 gt_tval_write(env, ri, GTIMER_PHYS, value); 2739 } 2740 2741 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2742 uint64_t value) 2743 { 2744 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2745 } 2746 2747 static int gt_phys_redir_timeridx(CPUARMState *env) 2748 { 2749 switch (arm_mmu_idx(env)) { 2750 case ARMMMUIdx_E20_0: 2751 case ARMMMUIdx_E20_2: 2752 case ARMMMUIdx_E20_2_PAN: 2753 return GTIMER_HYP; 2754 default: 2755 return GTIMER_PHYS; 2756 } 2757 } 2758 2759 static int gt_virt_redir_timeridx(CPUARMState *env) 2760 { 2761 switch (arm_mmu_idx(env)) { 2762 case ARMMMUIdx_E20_0: 2763 case ARMMMUIdx_E20_2: 2764 case ARMMMUIdx_E20_2_PAN: 2765 return GTIMER_HYPVIRT; 2766 default: 2767 return GTIMER_VIRT; 2768 } 2769 } 2770 2771 static uint64_t gt_phys_redir_cval_read(CPUARMState *env, 2772 const ARMCPRegInfo *ri) 2773 { 2774 int timeridx = gt_phys_redir_timeridx(env); 2775 return env->cp15.c14_timer[timeridx].cval; 2776 } 2777 2778 static void gt_phys_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2779 uint64_t value) 2780 { 2781 int timeridx = gt_phys_redir_timeridx(env); 2782 gt_cval_write(env, ri, timeridx, value); 2783 } 2784 2785 static uint64_t gt_phys_redir_tval_read(CPUARMState *env, 2786 const ARMCPRegInfo *ri) 2787 { 2788 int timeridx = gt_phys_redir_timeridx(env); 2789 return gt_tval_read(env, ri, timeridx); 2790 } 2791 2792 static void gt_phys_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2793 uint64_t value) 2794 { 2795 int timeridx = gt_phys_redir_timeridx(env); 2796 gt_tval_write(env, ri, timeridx, value); 2797 } 2798 2799 static uint64_t gt_phys_redir_ctl_read(CPUARMState *env, 2800 const ARMCPRegInfo *ri) 2801 { 2802 int timeridx = gt_phys_redir_timeridx(env); 2803 return env->cp15.c14_timer[timeridx].ctl; 2804 } 2805 2806 static void gt_phys_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2807 uint64_t value) 2808 { 2809 int timeridx = gt_phys_redir_timeridx(env); 2810 gt_ctl_write(env, ri, timeridx, value); 2811 } 2812 2813 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2814 { 2815 gt_timer_reset(env, ri, GTIMER_VIRT); 2816 } 2817 2818 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2819 uint64_t value) 2820 { 2821 gt_cval_write(env, ri, GTIMER_VIRT, value); 2822 } 2823 2824 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2825 { 2826 return gt_tval_read(env, ri, GTIMER_VIRT); 2827 } 2828 2829 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2830 uint64_t value) 2831 { 2832 gt_tval_write(env, ri, GTIMER_VIRT, value); 2833 } 2834 2835 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2836 uint64_t value) 2837 { 2838 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2839 } 2840 2841 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2842 uint64_t value) 2843 { 2844 ARMCPU *cpu = env_archcpu(env); 2845 2846 trace_arm_gt_cntvoff_write(value); 2847 raw_write(env, ri, value); 2848 gt_recalc_timer(cpu, GTIMER_VIRT); 2849 } 2850 2851 static uint64_t gt_virt_redir_cval_read(CPUARMState *env, 2852 const ARMCPRegInfo *ri) 2853 { 2854 int timeridx = gt_virt_redir_timeridx(env); 2855 return env->cp15.c14_timer[timeridx].cval; 2856 } 2857 2858 static void gt_virt_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2859 uint64_t value) 2860 { 2861 int timeridx = gt_virt_redir_timeridx(env); 2862 gt_cval_write(env, ri, timeridx, value); 2863 } 2864 2865 static uint64_t gt_virt_redir_tval_read(CPUARMState *env, 2866 const ARMCPRegInfo *ri) 2867 { 2868 int timeridx = gt_virt_redir_timeridx(env); 2869 return gt_tval_read(env, ri, timeridx); 2870 } 2871 2872 static void gt_virt_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2873 uint64_t value) 2874 { 2875 int timeridx = gt_virt_redir_timeridx(env); 2876 gt_tval_write(env, ri, timeridx, value); 2877 } 2878 2879 static uint64_t gt_virt_redir_ctl_read(CPUARMState *env, 2880 const ARMCPRegInfo *ri) 2881 { 2882 int timeridx = gt_virt_redir_timeridx(env); 2883 return env->cp15.c14_timer[timeridx].ctl; 2884 } 2885 2886 static void gt_virt_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2887 uint64_t value) 2888 { 2889 int timeridx = gt_virt_redir_timeridx(env); 2890 gt_ctl_write(env, ri, timeridx, value); 2891 } 2892 2893 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2894 { 2895 gt_timer_reset(env, ri, GTIMER_HYP); 2896 } 2897 2898 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2899 uint64_t value) 2900 { 2901 gt_cval_write(env, ri, GTIMER_HYP, value); 2902 } 2903 2904 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2905 { 2906 return gt_tval_read(env, ri, GTIMER_HYP); 2907 } 2908 2909 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2910 uint64_t value) 2911 { 2912 gt_tval_write(env, ri, GTIMER_HYP, value); 2913 } 2914 2915 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2916 uint64_t value) 2917 { 2918 gt_ctl_write(env, ri, GTIMER_HYP, value); 2919 } 2920 2921 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2922 { 2923 gt_timer_reset(env, ri, GTIMER_SEC); 2924 } 2925 2926 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2927 uint64_t value) 2928 { 2929 gt_cval_write(env, ri, GTIMER_SEC, value); 2930 } 2931 2932 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2933 { 2934 return gt_tval_read(env, ri, GTIMER_SEC); 2935 } 2936 2937 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2938 uint64_t value) 2939 { 2940 gt_tval_write(env, ri, GTIMER_SEC, value); 2941 } 2942 2943 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2944 uint64_t value) 2945 { 2946 gt_ctl_write(env, ri, GTIMER_SEC, value); 2947 } 2948 2949 static void gt_hv_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2950 { 2951 gt_timer_reset(env, ri, GTIMER_HYPVIRT); 2952 } 2953 2954 static void gt_hv_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2955 uint64_t value) 2956 { 2957 gt_cval_write(env, ri, GTIMER_HYPVIRT, value); 2958 } 2959 2960 static uint64_t gt_hv_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2961 { 2962 return gt_tval_read(env, ri, GTIMER_HYPVIRT); 2963 } 2964 2965 static void gt_hv_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2966 uint64_t value) 2967 { 2968 gt_tval_write(env, ri, GTIMER_HYPVIRT, value); 2969 } 2970 2971 static void gt_hv_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2972 uint64_t value) 2973 { 2974 gt_ctl_write(env, ri, GTIMER_HYPVIRT, value); 2975 } 2976 2977 void arm_gt_ptimer_cb(void *opaque) 2978 { 2979 ARMCPU *cpu = opaque; 2980 2981 gt_recalc_timer(cpu, GTIMER_PHYS); 2982 } 2983 2984 void arm_gt_vtimer_cb(void *opaque) 2985 { 2986 ARMCPU *cpu = opaque; 2987 2988 gt_recalc_timer(cpu, GTIMER_VIRT); 2989 } 2990 2991 void arm_gt_htimer_cb(void *opaque) 2992 { 2993 ARMCPU *cpu = opaque; 2994 2995 gt_recalc_timer(cpu, GTIMER_HYP); 2996 } 2997 2998 void arm_gt_stimer_cb(void *opaque) 2999 { 3000 ARMCPU *cpu = opaque; 3001 3002 gt_recalc_timer(cpu, GTIMER_SEC); 3003 } 3004 3005 void arm_gt_hvtimer_cb(void *opaque) 3006 { 3007 ARMCPU *cpu = opaque; 3008 3009 gt_recalc_timer(cpu, GTIMER_HYPVIRT); 3010 } 3011 3012 static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque) 3013 { 3014 ARMCPU *cpu = env_archcpu(env); 3015 3016 cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz; 3017 } 3018 3019 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 3020 /* 3021 * Note that CNTFRQ is purely reads-as-written for the benefit 3022 * of software; writing it doesn't actually change the timer frequency. 3023 * Our reset value matches the fixed frequency we implement the timer at. 3024 */ 3025 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 3026 .type = ARM_CP_ALIAS, 3027 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 3028 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 3029 }, 3030 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 3031 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 3032 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 3033 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 3034 .resetfn = arm_gt_cntfrq_reset, 3035 }, 3036 /* overall control: mostly access permissions */ 3037 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 3038 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 3039 .access = PL1_RW, 3040 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 3041 .resetvalue = 0, 3042 }, 3043 /* per-timer control */ 3044 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 3045 .secure = ARM_CP_SECSTATE_NS, 3046 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3047 .accessfn = gt_ptimer_access, 3048 .fieldoffset = offsetoflow32(CPUARMState, 3049 cp15.c14_timer[GTIMER_PHYS].ctl), 3050 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3051 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3052 }, 3053 { .name = "CNTP_CTL_S", 3054 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 3055 .secure = ARM_CP_SECSTATE_S, 3056 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3057 .accessfn = gt_ptimer_access, 3058 .fieldoffset = offsetoflow32(CPUARMState, 3059 cp15.c14_timer[GTIMER_SEC].ctl), 3060 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3061 }, 3062 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 3063 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 3064 .type = ARM_CP_IO, .access = PL0_RW, 3065 .accessfn = gt_ptimer_access, 3066 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 3067 .resetvalue = 0, 3068 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3069 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3070 }, 3071 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 3072 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3073 .accessfn = gt_vtimer_access, 3074 .fieldoffset = offsetoflow32(CPUARMState, 3075 cp15.c14_timer[GTIMER_VIRT].ctl), 3076 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3077 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3078 }, 3079 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 3080 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 3081 .type = ARM_CP_IO, .access = PL0_RW, 3082 .accessfn = gt_vtimer_access, 3083 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 3084 .resetvalue = 0, 3085 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3086 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3087 }, 3088 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 3089 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3090 .secure = ARM_CP_SECSTATE_NS, 3091 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3092 .accessfn = gt_ptimer_access, 3093 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3094 }, 3095 { .name = "CNTP_TVAL_S", 3096 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3097 .secure = ARM_CP_SECSTATE_S, 3098 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3099 .accessfn = gt_ptimer_access, 3100 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 3101 }, 3102 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3103 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 3104 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3105 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 3106 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3107 }, 3108 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 3109 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3110 .accessfn = gt_vtimer_access, 3111 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3112 }, 3113 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3114 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 3115 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3116 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 3117 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3118 }, 3119 /* The counter itself */ 3120 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 3121 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3122 .accessfn = gt_pct_access, 3123 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 3124 }, 3125 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 3126 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 3127 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3128 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 3129 }, 3130 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 3131 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3132 .accessfn = gt_vct_access, 3133 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 3134 }, 3135 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3136 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3137 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3138 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 3139 }, 3140 /* Comparison value, indicating when the timer goes off */ 3141 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 3142 .secure = ARM_CP_SECSTATE_NS, 3143 .access = PL0_RW, 3144 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3145 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3146 .accessfn = gt_ptimer_access, 3147 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3148 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3149 }, 3150 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 3151 .secure = ARM_CP_SECSTATE_S, 3152 .access = PL0_RW, 3153 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3154 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3155 .accessfn = gt_ptimer_access, 3156 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3157 }, 3158 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3159 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 3160 .access = PL0_RW, 3161 .type = ARM_CP_IO, 3162 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3163 .resetvalue = 0, .accessfn = gt_ptimer_access, 3164 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3165 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3166 }, 3167 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 3168 .access = PL0_RW, 3169 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3170 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3171 .accessfn = gt_vtimer_access, 3172 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3173 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3174 }, 3175 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3176 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 3177 .access = PL0_RW, 3178 .type = ARM_CP_IO, 3179 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3180 .resetvalue = 0, .accessfn = gt_vtimer_access, 3181 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3182 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3183 }, 3184 /* 3185 * Secure timer -- this is actually restricted to only EL3 3186 * and configurably Secure-EL1 via the accessfn. 3187 */ 3188 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 3189 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 3190 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 3191 .accessfn = gt_stimer_access, 3192 .readfn = gt_sec_tval_read, 3193 .writefn = gt_sec_tval_write, 3194 .resetfn = gt_sec_timer_reset, 3195 }, 3196 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 3197 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 3198 .type = ARM_CP_IO, .access = PL1_RW, 3199 .accessfn = gt_stimer_access, 3200 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 3201 .resetvalue = 0, 3202 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3203 }, 3204 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 3205 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 3206 .type = ARM_CP_IO, .access = PL1_RW, 3207 .accessfn = gt_stimer_access, 3208 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3209 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3210 }, 3211 }; 3212 3213 static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri, 3214 bool isread) 3215 { 3216 if (!(arm_hcr_el2_eff(env) & HCR_E2H)) { 3217 return CP_ACCESS_TRAP; 3218 } 3219 return CP_ACCESS_OK; 3220 } 3221 3222 #else 3223 3224 /* 3225 * In user-mode most of the generic timer registers are inaccessible 3226 * however modern kernels (4.12+) allow access to cntvct_el0 3227 */ 3228 3229 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 3230 { 3231 ARMCPU *cpu = env_archcpu(env); 3232 3233 /* 3234 * Currently we have no support for QEMUTimer in linux-user so we 3235 * can't call gt_get_countervalue(env), instead we directly 3236 * call the lower level functions. 3237 */ 3238 return cpu_get_clock() / gt_cntfrq_period_ns(cpu); 3239 } 3240 3241 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 3242 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 3243 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 3244 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 3245 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 3246 .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE, 3247 }, 3248 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3249 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3250 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3251 .readfn = gt_virt_cnt_read, 3252 }, 3253 }; 3254 3255 #endif 3256 3257 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3258 { 3259 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3260 raw_write(env, ri, value); 3261 } else if (arm_feature(env, ARM_FEATURE_V7)) { 3262 raw_write(env, ri, value & 0xfffff6ff); 3263 } else { 3264 raw_write(env, ri, value & 0xfffff1ff); 3265 } 3266 } 3267 3268 #ifndef CONFIG_USER_ONLY 3269 /* get_phys_addr() isn't present for user-mode-only targets */ 3270 3271 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 3272 bool isread) 3273 { 3274 if (ri->opc2 & 4) { 3275 /* 3276 * The ATS12NSO* operations must trap to EL3 or EL2 if executed in 3277 * Secure EL1 (which can only happen if EL3 is AArch64). 3278 * They are simply UNDEF if executed from NS EL1. 3279 * They function normally from EL2 or EL3. 3280 */ 3281 if (arm_current_el(env) == 1) { 3282 if (arm_is_secure_below_el3(env)) { 3283 if (env->cp15.scr_el3 & SCR_EEL2) { 3284 return CP_ACCESS_TRAP_UNCATEGORIZED_EL2; 3285 } 3286 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3; 3287 } 3288 return CP_ACCESS_TRAP_UNCATEGORIZED; 3289 } 3290 } 3291 return CP_ACCESS_OK; 3292 } 3293 3294 #ifdef CONFIG_TCG 3295 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 3296 MMUAccessType access_type, ARMMMUIdx mmu_idx, 3297 bool is_secure) 3298 { 3299 bool ret; 3300 uint64_t par64; 3301 bool format64 = false; 3302 ARMMMUFaultInfo fi = {}; 3303 GetPhysAddrResult res = {}; 3304 3305 ret = get_phys_addr_with_secure(env, value, access_type, mmu_idx, 3306 is_secure, &res, &fi); 3307 3308 /* 3309 * ATS operations only do S1 or S1+S2 translations, so we never 3310 * have to deal with the ARMCacheAttrs format for S2 only. 3311 */ 3312 assert(!res.cacheattrs.is_s2_format); 3313 3314 if (ret) { 3315 /* 3316 * Some kinds of translation fault must cause exceptions rather 3317 * than being reported in the PAR. 3318 */ 3319 int current_el = arm_current_el(env); 3320 int target_el; 3321 uint32_t syn, fsr, fsc; 3322 bool take_exc = false; 3323 3324 if (fi.s1ptw && current_el == 1 3325 && arm_mmu_idx_is_stage1_of_2(mmu_idx)) { 3326 /* 3327 * Synchronous stage 2 fault on an access made as part of the 3328 * translation table walk for AT S1E0* or AT S1E1* insn 3329 * executed from NS EL1. If this is a synchronous external abort 3330 * and SCR_EL3.EA == 1, then we take a synchronous external abort 3331 * to EL3. Otherwise the fault is taken as an exception to EL2, 3332 * and HPFAR_EL2 holds the faulting IPA. 3333 */ 3334 if (fi.type == ARMFault_SyncExternalOnWalk && 3335 (env->cp15.scr_el3 & SCR_EA)) { 3336 target_el = 3; 3337 } else { 3338 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4; 3339 if (arm_is_secure_below_el3(env) && fi.s1ns) { 3340 env->cp15.hpfar_el2 |= HPFAR_NS; 3341 } 3342 target_el = 2; 3343 } 3344 take_exc = true; 3345 } else if (fi.type == ARMFault_SyncExternalOnWalk) { 3346 /* 3347 * Synchronous external aborts during a translation table walk 3348 * are taken as Data Abort exceptions. 3349 */ 3350 if (fi.stage2) { 3351 if (current_el == 3) { 3352 target_el = 3; 3353 } else { 3354 target_el = 2; 3355 } 3356 } else { 3357 target_el = exception_target_el(env); 3358 } 3359 take_exc = true; 3360 } 3361 3362 if (take_exc) { 3363 /* Construct FSR and FSC using same logic as arm_deliver_fault() */ 3364 if (target_el == 2 || arm_el_is_aa64(env, target_el) || 3365 arm_s1_regime_using_lpae_format(env, mmu_idx)) { 3366 fsr = arm_fi_to_lfsc(&fi); 3367 fsc = extract32(fsr, 0, 6); 3368 } else { 3369 fsr = arm_fi_to_sfsc(&fi); 3370 fsc = 0x3f; 3371 } 3372 /* 3373 * Report exception with ESR indicating a fault due to a 3374 * translation table walk for a cache maintenance instruction. 3375 */ 3376 syn = syn_data_abort_no_iss(current_el == target_el, 0, 3377 fi.ea, 1, fi.s1ptw, 1, fsc); 3378 env->exception.vaddress = value; 3379 env->exception.fsr = fsr; 3380 raise_exception(env, EXCP_DATA_ABORT, syn, target_el); 3381 } 3382 } 3383 3384 if (is_a64(env)) { 3385 format64 = true; 3386 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 3387 /* 3388 * ATS1Cxx: 3389 * * TTBCR.EAE determines whether the result is returned using the 3390 * 32-bit or the 64-bit PAR format 3391 * * Instructions executed in Hyp mode always use the 64bit format 3392 * 3393 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 3394 * * The Non-secure TTBCR.EAE bit is set to 1 3395 * * The implementation includes EL2, and the value of HCR.VM is 1 3396 * 3397 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 3398 * 3399 * ATS1Hx always uses the 64bit format. 3400 */ 3401 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 3402 3403 if (arm_feature(env, ARM_FEATURE_EL2)) { 3404 if (mmu_idx == ARMMMUIdx_E10_0 || 3405 mmu_idx == ARMMMUIdx_E10_1 || 3406 mmu_idx == ARMMMUIdx_E10_1_PAN) { 3407 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 3408 } else { 3409 format64 |= arm_current_el(env) == 2; 3410 } 3411 } 3412 } 3413 3414 if (format64) { 3415 /* Create a 64-bit PAR */ 3416 par64 = (1 << 11); /* LPAE bit always set */ 3417 if (!ret) { 3418 par64 |= res.f.phys_addr & ~0xfffULL; 3419 if (!res.f.attrs.secure) { 3420 par64 |= (1 << 9); /* NS */ 3421 } 3422 par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */ 3423 par64 |= res.cacheattrs.shareability << 7; /* SH */ 3424 } else { 3425 uint32_t fsr = arm_fi_to_lfsc(&fi); 3426 3427 par64 |= 1; /* F */ 3428 par64 |= (fsr & 0x3f) << 1; /* FS */ 3429 if (fi.stage2) { 3430 par64 |= (1 << 9); /* S */ 3431 } 3432 if (fi.s1ptw) { 3433 par64 |= (1 << 8); /* PTW */ 3434 } 3435 } 3436 } else { 3437 /* 3438 * fsr is a DFSR/IFSR value for the short descriptor 3439 * translation table format (with WnR always clear). 3440 * Convert it to a 32-bit PAR. 3441 */ 3442 if (!ret) { 3443 /* We do not set any attribute bits in the PAR */ 3444 if (res.f.lg_page_size == 24 3445 && arm_feature(env, ARM_FEATURE_V7)) { 3446 par64 = (res.f.phys_addr & 0xff000000) | (1 << 1); 3447 } else { 3448 par64 = res.f.phys_addr & 0xfffff000; 3449 } 3450 if (!res.f.attrs.secure) { 3451 par64 |= (1 << 9); /* NS */ 3452 } 3453 } else { 3454 uint32_t fsr = arm_fi_to_sfsc(&fi); 3455 3456 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 3457 ((fsr & 0xf) << 1) | 1; 3458 } 3459 } 3460 return par64; 3461 } 3462 #endif /* CONFIG_TCG */ 3463 3464 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3465 { 3466 #ifdef CONFIG_TCG 3467 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3468 uint64_t par64; 3469 ARMMMUIdx mmu_idx; 3470 int el = arm_current_el(env); 3471 bool secure = arm_is_secure_below_el3(env); 3472 3473 switch (ri->opc2 & 6) { 3474 case 0: 3475 /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */ 3476 switch (el) { 3477 case 3: 3478 mmu_idx = ARMMMUIdx_E3; 3479 secure = true; 3480 break; 3481 case 2: 3482 g_assert(!secure); /* ARMv8.4-SecEL2 is 64-bit only */ 3483 /* fall through */ 3484 case 1: 3485 if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) { 3486 mmu_idx = ARMMMUIdx_Stage1_E1_PAN; 3487 } else { 3488 mmu_idx = ARMMMUIdx_Stage1_E1; 3489 } 3490 break; 3491 default: 3492 g_assert_not_reached(); 3493 } 3494 break; 3495 case 2: 3496 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3497 switch (el) { 3498 case 3: 3499 mmu_idx = ARMMMUIdx_E10_0; 3500 secure = true; 3501 break; 3502 case 2: 3503 g_assert(!secure); /* ARMv8.4-SecEL2 is 64-bit only */ 3504 mmu_idx = ARMMMUIdx_Stage1_E0; 3505 break; 3506 case 1: 3507 mmu_idx = ARMMMUIdx_Stage1_E0; 3508 break; 3509 default: 3510 g_assert_not_reached(); 3511 } 3512 break; 3513 case 4: 3514 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3515 mmu_idx = ARMMMUIdx_E10_1; 3516 secure = false; 3517 break; 3518 case 6: 3519 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3520 mmu_idx = ARMMMUIdx_E10_0; 3521 secure = false; 3522 break; 3523 default: 3524 g_assert_not_reached(); 3525 } 3526 3527 par64 = do_ats_write(env, value, access_type, mmu_idx, secure); 3528 3529 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3530 #else 3531 /* Handled by hardware accelerator. */ 3532 g_assert_not_reached(); 3533 #endif /* CONFIG_TCG */ 3534 } 3535 3536 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3537 uint64_t value) 3538 { 3539 #ifdef CONFIG_TCG 3540 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3541 uint64_t par64; 3542 3543 /* There is no SecureEL2 for AArch32. */ 3544 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2, false); 3545 3546 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3547 #else 3548 /* Handled by hardware accelerator. */ 3549 g_assert_not_reached(); 3550 #endif /* CONFIG_TCG */ 3551 } 3552 3553 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3554 bool isread) 3555 { 3556 if (arm_current_el(env) == 3 && 3557 !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) { 3558 return CP_ACCESS_TRAP; 3559 } 3560 return CP_ACCESS_OK; 3561 } 3562 3563 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3564 uint64_t value) 3565 { 3566 #ifdef CONFIG_TCG 3567 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3568 ARMMMUIdx mmu_idx; 3569 int secure = arm_is_secure_below_el3(env); 3570 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 3571 bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE); 3572 3573 switch (ri->opc2 & 6) { 3574 case 0: 3575 switch (ri->opc1) { 3576 case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */ 3577 if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) { 3578 mmu_idx = regime_e20 ? 3579 ARMMMUIdx_E20_2_PAN : ARMMMUIdx_Stage1_E1_PAN; 3580 } else { 3581 mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1; 3582 } 3583 break; 3584 case 4: /* AT S1E2R, AT S1E2W */ 3585 mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2; 3586 break; 3587 case 6: /* AT S1E3R, AT S1E3W */ 3588 mmu_idx = ARMMMUIdx_E3; 3589 secure = true; 3590 break; 3591 default: 3592 g_assert_not_reached(); 3593 } 3594 break; 3595 case 2: /* AT S1E0R, AT S1E0W */ 3596 mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_Stage1_E0; 3597 break; 3598 case 4: /* AT S12E1R, AT S12E1W */ 3599 mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_E10_1; 3600 break; 3601 case 6: /* AT S12E0R, AT S12E0W */ 3602 mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_E10_0; 3603 break; 3604 default: 3605 g_assert_not_reached(); 3606 } 3607 3608 env->cp15.par_el[1] = do_ats_write(env, value, access_type, 3609 mmu_idx, secure); 3610 #else 3611 /* Handled by hardware accelerator. */ 3612 g_assert_not_reached(); 3613 #endif /* CONFIG_TCG */ 3614 } 3615 #endif 3616 3617 static const ARMCPRegInfo vapa_cp_reginfo[] = { 3618 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 3619 .access = PL1_RW, .resetvalue = 0, 3620 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 3621 offsetoflow32(CPUARMState, cp15.par_ns) }, 3622 .writefn = par_write }, 3623 #ifndef CONFIG_USER_ONLY 3624 /* This underdecoding is safe because the reginfo is NO_RAW. */ 3625 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 3626 .access = PL1_W, .accessfn = ats_access, 3627 .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 3628 #endif 3629 }; 3630 3631 /* Return basic MPU access permission bits. */ 3632 static uint32_t simple_mpu_ap_bits(uint32_t val) 3633 { 3634 uint32_t ret; 3635 uint32_t mask; 3636 int i; 3637 ret = 0; 3638 mask = 3; 3639 for (i = 0; i < 16; i += 2) { 3640 ret |= (val >> i) & mask; 3641 mask <<= 2; 3642 } 3643 return ret; 3644 } 3645 3646 /* Pad basic MPU access permission bits to extended format. */ 3647 static uint32_t extended_mpu_ap_bits(uint32_t val) 3648 { 3649 uint32_t ret; 3650 uint32_t mask; 3651 int i; 3652 ret = 0; 3653 mask = 3; 3654 for (i = 0; i < 16; i += 2) { 3655 ret |= (val & mask) << i; 3656 mask <<= 2; 3657 } 3658 return ret; 3659 } 3660 3661 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3662 uint64_t value) 3663 { 3664 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3665 } 3666 3667 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3668 { 3669 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3670 } 3671 3672 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3673 uint64_t value) 3674 { 3675 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3676 } 3677 3678 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3679 { 3680 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3681 } 3682 3683 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3684 { 3685 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3686 3687 if (!u32p) { 3688 return 0; 3689 } 3690 3691 u32p += env->pmsav7.rnr[M_REG_NS]; 3692 return *u32p; 3693 } 3694 3695 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3696 uint64_t value) 3697 { 3698 ARMCPU *cpu = env_archcpu(env); 3699 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3700 3701 if (!u32p) { 3702 return; 3703 } 3704 3705 u32p += env->pmsav7.rnr[M_REG_NS]; 3706 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3707 *u32p = value; 3708 } 3709 3710 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3711 uint64_t value) 3712 { 3713 ARMCPU *cpu = env_archcpu(env); 3714 uint32_t nrgs = cpu->pmsav7_dregion; 3715 3716 if (value >= nrgs) { 3717 qemu_log_mask(LOG_GUEST_ERROR, 3718 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3719 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3720 return; 3721 } 3722 3723 raw_write(env, ri, value); 3724 } 3725 3726 static void prbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3727 uint64_t value) 3728 { 3729 ARMCPU *cpu = env_archcpu(env); 3730 3731 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3732 env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value; 3733 } 3734 3735 static uint64_t prbar_read(CPUARMState *env, const ARMCPRegInfo *ri) 3736 { 3737 return env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]]; 3738 } 3739 3740 static void prlar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3741 uint64_t value) 3742 { 3743 ARMCPU *cpu = env_archcpu(env); 3744 3745 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3746 env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value; 3747 } 3748 3749 static uint64_t prlar_read(CPUARMState *env, const ARMCPRegInfo *ri) 3750 { 3751 return env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]]; 3752 } 3753 3754 static void prselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3755 uint64_t value) 3756 { 3757 ARMCPU *cpu = env_archcpu(env); 3758 3759 /* 3760 * Ignore writes that would select not implemented region. 3761 * This is architecturally UNPREDICTABLE. 3762 */ 3763 if (value >= cpu->pmsav7_dregion) { 3764 return; 3765 } 3766 3767 env->pmsav7.rnr[M_REG_NS] = value; 3768 } 3769 3770 static void hprbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3771 uint64_t value) 3772 { 3773 ARMCPU *cpu = env_archcpu(env); 3774 3775 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3776 env->pmsav8.hprbar[env->pmsav8.hprselr] = value; 3777 } 3778 3779 static uint64_t hprbar_read(CPUARMState *env, const ARMCPRegInfo *ri) 3780 { 3781 return env->pmsav8.hprbar[env->pmsav8.hprselr]; 3782 } 3783 3784 static void hprlar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3785 uint64_t value) 3786 { 3787 ARMCPU *cpu = env_archcpu(env); 3788 3789 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3790 env->pmsav8.hprlar[env->pmsav8.hprselr] = value; 3791 } 3792 3793 static uint64_t hprlar_read(CPUARMState *env, const ARMCPRegInfo *ri) 3794 { 3795 return env->pmsav8.hprlar[env->pmsav8.hprselr]; 3796 } 3797 3798 static void hprenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3799 uint64_t value) 3800 { 3801 uint32_t n; 3802 uint32_t bit; 3803 ARMCPU *cpu = env_archcpu(env); 3804 3805 /* Ignore writes to unimplemented regions */ 3806 int rmax = MIN(cpu->pmsav8r_hdregion, 32); 3807 value &= MAKE_64BIT_MASK(0, rmax); 3808 3809 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3810 3811 /* Register alias is only valid for first 32 indexes */ 3812 for (n = 0; n < rmax; ++n) { 3813 bit = extract32(value, n, 1); 3814 env->pmsav8.hprlar[n] = deposit32( 3815 env->pmsav8.hprlar[n], 0, 1, bit); 3816 } 3817 } 3818 3819 static uint64_t hprenr_read(CPUARMState *env, const ARMCPRegInfo *ri) 3820 { 3821 uint32_t n; 3822 uint32_t result = 0x0; 3823 ARMCPU *cpu = env_archcpu(env); 3824 3825 /* Register alias is only valid for first 32 indexes */ 3826 for (n = 0; n < MIN(cpu->pmsav8r_hdregion, 32); ++n) { 3827 if (env->pmsav8.hprlar[n] & 0x1) { 3828 result |= (0x1 << n); 3829 } 3830 } 3831 return result; 3832 } 3833 3834 static void hprselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3835 uint64_t value) 3836 { 3837 ARMCPU *cpu = env_archcpu(env); 3838 3839 /* 3840 * Ignore writes that would select not implemented region. 3841 * This is architecturally UNPREDICTABLE. 3842 */ 3843 if (value >= cpu->pmsav8r_hdregion) { 3844 return; 3845 } 3846 3847 env->pmsav8.hprselr = value; 3848 } 3849 3850 static void pmsav8r_regn_write(CPUARMState *env, const ARMCPRegInfo *ri, 3851 uint64_t value) 3852 { 3853 ARMCPU *cpu = env_archcpu(env); 3854 uint8_t index = (extract32(ri->opc0, 0, 1) << 4) | 3855 (extract32(ri->crm, 0, 3) << 1) | extract32(ri->opc2, 2, 1); 3856 3857 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3858 3859 if (ri->opc1 & 4) { 3860 if (index >= cpu->pmsav8r_hdregion) { 3861 return; 3862 } 3863 if (ri->opc2 & 0x1) { 3864 env->pmsav8.hprlar[index] = value; 3865 } else { 3866 env->pmsav8.hprbar[index] = value; 3867 } 3868 } else { 3869 if (index >= cpu->pmsav7_dregion) { 3870 return; 3871 } 3872 if (ri->opc2 & 0x1) { 3873 env->pmsav8.rlar[M_REG_NS][index] = value; 3874 } else { 3875 env->pmsav8.rbar[M_REG_NS][index] = value; 3876 } 3877 } 3878 } 3879 3880 static uint64_t pmsav8r_regn_read(CPUARMState *env, const ARMCPRegInfo *ri) 3881 { 3882 ARMCPU *cpu = env_archcpu(env); 3883 uint8_t index = (extract32(ri->opc0, 0, 1) << 4) | 3884 (extract32(ri->crm, 0, 3) << 1) | extract32(ri->opc2, 2, 1); 3885 3886 if (ri->opc1 & 4) { 3887 if (index >= cpu->pmsav8r_hdregion) { 3888 return 0x0; 3889 } 3890 if (ri->opc2 & 0x1) { 3891 return env->pmsav8.hprlar[index]; 3892 } else { 3893 return env->pmsav8.hprbar[index]; 3894 } 3895 } else { 3896 if (index >= cpu->pmsav7_dregion) { 3897 return 0x0; 3898 } 3899 if (ri->opc2 & 0x1) { 3900 return env->pmsav8.rlar[M_REG_NS][index]; 3901 } else { 3902 return env->pmsav8.rbar[M_REG_NS][index]; 3903 } 3904 } 3905 } 3906 3907 static const ARMCPRegInfo pmsav8r_cp_reginfo[] = { 3908 { .name = "PRBAR", 3909 .cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 0, 3910 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3911 .accessfn = access_tvm_trvm, 3912 .readfn = prbar_read, .writefn = prbar_write }, 3913 { .name = "PRLAR", 3914 .cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 1, 3915 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3916 .accessfn = access_tvm_trvm, 3917 .readfn = prlar_read, .writefn = prlar_write }, 3918 { .name = "PRSELR", .resetvalue = 0, 3919 .cp = 15, .opc1 = 0, .crn = 6, .crm = 2, .opc2 = 1, 3920 .access = PL1_RW, .accessfn = access_tvm_trvm, 3921 .writefn = prselr_write, 3922 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]) }, 3923 { .name = "HPRBAR", .resetvalue = 0, 3924 .cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 0, 3925 .access = PL2_RW, .type = ARM_CP_NO_RAW, 3926 .readfn = hprbar_read, .writefn = hprbar_write }, 3927 { .name = "HPRLAR", 3928 .cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 1, 3929 .access = PL2_RW, .type = ARM_CP_NO_RAW, 3930 .readfn = hprlar_read, .writefn = hprlar_write }, 3931 { .name = "HPRSELR", .resetvalue = 0, 3932 .cp = 15, .opc1 = 4, .crn = 6, .crm = 2, .opc2 = 1, 3933 .access = PL2_RW, 3934 .writefn = hprselr_write, 3935 .fieldoffset = offsetof(CPUARMState, pmsav8.hprselr) }, 3936 { .name = "HPRENR", 3937 .cp = 15, .opc1 = 4, .crn = 6, .crm = 1, .opc2 = 1, 3938 .access = PL2_RW, .type = ARM_CP_NO_RAW, 3939 .readfn = hprenr_read, .writefn = hprenr_write }, 3940 }; 3941 3942 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 3943 /* 3944 * Reset for all these registers is handled in arm_cpu_reset(), 3945 * because the PMSAv7 is also used by M-profile CPUs, which do 3946 * not register cpregs but still need the state to be reset. 3947 */ 3948 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 3949 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3950 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 3951 .readfn = pmsav7_read, .writefn = pmsav7_write, 3952 .resetfn = arm_cp_reset_ignore }, 3953 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 3954 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3955 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 3956 .readfn = pmsav7_read, .writefn = pmsav7_write, 3957 .resetfn = arm_cp_reset_ignore }, 3958 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 3959 .access = PL1_RW, .type = ARM_CP_NO_RAW, 3960 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 3961 .readfn = pmsav7_read, .writefn = pmsav7_write, 3962 .resetfn = arm_cp_reset_ignore }, 3963 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 3964 .access = PL1_RW, 3965 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 3966 .writefn = pmsav7_rgnr_write, 3967 .resetfn = arm_cp_reset_ignore }, 3968 }; 3969 3970 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 3971 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 3972 .access = PL1_RW, .type = ARM_CP_ALIAS, 3973 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3974 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 3975 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 3976 .access = PL1_RW, .type = ARM_CP_ALIAS, 3977 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3978 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 3979 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 3980 .access = PL1_RW, 3981 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 3982 .resetvalue = 0, }, 3983 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 3984 .access = PL1_RW, 3985 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 3986 .resetvalue = 0, }, 3987 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 3988 .access = PL1_RW, 3989 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 3990 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 3991 .access = PL1_RW, 3992 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 3993 /* Protection region base and size registers */ 3994 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 3995 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3996 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 3997 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 3998 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 3999 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 4000 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 4001 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4002 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 4003 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 4004 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4005 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 4006 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 4007 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4008 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 4009 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 4010 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4011 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 4012 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 4013 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4014 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 4015 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 4016 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4017 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 4018 }; 4019 4020 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4021 uint64_t value) 4022 { 4023 ARMCPU *cpu = env_archcpu(env); 4024 4025 if (!arm_feature(env, ARM_FEATURE_V8)) { 4026 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 4027 /* 4028 * Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 4029 * using Long-descriptor translation table format 4030 */ 4031 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 4032 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 4033 /* 4034 * In an implementation that includes the Security Extensions 4035 * TTBCR has additional fields PD0 [4] and PD1 [5] for 4036 * Short-descriptor translation table format. 4037 */ 4038 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 4039 } else { 4040 value &= TTBCR_N; 4041 } 4042 } 4043 4044 if (arm_feature(env, ARM_FEATURE_LPAE)) { 4045 /* 4046 * With LPAE the TTBCR could result in a change of ASID 4047 * via the TTBCR.A1 bit, so do a TLB flush. 4048 */ 4049 tlb_flush(CPU(cpu)); 4050 } 4051 raw_write(env, ri, value); 4052 } 4053 4054 static void vmsa_tcr_el12_write(CPUARMState *env, const ARMCPRegInfo *ri, 4055 uint64_t value) 4056 { 4057 ARMCPU *cpu = env_archcpu(env); 4058 4059 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 4060 tlb_flush(CPU(cpu)); 4061 raw_write(env, ri, value); 4062 } 4063 4064 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4065 uint64_t value) 4066 { 4067 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 4068 if (cpreg_field_is_64bit(ri) && 4069 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 4070 ARMCPU *cpu = env_archcpu(env); 4071 tlb_flush(CPU(cpu)); 4072 } 4073 raw_write(env, ri, value); 4074 } 4075 4076 static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4077 uint64_t value) 4078 { 4079 /* 4080 * If we are running with E2&0 regime, then an ASID is active. 4081 * Flush if that might be changing. Note we're not checking 4082 * TCR_EL2.A1 to know if this is really the TTBRx_EL2 that 4083 * holds the active ASID, only checking the field that might. 4084 */ 4085 if (extract64(raw_read(env, ri) ^ value, 48, 16) && 4086 (arm_hcr_el2_eff(env) & HCR_E2H)) { 4087 uint16_t mask = ARMMMUIdxBit_E20_2 | 4088 ARMMMUIdxBit_E20_2_PAN | 4089 ARMMMUIdxBit_E20_0; 4090 tlb_flush_by_mmuidx(env_cpu(env), mask); 4091 } 4092 raw_write(env, ri, value); 4093 } 4094 4095 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4096 uint64_t value) 4097 { 4098 ARMCPU *cpu = env_archcpu(env); 4099 CPUState *cs = CPU(cpu); 4100 4101 /* 4102 * A change in VMID to the stage2 page table (Stage2) invalidates 4103 * the stage2 and combined stage 1&2 tlbs (EL10_1 and EL10_0). 4104 */ 4105 if (extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 4106 tlb_flush_by_mmuidx(cs, alle1_tlbmask(env)); 4107 } 4108 raw_write(env, ri, value); 4109 } 4110 4111 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 4112 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 4113 .access = PL1_RW, .accessfn = access_tvm_trvm, .type = ARM_CP_ALIAS, 4114 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 4115 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 4116 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 4117 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 4118 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 4119 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 4120 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 4121 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 4122 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 4123 offsetof(CPUARMState, cp15.dfar_ns) } }, 4124 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 4125 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 4126 .access = PL1_RW, .accessfn = access_tvm_trvm, 4127 .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 4128 .resetvalue = 0, }, 4129 }; 4130 4131 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 4132 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 4133 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 4134 .access = PL1_RW, .accessfn = access_tvm_trvm, 4135 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 4136 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 4137 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 4138 .access = PL1_RW, .accessfn = access_tvm_trvm, 4139 .writefn = vmsa_ttbr_write, .resetvalue = 0, 4140 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 4141 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 4142 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 4143 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 4144 .access = PL1_RW, .accessfn = access_tvm_trvm, 4145 .writefn = vmsa_ttbr_write, .resetvalue = 0, 4146 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 4147 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 4148 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 4149 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 4150 .access = PL1_RW, .accessfn = access_tvm_trvm, 4151 .writefn = vmsa_tcr_el12_write, 4152 .raw_writefn = raw_write, 4153 .resetvalue = 0, 4154 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 4155 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 4156 .access = PL1_RW, .accessfn = access_tvm_trvm, 4157 .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 4158 .raw_writefn = raw_write, 4159 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 4160 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 4161 }; 4162 4163 /* 4164 * Note that unlike TTBCR, writing to TTBCR2 does not require flushing 4165 * qemu tlbs nor adjusting cached masks. 4166 */ 4167 static const ARMCPRegInfo ttbcr2_reginfo = { 4168 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 4169 .access = PL1_RW, .accessfn = access_tvm_trvm, 4170 .type = ARM_CP_ALIAS, 4171 .bank_fieldoffsets = { 4172 offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 4173 offsetofhigh32(CPUARMState, cp15.tcr_el[1]), 4174 }, 4175 }; 4176 4177 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 4178 uint64_t value) 4179 { 4180 env->cp15.c15_ticonfig = value & 0xe7; 4181 /* The OS_TYPE bit in this register changes the reported CPUID! */ 4182 env->cp15.c0_cpuid = (value & (1 << 5)) ? 4183 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 4184 } 4185 4186 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 4187 uint64_t value) 4188 { 4189 env->cp15.c15_threadid = value & 0xffff; 4190 } 4191 4192 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 4193 uint64_t value) 4194 { 4195 /* Wait-for-interrupt (deprecated) */ 4196 cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT); 4197 } 4198 4199 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 4200 uint64_t value) 4201 { 4202 /* 4203 * On OMAP there are registers indicating the max/min index of dcache lines 4204 * containing a dirty line; cache flush operations have to reset these. 4205 */ 4206 env->cp15.c15_i_max = 0x000; 4207 env->cp15.c15_i_min = 0xff0; 4208 } 4209 4210 static const ARMCPRegInfo omap_cp_reginfo[] = { 4211 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 4212 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 4213 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 4214 .resetvalue = 0, }, 4215 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 4216 .access = PL1_RW, .type = ARM_CP_NOP }, 4217 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 4218 .access = PL1_RW, 4219 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 4220 .writefn = omap_ticonfig_write }, 4221 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 4222 .access = PL1_RW, 4223 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 4224 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 4225 .access = PL1_RW, .resetvalue = 0xff0, 4226 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 4227 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 4228 .access = PL1_RW, 4229 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 4230 .writefn = omap_threadid_write }, 4231 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 4232 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 4233 .type = ARM_CP_NO_RAW, 4234 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 4235 /* 4236 * TODO: Peripheral port remap register: 4237 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 4238 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 4239 * when MMU is off. 4240 */ 4241 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 4242 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 4243 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 4244 .writefn = omap_cachemaint_write }, 4245 { .name = "C9", .cp = 15, .crn = 9, 4246 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 4247 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 4248 }; 4249 4250 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4251 uint64_t value) 4252 { 4253 env->cp15.c15_cpar = value & 0x3fff; 4254 } 4255 4256 static const ARMCPRegInfo xscale_cp_reginfo[] = { 4257 { .name = "XSCALE_CPAR", 4258 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 4259 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 4260 .writefn = xscale_cpar_write, }, 4261 { .name = "XSCALE_AUXCR", 4262 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 4263 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 4264 .resetvalue = 0, }, 4265 /* 4266 * XScale specific cache-lockdown: since we have no cache we NOP these 4267 * and hope the guest does not really rely on cache behaviour. 4268 */ 4269 { .name = "XSCALE_LOCK_ICACHE_LINE", 4270 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 4271 .access = PL1_W, .type = ARM_CP_NOP }, 4272 { .name = "XSCALE_UNLOCK_ICACHE", 4273 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 4274 .access = PL1_W, .type = ARM_CP_NOP }, 4275 { .name = "XSCALE_DCACHE_LOCK", 4276 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 4277 .access = PL1_RW, .type = ARM_CP_NOP }, 4278 { .name = "XSCALE_UNLOCK_DCACHE", 4279 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 4280 .access = PL1_W, .type = ARM_CP_NOP }, 4281 }; 4282 4283 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 4284 /* 4285 * RAZ/WI the whole crn=15 space, when we don't have a more specific 4286 * implementation of this implementation-defined space. 4287 * Ideally this should eventually disappear in favour of actually 4288 * implementing the correct behaviour for all cores. 4289 */ 4290 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 4291 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4292 .access = PL1_RW, 4293 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 4294 .resetvalue = 0 }, 4295 }; 4296 4297 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 4298 /* Cache status: RAZ because we have no cache so it's always clean */ 4299 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 4300 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4301 .resetvalue = 0 }, 4302 }; 4303 4304 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 4305 /* We never have a block transfer operation in progress */ 4306 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 4307 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4308 .resetvalue = 0 }, 4309 /* The cache ops themselves: these all NOP for QEMU */ 4310 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 4311 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4312 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 4313 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4314 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 4315 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4316 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 4317 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4318 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 4319 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4320 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 4321 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4322 }; 4323 4324 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 4325 /* 4326 * The cache test-and-clean instructions always return (1 << 30) 4327 * to indicate that there are no dirty cache lines. 4328 */ 4329 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 4330 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4331 .resetvalue = (1 << 30) }, 4332 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 4333 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4334 .resetvalue = (1 << 30) }, 4335 }; 4336 4337 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 4338 /* Ignore ReadBuffer accesses */ 4339 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 4340 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4341 .access = PL1_RW, .resetvalue = 0, 4342 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 4343 }; 4344 4345 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4346 { 4347 unsigned int cur_el = arm_current_el(env); 4348 4349 if (arm_is_el2_enabled(env) && cur_el == 1) { 4350 return env->cp15.vpidr_el2; 4351 } 4352 return raw_read(env, ri); 4353 } 4354 4355 static uint64_t mpidr_read_val(CPUARMState *env) 4356 { 4357 ARMCPU *cpu = env_archcpu(env); 4358 uint64_t mpidr = cpu->mp_affinity; 4359 4360 if (arm_feature(env, ARM_FEATURE_V7MP)) { 4361 mpidr |= (1U << 31); 4362 /* 4363 * Cores which are uniprocessor (non-coherent) 4364 * but still implement the MP extensions set 4365 * bit 30. (For instance, Cortex-R5). 4366 */ 4367 if (cpu->mp_is_up) { 4368 mpidr |= (1u << 30); 4369 } 4370 } 4371 return mpidr; 4372 } 4373 4374 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4375 { 4376 unsigned int cur_el = arm_current_el(env); 4377 4378 if (arm_is_el2_enabled(env) && cur_el == 1) { 4379 return env->cp15.vmpidr_el2; 4380 } 4381 return mpidr_read_val(env); 4382 } 4383 4384 static const ARMCPRegInfo lpae_cp_reginfo[] = { 4385 /* NOP AMAIR0/1 */ 4386 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 4387 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 4388 .access = PL1_RW, .accessfn = access_tvm_trvm, 4389 .type = ARM_CP_CONST, .resetvalue = 0 }, 4390 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 4391 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 4392 .access = PL1_RW, .accessfn = access_tvm_trvm, 4393 .type = ARM_CP_CONST, .resetvalue = 0 }, 4394 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 4395 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 4396 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 4397 offsetof(CPUARMState, cp15.par_ns)} }, 4398 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 4399 .access = PL1_RW, .accessfn = access_tvm_trvm, 4400 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4401 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 4402 offsetof(CPUARMState, cp15.ttbr0_ns) }, 4403 .writefn = vmsa_ttbr_write, }, 4404 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 4405 .access = PL1_RW, .accessfn = access_tvm_trvm, 4406 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4407 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 4408 offsetof(CPUARMState, cp15.ttbr1_ns) }, 4409 .writefn = vmsa_ttbr_write, }, 4410 }; 4411 4412 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4413 { 4414 return vfp_get_fpcr(env); 4415 } 4416 4417 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4418 uint64_t value) 4419 { 4420 vfp_set_fpcr(env, value); 4421 } 4422 4423 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4424 { 4425 return vfp_get_fpsr(env); 4426 } 4427 4428 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4429 uint64_t value) 4430 { 4431 vfp_set_fpsr(env, value); 4432 } 4433 4434 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 4435 bool isread) 4436 { 4437 if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UMA)) { 4438 return CP_ACCESS_TRAP; 4439 } 4440 return CP_ACCESS_OK; 4441 } 4442 4443 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 4444 uint64_t value) 4445 { 4446 env->daif = value & PSTATE_DAIF; 4447 } 4448 4449 static uint64_t aa64_pan_read(CPUARMState *env, const ARMCPRegInfo *ri) 4450 { 4451 return env->pstate & PSTATE_PAN; 4452 } 4453 4454 static void aa64_pan_write(CPUARMState *env, const ARMCPRegInfo *ri, 4455 uint64_t value) 4456 { 4457 env->pstate = (env->pstate & ~PSTATE_PAN) | (value & PSTATE_PAN); 4458 } 4459 4460 static const ARMCPRegInfo pan_reginfo = { 4461 .name = "PAN", .state = ARM_CP_STATE_AA64, 4462 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 3, 4463 .type = ARM_CP_NO_RAW, .access = PL1_RW, 4464 .readfn = aa64_pan_read, .writefn = aa64_pan_write 4465 }; 4466 4467 static uint64_t aa64_uao_read(CPUARMState *env, const ARMCPRegInfo *ri) 4468 { 4469 return env->pstate & PSTATE_UAO; 4470 } 4471 4472 static void aa64_uao_write(CPUARMState *env, const ARMCPRegInfo *ri, 4473 uint64_t value) 4474 { 4475 env->pstate = (env->pstate & ~PSTATE_UAO) | (value & PSTATE_UAO); 4476 } 4477 4478 static const ARMCPRegInfo uao_reginfo = { 4479 .name = "UAO", .state = ARM_CP_STATE_AA64, 4480 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 4, 4481 .type = ARM_CP_NO_RAW, .access = PL1_RW, 4482 .readfn = aa64_uao_read, .writefn = aa64_uao_write 4483 }; 4484 4485 static uint64_t aa64_dit_read(CPUARMState *env, const ARMCPRegInfo *ri) 4486 { 4487 return env->pstate & PSTATE_DIT; 4488 } 4489 4490 static void aa64_dit_write(CPUARMState *env, const ARMCPRegInfo *ri, 4491 uint64_t value) 4492 { 4493 env->pstate = (env->pstate & ~PSTATE_DIT) | (value & PSTATE_DIT); 4494 } 4495 4496 static const ARMCPRegInfo dit_reginfo = { 4497 .name = "DIT", .state = ARM_CP_STATE_AA64, 4498 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 5, 4499 .type = ARM_CP_NO_RAW, .access = PL0_RW, 4500 .readfn = aa64_dit_read, .writefn = aa64_dit_write 4501 }; 4502 4503 static uint64_t aa64_ssbs_read(CPUARMState *env, const ARMCPRegInfo *ri) 4504 { 4505 return env->pstate & PSTATE_SSBS; 4506 } 4507 4508 static void aa64_ssbs_write(CPUARMState *env, const ARMCPRegInfo *ri, 4509 uint64_t value) 4510 { 4511 env->pstate = (env->pstate & ~PSTATE_SSBS) | (value & PSTATE_SSBS); 4512 } 4513 4514 static const ARMCPRegInfo ssbs_reginfo = { 4515 .name = "SSBS", .state = ARM_CP_STATE_AA64, 4516 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 6, 4517 .type = ARM_CP_NO_RAW, .access = PL0_RW, 4518 .readfn = aa64_ssbs_read, .writefn = aa64_ssbs_write 4519 }; 4520 4521 static CPAccessResult aa64_cacheop_poc_access(CPUARMState *env, 4522 const ARMCPRegInfo *ri, 4523 bool isread) 4524 { 4525 /* Cache invalidate/clean to Point of Coherency or Persistence... */ 4526 switch (arm_current_el(env)) { 4527 case 0: 4528 /* ... EL0 must UNDEF unless SCTLR_EL1.UCI is set. */ 4529 if (!(arm_sctlr(env, 0) & SCTLR_UCI)) { 4530 return CP_ACCESS_TRAP; 4531 } 4532 /* fall through */ 4533 case 1: 4534 /* ... EL1 must trap to EL2 if HCR_EL2.TPCP is set. */ 4535 if (arm_hcr_el2_eff(env) & HCR_TPCP) { 4536 return CP_ACCESS_TRAP_EL2; 4537 } 4538 break; 4539 } 4540 return CP_ACCESS_OK; 4541 } 4542 4543 static CPAccessResult do_cacheop_pou_access(CPUARMState *env, uint64_t hcrflags) 4544 { 4545 /* Cache invalidate/clean to Point of Unification... */ 4546 switch (arm_current_el(env)) { 4547 case 0: 4548 /* ... EL0 must UNDEF unless SCTLR_EL1.UCI is set. */ 4549 if (!(arm_sctlr(env, 0) & SCTLR_UCI)) { 4550 return CP_ACCESS_TRAP; 4551 } 4552 /* fall through */ 4553 case 1: 4554 /* ... EL1 must trap to EL2 if relevant HCR_EL2 flags are set. */ 4555 if (arm_hcr_el2_eff(env) & hcrflags) { 4556 return CP_ACCESS_TRAP_EL2; 4557 } 4558 break; 4559 } 4560 return CP_ACCESS_OK; 4561 } 4562 4563 static CPAccessResult access_ticab(CPUARMState *env, const ARMCPRegInfo *ri, 4564 bool isread) 4565 { 4566 return do_cacheop_pou_access(env, HCR_TICAB | HCR_TPU); 4567 } 4568 4569 static CPAccessResult access_tocu(CPUARMState *env, const ARMCPRegInfo *ri, 4570 bool isread) 4571 { 4572 return do_cacheop_pou_access(env, HCR_TOCU | HCR_TPU); 4573 } 4574 4575 /* 4576 * See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions 4577 * Page D4-1736 (DDI0487A.b) 4578 */ 4579 4580 static int vae1_tlbmask(CPUARMState *env) 4581 { 4582 uint64_t hcr = arm_hcr_el2_eff(env); 4583 uint16_t mask; 4584 4585 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 4586 mask = ARMMMUIdxBit_E20_2 | 4587 ARMMMUIdxBit_E20_2_PAN | 4588 ARMMMUIdxBit_E20_0; 4589 } else { 4590 mask = ARMMMUIdxBit_E10_1 | 4591 ARMMMUIdxBit_E10_1_PAN | 4592 ARMMMUIdxBit_E10_0; 4593 } 4594 return mask; 4595 } 4596 4597 /* Return 56 if TBI is enabled, 64 otherwise. */ 4598 static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx, 4599 uint64_t addr) 4600 { 4601 uint64_t tcr = regime_tcr(env, mmu_idx); 4602 int tbi = aa64_va_parameter_tbi(tcr, mmu_idx); 4603 int select = extract64(addr, 55, 1); 4604 4605 return (tbi >> select) & 1 ? 56 : 64; 4606 } 4607 4608 static int vae1_tlbbits(CPUARMState *env, uint64_t addr) 4609 { 4610 uint64_t hcr = arm_hcr_el2_eff(env); 4611 ARMMMUIdx mmu_idx; 4612 4613 /* Only the regime of the mmu_idx below is significant. */ 4614 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 4615 mmu_idx = ARMMMUIdx_E20_0; 4616 } else { 4617 mmu_idx = ARMMMUIdx_E10_0; 4618 } 4619 4620 return tlbbits_for_regime(env, mmu_idx, addr); 4621 } 4622 4623 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4624 uint64_t value) 4625 { 4626 CPUState *cs = env_cpu(env); 4627 int mask = vae1_tlbmask(env); 4628 4629 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4630 } 4631 4632 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4633 uint64_t value) 4634 { 4635 CPUState *cs = env_cpu(env); 4636 int mask = vae1_tlbmask(env); 4637 4638 if (tlb_force_broadcast(env)) { 4639 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4640 } else { 4641 tlb_flush_by_mmuidx(cs, mask); 4642 } 4643 } 4644 4645 static int e2_tlbmask(CPUARMState *env) 4646 { 4647 return (ARMMMUIdxBit_E20_0 | 4648 ARMMMUIdxBit_E20_2 | 4649 ARMMMUIdxBit_E20_2_PAN | 4650 ARMMMUIdxBit_E2); 4651 } 4652 4653 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4654 uint64_t value) 4655 { 4656 CPUState *cs = env_cpu(env); 4657 int mask = alle1_tlbmask(env); 4658 4659 tlb_flush_by_mmuidx(cs, mask); 4660 } 4661 4662 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4663 uint64_t value) 4664 { 4665 CPUState *cs = env_cpu(env); 4666 int mask = e2_tlbmask(env); 4667 4668 tlb_flush_by_mmuidx(cs, mask); 4669 } 4670 4671 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri, 4672 uint64_t value) 4673 { 4674 ARMCPU *cpu = env_archcpu(env); 4675 CPUState *cs = CPU(cpu); 4676 4677 tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E3); 4678 } 4679 4680 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4681 uint64_t value) 4682 { 4683 CPUState *cs = env_cpu(env); 4684 int mask = alle1_tlbmask(env); 4685 4686 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4687 } 4688 4689 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4690 uint64_t value) 4691 { 4692 CPUState *cs = env_cpu(env); 4693 int mask = e2_tlbmask(env); 4694 4695 tlb_flush_by_mmuidx_all_cpus_synced(cs, mask); 4696 } 4697 4698 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4699 uint64_t value) 4700 { 4701 CPUState *cs = env_cpu(env); 4702 4703 tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E3); 4704 } 4705 4706 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4707 uint64_t value) 4708 { 4709 /* 4710 * Invalidate by VA, EL2 4711 * Currently handles both VAE2 and VALE2, since we don't support 4712 * flush-last-level-only. 4713 */ 4714 CPUState *cs = env_cpu(env); 4715 int mask = e2_tlbmask(env); 4716 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4717 4718 tlb_flush_page_by_mmuidx(cs, pageaddr, mask); 4719 } 4720 4721 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri, 4722 uint64_t value) 4723 { 4724 /* 4725 * Invalidate by VA, EL3 4726 * Currently handles both VAE3 and VALE3, since we don't support 4727 * flush-last-level-only. 4728 */ 4729 ARMCPU *cpu = env_archcpu(env); 4730 CPUState *cs = CPU(cpu); 4731 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4732 4733 tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E3); 4734 } 4735 4736 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4737 uint64_t value) 4738 { 4739 CPUState *cs = env_cpu(env); 4740 int mask = vae1_tlbmask(env); 4741 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4742 int bits = vae1_tlbbits(env, pageaddr); 4743 4744 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits); 4745 } 4746 4747 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4748 uint64_t value) 4749 { 4750 /* 4751 * Invalidate by VA, EL1&0 (AArch64 version). 4752 * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1, 4753 * since we don't support flush-for-specific-ASID-only or 4754 * flush-last-level-only. 4755 */ 4756 CPUState *cs = env_cpu(env); 4757 int mask = vae1_tlbmask(env); 4758 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4759 int bits = vae1_tlbbits(env, pageaddr); 4760 4761 if (tlb_force_broadcast(env)) { 4762 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits); 4763 } else { 4764 tlb_flush_page_bits_by_mmuidx(cs, pageaddr, mask, bits); 4765 } 4766 } 4767 4768 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4769 uint64_t value) 4770 { 4771 CPUState *cs = env_cpu(env); 4772 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4773 int bits = tlbbits_for_regime(env, ARMMMUIdx_E2, pageaddr); 4774 4775 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, 4776 ARMMMUIdxBit_E2, bits); 4777 } 4778 4779 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4780 uint64_t value) 4781 { 4782 CPUState *cs = env_cpu(env); 4783 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4784 int bits = tlbbits_for_regime(env, ARMMMUIdx_E3, pageaddr); 4785 4786 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, 4787 ARMMMUIdxBit_E3, bits); 4788 } 4789 4790 static int ipas2e1_tlbmask(CPUARMState *env, int64_t value) 4791 { 4792 /* 4793 * The MSB of value is the NS field, which only applies if SEL2 4794 * is implemented and SCR_EL3.NS is not set (i.e. in secure mode). 4795 */ 4796 return (value >= 0 4797 && cpu_isar_feature(aa64_sel2, env_archcpu(env)) 4798 && arm_is_secure_below_el3(env) 4799 ? ARMMMUIdxBit_Stage2_S 4800 : ARMMMUIdxBit_Stage2); 4801 } 4802 4803 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 4804 uint64_t value) 4805 { 4806 CPUState *cs = env_cpu(env); 4807 int mask = ipas2e1_tlbmask(env, value); 4808 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4809 4810 if (tlb_force_broadcast(env)) { 4811 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask); 4812 } else { 4813 tlb_flush_page_by_mmuidx(cs, pageaddr, mask); 4814 } 4815 } 4816 4817 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri, 4818 uint64_t value) 4819 { 4820 CPUState *cs = env_cpu(env); 4821 int mask = ipas2e1_tlbmask(env, value); 4822 uint64_t pageaddr = sextract64(value << 12, 0, 56); 4823 4824 tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask); 4825 } 4826 4827 #ifdef TARGET_AARCH64 4828 typedef struct { 4829 uint64_t base; 4830 uint64_t length; 4831 } TLBIRange; 4832 4833 static ARMGranuleSize tlbi_range_tg_to_gran_size(int tg) 4834 { 4835 /* 4836 * Note that the TLBI range TG field encoding differs from both 4837 * TG0 and TG1 encodings. 4838 */ 4839 switch (tg) { 4840 case 1: 4841 return Gran4K; 4842 case 2: 4843 return Gran16K; 4844 case 3: 4845 return Gran64K; 4846 default: 4847 return GranInvalid; 4848 } 4849 } 4850 4851 static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx, 4852 uint64_t value) 4853 { 4854 unsigned int page_size_granule, page_shift, num, scale, exponent; 4855 /* Extract one bit to represent the va selector in use. */ 4856 uint64_t select = sextract64(value, 36, 1); 4857 ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true); 4858 TLBIRange ret = { }; 4859 ARMGranuleSize gran; 4860 4861 page_size_granule = extract64(value, 46, 2); 4862 gran = tlbi_range_tg_to_gran_size(page_size_granule); 4863 4864 /* The granule encoded in value must match the granule in use. */ 4865 if (gran != param.gran) { 4866 qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n", 4867 page_size_granule); 4868 return ret; 4869 } 4870 4871 page_shift = arm_granule_bits(gran); 4872 num = extract64(value, 39, 5); 4873 scale = extract64(value, 44, 2); 4874 exponent = (5 * scale) + 1; 4875 4876 ret.length = (num + 1) << (exponent + page_shift); 4877 4878 if (param.select) { 4879 ret.base = sextract64(value, 0, 37); 4880 } else { 4881 ret.base = extract64(value, 0, 37); 4882 } 4883 if (param.ds) { 4884 /* 4885 * With DS=1, BaseADDR is always shifted 16 so that it is able 4886 * to address all 52 va bits. The input address is perforce 4887 * aligned on a 64k boundary regardless of translation granule. 4888 */ 4889 page_shift = 16; 4890 } 4891 ret.base <<= page_shift; 4892 4893 return ret; 4894 } 4895 4896 static void do_rvae_write(CPUARMState *env, uint64_t value, 4897 int idxmap, bool synced) 4898 { 4899 ARMMMUIdx one_idx = ARM_MMU_IDX_A | ctz32(idxmap); 4900 TLBIRange range; 4901 int bits; 4902 4903 range = tlbi_aa64_get_range(env, one_idx, value); 4904 bits = tlbbits_for_regime(env, one_idx, range.base); 4905 4906 if (synced) { 4907 tlb_flush_range_by_mmuidx_all_cpus_synced(env_cpu(env), 4908 range.base, 4909 range.length, 4910 idxmap, 4911 bits); 4912 } else { 4913 tlb_flush_range_by_mmuidx(env_cpu(env), range.base, 4914 range.length, idxmap, bits); 4915 } 4916 } 4917 4918 static void tlbi_aa64_rvae1_write(CPUARMState *env, 4919 const ARMCPRegInfo *ri, 4920 uint64_t value) 4921 { 4922 /* 4923 * Invalidate by VA range, EL1&0. 4924 * Currently handles all of RVAE1, RVAAE1, RVAALE1 and RVALE1, 4925 * since we don't support flush-for-specific-ASID-only or 4926 * flush-last-level-only. 4927 */ 4928 4929 do_rvae_write(env, value, vae1_tlbmask(env), 4930 tlb_force_broadcast(env)); 4931 } 4932 4933 static void tlbi_aa64_rvae1is_write(CPUARMState *env, 4934 const ARMCPRegInfo *ri, 4935 uint64_t value) 4936 { 4937 /* 4938 * Invalidate by VA range, Inner/Outer Shareable EL1&0. 4939 * Currently handles all of RVAE1IS, RVAE1OS, RVAAE1IS, RVAAE1OS, 4940 * RVAALE1IS, RVAALE1OS, RVALE1IS and RVALE1OS, since we don't support 4941 * flush-for-specific-ASID-only, flush-last-level-only or inner/outer 4942 * shareable specific flushes. 4943 */ 4944 4945 do_rvae_write(env, value, vae1_tlbmask(env), true); 4946 } 4947 4948 static int vae2_tlbmask(CPUARMState *env) 4949 { 4950 return ARMMMUIdxBit_E2; 4951 } 4952 4953 static void tlbi_aa64_rvae2_write(CPUARMState *env, 4954 const ARMCPRegInfo *ri, 4955 uint64_t value) 4956 { 4957 /* 4958 * Invalidate by VA range, EL2. 4959 * Currently handles all of RVAE2 and RVALE2, 4960 * since we don't support flush-for-specific-ASID-only or 4961 * flush-last-level-only. 4962 */ 4963 4964 do_rvae_write(env, value, vae2_tlbmask(env), 4965 tlb_force_broadcast(env)); 4966 4967 4968 } 4969 4970 static void tlbi_aa64_rvae2is_write(CPUARMState *env, 4971 const ARMCPRegInfo *ri, 4972 uint64_t value) 4973 { 4974 /* 4975 * Invalidate by VA range, Inner/Outer Shareable, EL2. 4976 * Currently handles all of RVAE2IS, RVAE2OS, RVALE2IS and RVALE2OS, 4977 * since we don't support flush-for-specific-ASID-only, 4978 * flush-last-level-only or inner/outer shareable specific flushes. 4979 */ 4980 4981 do_rvae_write(env, value, vae2_tlbmask(env), true); 4982 4983 } 4984 4985 static void tlbi_aa64_rvae3_write(CPUARMState *env, 4986 const ARMCPRegInfo *ri, 4987 uint64_t value) 4988 { 4989 /* 4990 * Invalidate by VA range, EL3. 4991 * Currently handles all of RVAE3 and RVALE3, 4992 * since we don't support flush-for-specific-ASID-only or 4993 * flush-last-level-only. 4994 */ 4995 4996 do_rvae_write(env, value, ARMMMUIdxBit_E3, tlb_force_broadcast(env)); 4997 } 4998 4999 static void tlbi_aa64_rvae3is_write(CPUARMState *env, 5000 const ARMCPRegInfo *ri, 5001 uint64_t value) 5002 { 5003 /* 5004 * Invalidate by VA range, EL3, Inner/Outer Shareable. 5005 * Currently handles all of RVAE3IS, RVAE3OS, RVALE3IS and RVALE3OS, 5006 * since we don't support flush-for-specific-ASID-only, 5007 * flush-last-level-only or inner/outer specific flushes. 5008 */ 5009 5010 do_rvae_write(env, value, ARMMMUIdxBit_E3, true); 5011 } 5012 5013 static void tlbi_aa64_ripas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri, 5014 uint64_t value) 5015 { 5016 do_rvae_write(env, value, ipas2e1_tlbmask(env, value), 5017 tlb_force_broadcast(env)); 5018 } 5019 5020 static void tlbi_aa64_ripas2e1is_write(CPUARMState *env, 5021 const ARMCPRegInfo *ri, 5022 uint64_t value) 5023 { 5024 do_rvae_write(env, value, ipas2e1_tlbmask(env, value), true); 5025 } 5026 #endif 5027 5028 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 5029 bool isread) 5030 { 5031 int cur_el = arm_current_el(env); 5032 5033 if (cur_el < 2) { 5034 uint64_t hcr = arm_hcr_el2_eff(env); 5035 5036 if (cur_el == 0) { 5037 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 5038 if (!(env->cp15.sctlr_el[2] & SCTLR_DZE)) { 5039 return CP_ACCESS_TRAP_EL2; 5040 } 5041 } else { 5042 if (!(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 5043 return CP_ACCESS_TRAP; 5044 } 5045 if (hcr & HCR_TDZ) { 5046 return CP_ACCESS_TRAP_EL2; 5047 } 5048 } 5049 } else if (hcr & HCR_TDZ) { 5050 return CP_ACCESS_TRAP_EL2; 5051 } 5052 } 5053 return CP_ACCESS_OK; 5054 } 5055 5056 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 5057 { 5058 ARMCPU *cpu = env_archcpu(env); 5059 int dzp_bit = 1 << 4; 5060 5061 /* DZP indicates whether DC ZVA access is allowed */ 5062 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 5063 dzp_bit = 0; 5064 } 5065 return cpu->dcz_blocksize | dzp_bit; 5066 } 5067 5068 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 5069 bool isread) 5070 { 5071 if (!(env->pstate & PSTATE_SP)) { 5072 /* 5073 * Access to SP_EL0 is undefined if it's being used as 5074 * the stack pointer. 5075 */ 5076 return CP_ACCESS_TRAP_UNCATEGORIZED; 5077 } 5078 return CP_ACCESS_OK; 5079 } 5080 5081 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 5082 { 5083 return env->pstate & PSTATE_SP; 5084 } 5085 5086 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 5087 { 5088 update_spsel(env, val); 5089 } 5090 5091 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5092 uint64_t value) 5093 { 5094 ARMCPU *cpu = env_archcpu(env); 5095 5096 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 5097 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 5098 value &= ~SCTLR_M; 5099 } 5100 5101 /* ??? Lots of these bits are not implemented. */ 5102 5103 if (ri->state == ARM_CP_STATE_AA64 && !cpu_isar_feature(aa64_mte, cpu)) { 5104 if (ri->opc1 == 6) { /* SCTLR_EL3 */ 5105 value &= ~(SCTLR_ITFSB | SCTLR_TCF | SCTLR_ATA); 5106 } else { 5107 value &= ~(SCTLR_ITFSB | SCTLR_TCF0 | SCTLR_TCF | 5108 SCTLR_ATA0 | SCTLR_ATA); 5109 } 5110 } 5111 5112 if (raw_read(env, ri) == value) { 5113 /* 5114 * Skip the TLB flush if nothing actually changed; Linux likes 5115 * to do a lot of pointless SCTLR writes. 5116 */ 5117 return; 5118 } 5119 5120 raw_write(env, ri, value); 5121 5122 /* This may enable/disable the MMU, so do a TLB flush. */ 5123 tlb_flush(CPU(cpu)); 5124 5125 if (ri->type & ARM_CP_SUPPRESS_TB_END) { 5126 /* 5127 * Normally we would always end the TB on an SCTLR write; see the 5128 * comment in ARMCPRegInfo sctlr initialization below for why Xscale 5129 * is special. Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild 5130 * of hflags from the translator, so do it here. 5131 */ 5132 arm_rebuild_hflags(env); 5133 } 5134 } 5135 5136 static void mdcr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri, 5137 uint64_t value) 5138 { 5139 /* 5140 * Some MDCR_EL3 bits affect whether PMU counters are running: 5141 * if we are trying to change any of those then we must 5142 * bracket this update with PMU start/finish calls. 5143 */ 5144 bool pmu_op = (env->cp15.mdcr_el3 ^ value) & MDCR_EL3_PMU_ENABLE_BITS; 5145 5146 if (pmu_op) { 5147 pmu_op_start(env); 5148 } 5149 env->cp15.mdcr_el3 = value; 5150 if (pmu_op) { 5151 pmu_op_finish(env); 5152 } 5153 } 5154 5155 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 5156 uint64_t value) 5157 { 5158 /* Not all bits defined for MDCR_EL3 exist in the AArch32 SDCR */ 5159 mdcr_el3_write(env, ri, value & SDCR_VALID_MASK); 5160 } 5161 5162 static void mdcr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 5163 uint64_t value) 5164 { 5165 /* 5166 * Some MDCR_EL2 bits affect whether PMU counters are running: 5167 * if we are trying to change any of those then we must 5168 * bracket this update with PMU start/finish calls. 5169 */ 5170 bool pmu_op = (env->cp15.mdcr_el2 ^ value) & MDCR_EL2_PMU_ENABLE_BITS; 5171 5172 if (pmu_op) { 5173 pmu_op_start(env); 5174 } 5175 env->cp15.mdcr_el2 = value; 5176 if (pmu_op) { 5177 pmu_op_finish(env); 5178 } 5179 } 5180 5181 static const ARMCPRegInfo v8_cp_reginfo[] = { 5182 /* 5183 * Minimal set of EL0-visible registers. This will need to be expanded 5184 * significantly for system emulation of AArch64 CPUs. 5185 */ 5186 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 5187 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 5188 .access = PL0_RW, .type = ARM_CP_NZCV }, 5189 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 5190 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 5191 .type = ARM_CP_NO_RAW, 5192 .access = PL0_RW, .accessfn = aa64_daif_access, 5193 .fieldoffset = offsetof(CPUARMState, daif), 5194 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 5195 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 5196 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 5197 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 5198 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 5199 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 5200 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 5201 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 5202 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 5203 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 5204 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 5205 .access = PL0_R, .type = ARM_CP_NO_RAW, 5206 .readfn = aa64_dczid_read }, 5207 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 5208 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 5209 .access = PL0_W, .type = ARM_CP_DC_ZVA, 5210 #ifndef CONFIG_USER_ONLY 5211 /* Avoid overhead of an access check that always passes in user-mode */ 5212 .accessfn = aa64_zva_access, 5213 #endif 5214 }, 5215 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 5216 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 5217 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 5218 /* Cache ops: all NOPs since we don't emulate caches */ 5219 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 5220 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 5221 .access = PL1_W, .type = ARM_CP_NOP, 5222 .accessfn = access_ticab }, 5223 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 5224 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 5225 .access = PL1_W, .type = ARM_CP_NOP, 5226 .accessfn = access_tocu }, 5227 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 5228 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 5229 .access = PL0_W, .type = ARM_CP_NOP, 5230 .accessfn = access_tocu }, 5231 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 5232 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 5233 .access = PL1_W, .accessfn = aa64_cacheop_poc_access, 5234 .type = ARM_CP_NOP }, 5235 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 5236 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 5237 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5238 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 5239 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 5240 .access = PL0_W, .type = ARM_CP_NOP, 5241 .accessfn = aa64_cacheop_poc_access }, 5242 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 5243 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 5244 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5245 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 5246 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 5247 .access = PL0_W, .type = ARM_CP_NOP, 5248 .accessfn = access_tocu }, 5249 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 5250 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 5251 .access = PL0_W, .type = ARM_CP_NOP, 5252 .accessfn = aa64_cacheop_poc_access }, 5253 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 5254 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 5255 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5256 /* TLBI operations */ 5257 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64, 5258 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0, 5259 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5260 .writefn = tlbi_aa64_vmalle1is_write }, 5261 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64, 5262 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1, 5263 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5264 .writefn = tlbi_aa64_vae1is_write }, 5265 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64, 5266 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2, 5267 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5268 .writefn = tlbi_aa64_vmalle1is_write }, 5269 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64, 5270 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3, 5271 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5272 .writefn = tlbi_aa64_vae1is_write }, 5273 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64, 5274 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 5275 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5276 .writefn = tlbi_aa64_vae1is_write }, 5277 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64, 5278 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 5279 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 5280 .writefn = tlbi_aa64_vae1is_write }, 5281 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64, 5282 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0, 5283 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5284 .writefn = tlbi_aa64_vmalle1_write }, 5285 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64, 5286 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1, 5287 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5288 .writefn = tlbi_aa64_vae1_write }, 5289 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64, 5290 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2, 5291 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5292 .writefn = tlbi_aa64_vmalle1_write }, 5293 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64, 5294 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3, 5295 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5296 .writefn = tlbi_aa64_vae1_write }, 5297 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64, 5298 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 5299 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5300 .writefn = tlbi_aa64_vae1_write }, 5301 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64, 5302 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 5303 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 5304 .writefn = tlbi_aa64_vae1_write }, 5305 { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64, 5306 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 5307 .access = PL2_W, .type = ARM_CP_NO_RAW, 5308 .writefn = tlbi_aa64_ipas2e1is_write }, 5309 { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64, 5310 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 5311 .access = PL2_W, .type = ARM_CP_NO_RAW, 5312 .writefn = tlbi_aa64_ipas2e1is_write }, 5313 { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64, 5314 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 5315 .access = PL2_W, .type = ARM_CP_NO_RAW, 5316 .writefn = tlbi_aa64_alle1is_write }, 5317 { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64, 5318 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6, 5319 .access = PL2_W, .type = ARM_CP_NO_RAW, 5320 .writefn = tlbi_aa64_alle1is_write }, 5321 { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64, 5322 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 5323 .access = PL2_W, .type = ARM_CP_NO_RAW, 5324 .writefn = tlbi_aa64_ipas2e1_write }, 5325 { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64, 5326 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 5327 .access = PL2_W, .type = ARM_CP_NO_RAW, 5328 .writefn = tlbi_aa64_ipas2e1_write }, 5329 { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64, 5330 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 5331 .access = PL2_W, .type = ARM_CP_NO_RAW, 5332 .writefn = tlbi_aa64_alle1_write }, 5333 { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64, 5334 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6, 5335 .access = PL2_W, .type = ARM_CP_NO_RAW, 5336 .writefn = tlbi_aa64_alle1is_write }, 5337 #ifndef CONFIG_USER_ONLY 5338 /* 64 bit address translation operations */ 5339 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 5340 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 5341 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5342 .writefn = ats_write64 }, 5343 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 5344 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 5345 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5346 .writefn = ats_write64 }, 5347 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 5348 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 5349 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5350 .writefn = ats_write64 }, 5351 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 5352 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 5353 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5354 .writefn = ats_write64 }, 5355 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 5356 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 5357 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5358 .writefn = ats_write64 }, 5359 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 5360 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 5361 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5362 .writefn = ats_write64 }, 5363 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 5364 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 5365 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5366 .writefn = ats_write64 }, 5367 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 5368 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 5369 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5370 .writefn = ats_write64 }, 5371 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 5372 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 5373 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 5374 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5375 .writefn = ats_write64 }, 5376 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 5377 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 5378 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5379 .writefn = ats_write64 }, 5380 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 5381 .type = ARM_CP_ALIAS, 5382 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 5383 .access = PL1_RW, .resetvalue = 0, 5384 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 5385 .writefn = par_write }, 5386 #endif 5387 /* TLB invalidate last level of translation table walk */ 5388 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5, 5389 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 5390 .writefn = tlbimva_is_write }, 5391 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7, 5392 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis, 5393 .writefn = tlbimvaa_is_write }, 5394 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5, 5395 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 5396 .writefn = tlbimva_write }, 5397 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7, 5398 .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb, 5399 .writefn = tlbimvaa_write }, 5400 { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 5401 .type = ARM_CP_NO_RAW, .access = PL2_W, 5402 .writefn = tlbimva_hyp_write }, 5403 { .name = "TLBIMVALHIS", 5404 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 5405 .type = ARM_CP_NO_RAW, .access = PL2_W, 5406 .writefn = tlbimva_hyp_is_write }, 5407 { .name = "TLBIIPAS2", 5408 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1, 5409 .type = ARM_CP_NO_RAW, .access = PL2_W, 5410 .writefn = tlbiipas2_hyp_write }, 5411 { .name = "TLBIIPAS2IS", 5412 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1, 5413 .type = ARM_CP_NO_RAW, .access = PL2_W, 5414 .writefn = tlbiipas2is_hyp_write }, 5415 { .name = "TLBIIPAS2L", 5416 .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5, 5417 .type = ARM_CP_NO_RAW, .access = PL2_W, 5418 .writefn = tlbiipas2_hyp_write }, 5419 { .name = "TLBIIPAS2LIS", 5420 .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5, 5421 .type = ARM_CP_NO_RAW, .access = PL2_W, 5422 .writefn = tlbiipas2is_hyp_write }, 5423 /* 32 bit cache operations */ 5424 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 5425 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_ticab }, 5426 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 5427 .type = ARM_CP_NOP, .access = PL1_W }, 5428 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 5429 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5430 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 5431 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5432 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 5433 .type = ARM_CP_NOP, .access = PL1_W }, 5434 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 5435 .type = ARM_CP_NOP, .access = PL1_W }, 5436 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 5437 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5438 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 5439 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5440 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 5441 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5442 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 5443 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5444 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 5445 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5446 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 5447 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5448 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 5449 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5450 /* MMU Domain access control / MPU write buffer control */ 5451 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 5452 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 5453 .writefn = dacr_write, .raw_writefn = raw_write, 5454 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 5455 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 5456 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 5457 .type = ARM_CP_ALIAS, 5458 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 5459 .access = PL1_RW, 5460 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 5461 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 5462 .type = ARM_CP_ALIAS, 5463 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 5464 .access = PL1_RW, 5465 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 5466 /* 5467 * We rely on the access checks not allowing the guest to write to the 5468 * state field when SPSel indicates that it's being used as the stack 5469 * pointer. 5470 */ 5471 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 5472 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 5473 .access = PL1_RW, .accessfn = sp_el0_access, 5474 .type = ARM_CP_ALIAS, 5475 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 5476 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 5477 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 5478 .access = PL2_RW, .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_KEEP, 5479 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 5480 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 5481 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 5482 .type = ARM_CP_NO_RAW, 5483 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 5484 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 5485 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 5486 .access = PL2_RW, 5487 .type = ARM_CP_ALIAS | ARM_CP_FPU | ARM_CP_EL3_NO_EL2_KEEP, 5488 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]) }, 5489 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 5490 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 5491 .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP, 5492 .writefn = dacr_write, .raw_writefn = raw_write, 5493 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 5494 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 5495 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 5496 .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP, 5497 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 5498 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 5499 .type = ARM_CP_ALIAS, 5500 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 5501 .access = PL2_RW, 5502 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 5503 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 5504 .type = ARM_CP_ALIAS, 5505 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 5506 .access = PL2_RW, 5507 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 5508 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 5509 .type = ARM_CP_ALIAS, 5510 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 5511 .access = PL2_RW, 5512 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 5513 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 5514 .type = ARM_CP_ALIAS, 5515 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 5516 .access = PL2_RW, 5517 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 5518 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 5519 .type = ARM_CP_IO, 5520 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 5521 .resetvalue = 0, 5522 .access = PL3_RW, 5523 .writefn = mdcr_el3_write, 5524 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 5525 { .name = "SDCR", .type = ARM_CP_ALIAS | ARM_CP_IO, 5526 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 5527 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5528 .writefn = sdcr_write, 5529 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 5530 }; 5531 5532 static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask) 5533 { 5534 ARMCPU *cpu = env_archcpu(env); 5535 5536 if (arm_feature(env, ARM_FEATURE_V8)) { 5537 valid_mask |= MAKE_64BIT_MASK(0, 34); /* ARMv8.0 */ 5538 } else { 5539 valid_mask |= MAKE_64BIT_MASK(0, 28); /* ARMv7VE */ 5540 } 5541 5542 if (arm_feature(env, ARM_FEATURE_EL3)) { 5543 valid_mask &= ~HCR_HCD; 5544 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 5545 /* 5546 * Architecturally HCR.TSC is RES0 if EL3 is not implemented. 5547 * However, if we're using the SMC PSCI conduit then QEMU is 5548 * effectively acting like EL3 firmware and so the guest at 5549 * EL2 should retain the ability to prevent EL1 from being 5550 * able to make SMC calls into the ersatz firmware, so in 5551 * that case HCR.TSC should be read/write. 5552 */ 5553 valid_mask &= ~HCR_TSC; 5554 } 5555 5556 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 5557 if (cpu_isar_feature(aa64_vh, cpu)) { 5558 valid_mask |= HCR_E2H; 5559 } 5560 if (cpu_isar_feature(aa64_ras, cpu)) { 5561 valid_mask |= HCR_TERR | HCR_TEA; 5562 } 5563 if (cpu_isar_feature(aa64_lor, cpu)) { 5564 valid_mask |= HCR_TLOR; 5565 } 5566 if (cpu_isar_feature(aa64_pauth, cpu)) { 5567 valid_mask |= HCR_API | HCR_APK; 5568 } 5569 if (cpu_isar_feature(aa64_mte, cpu)) { 5570 valid_mask |= HCR_ATA | HCR_DCT | HCR_TID5; 5571 } 5572 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 5573 valid_mask |= HCR_ENSCXT; 5574 } 5575 if (cpu_isar_feature(aa64_fwb, cpu)) { 5576 valid_mask |= HCR_FWB; 5577 } 5578 } 5579 5580 if (cpu_isar_feature(any_evt, cpu)) { 5581 valid_mask |= HCR_TTLBIS | HCR_TTLBOS | HCR_TICAB | HCR_TOCU | HCR_TID4; 5582 } else if (cpu_isar_feature(any_half_evt, cpu)) { 5583 valid_mask |= HCR_TICAB | HCR_TOCU | HCR_TID4; 5584 } 5585 5586 /* Clear RES0 bits. */ 5587 value &= valid_mask; 5588 5589 /* 5590 * These bits change the MMU setup: 5591 * HCR_VM enables stage 2 translation 5592 * HCR_PTW forbids certain page-table setups 5593 * HCR_DC disables stage1 and enables stage2 translation 5594 * HCR_DCT enables tagging on (disabled) stage1 translation 5595 * HCR_FWB changes the interpretation of stage2 descriptor bits 5596 */ 5597 if ((env->cp15.hcr_el2 ^ value) & 5598 (HCR_VM | HCR_PTW | HCR_DC | HCR_DCT | HCR_FWB)) { 5599 tlb_flush(CPU(cpu)); 5600 } 5601 env->cp15.hcr_el2 = value; 5602 5603 /* 5604 * Updates to VI and VF require us to update the status of 5605 * virtual interrupts, which are the logical OR of these bits 5606 * and the state of the input lines from the GIC. (This requires 5607 * that we have the iothread lock, which is done by marking the 5608 * reginfo structs as ARM_CP_IO.) 5609 * Note that if a write to HCR pends a VIRQ or VFIQ it is never 5610 * possible for it to be taken immediately, because VIRQ and 5611 * VFIQ are masked unless running at EL0 or EL1, and HCR 5612 * can only be written at EL2. 5613 */ 5614 g_assert(qemu_mutex_iothread_locked()); 5615 arm_cpu_update_virq(cpu); 5616 arm_cpu_update_vfiq(cpu); 5617 arm_cpu_update_vserr(cpu); 5618 } 5619 5620 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 5621 { 5622 do_hcr_write(env, value, 0); 5623 } 5624 5625 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 5626 uint64_t value) 5627 { 5628 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 5629 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 5630 do_hcr_write(env, value, MAKE_64BIT_MASK(0, 32)); 5631 } 5632 5633 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 5634 uint64_t value) 5635 { 5636 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 5637 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 5638 do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32)); 5639 } 5640 5641 /* 5642 * Return the effective value of HCR_EL2, at the given security state. 5643 * Bits that are not included here: 5644 * RW (read from SCR_EL3.RW as needed) 5645 */ 5646 uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure) 5647 { 5648 uint64_t ret = env->cp15.hcr_el2; 5649 5650 if (!arm_is_el2_enabled_secstate(env, secure)) { 5651 /* 5652 * "This register has no effect if EL2 is not enabled in the 5653 * current Security state". This is ARMv8.4-SecEL2 speak for 5654 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 5655 * 5656 * Prior to that, the language was "In an implementation that 5657 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 5658 * as if this field is 0 for all purposes other than a direct 5659 * read or write access of HCR_EL2". With lots of enumeration 5660 * on a per-field basis. In current QEMU, this is condition 5661 * is arm_is_secure_below_el3. 5662 * 5663 * Since the v8.4 language applies to the entire register, and 5664 * appears to be backward compatible, use that. 5665 */ 5666 return 0; 5667 } 5668 5669 /* 5670 * For a cpu that supports both aarch64 and aarch32, we can set bits 5671 * in HCR_EL2 (e.g. via EL3) that are RES0 when we enter EL2 as aa32. 5672 * Ignore all of the bits in HCR+HCR2 that are not valid for aarch32. 5673 */ 5674 if (!arm_el_is_aa64(env, 2)) { 5675 uint64_t aa32_valid; 5676 5677 /* 5678 * These bits are up-to-date as of ARMv8.6. 5679 * For HCR, it's easiest to list just the 2 bits that are invalid. 5680 * For HCR2, list those that are valid. 5681 */ 5682 aa32_valid = MAKE_64BIT_MASK(0, 32) & ~(HCR_RW | HCR_TDZ); 5683 aa32_valid |= (HCR_CD | HCR_ID | HCR_TERR | HCR_TEA | HCR_MIOCNCE | 5684 HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_TTLBIS); 5685 ret &= aa32_valid; 5686 } 5687 5688 if (ret & HCR_TGE) { 5689 /* These bits are up-to-date as of ARMv8.6. */ 5690 if (ret & HCR_E2H) { 5691 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 5692 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 5693 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 5694 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE | 5695 HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_ENSCXT | 5696 HCR_TTLBIS | HCR_TTLBOS | HCR_TID5); 5697 } else { 5698 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 5699 } 5700 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 5701 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 5702 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 5703 HCR_TLOR); 5704 } 5705 5706 return ret; 5707 } 5708 5709 uint64_t arm_hcr_el2_eff(CPUARMState *env) 5710 { 5711 return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env)); 5712 } 5713 5714 /* 5715 * Corresponds to ARM pseudocode function ELIsInHost(). 5716 */ 5717 bool el_is_in_host(CPUARMState *env, int el) 5718 { 5719 uint64_t mask; 5720 5721 /* 5722 * Since we only care about E2H and TGE, we can skip arm_hcr_el2_eff(). 5723 * Perform the simplest bit tests first, and validate EL2 afterward. 5724 */ 5725 if (el & 1) { 5726 return false; /* EL1 or EL3 */ 5727 } 5728 5729 /* 5730 * Note that hcr_write() checks isar_feature_aa64_vh(), 5731 * aka HaveVirtHostExt(), in allowing HCR_E2H to be set. 5732 */ 5733 mask = el ? HCR_E2H : HCR_E2H | HCR_TGE; 5734 if ((env->cp15.hcr_el2 & mask) != mask) { 5735 return false; 5736 } 5737 5738 /* TGE and/or E2H set: double check those bits are currently legal. */ 5739 return arm_is_el2_enabled(env) && arm_el_is_aa64(env, 2); 5740 } 5741 5742 static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri, 5743 uint64_t value) 5744 { 5745 uint64_t valid_mask = 0; 5746 5747 /* No features adding bits to HCRX are implemented. */ 5748 5749 /* Clear RES0 bits. */ 5750 env->cp15.hcrx_el2 = value & valid_mask; 5751 } 5752 5753 static CPAccessResult access_hxen(CPUARMState *env, const ARMCPRegInfo *ri, 5754 bool isread) 5755 { 5756 if (arm_current_el(env) < 3 5757 && arm_feature(env, ARM_FEATURE_EL3) 5758 && !(env->cp15.scr_el3 & SCR_HXEN)) { 5759 return CP_ACCESS_TRAP_EL3; 5760 } 5761 return CP_ACCESS_OK; 5762 } 5763 5764 static const ARMCPRegInfo hcrx_el2_reginfo = { 5765 .name = "HCRX_EL2", .state = ARM_CP_STATE_AA64, 5766 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 2, 5767 .access = PL2_RW, .writefn = hcrx_write, .accessfn = access_hxen, 5768 .fieldoffset = offsetof(CPUARMState, cp15.hcrx_el2), 5769 }; 5770 5771 /* Return the effective value of HCRX_EL2. */ 5772 uint64_t arm_hcrx_el2_eff(CPUARMState *env) 5773 { 5774 /* 5775 * The bits in this register behave as 0 for all purposes other than 5776 * direct reads of the register if: 5777 * - EL2 is not enabled in the current security state, 5778 * - SCR_EL3.HXEn is 0. 5779 */ 5780 if (!arm_is_el2_enabled(env) 5781 || (arm_feature(env, ARM_FEATURE_EL3) 5782 && !(env->cp15.scr_el3 & SCR_HXEN))) { 5783 return 0; 5784 } 5785 return env->cp15.hcrx_el2; 5786 } 5787 5788 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 5789 uint64_t value) 5790 { 5791 /* 5792 * For A-profile AArch32 EL3, if NSACR.CP10 5793 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 5794 */ 5795 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 5796 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 5797 uint64_t mask = R_HCPTR_TCP11_MASK | R_HCPTR_TCP10_MASK; 5798 value = (value & ~mask) | (env->cp15.cptr_el[2] & mask); 5799 } 5800 env->cp15.cptr_el[2] = value; 5801 } 5802 5803 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri) 5804 { 5805 /* 5806 * For A-profile AArch32 EL3, if NSACR.CP10 5807 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 5808 */ 5809 uint64_t value = env->cp15.cptr_el[2]; 5810 5811 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 5812 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 5813 value |= R_HCPTR_TCP11_MASK | R_HCPTR_TCP10_MASK; 5814 } 5815 return value; 5816 } 5817 5818 static const ARMCPRegInfo el2_cp_reginfo[] = { 5819 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 5820 .type = ARM_CP_IO, 5821 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 5822 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 5823 .writefn = hcr_write }, 5824 { .name = "HCR", .state = ARM_CP_STATE_AA32, 5825 .type = ARM_CP_ALIAS | ARM_CP_IO, 5826 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 5827 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 5828 .writefn = hcr_writelow }, 5829 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 5830 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 5831 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5832 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 5833 .type = ARM_CP_ALIAS, 5834 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 5835 .access = PL2_RW, 5836 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 5837 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 5838 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 5839 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 5840 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 5841 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 5842 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 5843 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 5844 .type = ARM_CP_ALIAS, 5845 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 5846 .access = PL2_RW, 5847 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 5848 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 5849 .type = ARM_CP_ALIAS, 5850 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 5851 .access = PL2_RW, 5852 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 5853 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 5854 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 5855 .access = PL2_RW, .writefn = vbar_write, 5856 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 5857 .resetvalue = 0 }, 5858 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 5859 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 5860 .access = PL3_RW, .type = ARM_CP_ALIAS, 5861 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 5862 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 5863 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 5864 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 5865 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]), 5866 .readfn = cptr_el2_read, .writefn = cptr_el2_write }, 5867 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 5868 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 5869 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 5870 .resetvalue = 0 }, 5871 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 5872 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 5873 .access = PL2_RW, .type = ARM_CP_ALIAS, 5874 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 5875 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 5876 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 5877 .access = PL2_RW, .type = ARM_CP_CONST, 5878 .resetvalue = 0 }, 5879 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 5880 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 5881 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 5882 .access = PL2_RW, .type = ARM_CP_CONST, 5883 .resetvalue = 0 }, 5884 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 5885 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 5886 .access = PL2_RW, .type = ARM_CP_CONST, 5887 .resetvalue = 0 }, 5888 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 5889 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 5890 .access = PL2_RW, .type = ARM_CP_CONST, 5891 .resetvalue = 0 }, 5892 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 5893 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 5894 .access = PL2_RW, .writefn = vmsa_tcr_el12_write, 5895 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 5896 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 5897 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 5898 .type = ARM_CP_ALIAS, 5899 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5900 .fieldoffset = offsetoflow32(CPUARMState, cp15.vtcr_el2) }, 5901 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 5902 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 5903 .access = PL2_RW, 5904 /* no .writefn needed as this can't cause an ASID change */ 5905 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 5906 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 5907 .cp = 15, .opc1 = 6, .crm = 2, 5908 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 5909 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5910 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 5911 .writefn = vttbr_write }, 5912 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 5913 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 5914 .access = PL2_RW, .writefn = vttbr_write, 5915 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 5916 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 5917 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 5918 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 5919 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 5920 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 5921 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 5922 .access = PL2_RW, .resetvalue = 0, 5923 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 5924 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 5925 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 5926 .access = PL2_RW, .resetvalue = 0, .writefn = vmsa_tcr_ttbr_el2_write, 5927 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 5928 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 5929 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 5930 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 5931 { .name = "TLBIALLNSNH", 5932 .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4, 5933 .type = ARM_CP_NO_RAW, .access = PL2_W, 5934 .writefn = tlbiall_nsnh_write }, 5935 { .name = "TLBIALLNSNHIS", 5936 .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4, 5937 .type = ARM_CP_NO_RAW, .access = PL2_W, 5938 .writefn = tlbiall_nsnh_is_write }, 5939 { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 5940 .type = ARM_CP_NO_RAW, .access = PL2_W, 5941 .writefn = tlbiall_hyp_write }, 5942 { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 5943 .type = ARM_CP_NO_RAW, .access = PL2_W, 5944 .writefn = tlbiall_hyp_is_write }, 5945 { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 5946 .type = ARM_CP_NO_RAW, .access = PL2_W, 5947 .writefn = tlbimva_hyp_write }, 5948 { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 5949 .type = ARM_CP_NO_RAW, .access = PL2_W, 5950 .writefn = tlbimva_hyp_is_write }, 5951 { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64, 5952 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0, 5953 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 5954 .writefn = tlbi_aa64_alle2_write }, 5955 { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64, 5956 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1, 5957 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 5958 .writefn = tlbi_aa64_vae2_write }, 5959 { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64, 5960 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5, 5961 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 5962 .writefn = tlbi_aa64_vae2_write }, 5963 { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64, 5964 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0, 5965 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 5966 .writefn = tlbi_aa64_alle2is_write }, 5967 { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64, 5968 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1, 5969 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 5970 .writefn = tlbi_aa64_vae2is_write }, 5971 { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64, 5972 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5, 5973 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 5974 .writefn = tlbi_aa64_vae2is_write }, 5975 #ifndef CONFIG_USER_ONLY 5976 /* 5977 * Unlike the other EL2-related AT operations, these must 5978 * UNDEF from EL3 if EL2 is not implemented, which is why we 5979 * define them here rather than with the rest of the AT ops. 5980 */ 5981 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 5982 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 5983 .access = PL2_W, .accessfn = at_s1e2_access, 5984 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF, 5985 .writefn = ats_write64 }, 5986 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 5987 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 5988 .access = PL2_W, .accessfn = at_s1e2_access, 5989 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF, 5990 .writefn = ats_write64 }, 5991 /* 5992 * The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 5993 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 5994 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 5995 * to behave as if SCR.NS was 1. 5996 */ 5997 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 5998 .access = PL2_W, 5999 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 6000 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 6001 .access = PL2_W, 6002 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 6003 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 6004 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 6005 /* 6006 * ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 6007 * reset values as IMPDEF. We choose to reset to 3 to comply with 6008 * both ARMv7 and ARMv8. 6009 */ 6010 .access = PL2_RW, .resetvalue = 3, 6011 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 6012 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 6013 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 6014 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 6015 .writefn = gt_cntvoff_write, 6016 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 6017 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 6018 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 6019 .writefn = gt_cntvoff_write, 6020 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 6021 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 6022 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 6023 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 6024 .type = ARM_CP_IO, .access = PL2_RW, 6025 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 6026 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 6027 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 6028 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 6029 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 6030 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 6031 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 6032 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 6033 .resetfn = gt_hyp_timer_reset, 6034 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 6035 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 6036 .type = ARM_CP_IO, 6037 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 6038 .access = PL2_RW, 6039 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 6040 .resetvalue = 0, 6041 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 6042 #endif 6043 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 6044 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 6045 .access = PL2_RW, .accessfn = access_el3_aa32ns, 6046 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 6047 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 6048 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 6049 .access = PL2_RW, 6050 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 6051 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 6052 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 6053 .access = PL2_RW, 6054 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 6055 }; 6056 6057 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 6058 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 6059 .type = ARM_CP_ALIAS | ARM_CP_IO, 6060 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 6061 .access = PL2_RW, 6062 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 6063 .writefn = hcr_writehigh }, 6064 }; 6065 6066 static CPAccessResult sel2_access(CPUARMState *env, const ARMCPRegInfo *ri, 6067 bool isread) 6068 { 6069 if (arm_current_el(env) == 3 || arm_is_secure_below_el3(env)) { 6070 return CP_ACCESS_OK; 6071 } 6072 return CP_ACCESS_TRAP_UNCATEGORIZED; 6073 } 6074 6075 static const ARMCPRegInfo el2_sec_cp_reginfo[] = { 6076 { .name = "VSTTBR_EL2", .state = ARM_CP_STATE_AA64, 6077 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 0, 6078 .access = PL2_RW, .accessfn = sel2_access, 6079 .fieldoffset = offsetof(CPUARMState, cp15.vsttbr_el2) }, 6080 { .name = "VSTCR_EL2", .state = ARM_CP_STATE_AA64, 6081 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2, 6082 .access = PL2_RW, .accessfn = sel2_access, 6083 .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) }, 6084 }; 6085 6086 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 6087 bool isread) 6088 { 6089 /* 6090 * The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 6091 * At Secure EL1 it traps to EL3 or EL2. 6092 */ 6093 if (arm_current_el(env) == 3) { 6094 return CP_ACCESS_OK; 6095 } 6096 if (arm_is_secure_below_el3(env)) { 6097 if (env->cp15.scr_el3 & SCR_EEL2) { 6098 return CP_ACCESS_TRAP_EL2; 6099 } 6100 return CP_ACCESS_TRAP_EL3; 6101 } 6102 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 6103 if (isread) { 6104 return CP_ACCESS_OK; 6105 } 6106 return CP_ACCESS_TRAP_UNCATEGORIZED; 6107 } 6108 6109 static const ARMCPRegInfo el3_cp_reginfo[] = { 6110 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 6111 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 6112 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 6113 .resetfn = scr_reset, .writefn = scr_write }, 6114 { .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL, 6115 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 6116 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 6117 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 6118 .writefn = scr_write }, 6119 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 6120 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 6121 .access = PL3_RW, .resetvalue = 0, 6122 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 6123 { .name = "SDER", 6124 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 6125 .access = PL3_RW, .resetvalue = 0, 6126 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 6127 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 6128 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 6129 .writefn = vbar_write, .resetvalue = 0, 6130 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 6131 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 6132 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 6133 .access = PL3_RW, .resetvalue = 0, 6134 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 6135 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 6136 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 6137 .access = PL3_RW, 6138 /* no .writefn needed as this can't cause an ASID change */ 6139 .resetvalue = 0, 6140 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 6141 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 6142 .type = ARM_CP_ALIAS, 6143 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 6144 .access = PL3_RW, 6145 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 6146 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 6147 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 6148 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 6149 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 6150 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 6151 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 6152 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 6153 .type = ARM_CP_ALIAS, 6154 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 6155 .access = PL3_RW, 6156 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 6157 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 6158 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 6159 .access = PL3_RW, .writefn = vbar_write, 6160 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 6161 .resetvalue = 0 }, 6162 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 6163 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 6164 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 6165 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 6166 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 6167 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 6168 .access = PL3_RW, .resetvalue = 0, 6169 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 6170 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 6171 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 6172 .access = PL3_RW, .type = ARM_CP_CONST, 6173 .resetvalue = 0 }, 6174 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 6175 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 6176 .access = PL3_RW, .type = ARM_CP_CONST, 6177 .resetvalue = 0 }, 6178 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 6179 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 6180 .access = PL3_RW, .type = ARM_CP_CONST, 6181 .resetvalue = 0 }, 6182 { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64, 6183 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0, 6184 .access = PL3_W, .type = ARM_CP_NO_RAW, 6185 .writefn = tlbi_aa64_alle3is_write }, 6186 { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64, 6187 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1, 6188 .access = PL3_W, .type = ARM_CP_NO_RAW, 6189 .writefn = tlbi_aa64_vae3is_write }, 6190 { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64, 6191 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5, 6192 .access = PL3_W, .type = ARM_CP_NO_RAW, 6193 .writefn = tlbi_aa64_vae3is_write }, 6194 { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64, 6195 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0, 6196 .access = PL3_W, .type = ARM_CP_NO_RAW, 6197 .writefn = tlbi_aa64_alle3_write }, 6198 { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64, 6199 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1, 6200 .access = PL3_W, .type = ARM_CP_NO_RAW, 6201 .writefn = tlbi_aa64_vae3_write }, 6202 { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64, 6203 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5, 6204 .access = PL3_W, .type = ARM_CP_NO_RAW, 6205 .writefn = tlbi_aa64_vae3_write }, 6206 }; 6207 6208 #ifndef CONFIG_USER_ONLY 6209 /* Test if system register redirection is to occur in the current state. */ 6210 static bool redirect_for_e2h(CPUARMState *env) 6211 { 6212 return arm_current_el(env) == 2 && (arm_hcr_el2_eff(env) & HCR_E2H); 6213 } 6214 6215 static uint64_t el2_e2h_read(CPUARMState *env, const ARMCPRegInfo *ri) 6216 { 6217 CPReadFn *readfn; 6218 6219 if (redirect_for_e2h(env)) { 6220 /* Switch to the saved EL2 version of the register. */ 6221 ri = ri->opaque; 6222 readfn = ri->readfn; 6223 } else { 6224 readfn = ri->orig_readfn; 6225 } 6226 if (readfn == NULL) { 6227 readfn = raw_read; 6228 } 6229 return readfn(env, ri); 6230 } 6231 6232 static void el2_e2h_write(CPUARMState *env, const ARMCPRegInfo *ri, 6233 uint64_t value) 6234 { 6235 CPWriteFn *writefn; 6236 6237 if (redirect_for_e2h(env)) { 6238 /* Switch to the saved EL2 version of the register. */ 6239 ri = ri->opaque; 6240 writefn = ri->writefn; 6241 } else { 6242 writefn = ri->orig_writefn; 6243 } 6244 if (writefn == NULL) { 6245 writefn = raw_write; 6246 } 6247 writefn(env, ri, value); 6248 } 6249 6250 static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu) 6251 { 6252 struct E2HAlias { 6253 uint32_t src_key, dst_key, new_key; 6254 const char *src_name, *dst_name, *new_name; 6255 bool (*feature)(const ARMISARegisters *id); 6256 }; 6257 6258 #define K(op0, op1, crn, crm, op2) \ 6259 ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2) 6260 6261 static const struct E2HAlias aliases[] = { 6262 { K(3, 0, 1, 0, 0), K(3, 4, 1, 0, 0), K(3, 5, 1, 0, 0), 6263 "SCTLR", "SCTLR_EL2", "SCTLR_EL12" }, 6264 { K(3, 0, 1, 0, 2), K(3, 4, 1, 1, 2), K(3, 5, 1, 0, 2), 6265 "CPACR", "CPTR_EL2", "CPACR_EL12" }, 6266 { K(3, 0, 2, 0, 0), K(3, 4, 2, 0, 0), K(3, 5, 2, 0, 0), 6267 "TTBR0_EL1", "TTBR0_EL2", "TTBR0_EL12" }, 6268 { K(3, 0, 2, 0, 1), K(3, 4, 2, 0, 1), K(3, 5, 2, 0, 1), 6269 "TTBR1_EL1", "TTBR1_EL2", "TTBR1_EL12" }, 6270 { K(3, 0, 2, 0, 2), K(3, 4, 2, 0, 2), K(3, 5, 2, 0, 2), 6271 "TCR_EL1", "TCR_EL2", "TCR_EL12" }, 6272 { K(3, 0, 4, 0, 0), K(3, 4, 4, 0, 0), K(3, 5, 4, 0, 0), 6273 "SPSR_EL1", "SPSR_EL2", "SPSR_EL12" }, 6274 { K(3, 0, 4, 0, 1), K(3, 4, 4, 0, 1), K(3, 5, 4, 0, 1), 6275 "ELR_EL1", "ELR_EL2", "ELR_EL12" }, 6276 { K(3, 0, 5, 1, 0), K(3, 4, 5, 1, 0), K(3, 5, 5, 1, 0), 6277 "AFSR0_EL1", "AFSR0_EL2", "AFSR0_EL12" }, 6278 { K(3, 0, 5, 1, 1), K(3, 4, 5, 1, 1), K(3, 5, 5, 1, 1), 6279 "AFSR1_EL1", "AFSR1_EL2", "AFSR1_EL12" }, 6280 { K(3, 0, 5, 2, 0), K(3, 4, 5, 2, 0), K(3, 5, 5, 2, 0), 6281 "ESR_EL1", "ESR_EL2", "ESR_EL12" }, 6282 { K(3, 0, 6, 0, 0), K(3, 4, 6, 0, 0), K(3, 5, 6, 0, 0), 6283 "FAR_EL1", "FAR_EL2", "FAR_EL12" }, 6284 { K(3, 0, 10, 2, 0), K(3, 4, 10, 2, 0), K(3, 5, 10, 2, 0), 6285 "MAIR_EL1", "MAIR_EL2", "MAIR_EL12" }, 6286 { K(3, 0, 10, 3, 0), K(3, 4, 10, 3, 0), K(3, 5, 10, 3, 0), 6287 "AMAIR0", "AMAIR_EL2", "AMAIR_EL12" }, 6288 { K(3, 0, 12, 0, 0), K(3, 4, 12, 0, 0), K(3, 5, 12, 0, 0), 6289 "VBAR", "VBAR_EL2", "VBAR_EL12" }, 6290 { K(3, 0, 13, 0, 1), K(3, 4, 13, 0, 1), K(3, 5, 13, 0, 1), 6291 "CONTEXTIDR_EL1", "CONTEXTIDR_EL2", "CONTEXTIDR_EL12" }, 6292 { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0), 6293 "CNTKCTL", "CNTHCTL_EL2", "CNTKCTL_EL12" }, 6294 6295 /* 6296 * Note that redirection of ZCR is mentioned in the description 6297 * of ZCR_EL2, and aliasing in the description of ZCR_EL1, but 6298 * not in the summary table. 6299 */ 6300 { K(3, 0, 1, 2, 0), K(3, 4, 1, 2, 0), K(3, 5, 1, 2, 0), 6301 "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve }, 6302 { K(3, 0, 1, 2, 6), K(3, 4, 1, 2, 6), K(3, 5, 1, 2, 6), 6303 "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme }, 6304 6305 { K(3, 0, 5, 6, 0), K(3, 4, 5, 6, 0), K(3, 5, 5, 6, 0), 6306 "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte }, 6307 6308 { K(3, 0, 13, 0, 7), K(3, 4, 13, 0, 7), K(3, 5, 13, 0, 7), 6309 "SCXTNUM_EL1", "SCXTNUM_EL2", "SCXTNUM_EL12", 6310 isar_feature_aa64_scxtnum }, 6311 6312 /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */ 6313 /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */ 6314 }; 6315 #undef K 6316 6317 size_t i; 6318 6319 for (i = 0; i < ARRAY_SIZE(aliases); i++) { 6320 const struct E2HAlias *a = &aliases[i]; 6321 ARMCPRegInfo *src_reg, *dst_reg, *new_reg; 6322 bool ok; 6323 6324 if (a->feature && !a->feature(&cpu->isar)) { 6325 continue; 6326 } 6327 6328 src_reg = g_hash_table_lookup(cpu->cp_regs, 6329 (gpointer)(uintptr_t)a->src_key); 6330 dst_reg = g_hash_table_lookup(cpu->cp_regs, 6331 (gpointer)(uintptr_t)a->dst_key); 6332 g_assert(src_reg != NULL); 6333 g_assert(dst_reg != NULL); 6334 6335 /* Cross-compare names to detect typos in the keys. */ 6336 g_assert(strcmp(src_reg->name, a->src_name) == 0); 6337 g_assert(strcmp(dst_reg->name, a->dst_name) == 0); 6338 6339 /* None of the core system registers use opaque; we will. */ 6340 g_assert(src_reg->opaque == NULL); 6341 6342 /* Create alias before redirection so we dup the right data. */ 6343 new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo)); 6344 6345 new_reg->name = a->new_name; 6346 new_reg->type |= ARM_CP_ALIAS; 6347 /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place. */ 6348 new_reg->access &= PL2_RW | PL3_RW; 6349 6350 ok = g_hash_table_insert(cpu->cp_regs, 6351 (gpointer)(uintptr_t)a->new_key, new_reg); 6352 g_assert(ok); 6353 6354 src_reg->opaque = dst_reg; 6355 src_reg->orig_readfn = src_reg->readfn ?: raw_read; 6356 src_reg->orig_writefn = src_reg->writefn ?: raw_write; 6357 if (!src_reg->raw_readfn) { 6358 src_reg->raw_readfn = raw_read; 6359 } 6360 if (!src_reg->raw_writefn) { 6361 src_reg->raw_writefn = raw_write; 6362 } 6363 src_reg->readfn = el2_e2h_read; 6364 src_reg->writefn = el2_e2h_write; 6365 } 6366 } 6367 #endif 6368 6369 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 6370 bool isread) 6371 { 6372 int cur_el = arm_current_el(env); 6373 6374 if (cur_el < 2) { 6375 uint64_t hcr = arm_hcr_el2_eff(env); 6376 6377 if (cur_el == 0) { 6378 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 6379 if (!(env->cp15.sctlr_el[2] & SCTLR_UCT)) { 6380 return CP_ACCESS_TRAP_EL2; 6381 } 6382 } else { 6383 if (!(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 6384 return CP_ACCESS_TRAP; 6385 } 6386 if (hcr & HCR_TID2) { 6387 return CP_ACCESS_TRAP_EL2; 6388 } 6389 } 6390 } else if (hcr & HCR_TID2) { 6391 return CP_ACCESS_TRAP_EL2; 6392 } 6393 } 6394 6395 if (arm_current_el(env) < 2 && arm_hcr_el2_eff(env) & HCR_TID2) { 6396 return CP_ACCESS_TRAP_EL2; 6397 } 6398 6399 return CP_ACCESS_OK; 6400 } 6401 6402 /* 6403 * Check for traps to RAS registers, which are controlled 6404 * by HCR_EL2.TERR and SCR_EL3.TERR. 6405 */ 6406 static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri, 6407 bool isread) 6408 { 6409 int el = arm_current_el(env); 6410 6411 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) { 6412 return CP_ACCESS_TRAP_EL2; 6413 } 6414 if (el < 3 && (env->cp15.scr_el3 & SCR_TERR)) { 6415 return CP_ACCESS_TRAP_EL3; 6416 } 6417 return CP_ACCESS_OK; 6418 } 6419 6420 static uint64_t disr_read(CPUARMState *env, const ARMCPRegInfo *ri) 6421 { 6422 int el = arm_current_el(env); 6423 6424 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) { 6425 return env->cp15.vdisr_el2; 6426 } 6427 if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) { 6428 return 0; /* RAZ/WI */ 6429 } 6430 return env->cp15.disr_el1; 6431 } 6432 6433 static void disr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 6434 { 6435 int el = arm_current_el(env); 6436 6437 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) { 6438 env->cp15.vdisr_el2 = val; 6439 return; 6440 } 6441 if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) { 6442 return; /* RAZ/WI */ 6443 } 6444 env->cp15.disr_el1 = val; 6445 } 6446 6447 /* 6448 * Minimal RAS implementation with no Error Records. 6449 * Which means that all of the Error Record registers: 6450 * ERXADDR_EL1 6451 * ERXCTLR_EL1 6452 * ERXFR_EL1 6453 * ERXMISC0_EL1 6454 * ERXMISC1_EL1 6455 * ERXMISC2_EL1 6456 * ERXMISC3_EL1 6457 * ERXPFGCDN_EL1 (RASv1p1) 6458 * ERXPFGCTL_EL1 (RASv1p1) 6459 * ERXPFGF_EL1 (RASv1p1) 6460 * ERXSTATUS_EL1 6461 * and 6462 * ERRSELR_EL1 6463 * may generate UNDEFINED, which is the effect we get by not 6464 * listing them at all. 6465 */ 6466 static const ARMCPRegInfo minimal_ras_reginfo[] = { 6467 { .name = "DISR_EL1", .state = ARM_CP_STATE_BOTH, 6468 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 1, 6469 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.disr_el1), 6470 .readfn = disr_read, .writefn = disr_write, .raw_writefn = raw_write }, 6471 { .name = "ERRIDR_EL1", .state = ARM_CP_STATE_BOTH, 6472 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 3, .opc2 = 0, 6473 .access = PL1_R, .accessfn = access_terr, 6474 .type = ARM_CP_CONST, .resetvalue = 0 }, 6475 { .name = "VDISR_EL2", .state = ARM_CP_STATE_BOTH, 6476 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 1, .opc2 = 1, 6477 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vdisr_el2) }, 6478 { .name = "VSESR_EL2", .state = ARM_CP_STATE_BOTH, 6479 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 3, 6480 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vsesr_el2) }, 6481 }; 6482 6483 /* 6484 * Return the exception level to which exceptions should be taken 6485 * via SVEAccessTrap. This excludes the check for whether the exception 6486 * should be routed through AArch64.AdvSIMDFPAccessTrap. That can easily 6487 * be found by testing 0 < fp_exception_el < sve_exception_el. 6488 * 6489 * C.f. the ARM pseudocode function CheckSVEEnabled. Note that the 6490 * pseudocode does *not* separate out the FP trap checks, but has them 6491 * all in one function. 6492 */ 6493 int sve_exception_el(CPUARMState *env, int el) 6494 { 6495 #ifndef CONFIG_USER_ONLY 6496 if (el <= 1 && !el_is_in_host(env, el)) { 6497 switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, ZEN)) { 6498 case 1: 6499 if (el != 0) { 6500 break; 6501 } 6502 /* fall through */ 6503 case 0: 6504 case 2: 6505 return 1; 6506 } 6507 } 6508 6509 if (el <= 2 && arm_is_el2_enabled(env)) { 6510 /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */ 6511 if (env->cp15.hcr_el2 & HCR_E2H) { 6512 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, ZEN)) { 6513 case 1: 6514 if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) { 6515 break; 6516 } 6517 /* fall through */ 6518 case 0: 6519 case 2: 6520 return 2; 6521 } 6522 } else { 6523 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TZ)) { 6524 return 2; 6525 } 6526 } 6527 } 6528 6529 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 6530 if (arm_feature(env, ARM_FEATURE_EL3) 6531 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, EZ)) { 6532 return 3; 6533 } 6534 #endif 6535 return 0; 6536 } 6537 6538 /* 6539 * Return the exception level to which exceptions should be taken for SME. 6540 * C.f. the ARM pseudocode function CheckSMEAccess. 6541 */ 6542 int sme_exception_el(CPUARMState *env, int el) 6543 { 6544 #ifndef CONFIG_USER_ONLY 6545 if (el <= 1 && !el_is_in_host(env, el)) { 6546 switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) { 6547 case 1: 6548 if (el != 0) { 6549 break; 6550 } 6551 /* fall through */ 6552 case 0: 6553 case 2: 6554 return 1; 6555 } 6556 } 6557 6558 if (el <= 2 && arm_is_el2_enabled(env)) { 6559 /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */ 6560 if (env->cp15.hcr_el2 & HCR_E2H) { 6561 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) { 6562 case 1: 6563 if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) { 6564 break; 6565 } 6566 /* fall through */ 6567 case 0: 6568 case 2: 6569 return 2; 6570 } 6571 } else { 6572 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) { 6573 return 2; 6574 } 6575 } 6576 } 6577 6578 /* CPTR_EL3. Since ESM is negative we must check for EL3. */ 6579 if (arm_feature(env, ARM_FEATURE_EL3) 6580 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) { 6581 return 3; 6582 } 6583 #endif 6584 return 0; 6585 } 6586 6587 /* This corresponds to the ARM pseudocode function IsFullA64Enabled(). */ 6588 static bool sme_fa64(CPUARMState *env, int el) 6589 { 6590 if (!cpu_isar_feature(aa64_sme_fa64, env_archcpu(env))) { 6591 return false; 6592 } 6593 6594 if (el <= 1 && !el_is_in_host(env, el)) { 6595 if (!FIELD_EX64(env->vfp.smcr_el[1], SMCR, FA64)) { 6596 return false; 6597 } 6598 } 6599 if (el <= 2 && arm_is_el2_enabled(env)) { 6600 if (!FIELD_EX64(env->vfp.smcr_el[2], SMCR, FA64)) { 6601 return false; 6602 } 6603 } 6604 if (arm_feature(env, ARM_FEATURE_EL3)) { 6605 if (!FIELD_EX64(env->vfp.smcr_el[3], SMCR, FA64)) { 6606 return false; 6607 } 6608 } 6609 6610 return true; 6611 } 6612 6613 /* 6614 * Given that SVE is enabled, return the vector length for EL. 6615 */ 6616 uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm) 6617 { 6618 ARMCPU *cpu = env_archcpu(env); 6619 uint64_t *cr = env->vfp.zcr_el; 6620 uint32_t map = cpu->sve_vq.map; 6621 uint32_t len = ARM_MAX_VQ - 1; 6622 6623 if (sm) { 6624 cr = env->vfp.smcr_el; 6625 map = cpu->sme_vq.map; 6626 } 6627 6628 if (el <= 1 && !el_is_in_host(env, el)) { 6629 len = MIN(len, 0xf & (uint32_t)cr[1]); 6630 } 6631 if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) { 6632 len = MIN(len, 0xf & (uint32_t)cr[2]); 6633 } 6634 if (arm_feature(env, ARM_FEATURE_EL3)) { 6635 len = MIN(len, 0xf & (uint32_t)cr[3]); 6636 } 6637 6638 map &= MAKE_64BIT_MASK(0, len + 1); 6639 if (map != 0) { 6640 return 31 - clz32(map); 6641 } 6642 6643 /* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */ 6644 assert(sm); 6645 return ctz32(cpu->sme_vq.map); 6646 } 6647 6648 uint32_t sve_vqm1_for_el(CPUARMState *env, int el) 6649 { 6650 return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM)); 6651 } 6652 6653 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6654 uint64_t value) 6655 { 6656 int cur_el = arm_current_el(env); 6657 int old_len = sve_vqm1_for_el(env, cur_el); 6658 int new_len; 6659 6660 /* Bits other than [3:0] are RAZ/WI. */ 6661 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16); 6662 raw_write(env, ri, value & 0xf); 6663 6664 /* 6665 * Because we arrived here, we know both FP and SVE are enabled; 6666 * otherwise we would have trapped access to the ZCR_ELn register. 6667 */ 6668 new_len = sve_vqm1_for_el(env, cur_el); 6669 if (new_len < old_len) { 6670 aarch64_sve_narrow_vq(env, new_len + 1); 6671 } 6672 } 6673 6674 static const ARMCPRegInfo zcr_reginfo[] = { 6675 { .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 6676 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 6677 .access = PL1_RW, .type = ARM_CP_SVE, 6678 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 6679 .writefn = zcr_write, .raw_writefn = raw_write }, 6680 { .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 6681 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 6682 .access = PL2_RW, .type = ARM_CP_SVE, 6683 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 6684 .writefn = zcr_write, .raw_writefn = raw_write }, 6685 { .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 6686 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 6687 .access = PL3_RW, .type = ARM_CP_SVE, 6688 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 6689 .writefn = zcr_write, .raw_writefn = raw_write }, 6690 }; 6691 6692 #ifdef TARGET_AARCH64 6693 static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri, 6694 bool isread) 6695 { 6696 int el = arm_current_el(env); 6697 6698 if (el == 0) { 6699 uint64_t sctlr = arm_sctlr(env, el); 6700 if (!(sctlr & SCTLR_EnTP2)) { 6701 return CP_ACCESS_TRAP; 6702 } 6703 } 6704 /* TODO: FEAT_FGT */ 6705 if (el < 3 6706 && arm_feature(env, ARM_FEATURE_EL3) 6707 && !(env->cp15.scr_el3 & SCR_ENTP2)) { 6708 return CP_ACCESS_TRAP_EL3; 6709 } 6710 return CP_ACCESS_OK; 6711 } 6712 6713 static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri, 6714 bool isread) 6715 { 6716 /* TODO: FEAT_FGT for SMPRI_EL1 but not SMPRIMAP_EL2 */ 6717 if (arm_current_el(env) < 3 6718 && arm_feature(env, ARM_FEATURE_EL3) 6719 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) { 6720 return CP_ACCESS_TRAP_EL3; 6721 } 6722 return CP_ACCESS_OK; 6723 } 6724 6725 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6726 uint64_t value) 6727 { 6728 helper_set_pstate_sm(env, FIELD_EX64(value, SVCR, SM)); 6729 helper_set_pstate_za(env, FIELD_EX64(value, SVCR, ZA)); 6730 arm_rebuild_hflags(env); 6731 } 6732 6733 static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6734 uint64_t value) 6735 { 6736 int cur_el = arm_current_el(env); 6737 int old_len = sve_vqm1_for_el(env, cur_el); 6738 int new_len; 6739 6740 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1); 6741 value &= R_SMCR_LEN_MASK | R_SMCR_FA64_MASK; 6742 raw_write(env, ri, value); 6743 6744 /* 6745 * Note that it is CONSTRAINED UNPREDICTABLE what happens to ZA storage 6746 * when SVL is widened (old values kept, or zeros). Choose to keep the 6747 * current values for simplicity. But for QEMU internals, we must still 6748 * apply the narrower SVL to the Zregs and Pregs -- see the comment 6749 * above aarch64_sve_narrow_vq. 6750 */ 6751 new_len = sve_vqm1_for_el(env, cur_el); 6752 if (new_len < old_len) { 6753 aarch64_sve_narrow_vq(env, new_len + 1); 6754 } 6755 } 6756 6757 static const ARMCPRegInfo sme_reginfo[] = { 6758 { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64, 6759 .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5, 6760 .access = PL0_RW, .accessfn = access_tpidr2, 6761 .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) }, 6762 { .name = "SVCR", .state = ARM_CP_STATE_AA64, 6763 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 2, 6764 .access = PL0_RW, .type = ARM_CP_SME, 6765 .fieldoffset = offsetof(CPUARMState, svcr), 6766 .writefn = svcr_write, .raw_writefn = raw_write }, 6767 { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64, 6768 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6, 6769 .access = PL1_RW, .type = ARM_CP_SME, 6770 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]), 6771 .writefn = smcr_write, .raw_writefn = raw_write }, 6772 { .name = "SMCR_EL2", .state = ARM_CP_STATE_AA64, 6773 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 6, 6774 .access = PL2_RW, .type = ARM_CP_SME, 6775 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[2]), 6776 .writefn = smcr_write, .raw_writefn = raw_write }, 6777 { .name = "SMCR_EL3", .state = ARM_CP_STATE_AA64, 6778 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 6, 6779 .access = PL3_RW, .type = ARM_CP_SME, 6780 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]), 6781 .writefn = smcr_write, .raw_writefn = raw_write }, 6782 { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64, 6783 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6, 6784 .access = PL1_R, .accessfn = access_aa64_tid1, 6785 /* 6786 * IMPLEMENTOR = 0 (software) 6787 * REVISION = 0 (implementation defined) 6788 * SMPS = 0 (no streaming execution priority in QEMU) 6789 * AFFINITY = 0 (streaming sve mode not shared with other PEs) 6790 */ 6791 .type = ARM_CP_CONST, .resetvalue = 0, }, 6792 /* 6793 * Because SMIDR_EL1.SMPS is 0, SMPRI_EL1 and SMPRIMAP_EL2 are RES 0. 6794 */ 6795 { .name = "SMPRI_EL1", .state = ARM_CP_STATE_AA64, 6796 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 4, 6797 .access = PL1_RW, .accessfn = access_esm, 6798 .type = ARM_CP_CONST, .resetvalue = 0 }, 6799 { .name = "SMPRIMAP_EL2", .state = ARM_CP_STATE_AA64, 6800 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 5, 6801 .access = PL2_RW, .accessfn = access_esm, 6802 .type = ARM_CP_CONST, .resetvalue = 0 }, 6803 }; 6804 #endif /* TARGET_AARCH64 */ 6805 6806 static void define_pmu_regs(ARMCPU *cpu) 6807 { 6808 /* 6809 * v7 performance monitor control register: same implementor 6810 * field as main ID register, and we implement four counters in 6811 * addition to the cycle count register. 6812 */ 6813 unsigned int i, pmcrn = pmu_num_counters(&cpu->env); 6814 ARMCPRegInfo pmcr = { 6815 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 6816 .access = PL0_RW, 6817 .type = ARM_CP_IO | ARM_CP_ALIAS, 6818 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 6819 .accessfn = pmreg_access, .writefn = pmcr_write, 6820 .raw_writefn = raw_write, 6821 }; 6822 ARMCPRegInfo pmcr64 = { 6823 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 6824 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 6825 .access = PL0_RW, .accessfn = pmreg_access, 6826 .type = ARM_CP_IO, 6827 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 6828 .resetvalue = cpu->isar.reset_pmcr_el0, 6829 .writefn = pmcr_write, .raw_writefn = raw_write, 6830 }; 6831 6832 define_one_arm_cp_reg(cpu, &pmcr); 6833 define_one_arm_cp_reg(cpu, &pmcr64); 6834 for (i = 0; i < pmcrn; i++) { 6835 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 6836 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 6837 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 6838 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 6839 ARMCPRegInfo pmev_regs[] = { 6840 { .name = pmevcntr_name, .cp = 15, .crn = 14, 6841 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6842 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6843 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6844 .accessfn = pmreg_access_xevcntr }, 6845 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 6846 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)), 6847 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access_xevcntr, 6848 .type = ARM_CP_IO, 6849 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6850 .raw_readfn = pmevcntr_rawread, 6851 .raw_writefn = pmevcntr_rawwrite }, 6852 { .name = pmevtyper_name, .cp = 15, .crn = 14, 6853 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6854 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6855 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6856 .accessfn = pmreg_access }, 6857 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 6858 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)), 6859 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 6860 .type = ARM_CP_IO, 6861 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6862 .raw_writefn = pmevtyper_rawwrite }, 6863 }; 6864 define_arm_cp_regs(cpu, pmev_regs); 6865 g_free(pmevcntr_name); 6866 g_free(pmevcntr_el0_name); 6867 g_free(pmevtyper_name); 6868 g_free(pmevtyper_el0_name); 6869 } 6870 if (cpu_isar_feature(aa32_pmuv3p1, cpu)) { 6871 ARMCPRegInfo v81_pmu_regs[] = { 6872 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 6873 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 6874 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6875 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 6876 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 6877 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 6878 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6879 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 6880 }; 6881 define_arm_cp_regs(cpu, v81_pmu_regs); 6882 } 6883 if (cpu_isar_feature(any_pmuv3p4, cpu)) { 6884 static const ARMCPRegInfo v84_pmmir = { 6885 .name = "PMMIR_EL1", .state = ARM_CP_STATE_BOTH, 6886 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 6, 6887 .access = PL1_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6888 .resetvalue = 0 6889 }; 6890 define_one_arm_cp_reg(cpu, &v84_pmmir); 6891 } 6892 } 6893 6894 /* 6895 * We don't know until after realize whether there's a GICv3 6896 * attached, and that is what registers the gicv3 sysregs. 6897 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 6898 * at runtime. 6899 */ 6900 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 6901 { 6902 ARMCPU *cpu = env_archcpu(env); 6903 uint64_t pfr1 = cpu->isar.id_pfr1; 6904 6905 if (env->gicv3state) { 6906 pfr1 |= 1 << 28; 6907 } 6908 return pfr1; 6909 } 6910 6911 #ifndef CONFIG_USER_ONLY 6912 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 6913 { 6914 ARMCPU *cpu = env_archcpu(env); 6915 uint64_t pfr0 = cpu->isar.id_aa64pfr0; 6916 6917 if (env->gicv3state) { 6918 pfr0 |= 1 << 24; 6919 } 6920 return pfr0; 6921 } 6922 #endif 6923 6924 /* 6925 * Shared logic between LORID and the rest of the LOR* registers. 6926 * Secure state exclusion has already been dealt with. 6927 */ 6928 static CPAccessResult access_lor_ns(CPUARMState *env, 6929 const ARMCPRegInfo *ri, bool isread) 6930 { 6931 int el = arm_current_el(env); 6932 6933 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 6934 return CP_ACCESS_TRAP_EL2; 6935 } 6936 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 6937 return CP_ACCESS_TRAP_EL3; 6938 } 6939 return CP_ACCESS_OK; 6940 } 6941 6942 static CPAccessResult access_lor_other(CPUARMState *env, 6943 const ARMCPRegInfo *ri, bool isread) 6944 { 6945 if (arm_is_secure_below_el3(env)) { 6946 /* Access denied in secure mode. */ 6947 return CP_ACCESS_TRAP; 6948 } 6949 return access_lor_ns(env, ri, isread); 6950 } 6951 6952 /* 6953 * A trivial implementation of ARMv8.1-LOR leaves all of these 6954 * registers fixed at 0, which indicates that there are zero 6955 * supported Limited Ordering regions. 6956 */ 6957 static const ARMCPRegInfo lor_reginfo[] = { 6958 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 6959 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 6960 .access = PL1_RW, .accessfn = access_lor_other, 6961 .type = ARM_CP_CONST, .resetvalue = 0 }, 6962 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 6963 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 6964 .access = PL1_RW, .accessfn = access_lor_other, 6965 .type = ARM_CP_CONST, .resetvalue = 0 }, 6966 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 6967 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 6968 .access = PL1_RW, .accessfn = access_lor_other, 6969 .type = ARM_CP_CONST, .resetvalue = 0 }, 6970 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 6971 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 6972 .access = PL1_RW, .accessfn = access_lor_other, 6973 .type = ARM_CP_CONST, .resetvalue = 0 }, 6974 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 6975 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 6976 .access = PL1_R, .accessfn = access_lor_ns, 6977 .type = ARM_CP_CONST, .resetvalue = 0 }, 6978 }; 6979 6980 #ifdef TARGET_AARCH64 6981 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 6982 bool isread) 6983 { 6984 int el = arm_current_el(env); 6985 6986 if (el < 2 && 6987 arm_is_el2_enabled(env) && 6988 !(arm_hcr_el2_eff(env) & HCR_APK)) { 6989 return CP_ACCESS_TRAP_EL2; 6990 } 6991 if (el < 3 && 6992 arm_feature(env, ARM_FEATURE_EL3) && 6993 !(env->cp15.scr_el3 & SCR_APK)) { 6994 return CP_ACCESS_TRAP_EL3; 6995 } 6996 return CP_ACCESS_OK; 6997 } 6998 6999 static const ARMCPRegInfo pauth_reginfo[] = { 7000 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7001 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 7002 .access = PL1_RW, .accessfn = access_pauth, 7003 .fieldoffset = offsetof(CPUARMState, keys.apda.lo) }, 7004 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7005 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 7006 .access = PL1_RW, .accessfn = access_pauth, 7007 .fieldoffset = offsetof(CPUARMState, keys.apda.hi) }, 7008 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7009 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 7010 .access = PL1_RW, .accessfn = access_pauth, 7011 .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) }, 7012 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7013 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 7014 .access = PL1_RW, .accessfn = access_pauth, 7015 .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) }, 7016 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7017 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 7018 .access = PL1_RW, .accessfn = access_pauth, 7019 .fieldoffset = offsetof(CPUARMState, keys.apga.lo) }, 7020 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7021 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 7022 .access = PL1_RW, .accessfn = access_pauth, 7023 .fieldoffset = offsetof(CPUARMState, keys.apga.hi) }, 7024 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7025 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 7026 .access = PL1_RW, .accessfn = access_pauth, 7027 .fieldoffset = offsetof(CPUARMState, keys.apia.lo) }, 7028 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7029 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 7030 .access = PL1_RW, .accessfn = access_pauth, 7031 .fieldoffset = offsetof(CPUARMState, keys.apia.hi) }, 7032 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7033 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 7034 .access = PL1_RW, .accessfn = access_pauth, 7035 .fieldoffset = offsetof(CPUARMState, keys.apib.lo) }, 7036 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7037 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 7038 .access = PL1_RW, .accessfn = access_pauth, 7039 .fieldoffset = offsetof(CPUARMState, keys.apib.hi) }, 7040 }; 7041 7042 static const ARMCPRegInfo tlbirange_reginfo[] = { 7043 { .name = "TLBI_RVAE1IS", .state = ARM_CP_STATE_AA64, 7044 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 1, 7045 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 7046 .writefn = tlbi_aa64_rvae1is_write }, 7047 { .name = "TLBI_RVAAE1IS", .state = ARM_CP_STATE_AA64, 7048 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 3, 7049 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 7050 .writefn = tlbi_aa64_rvae1is_write }, 7051 { .name = "TLBI_RVALE1IS", .state = ARM_CP_STATE_AA64, 7052 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 5, 7053 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 7054 .writefn = tlbi_aa64_rvae1is_write }, 7055 { .name = "TLBI_RVAALE1IS", .state = ARM_CP_STATE_AA64, 7056 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 7, 7057 .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW, 7058 .writefn = tlbi_aa64_rvae1is_write }, 7059 { .name = "TLBI_RVAE1OS", .state = ARM_CP_STATE_AA64, 7060 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1, 7061 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7062 .writefn = tlbi_aa64_rvae1is_write }, 7063 { .name = "TLBI_RVAAE1OS", .state = ARM_CP_STATE_AA64, 7064 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 3, 7065 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7066 .writefn = tlbi_aa64_rvae1is_write }, 7067 { .name = "TLBI_RVALE1OS", .state = ARM_CP_STATE_AA64, 7068 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 5, 7069 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7070 .writefn = tlbi_aa64_rvae1is_write }, 7071 { .name = "TLBI_RVAALE1OS", .state = ARM_CP_STATE_AA64, 7072 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 7, 7073 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7074 .writefn = tlbi_aa64_rvae1is_write }, 7075 { .name = "TLBI_RVAE1", .state = ARM_CP_STATE_AA64, 7076 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1, 7077 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 7078 .writefn = tlbi_aa64_rvae1_write }, 7079 { .name = "TLBI_RVAAE1", .state = ARM_CP_STATE_AA64, 7080 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 3, 7081 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 7082 .writefn = tlbi_aa64_rvae1_write }, 7083 { .name = "TLBI_RVALE1", .state = ARM_CP_STATE_AA64, 7084 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 5, 7085 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 7086 .writefn = tlbi_aa64_rvae1_write }, 7087 { .name = "TLBI_RVAALE1", .state = ARM_CP_STATE_AA64, 7088 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 7, 7089 .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW, 7090 .writefn = tlbi_aa64_rvae1_write }, 7091 { .name = "TLBI_RIPAS2E1IS", .state = ARM_CP_STATE_AA64, 7092 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 2, 7093 .access = PL2_W, .type = ARM_CP_NO_RAW, 7094 .writefn = tlbi_aa64_ripas2e1is_write }, 7095 { .name = "TLBI_RIPAS2LE1IS", .state = ARM_CP_STATE_AA64, 7096 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 6, 7097 .access = PL2_W, .type = ARM_CP_NO_RAW, 7098 .writefn = tlbi_aa64_ripas2e1is_write }, 7099 { .name = "TLBI_RVAE2IS", .state = ARM_CP_STATE_AA64, 7100 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 1, 7101 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7102 .writefn = tlbi_aa64_rvae2is_write }, 7103 { .name = "TLBI_RVALE2IS", .state = ARM_CP_STATE_AA64, 7104 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 5, 7105 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7106 .writefn = tlbi_aa64_rvae2is_write }, 7107 { .name = "TLBI_RIPAS2E1", .state = ARM_CP_STATE_AA64, 7108 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 2, 7109 .access = PL2_W, .type = ARM_CP_NO_RAW, 7110 .writefn = tlbi_aa64_ripas2e1_write }, 7111 { .name = "TLBI_RIPAS2LE1", .state = ARM_CP_STATE_AA64, 7112 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 6, 7113 .access = PL2_W, .type = ARM_CP_NO_RAW, 7114 .writefn = tlbi_aa64_ripas2e1_write }, 7115 { .name = "TLBI_RVAE2OS", .state = ARM_CP_STATE_AA64, 7116 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 1, 7117 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7118 .writefn = tlbi_aa64_rvae2is_write }, 7119 { .name = "TLBI_RVALE2OS", .state = ARM_CP_STATE_AA64, 7120 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 5, 7121 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7122 .writefn = tlbi_aa64_rvae2is_write }, 7123 { .name = "TLBI_RVAE2", .state = ARM_CP_STATE_AA64, 7124 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 1, 7125 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7126 .writefn = tlbi_aa64_rvae2_write }, 7127 { .name = "TLBI_RVALE2", .state = ARM_CP_STATE_AA64, 7128 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 5, 7129 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7130 .writefn = tlbi_aa64_rvae2_write }, 7131 { .name = "TLBI_RVAE3IS", .state = ARM_CP_STATE_AA64, 7132 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 1, 7133 .access = PL3_W, .type = ARM_CP_NO_RAW, 7134 .writefn = tlbi_aa64_rvae3is_write }, 7135 { .name = "TLBI_RVALE3IS", .state = ARM_CP_STATE_AA64, 7136 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 5, 7137 .access = PL3_W, .type = ARM_CP_NO_RAW, 7138 .writefn = tlbi_aa64_rvae3is_write }, 7139 { .name = "TLBI_RVAE3OS", .state = ARM_CP_STATE_AA64, 7140 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 5, .opc2 = 1, 7141 .access = PL3_W, .type = ARM_CP_NO_RAW, 7142 .writefn = tlbi_aa64_rvae3is_write }, 7143 { .name = "TLBI_RVALE3OS", .state = ARM_CP_STATE_AA64, 7144 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 5, .opc2 = 5, 7145 .access = PL3_W, .type = ARM_CP_NO_RAW, 7146 .writefn = tlbi_aa64_rvae3is_write }, 7147 { .name = "TLBI_RVAE3", .state = ARM_CP_STATE_AA64, 7148 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 1, 7149 .access = PL3_W, .type = ARM_CP_NO_RAW, 7150 .writefn = tlbi_aa64_rvae3_write }, 7151 { .name = "TLBI_RVALE3", .state = ARM_CP_STATE_AA64, 7152 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 5, 7153 .access = PL3_W, .type = ARM_CP_NO_RAW, 7154 .writefn = tlbi_aa64_rvae3_write }, 7155 }; 7156 7157 static const ARMCPRegInfo tlbios_reginfo[] = { 7158 { .name = "TLBI_VMALLE1OS", .state = ARM_CP_STATE_AA64, 7159 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 0, 7160 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7161 .writefn = tlbi_aa64_vmalle1is_write }, 7162 { .name = "TLBI_VAE1OS", .state = ARM_CP_STATE_AA64, 7163 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 1, 7164 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7165 .writefn = tlbi_aa64_vae1is_write }, 7166 { .name = "TLBI_ASIDE1OS", .state = ARM_CP_STATE_AA64, 7167 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 2, 7168 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7169 .writefn = tlbi_aa64_vmalle1is_write }, 7170 { .name = "TLBI_VAAE1OS", .state = ARM_CP_STATE_AA64, 7171 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 3, 7172 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7173 .writefn = tlbi_aa64_vae1is_write }, 7174 { .name = "TLBI_VALE1OS", .state = ARM_CP_STATE_AA64, 7175 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 5, 7176 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7177 .writefn = tlbi_aa64_vae1is_write }, 7178 { .name = "TLBI_VAALE1OS", .state = ARM_CP_STATE_AA64, 7179 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 7, 7180 .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW, 7181 .writefn = tlbi_aa64_vae1is_write }, 7182 { .name = "TLBI_ALLE2OS", .state = ARM_CP_STATE_AA64, 7183 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 0, 7184 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7185 .writefn = tlbi_aa64_alle2is_write }, 7186 { .name = "TLBI_VAE2OS", .state = ARM_CP_STATE_AA64, 7187 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 1, 7188 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7189 .writefn = tlbi_aa64_vae2is_write }, 7190 { .name = "TLBI_ALLE1OS", .state = ARM_CP_STATE_AA64, 7191 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 4, 7192 .access = PL2_W, .type = ARM_CP_NO_RAW, 7193 .writefn = tlbi_aa64_alle1is_write }, 7194 { .name = "TLBI_VALE2OS", .state = ARM_CP_STATE_AA64, 7195 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 5, 7196 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF, 7197 .writefn = tlbi_aa64_vae2is_write }, 7198 { .name = "TLBI_VMALLS12E1OS", .state = ARM_CP_STATE_AA64, 7199 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 6, 7200 .access = PL2_W, .type = ARM_CP_NO_RAW, 7201 .writefn = tlbi_aa64_alle1is_write }, 7202 { .name = "TLBI_IPAS2E1OS", .state = ARM_CP_STATE_AA64, 7203 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 0, 7204 .access = PL2_W, .type = ARM_CP_NOP }, 7205 { .name = "TLBI_RIPAS2E1OS", .state = ARM_CP_STATE_AA64, 7206 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 3, 7207 .access = PL2_W, .type = ARM_CP_NOP }, 7208 { .name = "TLBI_IPAS2LE1OS", .state = ARM_CP_STATE_AA64, 7209 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 4, 7210 .access = PL2_W, .type = ARM_CP_NOP }, 7211 { .name = "TLBI_RIPAS2LE1OS", .state = ARM_CP_STATE_AA64, 7212 .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 7, 7213 .access = PL2_W, .type = ARM_CP_NOP }, 7214 { .name = "TLBI_ALLE3OS", .state = ARM_CP_STATE_AA64, 7215 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 0, 7216 .access = PL3_W, .type = ARM_CP_NO_RAW, 7217 .writefn = tlbi_aa64_alle3is_write }, 7218 { .name = "TLBI_VAE3OS", .state = ARM_CP_STATE_AA64, 7219 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 1, 7220 .access = PL3_W, .type = ARM_CP_NO_RAW, 7221 .writefn = tlbi_aa64_vae3is_write }, 7222 { .name = "TLBI_VALE3OS", .state = ARM_CP_STATE_AA64, 7223 .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 5, 7224 .access = PL3_W, .type = ARM_CP_NO_RAW, 7225 .writefn = tlbi_aa64_vae3is_write }, 7226 }; 7227 7228 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 7229 { 7230 Error *err = NULL; 7231 uint64_t ret; 7232 7233 /* Success sets NZCV = 0000. */ 7234 env->NF = env->CF = env->VF = 0, env->ZF = 1; 7235 7236 if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) { 7237 /* 7238 * ??? Failed, for unknown reasons in the crypto subsystem. 7239 * The best we can do is log the reason and return the 7240 * timed-out indication to the guest. There is no reason 7241 * we know to expect this failure to be transitory, so the 7242 * guest may well hang retrying the operation. 7243 */ 7244 qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s", 7245 ri->name, error_get_pretty(err)); 7246 error_free(err); 7247 7248 env->ZF = 0; /* NZCF = 0100 */ 7249 return 0; 7250 } 7251 return ret; 7252 } 7253 7254 /* We do not support re-seeding, so the two registers operate the same. */ 7255 static const ARMCPRegInfo rndr_reginfo[] = { 7256 { .name = "RNDR", .state = ARM_CP_STATE_AA64, 7257 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 7258 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0, 7259 .access = PL0_R, .readfn = rndr_readfn }, 7260 { .name = "RNDRRS", .state = ARM_CP_STATE_AA64, 7261 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 7262 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1, 7263 .access = PL0_R, .readfn = rndr_readfn }, 7264 }; 7265 7266 #ifndef CONFIG_USER_ONLY 7267 static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque, 7268 uint64_t value) 7269 { 7270 ARMCPU *cpu = env_archcpu(env); 7271 /* CTR_EL0 System register -> DminLine, bits [19:16] */ 7272 uint64_t dline_size = 4 << ((cpu->ctr >> 16) & 0xF); 7273 uint64_t vaddr_in = (uint64_t) value; 7274 uint64_t vaddr = vaddr_in & ~(dline_size - 1); 7275 void *haddr; 7276 int mem_idx = cpu_mmu_index(env, false); 7277 7278 /* This won't be crossing page boundaries */ 7279 haddr = probe_read(env, vaddr, dline_size, mem_idx, GETPC()); 7280 if (haddr) { 7281 7282 ram_addr_t offset; 7283 MemoryRegion *mr; 7284 7285 /* RCU lock is already being held */ 7286 mr = memory_region_from_host(haddr, &offset); 7287 7288 if (mr) { 7289 memory_region_writeback(mr, offset, dline_size); 7290 } 7291 } 7292 } 7293 7294 static const ARMCPRegInfo dcpop_reg[] = { 7295 { .name = "DC_CVAP", .state = ARM_CP_STATE_AA64, 7296 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1, 7297 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 7298 .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn }, 7299 }; 7300 7301 static const ARMCPRegInfo dcpodp_reg[] = { 7302 { .name = "DC_CVADP", .state = ARM_CP_STATE_AA64, 7303 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1, 7304 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 7305 .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn }, 7306 }; 7307 #endif /*CONFIG_USER_ONLY*/ 7308 7309 static CPAccessResult access_aa64_tid5(CPUARMState *env, const ARMCPRegInfo *ri, 7310 bool isread) 7311 { 7312 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID5)) { 7313 return CP_ACCESS_TRAP_EL2; 7314 } 7315 7316 return CP_ACCESS_OK; 7317 } 7318 7319 static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri, 7320 bool isread) 7321 { 7322 int el = arm_current_el(env); 7323 7324 if (el < 2 && arm_is_el2_enabled(env)) { 7325 uint64_t hcr = arm_hcr_el2_eff(env); 7326 if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) { 7327 return CP_ACCESS_TRAP_EL2; 7328 } 7329 } 7330 if (el < 3 && 7331 arm_feature(env, ARM_FEATURE_EL3) && 7332 !(env->cp15.scr_el3 & SCR_ATA)) { 7333 return CP_ACCESS_TRAP_EL3; 7334 } 7335 return CP_ACCESS_OK; 7336 } 7337 7338 static uint64_t tco_read(CPUARMState *env, const ARMCPRegInfo *ri) 7339 { 7340 return env->pstate & PSTATE_TCO; 7341 } 7342 7343 static void tco_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 7344 { 7345 env->pstate = (env->pstate & ~PSTATE_TCO) | (val & PSTATE_TCO); 7346 } 7347 7348 static const ARMCPRegInfo mte_reginfo[] = { 7349 { .name = "TFSRE0_EL1", .state = ARM_CP_STATE_AA64, 7350 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 1, 7351 .access = PL1_RW, .accessfn = access_mte, 7352 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[0]) }, 7353 { .name = "TFSR_EL1", .state = ARM_CP_STATE_AA64, 7354 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 0, 7355 .access = PL1_RW, .accessfn = access_mte, 7356 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[1]) }, 7357 { .name = "TFSR_EL2", .state = ARM_CP_STATE_AA64, 7358 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 6, .opc2 = 0, 7359 .access = PL2_RW, .accessfn = access_mte, 7360 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[2]) }, 7361 { .name = "TFSR_EL3", .state = ARM_CP_STATE_AA64, 7362 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 6, .opc2 = 0, 7363 .access = PL3_RW, 7364 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[3]) }, 7365 { .name = "RGSR_EL1", .state = ARM_CP_STATE_AA64, 7366 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 5, 7367 .access = PL1_RW, .accessfn = access_mte, 7368 .fieldoffset = offsetof(CPUARMState, cp15.rgsr_el1) }, 7369 { .name = "GCR_EL1", .state = ARM_CP_STATE_AA64, 7370 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 6, 7371 .access = PL1_RW, .accessfn = access_mte, 7372 .fieldoffset = offsetof(CPUARMState, cp15.gcr_el1) }, 7373 { .name = "GMID_EL1", .state = ARM_CP_STATE_AA64, 7374 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 4, 7375 .access = PL1_R, .accessfn = access_aa64_tid5, 7376 .type = ARM_CP_CONST, .resetvalue = GMID_EL1_BS }, 7377 { .name = "TCO", .state = ARM_CP_STATE_AA64, 7378 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7, 7379 .type = ARM_CP_NO_RAW, 7380 .access = PL0_RW, .readfn = tco_read, .writefn = tco_write }, 7381 { .name = "DC_IGVAC", .state = ARM_CP_STATE_AA64, 7382 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 3, 7383 .type = ARM_CP_NOP, .access = PL1_W, 7384 .accessfn = aa64_cacheop_poc_access }, 7385 { .name = "DC_IGSW", .state = ARM_CP_STATE_AA64, 7386 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 4, 7387 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7388 { .name = "DC_IGDVAC", .state = ARM_CP_STATE_AA64, 7389 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 5, 7390 .type = ARM_CP_NOP, .access = PL1_W, 7391 .accessfn = aa64_cacheop_poc_access }, 7392 { .name = "DC_IGDSW", .state = ARM_CP_STATE_AA64, 7393 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 6, 7394 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7395 { .name = "DC_CGSW", .state = ARM_CP_STATE_AA64, 7396 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 4, 7397 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7398 { .name = "DC_CGDSW", .state = ARM_CP_STATE_AA64, 7399 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 6, 7400 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7401 { .name = "DC_CIGSW", .state = ARM_CP_STATE_AA64, 7402 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 4, 7403 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7404 { .name = "DC_CIGDSW", .state = ARM_CP_STATE_AA64, 7405 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 6, 7406 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7407 }; 7408 7409 static const ARMCPRegInfo mte_tco_ro_reginfo[] = { 7410 { .name = "TCO", .state = ARM_CP_STATE_AA64, 7411 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7, 7412 .type = ARM_CP_CONST, .access = PL0_RW, }, 7413 }; 7414 7415 static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = { 7416 { .name = "DC_CGVAC", .state = ARM_CP_STATE_AA64, 7417 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 3, 7418 .type = ARM_CP_NOP, .access = PL0_W, 7419 .accessfn = aa64_cacheop_poc_access }, 7420 { .name = "DC_CGDVAC", .state = ARM_CP_STATE_AA64, 7421 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 5, 7422 .type = ARM_CP_NOP, .access = PL0_W, 7423 .accessfn = aa64_cacheop_poc_access }, 7424 { .name = "DC_CGVAP", .state = ARM_CP_STATE_AA64, 7425 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 3, 7426 .type = ARM_CP_NOP, .access = PL0_W, 7427 .accessfn = aa64_cacheop_poc_access }, 7428 { .name = "DC_CGDVAP", .state = ARM_CP_STATE_AA64, 7429 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 5, 7430 .type = ARM_CP_NOP, .access = PL0_W, 7431 .accessfn = aa64_cacheop_poc_access }, 7432 { .name = "DC_CGVADP", .state = ARM_CP_STATE_AA64, 7433 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 3, 7434 .type = ARM_CP_NOP, .access = PL0_W, 7435 .accessfn = aa64_cacheop_poc_access }, 7436 { .name = "DC_CGDVADP", .state = ARM_CP_STATE_AA64, 7437 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 5, 7438 .type = ARM_CP_NOP, .access = PL0_W, 7439 .accessfn = aa64_cacheop_poc_access }, 7440 { .name = "DC_CIGVAC", .state = ARM_CP_STATE_AA64, 7441 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 3, 7442 .type = ARM_CP_NOP, .access = PL0_W, 7443 .accessfn = aa64_cacheop_poc_access }, 7444 { .name = "DC_CIGDVAC", .state = ARM_CP_STATE_AA64, 7445 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 5, 7446 .type = ARM_CP_NOP, .access = PL0_W, 7447 .accessfn = aa64_cacheop_poc_access }, 7448 { .name = "DC_GVA", .state = ARM_CP_STATE_AA64, 7449 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 3, 7450 .access = PL0_W, .type = ARM_CP_DC_GVA, 7451 #ifndef CONFIG_USER_ONLY 7452 /* Avoid overhead of an access check that always passes in user-mode */ 7453 .accessfn = aa64_zva_access, 7454 #endif 7455 }, 7456 { .name = "DC_GZVA", .state = ARM_CP_STATE_AA64, 7457 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 4, 7458 .access = PL0_W, .type = ARM_CP_DC_GZVA, 7459 #ifndef CONFIG_USER_ONLY 7460 /* Avoid overhead of an access check that always passes in user-mode */ 7461 .accessfn = aa64_zva_access, 7462 #endif 7463 }, 7464 }; 7465 7466 static CPAccessResult access_scxtnum(CPUARMState *env, const ARMCPRegInfo *ri, 7467 bool isread) 7468 { 7469 uint64_t hcr = arm_hcr_el2_eff(env); 7470 int el = arm_current_el(env); 7471 7472 if (el == 0 && !((hcr & HCR_E2H) && (hcr & HCR_TGE))) { 7473 if (env->cp15.sctlr_el[1] & SCTLR_TSCXT) { 7474 if (hcr & HCR_TGE) { 7475 return CP_ACCESS_TRAP_EL2; 7476 } 7477 return CP_ACCESS_TRAP; 7478 } 7479 } else if (el < 2 && (env->cp15.sctlr_el[2] & SCTLR_TSCXT)) { 7480 return CP_ACCESS_TRAP_EL2; 7481 } 7482 if (el < 2 && arm_is_el2_enabled(env) && !(hcr & HCR_ENSCXT)) { 7483 return CP_ACCESS_TRAP_EL2; 7484 } 7485 if (el < 3 7486 && arm_feature(env, ARM_FEATURE_EL3) 7487 && !(env->cp15.scr_el3 & SCR_ENSCXT)) { 7488 return CP_ACCESS_TRAP_EL3; 7489 } 7490 return CP_ACCESS_OK; 7491 } 7492 7493 static const ARMCPRegInfo scxtnum_reginfo[] = { 7494 { .name = "SCXTNUM_EL0", .state = ARM_CP_STATE_AA64, 7495 .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 7, 7496 .access = PL0_RW, .accessfn = access_scxtnum, 7497 .fieldoffset = offsetof(CPUARMState, scxtnum_el[0]) }, 7498 { .name = "SCXTNUM_EL1", .state = ARM_CP_STATE_AA64, 7499 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 7, 7500 .access = PL1_RW, .accessfn = access_scxtnum, 7501 .fieldoffset = offsetof(CPUARMState, scxtnum_el[1]) }, 7502 { .name = "SCXTNUM_EL2", .state = ARM_CP_STATE_AA64, 7503 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 7, 7504 .access = PL2_RW, .accessfn = access_scxtnum, 7505 .fieldoffset = offsetof(CPUARMState, scxtnum_el[2]) }, 7506 { .name = "SCXTNUM_EL3", .state = ARM_CP_STATE_AA64, 7507 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 7, 7508 .access = PL3_RW, 7509 .fieldoffset = offsetof(CPUARMState, scxtnum_el[3]) }, 7510 }; 7511 #endif /* TARGET_AARCH64 */ 7512 7513 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri, 7514 bool isread) 7515 { 7516 int el = arm_current_el(env); 7517 7518 if (el == 0) { 7519 uint64_t sctlr = arm_sctlr(env, el); 7520 if (!(sctlr & SCTLR_EnRCTX)) { 7521 return CP_ACCESS_TRAP; 7522 } 7523 } else if (el == 1) { 7524 uint64_t hcr = arm_hcr_el2_eff(env); 7525 if (hcr & HCR_NV) { 7526 return CP_ACCESS_TRAP_EL2; 7527 } 7528 } 7529 return CP_ACCESS_OK; 7530 } 7531 7532 static const ARMCPRegInfo predinv_reginfo[] = { 7533 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64, 7534 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4, 7535 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7536 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64, 7537 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5, 7538 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7539 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64, 7540 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7, 7541 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7542 /* 7543 * Note the AArch32 opcodes have a different OPC1. 7544 */ 7545 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32, 7546 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4, 7547 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7548 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32, 7549 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5, 7550 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7551 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32, 7552 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7, 7553 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7554 }; 7555 7556 static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri) 7557 { 7558 /* Read the high 32 bits of the current CCSIDR */ 7559 return extract64(ccsidr_read(env, ri), 32, 32); 7560 } 7561 7562 static const ARMCPRegInfo ccsidr2_reginfo[] = { 7563 { .name = "CCSIDR2", .state = ARM_CP_STATE_BOTH, 7564 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 2, 7565 .access = PL1_R, 7566 .accessfn = access_tid4, 7567 .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW }, 7568 }; 7569 7570 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 7571 bool isread) 7572 { 7573 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) { 7574 return CP_ACCESS_TRAP_EL2; 7575 } 7576 7577 return CP_ACCESS_OK; 7578 } 7579 7580 static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 7581 bool isread) 7582 { 7583 if (arm_feature(env, ARM_FEATURE_V8)) { 7584 return access_aa64_tid3(env, ri, isread); 7585 } 7586 7587 return CP_ACCESS_OK; 7588 } 7589 7590 static CPAccessResult access_jazelle(CPUARMState *env, const ARMCPRegInfo *ri, 7591 bool isread) 7592 { 7593 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID0)) { 7594 return CP_ACCESS_TRAP_EL2; 7595 } 7596 7597 return CP_ACCESS_OK; 7598 } 7599 7600 static CPAccessResult access_joscr_jmcr(CPUARMState *env, 7601 const ARMCPRegInfo *ri, bool isread) 7602 { 7603 /* 7604 * HSTR.TJDBX traps JOSCR and JMCR accesses, but it exists only 7605 * in v7A, not in v8A. 7606 */ 7607 if (!arm_feature(env, ARM_FEATURE_V8) && 7608 arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) && 7609 (env->cp15.hstr_el2 & HSTR_TJDBX)) { 7610 return CP_ACCESS_TRAP_EL2; 7611 } 7612 return CP_ACCESS_OK; 7613 } 7614 7615 static const ARMCPRegInfo jazelle_regs[] = { 7616 { .name = "JIDR", 7617 .cp = 14, .crn = 0, .crm = 0, .opc1 = 7, .opc2 = 0, 7618 .access = PL1_R, .accessfn = access_jazelle, 7619 .type = ARM_CP_CONST, .resetvalue = 0 }, 7620 { .name = "JOSCR", 7621 .cp = 14, .crn = 1, .crm = 0, .opc1 = 7, .opc2 = 0, 7622 .accessfn = access_joscr_jmcr, 7623 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 7624 { .name = "JMCR", 7625 .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0, 7626 .accessfn = access_joscr_jmcr, 7627 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 7628 }; 7629 7630 static const ARMCPRegInfo contextidr_el2 = { 7631 .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64, 7632 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1, 7633 .access = PL2_RW, 7634 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2]) 7635 }; 7636 7637 static const ARMCPRegInfo vhe_reginfo[] = { 7638 { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64, 7639 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1, 7640 .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write, 7641 .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) }, 7642 #ifndef CONFIG_USER_ONLY 7643 { .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64, 7644 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 2, 7645 .fieldoffset = 7646 offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].cval), 7647 .type = ARM_CP_IO, .access = PL2_RW, 7648 .writefn = gt_hv_cval_write, .raw_writefn = raw_write }, 7649 { .name = "CNTHV_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 7650 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 0, 7651 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 7652 .resetfn = gt_hv_timer_reset, 7653 .readfn = gt_hv_tval_read, .writefn = gt_hv_tval_write }, 7654 { .name = "CNTHV_CTL_EL2", .state = ARM_CP_STATE_BOTH, 7655 .type = ARM_CP_IO, 7656 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 1, 7657 .access = PL2_RW, 7658 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].ctl), 7659 .writefn = gt_hv_ctl_write, .raw_writefn = raw_write }, 7660 { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64, 7661 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1, 7662 .type = ARM_CP_IO | ARM_CP_ALIAS, 7663 .access = PL2_RW, .accessfn = e2h_access, 7664 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 7665 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write }, 7666 { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64, 7667 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1, 7668 .type = ARM_CP_IO | ARM_CP_ALIAS, 7669 .access = PL2_RW, .accessfn = e2h_access, 7670 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 7671 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write }, 7672 { .name = "CNTP_TVAL_EL02", .state = ARM_CP_STATE_AA64, 7673 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 0, 7674 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 7675 .access = PL2_RW, .accessfn = e2h_access, 7676 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write }, 7677 { .name = "CNTV_TVAL_EL02", .state = ARM_CP_STATE_AA64, 7678 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 0, 7679 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 7680 .access = PL2_RW, .accessfn = e2h_access, 7681 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write }, 7682 { .name = "CNTP_CVAL_EL02", .state = ARM_CP_STATE_AA64, 7683 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 2, 7684 .type = ARM_CP_IO | ARM_CP_ALIAS, 7685 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 7686 .access = PL2_RW, .accessfn = e2h_access, 7687 .writefn = gt_phys_cval_write, .raw_writefn = raw_write }, 7688 { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64, 7689 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2, 7690 .type = ARM_CP_IO | ARM_CP_ALIAS, 7691 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 7692 .access = PL2_RW, .accessfn = e2h_access, 7693 .writefn = gt_virt_cval_write, .raw_writefn = raw_write }, 7694 #endif 7695 }; 7696 7697 #ifndef CONFIG_USER_ONLY 7698 static const ARMCPRegInfo ats1e1_reginfo[] = { 7699 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 7700 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0, 7701 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 7702 .writefn = ats_write64 }, 7703 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 7704 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1, 7705 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 7706 .writefn = ats_write64 }, 7707 }; 7708 7709 static const ARMCPRegInfo ats1cp_reginfo[] = { 7710 { .name = "ATS1CPRP", 7711 .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0, 7712 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 7713 .writefn = ats_write }, 7714 { .name = "ATS1CPWP", 7715 .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1, 7716 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 7717 .writefn = ats_write }, 7718 }; 7719 #endif 7720 7721 /* 7722 * ACTLR2 and HACTLR2 map to ACTLR_EL1[63:32] and 7723 * ACTLR_EL2[63:32]. They exist only if the ID_MMFR4.AC2 field 7724 * is non-zero, which is never for ARMv7, optionally in ARMv8 7725 * and mandatorily for ARMv8.2 and up. 7726 * ACTLR2 is banked for S and NS if EL3 is AArch32. Since QEMU's 7727 * implementation is RAZ/WI we can ignore this detail, as we 7728 * do for ACTLR. 7729 */ 7730 static const ARMCPRegInfo actlr2_hactlr2_reginfo[] = { 7731 { .name = "ACTLR2", .state = ARM_CP_STATE_AA32, 7732 .cp = 15, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 3, 7733 .access = PL1_RW, .accessfn = access_tacr, 7734 .type = ARM_CP_CONST, .resetvalue = 0 }, 7735 { .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 7736 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 7737 .access = PL2_RW, .type = ARM_CP_CONST, 7738 .resetvalue = 0 }, 7739 }; 7740 7741 void register_cp_regs_for_features(ARMCPU *cpu) 7742 { 7743 /* Register all the coprocessor registers based on feature bits */ 7744 CPUARMState *env = &cpu->env; 7745 if (arm_feature(env, ARM_FEATURE_M)) { 7746 /* M profile has no coprocessor registers */ 7747 return; 7748 } 7749 7750 define_arm_cp_regs(cpu, cp_reginfo); 7751 if (!arm_feature(env, ARM_FEATURE_V8)) { 7752 /* 7753 * Must go early as it is full of wildcards that may be 7754 * overridden by later definitions. 7755 */ 7756 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 7757 } 7758 7759 if (arm_feature(env, ARM_FEATURE_V6)) { 7760 /* The ID registers all have impdef reset values */ 7761 ARMCPRegInfo v6_idregs[] = { 7762 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 7763 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 7764 .access = PL1_R, .type = ARM_CP_CONST, 7765 .accessfn = access_aa32_tid3, 7766 .resetvalue = cpu->isar.id_pfr0 }, 7767 /* 7768 * ID_PFR1 is not a plain ARM_CP_CONST because we don't know 7769 * the value of the GIC field until after we define these regs. 7770 */ 7771 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 7772 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 7773 .access = PL1_R, .type = ARM_CP_NO_RAW, 7774 .accessfn = access_aa32_tid3, 7775 .readfn = id_pfr1_read, 7776 .writefn = arm_cp_write_ignore }, 7777 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 7778 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 7779 .access = PL1_R, .type = ARM_CP_CONST, 7780 .accessfn = access_aa32_tid3, 7781 .resetvalue = cpu->isar.id_dfr0 }, 7782 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 7783 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 7784 .access = PL1_R, .type = ARM_CP_CONST, 7785 .accessfn = access_aa32_tid3, 7786 .resetvalue = cpu->id_afr0 }, 7787 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 7788 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 7789 .access = PL1_R, .type = ARM_CP_CONST, 7790 .accessfn = access_aa32_tid3, 7791 .resetvalue = cpu->isar.id_mmfr0 }, 7792 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 7793 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 7794 .access = PL1_R, .type = ARM_CP_CONST, 7795 .accessfn = access_aa32_tid3, 7796 .resetvalue = cpu->isar.id_mmfr1 }, 7797 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 7798 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 7799 .access = PL1_R, .type = ARM_CP_CONST, 7800 .accessfn = access_aa32_tid3, 7801 .resetvalue = cpu->isar.id_mmfr2 }, 7802 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 7803 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 7804 .access = PL1_R, .type = ARM_CP_CONST, 7805 .accessfn = access_aa32_tid3, 7806 .resetvalue = cpu->isar.id_mmfr3 }, 7807 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 7808 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 7809 .access = PL1_R, .type = ARM_CP_CONST, 7810 .accessfn = access_aa32_tid3, 7811 .resetvalue = cpu->isar.id_isar0 }, 7812 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 7813 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 7814 .access = PL1_R, .type = ARM_CP_CONST, 7815 .accessfn = access_aa32_tid3, 7816 .resetvalue = cpu->isar.id_isar1 }, 7817 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 7818 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 7819 .access = PL1_R, .type = ARM_CP_CONST, 7820 .accessfn = access_aa32_tid3, 7821 .resetvalue = cpu->isar.id_isar2 }, 7822 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 7823 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 7824 .access = PL1_R, .type = ARM_CP_CONST, 7825 .accessfn = access_aa32_tid3, 7826 .resetvalue = cpu->isar.id_isar3 }, 7827 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 7828 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 7829 .access = PL1_R, .type = ARM_CP_CONST, 7830 .accessfn = access_aa32_tid3, 7831 .resetvalue = cpu->isar.id_isar4 }, 7832 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 7833 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 7834 .access = PL1_R, .type = ARM_CP_CONST, 7835 .accessfn = access_aa32_tid3, 7836 .resetvalue = cpu->isar.id_isar5 }, 7837 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 7838 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 7839 .access = PL1_R, .type = ARM_CP_CONST, 7840 .accessfn = access_aa32_tid3, 7841 .resetvalue = cpu->isar.id_mmfr4 }, 7842 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 7843 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 7844 .access = PL1_R, .type = ARM_CP_CONST, 7845 .accessfn = access_aa32_tid3, 7846 .resetvalue = cpu->isar.id_isar6 }, 7847 }; 7848 define_arm_cp_regs(cpu, v6_idregs); 7849 define_arm_cp_regs(cpu, v6_cp_reginfo); 7850 } else { 7851 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 7852 } 7853 if (arm_feature(env, ARM_FEATURE_V6K)) { 7854 define_arm_cp_regs(cpu, v6k_cp_reginfo); 7855 } 7856 if (arm_feature(env, ARM_FEATURE_V7MP) && 7857 !arm_feature(env, ARM_FEATURE_PMSA)) { 7858 define_arm_cp_regs(cpu, v7mp_cp_reginfo); 7859 } 7860 if (arm_feature(env, ARM_FEATURE_V7VE)) { 7861 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 7862 } 7863 if (arm_feature(env, ARM_FEATURE_V7)) { 7864 ARMCPRegInfo clidr = { 7865 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 7866 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 7867 .access = PL1_R, .type = ARM_CP_CONST, 7868 .accessfn = access_tid4, 7869 .resetvalue = cpu->clidr 7870 }; 7871 define_one_arm_cp_reg(cpu, &clidr); 7872 define_arm_cp_regs(cpu, v7_cp_reginfo); 7873 define_debug_regs(cpu); 7874 define_pmu_regs(cpu); 7875 } else { 7876 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 7877 } 7878 if (arm_feature(env, ARM_FEATURE_V8)) { 7879 /* 7880 * v8 ID registers, which all have impdef reset values. 7881 * Note that within the ID register ranges the unused slots 7882 * must all RAZ, not UNDEF; future architecture versions may 7883 * define new registers here. 7884 * ID registers which are AArch64 views of the AArch32 ID registers 7885 * which already existed in v6 and v7 are handled elsewhere, 7886 * in v6_idregs[]. 7887 */ 7888 int i; 7889 ARMCPRegInfo v8_idregs[] = { 7890 /* 7891 * ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST in system 7892 * emulation because we don't know the right value for the 7893 * GIC field until after we define these regs. 7894 */ 7895 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 7896 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 7897 .access = PL1_R, 7898 #ifdef CONFIG_USER_ONLY 7899 .type = ARM_CP_CONST, 7900 .resetvalue = cpu->isar.id_aa64pfr0 7901 #else 7902 .type = ARM_CP_NO_RAW, 7903 .accessfn = access_aa64_tid3, 7904 .readfn = id_aa64pfr0_read, 7905 .writefn = arm_cp_write_ignore 7906 #endif 7907 }, 7908 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 7909 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 7910 .access = PL1_R, .type = ARM_CP_CONST, 7911 .accessfn = access_aa64_tid3, 7912 .resetvalue = cpu->isar.id_aa64pfr1}, 7913 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7914 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 7915 .access = PL1_R, .type = ARM_CP_CONST, 7916 .accessfn = access_aa64_tid3, 7917 .resetvalue = 0 }, 7918 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7919 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 7920 .access = PL1_R, .type = ARM_CP_CONST, 7921 .accessfn = access_aa64_tid3, 7922 .resetvalue = 0 }, 7923 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 7924 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 7925 .access = PL1_R, .type = ARM_CP_CONST, 7926 .accessfn = access_aa64_tid3, 7927 .resetvalue = cpu->isar.id_aa64zfr0 }, 7928 { .name = "ID_AA64SMFR0_EL1", .state = ARM_CP_STATE_AA64, 7929 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 7930 .access = PL1_R, .type = ARM_CP_CONST, 7931 .accessfn = access_aa64_tid3, 7932 .resetvalue = cpu->isar.id_aa64smfr0 }, 7933 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7934 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 7935 .access = PL1_R, .type = ARM_CP_CONST, 7936 .accessfn = access_aa64_tid3, 7937 .resetvalue = 0 }, 7938 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7939 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 7940 .access = PL1_R, .type = ARM_CP_CONST, 7941 .accessfn = access_aa64_tid3, 7942 .resetvalue = 0 }, 7943 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 7944 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 7945 .access = PL1_R, .type = ARM_CP_CONST, 7946 .accessfn = access_aa64_tid3, 7947 .resetvalue = cpu->isar.id_aa64dfr0 }, 7948 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 7949 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 7950 .access = PL1_R, .type = ARM_CP_CONST, 7951 .accessfn = access_aa64_tid3, 7952 .resetvalue = cpu->isar.id_aa64dfr1 }, 7953 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7954 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 7955 .access = PL1_R, .type = ARM_CP_CONST, 7956 .accessfn = access_aa64_tid3, 7957 .resetvalue = 0 }, 7958 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7959 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 7960 .access = PL1_R, .type = ARM_CP_CONST, 7961 .accessfn = access_aa64_tid3, 7962 .resetvalue = 0 }, 7963 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 7964 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 7965 .access = PL1_R, .type = ARM_CP_CONST, 7966 .accessfn = access_aa64_tid3, 7967 .resetvalue = cpu->id_aa64afr0 }, 7968 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 7969 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 7970 .access = PL1_R, .type = ARM_CP_CONST, 7971 .accessfn = access_aa64_tid3, 7972 .resetvalue = cpu->id_aa64afr1 }, 7973 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7974 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 7975 .access = PL1_R, .type = ARM_CP_CONST, 7976 .accessfn = access_aa64_tid3, 7977 .resetvalue = 0 }, 7978 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7979 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 7980 .access = PL1_R, .type = ARM_CP_CONST, 7981 .accessfn = access_aa64_tid3, 7982 .resetvalue = 0 }, 7983 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 7984 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 7985 .access = PL1_R, .type = ARM_CP_CONST, 7986 .accessfn = access_aa64_tid3, 7987 .resetvalue = cpu->isar.id_aa64isar0 }, 7988 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 7989 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 7990 .access = PL1_R, .type = ARM_CP_CONST, 7991 .accessfn = access_aa64_tid3, 7992 .resetvalue = cpu->isar.id_aa64isar1 }, 7993 { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7994 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 7995 .access = PL1_R, .type = ARM_CP_CONST, 7996 .accessfn = access_aa64_tid3, 7997 .resetvalue = 0 }, 7998 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7999 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 8000 .access = PL1_R, .type = ARM_CP_CONST, 8001 .accessfn = access_aa64_tid3, 8002 .resetvalue = 0 }, 8003 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8004 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 8005 .access = PL1_R, .type = ARM_CP_CONST, 8006 .accessfn = access_aa64_tid3, 8007 .resetvalue = 0 }, 8008 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8009 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 8010 .access = PL1_R, .type = ARM_CP_CONST, 8011 .accessfn = access_aa64_tid3, 8012 .resetvalue = 0 }, 8013 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8014 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 8015 .access = PL1_R, .type = ARM_CP_CONST, 8016 .accessfn = access_aa64_tid3, 8017 .resetvalue = 0 }, 8018 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8019 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 8020 .access = PL1_R, .type = ARM_CP_CONST, 8021 .accessfn = access_aa64_tid3, 8022 .resetvalue = 0 }, 8023 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 8024 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 8025 .access = PL1_R, .type = ARM_CP_CONST, 8026 .accessfn = access_aa64_tid3, 8027 .resetvalue = cpu->isar.id_aa64mmfr0 }, 8028 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 8029 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 8030 .access = PL1_R, .type = ARM_CP_CONST, 8031 .accessfn = access_aa64_tid3, 8032 .resetvalue = cpu->isar.id_aa64mmfr1 }, 8033 { .name = "ID_AA64MMFR2_EL1", .state = ARM_CP_STATE_AA64, 8034 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 8035 .access = PL1_R, .type = ARM_CP_CONST, 8036 .accessfn = access_aa64_tid3, 8037 .resetvalue = cpu->isar.id_aa64mmfr2 }, 8038 { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8039 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 8040 .access = PL1_R, .type = ARM_CP_CONST, 8041 .accessfn = access_aa64_tid3, 8042 .resetvalue = 0 }, 8043 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8044 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 8045 .access = PL1_R, .type = ARM_CP_CONST, 8046 .accessfn = access_aa64_tid3, 8047 .resetvalue = 0 }, 8048 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8049 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 8050 .access = PL1_R, .type = ARM_CP_CONST, 8051 .accessfn = access_aa64_tid3, 8052 .resetvalue = 0 }, 8053 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8054 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 8055 .access = PL1_R, .type = ARM_CP_CONST, 8056 .accessfn = access_aa64_tid3, 8057 .resetvalue = 0 }, 8058 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8059 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 8060 .access = PL1_R, .type = ARM_CP_CONST, 8061 .accessfn = access_aa64_tid3, 8062 .resetvalue = 0 }, 8063 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 8064 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 8065 .access = PL1_R, .type = ARM_CP_CONST, 8066 .accessfn = access_aa64_tid3, 8067 .resetvalue = cpu->isar.mvfr0 }, 8068 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 8069 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 8070 .access = PL1_R, .type = ARM_CP_CONST, 8071 .accessfn = access_aa64_tid3, 8072 .resetvalue = cpu->isar.mvfr1 }, 8073 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 8074 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 8075 .access = PL1_R, .type = ARM_CP_CONST, 8076 .accessfn = access_aa64_tid3, 8077 .resetvalue = cpu->isar.mvfr2 }, 8078 /* 8079 * "0, c0, c3, {0,1,2}" are the encodings corresponding to 8080 * AArch64 MVFR[012]_EL1. Define the STATE_AA32 encoding 8081 * as RAZ, since it is in the "reserved for future ID 8082 * registers, RAZ" part of the AArch32 encoding space. 8083 */ 8084 { .name = "RES_0_C0_C3_0", .state = ARM_CP_STATE_AA32, 8085 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 8086 .access = PL1_R, .type = ARM_CP_CONST, 8087 .accessfn = access_aa64_tid3, 8088 .resetvalue = 0 }, 8089 { .name = "RES_0_C0_C3_1", .state = ARM_CP_STATE_AA32, 8090 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 8091 .access = PL1_R, .type = ARM_CP_CONST, 8092 .accessfn = access_aa64_tid3, 8093 .resetvalue = 0 }, 8094 { .name = "RES_0_C0_C3_2", .state = ARM_CP_STATE_AA32, 8095 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 8096 .access = PL1_R, .type = ARM_CP_CONST, 8097 .accessfn = access_aa64_tid3, 8098 .resetvalue = 0 }, 8099 /* 8100 * Other encodings in "0, c0, c3, ..." are STATE_BOTH because 8101 * they're also RAZ for AArch64, and in v8 are gradually 8102 * being filled with AArch64-view-of-AArch32-ID-register 8103 * for new ID registers. 8104 */ 8105 { .name = "RES_0_C0_C3_3", .state = ARM_CP_STATE_BOTH, 8106 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 8107 .access = PL1_R, .type = ARM_CP_CONST, 8108 .accessfn = access_aa64_tid3, 8109 .resetvalue = 0 }, 8110 { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH, 8111 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 8112 .access = PL1_R, .type = ARM_CP_CONST, 8113 .accessfn = access_aa64_tid3, 8114 .resetvalue = cpu->isar.id_pfr2 }, 8115 { .name = "ID_DFR1", .state = ARM_CP_STATE_BOTH, 8116 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 8117 .access = PL1_R, .type = ARM_CP_CONST, 8118 .accessfn = access_aa64_tid3, 8119 .resetvalue = cpu->isar.id_dfr1 }, 8120 { .name = "ID_MMFR5", .state = ARM_CP_STATE_BOTH, 8121 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 8122 .access = PL1_R, .type = ARM_CP_CONST, 8123 .accessfn = access_aa64_tid3, 8124 .resetvalue = cpu->isar.id_mmfr5 }, 8125 { .name = "RES_0_C0_C3_7", .state = ARM_CP_STATE_BOTH, 8126 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 8127 .access = PL1_R, .type = ARM_CP_CONST, 8128 .accessfn = access_aa64_tid3, 8129 .resetvalue = 0 }, 8130 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 8131 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 8132 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 8133 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 8134 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 8135 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 8136 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 8137 .resetvalue = cpu->pmceid0 }, 8138 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 8139 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 8140 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 8141 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 8142 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 8143 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 8144 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 8145 .resetvalue = cpu->pmceid1 }, 8146 }; 8147 #ifdef CONFIG_USER_ONLY 8148 static const ARMCPRegUserSpaceInfo v8_user_idregs[] = { 8149 { .name = "ID_AA64PFR0_EL1", 8150 .exported_bits = R_ID_AA64PFR0_FP_MASK | 8151 R_ID_AA64PFR0_ADVSIMD_MASK | 8152 R_ID_AA64PFR0_SVE_MASK | 8153 R_ID_AA64PFR0_DIT_MASK, 8154 .fixed_bits = (0x1u << R_ID_AA64PFR0_EL0_SHIFT) | 8155 (0x1u << R_ID_AA64PFR0_EL1_SHIFT) }, 8156 { .name = "ID_AA64PFR1_EL1", 8157 .exported_bits = R_ID_AA64PFR1_BT_MASK | 8158 R_ID_AA64PFR1_SSBS_MASK | 8159 R_ID_AA64PFR1_MTE_MASK | 8160 R_ID_AA64PFR1_SME_MASK }, 8161 { .name = "ID_AA64PFR*_EL1_RESERVED", 8162 .is_glob = true }, 8163 { .name = "ID_AA64ZFR0_EL1", 8164 .exported_bits = R_ID_AA64ZFR0_SVEVER_MASK | 8165 R_ID_AA64ZFR0_AES_MASK | 8166 R_ID_AA64ZFR0_BITPERM_MASK | 8167 R_ID_AA64ZFR0_BFLOAT16_MASK | 8168 R_ID_AA64ZFR0_SHA3_MASK | 8169 R_ID_AA64ZFR0_SM4_MASK | 8170 R_ID_AA64ZFR0_I8MM_MASK | 8171 R_ID_AA64ZFR0_F32MM_MASK | 8172 R_ID_AA64ZFR0_F64MM_MASK }, 8173 { .name = "ID_AA64SMFR0_EL1", 8174 .exported_bits = R_ID_AA64SMFR0_F32F32_MASK | 8175 R_ID_AA64SMFR0_B16F32_MASK | 8176 R_ID_AA64SMFR0_F16F32_MASK | 8177 R_ID_AA64SMFR0_I8I32_MASK | 8178 R_ID_AA64SMFR0_F64F64_MASK | 8179 R_ID_AA64SMFR0_I16I64_MASK | 8180 R_ID_AA64SMFR0_FA64_MASK }, 8181 { .name = "ID_AA64MMFR0_EL1", 8182 .exported_bits = R_ID_AA64MMFR0_ECV_MASK, 8183 .fixed_bits = (0xfu << R_ID_AA64MMFR0_TGRAN64_SHIFT) | 8184 (0xfu << R_ID_AA64MMFR0_TGRAN4_SHIFT) }, 8185 { .name = "ID_AA64MMFR1_EL1", 8186 .exported_bits = R_ID_AA64MMFR1_AFP_MASK }, 8187 { .name = "ID_AA64MMFR2_EL1", 8188 .exported_bits = R_ID_AA64MMFR2_AT_MASK }, 8189 { .name = "ID_AA64MMFR*_EL1_RESERVED", 8190 .is_glob = true }, 8191 { .name = "ID_AA64DFR0_EL1", 8192 .fixed_bits = (0x6u << R_ID_AA64DFR0_DEBUGVER_SHIFT) }, 8193 { .name = "ID_AA64DFR1_EL1" }, 8194 { .name = "ID_AA64DFR*_EL1_RESERVED", 8195 .is_glob = true }, 8196 { .name = "ID_AA64AFR*", 8197 .is_glob = true }, 8198 { .name = "ID_AA64ISAR0_EL1", 8199 .exported_bits = R_ID_AA64ISAR0_AES_MASK | 8200 R_ID_AA64ISAR0_SHA1_MASK | 8201 R_ID_AA64ISAR0_SHA2_MASK | 8202 R_ID_AA64ISAR0_CRC32_MASK | 8203 R_ID_AA64ISAR0_ATOMIC_MASK | 8204 R_ID_AA64ISAR0_RDM_MASK | 8205 R_ID_AA64ISAR0_SHA3_MASK | 8206 R_ID_AA64ISAR0_SM3_MASK | 8207 R_ID_AA64ISAR0_SM4_MASK | 8208 R_ID_AA64ISAR0_DP_MASK | 8209 R_ID_AA64ISAR0_FHM_MASK | 8210 R_ID_AA64ISAR0_TS_MASK | 8211 R_ID_AA64ISAR0_RNDR_MASK }, 8212 { .name = "ID_AA64ISAR1_EL1", 8213 .exported_bits = R_ID_AA64ISAR1_DPB_MASK | 8214 R_ID_AA64ISAR1_APA_MASK | 8215 R_ID_AA64ISAR1_API_MASK | 8216 R_ID_AA64ISAR1_JSCVT_MASK | 8217 R_ID_AA64ISAR1_FCMA_MASK | 8218 R_ID_AA64ISAR1_LRCPC_MASK | 8219 R_ID_AA64ISAR1_GPA_MASK | 8220 R_ID_AA64ISAR1_GPI_MASK | 8221 R_ID_AA64ISAR1_FRINTTS_MASK | 8222 R_ID_AA64ISAR1_SB_MASK | 8223 R_ID_AA64ISAR1_BF16_MASK | 8224 R_ID_AA64ISAR1_DGH_MASK | 8225 R_ID_AA64ISAR1_I8MM_MASK }, 8226 { .name = "ID_AA64ISAR2_EL1", 8227 .exported_bits = R_ID_AA64ISAR2_WFXT_MASK | 8228 R_ID_AA64ISAR2_RPRES_MASK | 8229 R_ID_AA64ISAR2_GPA3_MASK | 8230 R_ID_AA64ISAR2_APA3_MASK }, 8231 { .name = "ID_AA64ISAR*_EL1_RESERVED", 8232 .is_glob = true }, 8233 }; 8234 modify_arm_cp_regs(v8_idregs, v8_user_idregs); 8235 #endif 8236 /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ 8237 if (!arm_feature(env, ARM_FEATURE_EL3) && 8238 !arm_feature(env, ARM_FEATURE_EL2)) { 8239 ARMCPRegInfo rvbar = { 8240 .name = "RVBAR_EL1", .state = ARM_CP_STATE_BOTH, 8241 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 8242 .access = PL1_R, 8243 .fieldoffset = offsetof(CPUARMState, cp15.rvbar), 8244 }; 8245 define_one_arm_cp_reg(cpu, &rvbar); 8246 } 8247 define_arm_cp_regs(cpu, v8_idregs); 8248 define_arm_cp_regs(cpu, v8_cp_reginfo); 8249 8250 for (i = 4; i < 16; i++) { 8251 /* 8252 * Encodings in "0, c0, {c4-c7}, {0-7}" are RAZ for AArch32. 8253 * For pre-v8 cores there are RAZ patterns for these in 8254 * id_pre_v8_midr_cp_reginfo[]; for v8 we do that here. 8255 * v8 extends the "must RAZ" part of the ID register space 8256 * to also cover c0, 0, c{8-15}, {0-7}. 8257 * These are STATE_AA32 because in the AArch64 sysreg space 8258 * c4-c7 is where the AArch64 ID registers live (and we've 8259 * already defined those in v8_idregs[]), and c8-c15 are not 8260 * "must RAZ" for AArch64. 8261 */ 8262 g_autofree char *name = g_strdup_printf("RES_0_C0_C%d_X", i); 8263 ARMCPRegInfo v8_aa32_raz_idregs = { 8264 .name = name, 8265 .state = ARM_CP_STATE_AA32, 8266 .cp = 15, .opc1 = 0, .crn = 0, .crm = i, .opc2 = CP_ANY, 8267 .access = PL1_R, .type = ARM_CP_CONST, 8268 .accessfn = access_aa64_tid3, 8269 .resetvalue = 0 }; 8270 define_one_arm_cp_reg(cpu, &v8_aa32_raz_idregs); 8271 } 8272 } 8273 8274 /* 8275 * Register the base EL2 cpregs. 8276 * Pre v8, these registers are implemented only as part of the 8277 * Virtualization Extensions (EL2 present). Beginning with v8, 8278 * if EL2 is missing but EL3 is enabled, mostly these become 8279 * RES0 from EL3, with some specific exceptions. 8280 */ 8281 if (arm_feature(env, ARM_FEATURE_EL2) 8282 || (arm_feature(env, ARM_FEATURE_EL3) 8283 && arm_feature(env, ARM_FEATURE_V8))) { 8284 uint64_t vmpidr_def = mpidr_read_val(env); 8285 ARMCPRegInfo vpidr_regs[] = { 8286 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 8287 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 8288 .access = PL2_RW, .accessfn = access_el3_aa32ns, 8289 .resetvalue = cpu->midr, 8290 .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ, 8291 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 8292 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 8293 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 8294 .access = PL2_RW, .resetvalue = cpu->midr, 8295 .type = ARM_CP_EL3_NO_EL2_C_NZ, 8296 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 8297 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 8298 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 8299 .access = PL2_RW, .accessfn = access_el3_aa32ns, 8300 .resetvalue = vmpidr_def, 8301 .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ, 8302 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 8303 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 8304 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 8305 .access = PL2_RW, .resetvalue = vmpidr_def, 8306 .type = ARM_CP_EL3_NO_EL2_C_NZ, 8307 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 8308 }; 8309 /* 8310 * The only field of MDCR_EL2 that has a defined architectural reset 8311 * value is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N. 8312 */ 8313 ARMCPRegInfo mdcr_el2 = { 8314 .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, .type = ARM_CP_IO, 8315 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 8316 .writefn = mdcr_el2_write, 8317 .access = PL2_RW, .resetvalue = pmu_num_counters(env), 8318 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), 8319 }; 8320 define_one_arm_cp_reg(cpu, &mdcr_el2); 8321 define_arm_cp_regs(cpu, vpidr_regs); 8322 define_arm_cp_regs(cpu, el2_cp_reginfo); 8323 if (arm_feature(env, ARM_FEATURE_V8)) { 8324 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 8325 } 8326 if (cpu_isar_feature(aa64_sel2, cpu)) { 8327 define_arm_cp_regs(cpu, el2_sec_cp_reginfo); 8328 } 8329 /* RVBAR_EL2 is only implemented if EL2 is the highest EL */ 8330 if (!arm_feature(env, ARM_FEATURE_EL3)) { 8331 ARMCPRegInfo rvbar[] = { 8332 { 8333 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 8334 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 8335 .access = PL2_R, 8336 .fieldoffset = offsetof(CPUARMState, cp15.rvbar), 8337 }, 8338 { .name = "RVBAR", .type = ARM_CP_ALIAS, 8339 .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 8340 .access = PL2_R, 8341 .fieldoffset = offsetof(CPUARMState, cp15.rvbar), 8342 }, 8343 }; 8344 define_arm_cp_regs(cpu, rvbar); 8345 } 8346 } 8347 8348 /* Register the base EL3 cpregs. */ 8349 if (arm_feature(env, ARM_FEATURE_EL3)) { 8350 define_arm_cp_regs(cpu, el3_cp_reginfo); 8351 ARMCPRegInfo el3_regs[] = { 8352 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 8353 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 8354 .access = PL3_R, 8355 .fieldoffset = offsetof(CPUARMState, cp15.rvbar), 8356 }, 8357 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 8358 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 8359 .access = PL3_RW, 8360 .raw_writefn = raw_write, .writefn = sctlr_write, 8361 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 8362 .resetvalue = cpu->reset_sctlr }, 8363 }; 8364 8365 define_arm_cp_regs(cpu, el3_regs); 8366 } 8367 /* 8368 * The behaviour of NSACR is sufficiently various that we don't 8369 * try to describe it in a single reginfo: 8370 * if EL3 is 64 bit, then trap to EL3 from S EL1, 8371 * reads as constant 0xc00 from NS EL1 and NS EL2 8372 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 8373 * if v7 without EL3, register doesn't exist 8374 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 8375 */ 8376 if (arm_feature(env, ARM_FEATURE_EL3)) { 8377 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 8378 static const ARMCPRegInfo nsacr = { 8379 .name = "NSACR", .type = ARM_CP_CONST, 8380 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 8381 .access = PL1_RW, .accessfn = nsacr_access, 8382 .resetvalue = 0xc00 8383 }; 8384 define_one_arm_cp_reg(cpu, &nsacr); 8385 } else { 8386 static const ARMCPRegInfo nsacr = { 8387 .name = "NSACR", 8388 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 8389 .access = PL3_RW | PL1_R, 8390 .resetvalue = 0, 8391 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 8392 }; 8393 define_one_arm_cp_reg(cpu, &nsacr); 8394 } 8395 } else { 8396 if (arm_feature(env, ARM_FEATURE_V8)) { 8397 static const ARMCPRegInfo nsacr = { 8398 .name = "NSACR", .type = ARM_CP_CONST, 8399 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 8400 .access = PL1_R, 8401 .resetvalue = 0xc00 8402 }; 8403 define_one_arm_cp_reg(cpu, &nsacr); 8404 } 8405 } 8406 8407 if (arm_feature(env, ARM_FEATURE_PMSA)) { 8408 if (arm_feature(env, ARM_FEATURE_V6)) { 8409 /* PMSAv6 not implemented */ 8410 assert(arm_feature(env, ARM_FEATURE_V7)); 8411 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 8412 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 8413 } else { 8414 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 8415 } 8416 } else { 8417 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 8418 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 8419 /* TTCBR2 is introduced with ARMv8.2-AA32HPD. */ 8420 if (cpu_isar_feature(aa32_hpd, cpu)) { 8421 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 8422 } 8423 } 8424 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 8425 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 8426 } 8427 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 8428 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 8429 } 8430 if (arm_feature(env, ARM_FEATURE_VAPA)) { 8431 define_arm_cp_regs(cpu, vapa_cp_reginfo); 8432 } 8433 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 8434 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 8435 } 8436 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 8437 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 8438 } 8439 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 8440 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 8441 } 8442 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 8443 define_arm_cp_regs(cpu, omap_cp_reginfo); 8444 } 8445 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 8446 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 8447 } 8448 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 8449 define_arm_cp_regs(cpu, xscale_cp_reginfo); 8450 } 8451 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 8452 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 8453 } 8454 if (arm_feature(env, ARM_FEATURE_LPAE)) { 8455 define_arm_cp_regs(cpu, lpae_cp_reginfo); 8456 } 8457 if (cpu_isar_feature(aa32_jazelle, cpu)) { 8458 define_arm_cp_regs(cpu, jazelle_regs); 8459 } 8460 /* 8461 * Slightly awkwardly, the OMAP and StrongARM cores need all of 8462 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 8463 * be read-only (ie write causes UNDEF exception). 8464 */ 8465 { 8466 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 8467 /* 8468 * Pre-v8 MIDR space. 8469 * Note that the MIDR isn't a simple constant register because 8470 * of the TI925 behaviour where writes to another register can 8471 * cause the MIDR value to change. 8472 * 8473 * Unimplemented registers in the c15 0 0 0 space default to 8474 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 8475 * and friends override accordingly. 8476 */ 8477 { .name = "MIDR", 8478 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 8479 .access = PL1_R, .resetvalue = cpu->midr, 8480 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 8481 .readfn = midr_read, 8482 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 8483 .type = ARM_CP_OVERRIDE }, 8484 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 8485 { .name = "DUMMY", 8486 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 8487 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8488 { .name = "DUMMY", 8489 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 8490 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8491 { .name = "DUMMY", 8492 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 8493 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8494 { .name = "DUMMY", 8495 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 8496 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8497 { .name = "DUMMY", 8498 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 8499 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8500 }; 8501 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 8502 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 8503 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 8504 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 8505 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 8506 .readfn = midr_read }, 8507 /* crn = 0 op1 = 0 crm = 0 op2 = 7 : AArch32 aliases of MIDR */ 8508 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 8509 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 8510 .access = PL1_R, .resetvalue = cpu->midr }, 8511 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 8512 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 8513 .access = PL1_R, 8514 .accessfn = access_aa64_tid1, 8515 .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 8516 }; 8517 ARMCPRegInfo id_v8_midr_alias_cp_reginfo = { 8518 .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 8519 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 8520 .access = PL1_R, .resetvalue = cpu->midr 8521 }; 8522 ARMCPRegInfo id_cp_reginfo[] = { 8523 /* These are common to v8 and pre-v8 */ 8524 { .name = "CTR", 8525 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 8526 .access = PL1_R, .accessfn = ctr_el0_access, 8527 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 8528 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 8529 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 8530 .access = PL0_R, .accessfn = ctr_el0_access, 8531 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 8532 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 8533 { .name = "TCMTR", 8534 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 8535 .access = PL1_R, 8536 .accessfn = access_aa32_tid1, 8537 .type = ARM_CP_CONST, .resetvalue = 0 }, 8538 }; 8539 /* TLBTR is specific to VMSA */ 8540 ARMCPRegInfo id_tlbtr_reginfo = { 8541 .name = "TLBTR", 8542 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 8543 .access = PL1_R, 8544 .accessfn = access_aa32_tid1, 8545 .type = ARM_CP_CONST, .resetvalue = 0, 8546 }; 8547 /* MPUIR is specific to PMSA V6+ */ 8548 ARMCPRegInfo id_mpuir_reginfo = { 8549 .name = "MPUIR", 8550 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 8551 .access = PL1_R, .type = ARM_CP_CONST, 8552 .resetvalue = cpu->pmsav7_dregion << 8 8553 }; 8554 /* HMPUIR is specific to PMSA V8 */ 8555 ARMCPRegInfo id_hmpuir_reginfo = { 8556 .name = "HMPUIR", 8557 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 4, 8558 .access = PL2_R, .type = ARM_CP_CONST, 8559 .resetvalue = cpu->pmsav8r_hdregion 8560 }; 8561 static const ARMCPRegInfo crn0_wi_reginfo = { 8562 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 8563 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 8564 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 8565 }; 8566 #ifdef CONFIG_USER_ONLY 8567 static const ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = { 8568 { .name = "MIDR_EL1", 8569 .exported_bits = R_MIDR_EL1_REVISION_MASK | 8570 R_MIDR_EL1_PARTNUM_MASK | 8571 R_MIDR_EL1_ARCHITECTURE_MASK | 8572 R_MIDR_EL1_VARIANT_MASK | 8573 R_MIDR_EL1_IMPLEMENTER_MASK }, 8574 { .name = "REVIDR_EL1" }, 8575 }; 8576 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo); 8577 #endif 8578 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 8579 arm_feature(env, ARM_FEATURE_STRONGARM)) { 8580 size_t i; 8581 /* 8582 * Register the blanket "writes ignored" value first to cover the 8583 * whole space. Then update the specific ID registers to allow write 8584 * access, so that they ignore writes rather than causing them to 8585 * UNDEF. 8586 */ 8587 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 8588 for (i = 0; i < ARRAY_SIZE(id_pre_v8_midr_cp_reginfo); ++i) { 8589 id_pre_v8_midr_cp_reginfo[i].access = PL1_RW; 8590 } 8591 for (i = 0; i < ARRAY_SIZE(id_cp_reginfo); ++i) { 8592 id_cp_reginfo[i].access = PL1_RW; 8593 } 8594 id_mpuir_reginfo.access = PL1_RW; 8595 id_tlbtr_reginfo.access = PL1_RW; 8596 } 8597 if (arm_feature(env, ARM_FEATURE_V8)) { 8598 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 8599 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 8600 define_one_arm_cp_reg(cpu, &id_v8_midr_alias_cp_reginfo); 8601 } 8602 } else { 8603 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 8604 } 8605 define_arm_cp_regs(cpu, id_cp_reginfo); 8606 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 8607 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 8608 } else if (arm_feature(env, ARM_FEATURE_PMSA) && 8609 arm_feature(env, ARM_FEATURE_V8)) { 8610 uint32_t i = 0; 8611 char *tmp_string; 8612 8613 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 8614 define_one_arm_cp_reg(cpu, &id_hmpuir_reginfo); 8615 define_arm_cp_regs(cpu, pmsav8r_cp_reginfo); 8616 8617 /* Register alias is only valid for first 32 indexes */ 8618 for (i = 0; i < MIN(cpu->pmsav7_dregion, 32); ++i) { 8619 uint8_t crm = 0b1000 | extract32(i, 1, 3); 8620 uint8_t opc1 = extract32(i, 4, 1); 8621 uint8_t opc2 = extract32(i, 0, 1) << 2; 8622 8623 tmp_string = g_strdup_printf("PRBAR%u", i); 8624 ARMCPRegInfo tmp_prbarn_reginfo = { 8625 .name = tmp_string, .type = ARM_CP_ALIAS | ARM_CP_NO_RAW, 8626 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 8627 .access = PL1_RW, .resetvalue = 0, 8628 .accessfn = access_tvm_trvm, 8629 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 8630 }; 8631 define_one_arm_cp_reg(cpu, &tmp_prbarn_reginfo); 8632 g_free(tmp_string); 8633 8634 opc2 = extract32(i, 0, 1) << 2 | 0x1; 8635 tmp_string = g_strdup_printf("PRLAR%u", i); 8636 ARMCPRegInfo tmp_prlarn_reginfo = { 8637 .name = tmp_string, .type = ARM_CP_ALIAS | ARM_CP_NO_RAW, 8638 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 8639 .access = PL1_RW, .resetvalue = 0, 8640 .accessfn = access_tvm_trvm, 8641 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 8642 }; 8643 define_one_arm_cp_reg(cpu, &tmp_prlarn_reginfo); 8644 g_free(tmp_string); 8645 } 8646 8647 /* Register alias is only valid for first 32 indexes */ 8648 for (i = 0; i < MIN(cpu->pmsav8r_hdregion, 32); ++i) { 8649 uint8_t crm = 0b1000 | extract32(i, 1, 3); 8650 uint8_t opc1 = 0b100 | extract32(i, 4, 1); 8651 uint8_t opc2 = extract32(i, 0, 1) << 2; 8652 8653 tmp_string = g_strdup_printf("HPRBAR%u", i); 8654 ARMCPRegInfo tmp_hprbarn_reginfo = { 8655 .name = tmp_string, 8656 .type = ARM_CP_NO_RAW, 8657 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 8658 .access = PL2_RW, .resetvalue = 0, 8659 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 8660 }; 8661 define_one_arm_cp_reg(cpu, &tmp_hprbarn_reginfo); 8662 g_free(tmp_string); 8663 8664 opc2 = extract32(i, 0, 1) << 2 | 0x1; 8665 tmp_string = g_strdup_printf("HPRLAR%u", i); 8666 ARMCPRegInfo tmp_hprlarn_reginfo = { 8667 .name = tmp_string, 8668 .type = ARM_CP_NO_RAW, 8669 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 8670 .access = PL2_RW, .resetvalue = 0, 8671 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 8672 }; 8673 define_one_arm_cp_reg(cpu, &tmp_hprlarn_reginfo); 8674 g_free(tmp_string); 8675 } 8676 } else if (arm_feature(env, ARM_FEATURE_V7)) { 8677 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 8678 } 8679 } 8680 8681 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 8682 ARMCPRegInfo mpidr_cp_reginfo[] = { 8683 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH, 8684 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 8685 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 8686 }; 8687 #ifdef CONFIG_USER_ONLY 8688 static const ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = { 8689 { .name = "MPIDR_EL1", 8690 .fixed_bits = 0x0000000080000000 }, 8691 }; 8692 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo); 8693 #endif 8694 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 8695 } 8696 8697 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 8698 ARMCPRegInfo auxcr_reginfo[] = { 8699 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 8700 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 8701 .access = PL1_RW, .accessfn = access_tacr, 8702 .type = ARM_CP_CONST, .resetvalue = cpu->reset_auxcr }, 8703 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 8704 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 8705 .access = PL2_RW, .type = ARM_CP_CONST, 8706 .resetvalue = 0 }, 8707 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 8708 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 8709 .access = PL3_RW, .type = ARM_CP_CONST, 8710 .resetvalue = 0 }, 8711 }; 8712 define_arm_cp_regs(cpu, auxcr_reginfo); 8713 if (cpu_isar_feature(aa32_ac2, cpu)) { 8714 define_arm_cp_regs(cpu, actlr2_hactlr2_reginfo); 8715 } 8716 } 8717 8718 if (arm_feature(env, ARM_FEATURE_CBAR)) { 8719 /* 8720 * CBAR is IMPDEF, but common on Arm Cortex-A implementations. 8721 * There are two flavours: 8722 * (1) older 32-bit only cores have a simple 32-bit CBAR 8723 * (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a 8724 * 32-bit register visible to AArch32 at a different encoding 8725 * to the "flavour 1" register and with the bits rearranged to 8726 * be able to squash a 64-bit address into the 32-bit view. 8727 * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but 8728 * in future if we support AArch32-only configs of some of the 8729 * AArch64 cores we might need to add a specific feature flag 8730 * to indicate cores with "flavour 2" CBAR. 8731 */ 8732 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 8733 /* 32 bit view is [31:18] 0...0 [43:32]. */ 8734 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 8735 | extract64(cpu->reset_cbar, 32, 12); 8736 ARMCPRegInfo cbar_reginfo[] = { 8737 { .name = "CBAR", 8738 .type = ARM_CP_CONST, 8739 .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0, 8740 .access = PL1_R, .resetvalue = cbar32 }, 8741 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 8742 .type = ARM_CP_CONST, 8743 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 8744 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 8745 }; 8746 /* We don't implement a r/w 64 bit CBAR currently */ 8747 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 8748 define_arm_cp_regs(cpu, cbar_reginfo); 8749 } else { 8750 ARMCPRegInfo cbar = { 8751 .name = "CBAR", 8752 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 8753 .access = PL1_R | PL3_W, .resetvalue = cpu->reset_cbar, 8754 .fieldoffset = offsetof(CPUARMState, 8755 cp15.c15_config_base_address) 8756 }; 8757 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 8758 cbar.access = PL1_R; 8759 cbar.fieldoffset = 0; 8760 cbar.type = ARM_CP_CONST; 8761 } 8762 define_one_arm_cp_reg(cpu, &cbar); 8763 } 8764 } 8765 8766 if (arm_feature(env, ARM_FEATURE_VBAR)) { 8767 static const ARMCPRegInfo vbar_cp_reginfo[] = { 8768 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 8769 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 8770 .access = PL1_RW, .writefn = vbar_write, 8771 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 8772 offsetof(CPUARMState, cp15.vbar_ns) }, 8773 .resetvalue = 0 }, 8774 }; 8775 define_arm_cp_regs(cpu, vbar_cp_reginfo); 8776 } 8777 8778 /* Generic registers whose values depend on the implementation */ 8779 { 8780 ARMCPRegInfo sctlr = { 8781 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 8782 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 8783 .access = PL1_RW, .accessfn = access_tvm_trvm, 8784 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 8785 offsetof(CPUARMState, cp15.sctlr_ns) }, 8786 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 8787 .raw_writefn = raw_write, 8788 }; 8789 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 8790 /* 8791 * Normally we would always end the TB on an SCTLR write, but Linux 8792 * arch/arm/mach-pxa/sleep.S expects two instructions following 8793 * an MMU enable to execute from cache. Imitate this behaviour. 8794 */ 8795 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 8796 } 8797 define_one_arm_cp_reg(cpu, &sctlr); 8798 8799 if (arm_feature(env, ARM_FEATURE_PMSA) && 8800 arm_feature(env, ARM_FEATURE_V8)) { 8801 ARMCPRegInfo vsctlr = { 8802 .name = "VSCTLR", .state = ARM_CP_STATE_AA32, 8803 .cp = 15, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 8804 .access = PL2_RW, .resetvalue = 0x0, 8805 .fieldoffset = offsetoflow32(CPUARMState, cp15.vsctlr), 8806 }; 8807 define_one_arm_cp_reg(cpu, &vsctlr); 8808 } 8809 } 8810 8811 if (cpu_isar_feature(aa64_lor, cpu)) { 8812 define_arm_cp_regs(cpu, lor_reginfo); 8813 } 8814 if (cpu_isar_feature(aa64_pan, cpu)) { 8815 define_one_arm_cp_reg(cpu, &pan_reginfo); 8816 } 8817 #ifndef CONFIG_USER_ONLY 8818 if (cpu_isar_feature(aa64_ats1e1, cpu)) { 8819 define_arm_cp_regs(cpu, ats1e1_reginfo); 8820 } 8821 if (cpu_isar_feature(aa32_ats1e1, cpu)) { 8822 define_arm_cp_regs(cpu, ats1cp_reginfo); 8823 } 8824 #endif 8825 if (cpu_isar_feature(aa64_uao, cpu)) { 8826 define_one_arm_cp_reg(cpu, &uao_reginfo); 8827 } 8828 8829 if (cpu_isar_feature(aa64_dit, cpu)) { 8830 define_one_arm_cp_reg(cpu, &dit_reginfo); 8831 } 8832 if (cpu_isar_feature(aa64_ssbs, cpu)) { 8833 define_one_arm_cp_reg(cpu, &ssbs_reginfo); 8834 } 8835 if (cpu_isar_feature(any_ras, cpu)) { 8836 define_arm_cp_regs(cpu, minimal_ras_reginfo); 8837 } 8838 8839 if (cpu_isar_feature(aa64_vh, cpu) || 8840 cpu_isar_feature(aa64_debugv8p2, cpu)) { 8841 define_one_arm_cp_reg(cpu, &contextidr_el2); 8842 } 8843 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 8844 define_arm_cp_regs(cpu, vhe_reginfo); 8845 } 8846 8847 if (cpu_isar_feature(aa64_sve, cpu)) { 8848 define_arm_cp_regs(cpu, zcr_reginfo); 8849 } 8850 8851 if (cpu_isar_feature(aa64_hcx, cpu)) { 8852 define_one_arm_cp_reg(cpu, &hcrx_el2_reginfo); 8853 } 8854 8855 #ifdef TARGET_AARCH64 8856 if (cpu_isar_feature(aa64_sme, cpu)) { 8857 define_arm_cp_regs(cpu, sme_reginfo); 8858 } 8859 if (cpu_isar_feature(aa64_pauth, cpu)) { 8860 define_arm_cp_regs(cpu, pauth_reginfo); 8861 } 8862 if (cpu_isar_feature(aa64_rndr, cpu)) { 8863 define_arm_cp_regs(cpu, rndr_reginfo); 8864 } 8865 if (cpu_isar_feature(aa64_tlbirange, cpu)) { 8866 define_arm_cp_regs(cpu, tlbirange_reginfo); 8867 } 8868 if (cpu_isar_feature(aa64_tlbios, cpu)) { 8869 define_arm_cp_regs(cpu, tlbios_reginfo); 8870 } 8871 #ifndef CONFIG_USER_ONLY 8872 /* Data Cache clean instructions up to PoP */ 8873 if (cpu_isar_feature(aa64_dcpop, cpu)) { 8874 define_one_arm_cp_reg(cpu, dcpop_reg); 8875 8876 if (cpu_isar_feature(aa64_dcpodp, cpu)) { 8877 define_one_arm_cp_reg(cpu, dcpodp_reg); 8878 } 8879 } 8880 #endif /*CONFIG_USER_ONLY*/ 8881 8882 /* 8883 * If full MTE is enabled, add all of the system registers. 8884 * If only "instructions available at EL0" are enabled, 8885 * then define only a RAZ/WI version of PSTATE.TCO. 8886 */ 8887 if (cpu_isar_feature(aa64_mte, cpu)) { 8888 define_arm_cp_regs(cpu, mte_reginfo); 8889 define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo); 8890 } else if (cpu_isar_feature(aa64_mte_insn_reg, cpu)) { 8891 define_arm_cp_regs(cpu, mte_tco_ro_reginfo); 8892 define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo); 8893 } 8894 8895 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 8896 define_arm_cp_regs(cpu, scxtnum_reginfo); 8897 } 8898 #endif 8899 8900 if (cpu_isar_feature(any_predinv, cpu)) { 8901 define_arm_cp_regs(cpu, predinv_reginfo); 8902 } 8903 8904 if (cpu_isar_feature(any_ccidx, cpu)) { 8905 define_arm_cp_regs(cpu, ccsidr2_reginfo); 8906 } 8907 8908 #ifndef CONFIG_USER_ONLY 8909 /* 8910 * Register redirections and aliases must be done last, 8911 * after the registers from the other extensions have been defined. 8912 */ 8913 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 8914 define_arm_vh_e2h_redirects_aliases(cpu); 8915 } 8916 #endif 8917 } 8918 8919 /* Sort alphabetically by type name, except for "any". */ 8920 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b) 8921 { 8922 ObjectClass *class_a = (ObjectClass *)a; 8923 ObjectClass *class_b = (ObjectClass *)b; 8924 const char *name_a, *name_b; 8925 8926 name_a = object_class_get_name(class_a); 8927 name_b = object_class_get_name(class_b); 8928 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) { 8929 return 1; 8930 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) { 8931 return -1; 8932 } else { 8933 return strcmp(name_a, name_b); 8934 } 8935 } 8936 8937 static void arm_cpu_list_entry(gpointer data, gpointer user_data) 8938 { 8939 ObjectClass *oc = data; 8940 CPUClass *cc = CPU_CLASS(oc); 8941 const char *typename; 8942 char *name; 8943 8944 typename = object_class_get_name(oc); 8945 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU)); 8946 if (cc->deprecation_note) { 8947 qemu_printf(" %s (deprecated)\n", name); 8948 } else { 8949 qemu_printf(" %s\n", name); 8950 } 8951 g_free(name); 8952 } 8953 8954 void arm_cpu_list(void) 8955 { 8956 GSList *list; 8957 8958 list = object_class_get_list(TYPE_ARM_CPU, false); 8959 list = g_slist_sort(list, arm_cpu_list_compare); 8960 qemu_printf("Available CPUs:\n"); 8961 g_slist_foreach(list, arm_cpu_list_entry, NULL); 8962 g_slist_free(list); 8963 } 8964 8965 static void arm_cpu_add_definition(gpointer data, gpointer user_data) 8966 { 8967 ObjectClass *oc = data; 8968 CpuDefinitionInfoList **cpu_list = user_data; 8969 CpuDefinitionInfo *info; 8970 const char *typename; 8971 8972 typename = object_class_get_name(oc); 8973 info = g_malloc0(sizeof(*info)); 8974 info->name = g_strndup(typename, 8975 strlen(typename) - strlen("-" TYPE_ARM_CPU)); 8976 info->q_typename = g_strdup(typename); 8977 8978 QAPI_LIST_PREPEND(*cpu_list, info); 8979 } 8980 8981 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp) 8982 { 8983 CpuDefinitionInfoList *cpu_list = NULL; 8984 GSList *list; 8985 8986 list = object_class_get_list(TYPE_ARM_CPU, false); 8987 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list); 8988 g_slist_free(list); 8989 8990 return cpu_list; 8991 } 8992 8993 /* 8994 * Private utility function for define_one_arm_cp_reg_with_opaque(): 8995 * add a single reginfo struct to the hash table. 8996 */ 8997 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 8998 void *opaque, CPState state, 8999 CPSecureState secstate, 9000 int crm, int opc1, int opc2, 9001 const char *name) 9002 { 9003 CPUARMState *env = &cpu->env; 9004 uint32_t key; 9005 ARMCPRegInfo *r2; 9006 bool is64 = r->type & ARM_CP_64BIT; 9007 bool ns = secstate & ARM_CP_SECSTATE_NS; 9008 int cp = r->cp; 9009 size_t name_len; 9010 bool make_const; 9011 9012 switch (state) { 9013 case ARM_CP_STATE_AA32: 9014 /* We assume it is a cp15 register if the .cp field is left unset. */ 9015 if (cp == 0 && r->state == ARM_CP_STATE_BOTH) { 9016 cp = 15; 9017 } 9018 key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2); 9019 break; 9020 case ARM_CP_STATE_AA64: 9021 /* 9022 * To allow abbreviation of ARMCPRegInfo definitions, we treat 9023 * cp == 0 as equivalent to the value for "standard guest-visible 9024 * sysreg". STATE_BOTH definitions are also always "standard sysreg" 9025 * in their AArch64 view (the .cp value may be non-zero for the 9026 * benefit of the AArch32 view). 9027 */ 9028 if (cp == 0 || r->state == ARM_CP_STATE_BOTH) { 9029 cp = CP_REG_ARM64_SYSREG_CP; 9030 } 9031 key = ENCODE_AA64_CP_REG(cp, r->crn, crm, r->opc0, opc1, opc2); 9032 break; 9033 default: 9034 g_assert_not_reached(); 9035 } 9036 9037 /* Overriding of an existing definition must be explicitly requested. */ 9038 if (!(r->type & ARM_CP_OVERRIDE)) { 9039 const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key); 9040 if (oldreg) { 9041 assert(oldreg->type & ARM_CP_OVERRIDE); 9042 } 9043 } 9044 9045 /* 9046 * Eliminate registers that are not present because the EL is missing. 9047 * Doing this here makes it easier to put all registers for a given 9048 * feature into the same ARMCPRegInfo array and define them all at once. 9049 */ 9050 make_const = false; 9051 if (arm_feature(env, ARM_FEATURE_EL3)) { 9052 /* 9053 * An EL2 register without EL2 but with EL3 is (usually) RES0. 9054 * See rule RJFFP in section D1.1.3 of DDI0487H.a. 9055 */ 9056 int min_el = ctz32(r->access) / 2; 9057 if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) { 9058 if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) { 9059 return; 9060 } 9061 make_const = !(r->type & ARM_CP_EL3_NO_EL2_KEEP); 9062 } 9063 } else { 9064 CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2) 9065 ? PL2_RW : PL1_RW); 9066 if ((r->access & max_el) == 0) { 9067 return; 9068 } 9069 } 9070 9071 /* Combine cpreg and name into one allocation. */ 9072 name_len = strlen(name) + 1; 9073 r2 = g_malloc(sizeof(*r2) + name_len); 9074 *r2 = *r; 9075 r2->name = memcpy(r2 + 1, name, name_len); 9076 9077 /* 9078 * Update fields to match the instantiation, overwiting wildcards 9079 * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH. 9080 */ 9081 r2->cp = cp; 9082 r2->crm = crm; 9083 r2->opc1 = opc1; 9084 r2->opc2 = opc2; 9085 r2->state = state; 9086 r2->secure = secstate; 9087 if (opaque) { 9088 r2->opaque = opaque; 9089 } 9090 9091 if (make_const) { 9092 /* This should not have been a very special register to begin. */ 9093 int old_special = r2->type & ARM_CP_SPECIAL_MASK; 9094 assert(old_special == 0 || old_special == ARM_CP_NOP); 9095 /* 9096 * Set the special function to CONST, retaining the other flags. 9097 * This is important for e.g. ARM_CP_SVE so that we still 9098 * take the SVE trap if CPTR_EL3.EZ == 0. 9099 */ 9100 r2->type = (r2->type & ~ARM_CP_SPECIAL_MASK) | ARM_CP_CONST; 9101 /* 9102 * Usually, these registers become RES0, but there are a few 9103 * special cases like VPIDR_EL2 which have a constant non-zero 9104 * value with writes ignored. 9105 */ 9106 if (!(r->type & ARM_CP_EL3_NO_EL2_C_NZ)) { 9107 r2->resetvalue = 0; 9108 } 9109 /* 9110 * ARM_CP_CONST has precedence, so removing the callbacks and 9111 * offsets are not strictly necessary, but it is potentially 9112 * less confusing to debug later. 9113 */ 9114 r2->readfn = NULL; 9115 r2->writefn = NULL; 9116 r2->raw_readfn = NULL; 9117 r2->raw_writefn = NULL; 9118 r2->resetfn = NULL; 9119 r2->fieldoffset = 0; 9120 r2->bank_fieldoffsets[0] = 0; 9121 r2->bank_fieldoffsets[1] = 0; 9122 } else { 9123 bool isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]; 9124 9125 if (isbanked) { 9126 /* 9127 * Register is banked (using both entries in array). 9128 * Overwriting fieldoffset as the array is only used to define 9129 * banked registers but later only fieldoffset is used. 9130 */ 9131 r2->fieldoffset = r->bank_fieldoffsets[ns]; 9132 } 9133 if (state == ARM_CP_STATE_AA32) { 9134 if (isbanked) { 9135 /* 9136 * If the register is banked then we don't need to migrate or 9137 * reset the 32-bit instance in certain cases: 9138 * 9139 * 1) If the register has both 32-bit and 64-bit instances 9140 * then we can count on the 64-bit instance taking care 9141 * of the non-secure bank. 9142 * 2) If ARMv8 is enabled then we can count on a 64-bit 9143 * version taking care of the secure bank. This requires 9144 * that separate 32 and 64-bit definitions are provided. 9145 */ 9146 if ((r->state == ARM_CP_STATE_BOTH && ns) || 9147 (arm_feature(env, ARM_FEATURE_V8) && !ns)) { 9148 r2->type |= ARM_CP_ALIAS; 9149 } 9150 } else if ((secstate != r->secure) && !ns) { 9151 /* 9152 * The register is not banked so we only want to allow 9153 * migration of the non-secure instance. 9154 */ 9155 r2->type |= ARM_CP_ALIAS; 9156 } 9157 9158 if (HOST_BIG_ENDIAN && 9159 r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) { 9160 r2->fieldoffset += sizeof(uint32_t); 9161 } 9162 } 9163 } 9164 9165 /* 9166 * By convention, for wildcarded registers only the first 9167 * entry is used for migration; the others are marked as 9168 * ALIAS so we don't try to transfer the register 9169 * multiple times. Special registers (ie NOP/WFI) are 9170 * never migratable and not even raw-accessible. 9171 */ 9172 if (r2->type & ARM_CP_SPECIAL_MASK) { 9173 r2->type |= ARM_CP_NO_RAW; 9174 } 9175 if (((r->crm == CP_ANY) && crm != 0) || 9176 ((r->opc1 == CP_ANY) && opc1 != 0) || 9177 ((r->opc2 == CP_ANY) && opc2 != 0)) { 9178 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 9179 } 9180 9181 /* 9182 * Check that raw accesses are either forbidden or handled. Note that 9183 * we can't assert this earlier because the setup of fieldoffset for 9184 * banked registers has to be done first. 9185 */ 9186 if (!(r2->type & ARM_CP_NO_RAW)) { 9187 assert(!raw_accessors_invalid(r2)); 9188 } 9189 9190 g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2); 9191 } 9192 9193 9194 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 9195 const ARMCPRegInfo *r, void *opaque) 9196 { 9197 /* 9198 * Define implementations of coprocessor registers. 9199 * We store these in a hashtable because typically 9200 * there are less than 150 registers in a space which 9201 * is 16*16*16*8*8 = 262144 in size. 9202 * Wildcarding is supported for the crm, opc1 and opc2 fields. 9203 * If a register is defined twice then the second definition is 9204 * used, so this can be used to define some generic registers and 9205 * then override them with implementation specific variations. 9206 * At least one of the original and the second definition should 9207 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 9208 * against accidental use. 9209 * 9210 * The state field defines whether the register is to be 9211 * visible in the AArch32 or AArch64 execution state. If the 9212 * state is set to ARM_CP_STATE_BOTH then we synthesise a 9213 * reginfo structure for the AArch32 view, which sees the lower 9214 * 32 bits of the 64 bit register. 9215 * 9216 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 9217 * be wildcarded. AArch64 registers are always considered to be 64 9218 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 9219 * the register, if any. 9220 */ 9221 int crm, opc1, opc2; 9222 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 9223 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 9224 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 9225 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 9226 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 9227 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 9228 CPState state; 9229 9230 /* 64 bit registers have only CRm and Opc1 fields */ 9231 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 9232 /* op0 only exists in the AArch64 encodings */ 9233 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 9234 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 9235 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 9236 /* 9237 * This API is only for Arm's system coprocessors (14 and 15) or 9238 * (M-profile or v7A-and-earlier only) for implementation defined 9239 * coprocessors in the range 0..7. Our decode assumes this, since 9240 * 8..13 can be used for other insns including VFP and Neon. See 9241 * valid_cp() in translate.c. Assert here that we haven't tried 9242 * to use an invalid coprocessor number. 9243 */ 9244 switch (r->state) { 9245 case ARM_CP_STATE_BOTH: 9246 /* 0 has a special meaning, but otherwise the same rules as AA32. */ 9247 if (r->cp == 0) { 9248 break; 9249 } 9250 /* fall through */ 9251 case ARM_CP_STATE_AA32: 9252 if (arm_feature(&cpu->env, ARM_FEATURE_V8) && 9253 !arm_feature(&cpu->env, ARM_FEATURE_M)) { 9254 assert(r->cp >= 14 && r->cp <= 15); 9255 } else { 9256 assert(r->cp < 8 || (r->cp >= 14 && r->cp <= 15)); 9257 } 9258 break; 9259 case ARM_CP_STATE_AA64: 9260 assert(r->cp == 0 || r->cp == CP_REG_ARM64_SYSREG_CP); 9261 break; 9262 default: 9263 g_assert_not_reached(); 9264 } 9265 /* 9266 * The AArch64 pseudocode CheckSystemAccess() specifies that op1 9267 * encodes a minimum access level for the register. We roll this 9268 * runtime check into our general permission check code, so check 9269 * here that the reginfo's specified permissions are strict enough 9270 * to encompass the generic architectural permission check. 9271 */ 9272 if (r->state != ARM_CP_STATE_AA32) { 9273 CPAccessRights mask; 9274 switch (r->opc1) { 9275 case 0: 9276 /* min_EL EL1, but some accessible to EL0 via kernel ABI */ 9277 mask = PL0U_R | PL1_RW; 9278 break; 9279 case 1: case 2: 9280 /* min_EL EL1 */ 9281 mask = PL1_RW; 9282 break; 9283 case 3: 9284 /* min_EL EL0 */ 9285 mask = PL0_RW; 9286 break; 9287 case 4: 9288 case 5: 9289 /* min_EL EL2 */ 9290 mask = PL2_RW; 9291 break; 9292 case 6: 9293 /* min_EL EL3 */ 9294 mask = PL3_RW; 9295 break; 9296 case 7: 9297 /* min_EL EL1, secure mode only (we don't check the latter) */ 9298 mask = PL1_RW; 9299 break; 9300 default: 9301 /* broken reginfo with out-of-range opc1 */ 9302 g_assert_not_reached(); 9303 } 9304 /* assert our permissions are not too lax (stricter is fine) */ 9305 assert((r->access & ~mask) == 0); 9306 } 9307 9308 /* 9309 * Check that the register definition has enough info to handle 9310 * reads and writes if they are permitted. 9311 */ 9312 if (!(r->type & (ARM_CP_SPECIAL_MASK | ARM_CP_CONST))) { 9313 if (r->access & PL3_R) { 9314 assert((r->fieldoffset || 9315 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 9316 r->readfn); 9317 } 9318 if (r->access & PL3_W) { 9319 assert((r->fieldoffset || 9320 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 9321 r->writefn); 9322 } 9323 } 9324 9325 for (crm = crmmin; crm <= crmmax; crm++) { 9326 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 9327 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 9328 for (state = ARM_CP_STATE_AA32; 9329 state <= ARM_CP_STATE_AA64; state++) { 9330 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 9331 continue; 9332 } 9333 if (state == ARM_CP_STATE_AA32) { 9334 /* 9335 * Under AArch32 CP registers can be common 9336 * (same for secure and non-secure world) or banked. 9337 */ 9338 char *name; 9339 9340 switch (r->secure) { 9341 case ARM_CP_SECSTATE_S: 9342 case ARM_CP_SECSTATE_NS: 9343 add_cpreg_to_hashtable(cpu, r, opaque, state, 9344 r->secure, crm, opc1, opc2, 9345 r->name); 9346 break; 9347 case ARM_CP_SECSTATE_BOTH: 9348 name = g_strdup_printf("%s_S", r->name); 9349 add_cpreg_to_hashtable(cpu, r, opaque, state, 9350 ARM_CP_SECSTATE_S, 9351 crm, opc1, opc2, name); 9352 g_free(name); 9353 add_cpreg_to_hashtable(cpu, r, opaque, state, 9354 ARM_CP_SECSTATE_NS, 9355 crm, opc1, opc2, r->name); 9356 break; 9357 default: 9358 g_assert_not_reached(); 9359 } 9360 } else { 9361 /* 9362 * AArch64 registers get mapped to non-secure instance 9363 * of AArch32 9364 */ 9365 add_cpreg_to_hashtable(cpu, r, opaque, state, 9366 ARM_CP_SECSTATE_NS, 9367 crm, opc1, opc2, r->name); 9368 } 9369 } 9370 } 9371 } 9372 } 9373 } 9374 9375 /* Define a whole list of registers */ 9376 void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs, 9377 void *opaque, size_t len) 9378 { 9379 size_t i; 9380 for (i = 0; i < len; ++i) { 9381 define_one_arm_cp_reg_with_opaque(cpu, regs + i, opaque); 9382 } 9383 } 9384 9385 /* 9386 * Modify ARMCPRegInfo for access from userspace. 9387 * 9388 * This is a data driven modification directed by 9389 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as 9390 * user-space cannot alter any values and dynamic values pertaining to 9391 * execution state are hidden from user space view anyway. 9392 */ 9393 void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len, 9394 const ARMCPRegUserSpaceInfo *mods, 9395 size_t mods_len) 9396 { 9397 for (size_t mi = 0; mi < mods_len; ++mi) { 9398 const ARMCPRegUserSpaceInfo *m = mods + mi; 9399 GPatternSpec *pat = NULL; 9400 9401 if (m->is_glob) { 9402 pat = g_pattern_spec_new(m->name); 9403 } 9404 for (size_t ri = 0; ri < regs_len; ++ri) { 9405 ARMCPRegInfo *r = regs + ri; 9406 9407 if (pat && g_pattern_match_string(pat, r->name)) { 9408 r->type = ARM_CP_CONST; 9409 r->access = PL0U_R; 9410 r->resetvalue = 0; 9411 /* continue */ 9412 } else if (strcmp(r->name, m->name) == 0) { 9413 r->type = ARM_CP_CONST; 9414 r->access = PL0U_R; 9415 r->resetvalue &= m->exported_bits; 9416 r->resetvalue |= m->fixed_bits; 9417 break; 9418 } 9419 } 9420 if (pat) { 9421 g_pattern_spec_free(pat); 9422 } 9423 } 9424 } 9425 9426 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 9427 { 9428 return g_hash_table_lookup(cpregs, (gpointer)(uintptr_t)encoded_cp); 9429 } 9430 9431 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 9432 uint64_t value) 9433 { 9434 /* Helper coprocessor write function for write-ignore registers */ 9435 } 9436 9437 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 9438 { 9439 /* Helper coprocessor write function for read-as-zero registers */ 9440 return 0; 9441 } 9442 9443 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 9444 { 9445 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 9446 } 9447 9448 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 9449 { 9450 /* 9451 * Return true if it is not valid for us to switch to 9452 * this CPU mode (ie all the UNPREDICTABLE cases in 9453 * the ARM ARM CPSRWriteByInstr pseudocode). 9454 */ 9455 9456 /* Changes to or from Hyp via MSR and CPS are illegal. */ 9457 if (write_type == CPSRWriteByInstr && 9458 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 9459 mode == ARM_CPU_MODE_HYP)) { 9460 return 1; 9461 } 9462 9463 switch (mode) { 9464 case ARM_CPU_MODE_USR: 9465 return 0; 9466 case ARM_CPU_MODE_SYS: 9467 case ARM_CPU_MODE_SVC: 9468 case ARM_CPU_MODE_ABT: 9469 case ARM_CPU_MODE_UND: 9470 case ARM_CPU_MODE_IRQ: 9471 case ARM_CPU_MODE_FIQ: 9472 /* 9473 * Note that we don't implement the IMPDEF NSACR.RFR which in v7 9474 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 9475 */ 9476 /* 9477 * If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 9478 * and CPS are treated as illegal mode changes. 9479 */ 9480 if (write_type == CPSRWriteByInstr && 9481 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 9482 (arm_hcr_el2_eff(env) & HCR_TGE)) { 9483 return 1; 9484 } 9485 return 0; 9486 case ARM_CPU_MODE_HYP: 9487 return !arm_is_el2_enabled(env) || arm_current_el(env) < 2; 9488 case ARM_CPU_MODE_MON: 9489 return arm_current_el(env) < 3; 9490 default: 9491 return 1; 9492 } 9493 } 9494 9495 uint32_t cpsr_read(CPUARMState *env) 9496 { 9497 int ZF; 9498 ZF = (env->ZF == 0); 9499 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 9500 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 9501 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 9502 | ((env->condexec_bits & 0xfc) << 8) 9503 | (env->GE << 16) | (env->daif & CPSR_AIF); 9504 } 9505 9506 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 9507 CPSRWriteType write_type) 9508 { 9509 uint32_t changed_daif; 9510 bool rebuild_hflags = (write_type != CPSRWriteRaw) && 9511 (mask & (CPSR_M | CPSR_E | CPSR_IL)); 9512 9513 if (mask & CPSR_NZCV) { 9514 env->ZF = (~val) & CPSR_Z; 9515 env->NF = val; 9516 env->CF = (val >> 29) & 1; 9517 env->VF = (val << 3) & 0x80000000; 9518 } 9519 if (mask & CPSR_Q) { 9520 env->QF = ((val & CPSR_Q) != 0); 9521 } 9522 if (mask & CPSR_T) { 9523 env->thumb = ((val & CPSR_T) != 0); 9524 } 9525 if (mask & CPSR_IT_0_1) { 9526 env->condexec_bits &= ~3; 9527 env->condexec_bits |= (val >> 25) & 3; 9528 } 9529 if (mask & CPSR_IT_2_7) { 9530 env->condexec_bits &= 3; 9531 env->condexec_bits |= (val >> 8) & 0xfc; 9532 } 9533 if (mask & CPSR_GE) { 9534 env->GE = (val >> 16) & 0xf; 9535 } 9536 9537 /* 9538 * In a V7 implementation that includes the security extensions but does 9539 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 9540 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 9541 * bits respectively. 9542 * 9543 * In a V8 implementation, it is permitted for privileged software to 9544 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 9545 */ 9546 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 9547 arm_feature(env, ARM_FEATURE_EL3) && 9548 !arm_feature(env, ARM_FEATURE_EL2) && 9549 !arm_is_secure(env)) { 9550 9551 changed_daif = (env->daif ^ val) & mask; 9552 9553 if (changed_daif & CPSR_A) { 9554 /* 9555 * Check to see if we are allowed to change the masking of async 9556 * abort exceptions from a non-secure state. 9557 */ 9558 if (!(env->cp15.scr_el3 & SCR_AW)) { 9559 qemu_log_mask(LOG_GUEST_ERROR, 9560 "Ignoring attempt to switch CPSR_A flag from " 9561 "non-secure world with SCR.AW bit clear\n"); 9562 mask &= ~CPSR_A; 9563 } 9564 } 9565 9566 if (changed_daif & CPSR_F) { 9567 /* 9568 * Check to see if we are allowed to change the masking of FIQ 9569 * exceptions from a non-secure state. 9570 */ 9571 if (!(env->cp15.scr_el3 & SCR_FW)) { 9572 qemu_log_mask(LOG_GUEST_ERROR, 9573 "Ignoring attempt to switch CPSR_F flag from " 9574 "non-secure world with SCR.FW bit clear\n"); 9575 mask &= ~CPSR_F; 9576 } 9577 9578 /* 9579 * Check whether non-maskable FIQ (NMFI) support is enabled. 9580 * If this bit is set software is not allowed to mask 9581 * FIQs, but is allowed to set CPSR_F to 0. 9582 */ 9583 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 9584 (val & CPSR_F)) { 9585 qemu_log_mask(LOG_GUEST_ERROR, 9586 "Ignoring attempt to enable CPSR_F flag " 9587 "(non-maskable FIQ [NMFI] support enabled)\n"); 9588 mask &= ~CPSR_F; 9589 } 9590 } 9591 } 9592 9593 env->daif &= ~(CPSR_AIF & mask); 9594 env->daif |= val & CPSR_AIF & mask; 9595 9596 if (write_type != CPSRWriteRaw && 9597 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 9598 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 9599 /* 9600 * Note that we can only get here in USR mode if this is a 9601 * gdb stub write; for this case we follow the architectural 9602 * behaviour for guest writes in USR mode of ignoring an attempt 9603 * to switch mode. (Those are caught by translate.c for writes 9604 * triggered by guest instructions.) 9605 */ 9606 mask &= ~CPSR_M; 9607 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 9608 /* 9609 * Attempt to switch to an invalid mode: this is UNPREDICTABLE in 9610 * v7, and has defined behaviour in v8: 9611 * + leave CPSR.M untouched 9612 * + allow changes to the other CPSR fields 9613 * + set PSTATE.IL 9614 * For user changes via the GDB stub, we don't set PSTATE.IL, 9615 * as this would be unnecessarily harsh for a user error. 9616 */ 9617 mask &= ~CPSR_M; 9618 if (write_type != CPSRWriteByGDBStub && 9619 arm_feature(env, ARM_FEATURE_V8)) { 9620 mask |= CPSR_IL; 9621 val |= CPSR_IL; 9622 } 9623 qemu_log_mask(LOG_GUEST_ERROR, 9624 "Illegal AArch32 mode switch attempt from %s to %s\n", 9625 aarch32_mode_name(env->uncached_cpsr), 9626 aarch32_mode_name(val)); 9627 } else { 9628 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 9629 write_type == CPSRWriteExceptionReturn ? 9630 "Exception return from AArch32" : 9631 "AArch32 mode switch from", 9632 aarch32_mode_name(env->uncached_cpsr), 9633 aarch32_mode_name(val), env->regs[15]); 9634 switch_mode(env, val & CPSR_M); 9635 } 9636 } 9637 mask &= ~CACHED_CPSR_BITS; 9638 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 9639 if (rebuild_hflags) { 9640 arm_rebuild_hflags(env); 9641 } 9642 } 9643 9644 /* Sign/zero extend */ 9645 uint32_t HELPER(sxtb16)(uint32_t x) 9646 { 9647 uint32_t res; 9648 res = (uint16_t)(int8_t)x; 9649 res |= (uint32_t)(int8_t)(x >> 16) << 16; 9650 return res; 9651 } 9652 9653 static void handle_possible_div0_trap(CPUARMState *env, uintptr_t ra) 9654 { 9655 /* 9656 * Take a division-by-zero exception if necessary; otherwise return 9657 * to get the usual non-trapping division behaviour (result of 0) 9658 */ 9659 if (arm_feature(env, ARM_FEATURE_M) 9660 && (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_DIV_0_TRP_MASK)) { 9661 raise_exception_ra(env, EXCP_DIVBYZERO, 0, 1, ra); 9662 } 9663 } 9664 9665 uint32_t HELPER(uxtb16)(uint32_t x) 9666 { 9667 uint32_t res; 9668 res = (uint16_t)(uint8_t)x; 9669 res |= (uint32_t)(uint8_t)(x >> 16) << 16; 9670 return res; 9671 } 9672 9673 int32_t HELPER(sdiv)(CPUARMState *env, int32_t num, int32_t den) 9674 { 9675 if (den == 0) { 9676 handle_possible_div0_trap(env, GETPC()); 9677 return 0; 9678 } 9679 if (num == INT_MIN && den == -1) { 9680 return INT_MIN; 9681 } 9682 return num / den; 9683 } 9684 9685 uint32_t HELPER(udiv)(CPUARMState *env, uint32_t num, uint32_t den) 9686 { 9687 if (den == 0) { 9688 handle_possible_div0_trap(env, GETPC()); 9689 return 0; 9690 } 9691 return num / den; 9692 } 9693 9694 uint32_t HELPER(rbit)(uint32_t x) 9695 { 9696 return revbit32(x); 9697 } 9698 9699 #ifdef CONFIG_USER_ONLY 9700 9701 static void switch_mode(CPUARMState *env, int mode) 9702 { 9703 ARMCPU *cpu = env_archcpu(env); 9704 9705 if (mode != ARM_CPU_MODE_USR) { 9706 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 9707 } 9708 } 9709 9710 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 9711 uint32_t cur_el, bool secure) 9712 { 9713 return 1; 9714 } 9715 9716 void aarch64_sync_64_to_32(CPUARMState *env) 9717 { 9718 g_assert_not_reached(); 9719 } 9720 9721 #else 9722 9723 static void switch_mode(CPUARMState *env, int mode) 9724 { 9725 int old_mode; 9726 int i; 9727 9728 old_mode = env->uncached_cpsr & CPSR_M; 9729 if (mode == old_mode) { 9730 return; 9731 } 9732 9733 if (old_mode == ARM_CPU_MODE_FIQ) { 9734 memcpy(env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 9735 memcpy(env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 9736 } else if (mode == ARM_CPU_MODE_FIQ) { 9737 memcpy(env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 9738 memcpy(env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 9739 } 9740 9741 i = bank_number(old_mode); 9742 env->banked_r13[i] = env->regs[13]; 9743 env->banked_spsr[i] = env->spsr; 9744 9745 i = bank_number(mode); 9746 env->regs[13] = env->banked_r13[i]; 9747 env->spsr = env->banked_spsr[i]; 9748 9749 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 9750 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 9751 } 9752 9753 /* 9754 * Physical Interrupt Target EL Lookup Table 9755 * 9756 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 9757 * 9758 * The below multi-dimensional table is used for looking up the target 9759 * exception level given numerous condition criteria. Specifically, the 9760 * target EL is based on SCR and HCR routing controls as well as the 9761 * currently executing EL and secure state. 9762 * 9763 * Dimensions: 9764 * target_el_table[2][2][2][2][2][4] 9765 * | | | | | +--- Current EL 9766 * | | | | +------ Non-secure(0)/Secure(1) 9767 * | | | +--------- HCR mask override 9768 * | | +------------ SCR exec state control 9769 * | +--------------- SCR mask override 9770 * +------------------ 32-bit(0)/64-bit(1) EL3 9771 * 9772 * The table values are as such: 9773 * 0-3 = EL0-EL3 9774 * -1 = Cannot occur 9775 * 9776 * The ARM ARM target EL table includes entries indicating that an "exception 9777 * is not taken". The two cases where this is applicable are: 9778 * 1) An exception is taken from EL3 but the SCR does not have the exception 9779 * routed to EL3. 9780 * 2) An exception is taken from EL2 but the HCR does not have the exception 9781 * routed to EL2. 9782 * In these two cases, the below table contain a target of EL1. This value is 9783 * returned as it is expected that the consumer of the table data will check 9784 * for "target EL >= current EL" to ensure the exception is not taken. 9785 * 9786 * SCR HCR 9787 * 64 EA AMO From 9788 * BIT IRQ IMO Non-secure Secure 9789 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 9790 */ 9791 static const int8_t target_el_table[2][2][2][2][2][4] = { 9792 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 9793 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 9794 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 9795 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 9796 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 9797 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 9798 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 9799 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 9800 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 9801 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 2, 2, -1, 1 },},}, 9802 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, 1, 1 },}, 9803 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 2, 2, 2, 1 },},},}, 9804 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 9805 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 9806 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, 3, 3 },}, 9807 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, 3, 3 },},},},}, 9808 }; 9809 9810 /* 9811 * Determine the target EL for physical exceptions 9812 */ 9813 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 9814 uint32_t cur_el, bool secure) 9815 { 9816 CPUARMState *env = cs->env_ptr; 9817 bool rw; 9818 bool scr; 9819 bool hcr; 9820 int target_el; 9821 /* Is the highest EL AArch64? */ 9822 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 9823 uint64_t hcr_el2; 9824 9825 if (arm_feature(env, ARM_FEATURE_EL3)) { 9826 rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW); 9827 } else { 9828 /* 9829 * Either EL2 is the highest EL (and so the EL2 register width 9830 * is given by is64); or there is no EL2 or EL3, in which case 9831 * the value of 'rw' does not affect the table lookup anyway. 9832 */ 9833 rw = is64; 9834 } 9835 9836 hcr_el2 = arm_hcr_el2_eff(env); 9837 switch (excp_idx) { 9838 case EXCP_IRQ: 9839 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 9840 hcr = hcr_el2 & HCR_IMO; 9841 break; 9842 case EXCP_FIQ: 9843 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 9844 hcr = hcr_el2 & HCR_FMO; 9845 break; 9846 default: 9847 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 9848 hcr = hcr_el2 & HCR_AMO; 9849 break; 9850 }; 9851 9852 /* 9853 * For these purposes, TGE and AMO/IMO/FMO both force the 9854 * interrupt to EL2. Fold TGE into the bit extracted above. 9855 */ 9856 hcr |= (hcr_el2 & HCR_TGE) != 0; 9857 9858 /* Perform a table-lookup for the target EL given the current state */ 9859 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 9860 9861 assert(target_el > 0); 9862 9863 return target_el; 9864 } 9865 9866 void arm_log_exception(CPUState *cs) 9867 { 9868 int idx = cs->exception_index; 9869 9870 if (qemu_loglevel_mask(CPU_LOG_INT)) { 9871 const char *exc = NULL; 9872 static const char * const excnames[] = { 9873 [EXCP_UDEF] = "Undefined Instruction", 9874 [EXCP_SWI] = "SVC", 9875 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 9876 [EXCP_DATA_ABORT] = "Data Abort", 9877 [EXCP_IRQ] = "IRQ", 9878 [EXCP_FIQ] = "FIQ", 9879 [EXCP_BKPT] = "Breakpoint", 9880 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 9881 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 9882 [EXCP_HVC] = "Hypervisor Call", 9883 [EXCP_HYP_TRAP] = "Hypervisor Trap", 9884 [EXCP_SMC] = "Secure Monitor Call", 9885 [EXCP_VIRQ] = "Virtual IRQ", 9886 [EXCP_VFIQ] = "Virtual FIQ", 9887 [EXCP_SEMIHOST] = "Semihosting call", 9888 [EXCP_NOCP] = "v7M NOCP UsageFault", 9889 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 9890 [EXCP_STKOF] = "v8M STKOF UsageFault", 9891 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking", 9892 [EXCP_LSERR] = "v8M LSERR UsageFault", 9893 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault", 9894 [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault", 9895 [EXCP_VSERR] = "Virtual SERR", 9896 }; 9897 9898 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 9899 exc = excnames[idx]; 9900 } 9901 if (!exc) { 9902 exc = "unknown"; 9903 } 9904 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s] on CPU %d\n", 9905 idx, exc, cs->cpu_index); 9906 } 9907 } 9908 9909 /* 9910 * Function used to synchronize QEMU's AArch64 register set with AArch32 9911 * register set. This is necessary when switching between AArch32 and AArch64 9912 * execution state. 9913 */ 9914 void aarch64_sync_32_to_64(CPUARMState *env) 9915 { 9916 int i; 9917 uint32_t mode = env->uncached_cpsr & CPSR_M; 9918 9919 /* We can blanket copy R[0:7] to X[0:7] */ 9920 for (i = 0; i < 8; i++) { 9921 env->xregs[i] = env->regs[i]; 9922 } 9923 9924 /* 9925 * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 9926 * Otherwise, they come from the banked user regs. 9927 */ 9928 if (mode == ARM_CPU_MODE_FIQ) { 9929 for (i = 8; i < 13; i++) { 9930 env->xregs[i] = env->usr_regs[i - 8]; 9931 } 9932 } else { 9933 for (i = 8; i < 13; i++) { 9934 env->xregs[i] = env->regs[i]; 9935 } 9936 } 9937 9938 /* 9939 * Registers x13-x23 are the various mode SP and FP registers. Registers 9940 * r13 and r14 are only copied if we are in that mode, otherwise we copy 9941 * from the mode banked register. 9942 */ 9943 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 9944 env->xregs[13] = env->regs[13]; 9945 env->xregs[14] = env->regs[14]; 9946 } else { 9947 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 9948 /* HYP is an exception in that it is copied from r14 */ 9949 if (mode == ARM_CPU_MODE_HYP) { 9950 env->xregs[14] = env->regs[14]; 9951 } else { 9952 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 9953 } 9954 } 9955 9956 if (mode == ARM_CPU_MODE_HYP) { 9957 env->xregs[15] = env->regs[13]; 9958 } else { 9959 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 9960 } 9961 9962 if (mode == ARM_CPU_MODE_IRQ) { 9963 env->xregs[16] = env->regs[14]; 9964 env->xregs[17] = env->regs[13]; 9965 } else { 9966 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 9967 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 9968 } 9969 9970 if (mode == ARM_CPU_MODE_SVC) { 9971 env->xregs[18] = env->regs[14]; 9972 env->xregs[19] = env->regs[13]; 9973 } else { 9974 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 9975 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 9976 } 9977 9978 if (mode == ARM_CPU_MODE_ABT) { 9979 env->xregs[20] = env->regs[14]; 9980 env->xregs[21] = env->regs[13]; 9981 } else { 9982 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 9983 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 9984 } 9985 9986 if (mode == ARM_CPU_MODE_UND) { 9987 env->xregs[22] = env->regs[14]; 9988 env->xregs[23] = env->regs[13]; 9989 } else { 9990 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 9991 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 9992 } 9993 9994 /* 9995 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 9996 * mode, then we can copy from r8-r14. Otherwise, we copy from the 9997 * FIQ bank for r8-r14. 9998 */ 9999 if (mode == ARM_CPU_MODE_FIQ) { 10000 for (i = 24; i < 31; i++) { 10001 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 10002 } 10003 } else { 10004 for (i = 24; i < 29; i++) { 10005 env->xregs[i] = env->fiq_regs[i - 24]; 10006 } 10007 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 10008 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 10009 } 10010 10011 env->pc = env->regs[15]; 10012 } 10013 10014 /* 10015 * Function used to synchronize QEMU's AArch32 register set with AArch64 10016 * register set. This is necessary when switching between AArch32 and AArch64 10017 * execution state. 10018 */ 10019 void aarch64_sync_64_to_32(CPUARMState *env) 10020 { 10021 int i; 10022 uint32_t mode = env->uncached_cpsr & CPSR_M; 10023 10024 /* We can blanket copy X[0:7] to R[0:7] */ 10025 for (i = 0; i < 8; i++) { 10026 env->regs[i] = env->xregs[i]; 10027 } 10028 10029 /* 10030 * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 10031 * Otherwise, we copy x8-x12 into the banked user regs. 10032 */ 10033 if (mode == ARM_CPU_MODE_FIQ) { 10034 for (i = 8; i < 13; i++) { 10035 env->usr_regs[i - 8] = env->xregs[i]; 10036 } 10037 } else { 10038 for (i = 8; i < 13; i++) { 10039 env->regs[i] = env->xregs[i]; 10040 } 10041 } 10042 10043 /* 10044 * Registers r13 & r14 depend on the current mode. 10045 * If we are in a given mode, we copy the corresponding x registers to r13 10046 * and r14. Otherwise, we copy the x register to the banked r13 and r14 10047 * for the mode. 10048 */ 10049 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 10050 env->regs[13] = env->xregs[13]; 10051 env->regs[14] = env->xregs[14]; 10052 } else { 10053 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 10054 10055 /* 10056 * HYP is an exception in that it does not have its own banked r14 but 10057 * shares the USR r14 10058 */ 10059 if (mode == ARM_CPU_MODE_HYP) { 10060 env->regs[14] = env->xregs[14]; 10061 } else { 10062 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 10063 } 10064 } 10065 10066 if (mode == ARM_CPU_MODE_HYP) { 10067 env->regs[13] = env->xregs[15]; 10068 } else { 10069 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 10070 } 10071 10072 if (mode == ARM_CPU_MODE_IRQ) { 10073 env->regs[14] = env->xregs[16]; 10074 env->regs[13] = env->xregs[17]; 10075 } else { 10076 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 10077 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 10078 } 10079 10080 if (mode == ARM_CPU_MODE_SVC) { 10081 env->regs[14] = env->xregs[18]; 10082 env->regs[13] = env->xregs[19]; 10083 } else { 10084 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 10085 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 10086 } 10087 10088 if (mode == ARM_CPU_MODE_ABT) { 10089 env->regs[14] = env->xregs[20]; 10090 env->regs[13] = env->xregs[21]; 10091 } else { 10092 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 10093 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 10094 } 10095 10096 if (mode == ARM_CPU_MODE_UND) { 10097 env->regs[14] = env->xregs[22]; 10098 env->regs[13] = env->xregs[23]; 10099 } else { 10100 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 10101 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 10102 } 10103 10104 /* 10105 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 10106 * mode, then we can copy to r8-r14. Otherwise, we copy to the 10107 * FIQ bank for r8-r14. 10108 */ 10109 if (mode == ARM_CPU_MODE_FIQ) { 10110 for (i = 24; i < 31; i++) { 10111 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 10112 } 10113 } else { 10114 for (i = 24; i < 29; i++) { 10115 env->fiq_regs[i - 24] = env->xregs[i]; 10116 } 10117 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 10118 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 10119 } 10120 10121 env->regs[15] = env->pc; 10122 } 10123 10124 static void take_aarch32_exception(CPUARMState *env, int new_mode, 10125 uint32_t mask, uint32_t offset, 10126 uint32_t newpc) 10127 { 10128 int new_el; 10129 10130 /* Change the CPU state so as to actually take the exception. */ 10131 switch_mode(env, new_mode); 10132 10133 /* 10134 * For exceptions taken to AArch32 we must clear the SS bit in both 10135 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 10136 */ 10137 env->pstate &= ~PSTATE_SS; 10138 env->spsr = cpsr_read(env); 10139 /* Clear IT bits. */ 10140 env->condexec_bits = 0; 10141 /* Switch to the new mode, and to the correct instruction set. */ 10142 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 10143 10144 /* This must be after mode switching. */ 10145 new_el = arm_current_el(env); 10146 10147 /* Set new mode endianness */ 10148 env->uncached_cpsr &= ~CPSR_E; 10149 if (env->cp15.sctlr_el[new_el] & SCTLR_EE) { 10150 env->uncached_cpsr |= CPSR_E; 10151 } 10152 /* J and IL must always be cleared for exception entry */ 10153 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 10154 env->daif |= mask; 10155 10156 if (cpu_isar_feature(aa32_ssbs, env_archcpu(env))) { 10157 if (env->cp15.sctlr_el[new_el] & SCTLR_DSSBS_32) { 10158 env->uncached_cpsr |= CPSR_SSBS; 10159 } else { 10160 env->uncached_cpsr &= ~CPSR_SSBS; 10161 } 10162 } 10163 10164 if (new_mode == ARM_CPU_MODE_HYP) { 10165 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 10166 env->elr_el[2] = env->regs[15]; 10167 } else { 10168 /* CPSR.PAN is normally preserved preserved unless... */ 10169 if (cpu_isar_feature(aa32_pan, env_archcpu(env))) { 10170 switch (new_el) { 10171 case 3: 10172 if (!arm_is_secure_below_el3(env)) { 10173 /* ... the target is EL3, from non-secure state. */ 10174 env->uncached_cpsr &= ~CPSR_PAN; 10175 break; 10176 } 10177 /* ... the target is EL3, from secure state ... */ 10178 /* fall through */ 10179 case 1: 10180 /* ... the target is EL1 and SCTLR.SPAN is 0. */ 10181 if (!(env->cp15.sctlr_el[new_el] & SCTLR_SPAN)) { 10182 env->uncached_cpsr |= CPSR_PAN; 10183 } 10184 break; 10185 } 10186 } 10187 /* 10188 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 10189 * and we should just guard the thumb mode on V4 10190 */ 10191 if (arm_feature(env, ARM_FEATURE_V4T)) { 10192 env->thumb = 10193 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 10194 } 10195 env->regs[14] = env->regs[15] + offset; 10196 } 10197 env->regs[15] = newpc; 10198 arm_rebuild_hflags(env); 10199 } 10200 10201 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 10202 { 10203 /* 10204 * Handle exception entry to Hyp mode; this is sufficiently 10205 * different to entry to other AArch32 modes that we handle it 10206 * separately here. 10207 * 10208 * The vector table entry used is always the 0x14 Hyp mode entry point, 10209 * unless this is an UNDEF/SVC/HVC/abort taken from Hyp to Hyp. 10210 * The offset applied to the preferred return address is always zero 10211 * (see DDI0487C.a section G1.12.3). 10212 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 10213 */ 10214 uint32_t addr, mask; 10215 ARMCPU *cpu = ARM_CPU(cs); 10216 CPUARMState *env = &cpu->env; 10217 10218 switch (cs->exception_index) { 10219 case EXCP_UDEF: 10220 addr = 0x04; 10221 break; 10222 case EXCP_SWI: 10223 addr = 0x08; 10224 break; 10225 case EXCP_BKPT: 10226 /* Fall through to prefetch abort. */ 10227 case EXCP_PREFETCH_ABORT: 10228 env->cp15.ifar_s = env->exception.vaddress; 10229 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 10230 (uint32_t)env->exception.vaddress); 10231 addr = 0x0c; 10232 break; 10233 case EXCP_DATA_ABORT: 10234 env->cp15.dfar_s = env->exception.vaddress; 10235 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 10236 (uint32_t)env->exception.vaddress); 10237 addr = 0x10; 10238 break; 10239 case EXCP_IRQ: 10240 addr = 0x18; 10241 break; 10242 case EXCP_FIQ: 10243 addr = 0x1c; 10244 break; 10245 case EXCP_HVC: 10246 addr = 0x08; 10247 break; 10248 case EXCP_HYP_TRAP: 10249 addr = 0x14; 10250 break; 10251 default: 10252 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 10253 } 10254 10255 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 10256 if (!arm_feature(env, ARM_FEATURE_V8)) { 10257 /* 10258 * QEMU syndrome values are v8-style. v7 has the IL bit 10259 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 10260 * If this is a v7 CPU, squash the IL bit in those cases. 10261 */ 10262 if (cs->exception_index == EXCP_PREFETCH_ABORT || 10263 (cs->exception_index == EXCP_DATA_ABORT && 10264 !(env->exception.syndrome & ARM_EL_ISV)) || 10265 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 10266 env->exception.syndrome &= ~ARM_EL_IL; 10267 } 10268 } 10269 env->cp15.esr_el[2] = env->exception.syndrome; 10270 } 10271 10272 if (arm_current_el(env) != 2 && addr < 0x14) { 10273 addr = 0x14; 10274 } 10275 10276 mask = 0; 10277 if (!(env->cp15.scr_el3 & SCR_EA)) { 10278 mask |= CPSR_A; 10279 } 10280 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 10281 mask |= CPSR_I; 10282 } 10283 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 10284 mask |= CPSR_F; 10285 } 10286 10287 addr += env->cp15.hvbar; 10288 10289 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 10290 } 10291 10292 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 10293 { 10294 ARMCPU *cpu = ARM_CPU(cs); 10295 CPUARMState *env = &cpu->env; 10296 uint32_t addr; 10297 uint32_t mask; 10298 int new_mode; 10299 uint32_t offset; 10300 uint32_t moe; 10301 10302 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 10303 switch (syn_get_ec(env->exception.syndrome)) { 10304 case EC_BREAKPOINT: 10305 case EC_BREAKPOINT_SAME_EL: 10306 moe = 1; 10307 break; 10308 case EC_WATCHPOINT: 10309 case EC_WATCHPOINT_SAME_EL: 10310 moe = 10; 10311 break; 10312 case EC_AA32_BKPT: 10313 moe = 3; 10314 break; 10315 case EC_VECTORCATCH: 10316 moe = 5; 10317 break; 10318 default: 10319 moe = 0; 10320 break; 10321 } 10322 10323 if (moe) { 10324 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 10325 } 10326 10327 if (env->exception.target_el == 2) { 10328 arm_cpu_do_interrupt_aarch32_hyp(cs); 10329 return; 10330 } 10331 10332 switch (cs->exception_index) { 10333 case EXCP_UDEF: 10334 new_mode = ARM_CPU_MODE_UND; 10335 addr = 0x04; 10336 mask = CPSR_I; 10337 if (env->thumb) { 10338 offset = 2; 10339 } else { 10340 offset = 4; 10341 } 10342 break; 10343 case EXCP_SWI: 10344 new_mode = ARM_CPU_MODE_SVC; 10345 addr = 0x08; 10346 mask = CPSR_I; 10347 /* The PC already points to the next instruction. */ 10348 offset = 0; 10349 break; 10350 case EXCP_BKPT: 10351 /* Fall through to prefetch abort. */ 10352 case EXCP_PREFETCH_ABORT: 10353 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 10354 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 10355 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 10356 env->exception.fsr, (uint32_t)env->exception.vaddress); 10357 new_mode = ARM_CPU_MODE_ABT; 10358 addr = 0x0c; 10359 mask = CPSR_A | CPSR_I; 10360 offset = 4; 10361 break; 10362 case EXCP_DATA_ABORT: 10363 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 10364 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 10365 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 10366 env->exception.fsr, 10367 (uint32_t)env->exception.vaddress); 10368 new_mode = ARM_CPU_MODE_ABT; 10369 addr = 0x10; 10370 mask = CPSR_A | CPSR_I; 10371 offset = 8; 10372 break; 10373 case EXCP_IRQ: 10374 new_mode = ARM_CPU_MODE_IRQ; 10375 addr = 0x18; 10376 /* Disable IRQ and imprecise data aborts. */ 10377 mask = CPSR_A | CPSR_I; 10378 offset = 4; 10379 if (env->cp15.scr_el3 & SCR_IRQ) { 10380 /* IRQ routed to monitor mode */ 10381 new_mode = ARM_CPU_MODE_MON; 10382 mask |= CPSR_F; 10383 } 10384 break; 10385 case EXCP_FIQ: 10386 new_mode = ARM_CPU_MODE_FIQ; 10387 addr = 0x1c; 10388 /* Disable FIQ, IRQ and imprecise data aborts. */ 10389 mask = CPSR_A | CPSR_I | CPSR_F; 10390 if (env->cp15.scr_el3 & SCR_FIQ) { 10391 /* FIQ routed to monitor mode */ 10392 new_mode = ARM_CPU_MODE_MON; 10393 } 10394 offset = 4; 10395 break; 10396 case EXCP_VIRQ: 10397 new_mode = ARM_CPU_MODE_IRQ; 10398 addr = 0x18; 10399 /* Disable IRQ and imprecise data aborts. */ 10400 mask = CPSR_A | CPSR_I; 10401 offset = 4; 10402 break; 10403 case EXCP_VFIQ: 10404 new_mode = ARM_CPU_MODE_FIQ; 10405 addr = 0x1c; 10406 /* Disable FIQ, IRQ and imprecise data aborts. */ 10407 mask = CPSR_A | CPSR_I | CPSR_F; 10408 offset = 4; 10409 break; 10410 case EXCP_VSERR: 10411 { 10412 /* 10413 * Note that this is reported as a data abort, but the DFAR 10414 * has an UNKNOWN value. Construct the SError syndrome from 10415 * AET and ExT fields. 10416 */ 10417 ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal, }; 10418 10419 if (extended_addresses_enabled(env)) { 10420 env->exception.fsr = arm_fi_to_lfsc(&fi); 10421 } else { 10422 env->exception.fsr = arm_fi_to_sfsc(&fi); 10423 } 10424 env->exception.fsr |= env->cp15.vsesr_el2 & 0xd000; 10425 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 10426 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x\n", 10427 env->exception.fsr); 10428 10429 new_mode = ARM_CPU_MODE_ABT; 10430 addr = 0x10; 10431 mask = CPSR_A | CPSR_I; 10432 offset = 8; 10433 } 10434 break; 10435 case EXCP_SMC: 10436 new_mode = ARM_CPU_MODE_MON; 10437 addr = 0x08; 10438 mask = CPSR_A | CPSR_I | CPSR_F; 10439 offset = 0; 10440 break; 10441 default: 10442 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 10443 return; /* Never happens. Keep compiler happy. */ 10444 } 10445 10446 if (new_mode == ARM_CPU_MODE_MON) { 10447 addr += env->cp15.mvbar; 10448 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 10449 /* High vectors. When enabled, base address cannot be remapped. */ 10450 addr += 0xffff0000; 10451 } else { 10452 /* 10453 * ARM v7 architectures provide a vector base address register to remap 10454 * the interrupt vector table. 10455 * This register is only followed in non-monitor mode, and is banked. 10456 * Note: only bits 31:5 are valid. 10457 */ 10458 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 10459 } 10460 10461 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 10462 env->cp15.scr_el3 &= ~SCR_NS; 10463 } 10464 10465 take_aarch32_exception(env, new_mode, mask, offset, addr); 10466 } 10467 10468 static int aarch64_regnum(CPUARMState *env, int aarch32_reg) 10469 { 10470 /* 10471 * Return the register number of the AArch64 view of the AArch32 10472 * register @aarch32_reg. The CPUARMState CPSR is assumed to still 10473 * be that of the AArch32 mode the exception came from. 10474 */ 10475 int mode = env->uncached_cpsr & CPSR_M; 10476 10477 switch (aarch32_reg) { 10478 case 0 ... 7: 10479 return aarch32_reg; 10480 case 8 ... 12: 10481 return mode == ARM_CPU_MODE_FIQ ? aarch32_reg + 16 : aarch32_reg; 10482 case 13: 10483 switch (mode) { 10484 case ARM_CPU_MODE_USR: 10485 case ARM_CPU_MODE_SYS: 10486 return 13; 10487 case ARM_CPU_MODE_HYP: 10488 return 15; 10489 case ARM_CPU_MODE_IRQ: 10490 return 17; 10491 case ARM_CPU_MODE_SVC: 10492 return 19; 10493 case ARM_CPU_MODE_ABT: 10494 return 21; 10495 case ARM_CPU_MODE_UND: 10496 return 23; 10497 case ARM_CPU_MODE_FIQ: 10498 return 29; 10499 default: 10500 g_assert_not_reached(); 10501 } 10502 case 14: 10503 switch (mode) { 10504 case ARM_CPU_MODE_USR: 10505 case ARM_CPU_MODE_SYS: 10506 case ARM_CPU_MODE_HYP: 10507 return 14; 10508 case ARM_CPU_MODE_IRQ: 10509 return 16; 10510 case ARM_CPU_MODE_SVC: 10511 return 18; 10512 case ARM_CPU_MODE_ABT: 10513 return 20; 10514 case ARM_CPU_MODE_UND: 10515 return 22; 10516 case ARM_CPU_MODE_FIQ: 10517 return 30; 10518 default: 10519 g_assert_not_reached(); 10520 } 10521 case 15: 10522 return 31; 10523 default: 10524 g_assert_not_reached(); 10525 } 10526 } 10527 10528 static uint32_t cpsr_read_for_spsr_elx(CPUARMState *env) 10529 { 10530 uint32_t ret = cpsr_read(env); 10531 10532 /* Move DIT to the correct location for SPSR_ELx */ 10533 if (ret & CPSR_DIT) { 10534 ret &= ~CPSR_DIT; 10535 ret |= PSTATE_DIT; 10536 } 10537 /* Merge PSTATE.SS into SPSR_ELx */ 10538 ret |= env->pstate & PSTATE_SS; 10539 10540 return ret; 10541 } 10542 10543 static bool syndrome_is_sync_extabt(uint32_t syndrome) 10544 { 10545 /* Return true if this syndrome value is a synchronous external abort */ 10546 switch (syn_get_ec(syndrome)) { 10547 case EC_INSNABORT: 10548 case EC_INSNABORT_SAME_EL: 10549 case EC_DATAABORT: 10550 case EC_DATAABORT_SAME_EL: 10551 /* Look at fault status code for all the synchronous ext abort cases */ 10552 switch (syndrome & 0x3f) { 10553 case 0x10: 10554 case 0x13: 10555 case 0x14: 10556 case 0x15: 10557 case 0x16: 10558 case 0x17: 10559 return true; 10560 default: 10561 return false; 10562 } 10563 default: 10564 return false; 10565 } 10566 } 10567 10568 /* Handle exception entry to a target EL which is using AArch64 */ 10569 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 10570 { 10571 ARMCPU *cpu = ARM_CPU(cs); 10572 CPUARMState *env = &cpu->env; 10573 unsigned int new_el = env->exception.target_el; 10574 target_ulong addr = env->cp15.vbar_el[new_el]; 10575 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 10576 unsigned int old_mode; 10577 unsigned int cur_el = arm_current_el(env); 10578 int rt; 10579 10580 /* 10581 * Note that new_el can never be 0. If cur_el is 0, then 10582 * el0_a64 is is_a64(), else el0_a64 is ignored. 10583 */ 10584 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 10585 10586 if (cur_el < new_el) { 10587 /* 10588 * Entry vector offset depends on whether the implemented EL 10589 * immediately lower than the target level is using AArch32 or AArch64 10590 */ 10591 bool is_aa64; 10592 uint64_t hcr; 10593 10594 switch (new_el) { 10595 case 3: 10596 is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0; 10597 break; 10598 case 2: 10599 hcr = arm_hcr_el2_eff(env); 10600 if ((hcr & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 10601 is_aa64 = (hcr & HCR_RW) != 0; 10602 break; 10603 } 10604 /* fall through */ 10605 case 1: 10606 is_aa64 = is_a64(env); 10607 break; 10608 default: 10609 g_assert_not_reached(); 10610 } 10611 10612 if (is_aa64) { 10613 addr += 0x400; 10614 } else { 10615 addr += 0x600; 10616 } 10617 } else if (pstate_read(env) & PSTATE_SP) { 10618 addr += 0x200; 10619 } 10620 10621 switch (cs->exception_index) { 10622 case EXCP_PREFETCH_ABORT: 10623 case EXCP_DATA_ABORT: 10624 /* 10625 * FEAT_DoubleFault allows synchronous external aborts taken to EL3 10626 * to be taken to the SError vector entrypoint. 10627 */ 10628 if (new_el == 3 && (env->cp15.scr_el3 & SCR_EASE) && 10629 syndrome_is_sync_extabt(env->exception.syndrome)) { 10630 addr += 0x180; 10631 } 10632 env->cp15.far_el[new_el] = env->exception.vaddress; 10633 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 10634 env->cp15.far_el[new_el]); 10635 /* fall through */ 10636 case EXCP_BKPT: 10637 case EXCP_UDEF: 10638 case EXCP_SWI: 10639 case EXCP_HVC: 10640 case EXCP_HYP_TRAP: 10641 case EXCP_SMC: 10642 switch (syn_get_ec(env->exception.syndrome)) { 10643 case EC_ADVSIMDFPACCESSTRAP: 10644 /* 10645 * QEMU internal FP/SIMD syndromes from AArch32 include the 10646 * TA and coproc fields which are only exposed if the exception 10647 * is taken to AArch32 Hyp mode. Mask them out to get a valid 10648 * AArch64 format syndrome. 10649 */ 10650 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 10651 break; 10652 case EC_CP14RTTRAP: 10653 case EC_CP15RTTRAP: 10654 case EC_CP14DTTRAP: 10655 /* 10656 * For a trap on AArch32 MRC/MCR/LDC/STC the Rt field is currently 10657 * the raw register field from the insn; when taking this to 10658 * AArch64 we must convert it to the AArch64 view of the register 10659 * number. Notice that we read a 4-bit AArch32 register number and 10660 * write back a 5-bit AArch64 one. 10661 */ 10662 rt = extract32(env->exception.syndrome, 5, 4); 10663 rt = aarch64_regnum(env, rt); 10664 env->exception.syndrome = deposit32(env->exception.syndrome, 10665 5, 5, rt); 10666 break; 10667 case EC_CP15RRTTRAP: 10668 case EC_CP14RRTTRAP: 10669 /* Similarly for MRRC/MCRR traps for Rt and Rt2 fields */ 10670 rt = extract32(env->exception.syndrome, 5, 4); 10671 rt = aarch64_regnum(env, rt); 10672 env->exception.syndrome = deposit32(env->exception.syndrome, 10673 5, 5, rt); 10674 rt = extract32(env->exception.syndrome, 10, 4); 10675 rt = aarch64_regnum(env, rt); 10676 env->exception.syndrome = deposit32(env->exception.syndrome, 10677 10, 5, rt); 10678 break; 10679 } 10680 env->cp15.esr_el[new_el] = env->exception.syndrome; 10681 break; 10682 case EXCP_IRQ: 10683 case EXCP_VIRQ: 10684 addr += 0x80; 10685 break; 10686 case EXCP_FIQ: 10687 case EXCP_VFIQ: 10688 addr += 0x100; 10689 break; 10690 case EXCP_VSERR: 10691 addr += 0x180; 10692 /* Construct the SError syndrome from IDS and ISS fields. */ 10693 env->exception.syndrome = syn_serror(env->cp15.vsesr_el2 & 0x1ffffff); 10694 env->cp15.esr_el[new_el] = env->exception.syndrome; 10695 break; 10696 default: 10697 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 10698 } 10699 10700 if (is_a64(env)) { 10701 old_mode = pstate_read(env); 10702 aarch64_save_sp(env, arm_current_el(env)); 10703 env->elr_el[new_el] = env->pc; 10704 } else { 10705 old_mode = cpsr_read_for_spsr_elx(env); 10706 env->elr_el[new_el] = env->regs[15]; 10707 10708 aarch64_sync_32_to_64(env); 10709 10710 env->condexec_bits = 0; 10711 } 10712 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = old_mode; 10713 10714 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 10715 env->elr_el[new_el]); 10716 10717 if (cpu_isar_feature(aa64_pan, cpu)) { 10718 /* The value of PSTATE.PAN is normally preserved, except when ... */ 10719 new_mode |= old_mode & PSTATE_PAN; 10720 switch (new_el) { 10721 case 2: 10722 /* ... the target is EL2 with HCR_EL2.{E2H,TGE} == '11' ... */ 10723 if ((arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) 10724 != (HCR_E2H | HCR_TGE)) { 10725 break; 10726 } 10727 /* fall through */ 10728 case 1: 10729 /* ... the target is EL1 ... */ 10730 /* ... and SCTLR_ELx.SPAN == 0, then set to 1. */ 10731 if ((env->cp15.sctlr_el[new_el] & SCTLR_SPAN) == 0) { 10732 new_mode |= PSTATE_PAN; 10733 } 10734 break; 10735 } 10736 } 10737 if (cpu_isar_feature(aa64_mte, cpu)) { 10738 new_mode |= PSTATE_TCO; 10739 } 10740 10741 if (cpu_isar_feature(aa64_ssbs, cpu)) { 10742 if (env->cp15.sctlr_el[new_el] & SCTLR_DSSBS_64) { 10743 new_mode |= PSTATE_SSBS; 10744 } else { 10745 new_mode &= ~PSTATE_SSBS; 10746 } 10747 } 10748 10749 pstate_write(env, PSTATE_DAIF | new_mode); 10750 env->aarch64 = true; 10751 aarch64_restore_sp(env, new_el); 10752 helper_rebuild_hflags_a64(env, new_el); 10753 10754 env->pc = addr; 10755 10756 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 10757 new_el, env->pc, pstate_read(env)); 10758 } 10759 10760 /* 10761 * Do semihosting call and set the appropriate return value. All the 10762 * permission and validity checks have been done at translate time. 10763 * 10764 * We only see semihosting exceptions in TCG only as they are not 10765 * trapped to the hypervisor in KVM. 10766 */ 10767 #ifdef CONFIG_TCG 10768 static void handle_semihosting(CPUState *cs) 10769 { 10770 ARMCPU *cpu = ARM_CPU(cs); 10771 CPUARMState *env = &cpu->env; 10772 10773 if (is_a64(env)) { 10774 qemu_log_mask(CPU_LOG_INT, 10775 "...handling as semihosting call 0x%" PRIx64 "\n", 10776 env->xregs[0]); 10777 do_common_semihosting(cs); 10778 env->pc += 4; 10779 } else { 10780 qemu_log_mask(CPU_LOG_INT, 10781 "...handling as semihosting call 0x%x\n", 10782 env->regs[0]); 10783 do_common_semihosting(cs); 10784 env->regs[15] += env->thumb ? 2 : 4; 10785 } 10786 } 10787 #endif 10788 10789 /* 10790 * Handle a CPU exception for A and R profile CPUs. 10791 * Do any appropriate logging, handle PSCI calls, and then hand off 10792 * to the AArch64-entry or AArch32-entry function depending on the 10793 * target exception level's register width. 10794 * 10795 * Note: this is used for both TCG (as the do_interrupt tcg op), 10796 * and KVM to re-inject guest debug exceptions, and to 10797 * inject a Synchronous-External-Abort. 10798 */ 10799 void arm_cpu_do_interrupt(CPUState *cs) 10800 { 10801 ARMCPU *cpu = ARM_CPU(cs); 10802 CPUARMState *env = &cpu->env; 10803 unsigned int new_el = env->exception.target_el; 10804 10805 assert(!arm_feature(env, ARM_FEATURE_M)); 10806 10807 arm_log_exception(cs); 10808 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 10809 new_el); 10810 if (qemu_loglevel_mask(CPU_LOG_INT) 10811 && !excp_is_internal(cs->exception_index)) { 10812 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 10813 syn_get_ec(env->exception.syndrome), 10814 env->exception.syndrome); 10815 } 10816 10817 if (arm_is_psci_call(cpu, cs->exception_index)) { 10818 arm_handle_psci_call(cpu); 10819 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 10820 return; 10821 } 10822 10823 /* 10824 * Semihosting semantics depend on the register width of the code 10825 * that caused the exception, not the target exception level, so 10826 * must be handled here. 10827 */ 10828 #ifdef CONFIG_TCG 10829 if (cs->exception_index == EXCP_SEMIHOST) { 10830 handle_semihosting(cs); 10831 return; 10832 } 10833 #endif 10834 10835 /* 10836 * Hooks may change global state so BQL should be held, also the 10837 * BQL needs to be held for any modification of 10838 * cs->interrupt_request. 10839 */ 10840 g_assert(qemu_mutex_iothread_locked()); 10841 10842 arm_call_pre_el_change_hook(cpu); 10843 10844 assert(!excp_is_internal(cs->exception_index)); 10845 if (arm_el_is_aa64(env, new_el)) { 10846 arm_cpu_do_interrupt_aarch64(cs); 10847 } else { 10848 arm_cpu_do_interrupt_aarch32(cs); 10849 } 10850 10851 arm_call_el_change_hook(cpu); 10852 10853 if (!kvm_enabled()) { 10854 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 10855 } 10856 } 10857 #endif /* !CONFIG_USER_ONLY */ 10858 10859 uint64_t arm_sctlr(CPUARMState *env, int el) 10860 { 10861 /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */ 10862 if (el == 0) { 10863 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0); 10864 el = mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1; 10865 } 10866 return env->cp15.sctlr_el[el]; 10867 } 10868 10869 int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx) 10870 { 10871 if (regime_has_2_ranges(mmu_idx)) { 10872 return extract64(tcr, 37, 2); 10873 } else if (regime_is_stage2(mmu_idx)) { 10874 return 0; /* VTCR_EL2 */ 10875 } else { 10876 /* Replicate the single TBI bit so we always have 2 bits. */ 10877 return extract32(tcr, 20, 1) * 3; 10878 } 10879 } 10880 10881 int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx) 10882 { 10883 if (regime_has_2_ranges(mmu_idx)) { 10884 return extract64(tcr, 51, 2); 10885 } else if (regime_is_stage2(mmu_idx)) { 10886 return 0; /* VTCR_EL2 */ 10887 } else { 10888 /* Replicate the single TBID bit so we always have 2 bits. */ 10889 return extract32(tcr, 29, 1) * 3; 10890 } 10891 } 10892 10893 static int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx) 10894 { 10895 if (regime_has_2_ranges(mmu_idx)) { 10896 return extract64(tcr, 57, 2); 10897 } else { 10898 /* Replicate the single TCMA bit so we always have 2 bits. */ 10899 return extract32(tcr, 30, 1) * 3; 10900 } 10901 } 10902 10903 static ARMGranuleSize tg0_to_gran_size(int tg) 10904 { 10905 switch (tg) { 10906 case 0: 10907 return Gran4K; 10908 case 1: 10909 return Gran64K; 10910 case 2: 10911 return Gran16K; 10912 default: 10913 return GranInvalid; 10914 } 10915 } 10916 10917 static ARMGranuleSize tg1_to_gran_size(int tg) 10918 { 10919 switch (tg) { 10920 case 1: 10921 return Gran16K; 10922 case 2: 10923 return Gran4K; 10924 case 3: 10925 return Gran64K; 10926 default: 10927 return GranInvalid; 10928 } 10929 } 10930 10931 static inline bool have4k(ARMCPU *cpu, bool stage2) 10932 { 10933 return stage2 ? cpu_isar_feature(aa64_tgran4_2, cpu) 10934 : cpu_isar_feature(aa64_tgran4, cpu); 10935 } 10936 10937 static inline bool have16k(ARMCPU *cpu, bool stage2) 10938 { 10939 return stage2 ? cpu_isar_feature(aa64_tgran16_2, cpu) 10940 : cpu_isar_feature(aa64_tgran16, cpu); 10941 } 10942 10943 static inline bool have64k(ARMCPU *cpu, bool stage2) 10944 { 10945 return stage2 ? cpu_isar_feature(aa64_tgran64_2, cpu) 10946 : cpu_isar_feature(aa64_tgran64, cpu); 10947 } 10948 10949 static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran, 10950 bool stage2) 10951 { 10952 switch (gran) { 10953 case Gran4K: 10954 if (have4k(cpu, stage2)) { 10955 return gran; 10956 } 10957 break; 10958 case Gran16K: 10959 if (have16k(cpu, stage2)) { 10960 return gran; 10961 } 10962 break; 10963 case Gran64K: 10964 if (have64k(cpu, stage2)) { 10965 return gran; 10966 } 10967 break; 10968 case GranInvalid: 10969 break; 10970 } 10971 /* 10972 * If the guest selects a granule size that isn't implemented, 10973 * the architecture requires that we behave as if it selected one 10974 * that is (with an IMPDEF choice of which one to pick). We choose 10975 * to implement the smallest supported granule size. 10976 */ 10977 if (have4k(cpu, stage2)) { 10978 return Gran4K; 10979 } 10980 if (have16k(cpu, stage2)) { 10981 return Gran16K; 10982 } 10983 assert(have64k(cpu, stage2)); 10984 return Gran64K; 10985 } 10986 10987 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 10988 ARMMMUIdx mmu_idx, bool data) 10989 { 10990 uint64_t tcr = regime_tcr(env, mmu_idx); 10991 bool epd, hpd, tsz_oob, ds, ha, hd; 10992 int select, tsz, tbi, max_tsz, min_tsz, ps, sh; 10993 ARMGranuleSize gran; 10994 ARMCPU *cpu = env_archcpu(env); 10995 bool stage2 = regime_is_stage2(mmu_idx); 10996 10997 if (!regime_has_2_ranges(mmu_idx)) { 10998 select = 0; 10999 tsz = extract32(tcr, 0, 6); 11000 gran = tg0_to_gran_size(extract32(tcr, 14, 2)); 11001 if (stage2) { 11002 /* VTCR_EL2 */ 11003 hpd = false; 11004 } else { 11005 hpd = extract32(tcr, 24, 1); 11006 } 11007 epd = false; 11008 sh = extract32(tcr, 12, 2); 11009 ps = extract32(tcr, 16, 3); 11010 ha = extract32(tcr, 21, 1) && cpu_isar_feature(aa64_hafs, cpu); 11011 hd = extract32(tcr, 22, 1) && cpu_isar_feature(aa64_hdbs, cpu); 11012 ds = extract64(tcr, 32, 1); 11013 } else { 11014 bool e0pd; 11015 11016 /* 11017 * Bit 55 is always between the two regions, and is canonical for 11018 * determining if address tagging is enabled. 11019 */ 11020 select = extract64(va, 55, 1); 11021 if (!select) { 11022 tsz = extract32(tcr, 0, 6); 11023 gran = tg0_to_gran_size(extract32(tcr, 14, 2)); 11024 epd = extract32(tcr, 7, 1); 11025 sh = extract32(tcr, 12, 2); 11026 hpd = extract64(tcr, 41, 1); 11027 e0pd = extract64(tcr, 55, 1); 11028 } else { 11029 tsz = extract32(tcr, 16, 6); 11030 gran = tg1_to_gran_size(extract32(tcr, 30, 2)); 11031 epd = extract32(tcr, 23, 1); 11032 sh = extract32(tcr, 28, 2); 11033 hpd = extract64(tcr, 42, 1); 11034 e0pd = extract64(tcr, 56, 1); 11035 } 11036 ps = extract64(tcr, 32, 3); 11037 ha = extract64(tcr, 39, 1) && cpu_isar_feature(aa64_hafs, cpu); 11038 hd = extract64(tcr, 40, 1) && cpu_isar_feature(aa64_hdbs, cpu); 11039 ds = extract64(tcr, 59, 1); 11040 11041 if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) && 11042 regime_is_user(env, mmu_idx)) { 11043 epd = true; 11044 } 11045 } 11046 11047 gran = sanitize_gran_size(cpu, gran, stage2); 11048 11049 if (cpu_isar_feature(aa64_st, cpu)) { 11050 max_tsz = 48 - (gran == Gran64K); 11051 } else { 11052 max_tsz = 39; 11053 } 11054 11055 /* 11056 * DS is RES0 unless FEAT_LPA2 is supported for the given page size; 11057 * adjust the effective value of DS, as documented. 11058 */ 11059 min_tsz = 16; 11060 if (gran == Gran64K) { 11061 if (cpu_isar_feature(aa64_lva, cpu)) { 11062 min_tsz = 12; 11063 } 11064 ds = false; 11065 } else if (ds) { 11066 if (regime_is_stage2(mmu_idx)) { 11067 if (gran == Gran16K) { 11068 ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu); 11069 } else { 11070 ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu); 11071 } 11072 } else { 11073 if (gran == Gran16K) { 11074 ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu); 11075 } else { 11076 ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu); 11077 } 11078 } 11079 if (ds) { 11080 min_tsz = 12; 11081 } 11082 } 11083 11084 if (tsz > max_tsz) { 11085 tsz = max_tsz; 11086 tsz_oob = true; 11087 } else if (tsz < min_tsz) { 11088 tsz = min_tsz; 11089 tsz_oob = true; 11090 } else { 11091 tsz_oob = false; 11092 } 11093 11094 /* Present TBI as a composite with TBID. */ 11095 tbi = aa64_va_parameter_tbi(tcr, mmu_idx); 11096 if (!data) { 11097 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx); 11098 } 11099 tbi = (tbi >> select) & 1; 11100 11101 return (ARMVAParameters) { 11102 .tsz = tsz, 11103 .ps = ps, 11104 .sh = sh, 11105 .select = select, 11106 .tbi = tbi, 11107 .epd = epd, 11108 .hpd = hpd, 11109 .tsz_oob = tsz_oob, 11110 .ds = ds, 11111 .ha = ha, 11112 .hd = ha && hd, 11113 .gran = gran, 11114 }; 11115 } 11116 11117 /* 11118 * Note that signed overflow is undefined in C. The following routines are 11119 * careful to use unsigned types where modulo arithmetic is required. 11120 * Failure to do so _will_ break on newer gcc. 11121 */ 11122 11123 /* Signed saturating arithmetic. */ 11124 11125 /* Perform 16-bit signed saturating addition. */ 11126 static inline uint16_t add16_sat(uint16_t a, uint16_t b) 11127 { 11128 uint16_t res; 11129 11130 res = a + b; 11131 if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) { 11132 if (a & 0x8000) { 11133 res = 0x8000; 11134 } else { 11135 res = 0x7fff; 11136 } 11137 } 11138 return res; 11139 } 11140 11141 /* Perform 8-bit signed saturating addition. */ 11142 static inline uint8_t add8_sat(uint8_t a, uint8_t b) 11143 { 11144 uint8_t res; 11145 11146 res = a + b; 11147 if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) { 11148 if (a & 0x80) { 11149 res = 0x80; 11150 } else { 11151 res = 0x7f; 11152 } 11153 } 11154 return res; 11155 } 11156 11157 /* Perform 16-bit signed saturating subtraction. */ 11158 static inline uint16_t sub16_sat(uint16_t a, uint16_t b) 11159 { 11160 uint16_t res; 11161 11162 res = a - b; 11163 if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) { 11164 if (a & 0x8000) { 11165 res = 0x8000; 11166 } else { 11167 res = 0x7fff; 11168 } 11169 } 11170 return res; 11171 } 11172 11173 /* Perform 8-bit signed saturating subtraction. */ 11174 static inline uint8_t sub8_sat(uint8_t a, uint8_t b) 11175 { 11176 uint8_t res; 11177 11178 res = a - b; 11179 if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) { 11180 if (a & 0x80) { 11181 res = 0x80; 11182 } else { 11183 res = 0x7f; 11184 } 11185 } 11186 return res; 11187 } 11188 11189 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16); 11190 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16); 11191 #define ADD8(a, b, n) RESULT(add8_sat(a, b), n, 8); 11192 #define SUB8(a, b, n) RESULT(sub8_sat(a, b), n, 8); 11193 #define PFX q 11194 11195 #include "op_addsub.h" 11196 11197 /* Unsigned saturating arithmetic. */ 11198 static inline uint16_t add16_usat(uint16_t a, uint16_t b) 11199 { 11200 uint16_t res; 11201 res = a + b; 11202 if (res < a) { 11203 res = 0xffff; 11204 } 11205 return res; 11206 } 11207 11208 static inline uint16_t sub16_usat(uint16_t a, uint16_t b) 11209 { 11210 if (a > b) { 11211 return a - b; 11212 } else { 11213 return 0; 11214 } 11215 } 11216 11217 static inline uint8_t add8_usat(uint8_t a, uint8_t b) 11218 { 11219 uint8_t res; 11220 res = a + b; 11221 if (res < a) { 11222 res = 0xff; 11223 } 11224 return res; 11225 } 11226 11227 static inline uint8_t sub8_usat(uint8_t a, uint8_t b) 11228 { 11229 if (a > b) { 11230 return a - b; 11231 } else { 11232 return 0; 11233 } 11234 } 11235 11236 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16); 11237 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16); 11238 #define ADD8(a, b, n) RESULT(add8_usat(a, b), n, 8); 11239 #define SUB8(a, b, n) RESULT(sub8_usat(a, b), n, 8); 11240 #define PFX uq 11241 11242 #include "op_addsub.h" 11243 11244 /* Signed modulo arithmetic. */ 11245 #define SARITH16(a, b, n, op) do { \ 11246 int32_t sum; \ 11247 sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \ 11248 RESULT(sum, n, 16); \ 11249 if (sum >= 0) \ 11250 ge |= 3 << (n * 2); \ 11251 } while (0) 11252 11253 #define SARITH8(a, b, n, op) do { \ 11254 int32_t sum; \ 11255 sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \ 11256 RESULT(sum, n, 8); \ 11257 if (sum >= 0) \ 11258 ge |= 1 << n; \ 11259 } while (0) 11260 11261 11262 #define ADD16(a, b, n) SARITH16(a, b, n, +) 11263 #define SUB16(a, b, n) SARITH16(a, b, n, -) 11264 #define ADD8(a, b, n) SARITH8(a, b, n, +) 11265 #define SUB8(a, b, n) SARITH8(a, b, n, -) 11266 #define PFX s 11267 #define ARITH_GE 11268 11269 #include "op_addsub.h" 11270 11271 /* Unsigned modulo arithmetic. */ 11272 #define ADD16(a, b, n) do { \ 11273 uint32_t sum; \ 11274 sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \ 11275 RESULT(sum, n, 16); \ 11276 if ((sum >> 16) == 1) \ 11277 ge |= 3 << (n * 2); \ 11278 } while (0) 11279 11280 #define ADD8(a, b, n) do { \ 11281 uint32_t sum; \ 11282 sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \ 11283 RESULT(sum, n, 8); \ 11284 if ((sum >> 8) == 1) \ 11285 ge |= 1 << n; \ 11286 } while (0) 11287 11288 #define SUB16(a, b, n) do { \ 11289 uint32_t sum; \ 11290 sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \ 11291 RESULT(sum, n, 16); \ 11292 if ((sum >> 16) == 0) \ 11293 ge |= 3 << (n * 2); \ 11294 } while (0) 11295 11296 #define SUB8(a, b, n) do { \ 11297 uint32_t sum; \ 11298 sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \ 11299 RESULT(sum, n, 8); \ 11300 if ((sum >> 8) == 0) \ 11301 ge |= 1 << n; \ 11302 } while (0) 11303 11304 #define PFX u 11305 #define ARITH_GE 11306 11307 #include "op_addsub.h" 11308 11309 /* Halved signed arithmetic. */ 11310 #define ADD16(a, b, n) \ 11311 RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16) 11312 #define SUB16(a, b, n) \ 11313 RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16) 11314 #define ADD8(a, b, n) \ 11315 RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8) 11316 #define SUB8(a, b, n) \ 11317 RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8) 11318 #define PFX sh 11319 11320 #include "op_addsub.h" 11321 11322 /* Halved unsigned arithmetic. */ 11323 #define ADD16(a, b, n) \ 11324 RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16) 11325 #define SUB16(a, b, n) \ 11326 RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16) 11327 #define ADD8(a, b, n) \ 11328 RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8) 11329 #define SUB8(a, b, n) \ 11330 RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8) 11331 #define PFX uh 11332 11333 #include "op_addsub.h" 11334 11335 static inline uint8_t do_usad(uint8_t a, uint8_t b) 11336 { 11337 if (a > b) { 11338 return a - b; 11339 } else { 11340 return b - a; 11341 } 11342 } 11343 11344 /* Unsigned sum of absolute byte differences. */ 11345 uint32_t HELPER(usad8)(uint32_t a, uint32_t b) 11346 { 11347 uint32_t sum; 11348 sum = do_usad(a, b); 11349 sum += do_usad(a >> 8, b >> 8); 11350 sum += do_usad(a >> 16, b >> 16); 11351 sum += do_usad(a >> 24, b >> 24); 11352 return sum; 11353 } 11354 11355 /* For ARMv6 SEL instruction. */ 11356 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b) 11357 { 11358 uint32_t mask; 11359 11360 mask = 0; 11361 if (flags & 1) { 11362 mask |= 0xff; 11363 } 11364 if (flags & 2) { 11365 mask |= 0xff00; 11366 } 11367 if (flags & 4) { 11368 mask |= 0xff0000; 11369 } 11370 if (flags & 8) { 11371 mask |= 0xff000000; 11372 } 11373 return (a & mask) | (b & ~mask); 11374 } 11375 11376 /* 11377 * CRC helpers. 11378 * The upper bytes of val (above the number specified by 'bytes') must have 11379 * been zeroed out by the caller. 11380 */ 11381 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes) 11382 { 11383 uint8_t buf[4]; 11384 11385 stl_le_p(buf, val); 11386 11387 /* zlib crc32 converts the accumulator and output to one's complement. */ 11388 return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff; 11389 } 11390 11391 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes) 11392 { 11393 uint8_t buf[4]; 11394 11395 stl_le_p(buf, val); 11396 11397 /* Linux crc32c converts the output to one's complement. */ 11398 return crc32c(acc, buf, bytes) ^ 0xffffffff; 11399 } 11400 11401 /* 11402 * Return the exception level to which FP-disabled exceptions should 11403 * be taken, or 0 if FP is enabled. 11404 */ 11405 int fp_exception_el(CPUARMState *env, int cur_el) 11406 { 11407 #ifndef CONFIG_USER_ONLY 11408 uint64_t hcr_el2; 11409 11410 /* 11411 * CPACR and the CPTR registers don't exist before v6, so FP is 11412 * always accessible 11413 */ 11414 if (!arm_feature(env, ARM_FEATURE_V6)) { 11415 return 0; 11416 } 11417 11418 if (arm_feature(env, ARM_FEATURE_M)) { 11419 /* CPACR can cause a NOCP UsageFault taken to current security state */ 11420 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) { 11421 return 1; 11422 } 11423 11424 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) { 11425 if (!extract32(env->v7m.nsacr, 10, 1)) { 11426 /* FP insns cause a NOCP UsageFault taken to Secure */ 11427 return 3; 11428 } 11429 } 11430 11431 return 0; 11432 } 11433 11434 hcr_el2 = arm_hcr_el2_eff(env); 11435 11436 /* 11437 * The CPACR controls traps to EL1, or PL1 if we're 32 bit: 11438 * 0, 2 : trap EL0 and EL1/PL1 accesses 11439 * 1 : trap only EL0 accesses 11440 * 3 : trap no accesses 11441 * This register is ignored if E2H+TGE are both set. 11442 */ 11443 if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 11444 int fpen = FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, FPEN); 11445 11446 switch (fpen) { 11447 case 1: 11448 if (cur_el != 0) { 11449 break; 11450 } 11451 /* fall through */ 11452 case 0: 11453 case 2: 11454 /* Trap from Secure PL0 or PL1 to Secure PL1. */ 11455 if (!arm_el_is_aa64(env, 3) 11456 && (cur_el == 3 || arm_is_secure_below_el3(env))) { 11457 return 3; 11458 } 11459 if (cur_el <= 1) { 11460 return 1; 11461 } 11462 break; 11463 } 11464 } 11465 11466 /* 11467 * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode 11468 * to control non-secure access to the FPU. It doesn't have any 11469 * effect if EL3 is AArch64 or if EL3 doesn't exist at all. 11470 */ 11471 if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 11472 cur_el <= 2 && !arm_is_secure_below_el3(env))) { 11473 if (!extract32(env->cp15.nsacr, 10, 1)) { 11474 /* FP insns act as UNDEF */ 11475 return cur_el == 2 ? 2 : 1; 11476 } 11477 } 11478 11479 /* 11480 * CPTR_EL2 is present in v7VE or v8, and changes format 11481 * with HCR_EL2.E2H (regardless of TGE). 11482 */ 11483 if (cur_el <= 2) { 11484 if (hcr_el2 & HCR_E2H) { 11485 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, FPEN)) { 11486 case 1: 11487 if (cur_el != 0 || !(hcr_el2 & HCR_TGE)) { 11488 break; 11489 } 11490 /* fall through */ 11491 case 0: 11492 case 2: 11493 return 2; 11494 } 11495 } else if (arm_is_el2_enabled(env)) { 11496 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TFP)) { 11497 return 2; 11498 } 11499 } 11500 } 11501 11502 /* CPTR_EL3 : present in v8 */ 11503 if (FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TFP)) { 11504 /* Trap all FP ops to EL3 */ 11505 return 3; 11506 } 11507 #endif 11508 return 0; 11509 } 11510 11511 /* Return the exception level we're running at if this is our mmu_idx */ 11512 int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx) 11513 { 11514 if (mmu_idx & ARM_MMU_IDX_M) { 11515 return mmu_idx & ARM_MMU_IDX_M_PRIV; 11516 } 11517 11518 switch (mmu_idx) { 11519 case ARMMMUIdx_E10_0: 11520 case ARMMMUIdx_E20_0: 11521 return 0; 11522 case ARMMMUIdx_E10_1: 11523 case ARMMMUIdx_E10_1_PAN: 11524 return 1; 11525 case ARMMMUIdx_E2: 11526 case ARMMMUIdx_E20_2: 11527 case ARMMMUIdx_E20_2_PAN: 11528 return 2; 11529 case ARMMMUIdx_E3: 11530 return 3; 11531 default: 11532 g_assert_not_reached(); 11533 } 11534 } 11535 11536 #ifndef CONFIG_TCG 11537 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 11538 { 11539 g_assert_not_reached(); 11540 } 11541 #endif 11542 11543 static bool arm_pan_enabled(CPUARMState *env) 11544 { 11545 if (is_a64(env)) { 11546 return env->pstate & PSTATE_PAN; 11547 } else { 11548 return env->uncached_cpsr & CPSR_PAN; 11549 } 11550 } 11551 11552 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el) 11553 { 11554 ARMMMUIdx idx; 11555 uint64_t hcr; 11556 11557 if (arm_feature(env, ARM_FEATURE_M)) { 11558 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 11559 } 11560 11561 /* See ARM pseudo-function ELIsInHost. */ 11562 switch (el) { 11563 case 0: 11564 hcr = arm_hcr_el2_eff(env); 11565 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 11566 idx = ARMMMUIdx_E20_0; 11567 } else { 11568 idx = ARMMMUIdx_E10_0; 11569 } 11570 break; 11571 case 1: 11572 if (arm_pan_enabled(env)) { 11573 idx = ARMMMUIdx_E10_1_PAN; 11574 } else { 11575 idx = ARMMMUIdx_E10_1; 11576 } 11577 break; 11578 case 2: 11579 /* Note that TGE does not apply at EL2. */ 11580 if (arm_hcr_el2_eff(env) & HCR_E2H) { 11581 if (arm_pan_enabled(env)) { 11582 idx = ARMMMUIdx_E20_2_PAN; 11583 } else { 11584 idx = ARMMMUIdx_E20_2; 11585 } 11586 } else { 11587 idx = ARMMMUIdx_E2; 11588 } 11589 break; 11590 case 3: 11591 return ARMMMUIdx_E3; 11592 default: 11593 g_assert_not_reached(); 11594 } 11595 11596 return idx; 11597 } 11598 11599 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 11600 { 11601 return arm_mmu_idx_el(env, arm_current_el(env)); 11602 } 11603 11604 static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el, 11605 ARMMMUIdx mmu_idx, 11606 CPUARMTBFlags flags) 11607 { 11608 DP_TBFLAG_ANY(flags, FPEXC_EL, fp_el); 11609 DP_TBFLAG_ANY(flags, MMUIDX, arm_to_core_mmu_idx(mmu_idx)); 11610 11611 if (arm_singlestep_active(env)) { 11612 DP_TBFLAG_ANY(flags, SS_ACTIVE, 1); 11613 } 11614 return flags; 11615 } 11616 11617 static CPUARMTBFlags rebuild_hflags_common_32(CPUARMState *env, int fp_el, 11618 ARMMMUIdx mmu_idx, 11619 CPUARMTBFlags flags) 11620 { 11621 bool sctlr_b = arm_sctlr_b(env); 11622 11623 if (sctlr_b) { 11624 DP_TBFLAG_A32(flags, SCTLR__B, 1); 11625 } 11626 if (arm_cpu_data_is_big_endian_a32(env, sctlr_b)) { 11627 DP_TBFLAG_ANY(flags, BE_DATA, 1); 11628 } 11629 DP_TBFLAG_A32(flags, NS, !access_secure_reg(env)); 11630 11631 return rebuild_hflags_common(env, fp_el, mmu_idx, flags); 11632 } 11633 11634 static CPUARMTBFlags rebuild_hflags_m32(CPUARMState *env, int fp_el, 11635 ARMMMUIdx mmu_idx) 11636 { 11637 CPUARMTBFlags flags = {}; 11638 uint32_t ccr = env->v7m.ccr[env->v7m.secure]; 11639 11640 /* Without HaveMainExt, CCR.UNALIGN_TRP is RES1. */ 11641 if (ccr & R_V7M_CCR_UNALIGN_TRP_MASK) { 11642 DP_TBFLAG_ANY(flags, ALIGN_MEM, 1); 11643 } 11644 11645 if (arm_v7m_is_handler_mode(env)) { 11646 DP_TBFLAG_M32(flags, HANDLER, 1); 11647 } 11648 11649 /* 11650 * v8M always applies stack limit checks unless CCR.STKOFHFNMIGN 11651 * is suppressing them because the requested execution priority 11652 * is less than 0. 11653 */ 11654 if (arm_feature(env, ARM_FEATURE_V8) && 11655 !((mmu_idx & ARM_MMU_IDX_M_NEGPRI) && 11656 (ccr & R_V7M_CCR_STKOFHFNMIGN_MASK))) { 11657 DP_TBFLAG_M32(flags, STACKCHECK, 1); 11658 } 11659 11660 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && env->v7m.secure) { 11661 DP_TBFLAG_M32(flags, SECURE, 1); 11662 } 11663 11664 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags); 11665 } 11666 11667 static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el, 11668 ARMMMUIdx mmu_idx) 11669 { 11670 CPUARMTBFlags flags = {}; 11671 int el = arm_current_el(env); 11672 11673 if (arm_sctlr(env, el) & SCTLR_A) { 11674 DP_TBFLAG_ANY(flags, ALIGN_MEM, 1); 11675 } 11676 11677 if (arm_el_is_aa64(env, 1)) { 11678 DP_TBFLAG_A32(flags, VFPEN, 1); 11679 } 11680 11681 if (el < 2 && env->cp15.hstr_el2 && 11682 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 11683 DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1); 11684 } 11685 11686 if (env->uncached_cpsr & CPSR_IL) { 11687 DP_TBFLAG_ANY(flags, PSTATE__IL, 1); 11688 } 11689 11690 /* 11691 * The SME exception we are testing for is raised via 11692 * AArch64.CheckFPAdvSIMDEnabled(), as called from 11693 * AArch32.CheckAdvSIMDOrFPEnabled(). 11694 */ 11695 if (el == 0 11696 && FIELD_EX64(env->svcr, SVCR, SM) 11697 && (!arm_is_el2_enabled(env) 11698 || (arm_el_is_aa64(env, 2) && !(env->cp15.hcr_el2 & HCR_TGE))) 11699 && arm_el_is_aa64(env, 1) 11700 && !sme_fa64(env, el)) { 11701 DP_TBFLAG_A32(flags, SME_TRAP_NONSTREAMING, 1); 11702 } 11703 11704 return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags); 11705 } 11706 11707 static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el, 11708 ARMMMUIdx mmu_idx) 11709 { 11710 CPUARMTBFlags flags = {}; 11711 ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx); 11712 uint64_t tcr = regime_tcr(env, mmu_idx); 11713 uint64_t sctlr; 11714 int tbii, tbid; 11715 11716 DP_TBFLAG_ANY(flags, AARCH64_STATE, 1); 11717 11718 /* Get control bits for tagged addresses. */ 11719 tbid = aa64_va_parameter_tbi(tcr, mmu_idx); 11720 tbii = tbid & ~aa64_va_parameter_tbid(tcr, mmu_idx); 11721 11722 DP_TBFLAG_A64(flags, TBII, tbii); 11723 DP_TBFLAG_A64(flags, TBID, tbid); 11724 11725 if (cpu_isar_feature(aa64_sve, env_archcpu(env))) { 11726 int sve_el = sve_exception_el(env, el); 11727 11728 /* 11729 * If either FP or SVE are disabled, translator does not need len. 11730 * If SVE EL > FP EL, FP exception has precedence, and translator 11731 * does not need SVE EL. Save potential re-translations by forcing 11732 * the unneeded data to zero. 11733 */ 11734 if (fp_el != 0) { 11735 if (sve_el > fp_el) { 11736 sve_el = 0; 11737 } 11738 } else if (sve_el == 0) { 11739 DP_TBFLAG_A64(flags, VL, sve_vqm1_for_el(env, el)); 11740 } 11741 DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el); 11742 } 11743 if (cpu_isar_feature(aa64_sme, env_archcpu(env))) { 11744 int sme_el = sme_exception_el(env, el); 11745 bool sm = FIELD_EX64(env->svcr, SVCR, SM); 11746 11747 DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el); 11748 if (sme_el == 0) { 11749 /* Similarly, do not compute SVL if SME is disabled. */ 11750 int svl = sve_vqm1_for_el_sm(env, el, true); 11751 DP_TBFLAG_A64(flags, SVL, svl); 11752 if (sm) { 11753 /* If SVE is disabled, we will not have set VL above. */ 11754 DP_TBFLAG_A64(flags, VL, svl); 11755 } 11756 } 11757 if (sm) { 11758 DP_TBFLAG_A64(flags, PSTATE_SM, 1); 11759 DP_TBFLAG_A64(flags, SME_TRAP_NONSTREAMING, !sme_fa64(env, el)); 11760 } 11761 DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA)); 11762 } 11763 11764 sctlr = regime_sctlr(env, stage1); 11765 11766 if (sctlr & SCTLR_A) { 11767 DP_TBFLAG_ANY(flags, ALIGN_MEM, 1); 11768 } 11769 11770 if (arm_cpu_data_is_big_endian_a64(el, sctlr)) { 11771 DP_TBFLAG_ANY(flags, BE_DATA, 1); 11772 } 11773 11774 if (cpu_isar_feature(aa64_pauth, env_archcpu(env))) { 11775 /* 11776 * In order to save space in flags, we record only whether 11777 * pauth is "inactive", meaning all insns are implemented as 11778 * a nop, or "active" when some action must be performed. 11779 * The decision of which action to take is left to a helper. 11780 */ 11781 if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) { 11782 DP_TBFLAG_A64(flags, PAUTH_ACTIVE, 1); 11783 } 11784 } 11785 11786 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) { 11787 /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */ 11788 if (sctlr & (el == 0 ? SCTLR_BT0 : SCTLR_BT1)) { 11789 DP_TBFLAG_A64(flags, BT, 1); 11790 } 11791 } 11792 11793 /* Compute the condition for using AccType_UNPRIV for LDTR et al. */ 11794 if (!(env->pstate & PSTATE_UAO)) { 11795 switch (mmu_idx) { 11796 case ARMMMUIdx_E10_1: 11797 case ARMMMUIdx_E10_1_PAN: 11798 /* TODO: ARMv8.3-NV */ 11799 DP_TBFLAG_A64(flags, UNPRIV, 1); 11800 break; 11801 case ARMMMUIdx_E20_2: 11802 case ARMMMUIdx_E20_2_PAN: 11803 /* 11804 * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is 11805 * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR. 11806 */ 11807 if (env->cp15.hcr_el2 & HCR_TGE) { 11808 DP_TBFLAG_A64(flags, UNPRIV, 1); 11809 } 11810 break; 11811 default: 11812 break; 11813 } 11814 } 11815 11816 if (env->pstate & PSTATE_IL) { 11817 DP_TBFLAG_ANY(flags, PSTATE__IL, 1); 11818 } 11819 11820 if (cpu_isar_feature(aa64_mte, env_archcpu(env))) { 11821 /* 11822 * Set MTE_ACTIVE if any access may be Checked, and leave clear 11823 * if all accesses must be Unchecked: 11824 * 1) If no TBI, then there are no tags in the address to check, 11825 * 2) If Tag Check Override, then all accesses are Unchecked, 11826 * 3) If Tag Check Fail == 0, then Checked access have no effect, 11827 * 4) If no Allocation Tag Access, then all accesses are Unchecked. 11828 */ 11829 if (allocation_tag_access_enabled(env, el, sctlr)) { 11830 DP_TBFLAG_A64(flags, ATA, 1); 11831 if (tbid 11832 && !(env->pstate & PSTATE_TCO) 11833 && (sctlr & (el == 0 ? SCTLR_TCF0 : SCTLR_TCF))) { 11834 DP_TBFLAG_A64(flags, MTE_ACTIVE, 1); 11835 } 11836 } 11837 /* And again for unprivileged accesses, if required. */ 11838 if (EX_TBFLAG_A64(flags, UNPRIV) 11839 && tbid 11840 && !(env->pstate & PSTATE_TCO) 11841 && (sctlr & SCTLR_TCF0) 11842 && allocation_tag_access_enabled(env, 0, sctlr)) { 11843 DP_TBFLAG_A64(flags, MTE0_ACTIVE, 1); 11844 } 11845 /* Cache TCMA as well as TBI. */ 11846 DP_TBFLAG_A64(flags, TCMA, aa64_va_parameter_tcma(tcr, mmu_idx)); 11847 } 11848 11849 return rebuild_hflags_common(env, fp_el, mmu_idx, flags); 11850 } 11851 11852 static CPUARMTBFlags rebuild_hflags_internal(CPUARMState *env) 11853 { 11854 int el = arm_current_el(env); 11855 int fp_el = fp_exception_el(env, el); 11856 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 11857 11858 if (is_a64(env)) { 11859 return rebuild_hflags_a64(env, el, fp_el, mmu_idx); 11860 } else if (arm_feature(env, ARM_FEATURE_M)) { 11861 return rebuild_hflags_m32(env, fp_el, mmu_idx); 11862 } else { 11863 return rebuild_hflags_a32(env, fp_el, mmu_idx); 11864 } 11865 } 11866 11867 void arm_rebuild_hflags(CPUARMState *env) 11868 { 11869 env->hflags = rebuild_hflags_internal(env); 11870 } 11871 11872 /* 11873 * If we have triggered a EL state change we can't rely on the 11874 * translator having passed it to us, we need to recompute. 11875 */ 11876 void HELPER(rebuild_hflags_m32_newel)(CPUARMState *env) 11877 { 11878 int el = arm_current_el(env); 11879 int fp_el = fp_exception_el(env, el); 11880 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 11881 11882 env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx); 11883 } 11884 11885 void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el) 11886 { 11887 int fp_el = fp_exception_el(env, el); 11888 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 11889 11890 env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx); 11891 } 11892 11893 /* 11894 * If we have triggered a EL state change we can't rely on the 11895 * translator having passed it to us, we need to recompute. 11896 */ 11897 void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env) 11898 { 11899 int el = arm_current_el(env); 11900 int fp_el = fp_exception_el(env, el); 11901 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 11902 env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx); 11903 } 11904 11905 void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el) 11906 { 11907 int fp_el = fp_exception_el(env, el); 11908 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 11909 11910 env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx); 11911 } 11912 11913 void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el) 11914 { 11915 int fp_el = fp_exception_el(env, el); 11916 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el); 11917 11918 env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx); 11919 } 11920 11921 static inline void assert_hflags_rebuild_correctly(CPUARMState *env) 11922 { 11923 #ifdef CONFIG_DEBUG_TCG 11924 CPUARMTBFlags c = env->hflags; 11925 CPUARMTBFlags r = rebuild_hflags_internal(env); 11926 11927 if (unlikely(c.flags != r.flags || c.flags2 != r.flags2)) { 11928 fprintf(stderr, "TCG hflags mismatch " 11929 "(current:(0x%08x,0x" TARGET_FMT_lx ")" 11930 " rebuilt:(0x%08x,0x" TARGET_FMT_lx ")\n", 11931 c.flags, c.flags2, r.flags, r.flags2); 11932 abort(); 11933 } 11934 #endif 11935 } 11936 11937 static bool mve_no_pred(CPUARMState *env) 11938 { 11939 /* 11940 * Return true if there is definitely no predication of MVE 11941 * instructions by VPR or LTPSIZE. (Returning false even if there 11942 * isn't any predication is OK; generated code will just be 11943 * a little worse.) 11944 * If the CPU does not implement MVE then this TB flag is always 0. 11945 * 11946 * NOTE: if you change this logic, the "recalculate s->mve_no_pred" 11947 * logic in gen_update_fp_context() needs to be updated to match. 11948 * 11949 * We do not include the effect of the ECI bits here -- they are 11950 * tracked in other TB flags. This simplifies the logic for 11951 * "when did we emit code that changes the MVE_NO_PRED TB flag 11952 * and thus need to end the TB?". 11953 */ 11954 if (cpu_isar_feature(aa32_mve, env_archcpu(env))) { 11955 return false; 11956 } 11957 if (env->v7m.vpr) { 11958 return false; 11959 } 11960 if (env->v7m.ltpsize < 4) { 11961 return false; 11962 } 11963 return true; 11964 } 11965 11966 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, 11967 target_ulong *cs_base, uint32_t *pflags) 11968 { 11969 CPUARMTBFlags flags; 11970 11971 assert_hflags_rebuild_correctly(env); 11972 flags = env->hflags; 11973 11974 if (EX_TBFLAG_ANY(flags, AARCH64_STATE)) { 11975 *pc = env->pc; 11976 if (cpu_isar_feature(aa64_bti, env_archcpu(env))) { 11977 DP_TBFLAG_A64(flags, BTYPE, env->btype); 11978 } 11979 } else { 11980 *pc = env->regs[15]; 11981 11982 if (arm_feature(env, ARM_FEATURE_M)) { 11983 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && 11984 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) 11985 != env->v7m.secure) { 11986 DP_TBFLAG_M32(flags, FPCCR_S_WRONG, 1); 11987 } 11988 11989 if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) && 11990 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) || 11991 (env->v7m.secure && 11992 !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) { 11993 /* 11994 * ASPEN is set, but FPCA/SFPA indicate that there is no 11995 * active FP context; we must create a new FP context before 11996 * executing any FP insn. 11997 */ 11998 DP_TBFLAG_M32(flags, NEW_FP_CTXT_NEEDED, 1); 11999 } 12000 12001 bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK; 12002 if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) { 12003 DP_TBFLAG_M32(flags, LSPACT, 1); 12004 } 12005 12006 if (mve_no_pred(env)) { 12007 DP_TBFLAG_M32(flags, MVE_NO_PRED, 1); 12008 } 12009 } else { 12010 /* 12011 * Note that XSCALE_CPAR shares bits with VECSTRIDE. 12012 * Note that VECLEN+VECSTRIDE are RES0 for M-profile. 12013 */ 12014 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 12015 DP_TBFLAG_A32(flags, XSCALE_CPAR, env->cp15.c15_cpar); 12016 } else { 12017 DP_TBFLAG_A32(flags, VECLEN, env->vfp.vec_len); 12018 DP_TBFLAG_A32(flags, VECSTRIDE, env->vfp.vec_stride); 12019 } 12020 if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) { 12021 DP_TBFLAG_A32(flags, VFPEN, 1); 12022 } 12023 } 12024 12025 DP_TBFLAG_AM32(flags, THUMB, env->thumb); 12026 DP_TBFLAG_AM32(flags, CONDEXEC, env->condexec_bits); 12027 } 12028 12029 /* 12030 * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine 12031 * states defined in the ARM ARM for software singlestep: 12032 * SS_ACTIVE PSTATE.SS State 12033 * 0 x Inactive (the TB flag for SS is always 0) 12034 * 1 0 Active-pending 12035 * 1 1 Active-not-pending 12036 * SS_ACTIVE is set in hflags; PSTATE__SS is computed every TB. 12037 */ 12038 if (EX_TBFLAG_ANY(flags, SS_ACTIVE) && (env->pstate & PSTATE_SS)) { 12039 DP_TBFLAG_ANY(flags, PSTATE__SS, 1); 12040 } 12041 12042 *pflags = flags.flags; 12043 *cs_base = flags.flags2; 12044 } 12045 12046 #ifdef TARGET_AARCH64 12047 /* 12048 * The manual says that when SVE is enabled and VQ is widened the 12049 * implementation is allowed to zero the previously inaccessible 12050 * portion of the registers. The corollary to that is that when 12051 * SVE is enabled and VQ is narrowed we are also allowed to zero 12052 * the now inaccessible portion of the registers. 12053 * 12054 * The intent of this is that no predicate bit beyond VQ is ever set. 12055 * Which means that some operations on predicate registers themselves 12056 * may operate on full uint64_t or even unrolled across the maximum 12057 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 12058 * may well be cheaper than conditionals to restrict the operation 12059 * to the relevant portion of a uint16_t[16]. 12060 */ 12061 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 12062 { 12063 int i, j; 12064 uint64_t pmask; 12065 12066 assert(vq >= 1 && vq <= ARM_MAX_VQ); 12067 assert(vq <= env_archcpu(env)->sve_max_vq); 12068 12069 /* Zap the high bits of the zregs. */ 12070 for (i = 0; i < 32; i++) { 12071 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 12072 } 12073 12074 /* Zap the high bits of the pregs and ffr. */ 12075 pmask = 0; 12076 if (vq & 3) { 12077 pmask = ~(-1ULL << (16 * (vq & 3))); 12078 } 12079 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 12080 for (i = 0; i < 17; ++i) { 12081 env->vfp.pregs[i].p[j] &= pmask; 12082 } 12083 pmask = 0; 12084 } 12085 } 12086 12087 static uint32_t sve_vqm1_for_el_sm_ena(CPUARMState *env, int el, bool sm) 12088 { 12089 int exc_el; 12090 12091 if (sm) { 12092 exc_el = sme_exception_el(env, el); 12093 } else { 12094 exc_el = sve_exception_el(env, el); 12095 } 12096 if (exc_el) { 12097 return 0; /* disabled */ 12098 } 12099 return sve_vqm1_for_el_sm(env, el, sm); 12100 } 12101 12102 /* 12103 * Notice a change in SVE vector size when changing EL. 12104 */ 12105 void aarch64_sve_change_el(CPUARMState *env, int old_el, 12106 int new_el, bool el0_a64) 12107 { 12108 ARMCPU *cpu = env_archcpu(env); 12109 int old_len, new_len; 12110 bool old_a64, new_a64, sm; 12111 12112 /* Nothing to do if no SVE. */ 12113 if (!cpu_isar_feature(aa64_sve, cpu)) { 12114 return; 12115 } 12116 12117 /* Nothing to do if FP is disabled in either EL. */ 12118 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 12119 return; 12120 } 12121 12122 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 12123 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 12124 12125 /* 12126 * Both AArch64.TakeException and AArch64.ExceptionReturn 12127 * invoke ResetSVEState when taking an exception from, or 12128 * returning to, AArch32 state when PSTATE.SM is enabled. 12129 */ 12130 sm = FIELD_EX64(env->svcr, SVCR, SM); 12131 if (old_a64 != new_a64 && sm) { 12132 arm_reset_sve_state(env); 12133 return; 12134 } 12135 12136 /* 12137 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 12138 * at ELx, or not available because the EL is in AArch32 state, then 12139 * for all purposes other than a direct read, the ZCR_ELx.LEN field 12140 * has an effective value of 0". 12141 * 12142 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 12143 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 12144 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 12145 * we already have the correct register contents when encountering the 12146 * vq0->vq0 transition between EL0->EL1. 12147 */ 12148 old_len = new_len = 0; 12149 if (old_a64) { 12150 old_len = sve_vqm1_for_el_sm_ena(env, old_el, sm); 12151 } 12152 if (new_a64) { 12153 new_len = sve_vqm1_for_el_sm_ena(env, new_el, sm); 12154 } 12155 12156 /* When changing vector length, clear inaccessible state. */ 12157 if (new_len < old_len) { 12158 aarch64_sve_narrow_vq(env, new_len + 1); 12159 } 12160 } 12161 #endif 12162