xref: /openbmc/qemu/target/arm/helper.c (revision d5938f29fea29581725426f203a74da746ca03e7)
1 /*
2  * ARM generic helpers.
3  *
4  * This code is licensed under the GNU GPL v2 or later.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/units.h"
11 #include "target/arm/idau.h"
12 #include "trace.h"
13 #include "cpu.h"
14 #include "internals.h"
15 #include "exec/gdbstub.h"
16 #include "exec/helper-proto.h"
17 #include "qemu/host-utils.h"
18 #include "qemu/main-loop.h"
19 #include "qemu/bitops.h"
20 #include "qemu/crc32c.h"
21 #include "qemu/qemu-print.h"
22 #include "exec/exec-all.h"
23 #include <zlib.h> /* For crc32 */
24 #include "hw/irq.h"
25 #include "hw/semihosting/semihost.h"
26 #include "sysemu/cpus.h"
27 #include "sysemu/kvm.h"
28 #include "qemu/range.h"
29 #include "qapi/qapi-commands-machine-target.h"
30 #include "qapi/error.h"
31 #include "qemu/guest-random.h"
32 #ifdef CONFIG_TCG
33 #include "arm_ldst.h"
34 #include "exec/cpu_ldst.h"
35 #endif
36 
37 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
38 
39 #ifndef CONFIG_USER_ONLY
40 
41 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
42                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
43                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
44                                target_ulong *page_size_ptr,
45                                ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
46 #endif
47 
48 static void switch_mode(CPUARMState *env, int mode);
49 
50 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
51 {
52     int nregs;
53 
54     /* VFP data registers are always little-endian.  */
55     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
56     if (reg < nregs) {
57         stq_le_p(buf, *aa32_vfp_dreg(env, reg));
58         return 8;
59     }
60     if (arm_feature(env, ARM_FEATURE_NEON)) {
61         /* Aliases for Q regs.  */
62         nregs += 16;
63         if (reg < nregs) {
64             uint64_t *q = aa32_vfp_qreg(env, reg - 32);
65             stq_le_p(buf, q[0]);
66             stq_le_p(buf + 8, q[1]);
67             return 16;
68         }
69     }
70     switch (reg - nregs) {
71     case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
72     case 1: stl_p(buf, vfp_get_fpscr(env)); return 4;
73     case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
74     }
75     return 0;
76 }
77 
78 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
79 {
80     int nregs;
81 
82     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
83     if (reg < nregs) {
84         *aa32_vfp_dreg(env, reg) = ldq_le_p(buf);
85         return 8;
86     }
87     if (arm_feature(env, ARM_FEATURE_NEON)) {
88         nregs += 16;
89         if (reg < nregs) {
90             uint64_t *q = aa32_vfp_qreg(env, reg - 32);
91             q[0] = ldq_le_p(buf);
92             q[1] = ldq_le_p(buf + 8);
93             return 16;
94         }
95     }
96     switch (reg - nregs) {
97     case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
98     case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4;
99     case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
100     }
101     return 0;
102 }
103 
104 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
105 {
106     switch (reg) {
107     case 0 ... 31:
108         /* 128 bit FP register */
109         {
110             uint64_t *q = aa64_vfp_qreg(env, reg);
111             stq_le_p(buf, q[0]);
112             stq_le_p(buf + 8, q[1]);
113             return 16;
114         }
115     case 32:
116         /* FPSR */
117         stl_p(buf, vfp_get_fpsr(env));
118         return 4;
119     case 33:
120         /* FPCR */
121         stl_p(buf, vfp_get_fpcr(env));
122         return 4;
123     default:
124         return 0;
125     }
126 }
127 
128 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
129 {
130     switch (reg) {
131     case 0 ... 31:
132         /* 128 bit FP register */
133         {
134             uint64_t *q = aa64_vfp_qreg(env, reg);
135             q[0] = ldq_le_p(buf);
136             q[1] = ldq_le_p(buf + 8);
137             return 16;
138         }
139     case 32:
140         /* FPSR */
141         vfp_set_fpsr(env, ldl_p(buf));
142         return 4;
143     case 33:
144         /* FPCR */
145         vfp_set_fpcr(env, ldl_p(buf));
146         return 4;
147     default:
148         return 0;
149     }
150 }
151 
152 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
153 {
154     assert(ri->fieldoffset);
155     if (cpreg_field_is_64bit(ri)) {
156         return CPREG_FIELD64(env, ri);
157     } else {
158         return CPREG_FIELD32(env, ri);
159     }
160 }
161 
162 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
163                       uint64_t value)
164 {
165     assert(ri->fieldoffset);
166     if (cpreg_field_is_64bit(ri)) {
167         CPREG_FIELD64(env, ri) = value;
168     } else {
169         CPREG_FIELD32(env, ri) = value;
170     }
171 }
172 
173 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
174 {
175     return (char *)env + ri->fieldoffset;
176 }
177 
178 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
179 {
180     /* Raw read of a coprocessor register (as needed for migration, etc). */
181     if (ri->type & ARM_CP_CONST) {
182         return ri->resetvalue;
183     } else if (ri->raw_readfn) {
184         return ri->raw_readfn(env, ri);
185     } else if (ri->readfn) {
186         return ri->readfn(env, ri);
187     } else {
188         return raw_read(env, ri);
189     }
190 }
191 
192 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
193                              uint64_t v)
194 {
195     /* Raw write of a coprocessor register (as needed for migration, etc).
196      * Note that constant registers are treated as write-ignored; the
197      * caller should check for success by whether a readback gives the
198      * value written.
199      */
200     if (ri->type & ARM_CP_CONST) {
201         return;
202     } else if (ri->raw_writefn) {
203         ri->raw_writefn(env, ri, v);
204     } else if (ri->writefn) {
205         ri->writefn(env, ri, v);
206     } else {
207         raw_write(env, ri, v);
208     }
209 }
210 
211 static int arm_gdb_get_sysreg(CPUARMState *env, uint8_t *buf, int reg)
212 {
213     ARMCPU *cpu = env_archcpu(env);
214     const ARMCPRegInfo *ri;
215     uint32_t key;
216 
217     key = cpu->dyn_xml.cpregs_keys[reg];
218     ri = get_arm_cp_reginfo(cpu->cp_regs, key);
219     if (ri) {
220         if (cpreg_field_is_64bit(ri)) {
221             return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri));
222         } else {
223             return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri));
224         }
225     }
226     return 0;
227 }
228 
229 static int arm_gdb_set_sysreg(CPUARMState *env, uint8_t *buf, int reg)
230 {
231     return 0;
232 }
233 
234 static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
235 {
236    /* Return true if the regdef would cause an assertion if you called
237     * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
238     * program bug for it not to have the NO_RAW flag).
239     * NB that returning false here doesn't necessarily mean that calling
240     * read/write_raw_cp_reg() is safe, because we can't distinguish "has
241     * read/write access functions which are safe for raw use" from "has
242     * read/write access functions which have side effects but has forgotten
243     * to provide raw access functions".
244     * The tests here line up with the conditions in read/write_raw_cp_reg()
245     * and assertions in raw_read()/raw_write().
246     */
247     if ((ri->type & ARM_CP_CONST) ||
248         ri->fieldoffset ||
249         ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
250         return false;
251     }
252     return true;
253 }
254 
255 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
256 {
257     /* Write the coprocessor state from cpu->env to the (index,value) list. */
258     int i;
259     bool ok = true;
260 
261     for (i = 0; i < cpu->cpreg_array_len; i++) {
262         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
263         const ARMCPRegInfo *ri;
264         uint64_t newval;
265 
266         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
267         if (!ri) {
268             ok = false;
269             continue;
270         }
271         if (ri->type & ARM_CP_NO_RAW) {
272             continue;
273         }
274 
275         newval = read_raw_cp_reg(&cpu->env, ri);
276         if (kvm_sync) {
277             /*
278              * Only sync if the previous list->cpustate sync succeeded.
279              * Rather than tracking the success/failure state for every
280              * item in the list, we just recheck "does the raw write we must
281              * have made in write_list_to_cpustate() read back OK" here.
282              */
283             uint64_t oldval = cpu->cpreg_values[i];
284 
285             if (oldval == newval) {
286                 continue;
287             }
288 
289             write_raw_cp_reg(&cpu->env, ri, oldval);
290             if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
291                 continue;
292             }
293 
294             write_raw_cp_reg(&cpu->env, ri, newval);
295         }
296         cpu->cpreg_values[i] = newval;
297     }
298     return ok;
299 }
300 
301 bool write_list_to_cpustate(ARMCPU *cpu)
302 {
303     int i;
304     bool ok = true;
305 
306     for (i = 0; i < cpu->cpreg_array_len; i++) {
307         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
308         uint64_t v = cpu->cpreg_values[i];
309         const ARMCPRegInfo *ri;
310 
311         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
312         if (!ri) {
313             ok = false;
314             continue;
315         }
316         if (ri->type & ARM_CP_NO_RAW) {
317             continue;
318         }
319         /* Write value and confirm it reads back as written
320          * (to catch read-only registers and partially read-only
321          * registers where the incoming migration value doesn't match)
322          */
323         write_raw_cp_reg(&cpu->env, ri, v);
324         if (read_raw_cp_reg(&cpu->env, ri) != v) {
325             ok = false;
326         }
327     }
328     return ok;
329 }
330 
331 static void add_cpreg_to_list(gpointer key, gpointer opaque)
332 {
333     ARMCPU *cpu = opaque;
334     uint64_t regidx;
335     const ARMCPRegInfo *ri;
336 
337     regidx = *(uint32_t *)key;
338     ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
339 
340     if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
341         cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
342         /* The value array need not be initialized at this point */
343         cpu->cpreg_array_len++;
344     }
345 }
346 
347 static void count_cpreg(gpointer key, gpointer opaque)
348 {
349     ARMCPU *cpu = opaque;
350     uint64_t regidx;
351     const ARMCPRegInfo *ri;
352 
353     regidx = *(uint32_t *)key;
354     ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
355 
356     if (!(ri->type & (ARM_CP_NO_RAW|ARM_CP_ALIAS))) {
357         cpu->cpreg_array_len++;
358     }
359 }
360 
361 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
362 {
363     uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
364     uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
365 
366     if (aidx > bidx) {
367         return 1;
368     }
369     if (aidx < bidx) {
370         return -1;
371     }
372     return 0;
373 }
374 
375 void init_cpreg_list(ARMCPU *cpu)
376 {
377     /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
378      * Note that we require cpreg_tuples[] to be sorted by key ID.
379      */
380     GList *keys;
381     int arraylen;
382 
383     keys = g_hash_table_get_keys(cpu->cp_regs);
384     keys = g_list_sort(keys, cpreg_key_compare);
385 
386     cpu->cpreg_array_len = 0;
387 
388     g_list_foreach(keys, count_cpreg, cpu);
389 
390     arraylen = cpu->cpreg_array_len;
391     cpu->cpreg_indexes = g_new(uint64_t, arraylen);
392     cpu->cpreg_values = g_new(uint64_t, arraylen);
393     cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
394     cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
395     cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
396     cpu->cpreg_array_len = 0;
397 
398     g_list_foreach(keys, add_cpreg_to_list, cpu);
399 
400     assert(cpu->cpreg_array_len == arraylen);
401 
402     g_list_free(keys);
403 }
404 
405 /*
406  * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but
407  * they are accessible when EL3 is using AArch64 regardless of EL3.NS.
408  *
409  * access_el3_aa32ns: Used to check AArch32 register views.
410  * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views.
411  */
412 static CPAccessResult access_el3_aa32ns(CPUARMState *env,
413                                         const ARMCPRegInfo *ri,
414                                         bool isread)
415 {
416     bool secure = arm_is_secure_below_el3(env);
417 
418     assert(!arm_el_is_aa64(env, 3));
419     if (secure) {
420         return CP_ACCESS_TRAP_UNCATEGORIZED;
421     }
422     return CP_ACCESS_OK;
423 }
424 
425 static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env,
426                                                 const ARMCPRegInfo *ri,
427                                                 bool isread)
428 {
429     if (!arm_el_is_aa64(env, 3)) {
430         return access_el3_aa32ns(env, ri, isread);
431     }
432     return CP_ACCESS_OK;
433 }
434 
435 /* Some secure-only AArch32 registers trap to EL3 if used from
436  * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).
437  * Note that an access from Secure EL1 can only happen if EL3 is AArch64.
438  * We assume that the .access field is set to PL1_RW.
439  */
440 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
441                                             const ARMCPRegInfo *ri,
442                                             bool isread)
443 {
444     if (arm_current_el(env) == 3) {
445         return CP_ACCESS_OK;
446     }
447     if (arm_is_secure_below_el3(env)) {
448         return CP_ACCESS_TRAP_EL3;
449     }
450     /* This will be EL1 NS and EL2 NS, which just UNDEF */
451     return CP_ACCESS_TRAP_UNCATEGORIZED;
452 }
453 
454 /* Check for traps to "powerdown debug" registers, which are controlled
455  * by MDCR.TDOSA
456  */
457 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
458                                    bool isread)
459 {
460     int el = arm_current_el(env);
461     bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) ||
462         (env->cp15.mdcr_el2 & MDCR_TDE) ||
463         (arm_hcr_el2_eff(env) & HCR_TGE);
464 
465     if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) {
466         return CP_ACCESS_TRAP_EL2;
467     }
468     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
469         return CP_ACCESS_TRAP_EL3;
470     }
471     return CP_ACCESS_OK;
472 }
473 
474 /* Check for traps to "debug ROM" registers, which are controlled
475  * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
476  */
477 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
478                                   bool isread)
479 {
480     int el = arm_current_el(env);
481     bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) ||
482         (env->cp15.mdcr_el2 & MDCR_TDE) ||
483         (arm_hcr_el2_eff(env) & HCR_TGE);
484 
485     if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) {
486         return CP_ACCESS_TRAP_EL2;
487     }
488     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
489         return CP_ACCESS_TRAP_EL3;
490     }
491     return CP_ACCESS_OK;
492 }
493 
494 /* Check for traps to general debug registers, which are controlled
495  * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
496  */
497 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
498                                   bool isread)
499 {
500     int el = arm_current_el(env);
501     bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) ||
502         (env->cp15.mdcr_el2 & MDCR_TDE) ||
503         (arm_hcr_el2_eff(env) & HCR_TGE);
504 
505     if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) {
506         return CP_ACCESS_TRAP_EL2;
507     }
508     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
509         return CP_ACCESS_TRAP_EL3;
510     }
511     return CP_ACCESS_OK;
512 }
513 
514 /* Check for traps to performance monitor registers, which are controlled
515  * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
516  */
517 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
518                                  bool isread)
519 {
520     int el = arm_current_el(env);
521 
522     if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
523         && !arm_is_secure_below_el3(env)) {
524         return CP_ACCESS_TRAP_EL2;
525     }
526     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
527         return CP_ACCESS_TRAP_EL3;
528     }
529     return CP_ACCESS_OK;
530 }
531 
532 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
533 {
534     ARMCPU *cpu = env_archcpu(env);
535 
536     raw_write(env, ri, value);
537     tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */
538 }
539 
540 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
541 {
542     ARMCPU *cpu = env_archcpu(env);
543 
544     if (raw_read(env, ri) != value) {
545         /* Unlike real hardware the qemu TLB uses virtual addresses,
546          * not modified virtual addresses, so this causes a TLB flush.
547          */
548         tlb_flush(CPU(cpu));
549         raw_write(env, ri, value);
550     }
551 }
552 
553 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
554                              uint64_t value)
555 {
556     ARMCPU *cpu = env_archcpu(env);
557 
558     if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
559         && !extended_addresses_enabled(env)) {
560         /* For VMSA (when not using the LPAE long descriptor page table
561          * format) this register includes the ASID, so do a TLB flush.
562          * For PMSA it is purely a process ID and no action is needed.
563          */
564         tlb_flush(CPU(cpu));
565     }
566     raw_write(env, ri, value);
567 }
568 
569 /* IS variants of TLB operations must affect all cores */
570 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
571                              uint64_t value)
572 {
573     CPUState *cs = env_cpu(env);
574 
575     tlb_flush_all_cpus_synced(cs);
576 }
577 
578 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
579                              uint64_t value)
580 {
581     CPUState *cs = env_cpu(env);
582 
583     tlb_flush_all_cpus_synced(cs);
584 }
585 
586 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
587                              uint64_t value)
588 {
589     CPUState *cs = env_cpu(env);
590 
591     tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
592 }
593 
594 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
595                              uint64_t value)
596 {
597     CPUState *cs = env_cpu(env);
598 
599     tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
600 }
601 
602 /*
603  * Non-IS variants of TLB operations are upgraded to
604  * IS versions if we are at NS EL1 and HCR_EL2.FB is set to
605  * force broadcast of these operations.
606  */
607 static bool tlb_force_broadcast(CPUARMState *env)
608 {
609     return (env->cp15.hcr_el2 & HCR_FB) &&
610         arm_current_el(env) == 1 && arm_is_secure_below_el3(env);
611 }
612 
613 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
614                           uint64_t value)
615 {
616     /* Invalidate all (TLBIALL) */
617     ARMCPU *cpu = env_archcpu(env);
618 
619     if (tlb_force_broadcast(env)) {
620         tlbiall_is_write(env, NULL, value);
621         return;
622     }
623 
624     tlb_flush(CPU(cpu));
625 }
626 
627 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
628                           uint64_t value)
629 {
630     /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
631     ARMCPU *cpu = env_archcpu(env);
632 
633     if (tlb_force_broadcast(env)) {
634         tlbimva_is_write(env, NULL, value);
635         return;
636     }
637 
638     tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
639 }
640 
641 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
642                            uint64_t value)
643 {
644     /* Invalidate by ASID (TLBIASID) */
645     ARMCPU *cpu = env_archcpu(env);
646 
647     if (tlb_force_broadcast(env)) {
648         tlbiasid_is_write(env, NULL, value);
649         return;
650     }
651 
652     tlb_flush(CPU(cpu));
653 }
654 
655 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
656                            uint64_t value)
657 {
658     /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
659     ARMCPU *cpu = env_archcpu(env);
660 
661     if (tlb_force_broadcast(env)) {
662         tlbimvaa_is_write(env, NULL, value);
663         return;
664     }
665 
666     tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
667 }
668 
669 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
670                                uint64_t value)
671 {
672     CPUState *cs = env_cpu(env);
673 
674     tlb_flush_by_mmuidx(cs,
675                         ARMMMUIdxBit_S12NSE1 |
676                         ARMMMUIdxBit_S12NSE0 |
677                         ARMMMUIdxBit_S2NS);
678 }
679 
680 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
681                                   uint64_t value)
682 {
683     CPUState *cs = env_cpu(env);
684 
685     tlb_flush_by_mmuidx_all_cpus_synced(cs,
686                                         ARMMMUIdxBit_S12NSE1 |
687                                         ARMMMUIdxBit_S12NSE0 |
688                                         ARMMMUIdxBit_S2NS);
689 }
690 
691 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
692                             uint64_t value)
693 {
694     /* Invalidate by IPA. This has to invalidate any structures that
695      * contain only stage 2 translation information, but does not need
696      * to apply to structures that contain combined stage 1 and stage 2
697      * translation information.
698      * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
699      */
700     CPUState *cs = env_cpu(env);
701     uint64_t pageaddr;
702 
703     if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
704         return;
705     }
706 
707     pageaddr = sextract64(value << 12, 0, 40);
708 
709     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
710 }
711 
712 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
713                                uint64_t value)
714 {
715     CPUState *cs = env_cpu(env);
716     uint64_t pageaddr;
717 
718     if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
719         return;
720     }
721 
722     pageaddr = sextract64(value << 12, 0, 40);
723 
724     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
725                                              ARMMMUIdxBit_S2NS);
726 }
727 
728 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
729                               uint64_t value)
730 {
731     CPUState *cs = env_cpu(env);
732 
733     tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
734 }
735 
736 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
737                                  uint64_t value)
738 {
739     CPUState *cs = env_cpu(env);
740 
741     tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
742 }
743 
744 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
745                               uint64_t value)
746 {
747     CPUState *cs = env_cpu(env);
748     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
749 
750     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
751 }
752 
753 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
754                                  uint64_t value)
755 {
756     CPUState *cs = env_cpu(env);
757     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
758 
759     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
760                                              ARMMMUIdxBit_S1E2);
761 }
762 
763 static const ARMCPRegInfo cp_reginfo[] = {
764     /* Define the secure and non-secure FCSE identifier CP registers
765      * separately because there is no secure bank in V8 (no _EL3).  This allows
766      * the secure register to be properly reset and migrated. There is also no
767      * v8 EL1 version of the register so the non-secure instance stands alone.
768      */
769     { .name = "FCSEIDR",
770       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
771       .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
772       .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
773       .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
774     { .name = "FCSEIDR_S",
775       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
776       .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
777       .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
778       .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
779     /* Define the secure and non-secure context identifier CP registers
780      * separately because there is no secure bank in V8 (no _EL3).  This allows
781      * the secure register to be properly reset and migrated.  In the
782      * non-secure case, the 32-bit register will have reset and migration
783      * disabled during registration as it is handled by the 64-bit instance.
784      */
785     { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
786       .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
787       .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
788       .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
789       .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
790     { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32,
791       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
792       .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
793       .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
794       .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
795     REGINFO_SENTINEL
796 };
797 
798 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
799     /* NB: Some of these registers exist in v8 but with more precise
800      * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
801      */
802     /* MMU Domain access control / MPU write buffer control */
803     { .name = "DACR",
804       .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
805       .access = PL1_RW, .resetvalue = 0,
806       .writefn = dacr_write, .raw_writefn = raw_write,
807       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
808                              offsetoflow32(CPUARMState, cp15.dacr_ns) } },
809     /* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
810      * For v6 and v5, these mappings are overly broad.
811      */
812     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
813       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
814     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
815       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
816     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
817       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
818     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
819       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
820     /* Cache maintenance ops; some of this space may be overridden later. */
821     { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
822       .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
823       .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
824     REGINFO_SENTINEL
825 };
826 
827 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
828     /* Not all pre-v6 cores implemented this WFI, so this is slightly
829      * over-broad.
830      */
831     { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
832       .access = PL1_W, .type = ARM_CP_WFI },
833     REGINFO_SENTINEL
834 };
835 
836 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
837     /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
838      * is UNPREDICTABLE; we choose to NOP as most implementations do).
839      */
840     { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
841       .access = PL1_W, .type = ARM_CP_WFI },
842     /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
843      * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
844      * OMAPCP will override this space.
845      */
846     { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
847       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
848       .resetvalue = 0 },
849     { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
850       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
851       .resetvalue = 0 },
852     /* v6 doesn't have the cache ID registers but Linux reads them anyway */
853     { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
854       .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
855       .resetvalue = 0 },
856     /* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
857      * implementing it as RAZ means the "debug architecture version" bits
858      * will read as a reserved value, which should cause Linux to not try
859      * to use the debug hardware.
860      */
861     { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
862       .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
863     /* MMU TLB control. Note that the wildcarding means we cover not just
864      * the unified TLB ops but also the dside/iside/inner-shareable variants.
865      */
866     { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
867       .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
868       .type = ARM_CP_NO_RAW },
869     { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
870       .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
871       .type = ARM_CP_NO_RAW },
872     { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
873       .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
874       .type = ARM_CP_NO_RAW },
875     { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
876       .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
877       .type = ARM_CP_NO_RAW },
878     { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
879       .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
880     { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
881       .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
882     REGINFO_SENTINEL
883 };
884 
885 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
886                         uint64_t value)
887 {
888     uint32_t mask = 0;
889 
890     /* In ARMv8 most bits of CPACR_EL1 are RES0. */
891     if (!arm_feature(env, ARM_FEATURE_V8)) {
892         /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
893          * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
894          * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
895          */
896         if (arm_feature(env, ARM_FEATURE_VFP)) {
897             /* VFP coprocessor: cp10 & cp11 [23:20] */
898             mask |= (1 << 31) | (1 << 30) | (0xf << 20);
899 
900             if (!arm_feature(env, ARM_FEATURE_NEON)) {
901                 /* ASEDIS [31] bit is RAO/WI */
902                 value |= (1 << 31);
903             }
904 
905             /* VFPv3 and upwards with NEON implement 32 double precision
906              * registers (D0-D31).
907              */
908             if (!arm_feature(env, ARM_FEATURE_NEON) ||
909                     !arm_feature(env, ARM_FEATURE_VFP3)) {
910                 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
911                 value |= (1 << 30);
912             }
913         }
914         value &= mask;
915     }
916 
917     /*
918      * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
919      * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
920      */
921     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
922         !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
923         value &= ~(0xf << 20);
924         value |= env->cp15.cpacr_el1 & (0xf << 20);
925     }
926 
927     env->cp15.cpacr_el1 = value;
928 }
929 
930 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri)
931 {
932     /*
933      * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
934      * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
935      */
936     uint64_t value = env->cp15.cpacr_el1;
937 
938     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
939         !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
940         value &= ~(0xf << 20);
941     }
942     return value;
943 }
944 
945 
946 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
947 {
948     /* Call cpacr_write() so that we reset with the correct RAO bits set
949      * for our CPU features.
950      */
951     cpacr_write(env, ri, 0);
952 }
953 
954 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
955                                    bool isread)
956 {
957     if (arm_feature(env, ARM_FEATURE_V8)) {
958         /* Check if CPACR accesses are to be trapped to EL2 */
959         if (arm_current_el(env) == 1 &&
960             (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
961             return CP_ACCESS_TRAP_EL2;
962         /* Check if CPACR accesses are to be trapped to EL3 */
963         } else if (arm_current_el(env) < 3 &&
964                    (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
965             return CP_ACCESS_TRAP_EL3;
966         }
967     }
968 
969     return CP_ACCESS_OK;
970 }
971 
972 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri,
973                                   bool isread)
974 {
975     /* Check if CPTR accesses are set to trap to EL3 */
976     if (arm_current_el(env) == 2 && (env->cp15.cptr_el[3] & CPTR_TCPAC)) {
977         return CP_ACCESS_TRAP_EL3;
978     }
979 
980     return CP_ACCESS_OK;
981 }
982 
983 static const ARMCPRegInfo v6_cp_reginfo[] = {
984     /* prefetch by MVA in v6, NOP in v7 */
985     { .name = "MVA_prefetch",
986       .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
987       .access = PL1_W, .type = ARM_CP_NOP },
988     /* We need to break the TB after ISB to execute self-modifying code
989      * correctly and also to take any pending interrupts immediately.
990      * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag.
991      */
992     { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
993       .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore },
994     { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
995       .access = PL0_W, .type = ARM_CP_NOP },
996     { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
997       .access = PL0_W, .type = ARM_CP_NOP },
998     { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
999       .access = PL1_RW,
1000       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
1001                              offsetof(CPUARMState, cp15.ifar_ns) },
1002       .resetvalue = 0, },
1003     /* Watchpoint Fault Address Register : should actually only be present
1004      * for 1136, 1176, 11MPCore.
1005      */
1006     { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
1007       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
1008     { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
1009       .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
1010       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
1011       .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
1012     REGINFO_SENTINEL
1013 };
1014 
1015 /* Definitions for the PMU registers */
1016 #define PMCRN_MASK  0xf800
1017 #define PMCRN_SHIFT 11
1018 #define PMCRLC  0x40
1019 #define PMCRDP  0x10
1020 #define PMCRD   0x8
1021 #define PMCRC   0x4
1022 #define PMCRP   0x2
1023 #define PMCRE   0x1
1024 
1025 #define PMXEVTYPER_P          0x80000000
1026 #define PMXEVTYPER_U          0x40000000
1027 #define PMXEVTYPER_NSK        0x20000000
1028 #define PMXEVTYPER_NSU        0x10000000
1029 #define PMXEVTYPER_NSH        0x08000000
1030 #define PMXEVTYPER_M          0x04000000
1031 #define PMXEVTYPER_MT         0x02000000
1032 #define PMXEVTYPER_EVTCOUNT   0x0000ffff
1033 #define PMXEVTYPER_MASK       (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \
1034                                PMXEVTYPER_NSU | PMXEVTYPER_NSH | \
1035                                PMXEVTYPER_M | PMXEVTYPER_MT | \
1036                                PMXEVTYPER_EVTCOUNT)
1037 
1038 #define PMCCFILTR             0xf8000000
1039 #define PMCCFILTR_M           PMXEVTYPER_M
1040 #define PMCCFILTR_EL0         (PMCCFILTR | PMCCFILTR_M)
1041 
1042 static inline uint32_t pmu_num_counters(CPUARMState *env)
1043 {
1044   return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
1045 }
1046 
1047 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
1048 static inline uint64_t pmu_counter_mask(CPUARMState *env)
1049 {
1050   return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
1051 }
1052 
1053 typedef struct pm_event {
1054     uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */
1055     /* If the event is supported on this CPU (used to generate PMCEID[01]) */
1056     bool (*supported)(CPUARMState *);
1057     /*
1058      * Retrieve the current count of the underlying event. The programmed
1059      * counters hold a difference from the return value from this function
1060      */
1061     uint64_t (*get_count)(CPUARMState *);
1062     /*
1063      * Return how many nanoseconds it will take (at a minimum) for count events
1064      * to occur. A negative value indicates the counter will never overflow, or
1065      * that the counter has otherwise arranged for the overflow bit to be set
1066      * and the PMU interrupt to be raised on overflow.
1067      */
1068     int64_t (*ns_per_count)(uint64_t);
1069 } pm_event;
1070 
1071 static bool event_always_supported(CPUARMState *env)
1072 {
1073     return true;
1074 }
1075 
1076 static uint64_t swinc_get_count(CPUARMState *env)
1077 {
1078     /*
1079      * SW_INCR events are written directly to the pmevcntr's by writes to
1080      * PMSWINC, so there is no underlying count maintained by the PMU itself
1081      */
1082     return 0;
1083 }
1084 
1085 static int64_t swinc_ns_per(uint64_t ignored)
1086 {
1087     return -1;
1088 }
1089 
1090 /*
1091  * Return the underlying cycle count for the PMU cycle counters. If we're in
1092  * usermode, simply return 0.
1093  */
1094 static uint64_t cycles_get_count(CPUARMState *env)
1095 {
1096 #ifndef CONFIG_USER_ONLY
1097     return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
1098                    ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
1099 #else
1100     return cpu_get_host_ticks();
1101 #endif
1102 }
1103 
1104 #ifndef CONFIG_USER_ONLY
1105 static int64_t cycles_ns_per(uint64_t cycles)
1106 {
1107     return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles;
1108 }
1109 
1110 static bool instructions_supported(CPUARMState *env)
1111 {
1112     return use_icount == 1 /* Precise instruction counting */;
1113 }
1114 
1115 static uint64_t instructions_get_count(CPUARMState *env)
1116 {
1117     return (uint64_t)cpu_get_icount_raw();
1118 }
1119 
1120 static int64_t instructions_ns_per(uint64_t icount)
1121 {
1122     return cpu_icount_to_ns((int64_t)icount);
1123 }
1124 #endif
1125 
1126 static const pm_event pm_events[] = {
1127     { .number = 0x000, /* SW_INCR */
1128       .supported = event_always_supported,
1129       .get_count = swinc_get_count,
1130       .ns_per_count = swinc_ns_per,
1131     },
1132 #ifndef CONFIG_USER_ONLY
1133     { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */
1134       .supported = instructions_supported,
1135       .get_count = instructions_get_count,
1136       .ns_per_count = instructions_ns_per,
1137     },
1138     { .number = 0x011, /* CPU_CYCLES, Cycle */
1139       .supported = event_always_supported,
1140       .get_count = cycles_get_count,
1141       .ns_per_count = cycles_ns_per,
1142     }
1143 #endif
1144 };
1145 
1146 /*
1147  * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of
1148  * events (i.e. the statistical profiling extension), this implementation
1149  * should first be updated to something sparse instead of the current
1150  * supported_event_map[] array.
1151  */
1152 #define MAX_EVENT_ID 0x11
1153 #define UNSUPPORTED_EVENT UINT16_MAX
1154 static uint16_t supported_event_map[MAX_EVENT_ID + 1];
1155 
1156 /*
1157  * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map
1158  * of ARM event numbers to indices in our pm_events array.
1159  *
1160  * Note: Events in the 0x40XX range are not currently supported.
1161  */
1162 void pmu_init(ARMCPU *cpu)
1163 {
1164     unsigned int i;
1165 
1166     /*
1167      * Empty supported_event_map and cpu->pmceid[01] before adding supported
1168      * events to them
1169      */
1170     for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) {
1171         supported_event_map[i] = UNSUPPORTED_EVENT;
1172     }
1173     cpu->pmceid0 = 0;
1174     cpu->pmceid1 = 0;
1175 
1176     for (i = 0; i < ARRAY_SIZE(pm_events); i++) {
1177         const pm_event *cnt = &pm_events[i];
1178         assert(cnt->number <= MAX_EVENT_ID);
1179         /* We do not currently support events in the 0x40xx range */
1180         assert(cnt->number <= 0x3f);
1181 
1182         if (cnt->supported(&cpu->env)) {
1183             supported_event_map[cnt->number] = i;
1184             uint64_t event_mask = 1ULL << (cnt->number & 0x1f);
1185             if (cnt->number & 0x20) {
1186                 cpu->pmceid1 |= event_mask;
1187             } else {
1188                 cpu->pmceid0 |= event_mask;
1189             }
1190         }
1191     }
1192 }
1193 
1194 /*
1195  * Check at runtime whether a PMU event is supported for the current machine
1196  */
1197 static bool event_supported(uint16_t number)
1198 {
1199     if (number > MAX_EVENT_ID) {
1200         return false;
1201     }
1202     return supported_event_map[number] != UNSUPPORTED_EVENT;
1203 }
1204 
1205 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
1206                                    bool isread)
1207 {
1208     /* Performance monitor registers user accessibility is controlled
1209      * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
1210      * trapping to EL2 or EL3 for other accesses.
1211      */
1212     int el = arm_current_el(env);
1213 
1214     if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
1215         return CP_ACCESS_TRAP;
1216     }
1217     if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
1218         && !arm_is_secure_below_el3(env)) {
1219         return CP_ACCESS_TRAP_EL2;
1220     }
1221     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
1222         return CP_ACCESS_TRAP_EL3;
1223     }
1224 
1225     return CP_ACCESS_OK;
1226 }
1227 
1228 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env,
1229                                            const ARMCPRegInfo *ri,
1230                                            bool isread)
1231 {
1232     /* ER: event counter read trap control */
1233     if (arm_feature(env, ARM_FEATURE_V8)
1234         && arm_current_el(env) == 0
1235         && (env->cp15.c9_pmuserenr & (1 << 3)) != 0
1236         && isread) {
1237         return CP_ACCESS_OK;
1238     }
1239 
1240     return pmreg_access(env, ri, isread);
1241 }
1242 
1243 static CPAccessResult pmreg_access_swinc(CPUARMState *env,
1244                                          const ARMCPRegInfo *ri,
1245                                          bool isread)
1246 {
1247     /* SW: software increment write trap control */
1248     if (arm_feature(env, ARM_FEATURE_V8)
1249         && arm_current_el(env) == 0
1250         && (env->cp15.c9_pmuserenr & (1 << 1)) != 0
1251         && !isread) {
1252         return CP_ACCESS_OK;
1253     }
1254 
1255     return pmreg_access(env, ri, isread);
1256 }
1257 
1258 static CPAccessResult pmreg_access_selr(CPUARMState *env,
1259                                         const ARMCPRegInfo *ri,
1260                                         bool isread)
1261 {
1262     /* ER: event counter read trap control */
1263     if (arm_feature(env, ARM_FEATURE_V8)
1264         && arm_current_el(env) == 0
1265         && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) {
1266         return CP_ACCESS_OK;
1267     }
1268 
1269     return pmreg_access(env, ri, isread);
1270 }
1271 
1272 static CPAccessResult pmreg_access_ccntr(CPUARMState *env,
1273                                          const ARMCPRegInfo *ri,
1274                                          bool isread)
1275 {
1276     /* CR: cycle counter read trap control */
1277     if (arm_feature(env, ARM_FEATURE_V8)
1278         && arm_current_el(env) == 0
1279         && (env->cp15.c9_pmuserenr & (1 << 2)) != 0
1280         && isread) {
1281         return CP_ACCESS_OK;
1282     }
1283 
1284     return pmreg_access(env, ri, isread);
1285 }
1286 
1287 /* Returns true if the counter (pass 31 for PMCCNTR) should count events using
1288  * the current EL, security state, and register configuration.
1289  */
1290 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
1291 {
1292     uint64_t filter;
1293     bool e, p, u, nsk, nsu, nsh, m;
1294     bool enabled, prohibited, filtered;
1295     bool secure = arm_is_secure(env);
1296     int el = arm_current_el(env);
1297     uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
1298 
1299     if (!arm_feature(env, ARM_FEATURE_PMU)) {
1300         return false;
1301     }
1302 
1303     if (!arm_feature(env, ARM_FEATURE_EL2) ||
1304             (counter < hpmn || counter == 31)) {
1305         e = env->cp15.c9_pmcr & PMCRE;
1306     } else {
1307         e = env->cp15.mdcr_el2 & MDCR_HPME;
1308     }
1309     enabled = e && (env->cp15.c9_pmcnten & (1 << counter));
1310 
1311     if (!secure) {
1312         if (el == 2 && (counter < hpmn || counter == 31)) {
1313             prohibited = env->cp15.mdcr_el2 & MDCR_HPMD;
1314         } else {
1315             prohibited = false;
1316         }
1317     } else {
1318         prohibited = arm_feature(env, ARM_FEATURE_EL3) &&
1319            (env->cp15.mdcr_el3 & MDCR_SPME);
1320     }
1321 
1322     if (prohibited && counter == 31) {
1323         prohibited = env->cp15.c9_pmcr & PMCRDP;
1324     }
1325 
1326     if (counter == 31) {
1327         filter = env->cp15.pmccfiltr_el0;
1328     } else {
1329         filter = env->cp15.c14_pmevtyper[counter];
1330     }
1331 
1332     p   = filter & PMXEVTYPER_P;
1333     u   = filter & PMXEVTYPER_U;
1334     nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK);
1335     nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU);
1336     nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH);
1337     m   = arm_el_is_aa64(env, 1) &&
1338               arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M);
1339 
1340     if (el == 0) {
1341         filtered = secure ? u : u != nsu;
1342     } else if (el == 1) {
1343         filtered = secure ? p : p != nsk;
1344     } else if (el == 2) {
1345         filtered = !nsh;
1346     } else { /* EL3 */
1347         filtered = m != p;
1348     }
1349 
1350     if (counter != 31) {
1351         /*
1352          * If not checking PMCCNTR, ensure the counter is setup to an event we
1353          * support
1354          */
1355         uint16_t event = filter & PMXEVTYPER_EVTCOUNT;
1356         if (!event_supported(event)) {
1357             return false;
1358         }
1359     }
1360 
1361     return enabled && !prohibited && !filtered;
1362 }
1363 
1364 static void pmu_update_irq(CPUARMState *env)
1365 {
1366     ARMCPU *cpu = env_archcpu(env);
1367     qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) &&
1368             (env->cp15.c9_pminten & env->cp15.c9_pmovsr));
1369 }
1370 
1371 /*
1372  * Ensure c15_ccnt is the guest-visible count so that operations such as
1373  * enabling/disabling the counter or filtering, modifying the count itself,
1374  * etc. can be done logically. This is essentially a no-op if the counter is
1375  * not enabled at the time of the call.
1376  */
1377 static void pmccntr_op_start(CPUARMState *env)
1378 {
1379     uint64_t cycles = cycles_get_count(env);
1380 
1381     if (pmu_counter_enabled(env, 31)) {
1382         uint64_t eff_cycles = cycles;
1383         if (env->cp15.c9_pmcr & PMCRD) {
1384             /* Increment once every 64 processor clock cycles */
1385             eff_cycles /= 64;
1386         }
1387 
1388         uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta;
1389 
1390         uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \
1391                                  1ull << 63 : 1ull << 31;
1392         if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) {
1393             env->cp15.c9_pmovsr |= (1 << 31);
1394             pmu_update_irq(env);
1395         }
1396 
1397         env->cp15.c15_ccnt = new_pmccntr;
1398     }
1399     env->cp15.c15_ccnt_delta = cycles;
1400 }
1401 
1402 /*
1403  * If PMCCNTR is enabled, recalculate the delta between the clock and the
1404  * guest-visible count. A call to pmccntr_op_finish should follow every call to
1405  * pmccntr_op_start.
1406  */
1407 static void pmccntr_op_finish(CPUARMState *env)
1408 {
1409     if (pmu_counter_enabled(env, 31)) {
1410 #ifndef CONFIG_USER_ONLY
1411         /* Calculate when the counter will next overflow */
1412         uint64_t remaining_cycles = -env->cp15.c15_ccnt;
1413         if (!(env->cp15.c9_pmcr & PMCRLC)) {
1414             remaining_cycles = (uint32_t)remaining_cycles;
1415         }
1416         int64_t overflow_in = cycles_ns_per(remaining_cycles);
1417 
1418         if (overflow_in > 0) {
1419             int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
1420                 overflow_in;
1421             ARMCPU *cpu = env_archcpu(env);
1422             timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
1423         }
1424 #endif
1425 
1426         uint64_t prev_cycles = env->cp15.c15_ccnt_delta;
1427         if (env->cp15.c9_pmcr & PMCRD) {
1428             /* Increment once every 64 processor clock cycles */
1429             prev_cycles /= 64;
1430         }
1431         env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt;
1432     }
1433 }
1434 
1435 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter)
1436 {
1437 
1438     uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
1439     uint64_t count = 0;
1440     if (event_supported(event)) {
1441         uint16_t event_idx = supported_event_map[event];
1442         count = pm_events[event_idx].get_count(env);
1443     }
1444 
1445     if (pmu_counter_enabled(env, counter)) {
1446         uint32_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter];
1447 
1448         if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & INT32_MIN) {
1449             env->cp15.c9_pmovsr |= (1 << counter);
1450             pmu_update_irq(env);
1451         }
1452         env->cp15.c14_pmevcntr[counter] = new_pmevcntr;
1453     }
1454     env->cp15.c14_pmevcntr_delta[counter] = count;
1455 }
1456 
1457 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter)
1458 {
1459     if (pmu_counter_enabled(env, counter)) {
1460 #ifndef CONFIG_USER_ONLY
1461         uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
1462         uint16_t event_idx = supported_event_map[event];
1463         uint64_t delta = UINT32_MAX -
1464             (uint32_t)env->cp15.c14_pmevcntr[counter] + 1;
1465         int64_t overflow_in = pm_events[event_idx].ns_per_count(delta);
1466 
1467         if (overflow_in > 0) {
1468             int64_t overflow_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
1469                 overflow_in;
1470             ARMCPU *cpu = env_archcpu(env);
1471             timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
1472         }
1473 #endif
1474 
1475         env->cp15.c14_pmevcntr_delta[counter] -=
1476             env->cp15.c14_pmevcntr[counter];
1477     }
1478 }
1479 
1480 void pmu_op_start(CPUARMState *env)
1481 {
1482     unsigned int i;
1483     pmccntr_op_start(env);
1484     for (i = 0; i < pmu_num_counters(env); i++) {
1485         pmevcntr_op_start(env, i);
1486     }
1487 }
1488 
1489 void pmu_op_finish(CPUARMState *env)
1490 {
1491     unsigned int i;
1492     pmccntr_op_finish(env);
1493     for (i = 0; i < pmu_num_counters(env); i++) {
1494         pmevcntr_op_finish(env, i);
1495     }
1496 }
1497 
1498 void pmu_pre_el_change(ARMCPU *cpu, void *ignored)
1499 {
1500     pmu_op_start(&cpu->env);
1501 }
1502 
1503 void pmu_post_el_change(ARMCPU *cpu, void *ignored)
1504 {
1505     pmu_op_finish(&cpu->env);
1506 }
1507 
1508 void arm_pmu_timer_cb(void *opaque)
1509 {
1510     ARMCPU *cpu = opaque;
1511 
1512     /*
1513      * Update all the counter values based on the current underlying counts,
1514      * triggering interrupts to be raised, if necessary. pmu_op_finish() also
1515      * has the effect of setting the cpu->pmu_timer to the next earliest time a
1516      * counter may expire.
1517      */
1518     pmu_op_start(&cpu->env);
1519     pmu_op_finish(&cpu->env);
1520 }
1521 
1522 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1523                        uint64_t value)
1524 {
1525     pmu_op_start(env);
1526 
1527     if (value & PMCRC) {
1528         /* The counter has been reset */
1529         env->cp15.c15_ccnt = 0;
1530     }
1531 
1532     if (value & PMCRP) {
1533         unsigned int i;
1534         for (i = 0; i < pmu_num_counters(env); i++) {
1535             env->cp15.c14_pmevcntr[i] = 0;
1536         }
1537     }
1538 
1539     /* only the DP, X, D and E bits are writable */
1540     env->cp15.c9_pmcr &= ~0x39;
1541     env->cp15.c9_pmcr |= (value & 0x39);
1542 
1543     pmu_op_finish(env);
1544 }
1545 
1546 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri,
1547                           uint64_t value)
1548 {
1549     unsigned int i;
1550     for (i = 0; i < pmu_num_counters(env); i++) {
1551         /* Increment a counter's count iff: */
1552         if ((value & (1 << i)) && /* counter's bit is set */
1553                 /* counter is enabled and not filtered */
1554                 pmu_counter_enabled(env, i) &&
1555                 /* counter is SW_INCR */
1556                 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) {
1557             pmevcntr_op_start(env, i);
1558 
1559             /*
1560              * Detect if this write causes an overflow since we can't predict
1561              * PMSWINC overflows like we can for other events
1562              */
1563             uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1;
1564 
1565             if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) {
1566                 env->cp15.c9_pmovsr |= (1 << i);
1567                 pmu_update_irq(env);
1568             }
1569 
1570             env->cp15.c14_pmevcntr[i] = new_pmswinc;
1571 
1572             pmevcntr_op_finish(env, i);
1573         }
1574     }
1575 }
1576 
1577 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1578 {
1579     uint64_t ret;
1580     pmccntr_op_start(env);
1581     ret = env->cp15.c15_ccnt;
1582     pmccntr_op_finish(env);
1583     return ret;
1584 }
1585 
1586 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1587                          uint64_t value)
1588 {
1589     /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
1590      * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
1591      * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
1592      * accessed.
1593      */
1594     env->cp15.c9_pmselr = value & 0x1f;
1595 }
1596 
1597 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1598                         uint64_t value)
1599 {
1600     pmccntr_op_start(env);
1601     env->cp15.c15_ccnt = value;
1602     pmccntr_op_finish(env);
1603 }
1604 
1605 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
1606                             uint64_t value)
1607 {
1608     uint64_t cur_val = pmccntr_read(env, NULL);
1609 
1610     pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
1611 }
1612 
1613 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1614                             uint64_t value)
1615 {
1616     pmccntr_op_start(env);
1617     env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0;
1618     pmccntr_op_finish(env);
1619 }
1620 
1621 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri,
1622                             uint64_t value)
1623 {
1624     pmccntr_op_start(env);
1625     /* M is not accessible from AArch32 */
1626     env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) |
1627         (value & PMCCFILTR);
1628     pmccntr_op_finish(env);
1629 }
1630 
1631 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri)
1632 {
1633     /* M is not visible in AArch32 */
1634     return env->cp15.pmccfiltr_el0 & PMCCFILTR;
1635 }
1636 
1637 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1638                             uint64_t value)
1639 {
1640     value &= pmu_counter_mask(env);
1641     env->cp15.c9_pmcnten |= value;
1642 }
1643 
1644 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1645                              uint64_t value)
1646 {
1647     value &= pmu_counter_mask(env);
1648     env->cp15.c9_pmcnten &= ~value;
1649 }
1650 
1651 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1652                          uint64_t value)
1653 {
1654     value &= pmu_counter_mask(env);
1655     env->cp15.c9_pmovsr &= ~value;
1656     pmu_update_irq(env);
1657 }
1658 
1659 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1660                          uint64_t value)
1661 {
1662     value &= pmu_counter_mask(env);
1663     env->cp15.c9_pmovsr |= value;
1664     pmu_update_irq(env);
1665 }
1666 
1667 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1668                              uint64_t value, const uint8_t counter)
1669 {
1670     if (counter == 31) {
1671         pmccfiltr_write(env, ri, value);
1672     } else if (counter < pmu_num_counters(env)) {
1673         pmevcntr_op_start(env, counter);
1674 
1675         /*
1676          * If this counter's event type is changing, store the current
1677          * underlying count for the new type in c14_pmevcntr_delta[counter] so
1678          * pmevcntr_op_finish has the correct baseline when it converts back to
1679          * a delta.
1680          */
1681         uint16_t old_event = env->cp15.c14_pmevtyper[counter] &
1682             PMXEVTYPER_EVTCOUNT;
1683         uint16_t new_event = value & PMXEVTYPER_EVTCOUNT;
1684         if (old_event != new_event) {
1685             uint64_t count = 0;
1686             if (event_supported(new_event)) {
1687                 uint16_t event_idx = supported_event_map[new_event];
1688                 count = pm_events[event_idx].get_count(env);
1689             }
1690             env->cp15.c14_pmevcntr_delta[counter] = count;
1691         }
1692 
1693         env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK;
1694         pmevcntr_op_finish(env, counter);
1695     }
1696     /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
1697      * PMSELR value is equal to or greater than the number of implemented
1698      * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
1699      */
1700 }
1701 
1702 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri,
1703                                const uint8_t counter)
1704 {
1705     if (counter == 31) {
1706         return env->cp15.pmccfiltr_el0;
1707     } else if (counter < pmu_num_counters(env)) {
1708         return env->cp15.c14_pmevtyper[counter];
1709     } else {
1710       /*
1711        * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
1712        * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write().
1713        */
1714         return 0;
1715     }
1716 }
1717 
1718 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
1719                               uint64_t value)
1720 {
1721     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1722     pmevtyper_write(env, ri, value, counter);
1723 }
1724 
1725 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
1726                                uint64_t value)
1727 {
1728     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1729     env->cp15.c14_pmevtyper[counter] = value;
1730 
1731     /*
1732      * pmevtyper_rawwrite is called between a pair of pmu_op_start and
1733      * pmu_op_finish calls when loading saved state for a migration. Because
1734      * we're potentially updating the type of event here, the value written to
1735      * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a
1736      * different counter type. Therefore, we need to set this value to the
1737      * current count for the counter type we're writing so that pmu_op_finish
1738      * has the correct count for its calculation.
1739      */
1740     uint16_t event = value & PMXEVTYPER_EVTCOUNT;
1741     if (event_supported(event)) {
1742         uint16_t event_idx = supported_event_map[event];
1743         env->cp15.c14_pmevcntr_delta[counter] =
1744             pm_events[event_idx].get_count(env);
1745     }
1746 }
1747 
1748 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
1749 {
1750     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1751     return pmevtyper_read(env, ri, counter);
1752 }
1753 
1754 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1755                              uint64_t value)
1756 {
1757     pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31);
1758 }
1759 
1760 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
1761 {
1762     return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31);
1763 }
1764 
1765 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1766                              uint64_t value, uint8_t counter)
1767 {
1768     if (counter < pmu_num_counters(env)) {
1769         pmevcntr_op_start(env, counter);
1770         env->cp15.c14_pmevcntr[counter] = value;
1771         pmevcntr_op_finish(env, counter);
1772     }
1773     /*
1774      * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
1775      * are CONSTRAINED UNPREDICTABLE.
1776      */
1777 }
1778 
1779 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri,
1780                               uint8_t counter)
1781 {
1782     if (counter < pmu_num_counters(env)) {
1783         uint64_t ret;
1784         pmevcntr_op_start(env, counter);
1785         ret = env->cp15.c14_pmevcntr[counter];
1786         pmevcntr_op_finish(env, counter);
1787         return ret;
1788     } else {
1789       /* We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
1790        * are CONSTRAINED UNPREDICTABLE. */
1791         return 0;
1792     }
1793 }
1794 
1795 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
1796                              uint64_t value)
1797 {
1798     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1799     pmevcntr_write(env, ri, value, counter);
1800 }
1801 
1802 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
1803 {
1804     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1805     return pmevcntr_read(env, ri, counter);
1806 }
1807 
1808 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
1809                              uint64_t value)
1810 {
1811     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1812     assert(counter < pmu_num_counters(env));
1813     env->cp15.c14_pmevcntr[counter] = value;
1814     pmevcntr_write(env, ri, value, counter);
1815 }
1816 
1817 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri)
1818 {
1819     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1820     assert(counter < pmu_num_counters(env));
1821     return env->cp15.c14_pmevcntr[counter];
1822 }
1823 
1824 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1825                              uint64_t value)
1826 {
1827     pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31);
1828 }
1829 
1830 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1831 {
1832     return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31);
1833 }
1834 
1835 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1836                             uint64_t value)
1837 {
1838     if (arm_feature(env, ARM_FEATURE_V8)) {
1839         env->cp15.c9_pmuserenr = value & 0xf;
1840     } else {
1841         env->cp15.c9_pmuserenr = value & 1;
1842     }
1843 }
1844 
1845 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1846                              uint64_t value)
1847 {
1848     /* We have no event counters so only the C bit can be changed */
1849     value &= pmu_counter_mask(env);
1850     env->cp15.c9_pminten |= value;
1851     pmu_update_irq(env);
1852 }
1853 
1854 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1855                              uint64_t value)
1856 {
1857     value &= pmu_counter_mask(env);
1858     env->cp15.c9_pminten &= ~value;
1859     pmu_update_irq(env);
1860 }
1861 
1862 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
1863                        uint64_t value)
1864 {
1865     /* Note that even though the AArch64 view of this register has bits
1866      * [10:0] all RES0 we can only mask the bottom 5, to comply with the
1867      * architectural requirements for bits which are RES0 only in some
1868      * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
1869      * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
1870      */
1871     raw_write(env, ri, value & ~0x1FULL);
1872 }
1873 
1874 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1875 {
1876     /* Begin with base v8.0 state.  */
1877     uint32_t valid_mask = 0x3fff;
1878     ARMCPU *cpu = env_archcpu(env);
1879 
1880     if (arm_el_is_aa64(env, 3)) {
1881         value |= SCR_FW | SCR_AW;   /* these two bits are RES1.  */
1882         valid_mask &= ~SCR_NET;
1883     } else {
1884         valid_mask &= ~(SCR_RW | SCR_ST);
1885     }
1886 
1887     if (!arm_feature(env, ARM_FEATURE_EL2)) {
1888         valid_mask &= ~SCR_HCE;
1889 
1890         /* On ARMv7, SMD (or SCD as it is called in v7) is only
1891          * supported if EL2 exists. The bit is UNK/SBZP when
1892          * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
1893          * when EL2 is unavailable.
1894          * On ARMv8, this bit is always available.
1895          */
1896         if (arm_feature(env, ARM_FEATURE_V7) &&
1897             !arm_feature(env, ARM_FEATURE_V8)) {
1898             valid_mask &= ~SCR_SMD;
1899         }
1900     }
1901     if (cpu_isar_feature(aa64_lor, cpu)) {
1902         valid_mask |= SCR_TLOR;
1903     }
1904     if (cpu_isar_feature(aa64_pauth, cpu)) {
1905         valid_mask |= SCR_API | SCR_APK;
1906     }
1907 
1908     /* Clear all-context RES0 bits.  */
1909     value &= valid_mask;
1910     raw_write(env, ri, value);
1911 }
1912 
1913 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1914 {
1915     ARMCPU *cpu = env_archcpu(env);
1916 
1917     /* Acquire the CSSELR index from the bank corresponding to the CCSIDR
1918      * bank
1919      */
1920     uint32_t index = A32_BANKED_REG_GET(env, csselr,
1921                                         ri->secure & ARM_CP_SECSTATE_S);
1922 
1923     return cpu->ccsidr[index];
1924 }
1925 
1926 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1927                          uint64_t value)
1928 {
1929     raw_write(env, ri, value & 0xf);
1930 }
1931 
1932 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1933 {
1934     CPUState *cs = env_cpu(env);
1935     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
1936     uint64_t ret = 0;
1937 
1938     if (hcr_el2 & HCR_IMO) {
1939         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
1940             ret |= CPSR_I;
1941         }
1942     } else {
1943         if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
1944             ret |= CPSR_I;
1945         }
1946     }
1947 
1948     if (hcr_el2 & HCR_FMO) {
1949         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
1950             ret |= CPSR_F;
1951         }
1952     } else {
1953         if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
1954             ret |= CPSR_F;
1955         }
1956     }
1957 
1958     /* External aborts are not possible in QEMU so A bit is always clear */
1959     return ret;
1960 }
1961 
1962 static const ARMCPRegInfo v7_cp_reginfo[] = {
1963     /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
1964     { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
1965       .access = PL1_W, .type = ARM_CP_NOP },
1966     /* Performance monitors are implementation defined in v7,
1967      * but with an ARM recommended set of registers, which we
1968      * follow.
1969      *
1970      * Performance registers fall into three categories:
1971      *  (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
1972      *  (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
1973      *  (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
1974      * For the cases controlled by PMUSERENR we must set .access to PL0_RW
1975      * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
1976      */
1977     { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
1978       .access = PL0_RW, .type = ARM_CP_ALIAS,
1979       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
1980       .writefn = pmcntenset_write,
1981       .accessfn = pmreg_access,
1982       .raw_writefn = raw_write },
1983     { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64,
1984       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
1985       .access = PL0_RW, .accessfn = pmreg_access,
1986       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
1987       .writefn = pmcntenset_write, .raw_writefn = raw_write },
1988     { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
1989       .access = PL0_RW,
1990       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
1991       .accessfn = pmreg_access,
1992       .writefn = pmcntenclr_write,
1993       .type = ARM_CP_ALIAS },
1994     { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
1995       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
1996       .access = PL0_RW, .accessfn = pmreg_access,
1997       .type = ARM_CP_ALIAS,
1998       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
1999       .writefn = pmcntenclr_write },
2000     { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
2001       .access = PL0_RW, .type = ARM_CP_IO,
2002       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
2003       .accessfn = pmreg_access,
2004       .writefn = pmovsr_write,
2005       .raw_writefn = raw_write },
2006     { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64,
2007       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3,
2008       .access = PL0_RW, .accessfn = pmreg_access,
2009       .type = ARM_CP_ALIAS | ARM_CP_IO,
2010       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
2011       .writefn = pmovsr_write,
2012       .raw_writefn = raw_write },
2013     { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
2014       .access = PL0_W, .accessfn = pmreg_access_swinc,
2015       .type = ARM_CP_NO_RAW | ARM_CP_IO,
2016       .writefn = pmswinc_write },
2017     { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64,
2018       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4,
2019       .access = PL0_W, .accessfn = pmreg_access_swinc,
2020       .type = ARM_CP_NO_RAW | ARM_CP_IO,
2021       .writefn = pmswinc_write },
2022     { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
2023       .access = PL0_RW, .type = ARM_CP_ALIAS,
2024       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
2025       .accessfn = pmreg_access_selr, .writefn = pmselr_write,
2026       .raw_writefn = raw_write},
2027     { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
2028       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
2029       .access = PL0_RW, .accessfn = pmreg_access_selr,
2030       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
2031       .writefn = pmselr_write, .raw_writefn = raw_write, },
2032     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
2033       .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
2034       .readfn = pmccntr_read, .writefn = pmccntr_write32,
2035       .accessfn = pmreg_access_ccntr },
2036     { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
2037       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
2038       .access = PL0_RW, .accessfn = pmreg_access_ccntr,
2039       .type = ARM_CP_IO,
2040       .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt),
2041       .readfn = pmccntr_read, .writefn = pmccntr_write,
2042       .raw_readfn = raw_read, .raw_writefn = raw_write, },
2043     { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7,
2044       .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32,
2045       .access = PL0_RW, .accessfn = pmreg_access,
2046       .type = ARM_CP_ALIAS | ARM_CP_IO,
2047       .resetvalue = 0, },
2048     { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
2049       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
2050       .writefn = pmccfiltr_write, .raw_writefn = raw_write,
2051       .access = PL0_RW, .accessfn = pmreg_access,
2052       .type = ARM_CP_IO,
2053       .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
2054       .resetvalue = 0, },
2055     { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
2056       .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2057       .accessfn = pmreg_access,
2058       .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
2059     { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
2060       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
2061       .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2062       .accessfn = pmreg_access,
2063       .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
2064     { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
2065       .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2066       .accessfn = pmreg_access_xevcntr,
2067       .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
2068     { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64,
2069       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2,
2070       .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2071       .accessfn = pmreg_access_xevcntr,
2072       .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
2073     { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
2074       .access = PL0_R | PL1_RW, .accessfn = access_tpm,
2075       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
2076       .resetvalue = 0,
2077       .writefn = pmuserenr_write, .raw_writefn = raw_write },
2078     { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
2079       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0,
2080       .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
2081       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
2082       .resetvalue = 0,
2083       .writefn = pmuserenr_write, .raw_writefn = raw_write },
2084     { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
2085       .access = PL1_RW, .accessfn = access_tpm,
2086       .type = ARM_CP_ALIAS | ARM_CP_IO,
2087       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
2088       .resetvalue = 0,
2089       .writefn = pmintenset_write, .raw_writefn = raw_write },
2090     { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
2091       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
2092       .access = PL1_RW, .accessfn = access_tpm,
2093       .type = ARM_CP_IO,
2094       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2095       .writefn = pmintenset_write, .raw_writefn = raw_write,
2096       .resetvalue = 0x0 },
2097     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
2098       .access = PL1_RW, .accessfn = access_tpm,
2099       .type = ARM_CP_ALIAS | ARM_CP_IO,
2100       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2101       .writefn = pmintenclr_write, },
2102     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
2103       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
2104       .access = PL1_RW, .accessfn = access_tpm,
2105       .type = ARM_CP_ALIAS | ARM_CP_IO,
2106       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2107       .writefn = pmintenclr_write },
2108     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
2109       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
2110       .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
2111     { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
2112       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
2113       .access = PL1_RW, .writefn = csselr_write, .resetvalue = 0,
2114       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
2115                              offsetof(CPUARMState, cp15.csselr_ns) } },
2116     /* Auxiliary ID register: this actually has an IMPDEF value but for now
2117      * just RAZ for all cores:
2118      */
2119     { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
2120       .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
2121       .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2122     /* Auxiliary fault status registers: these also are IMPDEF, and we
2123      * choose to RAZ/WI for all cores.
2124      */
2125     { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
2126       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
2127       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2128     { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
2129       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
2130       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2131     /* MAIR can just read-as-written because we don't implement caches
2132      * and so don't need to care about memory attributes.
2133      */
2134     { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
2135       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
2136       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
2137       .resetvalue = 0 },
2138     { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
2139       .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
2140       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
2141       .resetvalue = 0 },
2142     /* For non-long-descriptor page tables these are PRRR and NMRR;
2143      * regardless they still act as reads-as-written for QEMU.
2144      */
2145      /* MAIR0/1 are defined separately from their 64-bit counterpart which
2146       * allows them to assign the correct fieldoffset based on the endianness
2147       * handled in the field definitions.
2148       */
2149     { .name = "MAIR0", .state = ARM_CP_STATE_AA32,
2150       .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
2151       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
2152                              offsetof(CPUARMState, cp15.mair0_ns) },
2153       .resetfn = arm_cp_reset_ignore },
2154     { .name = "MAIR1", .state = ARM_CP_STATE_AA32,
2155       .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
2156       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
2157                              offsetof(CPUARMState, cp15.mair1_ns) },
2158       .resetfn = arm_cp_reset_ignore },
2159     { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
2160       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
2161       .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
2162     /* 32 bit ITLB invalidates */
2163     { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
2164       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2165     { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
2166       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2167     { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
2168       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2169     /* 32 bit DTLB invalidates */
2170     { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
2171       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2172     { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
2173       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2174     { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
2175       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2176     /* 32 bit TLB invalidates */
2177     { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2178       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_write },
2179     { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2180       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
2181     { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2182       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiasid_write },
2183     { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2184       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
2185     REGINFO_SENTINEL
2186 };
2187 
2188 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
2189     /* 32 bit TLB invalidates, Inner Shareable */
2190     { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2191       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbiall_is_write },
2192     { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2193       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
2194     { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2195       .type = ARM_CP_NO_RAW, .access = PL1_W,
2196       .writefn = tlbiasid_is_write },
2197     { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2198       .type = ARM_CP_NO_RAW, .access = PL1_W,
2199       .writefn = tlbimvaa_is_write },
2200     REGINFO_SENTINEL
2201 };
2202 
2203 static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
2204     /* PMOVSSET is not implemented in v7 before v7ve */
2205     { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3,
2206       .access = PL0_RW, .accessfn = pmreg_access,
2207       .type = ARM_CP_ALIAS | ARM_CP_IO,
2208       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
2209       .writefn = pmovsset_write,
2210       .raw_writefn = raw_write },
2211     { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64,
2212       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3,
2213       .access = PL0_RW, .accessfn = pmreg_access,
2214       .type = ARM_CP_ALIAS | ARM_CP_IO,
2215       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
2216       .writefn = pmovsset_write,
2217       .raw_writefn = raw_write },
2218     REGINFO_SENTINEL
2219 };
2220 
2221 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2222                         uint64_t value)
2223 {
2224     value &= 1;
2225     env->teecr = value;
2226 }
2227 
2228 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri,
2229                                     bool isread)
2230 {
2231     if (arm_current_el(env) == 0 && (env->teecr & 1)) {
2232         return CP_ACCESS_TRAP;
2233     }
2234     return CP_ACCESS_OK;
2235 }
2236 
2237 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
2238     { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
2239       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
2240       .resetvalue = 0,
2241       .writefn = teecr_write },
2242     { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
2243       .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
2244       .accessfn = teehbr_access, .resetvalue = 0 },
2245     REGINFO_SENTINEL
2246 };
2247 
2248 static const ARMCPRegInfo v6k_cp_reginfo[] = {
2249     { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
2250       .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
2251       .access = PL0_RW,
2252       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
2253     { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
2254       .access = PL0_RW,
2255       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
2256                              offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
2257       .resetfn = arm_cp_reset_ignore },
2258     { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
2259       .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
2260       .access = PL0_R|PL1_W,
2261       .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
2262       .resetvalue = 0},
2263     { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
2264       .access = PL0_R|PL1_W,
2265       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
2266                              offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
2267       .resetfn = arm_cp_reset_ignore },
2268     { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
2269       .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
2270       .access = PL1_RW,
2271       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
2272     { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
2273       .access = PL1_RW,
2274       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
2275                              offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
2276       .resetvalue = 0 },
2277     REGINFO_SENTINEL
2278 };
2279 
2280 #ifndef CONFIG_USER_ONLY
2281 
2282 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri,
2283                                        bool isread)
2284 {
2285     /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
2286      * Writable only at the highest implemented exception level.
2287      */
2288     int el = arm_current_el(env);
2289 
2290     switch (el) {
2291     case 0:
2292         if (!extract32(env->cp15.c14_cntkctl, 0, 2)) {
2293             return CP_ACCESS_TRAP;
2294         }
2295         break;
2296     case 1:
2297         if (!isread && ri->state == ARM_CP_STATE_AA32 &&
2298             arm_is_secure_below_el3(env)) {
2299             /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
2300             return CP_ACCESS_TRAP_UNCATEGORIZED;
2301         }
2302         break;
2303     case 2:
2304     case 3:
2305         break;
2306     }
2307 
2308     if (!isread && el < arm_highest_el(env)) {
2309         return CP_ACCESS_TRAP_UNCATEGORIZED;
2310     }
2311 
2312     return CP_ACCESS_OK;
2313 }
2314 
2315 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
2316                                         bool isread)
2317 {
2318     unsigned int cur_el = arm_current_el(env);
2319     bool secure = arm_is_secure(env);
2320 
2321     /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
2322     if (cur_el == 0 &&
2323         !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
2324         return CP_ACCESS_TRAP;
2325     }
2326 
2327     if (arm_feature(env, ARM_FEATURE_EL2) &&
2328         timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
2329         !extract32(env->cp15.cnthctl_el2, 0, 1)) {
2330         return CP_ACCESS_TRAP_EL2;
2331     }
2332     return CP_ACCESS_OK;
2333 }
2334 
2335 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
2336                                       bool isread)
2337 {
2338     unsigned int cur_el = arm_current_el(env);
2339     bool secure = arm_is_secure(env);
2340 
2341     /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
2342      * EL0[PV]TEN is zero.
2343      */
2344     if (cur_el == 0 &&
2345         !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
2346         return CP_ACCESS_TRAP;
2347     }
2348 
2349     if (arm_feature(env, ARM_FEATURE_EL2) &&
2350         timeridx == GTIMER_PHYS && !secure && cur_el < 2 &&
2351         !extract32(env->cp15.cnthctl_el2, 1, 1)) {
2352         return CP_ACCESS_TRAP_EL2;
2353     }
2354     return CP_ACCESS_OK;
2355 }
2356 
2357 static CPAccessResult gt_pct_access(CPUARMState *env,
2358                                     const ARMCPRegInfo *ri,
2359                                     bool isread)
2360 {
2361     return gt_counter_access(env, GTIMER_PHYS, isread);
2362 }
2363 
2364 static CPAccessResult gt_vct_access(CPUARMState *env,
2365                                     const ARMCPRegInfo *ri,
2366                                     bool isread)
2367 {
2368     return gt_counter_access(env, GTIMER_VIRT, isread);
2369 }
2370 
2371 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
2372                                        bool isread)
2373 {
2374     return gt_timer_access(env, GTIMER_PHYS, isread);
2375 }
2376 
2377 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
2378                                        bool isread)
2379 {
2380     return gt_timer_access(env, GTIMER_VIRT, isread);
2381 }
2382 
2383 static CPAccessResult gt_stimer_access(CPUARMState *env,
2384                                        const ARMCPRegInfo *ri,
2385                                        bool isread)
2386 {
2387     /* The AArch64 register view of the secure physical timer is
2388      * always accessible from EL3, and configurably accessible from
2389      * Secure EL1.
2390      */
2391     switch (arm_current_el(env)) {
2392     case 1:
2393         if (!arm_is_secure(env)) {
2394             return CP_ACCESS_TRAP;
2395         }
2396         if (!(env->cp15.scr_el3 & SCR_ST)) {
2397             return CP_ACCESS_TRAP_EL3;
2398         }
2399         return CP_ACCESS_OK;
2400     case 0:
2401     case 2:
2402         return CP_ACCESS_TRAP;
2403     case 3:
2404         return CP_ACCESS_OK;
2405     default:
2406         g_assert_not_reached();
2407     }
2408 }
2409 
2410 static uint64_t gt_get_countervalue(CPUARMState *env)
2411 {
2412     return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
2413 }
2414 
2415 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
2416 {
2417     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
2418 
2419     if (gt->ctl & 1) {
2420         /* Timer enabled: calculate and set current ISTATUS, irq, and
2421          * reset timer to when ISTATUS next has to change
2422          */
2423         uint64_t offset = timeridx == GTIMER_VIRT ?
2424                                       cpu->env.cp15.cntvoff_el2 : 0;
2425         uint64_t count = gt_get_countervalue(&cpu->env);
2426         /* Note that this must be unsigned 64 bit arithmetic: */
2427         int istatus = count - offset >= gt->cval;
2428         uint64_t nexttick;
2429         int irqstate;
2430 
2431         gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
2432 
2433         irqstate = (istatus && !(gt->ctl & 2));
2434         qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
2435 
2436         if (istatus) {
2437             /* Next transition is when count rolls back over to zero */
2438             nexttick = UINT64_MAX;
2439         } else {
2440             /* Next transition is when we hit cval */
2441             nexttick = gt->cval + offset;
2442         }
2443         /* Note that the desired next expiry time might be beyond the
2444          * signed-64-bit range of a QEMUTimer -- in this case we just
2445          * set the timer for as far in the future as possible. When the
2446          * timer expires we will reset the timer for any remaining period.
2447          */
2448         if (nexttick > INT64_MAX / GTIMER_SCALE) {
2449             nexttick = INT64_MAX / GTIMER_SCALE;
2450         }
2451         timer_mod(cpu->gt_timer[timeridx], nexttick);
2452         trace_arm_gt_recalc(timeridx, irqstate, nexttick);
2453     } else {
2454         /* Timer disabled: ISTATUS and timer output always clear */
2455         gt->ctl &= ~4;
2456         qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
2457         timer_del(cpu->gt_timer[timeridx]);
2458         trace_arm_gt_recalc_disabled(timeridx);
2459     }
2460 }
2461 
2462 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
2463                            int timeridx)
2464 {
2465     ARMCPU *cpu = env_archcpu(env);
2466 
2467     timer_del(cpu->gt_timer[timeridx]);
2468 }
2469 
2470 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2471 {
2472     return gt_get_countervalue(env);
2473 }
2474 
2475 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2476 {
2477     return gt_get_countervalue(env) - env->cp15.cntvoff_el2;
2478 }
2479 
2480 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2481                           int timeridx,
2482                           uint64_t value)
2483 {
2484     trace_arm_gt_cval_write(timeridx, value);
2485     env->cp15.c14_timer[timeridx].cval = value;
2486     gt_recalc_timer(env_archcpu(env), timeridx);
2487 }
2488 
2489 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
2490                              int timeridx)
2491 {
2492     uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
2493 
2494     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
2495                       (gt_get_countervalue(env) - offset));
2496 }
2497 
2498 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2499                           int timeridx,
2500                           uint64_t value)
2501 {
2502     uint64_t offset = timeridx == GTIMER_VIRT ? env->cp15.cntvoff_el2 : 0;
2503 
2504     trace_arm_gt_tval_write(timeridx, value);
2505     env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
2506                                          sextract64(value, 0, 32);
2507     gt_recalc_timer(env_archcpu(env), timeridx);
2508 }
2509 
2510 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2511                          int timeridx,
2512                          uint64_t value)
2513 {
2514     ARMCPU *cpu = env_archcpu(env);
2515     uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
2516 
2517     trace_arm_gt_ctl_write(timeridx, value);
2518     env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
2519     if ((oldval ^ value) & 1) {
2520         /* Enable toggled */
2521         gt_recalc_timer(cpu, timeridx);
2522     } else if ((oldval ^ value) & 2) {
2523         /* IMASK toggled: don't need to recalculate,
2524          * just set the interrupt line based on ISTATUS
2525          */
2526         int irqstate = (oldval & 4) && !(value & 2);
2527 
2528         trace_arm_gt_imask_toggle(timeridx, irqstate);
2529         qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
2530     }
2531 }
2532 
2533 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2534 {
2535     gt_timer_reset(env, ri, GTIMER_PHYS);
2536 }
2537 
2538 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2539                                uint64_t value)
2540 {
2541     gt_cval_write(env, ri, GTIMER_PHYS, value);
2542 }
2543 
2544 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2545 {
2546     return gt_tval_read(env, ri, GTIMER_PHYS);
2547 }
2548 
2549 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2550                                uint64_t value)
2551 {
2552     gt_tval_write(env, ri, GTIMER_PHYS, value);
2553 }
2554 
2555 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2556                               uint64_t value)
2557 {
2558     gt_ctl_write(env, ri, GTIMER_PHYS, value);
2559 }
2560 
2561 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2562 {
2563     gt_timer_reset(env, ri, GTIMER_VIRT);
2564 }
2565 
2566 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2567                                uint64_t value)
2568 {
2569     gt_cval_write(env, ri, GTIMER_VIRT, value);
2570 }
2571 
2572 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2573 {
2574     return gt_tval_read(env, ri, GTIMER_VIRT);
2575 }
2576 
2577 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2578                                uint64_t value)
2579 {
2580     gt_tval_write(env, ri, GTIMER_VIRT, value);
2581 }
2582 
2583 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2584                               uint64_t value)
2585 {
2586     gt_ctl_write(env, ri, GTIMER_VIRT, value);
2587 }
2588 
2589 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
2590                               uint64_t value)
2591 {
2592     ARMCPU *cpu = env_archcpu(env);
2593 
2594     trace_arm_gt_cntvoff_write(value);
2595     raw_write(env, ri, value);
2596     gt_recalc_timer(cpu, GTIMER_VIRT);
2597 }
2598 
2599 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2600 {
2601     gt_timer_reset(env, ri, GTIMER_HYP);
2602 }
2603 
2604 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2605                               uint64_t value)
2606 {
2607     gt_cval_write(env, ri, GTIMER_HYP, value);
2608 }
2609 
2610 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2611 {
2612     return gt_tval_read(env, ri, GTIMER_HYP);
2613 }
2614 
2615 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2616                               uint64_t value)
2617 {
2618     gt_tval_write(env, ri, GTIMER_HYP, value);
2619 }
2620 
2621 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2622                               uint64_t value)
2623 {
2624     gt_ctl_write(env, ri, GTIMER_HYP, value);
2625 }
2626 
2627 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2628 {
2629     gt_timer_reset(env, ri, GTIMER_SEC);
2630 }
2631 
2632 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2633                               uint64_t value)
2634 {
2635     gt_cval_write(env, ri, GTIMER_SEC, value);
2636 }
2637 
2638 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2639 {
2640     return gt_tval_read(env, ri, GTIMER_SEC);
2641 }
2642 
2643 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2644                               uint64_t value)
2645 {
2646     gt_tval_write(env, ri, GTIMER_SEC, value);
2647 }
2648 
2649 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2650                               uint64_t value)
2651 {
2652     gt_ctl_write(env, ri, GTIMER_SEC, value);
2653 }
2654 
2655 void arm_gt_ptimer_cb(void *opaque)
2656 {
2657     ARMCPU *cpu = opaque;
2658 
2659     gt_recalc_timer(cpu, GTIMER_PHYS);
2660 }
2661 
2662 void arm_gt_vtimer_cb(void *opaque)
2663 {
2664     ARMCPU *cpu = opaque;
2665 
2666     gt_recalc_timer(cpu, GTIMER_VIRT);
2667 }
2668 
2669 void arm_gt_htimer_cb(void *opaque)
2670 {
2671     ARMCPU *cpu = opaque;
2672 
2673     gt_recalc_timer(cpu, GTIMER_HYP);
2674 }
2675 
2676 void arm_gt_stimer_cb(void *opaque)
2677 {
2678     ARMCPU *cpu = opaque;
2679 
2680     gt_recalc_timer(cpu, GTIMER_SEC);
2681 }
2682 
2683 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2684     /* Note that CNTFRQ is purely reads-as-written for the benefit
2685      * of software; writing it doesn't actually change the timer frequency.
2686      * Our reset value matches the fixed frequency we implement the timer at.
2687      */
2688     { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
2689       .type = ARM_CP_ALIAS,
2690       .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
2691       .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
2692     },
2693     { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2694       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2695       .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
2696       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2697       .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
2698     },
2699     /* overall control: mostly access permissions */
2700     { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
2701       .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
2702       .access = PL1_RW,
2703       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
2704       .resetvalue = 0,
2705     },
2706     /* per-timer control */
2707     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2708       .secure = ARM_CP_SECSTATE_NS,
2709       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2710       .accessfn = gt_ptimer_access,
2711       .fieldoffset = offsetoflow32(CPUARMState,
2712                                    cp15.c14_timer[GTIMER_PHYS].ctl),
2713       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
2714     },
2715     { .name = "CNTP_CTL_S",
2716       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2717       .secure = ARM_CP_SECSTATE_S,
2718       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2719       .accessfn = gt_ptimer_access,
2720       .fieldoffset = offsetoflow32(CPUARMState,
2721                                    cp15.c14_timer[GTIMER_SEC].ctl),
2722       .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2723     },
2724     { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
2725       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
2726       .type = ARM_CP_IO, .access = PL0_RW,
2727       .accessfn = gt_ptimer_access,
2728       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
2729       .resetvalue = 0,
2730       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
2731     },
2732     { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
2733       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
2734       .accessfn = gt_vtimer_access,
2735       .fieldoffset = offsetoflow32(CPUARMState,
2736                                    cp15.c14_timer[GTIMER_VIRT].ctl),
2737       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
2738     },
2739     { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
2740       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
2741       .type = ARM_CP_IO, .access = PL0_RW,
2742       .accessfn = gt_vtimer_access,
2743       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
2744       .resetvalue = 0,
2745       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write,
2746     },
2747     /* TimerValue views: a 32 bit downcounting view of the underlying state */
2748     { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2749       .secure = ARM_CP_SECSTATE_NS,
2750       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2751       .accessfn = gt_ptimer_access,
2752       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
2753     },
2754     { .name = "CNTP_TVAL_S",
2755       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2756       .secure = ARM_CP_SECSTATE_S,
2757       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2758       .accessfn = gt_ptimer_access,
2759       .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
2760     },
2761     { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2762       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
2763       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2764       .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
2765       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
2766     },
2767     { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
2768       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2769       .accessfn = gt_vtimer_access,
2770       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
2771     },
2772     { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2773       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
2774       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
2775       .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
2776       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
2777     },
2778     /* The counter itself */
2779     { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
2780       .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
2781       .accessfn = gt_pct_access,
2782       .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
2783     },
2784     { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
2785       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
2786       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2787       .accessfn = gt_pct_access, .readfn = gt_cnt_read,
2788     },
2789     { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
2790       .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
2791       .accessfn = gt_vct_access,
2792       .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
2793     },
2794     { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2795       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2796       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2797       .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
2798     },
2799     /* Comparison value, indicating when the timer goes off */
2800     { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
2801       .secure = ARM_CP_SECSTATE_NS,
2802       .access = PL0_RW,
2803       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2804       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2805       .accessfn = gt_ptimer_access,
2806       .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
2807     },
2808     { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
2809       .secure = ARM_CP_SECSTATE_S,
2810       .access = PL0_RW,
2811       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2812       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2813       .accessfn = gt_ptimer_access,
2814       .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2815     },
2816     { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2817       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
2818       .access = PL0_RW,
2819       .type = ARM_CP_IO,
2820       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2821       .resetvalue = 0, .accessfn = gt_ptimer_access,
2822       .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
2823     },
2824     { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
2825       .access = PL0_RW,
2826       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
2827       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2828       .accessfn = gt_vtimer_access,
2829       .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
2830     },
2831     { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2832       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
2833       .access = PL0_RW,
2834       .type = ARM_CP_IO,
2835       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2836       .resetvalue = 0, .accessfn = gt_vtimer_access,
2837       .writefn = gt_virt_cval_write, .raw_writefn = raw_write,
2838     },
2839     /* Secure timer -- this is actually restricted to only EL3
2840      * and configurably Secure-EL1 via the accessfn.
2841      */
2842     { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
2843       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
2844       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW,
2845       .accessfn = gt_stimer_access,
2846       .readfn = gt_sec_tval_read,
2847       .writefn = gt_sec_tval_write,
2848       .resetfn = gt_sec_timer_reset,
2849     },
2850     { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
2851       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
2852       .type = ARM_CP_IO, .access = PL1_RW,
2853       .accessfn = gt_stimer_access,
2854       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
2855       .resetvalue = 0,
2856       .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2857     },
2858     { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
2859       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
2860       .type = ARM_CP_IO, .access = PL1_RW,
2861       .accessfn = gt_stimer_access,
2862       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2863       .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2864     },
2865     REGINFO_SENTINEL
2866 };
2867 
2868 #else
2869 
2870 /* In user-mode most of the generic timer registers are inaccessible
2871  * however modern kernels (4.12+) allow access to cntvct_el0
2872  */
2873 
2874 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2875 {
2876     /* Currently we have no support for QEMUTimer in linux-user so we
2877      * can't call gt_get_countervalue(env), instead we directly
2878      * call the lower level functions.
2879      */
2880     return cpu_get_clock() / GTIMER_SCALE;
2881 }
2882 
2883 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2884     { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2885       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2886       .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */,
2887       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2888       .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE,
2889     },
2890     { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2891       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2892       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2893       .readfn = gt_virt_cnt_read,
2894     },
2895     REGINFO_SENTINEL
2896 };
2897 
2898 #endif
2899 
2900 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
2901 {
2902     if (arm_feature(env, ARM_FEATURE_LPAE)) {
2903         raw_write(env, ri, value);
2904     } else if (arm_feature(env, ARM_FEATURE_V7)) {
2905         raw_write(env, ri, value & 0xfffff6ff);
2906     } else {
2907         raw_write(env, ri, value & 0xfffff1ff);
2908     }
2909 }
2910 
2911 #ifndef CONFIG_USER_ONLY
2912 /* get_phys_addr() isn't present for user-mode-only targets */
2913 
2914 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
2915                                  bool isread)
2916 {
2917     if (ri->opc2 & 4) {
2918         /* The ATS12NSO* operations must trap to EL3 if executed in
2919          * Secure EL1 (which can only happen if EL3 is AArch64).
2920          * They are simply UNDEF if executed from NS EL1.
2921          * They function normally from EL2 or EL3.
2922          */
2923         if (arm_current_el(env) == 1) {
2924             if (arm_is_secure_below_el3(env)) {
2925                 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3;
2926             }
2927             return CP_ACCESS_TRAP_UNCATEGORIZED;
2928         }
2929     }
2930     return CP_ACCESS_OK;
2931 }
2932 
2933 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
2934                              MMUAccessType access_type, ARMMMUIdx mmu_idx)
2935 {
2936     hwaddr phys_addr;
2937     target_ulong page_size;
2938     int prot;
2939     bool ret;
2940     uint64_t par64;
2941     bool format64 = false;
2942     MemTxAttrs attrs = {};
2943     ARMMMUFaultInfo fi = {};
2944     ARMCacheAttrs cacheattrs = {};
2945 
2946     ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
2947                         &prot, &page_size, &fi, &cacheattrs);
2948 
2949     if (is_a64(env)) {
2950         format64 = true;
2951     } else if (arm_feature(env, ARM_FEATURE_LPAE)) {
2952         /*
2953          * ATS1Cxx:
2954          * * TTBCR.EAE determines whether the result is returned using the
2955          *   32-bit or the 64-bit PAR format
2956          * * Instructions executed in Hyp mode always use the 64bit format
2957          *
2958          * ATS1S2NSOxx uses the 64bit format if any of the following is true:
2959          * * The Non-secure TTBCR.EAE bit is set to 1
2960          * * The implementation includes EL2, and the value of HCR.VM is 1
2961          *
2962          * (Note that HCR.DC makes HCR.VM behave as if it is 1.)
2963          *
2964          * ATS1Hx always uses the 64bit format.
2965          */
2966         format64 = arm_s1_regime_using_lpae_format(env, mmu_idx);
2967 
2968         if (arm_feature(env, ARM_FEATURE_EL2)) {
2969             if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
2970                 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC);
2971             } else {
2972                 format64 |= arm_current_el(env) == 2;
2973             }
2974         }
2975     }
2976 
2977     if (format64) {
2978         /* Create a 64-bit PAR */
2979         par64 = (1 << 11); /* LPAE bit always set */
2980         if (!ret) {
2981             par64 |= phys_addr & ~0xfffULL;
2982             if (!attrs.secure) {
2983                 par64 |= (1 << 9); /* NS */
2984             }
2985             par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
2986             par64 |= cacheattrs.shareability << 7; /* SH */
2987         } else {
2988             uint32_t fsr = arm_fi_to_lfsc(&fi);
2989 
2990             par64 |= 1; /* F */
2991             par64 |= (fsr & 0x3f) << 1; /* FS */
2992             if (fi.stage2) {
2993                 par64 |= (1 << 9); /* S */
2994             }
2995             if (fi.s1ptw) {
2996                 par64 |= (1 << 8); /* PTW */
2997             }
2998         }
2999     } else {
3000         /* fsr is a DFSR/IFSR value for the short descriptor
3001          * translation table format (with WnR always clear).
3002          * Convert it to a 32-bit PAR.
3003          */
3004         if (!ret) {
3005             /* We do not set any attribute bits in the PAR */
3006             if (page_size == (1 << 24)
3007                 && arm_feature(env, ARM_FEATURE_V7)) {
3008                 par64 = (phys_addr & 0xff000000) | (1 << 1);
3009             } else {
3010                 par64 = phys_addr & 0xfffff000;
3011             }
3012             if (!attrs.secure) {
3013                 par64 |= (1 << 9); /* NS */
3014             }
3015         } else {
3016             uint32_t fsr = arm_fi_to_sfsc(&fi);
3017 
3018             par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
3019                     ((fsr & 0xf) << 1) | 1;
3020         }
3021     }
3022     return par64;
3023 }
3024 
3025 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
3026 {
3027     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3028     uint64_t par64;
3029     ARMMMUIdx mmu_idx;
3030     int el = arm_current_el(env);
3031     bool secure = arm_is_secure_below_el3(env);
3032 
3033     switch (ri->opc2 & 6) {
3034     case 0:
3035         /* stage 1 current state PL1: ATS1CPR, ATS1CPW */
3036         switch (el) {
3037         case 3:
3038             mmu_idx = ARMMMUIdx_S1E3;
3039             break;
3040         case 2:
3041             mmu_idx = ARMMMUIdx_S1NSE1;
3042             break;
3043         case 1:
3044             mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
3045             break;
3046         default:
3047             g_assert_not_reached();
3048         }
3049         break;
3050     case 2:
3051         /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
3052         switch (el) {
3053         case 3:
3054             mmu_idx = ARMMMUIdx_S1SE0;
3055             break;
3056         case 2:
3057             mmu_idx = ARMMMUIdx_S1NSE0;
3058             break;
3059         case 1:
3060             mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
3061             break;
3062         default:
3063             g_assert_not_reached();
3064         }
3065         break;
3066     case 4:
3067         /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
3068         mmu_idx = ARMMMUIdx_S12NSE1;
3069         break;
3070     case 6:
3071         /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
3072         mmu_idx = ARMMMUIdx_S12NSE0;
3073         break;
3074     default:
3075         g_assert_not_reached();
3076     }
3077 
3078     par64 = do_ats_write(env, value, access_type, mmu_idx);
3079 
3080     A32_BANKED_CURRENT_REG_SET(env, par, par64);
3081 }
3082 
3083 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
3084                         uint64_t value)
3085 {
3086     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3087     uint64_t par64;
3088 
3089     par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S1E2);
3090 
3091     A32_BANKED_CURRENT_REG_SET(env, par, par64);
3092 }
3093 
3094 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
3095                                      bool isread)
3096 {
3097     if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) {
3098         return CP_ACCESS_TRAP;
3099     }
3100     return CP_ACCESS_OK;
3101 }
3102 
3103 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
3104                         uint64_t value)
3105 {
3106     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3107     ARMMMUIdx mmu_idx;
3108     int secure = arm_is_secure_below_el3(env);
3109 
3110     switch (ri->opc2 & 6) {
3111     case 0:
3112         switch (ri->opc1) {
3113         case 0: /* AT S1E1R, AT S1E1W */
3114             mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S1NSE1;
3115             break;
3116         case 4: /* AT S1E2R, AT S1E2W */
3117             mmu_idx = ARMMMUIdx_S1E2;
3118             break;
3119         case 6: /* AT S1E3R, AT S1E3W */
3120             mmu_idx = ARMMMUIdx_S1E3;
3121             break;
3122         default:
3123             g_assert_not_reached();
3124         }
3125         break;
3126     case 2: /* AT S1E0R, AT S1E0W */
3127         mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S1NSE0;
3128         break;
3129     case 4: /* AT S12E1R, AT S12E1W */
3130         mmu_idx = secure ? ARMMMUIdx_S1SE1 : ARMMMUIdx_S12NSE1;
3131         break;
3132     case 6: /* AT S12E0R, AT S12E0W */
3133         mmu_idx = secure ? ARMMMUIdx_S1SE0 : ARMMMUIdx_S12NSE0;
3134         break;
3135     default:
3136         g_assert_not_reached();
3137     }
3138 
3139     env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx);
3140 }
3141 #endif
3142 
3143 static const ARMCPRegInfo vapa_cp_reginfo[] = {
3144     { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
3145       .access = PL1_RW, .resetvalue = 0,
3146       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
3147                              offsetoflow32(CPUARMState, cp15.par_ns) },
3148       .writefn = par_write },
3149 #ifndef CONFIG_USER_ONLY
3150     /* This underdecoding is safe because the reginfo is NO_RAW. */
3151     { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
3152       .access = PL1_W, .accessfn = ats_access,
3153       .writefn = ats_write, .type = ARM_CP_NO_RAW },
3154 #endif
3155     REGINFO_SENTINEL
3156 };
3157 
3158 /* Return basic MPU access permission bits.  */
3159 static uint32_t simple_mpu_ap_bits(uint32_t val)
3160 {
3161     uint32_t ret;
3162     uint32_t mask;
3163     int i;
3164     ret = 0;
3165     mask = 3;
3166     for (i = 0; i < 16; i += 2) {
3167         ret |= (val >> i) & mask;
3168         mask <<= 2;
3169     }
3170     return ret;
3171 }
3172 
3173 /* Pad basic MPU access permission bits to extended format.  */
3174 static uint32_t extended_mpu_ap_bits(uint32_t val)
3175 {
3176     uint32_t ret;
3177     uint32_t mask;
3178     int i;
3179     ret = 0;
3180     mask = 3;
3181     for (i = 0; i < 16; i += 2) {
3182         ret |= (val & mask) << i;
3183         mask <<= 2;
3184     }
3185     return ret;
3186 }
3187 
3188 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
3189                                  uint64_t value)
3190 {
3191     env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
3192 }
3193 
3194 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
3195 {
3196     return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
3197 }
3198 
3199 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
3200                                  uint64_t value)
3201 {
3202     env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
3203 }
3204 
3205 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
3206 {
3207     return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
3208 }
3209 
3210 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
3211 {
3212     uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
3213 
3214     if (!u32p) {
3215         return 0;
3216     }
3217 
3218     u32p += env->pmsav7.rnr[M_REG_NS];
3219     return *u32p;
3220 }
3221 
3222 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
3223                          uint64_t value)
3224 {
3225     ARMCPU *cpu = env_archcpu(env);
3226     uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
3227 
3228     if (!u32p) {
3229         return;
3230     }
3231 
3232     u32p += env->pmsav7.rnr[M_REG_NS];
3233     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
3234     *u32p = value;
3235 }
3236 
3237 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3238                               uint64_t value)
3239 {
3240     ARMCPU *cpu = env_archcpu(env);
3241     uint32_t nrgs = cpu->pmsav7_dregion;
3242 
3243     if (value >= nrgs) {
3244         qemu_log_mask(LOG_GUEST_ERROR,
3245                       "PMSAv7 RGNR write >= # supported regions, %" PRIu32
3246                       " > %" PRIu32 "\n", (uint32_t)value, nrgs);
3247         return;
3248     }
3249 
3250     raw_write(env, ri, value);
3251 }
3252 
3253 static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
3254     /* Reset for all these registers is handled in arm_cpu_reset(),
3255      * because the PMSAv7 is also used by M-profile CPUs, which do
3256      * not register cpregs but still need the state to be reset.
3257      */
3258     { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
3259       .access = PL1_RW, .type = ARM_CP_NO_RAW,
3260       .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
3261       .readfn = pmsav7_read, .writefn = pmsav7_write,
3262       .resetfn = arm_cp_reset_ignore },
3263     { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
3264       .access = PL1_RW, .type = ARM_CP_NO_RAW,
3265       .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
3266       .readfn = pmsav7_read, .writefn = pmsav7_write,
3267       .resetfn = arm_cp_reset_ignore },
3268     { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
3269       .access = PL1_RW, .type = ARM_CP_NO_RAW,
3270       .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
3271       .readfn = pmsav7_read, .writefn = pmsav7_write,
3272       .resetfn = arm_cp_reset_ignore },
3273     { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
3274       .access = PL1_RW,
3275       .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]),
3276       .writefn = pmsav7_rgnr_write,
3277       .resetfn = arm_cp_reset_ignore },
3278     REGINFO_SENTINEL
3279 };
3280 
3281 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
3282     { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
3283       .access = PL1_RW, .type = ARM_CP_ALIAS,
3284       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
3285       .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
3286     { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
3287       .access = PL1_RW, .type = ARM_CP_ALIAS,
3288       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
3289       .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
3290     { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
3291       .access = PL1_RW,
3292       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
3293       .resetvalue = 0, },
3294     { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
3295       .access = PL1_RW,
3296       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
3297       .resetvalue = 0, },
3298     { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
3299       .access = PL1_RW,
3300       .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
3301     { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
3302       .access = PL1_RW,
3303       .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
3304     /* Protection region base and size registers */
3305     { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
3306       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3307       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
3308     { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
3309       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3310       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
3311     { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
3312       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3313       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
3314     { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
3315       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3316       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
3317     { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
3318       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3319       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
3320     { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
3321       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3322       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
3323     { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
3324       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3325       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
3326     { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
3327       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
3328       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
3329     REGINFO_SENTINEL
3330 };
3331 
3332 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
3333                                  uint64_t value)
3334 {
3335     TCR *tcr = raw_ptr(env, ri);
3336     int maskshift = extract32(value, 0, 3);
3337 
3338     if (!arm_feature(env, ARM_FEATURE_V8)) {
3339         if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
3340             /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
3341              * using Long-desciptor translation table format */
3342             value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
3343         } else if (arm_feature(env, ARM_FEATURE_EL3)) {
3344             /* In an implementation that includes the Security Extensions
3345              * TTBCR has additional fields PD0 [4] and PD1 [5] for
3346              * Short-descriptor translation table format.
3347              */
3348             value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
3349         } else {
3350             value &= TTBCR_N;
3351         }
3352     }
3353 
3354     /* Update the masks corresponding to the TCR bank being written
3355      * Note that we always calculate mask and base_mask, but
3356      * they are only used for short-descriptor tables (ie if EAE is 0);
3357      * for long-descriptor tables the TCR fields are used differently
3358      * and the mask and base_mask values are meaningless.
3359      */
3360     tcr->raw_tcr = value;
3361     tcr->mask = ~(((uint32_t)0xffffffffu) >> maskshift);
3362     tcr->base_mask = ~((uint32_t)0x3fffu >> maskshift);
3363 }
3364 
3365 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3366                              uint64_t value)
3367 {
3368     ARMCPU *cpu = env_archcpu(env);
3369     TCR *tcr = raw_ptr(env, ri);
3370 
3371     if (arm_feature(env, ARM_FEATURE_LPAE)) {
3372         /* With LPAE the TTBCR could result in a change of ASID
3373          * via the TTBCR.A1 bit, so do a TLB flush.
3374          */
3375         tlb_flush(CPU(cpu));
3376     }
3377     /* Preserve the high half of TCR_EL1, set via TTBCR2.  */
3378     value = deposit64(tcr->raw_tcr, 0, 32, value);
3379     vmsa_ttbcr_raw_write(env, ri, value);
3380 }
3381 
3382 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
3383 {
3384     TCR *tcr = raw_ptr(env, ri);
3385 
3386     /* Reset both the TCR as well as the masks corresponding to the bank of
3387      * the TCR being reset.
3388      */
3389     tcr->raw_tcr = 0;
3390     tcr->mask = 0;
3391     tcr->base_mask = 0xffffc000u;
3392 }
3393 
3394 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3395                                uint64_t value)
3396 {
3397     ARMCPU *cpu = env_archcpu(env);
3398     TCR *tcr = raw_ptr(env, ri);
3399 
3400     /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
3401     tlb_flush(CPU(cpu));
3402     tcr->raw_tcr = value;
3403 }
3404 
3405 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3406                             uint64_t value)
3407 {
3408     /* If the ASID changes (with a 64-bit write), we must flush the TLB.  */
3409     if (cpreg_field_is_64bit(ri) &&
3410         extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
3411         ARMCPU *cpu = env_archcpu(env);
3412         tlb_flush(CPU(cpu));
3413     }
3414     raw_write(env, ri, value);
3415 }
3416 
3417 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3418                         uint64_t value)
3419 {
3420     ARMCPU *cpu = env_archcpu(env);
3421     CPUState *cs = CPU(cpu);
3422 
3423     /* Accesses to VTTBR may change the VMID so we must flush the TLB.  */
3424     if (raw_read(env, ri) != value) {
3425         tlb_flush_by_mmuidx(cs,
3426                             ARMMMUIdxBit_S12NSE1 |
3427                             ARMMMUIdxBit_S12NSE0 |
3428                             ARMMMUIdxBit_S2NS);
3429         raw_write(env, ri, value);
3430     }
3431 }
3432 
3433 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
3434     { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
3435       .access = PL1_RW, .type = ARM_CP_ALIAS,
3436       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
3437                              offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
3438     { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
3439       .access = PL1_RW, .resetvalue = 0,
3440       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
3441                              offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
3442     { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
3443       .access = PL1_RW, .resetvalue = 0,
3444       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
3445                              offsetof(CPUARMState, cp15.dfar_ns) } },
3446     { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
3447       .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
3448       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
3449       .resetvalue = 0, },
3450     REGINFO_SENTINEL
3451 };
3452 
3453 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
3454     { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
3455       .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
3456       .access = PL1_RW,
3457       .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
3458     { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
3459       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
3460       .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3461       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
3462                              offsetof(CPUARMState, cp15.ttbr0_ns) } },
3463     { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
3464       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
3465       .access = PL1_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
3466       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
3467                              offsetof(CPUARMState, cp15.ttbr1_ns) } },
3468     { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
3469       .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
3470       .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
3471       .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
3472       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
3473     { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
3474       .access = PL1_RW, .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
3475       .raw_writefn = vmsa_ttbcr_raw_write,
3476       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
3477                              offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
3478     REGINFO_SENTINEL
3479 };
3480 
3481 /* Note that unlike TTBCR, writing to TTBCR2 does not require flushing
3482  * qemu tlbs nor adjusting cached masks.
3483  */
3484 static const ARMCPRegInfo ttbcr2_reginfo = {
3485     .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3,
3486     .access = PL1_RW, .type = ARM_CP_ALIAS,
3487     .bank_fieldoffsets = { offsetofhigh32(CPUARMState, cp15.tcr_el[3]),
3488                            offsetofhigh32(CPUARMState, cp15.tcr_el[1]) },
3489 };
3490 
3491 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
3492                                 uint64_t value)
3493 {
3494     env->cp15.c15_ticonfig = value & 0xe7;
3495     /* The OS_TYPE bit in this register changes the reported CPUID! */
3496     env->cp15.c0_cpuid = (value & (1 << 5)) ?
3497         ARM_CPUID_TI915T : ARM_CPUID_TI925T;
3498 }
3499 
3500 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
3501                                 uint64_t value)
3502 {
3503     env->cp15.c15_threadid = value & 0xffff;
3504 }
3505 
3506 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
3507                            uint64_t value)
3508 {
3509     /* Wait-for-interrupt (deprecated) */
3510     cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT);
3511 }
3512 
3513 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
3514                                   uint64_t value)
3515 {
3516     /* On OMAP there are registers indicating the max/min index of dcache lines
3517      * containing a dirty line; cache flush operations have to reset these.
3518      */
3519     env->cp15.c15_i_max = 0x000;
3520     env->cp15.c15_i_min = 0xff0;
3521 }
3522 
3523 static const ARMCPRegInfo omap_cp_reginfo[] = {
3524     { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
3525       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
3526       .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
3527       .resetvalue = 0, },
3528     { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
3529       .access = PL1_RW, .type = ARM_CP_NOP },
3530     { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
3531       .access = PL1_RW,
3532       .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
3533       .writefn = omap_ticonfig_write },
3534     { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
3535       .access = PL1_RW,
3536       .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
3537     { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
3538       .access = PL1_RW, .resetvalue = 0xff0,
3539       .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
3540     { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
3541       .access = PL1_RW,
3542       .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
3543       .writefn = omap_threadid_write },
3544     { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
3545       .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
3546       .type = ARM_CP_NO_RAW,
3547       .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
3548     /* TODO: Peripheral port remap register:
3549      * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
3550      * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
3551      * when MMU is off.
3552      */
3553     { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
3554       .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
3555       .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW,
3556       .writefn = omap_cachemaint_write },
3557     { .name = "C9", .cp = 15, .crn = 9,
3558       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
3559       .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
3560     REGINFO_SENTINEL
3561 };
3562 
3563 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
3564                               uint64_t value)
3565 {
3566     env->cp15.c15_cpar = value & 0x3fff;
3567 }
3568 
3569 static const ARMCPRegInfo xscale_cp_reginfo[] = {
3570     { .name = "XSCALE_CPAR",
3571       .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
3572       .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
3573       .writefn = xscale_cpar_write, },
3574     { .name = "XSCALE_AUXCR",
3575       .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
3576       .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
3577       .resetvalue = 0, },
3578     /* XScale specific cache-lockdown: since we have no cache we NOP these
3579      * and hope the guest does not really rely on cache behaviour.
3580      */
3581     { .name = "XSCALE_LOCK_ICACHE_LINE",
3582       .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
3583       .access = PL1_W, .type = ARM_CP_NOP },
3584     { .name = "XSCALE_UNLOCK_ICACHE",
3585       .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
3586       .access = PL1_W, .type = ARM_CP_NOP },
3587     { .name = "XSCALE_DCACHE_LOCK",
3588       .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
3589       .access = PL1_RW, .type = ARM_CP_NOP },
3590     { .name = "XSCALE_UNLOCK_DCACHE",
3591       .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
3592       .access = PL1_W, .type = ARM_CP_NOP },
3593     REGINFO_SENTINEL
3594 };
3595 
3596 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
3597     /* RAZ/WI the whole crn=15 space, when we don't have a more specific
3598      * implementation of this implementation-defined space.
3599      * Ideally this should eventually disappear in favour of actually
3600      * implementing the correct behaviour for all cores.
3601      */
3602     { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
3603       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
3604       .access = PL1_RW,
3605       .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
3606       .resetvalue = 0 },
3607     REGINFO_SENTINEL
3608 };
3609 
3610 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
3611     /* Cache status: RAZ because we have no cache so it's always clean */
3612     { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
3613       .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3614       .resetvalue = 0 },
3615     REGINFO_SENTINEL
3616 };
3617 
3618 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
3619     /* We never have a a block transfer operation in progress */
3620     { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
3621       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3622       .resetvalue = 0 },
3623     /* The cache ops themselves: these all NOP for QEMU */
3624     { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
3625       .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3626     { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
3627       .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3628     { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
3629       .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3630     { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
3631       .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3632     { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
3633       .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3634     { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
3635       .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
3636     REGINFO_SENTINEL
3637 };
3638 
3639 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
3640     /* The cache test-and-clean instructions always return (1 << 30)
3641      * to indicate that there are no dirty cache lines.
3642      */
3643     { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
3644       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3645       .resetvalue = (1 << 30) },
3646     { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
3647       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
3648       .resetvalue = (1 << 30) },
3649     REGINFO_SENTINEL
3650 };
3651 
3652 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
3653     /* Ignore ReadBuffer accesses */
3654     { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
3655       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
3656       .access = PL1_RW, .resetvalue = 0,
3657       .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
3658     REGINFO_SENTINEL
3659 };
3660 
3661 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3662 {
3663     ARMCPU *cpu = env_archcpu(env);
3664     unsigned int cur_el = arm_current_el(env);
3665     bool secure = arm_is_secure(env);
3666 
3667     if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
3668         return env->cp15.vpidr_el2;
3669     }
3670     return raw_read(env, ri);
3671 }
3672 
3673 static uint64_t mpidr_read_val(CPUARMState *env)
3674 {
3675     ARMCPU *cpu = env_archcpu(env);
3676     uint64_t mpidr = cpu->mp_affinity;
3677 
3678     if (arm_feature(env, ARM_FEATURE_V7MP)) {
3679         mpidr |= (1U << 31);
3680         /* Cores which are uniprocessor (non-coherent)
3681          * but still implement the MP extensions set
3682          * bit 30. (For instance, Cortex-R5).
3683          */
3684         if (cpu->mp_is_up) {
3685             mpidr |= (1u << 30);
3686         }
3687     }
3688     return mpidr;
3689 }
3690 
3691 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3692 {
3693     unsigned int cur_el = arm_current_el(env);
3694     bool secure = arm_is_secure(env);
3695 
3696     if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
3697         return env->cp15.vmpidr_el2;
3698     }
3699     return mpidr_read_val(env);
3700 }
3701 
3702 static const ARMCPRegInfo lpae_cp_reginfo[] = {
3703     /* NOP AMAIR0/1 */
3704     { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
3705       .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
3706       .access = PL1_RW, .type = ARM_CP_CONST,
3707       .resetvalue = 0 },
3708     /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
3709     { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
3710       .access = PL1_RW, .type = ARM_CP_CONST,
3711       .resetvalue = 0 },
3712     { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
3713       .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
3714       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
3715                              offsetof(CPUARMState, cp15.par_ns)} },
3716     { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
3717       .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3718       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
3719                              offsetof(CPUARMState, cp15.ttbr0_ns) },
3720       .writefn = vmsa_ttbr_write, },
3721     { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
3722       .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
3723       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
3724                              offsetof(CPUARMState, cp15.ttbr1_ns) },
3725       .writefn = vmsa_ttbr_write, },
3726     REGINFO_SENTINEL
3727 };
3728 
3729 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3730 {
3731     return vfp_get_fpcr(env);
3732 }
3733 
3734 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3735                             uint64_t value)
3736 {
3737     vfp_set_fpcr(env, value);
3738 }
3739 
3740 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
3741 {
3742     return vfp_get_fpsr(env);
3743 }
3744 
3745 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
3746                             uint64_t value)
3747 {
3748     vfp_set_fpsr(env, value);
3749 }
3750 
3751 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri,
3752                                        bool isread)
3753 {
3754     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UMA)) {
3755         return CP_ACCESS_TRAP;
3756     }
3757     return CP_ACCESS_OK;
3758 }
3759 
3760 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
3761                             uint64_t value)
3762 {
3763     env->daif = value & PSTATE_DAIF;
3764 }
3765 
3766 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
3767                                           const ARMCPRegInfo *ri,
3768                                           bool isread)
3769 {
3770     /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
3771      * SCTLR_EL1.UCI is set.
3772      */
3773     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCI)) {
3774         return CP_ACCESS_TRAP;
3775     }
3776     return CP_ACCESS_OK;
3777 }
3778 
3779 /* See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
3780  * Page D4-1736 (DDI0487A.b)
3781  */
3782 
3783 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3784                                       uint64_t value)
3785 {
3786     CPUState *cs = env_cpu(env);
3787     bool sec = arm_is_secure_below_el3(env);
3788 
3789     if (sec) {
3790         tlb_flush_by_mmuidx_all_cpus_synced(cs,
3791                                             ARMMMUIdxBit_S1SE1 |
3792                                             ARMMMUIdxBit_S1SE0);
3793     } else {
3794         tlb_flush_by_mmuidx_all_cpus_synced(cs,
3795                                             ARMMMUIdxBit_S12NSE1 |
3796                                             ARMMMUIdxBit_S12NSE0);
3797     }
3798 }
3799 
3800 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3801                                     uint64_t value)
3802 {
3803     CPUState *cs = env_cpu(env);
3804 
3805     if (tlb_force_broadcast(env)) {
3806         tlbi_aa64_vmalle1is_write(env, NULL, value);
3807         return;
3808     }
3809 
3810     if (arm_is_secure_below_el3(env)) {
3811         tlb_flush_by_mmuidx(cs,
3812                             ARMMMUIdxBit_S1SE1 |
3813                             ARMMMUIdxBit_S1SE0);
3814     } else {
3815         tlb_flush_by_mmuidx(cs,
3816                             ARMMMUIdxBit_S12NSE1 |
3817                             ARMMMUIdxBit_S12NSE0);
3818     }
3819 }
3820 
3821 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3822                                   uint64_t value)
3823 {
3824     /* Note that the 'ALL' scope must invalidate both stage 1 and
3825      * stage 2 translations, whereas most other scopes only invalidate
3826      * stage 1 translations.
3827      */
3828     ARMCPU *cpu = env_archcpu(env);
3829     CPUState *cs = CPU(cpu);
3830 
3831     if (arm_is_secure_below_el3(env)) {
3832         tlb_flush_by_mmuidx(cs,
3833                             ARMMMUIdxBit_S1SE1 |
3834                             ARMMMUIdxBit_S1SE0);
3835     } else {
3836         if (arm_feature(env, ARM_FEATURE_EL2)) {
3837             tlb_flush_by_mmuidx(cs,
3838                                 ARMMMUIdxBit_S12NSE1 |
3839                                 ARMMMUIdxBit_S12NSE0 |
3840                                 ARMMMUIdxBit_S2NS);
3841         } else {
3842             tlb_flush_by_mmuidx(cs,
3843                                 ARMMMUIdxBit_S12NSE1 |
3844                                 ARMMMUIdxBit_S12NSE0);
3845         }
3846     }
3847 }
3848 
3849 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
3850                                   uint64_t value)
3851 {
3852     ARMCPU *cpu = env_archcpu(env);
3853     CPUState *cs = CPU(cpu);
3854 
3855     tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
3856 }
3857 
3858 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
3859                                   uint64_t value)
3860 {
3861     ARMCPU *cpu = env_archcpu(env);
3862     CPUState *cs = CPU(cpu);
3863 
3864     tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3);
3865 }
3866 
3867 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3868                                     uint64_t value)
3869 {
3870     /* Note that the 'ALL' scope must invalidate both stage 1 and
3871      * stage 2 translations, whereas most other scopes only invalidate
3872      * stage 1 translations.
3873      */
3874     CPUState *cs = env_cpu(env);
3875     bool sec = arm_is_secure_below_el3(env);
3876     bool has_el2 = arm_feature(env, ARM_FEATURE_EL2);
3877 
3878     if (sec) {
3879         tlb_flush_by_mmuidx_all_cpus_synced(cs,
3880                                             ARMMMUIdxBit_S1SE1 |
3881                                             ARMMMUIdxBit_S1SE0);
3882     } else if (has_el2) {
3883         tlb_flush_by_mmuidx_all_cpus_synced(cs,
3884                                             ARMMMUIdxBit_S12NSE1 |
3885                                             ARMMMUIdxBit_S12NSE0 |
3886                                             ARMMMUIdxBit_S2NS);
3887     } else {
3888           tlb_flush_by_mmuidx_all_cpus_synced(cs,
3889                                               ARMMMUIdxBit_S12NSE1 |
3890                                               ARMMMUIdxBit_S12NSE0);
3891     }
3892 }
3893 
3894 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3895                                     uint64_t value)
3896 {
3897     CPUState *cs = env_cpu(env);
3898 
3899     tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
3900 }
3901 
3902 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3903                                     uint64_t value)
3904 {
3905     CPUState *cs = env_cpu(env);
3906 
3907     tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3);
3908 }
3909 
3910 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
3911                                  uint64_t value)
3912 {
3913     /* Invalidate by VA, EL2
3914      * Currently handles both VAE2 and VALE2, since we don't support
3915      * flush-last-level-only.
3916      */
3917     ARMCPU *cpu = env_archcpu(env);
3918     CPUState *cs = CPU(cpu);
3919     uint64_t pageaddr = sextract64(value << 12, 0, 56);
3920 
3921     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
3922 }
3923 
3924 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
3925                                  uint64_t value)
3926 {
3927     /* Invalidate by VA, EL3
3928      * Currently handles both VAE3 and VALE3, since we don't support
3929      * flush-last-level-only.
3930      */
3931     ARMCPU *cpu = env_archcpu(env);
3932     CPUState *cs = CPU(cpu);
3933     uint64_t pageaddr = sextract64(value << 12, 0, 56);
3934 
3935     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3);
3936 }
3937 
3938 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3939                                    uint64_t value)
3940 {
3941     ARMCPU *cpu = env_archcpu(env);
3942     CPUState *cs = CPU(cpu);
3943     bool sec = arm_is_secure_below_el3(env);
3944     uint64_t pageaddr = sextract64(value << 12, 0, 56);
3945 
3946     if (sec) {
3947         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
3948                                                  ARMMMUIdxBit_S1SE1 |
3949                                                  ARMMMUIdxBit_S1SE0);
3950     } else {
3951         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
3952                                                  ARMMMUIdxBit_S12NSE1 |
3953                                                  ARMMMUIdxBit_S12NSE0);
3954     }
3955 }
3956 
3957 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
3958                                  uint64_t value)
3959 {
3960     /* Invalidate by VA, EL1&0 (AArch64 version).
3961      * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1,
3962      * since we don't support flush-for-specific-ASID-only or
3963      * flush-last-level-only.
3964      */
3965     ARMCPU *cpu = env_archcpu(env);
3966     CPUState *cs = CPU(cpu);
3967     uint64_t pageaddr = sextract64(value << 12, 0, 56);
3968 
3969     if (tlb_force_broadcast(env)) {
3970         tlbi_aa64_vae1is_write(env, NULL, value);
3971         return;
3972     }
3973 
3974     if (arm_is_secure_below_el3(env)) {
3975         tlb_flush_page_by_mmuidx(cs, pageaddr,
3976                                  ARMMMUIdxBit_S1SE1 |
3977                                  ARMMMUIdxBit_S1SE0);
3978     } else {
3979         tlb_flush_page_by_mmuidx(cs, pageaddr,
3980                                  ARMMMUIdxBit_S12NSE1 |
3981                                  ARMMMUIdxBit_S12NSE0);
3982     }
3983 }
3984 
3985 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3986                                    uint64_t value)
3987 {
3988     CPUState *cs = env_cpu(env);
3989     uint64_t pageaddr = sextract64(value << 12, 0, 56);
3990 
3991     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
3992                                              ARMMMUIdxBit_S1E2);
3993 }
3994 
3995 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
3996                                    uint64_t value)
3997 {
3998     CPUState *cs = env_cpu(env);
3999     uint64_t pageaddr = sextract64(value << 12, 0, 56);
4000 
4001     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4002                                              ARMMMUIdxBit_S1E3);
4003 }
4004 
4005 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
4006                                     uint64_t value)
4007 {
4008     /* Invalidate by IPA. This has to invalidate any structures that
4009      * contain only stage 2 translation information, but does not need
4010      * to apply to structures that contain combined stage 1 and stage 2
4011      * translation information.
4012      * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
4013      */
4014     ARMCPU *cpu = env_archcpu(env);
4015     CPUState *cs = CPU(cpu);
4016     uint64_t pageaddr;
4017 
4018     if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
4019         return;
4020     }
4021 
4022     pageaddr = sextract64(value << 12, 0, 48);
4023 
4024     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
4025 }
4026 
4027 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4028                                       uint64_t value)
4029 {
4030     CPUState *cs = env_cpu(env);
4031     uint64_t pageaddr;
4032 
4033     if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
4034         return;
4035     }
4036 
4037     pageaddr = sextract64(value << 12, 0, 48);
4038 
4039     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
4040                                              ARMMMUIdxBit_S2NS);
4041 }
4042 
4043 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
4044                                       bool isread)
4045 {
4046     /* We don't implement EL2, so the only control on DC ZVA is the
4047      * bit in the SCTLR which can prohibit access for EL0.
4048      */
4049     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
4050         return CP_ACCESS_TRAP;
4051     }
4052     return CP_ACCESS_OK;
4053 }
4054 
4055 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
4056 {
4057     ARMCPU *cpu = env_archcpu(env);
4058     int dzp_bit = 1 << 4;
4059 
4060     /* DZP indicates whether DC ZVA access is allowed */
4061     if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) {
4062         dzp_bit = 0;
4063     }
4064     return cpu->dcz_blocksize | dzp_bit;
4065 }
4066 
4067 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
4068                                     bool isread)
4069 {
4070     if (!(env->pstate & PSTATE_SP)) {
4071         /* Access to SP_EL0 is undefined if it's being used as
4072          * the stack pointer.
4073          */
4074         return CP_ACCESS_TRAP_UNCATEGORIZED;
4075     }
4076     return CP_ACCESS_OK;
4077 }
4078 
4079 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
4080 {
4081     return env->pstate & PSTATE_SP;
4082 }
4083 
4084 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
4085 {
4086     update_spsel(env, val);
4087 }
4088 
4089 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4090                         uint64_t value)
4091 {
4092     ARMCPU *cpu = env_archcpu(env);
4093 
4094     if (raw_read(env, ri) == value) {
4095         /* Skip the TLB flush if nothing actually changed; Linux likes
4096          * to do a lot of pointless SCTLR writes.
4097          */
4098         return;
4099     }
4100 
4101     if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
4102         /* M bit is RAZ/WI for PMSA with no MPU implemented */
4103         value &= ~SCTLR_M;
4104     }
4105 
4106     raw_write(env, ri, value);
4107     /* ??? Lots of these bits are not implemented.  */
4108     /* This may enable/disable the MMU, so do a TLB flush.  */
4109     tlb_flush(CPU(cpu));
4110 }
4111 
4112 static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri,
4113                                      bool isread)
4114 {
4115     if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) {
4116         return CP_ACCESS_TRAP_FP_EL2;
4117     }
4118     if (env->cp15.cptr_el[3] & CPTR_TFP) {
4119         return CP_ACCESS_TRAP_FP_EL3;
4120     }
4121     return CP_ACCESS_OK;
4122 }
4123 
4124 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4125                        uint64_t value)
4126 {
4127     env->cp15.mdcr_el3 = value & SDCR_VALID_MASK;
4128 }
4129 
4130 static const ARMCPRegInfo v8_cp_reginfo[] = {
4131     /* Minimal set of EL0-visible registers. This will need to be expanded
4132      * significantly for system emulation of AArch64 CPUs.
4133      */
4134     { .name = "NZCV", .state = ARM_CP_STATE_AA64,
4135       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
4136       .access = PL0_RW, .type = ARM_CP_NZCV },
4137     { .name = "DAIF", .state = ARM_CP_STATE_AA64,
4138       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
4139       .type = ARM_CP_NO_RAW,
4140       .access = PL0_RW, .accessfn = aa64_daif_access,
4141       .fieldoffset = offsetof(CPUARMState, daif),
4142       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
4143     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
4144       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
4145       .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
4146       .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
4147     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
4148       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
4149       .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
4150       .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
4151     { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
4152       .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
4153       .access = PL0_R, .type = ARM_CP_NO_RAW,
4154       .readfn = aa64_dczid_read },
4155     { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
4156       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
4157       .access = PL0_W, .type = ARM_CP_DC_ZVA,
4158 #ifndef CONFIG_USER_ONLY
4159       /* Avoid overhead of an access check that always passes in user-mode */
4160       .accessfn = aa64_zva_access,
4161 #endif
4162     },
4163     { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
4164       .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
4165       .access = PL1_R, .type = ARM_CP_CURRENTEL },
4166     /* Cache ops: all NOPs since we don't emulate caches */
4167     { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
4168       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
4169       .access = PL1_W, .type = ARM_CP_NOP },
4170     { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
4171       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
4172       .access = PL1_W, .type = ARM_CP_NOP },
4173     { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
4174       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
4175       .access = PL0_W, .type = ARM_CP_NOP,
4176       .accessfn = aa64_cacheop_access },
4177     { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
4178       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
4179       .access = PL1_W, .type = ARM_CP_NOP },
4180     { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
4181       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
4182       .access = PL1_W, .type = ARM_CP_NOP },
4183     { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
4184       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
4185       .access = PL0_W, .type = ARM_CP_NOP,
4186       .accessfn = aa64_cacheop_access },
4187     { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
4188       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
4189       .access = PL1_W, .type = ARM_CP_NOP },
4190     { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
4191       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
4192       .access = PL0_W, .type = ARM_CP_NOP,
4193       .accessfn = aa64_cacheop_access },
4194     { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
4195       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
4196       .access = PL0_W, .type = ARM_CP_NOP,
4197       .accessfn = aa64_cacheop_access },
4198     { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
4199       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
4200       .access = PL1_W, .type = ARM_CP_NOP },
4201     /* TLBI operations */
4202     { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
4203       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
4204       .access = PL1_W, .type = ARM_CP_NO_RAW,
4205       .writefn = tlbi_aa64_vmalle1is_write },
4206     { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
4207       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
4208       .access = PL1_W, .type = ARM_CP_NO_RAW,
4209       .writefn = tlbi_aa64_vae1is_write },
4210     { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
4211       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
4212       .access = PL1_W, .type = ARM_CP_NO_RAW,
4213       .writefn = tlbi_aa64_vmalle1is_write },
4214     { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
4215       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
4216       .access = PL1_W, .type = ARM_CP_NO_RAW,
4217       .writefn = tlbi_aa64_vae1is_write },
4218     { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
4219       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
4220       .access = PL1_W, .type = ARM_CP_NO_RAW,
4221       .writefn = tlbi_aa64_vae1is_write },
4222     { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
4223       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
4224       .access = PL1_W, .type = ARM_CP_NO_RAW,
4225       .writefn = tlbi_aa64_vae1is_write },
4226     { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
4227       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
4228       .access = PL1_W, .type = ARM_CP_NO_RAW,
4229       .writefn = tlbi_aa64_vmalle1_write },
4230     { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
4231       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
4232       .access = PL1_W, .type = ARM_CP_NO_RAW,
4233       .writefn = tlbi_aa64_vae1_write },
4234     { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
4235       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
4236       .access = PL1_W, .type = ARM_CP_NO_RAW,
4237       .writefn = tlbi_aa64_vmalle1_write },
4238     { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
4239       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
4240       .access = PL1_W, .type = ARM_CP_NO_RAW,
4241       .writefn = tlbi_aa64_vae1_write },
4242     { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
4243       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
4244       .access = PL1_W, .type = ARM_CP_NO_RAW,
4245       .writefn = tlbi_aa64_vae1_write },
4246     { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
4247       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
4248       .access = PL1_W, .type = ARM_CP_NO_RAW,
4249       .writefn = tlbi_aa64_vae1_write },
4250     { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
4251       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
4252       .access = PL2_W, .type = ARM_CP_NO_RAW,
4253       .writefn = tlbi_aa64_ipas2e1is_write },
4254     { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
4255       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
4256       .access = PL2_W, .type = ARM_CP_NO_RAW,
4257       .writefn = tlbi_aa64_ipas2e1is_write },
4258     { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
4259       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
4260       .access = PL2_W, .type = ARM_CP_NO_RAW,
4261       .writefn = tlbi_aa64_alle1is_write },
4262     { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64,
4263       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6,
4264       .access = PL2_W, .type = ARM_CP_NO_RAW,
4265       .writefn = tlbi_aa64_alle1is_write },
4266     { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
4267       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
4268       .access = PL2_W, .type = ARM_CP_NO_RAW,
4269       .writefn = tlbi_aa64_ipas2e1_write },
4270     { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
4271       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
4272       .access = PL2_W, .type = ARM_CP_NO_RAW,
4273       .writefn = tlbi_aa64_ipas2e1_write },
4274     { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
4275       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
4276       .access = PL2_W, .type = ARM_CP_NO_RAW,
4277       .writefn = tlbi_aa64_alle1_write },
4278     { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64,
4279       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6,
4280       .access = PL2_W, .type = ARM_CP_NO_RAW,
4281       .writefn = tlbi_aa64_alle1is_write },
4282 #ifndef CONFIG_USER_ONLY
4283     /* 64 bit address translation operations */
4284     { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
4285       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
4286       .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4287     { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
4288       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
4289       .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4290     { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
4291       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
4292       .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4293     { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
4294       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
4295       .access = PL1_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4296     { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
4297       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
4298       .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4299     { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
4300       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
4301       .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4302     { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
4303       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
4304       .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4305     { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
4306       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
4307       .access = PL2_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4308     /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
4309     { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
4310       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
4311       .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4312     { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
4313       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
4314       .access = PL3_W, .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4315     { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
4316       .type = ARM_CP_ALIAS,
4317       .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
4318       .access = PL1_RW, .resetvalue = 0,
4319       .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
4320       .writefn = par_write },
4321 #endif
4322     /* TLB invalidate last level of translation table walk */
4323     { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
4324       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_is_write },
4325     { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
4326       .type = ARM_CP_NO_RAW, .access = PL1_W,
4327       .writefn = tlbimvaa_is_write },
4328     { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
4329       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimva_write },
4330     { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
4331       .type = ARM_CP_NO_RAW, .access = PL1_W, .writefn = tlbimvaa_write },
4332     { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
4333       .type = ARM_CP_NO_RAW, .access = PL2_W,
4334       .writefn = tlbimva_hyp_write },
4335     { .name = "TLBIMVALHIS",
4336       .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
4337       .type = ARM_CP_NO_RAW, .access = PL2_W,
4338       .writefn = tlbimva_hyp_is_write },
4339     { .name = "TLBIIPAS2",
4340       .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
4341       .type = ARM_CP_NO_RAW, .access = PL2_W,
4342       .writefn = tlbiipas2_write },
4343     { .name = "TLBIIPAS2IS",
4344       .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
4345       .type = ARM_CP_NO_RAW, .access = PL2_W,
4346       .writefn = tlbiipas2_is_write },
4347     { .name = "TLBIIPAS2L",
4348       .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
4349       .type = ARM_CP_NO_RAW, .access = PL2_W,
4350       .writefn = tlbiipas2_write },
4351     { .name = "TLBIIPAS2LIS",
4352       .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
4353       .type = ARM_CP_NO_RAW, .access = PL2_W,
4354       .writefn = tlbiipas2_is_write },
4355     /* 32 bit cache operations */
4356     { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
4357       .type = ARM_CP_NOP, .access = PL1_W },
4358     { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
4359       .type = ARM_CP_NOP, .access = PL1_W },
4360     { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
4361       .type = ARM_CP_NOP, .access = PL1_W },
4362     { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
4363       .type = ARM_CP_NOP, .access = PL1_W },
4364     { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
4365       .type = ARM_CP_NOP, .access = PL1_W },
4366     { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
4367       .type = ARM_CP_NOP, .access = PL1_W },
4368     { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
4369       .type = ARM_CP_NOP, .access = PL1_W },
4370     { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
4371       .type = ARM_CP_NOP, .access = PL1_W },
4372     { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
4373       .type = ARM_CP_NOP, .access = PL1_W },
4374     { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
4375       .type = ARM_CP_NOP, .access = PL1_W },
4376     { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
4377       .type = ARM_CP_NOP, .access = PL1_W },
4378     { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
4379       .type = ARM_CP_NOP, .access = PL1_W },
4380     { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
4381       .type = ARM_CP_NOP, .access = PL1_W },
4382     /* MMU Domain access control / MPU write buffer control */
4383     { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
4384       .access = PL1_RW, .resetvalue = 0,
4385       .writefn = dacr_write, .raw_writefn = raw_write,
4386       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
4387                              offsetoflow32(CPUARMState, cp15.dacr_ns) } },
4388     { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
4389       .type = ARM_CP_ALIAS,
4390       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
4391       .access = PL1_RW,
4392       .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
4393     { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
4394       .type = ARM_CP_ALIAS,
4395       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
4396       .access = PL1_RW,
4397       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) },
4398     /* We rely on the access checks not allowing the guest to write to the
4399      * state field when SPSel indicates that it's being used as the stack
4400      * pointer.
4401      */
4402     { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
4403       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
4404       .access = PL1_RW, .accessfn = sp_el0_access,
4405       .type = ARM_CP_ALIAS,
4406       .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
4407     { .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
4408       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
4409       .access = PL2_RW, .type = ARM_CP_ALIAS,
4410       .fieldoffset = offsetof(CPUARMState, sp_el[1]) },
4411     { .name = "SPSel", .state = ARM_CP_STATE_AA64,
4412       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
4413       .type = ARM_CP_NO_RAW,
4414       .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
4415     { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64,
4416       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0,
4417       .type = ARM_CP_ALIAS,
4418       .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]),
4419       .access = PL2_RW, .accessfn = fpexc32_access },
4420     { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
4421       .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
4422       .access = PL2_RW, .resetvalue = 0,
4423       .writefn = dacr_write, .raw_writefn = raw_write,
4424       .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
4425     { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
4426       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
4427       .access = PL2_RW, .resetvalue = 0,
4428       .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
4429     { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64,
4430       .type = ARM_CP_ALIAS,
4431       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0,
4432       .access = PL2_RW,
4433       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) },
4434     { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64,
4435       .type = ARM_CP_ALIAS,
4436       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1,
4437       .access = PL2_RW,
4438       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) },
4439     { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64,
4440       .type = ARM_CP_ALIAS,
4441       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2,
4442       .access = PL2_RW,
4443       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) },
4444     { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64,
4445       .type = ARM_CP_ALIAS,
4446       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3,
4447       .access = PL2_RW,
4448       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) },
4449     { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64,
4450       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1,
4451       .resetvalue = 0,
4452       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) },
4453     { .name = "SDCR", .type = ARM_CP_ALIAS,
4454       .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1,
4455       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
4456       .writefn = sdcr_write,
4457       .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
4458     REGINFO_SENTINEL
4459 };
4460 
4461 /* Used to describe the behaviour of EL2 regs when EL2 does not exist.  */
4462 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
4463     { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
4464       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
4465       .access = PL2_RW,
4466       .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
4467     { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH,
4468       .type = ARM_CP_NO_RAW,
4469       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4470       .access = PL2_RW,
4471       .type = ARM_CP_CONST, .resetvalue = 0 },
4472     { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
4473       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
4474       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4475     { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
4476       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
4477       .access = PL2_RW,
4478       .type = ARM_CP_CONST, .resetvalue = 0 },
4479     { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
4480       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
4481       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4482     { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
4483       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
4484       .access = PL2_RW, .type = ARM_CP_CONST,
4485       .resetvalue = 0 },
4486     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
4487       .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
4488       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4489     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
4490       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
4491       .access = PL2_RW, .type = ARM_CP_CONST,
4492       .resetvalue = 0 },
4493     { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
4494       .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
4495       .access = PL2_RW, .type = ARM_CP_CONST,
4496       .resetvalue = 0 },
4497     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
4498       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
4499       .access = PL2_RW, .type = ARM_CP_CONST,
4500       .resetvalue = 0 },
4501     { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
4502       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
4503       .access = PL2_RW, .type = ARM_CP_CONST,
4504       .resetvalue = 0 },
4505     { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
4506       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
4507       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4508     { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,
4509       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4510       .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4511       .type = ARM_CP_CONST, .resetvalue = 0 },
4512     { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
4513       .cp = 15, .opc1 = 6, .crm = 2,
4514       .access = PL2_RW, .accessfn = access_el3_aa32ns,
4515       .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
4516     { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
4517       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
4518       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4519     { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
4520       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
4521       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4522     { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4523       .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
4524       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4525     { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
4526       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
4527       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4528     { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
4529       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4530       .resetvalue = 0 },
4531     { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
4532       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
4533       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4534     { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
4535       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
4536       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4537     { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
4538       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4539       .resetvalue = 0 },
4540     { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
4541       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
4542       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4543     { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
4544       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
4545       .resetvalue = 0 },
4546     { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
4547       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
4548       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4549     { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
4550       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
4551       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4552     { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
4553       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
4554       .access = PL2_RW, .accessfn = access_tda,
4555       .type = ARM_CP_CONST, .resetvalue = 0 },
4556     { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH,
4557       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4558       .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
4559       .type = ARM_CP_CONST, .resetvalue = 0 },
4560     { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
4561       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
4562       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4563     { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
4564       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
4565       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4566     { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
4567       .type = ARM_CP_CONST,
4568       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
4569       .access = PL2_RW, .resetvalue = 0 },
4570     REGINFO_SENTINEL
4571 };
4572 
4573 /* Ditto, but for registers which exist in ARMv8 but not v7 */
4574 static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
4575     { .name = "HCR2", .state = ARM_CP_STATE_AA32,
4576       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
4577       .access = PL2_RW,
4578       .type = ARM_CP_CONST, .resetvalue = 0 },
4579     REGINFO_SENTINEL
4580 };
4581 
4582 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
4583 {
4584     ARMCPU *cpu = env_archcpu(env);
4585     uint64_t valid_mask = HCR_MASK;
4586 
4587     if (arm_feature(env, ARM_FEATURE_EL3)) {
4588         valid_mask &= ~HCR_HCD;
4589     } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
4590         /* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
4591          * However, if we're using the SMC PSCI conduit then QEMU is
4592          * effectively acting like EL3 firmware and so the guest at
4593          * EL2 should retain the ability to prevent EL1 from being
4594          * able to make SMC calls into the ersatz firmware, so in
4595          * that case HCR.TSC should be read/write.
4596          */
4597         valid_mask &= ~HCR_TSC;
4598     }
4599     if (cpu_isar_feature(aa64_lor, cpu)) {
4600         valid_mask |= HCR_TLOR;
4601     }
4602     if (cpu_isar_feature(aa64_pauth, cpu)) {
4603         valid_mask |= HCR_API | HCR_APK;
4604     }
4605 
4606     /* Clear RES0 bits.  */
4607     value &= valid_mask;
4608 
4609     /* These bits change the MMU setup:
4610      * HCR_VM enables stage 2 translation
4611      * HCR_PTW forbids certain page-table setups
4612      * HCR_DC Disables stage1 and enables stage2 translation
4613      */
4614     if ((env->cp15.hcr_el2 ^ value) & (HCR_VM | HCR_PTW | HCR_DC)) {
4615         tlb_flush(CPU(cpu));
4616     }
4617     env->cp15.hcr_el2 = value;
4618 
4619     /*
4620      * Updates to VI and VF require us to update the status of
4621      * virtual interrupts, which are the logical OR of these bits
4622      * and the state of the input lines from the GIC. (This requires
4623      * that we have the iothread lock, which is done by marking the
4624      * reginfo structs as ARM_CP_IO.)
4625      * Note that if a write to HCR pends a VIRQ or VFIQ it is never
4626      * possible for it to be taken immediately, because VIRQ and
4627      * VFIQ are masked unless running at EL0 or EL1, and HCR
4628      * can only be written at EL2.
4629      */
4630     g_assert(qemu_mutex_iothread_locked());
4631     arm_cpu_update_virq(cpu);
4632     arm_cpu_update_vfiq(cpu);
4633 }
4634 
4635 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri,
4636                           uint64_t value)
4637 {
4638     /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */
4639     value = deposit64(env->cp15.hcr_el2, 32, 32, value);
4640     hcr_write(env, NULL, value);
4641 }
4642 
4643 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
4644                          uint64_t value)
4645 {
4646     /* Handle HCR write, i.e. write to low half of HCR_EL2 */
4647     value = deposit64(env->cp15.hcr_el2, 0, 32, value);
4648     hcr_write(env, NULL, value);
4649 }
4650 
4651 /*
4652  * Return the effective value of HCR_EL2.
4653  * Bits that are not included here:
4654  * RW       (read from SCR_EL3.RW as needed)
4655  */
4656 uint64_t arm_hcr_el2_eff(CPUARMState *env)
4657 {
4658     uint64_t ret = env->cp15.hcr_el2;
4659 
4660     if (arm_is_secure_below_el3(env)) {
4661         /*
4662          * "This register has no effect if EL2 is not enabled in the
4663          * current Security state".  This is ARMv8.4-SecEL2 speak for
4664          * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1).
4665          *
4666          * Prior to that, the language was "In an implementation that
4667          * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves
4668          * as if this field is 0 for all purposes other than a direct
4669          * read or write access of HCR_EL2".  With lots of enumeration
4670          * on a per-field basis.  In current QEMU, this is condition
4671          * is arm_is_secure_below_el3.
4672          *
4673          * Since the v8.4 language applies to the entire register, and
4674          * appears to be backward compatible, use that.
4675          */
4676         ret = 0;
4677     } else if (ret & HCR_TGE) {
4678         /* These bits are up-to-date as of ARMv8.4.  */
4679         if (ret & HCR_E2H) {
4680             ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO |
4681                      HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE |
4682                      HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU |
4683                      HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE);
4684         } else {
4685             ret |= HCR_FMO | HCR_IMO | HCR_AMO;
4686         }
4687         ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE |
4688                  HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR |
4689                  HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM |
4690                  HCR_TLOR);
4691     }
4692 
4693     return ret;
4694 }
4695 
4696 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
4697                            uint64_t value)
4698 {
4699     /*
4700      * For A-profile AArch32 EL3, if NSACR.CP10
4701      * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
4702      */
4703     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
4704         !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
4705         value &= ~(0x3 << 10);
4706         value |= env->cp15.cptr_el[2] & (0x3 << 10);
4707     }
4708     env->cp15.cptr_el[2] = value;
4709 }
4710 
4711 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri)
4712 {
4713     /*
4714      * For A-profile AArch32 EL3, if NSACR.CP10
4715      * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
4716      */
4717     uint64_t value = env->cp15.cptr_el[2];
4718 
4719     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
4720         !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
4721         value |= 0x3 << 10;
4722     }
4723     return value;
4724 }
4725 
4726 static const ARMCPRegInfo el2_cp_reginfo[] = {
4727     { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
4728       .type = ARM_CP_IO,
4729       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4730       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4731       .writefn = hcr_write },
4732     { .name = "HCR", .state = ARM_CP_STATE_AA32,
4733       .type = ARM_CP_ALIAS | ARM_CP_IO,
4734       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4735       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4736       .writefn = hcr_writelow },
4737     { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
4738       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
4739       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4740     { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
4741       .type = ARM_CP_ALIAS,
4742       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
4743       .access = PL2_RW,
4744       .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
4745     { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
4746       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
4747       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
4748     { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
4749       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
4750       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
4751     { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
4752       .type = ARM_CP_ALIAS,
4753       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
4754       .access = PL2_RW,
4755       .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) },
4756     { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
4757       .type = ARM_CP_ALIAS,
4758       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
4759       .access = PL2_RW,
4760       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
4761     { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
4762       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
4763       .access = PL2_RW, .writefn = vbar_write,
4764       .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
4765       .resetvalue = 0 },
4766     { .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
4767       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
4768       .access = PL3_RW, .type = ARM_CP_ALIAS,
4769       .fieldoffset = offsetof(CPUARMState, sp_el[2]) },
4770     { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
4771       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
4772       .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
4773       .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]),
4774       .readfn = cptr_el2_read, .writefn = cptr_el2_write },
4775     { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
4776       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
4777       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
4778       .resetvalue = 0 },
4779     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
4780       .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
4781       .access = PL2_RW, .type = ARM_CP_ALIAS,
4782       .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
4783     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
4784       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
4785       .access = PL2_RW, .type = ARM_CP_CONST,
4786       .resetvalue = 0 },
4787     /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
4788     { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
4789       .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
4790       .access = PL2_RW, .type = ARM_CP_CONST,
4791       .resetvalue = 0 },
4792     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
4793       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
4794       .access = PL2_RW, .type = ARM_CP_CONST,
4795       .resetvalue = 0 },
4796     { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
4797       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
4798       .access = PL2_RW, .type = ARM_CP_CONST,
4799       .resetvalue = 0 },
4800     { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
4801       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
4802       .access = PL2_RW,
4803       /* no .writefn needed as this can't cause an ASID change;
4804        * no .raw_writefn or .resetfn needed as we never use mask/base_mask
4805        */
4806       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
4807     { .name = "VTCR", .state = ARM_CP_STATE_AA32,
4808       .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4809       .type = ARM_CP_ALIAS,
4810       .access = PL2_RW, .accessfn = access_el3_aa32ns,
4811       .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4812     { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
4813       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4814       .access = PL2_RW,
4815       /* no .writefn needed as this can't cause an ASID change;
4816        * no .raw_writefn or .resetfn needed as we never use mask/base_mask
4817        */
4818       .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4819     { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
4820       .cp = 15, .opc1 = 6, .crm = 2,
4821       .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4822       .access = PL2_RW, .accessfn = access_el3_aa32ns,
4823       .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
4824       .writefn = vttbr_write },
4825     { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
4826       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
4827       .access = PL2_RW, .writefn = vttbr_write,
4828       .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
4829     { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
4830       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
4831       .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
4832       .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
4833     { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4834       .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
4835       .access = PL2_RW, .resetvalue = 0,
4836       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
4837     { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
4838       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
4839       .access = PL2_RW, .resetvalue = 0,
4840       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4841     { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
4842       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4843       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4844     { .name = "TLBIALLNSNH",
4845       .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
4846       .type = ARM_CP_NO_RAW, .access = PL2_W,
4847       .writefn = tlbiall_nsnh_write },
4848     { .name = "TLBIALLNSNHIS",
4849       .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
4850       .type = ARM_CP_NO_RAW, .access = PL2_W,
4851       .writefn = tlbiall_nsnh_is_write },
4852     { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
4853       .type = ARM_CP_NO_RAW, .access = PL2_W,
4854       .writefn = tlbiall_hyp_write },
4855     { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
4856       .type = ARM_CP_NO_RAW, .access = PL2_W,
4857       .writefn = tlbiall_hyp_is_write },
4858     { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
4859       .type = ARM_CP_NO_RAW, .access = PL2_W,
4860       .writefn = tlbimva_hyp_write },
4861     { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
4862       .type = ARM_CP_NO_RAW, .access = PL2_W,
4863       .writefn = tlbimva_hyp_is_write },
4864     { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
4865       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
4866       .type = ARM_CP_NO_RAW, .access = PL2_W,
4867       .writefn = tlbi_aa64_alle2_write },
4868     { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
4869       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
4870       .type = ARM_CP_NO_RAW, .access = PL2_W,
4871       .writefn = tlbi_aa64_vae2_write },
4872     { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
4873       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
4874       .access = PL2_W, .type = ARM_CP_NO_RAW,
4875       .writefn = tlbi_aa64_vae2_write },
4876     { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
4877       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
4878       .access = PL2_W, .type = ARM_CP_NO_RAW,
4879       .writefn = tlbi_aa64_alle2is_write },
4880     { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
4881       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
4882       .type = ARM_CP_NO_RAW, .access = PL2_W,
4883       .writefn = tlbi_aa64_vae2is_write },
4884     { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
4885       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
4886       .access = PL2_W, .type = ARM_CP_NO_RAW,
4887       .writefn = tlbi_aa64_vae2is_write },
4888 #ifndef CONFIG_USER_ONLY
4889     /* Unlike the other EL2-related AT operations, these must
4890      * UNDEF from EL3 if EL2 is not implemented, which is why we
4891      * define them here rather than with the rest of the AT ops.
4892      */
4893     { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
4894       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
4895       .access = PL2_W, .accessfn = at_s1e2_access,
4896       .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4897     { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
4898       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
4899       .access = PL2_W, .accessfn = at_s1e2_access,
4900       .type = ARM_CP_NO_RAW, .writefn = ats_write64 },
4901     /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
4902      * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
4903      * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
4904      * to behave as if SCR.NS was 1.
4905      */
4906     { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
4907       .access = PL2_W,
4908       .writefn = ats1h_write, .type = ARM_CP_NO_RAW },
4909     { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
4910       .access = PL2_W,
4911       .writefn = ats1h_write, .type = ARM_CP_NO_RAW },
4912     { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
4913       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
4914       /* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
4915        * reset values as IMPDEF. We choose to reset to 3 to comply with
4916        * both ARMv7 and ARMv8.
4917        */
4918       .access = PL2_RW, .resetvalue = 3,
4919       .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
4920     { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
4921       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
4922       .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
4923       .writefn = gt_cntvoff_write,
4924       .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
4925     { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
4926       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO,
4927       .writefn = gt_cntvoff_write,
4928       .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
4929     { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
4930       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
4931       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
4932       .type = ARM_CP_IO, .access = PL2_RW,
4933       .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
4934     { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
4935       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
4936       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO,
4937       .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
4938     { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
4939       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
4940       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW,
4941       .resetfn = gt_hyp_timer_reset,
4942       .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
4943     { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
4944       .type = ARM_CP_IO,
4945       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
4946       .access = PL2_RW,
4947       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
4948       .resetvalue = 0,
4949       .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
4950 #endif
4951     /* The only field of MDCR_EL2 that has a defined architectural reset value
4952      * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N; but we
4953      * don't implement any PMU event counters, so using zero as a reset
4954      * value for MDCR_EL2 is okay
4955      */
4956     { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
4957       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
4958       .access = PL2_RW, .resetvalue = 0,
4959       .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
4960     { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
4961       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4962       .access = PL2_RW, .accessfn = access_el3_aa32ns,
4963       .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
4964     { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64,
4965       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4966       .access = PL2_RW,
4967       .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
4968     { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
4969       .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
4970       .access = PL2_RW,
4971       .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) },
4972     REGINFO_SENTINEL
4973 };
4974 
4975 static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
4976     { .name = "HCR2", .state = ARM_CP_STATE_AA32,
4977       .type = ARM_CP_ALIAS | ARM_CP_IO,
4978       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
4979       .access = PL2_RW,
4980       .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
4981       .writefn = hcr_writehigh },
4982     REGINFO_SENTINEL
4983 };
4984 
4985 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
4986                                    bool isread)
4987 {
4988     /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
4989      * At Secure EL1 it traps to EL3.
4990      */
4991     if (arm_current_el(env) == 3) {
4992         return CP_ACCESS_OK;
4993     }
4994     if (arm_is_secure_below_el3(env)) {
4995         return CP_ACCESS_TRAP_EL3;
4996     }
4997     /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
4998     if (isread) {
4999         return CP_ACCESS_OK;
5000     }
5001     return CP_ACCESS_TRAP_UNCATEGORIZED;
5002 }
5003 
5004 static const ARMCPRegInfo el3_cp_reginfo[] = {
5005     { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
5006       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
5007       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
5008       .resetvalue = 0, .writefn = scr_write },
5009     { .name = "SCR",  .type = ARM_CP_ALIAS,
5010       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
5011       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
5012       .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
5013       .writefn = scr_write },
5014     { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
5015       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
5016       .access = PL3_RW, .resetvalue = 0,
5017       .fieldoffset = offsetof(CPUARMState, cp15.sder) },
5018     { .name = "SDER",
5019       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
5020       .access = PL3_RW, .resetvalue = 0,
5021       .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
5022     { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
5023       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
5024       .writefn = vbar_write, .resetvalue = 0,
5025       .fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
5026     { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
5027       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
5028       .access = PL3_RW, .resetvalue = 0,
5029       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
5030     { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
5031       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
5032       .access = PL3_RW,
5033       /* no .writefn needed as this can't cause an ASID change;
5034        * we must provide a .raw_writefn and .resetfn because we handle
5035        * reset and migration for the AArch32 TTBCR(S), which might be
5036        * using mask and base_mask.
5037        */
5038       .resetfn = vmsa_ttbcr_reset, .raw_writefn = vmsa_ttbcr_raw_write,
5039       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
5040     { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
5041       .type = ARM_CP_ALIAS,
5042       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
5043       .access = PL3_RW,
5044       .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
5045     { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
5046       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
5047       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
5048     { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
5049       .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
5050       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
5051     { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
5052       .type = ARM_CP_ALIAS,
5053       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
5054       .access = PL3_RW,
5055       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) },
5056     { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
5057       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
5058       .access = PL3_RW, .writefn = vbar_write,
5059       .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
5060       .resetvalue = 0 },
5061     { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
5062       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
5063       .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
5064       .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
5065     { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
5066       .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
5067       .access = PL3_RW, .resetvalue = 0,
5068       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
5069     { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
5070       .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
5071       .access = PL3_RW, .type = ARM_CP_CONST,
5072       .resetvalue = 0 },
5073     { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH,
5074       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0,
5075       .access = PL3_RW, .type = ARM_CP_CONST,
5076       .resetvalue = 0 },
5077     { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH,
5078       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1,
5079       .access = PL3_RW, .type = ARM_CP_CONST,
5080       .resetvalue = 0 },
5081     { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64,
5082       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0,
5083       .access = PL3_W, .type = ARM_CP_NO_RAW,
5084       .writefn = tlbi_aa64_alle3is_write },
5085     { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64,
5086       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1,
5087       .access = PL3_W, .type = ARM_CP_NO_RAW,
5088       .writefn = tlbi_aa64_vae3is_write },
5089     { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64,
5090       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5,
5091       .access = PL3_W, .type = ARM_CP_NO_RAW,
5092       .writefn = tlbi_aa64_vae3is_write },
5093     { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64,
5094       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0,
5095       .access = PL3_W, .type = ARM_CP_NO_RAW,
5096       .writefn = tlbi_aa64_alle3_write },
5097     { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64,
5098       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1,
5099       .access = PL3_W, .type = ARM_CP_NO_RAW,
5100       .writefn = tlbi_aa64_vae3_write },
5101     { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64,
5102       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
5103       .access = PL3_W, .type = ARM_CP_NO_RAW,
5104       .writefn = tlbi_aa64_vae3_write },
5105     REGINFO_SENTINEL
5106 };
5107 
5108 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
5109                                      bool isread)
5110 {
5111     /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
5112      * but the AArch32 CTR has its own reginfo struct)
5113      */
5114     if (arm_current_el(env) == 0 && !(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
5115         return CP_ACCESS_TRAP;
5116     }
5117     return CP_ACCESS_OK;
5118 }
5119 
5120 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
5121                         uint64_t value)
5122 {
5123     /* Writes to OSLAR_EL1 may update the OS lock status, which can be
5124      * read via a bit in OSLSR_EL1.
5125      */
5126     int oslock;
5127 
5128     if (ri->state == ARM_CP_STATE_AA32) {
5129         oslock = (value == 0xC5ACCE55);
5130     } else {
5131         oslock = value & 1;
5132     }
5133 
5134     env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
5135 }
5136 
5137 static const ARMCPRegInfo debug_cp_reginfo[] = {
5138     /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
5139      * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
5140      * unlike DBGDRAR it is never accessible from EL0.
5141      * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
5142      * accessor.
5143      */
5144     { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
5145       .access = PL0_R, .accessfn = access_tdra,
5146       .type = ARM_CP_CONST, .resetvalue = 0 },
5147     { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
5148       .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
5149       .access = PL1_R, .accessfn = access_tdra,
5150       .type = ARM_CP_CONST, .resetvalue = 0 },
5151     { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
5152       .access = PL0_R, .accessfn = access_tdra,
5153       .type = ARM_CP_CONST, .resetvalue = 0 },
5154     /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
5155     { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
5156       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
5157       .access = PL1_RW, .accessfn = access_tda,
5158       .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
5159       .resetvalue = 0 },
5160     /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1.
5161      * We don't implement the configurable EL0 access.
5162      */
5163     { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH,
5164       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
5165       .type = ARM_CP_ALIAS,
5166       .access = PL1_R, .accessfn = access_tda,
5167       .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
5168     { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
5169       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
5170       .access = PL1_W, .type = ARM_CP_NO_RAW,
5171       .accessfn = access_tdosa,
5172       .writefn = oslar_write },
5173     { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
5174       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
5175       .access = PL1_R, .resetvalue = 10,
5176       .accessfn = access_tdosa,
5177       .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
5178     /* Dummy OSDLR_EL1: 32-bit Linux will read this */
5179     { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
5180       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
5181       .access = PL1_RW, .accessfn = access_tdosa,
5182       .type = ARM_CP_NOP },
5183     /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
5184      * implement vector catch debug events yet.
5185      */
5186     { .name = "DBGVCR",
5187       .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
5188       .access = PL1_RW, .accessfn = access_tda,
5189       .type = ARM_CP_NOP },
5190     /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
5191      * to save and restore a 32-bit guest's DBGVCR)
5192      */
5193     { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
5194       .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
5195       .access = PL2_RW, .accessfn = access_tda,
5196       .type = ARM_CP_NOP },
5197     /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
5198      * Channel but Linux may try to access this register. The 32-bit
5199      * alias is DBGDCCINT.
5200      */
5201     { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
5202       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
5203       .access = PL1_RW, .accessfn = access_tda,
5204       .type = ARM_CP_NOP },
5205     REGINFO_SENTINEL
5206 };
5207 
5208 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
5209     /* 64 bit access versions of the (dummy) debug registers */
5210     { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
5211       .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
5212     { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
5213       .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
5214     REGINFO_SENTINEL
5215 };
5216 
5217 /* Return the exception level to which exceptions should be taken
5218  * via SVEAccessTrap.  If an exception should be routed through
5219  * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should
5220  * take care of raising that exception.
5221  * C.f. the ARM pseudocode function CheckSVEEnabled.
5222  */
5223 int sve_exception_el(CPUARMState *env, int el)
5224 {
5225 #ifndef CONFIG_USER_ONLY
5226     if (el <= 1) {
5227         bool disabled = false;
5228 
5229         /* The CPACR.ZEN controls traps to EL1:
5230          * 0, 2 : trap EL0 and EL1 accesses
5231          * 1    : trap only EL0 accesses
5232          * 3    : trap no accesses
5233          */
5234         if (!extract32(env->cp15.cpacr_el1, 16, 1)) {
5235             disabled = true;
5236         } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) {
5237             disabled = el == 0;
5238         }
5239         if (disabled) {
5240             /* route_to_el2 */
5241             return (arm_feature(env, ARM_FEATURE_EL2)
5242                     && (arm_hcr_el2_eff(env) & HCR_TGE) ? 2 : 1);
5243         }
5244 
5245         /* Check CPACR.FPEN.  */
5246         if (!extract32(env->cp15.cpacr_el1, 20, 1)) {
5247             disabled = true;
5248         } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) {
5249             disabled = el == 0;
5250         }
5251         if (disabled) {
5252             return 0;
5253         }
5254     }
5255 
5256     /* CPTR_EL2.  Since TZ and TFP are positive,
5257      * they will be zero when EL2 is not present.
5258      */
5259     if (el <= 2 && !arm_is_secure_below_el3(env)) {
5260         if (env->cp15.cptr_el[2] & CPTR_TZ) {
5261             return 2;
5262         }
5263         if (env->cp15.cptr_el[2] & CPTR_TFP) {
5264             return 0;
5265         }
5266     }
5267 
5268     /* CPTR_EL3.  Since EZ is negative we must check for EL3.  */
5269     if (arm_feature(env, ARM_FEATURE_EL3)
5270         && !(env->cp15.cptr_el[3] & CPTR_EZ)) {
5271         return 3;
5272     }
5273 #endif
5274     return 0;
5275 }
5276 
5277 /*
5278  * Given that SVE is enabled, return the vector length for EL.
5279  */
5280 uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
5281 {
5282     ARMCPU *cpu = env_archcpu(env);
5283     uint32_t zcr_len = cpu->sve_max_vq - 1;
5284 
5285     if (el <= 1) {
5286         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
5287     }
5288     if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) {
5289         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
5290     }
5291     if (arm_feature(env, ARM_FEATURE_EL3)) {
5292         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
5293     }
5294     return zcr_len;
5295 }
5296 
5297 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5298                       uint64_t value)
5299 {
5300     int cur_el = arm_current_el(env);
5301     int old_len = sve_zcr_len_for_el(env, cur_el);
5302     int new_len;
5303 
5304     /* Bits other than [3:0] are RAZ/WI.  */
5305     raw_write(env, ri, value & 0xf);
5306 
5307     /*
5308      * Because we arrived here, we know both FP and SVE are enabled;
5309      * otherwise we would have trapped access to the ZCR_ELn register.
5310      */
5311     new_len = sve_zcr_len_for_el(env, cur_el);
5312     if (new_len < old_len) {
5313         aarch64_sve_narrow_vq(env, new_len + 1);
5314     }
5315 }
5316 
5317 static const ARMCPRegInfo zcr_el1_reginfo = {
5318     .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
5319     .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
5320     .access = PL1_RW, .type = ARM_CP_SVE,
5321     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
5322     .writefn = zcr_write, .raw_writefn = raw_write
5323 };
5324 
5325 static const ARMCPRegInfo zcr_el2_reginfo = {
5326     .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
5327     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
5328     .access = PL2_RW, .type = ARM_CP_SVE,
5329     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
5330     .writefn = zcr_write, .raw_writefn = raw_write
5331 };
5332 
5333 static const ARMCPRegInfo zcr_no_el2_reginfo = {
5334     .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
5335     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
5336     .access = PL2_RW, .type = ARM_CP_SVE,
5337     .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
5338 };
5339 
5340 static const ARMCPRegInfo zcr_el3_reginfo = {
5341     .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
5342     .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
5343     .access = PL3_RW, .type = ARM_CP_SVE,
5344     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
5345     .writefn = zcr_write, .raw_writefn = raw_write
5346 };
5347 
5348 void hw_watchpoint_update(ARMCPU *cpu, int n)
5349 {
5350     CPUARMState *env = &cpu->env;
5351     vaddr len = 0;
5352     vaddr wvr = env->cp15.dbgwvr[n];
5353     uint64_t wcr = env->cp15.dbgwcr[n];
5354     int mask;
5355     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
5356 
5357     if (env->cpu_watchpoint[n]) {
5358         cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
5359         env->cpu_watchpoint[n] = NULL;
5360     }
5361 
5362     if (!extract64(wcr, 0, 1)) {
5363         /* E bit clear : watchpoint disabled */
5364         return;
5365     }
5366 
5367     switch (extract64(wcr, 3, 2)) {
5368     case 0:
5369         /* LSC 00 is reserved and must behave as if the wp is disabled */
5370         return;
5371     case 1:
5372         flags |= BP_MEM_READ;
5373         break;
5374     case 2:
5375         flags |= BP_MEM_WRITE;
5376         break;
5377     case 3:
5378         flags |= BP_MEM_ACCESS;
5379         break;
5380     }
5381 
5382     /* Attempts to use both MASK and BAS fields simultaneously are
5383      * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
5384      * thus generating a watchpoint for every byte in the masked region.
5385      */
5386     mask = extract64(wcr, 24, 4);
5387     if (mask == 1 || mask == 2) {
5388         /* Reserved values of MASK; we must act as if the mask value was
5389          * some non-reserved value, or as if the watchpoint were disabled.
5390          * We choose the latter.
5391          */
5392         return;
5393     } else if (mask) {
5394         /* Watchpoint covers an aligned area up to 2GB in size */
5395         len = 1ULL << mask;
5396         /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
5397          * whether the watchpoint fires when the unmasked bits match; we opt
5398          * to generate the exceptions.
5399          */
5400         wvr &= ~(len - 1);
5401     } else {
5402         /* Watchpoint covers bytes defined by the byte address select bits */
5403         int bas = extract64(wcr, 5, 8);
5404         int basstart;
5405 
5406         if (bas == 0) {
5407             /* This must act as if the watchpoint is disabled */
5408             return;
5409         }
5410 
5411         if (extract64(wvr, 2, 1)) {
5412             /* Deprecated case of an only 4-aligned address. BAS[7:4] are
5413              * ignored, and BAS[3:0] define which bytes to watch.
5414              */
5415             bas &= 0xf;
5416         }
5417         /* The BAS bits are supposed to be programmed to indicate a contiguous
5418          * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
5419          * we fire for each byte in the word/doubleword addressed by the WVR.
5420          * We choose to ignore any non-zero bits after the first range of 1s.
5421          */
5422         basstart = ctz32(bas);
5423         len = cto32(bas >> basstart);
5424         wvr += basstart;
5425     }
5426 
5427     cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
5428                           &env->cpu_watchpoint[n]);
5429 }
5430 
5431 void hw_watchpoint_update_all(ARMCPU *cpu)
5432 {
5433     int i;
5434     CPUARMState *env = &cpu->env;
5435 
5436     /* Completely clear out existing QEMU watchpoints and our array, to
5437      * avoid possible stale entries following migration load.
5438      */
5439     cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
5440     memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
5441 
5442     for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
5443         hw_watchpoint_update(cpu, i);
5444     }
5445 }
5446 
5447 static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5448                          uint64_t value)
5449 {
5450     ARMCPU *cpu = env_archcpu(env);
5451     int i = ri->crm;
5452 
5453     /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
5454      * register reads and behaves as if values written are sign extended.
5455      * Bits [1:0] are RES0.
5456      */
5457     value = sextract64(value, 0, 49) & ~3ULL;
5458 
5459     raw_write(env, ri, value);
5460     hw_watchpoint_update(cpu, i);
5461 }
5462 
5463 static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5464                          uint64_t value)
5465 {
5466     ARMCPU *cpu = env_archcpu(env);
5467     int i = ri->crm;
5468 
5469     raw_write(env, ri, value);
5470     hw_watchpoint_update(cpu, i);
5471 }
5472 
5473 void hw_breakpoint_update(ARMCPU *cpu, int n)
5474 {
5475     CPUARMState *env = &cpu->env;
5476     uint64_t bvr = env->cp15.dbgbvr[n];
5477     uint64_t bcr = env->cp15.dbgbcr[n];
5478     vaddr addr;
5479     int bt;
5480     int flags = BP_CPU;
5481 
5482     if (env->cpu_breakpoint[n]) {
5483         cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
5484         env->cpu_breakpoint[n] = NULL;
5485     }
5486 
5487     if (!extract64(bcr, 0, 1)) {
5488         /* E bit clear : watchpoint disabled */
5489         return;
5490     }
5491 
5492     bt = extract64(bcr, 20, 4);
5493 
5494     switch (bt) {
5495     case 4: /* unlinked address mismatch (reserved if AArch64) */
5496     case 5: /* linked address mismatch (reserved if AArch64) */
5497         qemu_log_mask(LOG_UNIMP,
5498                       "arm: address mismatch breakpoint types not implemented\n");
5499         return;
5500     case 0: /* unlinked address match */
5501     case 1: /* linked address match */
5502     {
5503         /* Bits [63:49] are hardwired to the value of bit [48]; that is,
5504          * we behave as if the register was sign extended. Bits [1:0] are
5505          * RES0. The BAS field is used to allow setting breakpoints on 16
5506          * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
5507          * a bp will fire if the addresses covered by the bp and the addresses
5508          * covered by the insn overlap but the insn doesn't start at the
5509          * start of the bp address range. We choose to require the insn and
5510          * the bp to have the same address. The constraints on writing to
5511          * BAS enforced in dbgbcr_write mean we have only four cases:
5512          *  0b0000  => no breakpoint
5513          *  0b0011  => breakpoint on addr
5514          *  0b1100  => breakpoint on addr + 2
5515          *  0b1111  => breakpoint on addr
5516          * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
5517          */
5518         int bas = extract64(bcr, 5, 4);
5519         addr = sextract64(bvr, 0, 49) & ~3ULL;
5520         if (bas == 0) {
5521             return;
5522         }
5523         if (bas == 0xc) {
5524             addr += 2;
5525         }
5526         break;
5527     }
5528     case 2: /* unlinked context ID match */
5529     case 8: /* unlinked VMID match (reserved if no EL2) */
5530     case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
5531         qemu_log_mask(LOG_UNIMP,
5532                       "arm: unlinked context breakpoint types not implemented\n");
5533         return;
5534     case 9: /* linked VMID match (reserved if no EL2) */
5535     case 11: /* linked context ID and VMID match (reserved if no EL2) */
5536     case 3: /* linked context ID match */
5537     default:
5538         /* We must generate no events for Linked context matches (unless
5539          * they are linked to by some other bp/wp, which is handled in
5540          * updates for the linking bp/wp). We choose to also generate no events
5541          * for reserved values.
5542          */
5543         return;
5544     }
5545 
5546     cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
5547 }
5548 
5549 void hw_breakpoint_update_all(ARMCPU *cpu)
5550 {
5551     int i;
5552     CPUARMState *env = &cpu->env;
5553 
5554     /* Completely clear out existing QEMU breakpoints and our array, to
5555      * avoid possible stale entries following migration load.
5556      */
5557     cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
5558     memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
5559 
5560     for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
5561         hw_breakpoint_update(cpu, i);
5562     }
5563 }
5564 
5565 static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5566                          uint64_t value)
5567 {
5568     ARMCPU *cpu = env_archcpu(env);
5569     int i = ri->crm;
5570 
5571     raw_write(env, ri, value);
5572     hw_breakpoint_update(cpu, i);
5573 }
5574 
5575 static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5576                          uint64_t value)
5577 {
5578     ARMCPU *cpu = env_archcpu(env);
5579     int i = ri->crm;
5580 
5581     /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
5582      * copy of BAS[0].
5583      */
5584     value = deposit64(value, 6, 1, extract64(value, 5, 1));
5585     value = deposit64(value, 8, 1, extract64(value, 7, 1));
5586 
5587     raw_write(env, ri, value);
5588     hw_breakpoint_update(cpu, i);
5589 }
5590 
5591 static void define_debug_regs(ARMCPU *cpu)
5592 {
5593     /* Define v7 and v8 architectural debug registers.
5594      * These are just dummy implementations for now.
5595      */
5596     int i;
5597     int wrps, brps, ctx_cmps;
5598     ARMCPRegInfo dbgdidr = {
5599         .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
5600         .access = PL0_R, .accessfn = access_tda,
5601         .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr,
5602     };
5603 
5604     /* Note that all these register fields hold "number of Xs minus 1". */
5605     brps = extract32(cpu->dbgdidr, 24, 4);
5606     wrps = extract32(cpu->dbgdidr, 28, 4);
5607     ctx_cmps = extract32(cpu->dbgdidr, 20, 4);
5608 
5609     assert(ctx_cmps <= brps);
5610 
5611     /* The DBGDIDR and ID_AA64DFR0_EL1 define various properties
5612      * of the debug registers such as number of breakpoints;
5613      * check that if they both exist then they agree.
5614      */
5615     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
5616         assert(extract32(cpu->id_aa64dfr0, 12, 4) == brps);
5617         assert(extract32(cpu->id_aa64dfr0, 20, 4) == wrps);
5618         assert(extract32(cpu->id_aa64dfr0, 28, 4) == ctx_cmps);
5619     }
5620 
5621     define_one_arm_cp_reg(cpu, &dbgdidr);
5622     define_arm_cp_regs(cpu, debug_cp_reginfo);
5623 
5624     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
5625         define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
5626     }
5627 
5628     for (i = 0; i < brps + 1; i++) {
5629         ARMCPRegInfo dbgregs[] = {
5630             { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH,
5631               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
5632               .access = PL1_RW, .accessfn = access_tda,
5633               .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
5634               .writefn = dbgbvr_write, .raw_writefn = raw_write
5635             },
5636             { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH,
5637               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
5638               .access = PL1_RW, .accessfn = access_tda,
5639               .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
5640               .writefn = dbgbcr_write, .raw_writefn = raw_write
5641             },
5642             REGINFO_SENTINEL
5643         };
5644         define_arm_cp_regs(cpu, dbgregs);
5645     }
5646 
5647     for (i = 0; i < wrps + 1; i++) {
5648         ARMCPRegInfo dbgregs[] = {
5649             { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH,
5650               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
5651               .access = PL1_RW, .accessfn = access_tda,
5652               .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
5653               .writefn = dbgwvr_write, .raw_writefn = raw_write
5654             },
5655             { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH,
5656               .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
5657               .access = PL1_RW, .accessfn = access_tda,
5658               .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
5659               .writefn = dbgwcr_write, .raw_writefn = raw_write
5660             },
5661             REGINFO_SENTINEL
5662         };
5663         define_arm_cp_regs(cpu, dbgregs);
5664     }
5665 }
5666 
5667 /* We don't know until after realize whether there's a GICv3
5668  * attached, and that is what registers the gicv3 sysregs.
5669  * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1
5670  * at runtime.
5671  */
5672 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
5673 {
5674     ARMCPU *cpu = env_archcpu(env);
5675     uint64_t pfr1 = cpu->id_pfr1;
5676 
5677     if (env->gicv3state) {
5678         pfr1 |= 1 << 28;
5679     }
5680     return pfr1;
5681 }
5682 
5683 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
5684 {
5685     ARMCPU *cpu = env_archcpu(env);
5686     uint64_t pfr0 = cpu->isar.id_aa64pfr0;
5687 
5688     if (env->gicv3state) {
5689         pfr0 |= 1 << 24;
5690     }
5691     return pfr0;
5692 }
5693 
5694 /* Shared logic between LORID and the rest of the LOR* registers.
5695  * Secure state has already been delt with.
5696  */
5697 static CPAccessResult access_lor_ns(CPUARMState *env)
5698 {
5699     int el = arm_current_el(env);
5700 
5701     if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) {
5702         return CP_ACCESS_TRAP_EL2;
5703     }
5704     if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) {
5705         return CP_ACCESS_TRAP_EL3;
5706     }
5707     return CP_ACCESS_OK;
5708 }
5709 
5710 static CPAccessResult access_lorid(CPUARMState *env, const ARMCPRegInfo *ri,
5711                                    bool isread)
5712 {
5713     if (arm_is_secure_below_el3(env)) {
5714         /* Access ok in secure mode.  */
5715         return CP_ACCESS_OK;
5716     }
5717     return access_lor_ns(env);
5718 }
5719 
5720 static CPAccessResult access_lor_other(CPUARMState *env,
5721                                        const ARMCPRegInfo *ri, bool isread)
5722 {
5723     if (arm_is_secure_below_el3(env)) {
5724         /* Access denied in secure mode.  */
5725         return CP_ACCESS_TRAP;
5726     }
5727     return access_lor_ns(env);
5728 }
5729 
5730 #ifdef TARGET_AARCH64
5731 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri,
5732                                    bool isread)
5733 {
5734     int el = arm_current_el(env);
5735 
5736     if (el < 2 &&
5737         arm_feature(env, ARM_FEATURE_EL2) &&
5738         !(arm_hcr_el2_eff(env) & HCR_APK)) {
5739         return CP_ACCESS_TRAP_EL2;
5740     }
5741     if (el < 3 &&
5742         arm_feature(env, ARM_FEATURE_EL3) &&
5743         !(env->cp15.scr_el3 & SCR_APK)) {
5744         return CP_ACCESS_TRAP_EL3;
5745     }
5746     return CP_ACCESS_OK;
5747 }
5748 
5749 static const ARMCPRegInfo pauth_reginfo[] = {
5750     { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5751       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0,
5752       .access = PL1_RW, .accessfn = access_pauth,
5753       .fieldoffset = offsetof(CPUARMState, keys.apda.lo) },
5754     { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5755       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1,
5756       .access = PL1_RW, .accessfn = access_pauth,
5757       .fieldoffset = offsetof(CPUARMState, keys.apda.hi) },
5758     { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5759       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2,
5760       .access = PL1_RW, .accessfn = access_pauth,
5761       .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) },
5762     { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5763       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3,
5764       .access = PL1_RW, .accessfn = access_pauth,
5765       .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) },
5766     { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5767       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0,
5768       .access = PL1_RW, .accessfn = access_pauth,
5769       .fieldoffset = offsetof(CPUARMState, keys.apga.lo) },
5770     { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5771       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1,
5772       .access = PL1_RW, .accessfn = access_pauth,
5773       .fieldoffset = offsetof(CPUARMState, keys.apga.hi) },
5774     { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5775       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0,
5776       .access = PL1_RW, .accessfn = access_pauth,
5777       .fieldoffset = offsetof(CPUARMState, keys.apia.lo) },
5778     { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5779       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1,
5780       .access = PL1_RW, .accessfn = access_pauth,
5781       .fieldoffset = offsetof(CPUARMState, keys.apia.hi) },
5782     { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64,
5783       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2,
5784       .access = PL1_RW, .accessfn = access_pauth,
5785       .fieldoffset = offsetof(CPUARMState, keys.apib.lo) },
5786     { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
5787       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3,
5788       .access = PL1_RW, .accessfn = access_pauth,
5789       .fieldoffset = offsetof(CPUARMState, keys.apib.hi) },
5790     REGINFO_SENTINEL
5791 };
5792 
5793 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
5794 {
5795     Error *err = NULL;
5796     uint64_t ret;
5797 
5798     /* Success sets NZCV = 0000.  */
5799     env->NF = env->CF = env->VF = 0, env->ZF = 1;
5800 
5801     if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) {
5802         /*
5803          * ??? Failed, for unknown reasons in the crypto subsystem.
5804          * The best we can do is log the reason and return the
5805          * timed-out indication to the guest.  There is no reason
5806          * we know to expect this failure to be transitory, so the
5807          * guest may well hang retrying the operation.
5808          */
5809         qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
5810                       ri->name, error_get_pretty(err));
5811         error_free(err);
5812 
5813         env->ZF = 0; /* NZCF = 0100 */
5814         return 0;
5815     }
5816     return ret;
5817 }
5818 
5819 /* We do not support re-seeding, so the two registers operate the same.  */
5820 static const ARMCPRegInfo rndr_reginfo[] = {
5821     { .name = "RNDR", .state = ARM_CP_STATE_AA64,
5822       .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
5823       .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0,
5824       .access = PL0_R, .readfn = rndr_readfn },
5825     { .name = "RNDRRS", .state = ARM_CP_STATE_AA64,
5826       .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
5827       .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1,
5828       .access = PL0_R, .readfn = rndr_readfn },
5829     REGINFO_SENTINEL
5830 };
5831 #endif
5832 
5833 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri,
5834                                      bool isread)
5835 {
5836     int el = arm_current_el(env);
5837 
5838     if (el == 0) {
5839         uint64_t sctlr = arm_sctlr(env, el);
5840         if (!(sctlr & SCTLR_EnRCTX)) {
5841             return CP_ACCESS_TRAP;
5842         }
5843     } else if (el == 1) {
5844         uint64_t hcr = arm_hcr_el2_eff(env);
5845         if (hcr & HCR_NV) {
5846             return CP_ACCESS_TRAP_EL2;
5847         }
5848     }
5849     return CP_ACCESS_OK;
5850 }
5851 
5852 static const ARMCPRegInfo predinv_reginfo[] = {
5853     { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64,
5854       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4,
5855       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5856     { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64,
5857       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5,
5858       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5859     { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64,
5860       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7,
5861       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5862     /*
5863      * Note the AArch32 opcodes have a different OPC1.
5864      */
5865     { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32,
5866       .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4,
5867       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5868     { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32,
5869       .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5,
5870       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5871     { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32,
5872       .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7,
5873       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
5874     REGINFO_SENTINEL
5875 };
5876 
5877 void register_cp_regs_for_features(ARMCPU *cpu)
5878 {
5879     /* Register all the coprocessor registers based on feature bits */
5880     CPUARMState *env = &cpu->env;
5881     if (arm_feature(env, ARM_FEATURE_M)) {
5882         /* M profile has no coprocessor registers */
5883         return;
5884     }
5885 
5886     define_arm_cp_regs(cpu, cp_reginfo);
5887     if (!arm_feature(env, ARM_FEATURE_V8)) {
5888         /* Must go early as it is full of wildcards that may be
5889          * overridden by later definitions.
5890          */
5891         define_arm_cp_regs(cpu, not_v8_cp_reginfo);
5892     }
5893 
5894     if (arm_feature(env, ARM_FEATURE_V6)) {
5895         /* The ID registers all have impdef reset values */
5896         ARMCPRegInfo v6_idregs[] = {
5897             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
5898               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
5899               .access = PL1_R, .type = ARM_CP_CONST,
5900               .resetvalue = cpu->id_pfr0 },
5901             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
5902              * the value of the GIC field until after we define these regs.
5903              */
5904             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
5905               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
5906               .access = PL1_R, .type = ARM_CP_NO_RAW,
5907               .readfn = id_pfr1_read,
5908               .writefn = arm_cp_write_ignore },
5909             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
5910               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
5911               .access = PL1_R, .type = ARM_CP_CONST,
5912               .resetvalue = cpu->id_dfr0 },
5913             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
5914               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
5915               .access = PL1_R, .type = ARM_CP_CONST,
5916               .resetvalue = cpu->id_afr0 },
5917             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
5918               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
5919               .access = PL1_R, .type = ARM_CP_CONST,
5920               .resetvalue = cpu->id_mmfr0 },
5921             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
5922               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
5923               .access = PL1_R, .type = ARM_CP_CONST,
5924               .resetvalue = cpu->id_mmfr1 },
5925             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
5926               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
5927               .access = PL1_R, .type = ARM_CP_CONST,
5928               .resetvalue = cpu->id_mmfr2 },
5929             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
5930               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
5931               .access = PL1_R, .type = ARM_CP_CONST,
5932               .resetvalue = cpu->id_mmfr3 },
5933             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
5934               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
5935               .access = PL1_R, .type = ARM_CP_CONST,
5936               .resetvalue = cpu->isar.id_isar0 },
5937             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
5938               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
5939               .access = PL1_R, .type = ARM_CP_CONST,
5940               .resetvalue = cpu->isar.id_isar1 },
5941             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
5942               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
5943               .access = PL1_R, .type = ARM_CP_CONST,
5944               .resetvalue = cpu->isar.id_isar2 },
5945             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
5946               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
5947               .access = PL1_R, .type = ARM_CP_CONST,
5948               .resetvalue = cpu->isar.id_isar3 },
5949             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
5950               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
5951               .access = PL1_R, .type = ARM_CP_CONST,
5952               .resetvalue = cpu->isar.id_isar4 },
5953             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
5954               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
5955               .access = PL1_R, .type = ARM_CP_CONST,
5956               .resetvalue = cpu->isar.id_isar5 },
5957             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
5958               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
5959               .access = PL1_R, .type = ARM_CP_CONST,
5960               .resetvalue = cpu->id_mmfr4 },
5961             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
5962               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
5963               .access = PL1_R, .type = ARM_CP_CONST,
5964               .resetvalue = cpu->isar.id_isar6 },
5965             REGINFO_SENTINEL
5966         };
5967         define_arm_cp_regs(cpu, v6_idregs);
5968         define_arm_cp_regs(cpu, v6_cp_reginfo);
5969     } else {
5970         define_arm_cp_regs(cpu, not_v6_cp_reginfo);
5971     }
5972     if (arm_feature(env, ARM_FEATURE_V6K)) {
5973         define_arm_cp_regs(cpu, v6k_cp_reginfo);
5974     }
5975     if (arm_feature(env, ARM_FEATURE_V7MP) &&
5976         !arm_feature(env, ARM_FEATURE_PMSA)) {
5977         define_arm_cp_regs(cpu, v7mp_cp_reginfo);
5978     }
5979     if (arm_feature(env, ARM_FEATURE_V7VE)) {
5980         define_arm_cp_regs(cpu, pmovsset_cp_reginfo);
5981     }
5982     if (arm_feature(env, ARM_FEATURE_V7)) {
5983         /* v7 performance monitor control register: same implementor
5984          * field as main ID register, and we implement four counters in
5985          * addition to the cycle count register.
5986          */
5987         unsigned int i, pmcrn = 4;
5988         ARMCPRegInfo pmcr = {
5989             .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
5990             .access = PL0_RW,
5991             .type = ARM_CP_IO | ARM_CP_ALIAS,
5992             .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
5993             .accessfn = pmreg_access, .writefn = pmcr_write,
5994             .raw_writefn = raw_write,
5995         };
5996         ARMCPRegInfo pmcr64 = {
5997             .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
5998             .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
5999             .access = PL0_RW, .accessfn = pmreg_access,
6000             .type = ARM_CP_IO,
6001             .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
6002             .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT),
6003             .writefn = pmcr_write, .raw_writefn = raw_write,
6004         };
6005         define_one_arm_cp_reg(cpu, &pmcr);
6006         define_one_arm_cp_reg(cpu, &pmcr64);
6007         for (i = 0; i < pmcrn; i++) {
6008             char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i);
6009             char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i);
6010             char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i);
6011             char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i);
6012             ARMCPRegInfo pmev_regs[] = {
6013                 { .name = pmevcntr_name, .cp = 15, .crn = 14,
6014                   .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
6015                   .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
6016                   .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
6017                   .accessfn = pmreg_access },
6018                 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
6019                   .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
6020                   .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
6021                   .type = ARM_CP_IO,
6022                   .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
6023                   .raw_readfn = pmevcntr_rawread,
6024                   .raw_writefn = pmevcntr_rawwrite },
6025                 { .name = pmevtyper_name, .cp = 15, .crn = 14,
6026                   .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
6027                   .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
6028                   .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
6029                   .accessfn = pmreg_access },
6030                 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64,
6031                   .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)),
6032                   .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
6033                   .type = ARM_CP_IO,
6034                   .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
6035                   .raw_writefn = pmevtyper_rawwrite },
6036                 REGINFO_SENTINEL
6037             };
6038             define_arm_cp_regs(cpu, pmev_regs);
6039             g_free(pmevcntr_name);
6040             g_free(pmevcntr_el0_name);
6041             g_free(pmevtyper_name);
6042             g_free(pmevtyper_el0_name);
6043         }
6044         ARMCPRegInfo clidr = {
6045             .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
6046             .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
6047             .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
6048         };
6049         define_one_arm_cp_reg(cpu, &clidr);
6050         define_arm_cp_regs(cpu, v7_cp_reginfo);
6051         define_debug_regs(cpu);
6052     } else {
6053         define_arm_cp_regs(cpu, not_v7_cp_reginfo);
6054     }
6055     if (FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) >= 4 &&
6056             FIELD_EX32(cpu->id_dfr0, ID_DFR0, PERFMON) != 0xf) {
6057         ARMCPRegInfo v81_pmu_regs[] = {
6058             { .name = "PMCEID2", .state = ARM_CP_STATE_AA32,
6059               .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4,
6060               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6061               .resetvalue = extract64(cpu->pmceid0, 32, 32) },
6062             { .name = "PMCEID3", .state = ARM_CP_STATE_AA32,
6063               .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5,
6064               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6065               .resetvalue = extract64(cpu->pmceid1, 32, 32) },
6066             REGINFO_SENTINEL
6067         };
6068         define_arm_cp_regs(cpu, v81_pmu_regs);
6069     }
6070     if (arm_feature(env, ARM_FEATURE_V8)) {
6071         /* AArch64 ID registers, which all have impdef reset values.
6072          * Note that within the ID register ranges the unused slots
6073          * must all RAZ, not UNDEF; future architecture versions may
6074          * define new registers here.
6075          */
6076         ARMCPRegInfo v8_idregs[] = {
6077             /* ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST because we don't
6078              * know the right value for the GIC field until after we
6079              * define these regs.
6080              */
6081             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
6082               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
6083               .access = PL1_R, .type = ARM_CP_NO_RAW,
6084               .readfn = id_aa64pfr0_read,
6085               .writefn = arm_cp_write_ignore },
6086             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
6087               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
6088               .access = PL1_R, .type = ARM_CP_CONST,
6089               .resetvalue = cpu->isar.id_aa64pfr1},
6090             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6091               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
6092               .access = PL1_R, .type = ARM_CP_CONST,
6093               .resetvalue = 0 },
6094             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6095               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
6096               .access = PL1_R, .type = ARM_CP_CONST,
6097               .resetvalue = 0 },
6098             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
6099               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
6100               .access = PL1_R, .type = ARM_CP_CONST,
6101               /* At present, only SVEver == 0 is defined anyway.  */
6102               .resetvalue = 0 },
6103             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6104               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
6105               .access = PL1_R, .type = ARM_CP_CONST,
6106               .resetvalue = 0 },
6107             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6108               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
6109               .access = PL1_R, .type = ARM_CP_CONST,
6110               .resetvalue = 0 },
6111             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6112               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
6113               .access = PL1_R, .type = ARM_CP_CONST,
6114               .resetvalue = 0 },
6115             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
6116               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
6117               .access = PL1_R, .type = ARM_CP_CONST,
6118               .resetvalue = cpu->id_aa64dfr0 },
6119             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
6120               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
6121               .access = PL1_R, .type = ARM_CP_CONST,
6122               .resetvalue = cpu->id_aa64dfr1 },
6123             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6124               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
6125               .access = PL1_R, .type = ARM_CP_CONST,
6126               .resetvalue = 0 },
6127             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6128               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
6129               .access = PL1_R, .type = ARM_CP_CONST,
6130               .resetvalue = 0 },
6131             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
6132               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
6133               .access = PL1_R, .type = ARM_CP_CONST,
6134               .resetvalue = cpu->id_aa64afr0 },
6135             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
6136               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
6137               .access = PL1_R, .type = ARM_CP_CONST,
6138               .resetvalue = cpu->id_aa64afr1 },
6139             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6140               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
6141               .access = PL1_R, .type = ARM_CP_CONST,
6142               .resetvalue = 0 },
6143             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6144               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
6145               .access = PL1_R, .type = ARM_CP_CONST,
6146               .resetvalue = 0 },
6147             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
6148               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
6149               .access = PL1_R, .type = ARM_CP_CONST,
6150               .resetvalue = cpu->isar.id_aa64isar0 },
6151             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
6152               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
6153               .access = PL1_R, .type = ARM_CP_CONST,
6154               .resetvalue = cpu->isar.id_aa64isar1 },
6155             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6156               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
6157               .access = PL1_R, .type = ARM_CP_CONST,
6158               .resetvalue = 0 },
6159             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6160               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
6161               .access = PL1_R, .type = ARM_CP_CONST,
6162               .resetvalue = 0 },
6163             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6164               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
6165               .access = PL1_R, .type = ARM_CP_CONST,
6166               .resetvalue = 0 },
6167             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6168               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
6169               .access = PL1_R, .type = ARM_CP_CONST,
6170               .resetvalue = 0 },
6171             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6172               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
6173               .access = PL1_R, .type = ARM_CP_CONST,
6174               .resetvalue = 0 },
6175             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6176               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
6177               .access = PL1_R, .type = ARM_CP_CONST,
6178               .resetvalue = 0 },
6179             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
6180               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
6181               .access = PL1_R, .type = ARM_CP_CONST,
6182               .resetvalue = cpu->isar.id_aa64mmfr0 },
6183             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
6184               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
6185               .access = PL1_R, .type = ARM_CP_CONST,
6186               .resetvalue = cpu->isar.id_aa64mmfr1 },
6187             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6188               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
6189               .access = PL1_R, .type = ARM_CP_CONST,
6190               .resetvalue = 0 },
6191             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6192               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
6193               .access = PL1_R, .type = ARM_CP_CONST,
6194               .resetvalue = 0 },
6195             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6196               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
6197               .access = PL1_R, .type = ARM_CP_CONST,
6198               .resetvalue = 0 },
6199             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6200               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
6201               .access = PL1_R, .type = ARM_CP_CONST,
6202               .resetvalue = 0 },
6203             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6204               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
6205               .access = PL1_R, .type = ARM_CP_CONST,
6206               .resetvalue = 0 },
6207             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6208               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
6209               .access = PL1_R, .type = ARM_CP_CONST,
6210               .resetvalue = 0 },
6211             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
6212               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
6213               .access = PL1_R, .type = ARM_CP_CONST,
6214               .resetvalue = cpu->isar.mvfr0 },
6215             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
6216               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
6217               .access = PL1_R, .type = ARM_CP_CONST,
6218               .resetvalue = cpu->isar.mvfr1 },
6219             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
6220               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
6221               .access = PL1_R, .type = ARM_CP_CONST,
6222               .resetvalue = cpu->isar.mvfr2 },
6223             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6224               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
6225               .access = PL1_R, .type = ARM_CP_CONST,
6226               .resetvalue = 0 },
6227             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6228               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
6229               .access = PL1_R, .type = ARM_CP_CONST,
6230               .resetvalue = 0 },
6231             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6232               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
6233               .access = PL1_R, .type = ARM_CP_CONST,
6234               .resetvalue = 0 },
6235             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6236               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
6237               .access = PL1_R, .type = ARM_CP_CONST,
6238               .resetvalue = 0 },
6239             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
6240               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
6241               .access = PL1_R, .type = ARM_CP_CONST,
6242               .resetvalue = 0 },
6243             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
6244               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
6245               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6246               .resetvalue = extract64(cpu->pmceid0, 0, 32) },
6247             { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64,
6248               .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6,
6249               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6250               .resetvalue = cpu->pmceid0 },
6251             { .name = "PMCEID1", .state = ARM_CP_STATE_AA32,
6252               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7,
6253               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6254               .resetvalue = extract64(cpu->pmceid1, 0, 32) },
6255             { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64,
6256               .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
6257               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
6258               .resetvalue = cpu->pmceid1 },
6259             REGINFO_SENTINEL
6260         };
6261 #ifdef CONFIG_USER_ONLY
6262         ARMCPRegUserSpaceInfo v8_user_idregs[] = {
6263             { .name = "ID_AA64PFR0_EL1",
6264               .exported_bits = 0x000f000f00ff0000,
6265               .fixed_bits    = 0x0000000000000011 },
6266             { .name = "ID_AA64PFR1_EL1",
6267               .exported_bits = 0x00000000000000f0 },
6268             { .name = "ID_AA64PFR*_EL1_RESERVED",
6269               .is_glob = true                     },
6270             { .name = "ID_AA64ZFR0_EL1"           },
6271             { .name = "ID_AA64MMFR0_EL1",
6272               .fixed_bits    = 0x00000000ff000000 },
6273             { .name = "ID_AA64MMFR1_EL1"          },
6274             { .name = "ID_AA64MMFR*_EL1_RESERVED",
6275               .is_glob = true                     },
6276             { .name = "ID_AA64DFR0_EL1",
6277               .fixed_bits    = 0x0000000000000006 },
6278             { .name = "ID_AA64DFR1_EL1"           },
6279             { .name = "ID_AA64DFR*_EL1_RESERVED",
6280               .is_glob = true                     },
6281             { .name = "ID_AA64AFR*",
6282               .is_glob = true                     },
6283             { .name = "ID_AA64ISAR0_EL1",
6284               .exported_bits = 0x00fffffff0fffff0 },
6285             { .name = "ID_AA64ISAR1_EL1",
6286               .exported_bits = 0x000000f0ffffffff },
6287             { .name = "ID_AA64ISAR*_EL1_RESERVED",
6288               .is_glob = true                     },
6289             REGUSERINFO_SENTINEL
6290         };
6291         modify_arm_cp_regs(v8_idregs, v8_user_idregs);
6292 #endif
6293         /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
6294         if (!arm_feature(env, ARM_FEATURE_EL3) &&
6295             !arm_feature(env, ARM_FEATURE_EL2)) {
6296             ARMCPRegInfo rvbar = {
6297                 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
6298                 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
6299                 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
6300             };
6301             define_one_arm_cp_reg(cpu, &rvbar);
6302         }
6303         define_arm_cp_regs(cpu, v8_idregs);
6304         define_arm_cp_regs(cpu, v8_cp_reginfo);
6305     }
6306     if (arm_feature(env, ARM_FEATURE_EL2)) {
6307         uint64_t vmpidr_def = mpidr_read_val(env);
6308         ARMCPRegInfo vpidr_regs[] = {
6309             { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
6310               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6311               .access = PL2_RW, .accessfn = access_el3_aa32ns,
6312               .resetvalue = cpu->midr, .type = ARM_CP_ALIAS,
6313               .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
6314             { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
6315               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6316               .access = PL2_RW, .resetvalue = cpu->midr,
6317               .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
6318             { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
6319               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6320               .access = PL2_RW, .accessfn = access_el3_aa32ns,
6321               .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS,
6322               .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
6323             { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
6324               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6325               .access = PL2_RW,
6326               .resetvalue = vmpidr_def,
6327               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
6328             REGINFO_SENTINEL
6329         };
6330         define_arm_cp_regs(cpu, vpidr_regs);
6331         define_arm_cp_regs(cpu, el2_cp_reginfo);
6332         if (arm_feature(env, ARM_FEATURE_V8)) {
6333             define_arm_cp_regs(cpu, el2_v8_cp_reginfo);
6334         }
6335         /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
6336         if (!arm_feature(env, ARM_FEATURE_EL3)) {
6337             ARMCPRegInfo rvbar = {
6338                 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
6339                 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
6340                 .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
6341             };
6342             define_one_arm_cp_reg(cpu, &rvbar);
6343         }
6344     } else {
6345         /* If EL2 is missing but higher ELs are enabled, we need to
6346          * register the no_el2 reginfos.
6347          */
6348         if (arm_feature(env, ARM_FEATURE_EL3)) {
6349             /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
6350              * of MIDR_EL1 and MPIDR_EL1.
6351              */
6352             ARMCPRegInfo vpidr_regs[] = {
6353                 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,
6354                   .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
6355                   .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
6356                   .type = ARM_CP_CONST, .resetvalue = cpu->midr,
6357                   .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
6358                 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,
6359                   .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
6360                   .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,
6361                   .type = ARM_CP_NO_RAW,
6362                   .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
6363                 REGINFO_SENTINEL
6364             };
6365             define_arm_cp_regs(cpu, vpidr_regs);
6366             define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
6367             if (arm_feature(env, ARM_FEATURE_V8)) {
6368                 define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo);
6369             }
6370         }
6371     }
6372     if (arm_feature(env, ARM_FEATURE_EL3)) {
6373         define_arm_cp_regs(cpu, el3_cp_reginfo);
6374         ARMCPRegInfo el3_regs[] = {
6375             { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
6376               .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
6377               .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },
6378             { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
6379               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
6380               .access = PL3_RW,
6381               .raw_writefn = raw_write, .writefn = sctlr_write,
6382               .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]),
6383               .resetvalue = cpu->reset_sctlr },
6384             REGINFO_SENTINEL
6385         };
6386 
6387         define_arm_cp_regs(cpu, el3_regs);
6388     }
6389     /* The behaviour of NSACR is sufficiently various that we don't
6390      * try to describe it in a single reginfo:
6391      *  if EL3 is 64 bit, then trap to EL3 from S EL1,
6392      *     reads as constant 0xc00 from NS EL1 and NS EL2
6393      *  if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2
6394      *  if v7 without EL3, register doesn't exist
6395      *  if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2
6396      */
6397     if (arm_feature(env, ARM_FEATURE_EL3)) {
6398         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6399             ARMCPRegInfo nsacr = {
6400                 .name = "NSACR", .type = ARM_CP_CONST,
6401                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6402                 .access = PL1_RW, .accessfn = nsacr_access,
6403                 .resetvalue = 0xc00
6404             };
6405             define_one_arm_cp_reg(cpu, &nsacr);
6406         } else {
6407             ARMCPRegInfo nsacr = {
6408                 .name = "NSACR",
6409                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6410                 .access = PL3_RW | PL1_R,
6411                 .resetvalue = 0,
6412                 .fieldoffset = offsetof(CPUARMState, cp15.nsacr)
6413             };
6414             define_one_arm_cp_reg(cpu, &nsacr);
6415         }
6416     } else {
6417         if (arm_feature(env, ARM_FEATURE_V8)) {
6418             ARMCPRegInfo nsacr = {
6419                 .name = "NSACR", .type = ARM_CP_CONST,
6420                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
6421                 .access = PL1_R,
6422                 .resetvalue = 0xc00
6423             };
6424             define_one_arm_cp_reg(cpu, &nsacr);
6425         }
6426     }
6427 
6428     if (arm_feature(env, ARM_FEATURE_PMSA)) {
6429         if (arm_feature(env, ARM_FEATURE_V6)) {
6430             /* PMSAv6 not implemented */
6431             assert(arm_feature(env, ARM_FEATURE_V7));
6432             define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
6433             define_arm_cp_regs(cpu, pmsav7_cp_reginfo);
6434         } else {
6435             define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
6436         }
6437     } else {
6438         define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
6439         define_arm_cp_regs(cpu, vmsa_cp_reginfo);
6440         /* TTCBR2 is introduced with ARMv8.2-A32HPD.  */
6441         if (FIELD_EX32(cpu->id_mmfr4, ID_MMFR4, HPDS) != 0) {
6442             define_one_arm_cp_reg(cpu, &ttbcr2_reginfo);
6443         }
6444     }
6445     if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
6446         define_arm_cp_regs(cpu, t2ee_cp_reginfo);
6447     }
6448     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
6449         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
6450     }
6451     if (arm_feature(env, ARM_FEATURE_VAPA)) {
6452         define_arm_cp_regs(cpu, vapa_cp_reginfo);
6453     }
6454     if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
6455         define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
6456     }
6457     if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
6458         define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
6459     }
6460     if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
6461         define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
6462     }
6463     if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
6464         define_arm_cp_regs(cpu, omap_cp_reginfo);
6465     }
6466     if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
6467         define_arm_cp_regs(cpu, strongarm_cp_reginfo);
6468     }
6469     if (arm_feature(env, ARM_FEATURE_XSCALE)) {
6470         define_arm_cp_regs(cpu, xscale_cp_reginfo);
6471     }
6472     if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
6473         define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
6474     }
6475     if (arm_feature(env, ARM_FEATURE_LPAE)) {
6476         define_arm_cp_regs(cpu, lpae_cp_reginfo);
6477     }
6478     /* Slightly awkwardly, the OMAP and StrongARM cores need all of
6479      * cp15 crn=0 to be writes-ignored, whereas for other cores they should
6480      * be read-only (ie write causes UNDEF exception).
6481      */
6482     {
6483         ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
6484             /* Pre-v8 MIDR space.
6485              * Note that the MIDR isn't a simple constant register because
6486              * of the TI925 behaviour where writes to another register can
6487              * cause the MIDR value to change.
6488              *
6489              * Unimplemented registers in the c15 0 0 0 space default to
6490              * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
6491              * and friends override accordingly.
6492              */
6493             { .name = "MIDR",
6494               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
6495               .access = PL1_R, .resetvalue = cpu->midr,
6496               .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
6497               .readfn = midr_read,
6498               .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
6499               .type = ARM_CP_OVERRIDE },
6500             /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
6501             { .name = "DUMMY",
6502               .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
6503               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6504             { .name = "DUMMY",
6505               .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
6506               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6507             { .name = "DUMMY",
6508               .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
6509               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6510             { .name = "DUMMY",
6511               .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
6512               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6513             { .name = "DUMMY",
6514               .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
6515               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6516             REGINFO_SENTINEL
6517         };
6518         ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
6519             { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
6520               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
6521               .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr,
6522               .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
6523               .readfn = midr_read },
6524             /* crn = 0 op1 = 0 crm = 0 op2 = 4,7 : AArch32 aliases of MIDR */
6525             { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
6526               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
6527               .access = PL1_R, .resetvalue = cpu->midr },
6528             { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
6529               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7,
6530               .access = PL1_R, .resetvalue = cpu->midr },
6531             { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
6532               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
6533               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
6534             REGINFO_SENTINEL
6535         };
6536         ARMCPRegInfo id_cp_reginfo[] = {
6537             /* These are common to v8 and pre-v8 */
6538             { .name = "CTR",
6539               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
6540               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
6541             { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
6542               .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
6543               .access = PL0_R, .accessfn = ctr_el0_access,
6544               .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
6545             /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
6546             { .name = "TCMTR",
6547               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
6548               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
6549             REGINFO_SENTINEL
6550         };
6551         /* TLBTR is specific to VMSA */
6552         ARMCPRegInfo id_tlbtr_reginfo = {
6553               .name = "TLBTR",
6554               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
6555               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0,
6556         };
6557         /* MPUIR is specific to PMSA V6+ */
6558         ARMCPRegInfo id_mpuir_reginfo = {
6559               .name = "MPUIR",
6560               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
6561               .access = PL1_R, .type = ARM_CP_CONST,
6562               .resetvalue = cpu->pmsav7_dregion << 8
6563         };
6564         ARMCPRegInfo crn0_wi_reginfo = {
6565             .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
6566             .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
6567             .type = ARM_CP_NOP | ARM_CP_OVERRIDE
6568         };
6569 #ifdef CONFIG_USER_ONLY
6570         ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
6571             { .name = "MIDR_EL1",
6572               .exported_bits = 0x00000000ffffffff },
6573             { .name = "REVIDR_EL1"                },
6574             REGUSERINFO_SENTINEL
6575         };
6576         modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo);
6577 #endif
6578         if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
6579             arm_feature(env, ARM_FEATURE_STRONGARM)) {
6580             ARMCPRegInfo *r;
6581             /* Register the blanket "writes ignored" value first to cover the
6582              * whole space. Then update the specific ID registers to allow write
6583              * access, so that they ignore writes rather than causing them to
6584              * UNDEF.
6585              */
6586             define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
6587             for (r = id_pre_v8_midr_cp_reginfo;
6588                  r->type != ARM_CP_SENTINEL; r++) {
6589                 r->access = PL1_RW;
6590             }
6591             for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
6592                 r->access = PL1_RW;
6593             }
6594             id_mpuir_reginfo.access = PL1_RW;
6595             id_tlbtr_reginfo.access = PL1_RW;
6596         }
6597         if (arm_feature(env, ARM_FEATURE_V8)) {
6598             define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
6599         } else {
6600             define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
6601         }
6602         define_arm_cp_regs(cpu, id_cp_reginfo);
6603         if (!arm_feature(env, ARM_FEATURE_PMSA)) {
6604             define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
6605         } else if (arm_feature(env, ARM_FEATURE_V7)) {
6606             define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
6607         }
6608     }
6609 
6610     if (arm_feature(env, ARM_FEATURE_MPIDR)) {
6611         ARMCPRegInfo mpidr_cp_reginfo[] = {
6612             { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH,
6613               .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
6614               .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
6615             REGINFO_SENTINEL
6616         };
6617 #ifdef CONFIG_USER_ONLY
6618         ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
6619             { .name = "MPIDR_EL1",
6620               .fixed_bits = 0x0000000080000000 },
6621             REGUSERINFO_SENTINEL
6622         };
6623         modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo);
6624 #endif
6625         define_arm_cp_regs(cpu, mpidr_cp_reginfo);
6626     }
6627 
6628     if (arm_feature(env, ARM_FEATURE_AUXCR)) {
6629         ARMCPRegInfo auxcr_reginfo[] = {
6630             { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
6631               .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
6632               .access = PL1_RW, .type = ARM_CP_CONST,
6633               .resetvalue = cpu->reset_auxcr },
6634             { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH,
6635               .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1,
6636               .access = PL2_RW, .type = ARM_CP_CONST,
6637               .resetvalue = 0 },
6638             { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64,
6639               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
6640               .access = PL3_RW, .type = ARM_CP_CONST,
6641               .resetvalue = 0 },
6642             REGINFO_SENTINEL
6643         };
6644         define_arm_cp_regs(cpu, auxcr_reginfo);
6645         if (arm_feature(env, ARM_FEATURE_V8)) {
6646             /* HACTLR2 maps to ACTLR_EL2[63:32] and is not in ARMv7 */
6647             ARMCPRegInfo hactlr2_reginfo = {
6648                 .name = "HACTLR2", .state = ARM_CP_STATE_AA32,
6649                 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3,
6650                 .access = PL2_RW, .type = ARM_CP_CONST,
6651                 .resetvalue = 0
6652             };
6653             define_one_arm_cp_reg(cpu, &hactlr2_reginfo);
6654         }
6655     }
6656 
6657     if (arm_feature(env, ARM_FEATURE_CBAR)) {
6658         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6659             /* 32 bit view is [31:18] 0...0 [43:32]. */
6660             uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
6661                 | extract64(cpu->reset_cbar, 32, 12);
6662             ARMCPRegInfo cbar_reginfo[] = {
6663                 { .name = "CBAR",
6664                   .type = ARM_CP_CONST,
6665                   .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
6666                   .access = PL1_R, .resetvalue = cpu->reset_cbar },
6667                 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
6668                   .type = ARM_CP_CONST,
6669                   .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
6670                   .access = PL1_R, .resetvalue = cbar32 },
6671                 REGINFO_SENTINEL
6672             };
6673             /* We don't implement a r/w 64 bit CBAR currently */
6674             assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
6675             define_arm_cp_regs(cpu, cbar_reginfo);
6676         } else {
6677             ARMCPRegInfo cbar = {
6678                 .name = "CBAR",
6679                 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
6680                 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
6681                 .fieldoffset = offsetof(CPUARMState,
6682                                         cp15.c15_config_base_address)
6683             };
6684             if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
6685                 cbar.access = PL1_R;
6686                 cbar.fieldoffset = 0;
6687                 cbar.type = ARM_CP_CONST;
6688             }
6689             define_one_arm_cp_reg(cpu, &cbar);
6690         }
6691     }
6692 
6693     if (arm_feature(env, ARM_FEATURE_VBAR)) {
6694         ARMCPRegInfo vbar_cp_reginfo[] = {
6695             { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
6696               .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
6697               .access = PL1_RW, .writefn = vbar_write,
6698               .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
6699                                      offsetof(CPUARMState, cp15.vbar_ns) },
6700               .resetvalue = 0 },
6701             REGINFO_SENTINEL
6702         };
6703         define_arm_cp_regs(cpu, vbar_cp_reginfo);
6704     }
6705 
6706     /* Generic registers whose values depend on the implementation */
6707     {
6708         ARMCPRegInfo sctlr = {
6709             .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
6710             .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
6711             .access = PL1_RW,
6712             .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
6713                                    offsetof(CPUARMState, cp15.sctlr_ns) },
6714             .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
6715             .raw_writefn = raw_write,
6716         };
6717         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
6718             /* Normally we would always end the TB on an SCTLR write, but Linux
6719              * arch/arm/mach-pxa/sleep.S expects two instructions following
6720              * an MMU enable to execute from cache.  Imitate this behaviour.
6721              */
6722             sctlr.type |= ARM_CP_SUPPRESS_TB_END;
6723         }
6724         define_one_arm_cp_reg(cpu, &sctlr);
6725     }
6726 
6727     if (cpu_isar_feature(aa64_lor, cpu)) {
6728         /*
6729          * A trivial implementation of ARMv8.1-LOR leaves all of these
6730          * registers fixed at 0, which indicates that there are zero
6731          * supported Limited Ordering regions.
6732          */
6733         static const ARMCPRegInfo lor_reginfo[] = {
6734             { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64,
6735               .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0,
6736               .access = PL1_RW, .accessfn = access_lor_other,
6737               .type = ARM_CP_CONST, .resetvalue = 0 },
6738             { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64,
6739               .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1,
6740               .access = PL1_RW, .accessfn = access_lor_other,
6741               .type = ARM_CP_CONST, .resetvalue = 0 },
6742             { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64,
6743               .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2,
6744               .access = PL1_RW, .accessfn = access_lor_other,
6745               .type = ARM_CP_CONST, .resetvalue = 0 },
6746             { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64,
6747               .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3,
6748               .access = PL1_RW, .accessfn = access_lor_other,
6749               .type = ARM_CP_CONST, .resetvalue = 0 },
6750             { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64,
6751               .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7,
6752               .access = PL1_R, .accessfn = access_lorid,
6753               .type = ARM_CP_CONST, .resetvalue = 0 },
6754             REGINFO_SENTINEL
6755         };
6756         define_arm_cp_regs(cpu, lor_reginfo);
6757     }
6758 
6759     if (cpu_isar_feature(aa64_sve, cpu)) {
6760         define_one_arm_cp_reg(cpu, &zcr_el1_reginfo);
6761         if (arm_feature(env, ARM_FEATURE_EL2)) {
6762             define_one_arm_cp_reg(cpu, &zcr_el2_reginfo);
6763         } else {
6764             define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo);
6765         }
6766         if (arm_feature(env, ARM_FEATURE_EL3)) {
6767             define_one_arm_cp_reg(cpu, &zcr_el3_reginfo);
6768         }
6769     }
6770 
6771 #ifdef TARGET_AARCH64
6772     if (cpu_isar_feature(aa64_pauth, cpu)) {
6773         define_arm_cp_regs(cpu, pauth_reginfo);
6774     }
6775     if (cpu_isar_feature(aa64_rndr, cpu)) {
6776         define_arm_cp_regs(cpu, rndr_reginfo);
6777     }
6778 #endif
6779 
6780     /*
6781      * While all v8.0 cpus support aarch64, QEMU does have configurations
6782      * that do not set ID_AA64ISAR1, e.g. user-only qemu-arm -cpu max,
6783      * which will set ID_ISAR6.
6784      */
6785     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
6786         ? cpu_isar_feature(aa64_predinv, cpu)
6787         : cpu_isar_feature(aa32_predinv, cpu)) {
6788         define_arm_cp_regs(cpu, predinv_reginfo);
6789     }
6790 }
6791 
6792 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
6793 {
6794     CPUState *cs = CPU(cpu);
6795     CPUARMState *env = &cpu->env;
6796 
6797     if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6798         gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
6799                                  aarch64_fpu_gdb_set_reg,
6800                                  34, "aarch64-fpu.xml", 0);
6801     } else if (arm_feature(env, ARM_FEATURE_NEON)) {
6802         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
6803                                  51, "arm-neon.xml", 0);
6804     } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
6805         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
6806                                  35, "arm-vfp3.xml", 0);
6807     } else if (arm_feature(env, ARM_FEATURE_VFP)) {
6808         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
6809                                  19, "arm-vfp.xml", 0);
6810     }
6811     gdb_register_coprocessor(cs, arm_gdb_get_sysreg, arm_gdb_set_sysreg,
6812                              arm_gen_dynamic_xml(cs),
6813                              "system-registers.xml", 0);
6814 }
6815 
6816 /* Sort alphabetically by type name, except for "any". */
6817 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
6818 {
6819     ObjectClass *class_a = (ObjectClass *)a;
6820     ObjectClass *class_b = (ObjectClass *)b;
6821     const char *name_a, *name_b;
6822 
6823     name_a = object_class_get_name(class_a);
6824     name_b = object_class_get_name(class_b);
6825     if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
6826         return 1;
6827     } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
6828         return -1;
6829     } else {
6830         return strcmp(name_a, name_b);
6831     }
6832 }
6833 
6834 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
6835 {
6836     ObjectClass *oc = data;
6837     const char *typename;
6838     char *name;
6839 
6840     typename = object_class_get_name(oc);
6841     name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
6842     qemu_printf("  %s\n", name);
6843     g_free(name);
6844 }
6845 
6846 void arm_cpu_list(void)
6847 {
6848     GSList *list;
6849 
6850     list = object_class_get_list(TYPE_ARM_CPU, false);
6851     list = g_slist_sort(list, arm_cpu_list_compare);
6852     qemu_printf("Available CPUs:\n");
6853     g_slist_foreach(list, arm_cpu_list_entry, NULL);
6854     g_slist_free(list);
6855 }
6856 
6857 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
6858 {
6859     ObjectClass *oc = data;
6860     CpuDefinitionInfoList **cpu_list = user_data;
6861     CpuDefinitionInfoList *entry;
6862     CpuDefinitionInfo *info;
6863     const char *typename;
6864 
6865     typename = object_class_get_name(oc);
6866     info = g_malloc0(sizeof(*info));
6867     info->name = g_strndup(typename,
6868                            strlen(typename) - strlen("-" TYPE_ARM_CPU));
6869     info->q_typename = g_strdup(typename);
6870 
6871     entry = g_malloc0(sizeof(*entry));
6872     entry->value = info;
6873     entry->next = *cpu_list;
6874     *cpu_list = entry;
6875 }
6876 
6877 CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
6878 {
6879     CpuDefinitionInfoList *cpu_list = NULL;
6880     GSList *list;
6881 
6882     list = object_class_get_list(TYPE_ARM_CPU, false);
6883     g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
6884     g_slist_free(list);
6885 
6886     return cpu_list;
6887 }
6888 
6889 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
6890                                    void *opaque, int state, int secstate,
6891                                    int crm, int opc1, int opc2,
6892                                    const char *name)
6893 {
6894     /* Private utility function for define_one_arm_cp_reg_with_opaque():
6895      * add a single reginfo struct to the hash table.
6896      */
6897     uint32_t *key = g_new(uint32_t, 1);
6898     ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
6899     int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
6900     int ns = (secstate & ARM_CP_SECSTATE_NS) ? 1 : 0;
6901 
6902     r2->name = g_strdup(name);
6903     /* Reset the secure state to the specific incoming state.  This is
6904      * necessary as the register may have been defined with both states.
6905      */
6906     r2->secure = secstate;
6907 
6908     if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
6909         /* Register is banked (using both entries in array).
6910          * Overwriting fieldoffset as the array is only used to define
6911          * banked registers but later only fieldoffset is used.
6912          */
6913         r2->fieldoffset = r->bank_fieldoffsets[ns];
6914     }
6915 
6916     if (state == ARM_CP_STATE_AA32) {
6917         if (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]) {
6918             /* If the register is banked then we don't need to migrate or
6919              * reset the 32-bit instance in certain cases:
6920              *
6921              * 1) If the register has both 32-bit and 64-bit instances then we
6922              *    can count on the 64-bit instance taking care of the
6923              *    non-secure bank.
6924              * 2) If ARMv8 is enabled then we can count on a 64-bit version
6925              *    taking care of the secure bank.  This requires that separate
6926              *    32 and 64-bit definitions are provided.
6927              */
6928             if ((r->state == ARM_CP_STATE_BOTH && ns) ||
6929                 (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
6930                 r2->type |= ARM_CP_ALIAS;
6931             }
6932         } else if ((secstate != r->secure) && !ns) {
6933             /* The register is not banked so we only want to allow migration of
6934              * the non-secure instance.
6935              */
6936             r2->type |= ARM_CP_ALIAS;
6937         }
6938 
6939         if (r->state == ARM_CP_STATE_BOTH) {
6940             /* We assume it is a cp15 register if the .cp field is left unset.
6941              */
6942             if (r2->cp == 0) {
6943                 r2->cp = 15;
6944             }
6945 
6946 #ifdef HOST_WORDS_BIGENDIAN
6947             if (r2->fieldoffset) {
6948                 r2->fieldoffset += sizeof(uint32_t);
6949             }
6950 #endif
6951         }
6952     }
6953     if (state == ARM_CP_STATE_AA64) {
6954         /* To allow abbreviation of ARMCPRegInfo
6955          * definitions, we treat cp == 0 as equivalent to
6956          * the value for "standard guest-visible sysreg".
6957          * STATE_BOTH definitions are also always "standard
6958          * sysreg" in their AArch64 view (the .cp value may
6959          * be non-zero for the benefit of the AArch32 view).
6960          */
6961         if (r->cp == 0 || r->state == ARM_CP_STATE_BOTH) {
6962             r2->cp = CP_REG_ARM64_SYSREG_CP;
6963         }
6964         *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
6965                                   r2->opc0, opc1, opc2);
6966     } else {
6967         *key = ENCODE_CP_REG(r2->cp, is64, ns, r2->crn, crm, opc1, opc2);
6968     }
6969     if (opaque) {
6970         r2->opaque = opaque;
6971     }
6972     /* reginfo passed to helpers is correct for the actual access,
6973      * and is never ARM_CP_STATE_BOTH:
6974      */
6975     r2->state = state;
6976     /* Make sure reginfo passed to helpers for wildcarded regs
6977      * has the correct crm/opc1/opc2 for this reg, not CP_ANY:
6978      */
6979     r2->crm = crm;
6980     r2->opc1 = opc1;
6981     r2->opc2 = opc2;
6982     /* By convention, for wildcarded registers only the first
6983      * entry is used for migration; the others are marked as
6984      * ALIAS so we don't try to transfer the register
6985      * multiple times. Special registers (ie NOP/WFI) are
6986      * never migratable and not even raw-accessible.
6987      */
6988     if ((r->type & ARM_CP_SPECIAL)) {
6989         r2->type |= ARM_CP_NO_RAW;
6990     }
6991     if (((r->crm == CP_ANY) && crm != 0) ||
6992         ((r->opc1 == CP_ANY) && opc1 != 0) ||
6993         ((r->opc2 == CP_ANY) && opc2 != 0)) {
6994         r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
6995     }
6996 
6997     /* Check that raw accesses are either forbidden or handled. Note that
6998      * we can't assert this earlier because the setup of fieldoffset for
6999      * banked registers has to be done first.
7000      */
7001     if (!(r2->type & ARM_CP_NO_RAW)) {
7002         assert(!raw_accessors_invalid(r2));
7003     }
7004 
7005     /* Overriding of an existing definition must be explicitly
7006      * requested.
7007      */
7008     if (!(r->type & ARM_CP_OVERRIDE)) {
7009         ARMCPRegInfo *oldreg;
7010         oldreg = g_hash_table_lookup(cpu->cp_regs, key);
7011         if (oldreg && !(oldreg->type & ARM_CP_OVERRIDE)) {
7012             fprintf(stderr, "Register redefined: cp=%d %d bit "
7013                     "crn=%d crm=%d opc1=%d opc2=%d, "
7014                     "was %s, now %s\n", r2->cp, 32 + 32 * is64,
7015                     r2->crn, r2->crm, r2->opc1, r2->opc2,
7016                     oldreg->name, r2->name);
7017             g_assert_not_reached();
7018         }
7019     }
7020     g_hash_table_insert(cpu->cp_regs, key, r2);
7021 }
7022 
7023 
7024 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
7025                                        const ARMCPRegInfo *r, void *opaque)
7026 {
7027     /* Define implementations of coprocessor registers.
7028      * We store these in a hashtable because typically
7029      * there are less than 150 registers in a space which
7030      * is 16*16*16*8*8 = 262144 in size.
7031      * Wildcarding is supported for the crm, opc1 and opc2 fields.
7032      * If a register is defined twice then the second definition is
7033      * used, so this can be used to define some generic registers and
7034      * then override them with implementation specific variations.
7035      * At least one of the original and the second definition should
7036      * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
7037      * against accidental use.
7038      *
7039      * The state field defines whether the register is to be
7040      * visible in the AArch32 or AArch64 execution state. If the
7041      * state is set to ARM_CP_STATE_BOTH then we synthesise a
7042      * reginfo structure for the AArch32 view, which sees the lower
7043      * 32 bits of the 64 bit register.
7044      *
7045      * Only registers visible in AArch64 may set r->opc0; opc0 cannot
7046      * be wildcarded. AArch64 registers are always considered to be 64
7047      * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
7048      * the register, if any.
7049      */
7050     int crm, opc1, opc2, state;
7051     int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
7052     int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
7053     int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
7054     int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
7055     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
7056     int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
7057     /* 64 bit registers have only CRm and Opc1 fields */
7058     assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
7059     /* op0 only exists in the AArch64 encodings */
7060     assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
7061     /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
7062     assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
7063     /* The AArch64 pseudocode CheckSystemAccess() specifies that op1
7064      * encodes a minimum access level for the register. We roll this
7065      * runtime check into our general permission check code, so check
7066      * here that the reginfo's specified permissions are strict enough
7067      * to encompass the generic architectural permission check.
7068      */
7069     if (r->state != ARM_CP_STATE_AA32) {
7070         int mask = 0;
7071         switch (r->opc1) {
7072         case 0:
7073             /* min_EL EL1, but some accessible to EL0 via kernel ABI */
7074             mask = PL0U_R | PL1_RW;
7075             break;
7076         case 1: case 2:
7077             /* min_EL EL1 */
7078             mask = PL1_RW;
7079             break;
7080         case 3:
7081             /* min_EL EL0 */
7082             mask = PL0_RW;
7083             break;
7084         case 4:
7085             /* min_EL EL2 */
7086             mask = PL2_RW;
7087             break;
7088         case 5:
7089             /* unallocated encoding, so not possible */
7090             assert(false);
7091             break;
7092         case 6:
7093             /* min_EL EL3 */
7094             mask = PL3_RW;
7095             break;
7096         case 7:
7097             /* min_EL EL1, secure mode only (we don't check the latter) */
7098             mask = PL1_RW;
7099             break;
7100         default:
7101             /* broken reginfo with out-of-range opc1 */
7102             assert(false);
7103             break;
7104         }
7105         /* assert our permissions are not too lax (stricter is fine) */
7106         assert((r->access & ~mask) == 0);
7107     }
7108 
7109     /* Check that the register definition has enough info to handle
7110      * reads and writes if they are permitted.
7111      */
7112     if (!(r->type & (ARM_CP_SPECIAL|ARM_CP_CONST))) {
7113         if (r->access & PL3_R) {
7114             assert((r->fieldoffset ||
7115                    (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
7116                    r->readfn);
7117         }
7118         if (r->access & PL3_W) {
7119             assert((r->fieldoffset ||
7120                    (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
7121                    r->writefn);
7122         }
7123     }
7124     /* Bad type field probably means missing sentinel at end of reg list */
7125     assert(cptype_valid(r->type));
7126     for (crm = crmmin; crm <= crmmax; crm++) {
7127         for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
7128             for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
7129                 for (state = ARM_CP_STATE_AA32;
7130                      state <= ARM_CP_STATE_AA64; state++) {
7131                     if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
7132                         continue;
7133                     }
7134                     if (state == ARM_CP_STATE_AA32) {
7135                         /* Under AArch32 CP registers can be common
7136                          * (same for secure and non-secure world) or banked.
7137                          */
7138                         char *name;
7139 
7140                         switch (r->secure) {
7141                         case ARM_CP_SECSTATE_S:
7142                         case ARM_CP_SECSTATE_NS:
7143                             add_cpreg_to_hashtable(cpu, r, opaque, state,
7144                                                    r->secure, crm, opc1, opc2,
7145                                                    r->name);
7146                             break;
7147                         default:
7148                             name = g_strdup_printf("%s_S", r->name);
7149                             add_cpreg_to_hashtable(cpu, r, opaque, state,
7150                                                    ARM_CP_SECSTATE_S,
7151                                                    crm, opc1, opc2, name);
7152                             g_free(name);
7153                             add_cpreg_to_hashtable(cpu, r, opaque, state,
7154                                                    ARM_CP_SECSTATE_NS,
7155                                                    crm, opc1, opc2, r->name);
7156                             break;
7157                         }
7158                     } else {
7159                         /* AArch64 registers get mapped to non-secure instance
7160                          * of AArch32 */
7161                         add_cpreg_to_hashtable(cpu, r, opaque, state,
7162                                                ARM_CP_SECSTATE_NS,
7163                                                crm, opc1, opc2, r->name);
7164                     }
7165                 }
7166             }
7167         }
7168     }
7169 }
7170 
7171 void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
7172                                     const ARMCPRegInfo *regs, void *opaque)
7173 {
7174     /* Define a whole list of registers */
7175     const ARMCPRegInfo *r;
7176     for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
7177         define_one_arm_cp_reg_with_opaque(cpu, r, opaque);
7178     }
7179 }
7180 
7181 /*
7182  * Modify ARMCPRegInfo for access from userspace.
7183  *
7184  * This is a data driven modification directed by
7185  * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as
7186  * user-space cannot alter any values and dynamic values pertaining to
7187  * execution state are hidden from user space view anyway.
7188  */
7189 void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
7190 {
7191     const ARMCPRegUserSpaceInfo *m;
7192     ARMCPRegInfo *r;
7193 
7194     for (m = mods; m->name; m++) {
7195         GPatternSpec *pat = NULL;
7196         if (m->is_glob) {
7197             pat = g_pattern_spec_new(m->name);
7198         }
7199         for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
7200             if (pat && g_pattern_match_string(pat, r->name)) {
7201                 r->type = ARM_CP_CONST;
7202                 r->access = PL0U_R;
7203                 r->resetvalue = 0;
7204                 /* continue */
7205             } else if (strcmp(r->name, m->name) == 0) {
7206                 r->type = ARM_CP_CONST;
7207                 r->access = PL0U_R;
7208                 r->resetvalue &= m->exported_bits;
7209                 r->resetvalue |= m->fixed_bits;
7210                 break;
7211             }
7212         }
7213         if (pat) {
7214             g_pattern_spec_free(pat);
7215         }
7216     }
7217 }
7218 
7219 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
7220 {
7221     return g_hash_table_lookup(cpregs, &encoded_cp);
7222 }
7223 
7224 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
7225                          uint64_t value)
7226 {
7227     /* Helper coprocessor write function for write-ignore registers */
7228 }
7229 
7230 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
7231 {
7232     /* Helper coprocessor write function for read-as-zero registers */
7233     return 0;
7234 }
7235 
7236 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
7237 {
7238     /* Helper coprocessor reset function for do-nothing-on-reset registers */
7239 }
7240 
7241 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type)
7242 {
7243     /* Return true if it is not valid for us to switch to
7244      * this CPU mode (ie all the UNPREDICTABLE cases in
7245      * the ARM ARM CPSRWriteByInstr pseudocode).
7246      */
7247 
7248     /* Changes to or from Hyp via MSR and CPS are illegal. */
7249     if (write_type == CPSRWriteByInstr &&
7250         ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP ||
7251          mode == ARM_CPU_MODE_HYP)) {
7252         return 1;
7253     }
7254 
7255     switch (mode) {
7256     case ARM_CPU_MODE_USR:
7257         return 0;
7258     case ARM_CPU_MODE_SYS:
7259     case ARM_CPU_MODE_SVC:
7260     case ARM_CPU_MODE_ABT:
7261     case ARM_CPU_MODE_UND:
7262     case ARM_CPU_MODE_IRQ:
7263     case ARM_CPU_MODE_FIQ:
7264         /* Note that we don't implement the IMPDEF NSACR.RFR which in v7
7265          * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.)
7266          */
7267         /* If HCR.TGE is set then changes from Monitor to NS PL1 via MSR
7268          * and CPS are treated as illegal mode changes.
7269          */
7270         if (write_type == CPSRWriteByInstr &&
7271             (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON &&
7272             (arm_hcr_el2_eff(env) & HCR_TGE)) {
7273             return 1;
7274         }
7275         return 0;
7276     case ARM_CPU_MODE_HYP:
7277         return !arm_feature(env, ARM_FEATURE_EL2)
7278             || arm_current_el(env) < 2 || arm_is_secure_below_el3(env);
7279     case ARM_CPU_MODE_MON:
7280         return arm_current_el(env) < 3;
7281     default:
7282         return 1;
7283     }
7284 }
7285 
7286 uint32_t cpsr_read(CPUARMState *env)
7287 {
7288     int ZF;
7289     ZF = (env->ZF == 0);
7290     return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
7291         (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
7292         | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
7293         | ((env->condexec_bits & 0xfc) << 8)
7294         | (env->GE << 16) | (env->daif & CPSR_AIF);
7295 }
7296 
7297 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask,
7298                 CPSRWriteType write_type)
7299 {
7300     uint32_t changed_daif;
7301 
7302     if (mask & CPSR_NZCV) {
7303         env->ZF = (~val) & CPSR_Z;
7304         env->NF = val;
7305         env->CF = (val >> 29) & 1;
7306         env->VF = (val << 3) & 0x80000000;
7307     }
7308     if (mask & CPSR_Q)
7309         env->QF = ((val & CPSR_Q) != 0);
7310     if (mask & CPSR_T)
7311         env->thumb = ((val & CPSR_T) != 0);
7312     if (mask & CPSR_IT_0_1) {
7313         env->condexec_bits &= ~3;
7314         env->condexec_bits |= (val >> 25) & 3;
7315     }
7316     if (mask & CPSR_IT_2_7) {
7317         env->condexec_bits &= 3;
7318         env->condexec_bits |= (val >> 8) & 0xfc;
7319     }
7320     if (mask & CPSR_GE) {
7321         env->GE = (val >> 16) & 0xf;
7322     }
7323 
7324     /* In a V7 implementation that includes the security extensions but does
7325      * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
7326      * whether non-secure software is allowed to change the CPSR_F and CPSR_A
7327      * bits respectively.
7328      *
7329      * In a V8 implementation, it is permitted for privileged software to
7330      * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
7331      */
7332     if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) &&
7333         arm_feature(env, ARM_FEATURE_EL3) &&
7334         !arm_feature(env, ARM_FEATURE_EL2) &&
7335         !arm_is_secure(env)) {
7336 
7337         changed_daif = (env->daif ^ val) & mask;
7338 
7339         if (changed_daif & CPSR_A) {
7340             /* Check to see if we are allowed to change the masking of async
7341              * abort exceptions from a non-secure state.
7342              */
7343             if (!(env->cp15.scr_el3 & SCR_AW)) {
7344                 qemu_log_mask(LOG_GUEST_ERROR,
7345                               "Ignoring attempt to switch CPSR_A flag from "
7346                               "non-secure world with SCR.AW bit clear\n");
7347                 mask &= ~CPSR_A;
7348             }
7349         }
7350 
7351         if (changed_daif & CPSR_F) {
7352             /* Check to see if we are allowed to change the masking of FIQ
7353              * exceptions from a non-secure state.
7354              */
7355             if (!(env->cp15.scr_el3 & SCR_FW)) {
7356                 qemu_log_mask(LOG_GUEST_ERROR,
7357                               "Ignoring attempt to switch CPSR_F flag from "
7358                               "non-secure world with SCR.FW bit clear\n");
7359                 mask &= ~CPSR_F;
7360             }
7361 
7362             /* Check whether non-maskable FIQ (NMFI) support is enabled.
7363              * If this bit is set software is not allowed to mask
7364              * FIQs, but is allowed to set CPSR_F to 0.
7365              */
7366             if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) &&
7367                 (val & CPSR_F)) {
7368                 qemu_log_mask(LOG_GUEST_ERROR,
7369                               "Ignoring attempt to enable CPSR_F flag "
7370                               "(non-maskable FIQ [NMFI] support enabled)\n");
7371                 mask &= ~CPSR_F;
7372             }
7373         }
7374     }
7375 
7376     env->daif &= ~(CPSR_AIF & mask);
7377     env->daif |= val & CPSR_AIF & mask;
7378 
7379     if (write_type != CPSRWriteRaw &&
7380         ((env->uncached_cpsr ^ val) & mask & CPSR_M)) {
7381         if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) {
7382             /* Note that we can only get here in USR mode if this is a
7383              * gdb stub write; for this case we follow the architectural
7384              * behaviour for guest writes in USR mode of ignoring an attempt
7385              * to switch mode. (Those are caught by translate.c for writes
7386              * triggered by guest instructions.)
7387              */
7388             mask &= ~CPSR_M;
7389         } else if (bad_mode_switch(env, val & CPSR_M, write_type)) {
7390             /* Attempt to switch to an invalid mode: this is UNPREDICTABLE in
7391              * v7, and has defined behaviour in v8:
7392              *  + leave CPSR.M untouched
7393              *  + allow changes to the other CPSR fields
7394              *  + set PSTATE.IL
7395              * For user changes via the GDB stub, we don't set PSTATE.IL,
7396              * as this would be unnecessarily harsh for a user error.
7397              */
7398             mask &= ~CPSR_M;
7399             if (write_type != CPSRWriteByGDBStub &&
7400                 arm_feature(env, ARM_FEATURE_V8)) {
7401                 mask |= CPSR_IL;
7402                 val |= CPSR_IL;
7403             }
7404             qemu_log_mask(LOG_GUEST_ERROR,
7405                           "Illegal AArch32 mode switch attempt from %s to %s\n",
7406                           aarch32_mode_name(env->uncached_cpsr),
7407                           aarch32_mode_name(val));
7408         } else {
7409             qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n",
7410                           write_type == CPSRWriteExceptionReturn ?
7411                           "Exception return from AArch32" :
7412                           "AArch32 mode switch from",
7413                           aarch32_mode_name(env->uncached_cpsr),
7414                           aarch32_mode_name(val), env->regs[15]);
7415             switch_mode(env, val & CPSR_M);
7416         }
7417     }
7418     mask &= ~CACHED_CPSR_BITS;
7419     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
7420 }
7421 
7422 /* Sign/zero extend */
7423 uint32_t HELPER(sxtb16)(uint32_t x)
7424 {
7425     uint32_t res;
7426     res = (uint16_t)(int8_t)x;
7427     res |= (uint32_t)(int8_t)(x >> 16) << 16;
7428     return res;
7429 }
7430 
7431 uint32_t HELPER(uxtb16)(uint32_t x)
7432 {
7433     uint32_t res;
7434     res = (uint16_t)(uint8_t)x;
7435     res |= (uint32_t)(uint8_t)(x >> 16) << 16;
7436     return res;
7437 }
7438 
7439 int32_t HELPER(sdiv)(int32_t num, int32_t den)
7440 {
7441     if (den == 0)
7442       return 0;
7443     if (num == INT_MIN && den == -1)
7444       return INT_MIN;
7445     return num / den;
7446 }
7447 
7448 uint32_t HELPER(udiv)(uint32_t num, uint32_t den)
7449 {
7450     if (den == 0)
7451       return 0;
7452     return num / den;
7453 }
7454 
7455 uint32_t HELPER(rbit)(uint32_t x)
7456 {
7457     return revbit32(x);
7458 }
7459 
7460 #ifdef CONFIG_USER_ONLY
7461 
7462 static void switch_mode(CPUARMState *env, int mode)
7463 {
7464     ARMCPU *cpu = env_archcpu(env);
7465 
7466     if (mode != ARM_CPU_MODE_USR) {
7467         cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
7468     }
7469 }
7470 
7471 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
7472                                  uint32_t cur_el, bool secure)
7473 {
7474     return 1;
7475 }
7476 
7477 void aarch64_sync_64_to_32(CPUARMState *env)
7478 {
7479     g_assert_not_reached();
7480 }
7481 
7482 #else
7483 
7484 static void switch_mode(CPUARMState *env, int mode)
7485 {
7486     int old_mode;
7487     int i;
7488 
7489     old_mode = env->uncached_cpsr & CPSR_M;
7490     if (mode == old_mode)
7491         return;
7492 
7493     if (old_mode == ARM_CPU_MODE_FIQ) {
7494         memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
7495         memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
7496     } else if (mode == ARM_CPU_MODE_FIQ) {
7497         memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
7498         memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
7499     }
7500 
7501     i = bank_number(old_mode);
7502     env->banked_r13[i] = env->regs[13];
7503     env->banked_spsr[i] = env->spsr;
7504 
7505     i = bank_number(mode);
7506     env->regs[13] = env->banked_r13[i];
7507     env->spsr = env->banked_spsr[i];
7508 
7509     env->banked_r14[r14_bank_number(old_mode)] = env->regs[14];
7510     env->regs[14] = env->banked_r14[r14_bank_number(mode)];
7511 }
7512 
7513 /* Physical Interrupt Target EL Lookup Table
7514  *
7515  * [ From ARM ARM section G1.13.4 (Table G1-15) ]
7516  *
7517  * The below multi-dimensional table is used for looking up the target
7518  * exception level given numerous condition criteria.  Specifically, the
7519  * target EL is based on SCR and HCR routing controls as well as the
7520  * currently executing EL and secure state.
7521  *
7522  *    Dimensions:
7523  *    target_el_table[2][2][2][2][2][4]
7524  *                    |  |  |  |  |  +--- Current EL
7525  *                    |  |  |  |  +------ Non-secure(0)/Secure(1)
7526  *                    |  |  |  +--------- HCR mask override
7527  *                    |  |  +------------ SCR exec state control
7528  *                    |  +--------------- SCR mask override
7529  *                    +------------------ 32-bit(0)/64-bit(1) EL3
7530  *
7531  *    The table values are as such:
7532  *    0-3 = EL0-EL3
7533  *     -1 = Cannot occur
7534  *
7535  * The ARM ARM target EL table includes entries indicating that an "exception
7536  * is not taken".  The two cases where this is applicable are:
7537  *    1) An exception is taken from EL3 but the SCR does not have the exception
7538  *    routed to EL3.
7539  *    2) An exception is taken from EL2 but the HCR does not have the exception
7540  *    routed to EL2.
7541  * In these two cases, the below table contain a target of EL1.  This value is
7542  * returned as it is expected that the consumer of the table data will check
7543  * for "target EL >= current EL" to ensure the exception is not taken.
7544  *
7545  *            SCR     HCR
7546  *         64  EA     AMO                 From
7547  *        BIT IRQ     IMO      Non-secure         Secure
7548  *        EL3 FIQ  RW FMO   EL0 EL1 EL2 EL3   EL0 EL1 EL2 EL3
7549  */
7550 static const int8_t target_el_table[2][2][2][2][2][4] = {
7551     {{{{/* 0   0   0   0 */{ 1,  1,  2, -1 },{ 3, -1, -1,  3 },},
7552        {/* 0   0   0   1 */{ 2,  2,  2, -1 },{ 3, -1, -1,  3 },},},
7553       {{/* 0   0   1   0 */{ 1,  1,  2, -1 },{ 3, -1, -1,  3 },},
7554        {/* 0   0   1   1 */{ 2,  2,  2, -1 },{ 3, -1, -1,  3 },},},},
7555      {{{/* 0   1   0   0 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},
7556        {/* 0   1   0   1 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},},
7557       {{/* 0   1   1   0 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},
7558        {/* 0   1   1   1 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},},},},
7559     {{{{/* 1   0   0   0 */{ 1,  1,  2, -1 },{ 1,  1, -1,  1 },},
7560        {/* 1   0   0   1 */{ 2,  2,  2, -1 },{ 1,  1, -1,  1 },},},
7561       {{/* 1   0   1   0 */{ 1,  1,  1, -1 },{ 1,  1, -1,  1 },},
7562        {/* 1   0   1   1 */{ 2,  2,  2, -1 },{ 1,  1, -1,  1 },},},},
7563      {{{/* 1   1   0   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
7564        {/* 1   1   0   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},
7565       {{/* 1   1   1   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
7566        {/* 1   1   1   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},},},
7567 };
7568 
7569 /*
7570  * Determine the target EL for physical exceptions
7571  */
7572 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
7573                                  uint32_t cur_el, bool secure)
7574 {
7575     CPUARMState *env = cs->env_ptr;
7576     bool rw;
7577     bool scr;
7578     bool hcr;
7579     int target_el;
7580     /* Is the highest EL AArch64? */
7581     bool is64 = arm_feature(env, ARM_FEATURE_AARCH64);
7582     uint64_t hcr_el2;
7583 
7584     if (arm_feature(env, ARM_FEATURE_EL3)) {
7585         rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
7586     } else {
7587         /* Either EL2 is the highest EL (and so the EL2 register width
7588          * is given by is64); or there is no EL2 or EL3, in which case
7589          * the value of 'rw' does not affect the table lookup anyway.
7590          */
7591         rw = is64;
7592     }
7593 
7594     hcr_el2 = arm_hcr_el2_eff(env);
7595     switch (excp_idx) {
7596     case EXCP_IRQ:
7597         scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ);
7598         hcr = hcr_el2 & HCR_IMO;
7599         break;
7600     case EXCP_FIQ:
7601         scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ);
7602         hcr = hcr_el2 & HCR_FMO;
7603         break;
7604     default:
7605         scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA);
7606         hcr = hcr_el2 & HCR_AMO;
7607         break;
7608     };
7609 
7610     /* Perform a table-lookup for the target EL given the current state */
7611     target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
7612 
7613     assert(target_el > 0);
7614 
7615     return target_el;
7616 }
7617 
7618 void arm_log_exception(int idx)
7619 {
7620     if (qemu_loglevel_mask(CPU_LOG_INT)) {
7621         const char *exc = NULL;
7622         static const char * const excnames[] = {
7623             [EXCP_UDEF] = "Undefined Instruction",
7624             [EXCP_SWI] = "SVC",
7625             [EXCP_PREFETCH_ABORT] = "Prefetch Abort",
7626             [EXCP_DATA_ABORT] = "Data Abort",
7627             [EXCP_IRQ] = "IRQ",
7628             [EXCP_FIQ] = "FIQ",
7629             [EXCP_BKPT] = "Breakpoint",
7630             [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit",
7631             [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage",
7632             [EXCP_HVC] = "Hypervisor Call",
7633             [EXCP_HYP_TRAP] = "Hypervisor Trap",
7634             [EXCP_SMC] = "Secure Monitor Call",
7635             [EXCP_VIRQ] = "Virtual IRQ",
7636             [EXCP_VFIQ] = "Virtual FIQ",
7637             [EXCP_SEMIHOST] = "Semihosting call",
7638             [EXCP_NOCP] = "v7M NOCP UsageFault",
7639             [EXCP_INVSTATE] = "v7M INVSTATE UsageFault",
7640             [EXCP_STKOF] = "v8M STKOF UsageFault",
7641             [EXCP_LAZYFP] = "v7M exception during lazy FP stacking",
7642             [EXCP_LSERR] = "v8M LSERR UsageFault",
7643             [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
7644         };
7645 
7646         if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
7647             exc = excnames[idx];
7648         }
7649         if (!exc) {
7650             exc = "unknown";
7651         }
7652         qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc);
7653     }
7654 }
7655 
7656 /*
7657  * Function used to synchronize QEMU's AArch64 register set with AArch32
7658  * register set.  This is necessary when switching between AArch32 and AArch64
7659  * execution state.
7660  */
7661 void aarch64_sync_32_to_64(CPUARMState *env)
7662 {
7663     int i;
7664     uint32_t mode = env->uncached_cpsr & CPSR_M;
7665 
7666     /* We can blanket copy R[0:7] to X[0:7] */
7667     for (i = 0; i < 8; i++) {
7668         env->xregs[i] = env->regs[i];
7669     }
7670 
7671     /*
7672      * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
7673      * Otherwise, they come from the banked user regs.
7674      */
7675     if (mode == ARM_CPU_MODE_FIQ) {
7676         for (i = 8; i < 13; i++) {
7677             env->xregs[i] = env->usr_regs[i - 8];
7678         }
7679     } else {
7680         for (i = 8; i < 13; i++) {
7681             env->xregs[i] = env->regs[i];
7682         }
7683     }
7684 
7685     /*
7686      * Registers x13-x23 are the various mode SP and FP registers. Registers
7687      * r13 and r14 are only copied if we are in that mode, otherwise we copy
7688      * from the mode banked register.
7689      */
7690     if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
7691         env->xregs[13] = env->regs[13];
7692         env->xregs[14] = env->regs[14];
7693     } else {
7694         env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)];
7695         /* HYP is an exception in that it is copied from r14 */
7696         if (mode == ARM_CPU_MODE_HYP) {
7697             env->xregs[14] = env->regs[14];
7698         } else {
7699             env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)];
7700         }
7701     }
7702 
7703     if (mode == ARM_CPU_MODE_HYP) {
7704         env->xregs[15] = env->regs[13];
7705     } else {
7706         env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)];
7707     }
7708 
7709     if (mode == ARM_CPU_MODE_IRQ) {
7710         env->xregs[16] = env->regs[14];
7711         env->xregs[17] = env->regs[13];
7712     } else {
7713         env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)];
7714         env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
7715     }
7716 
7717     if (mode == ARM_CPU_MODE_SVC) {
7718         env->xregs[18] = env->regs[14];
7719         env->xregs[19] = env->regs[13];
7720     } else {
7721         env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)];
7722         env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
7723     }
7724 
7725     if (mode == ARM_CPU_MODE_ABT) {
7726         env->xregs[20] = env->regs[14];
7727         env->xregs[21] = env->regs[13];
7728     } else {
7729         env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)];
7730         env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
7731     }
7732 
7733     if (mode == ARM_CPU_MODE_UND) {
7734         env->xregs[22] = env->regs[14];
7735         env->xregs[23] = env->regs[13];
7736     } else {
7737         env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)];
7738         env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
7739     }
7740 
7741     /*
7742      * Registers x24-x30 are mapped to r8-r14 in FIQ mode.  If we are in FIQ
7743      * mode, then we can copy from r8-r14.  Otherwise, we copy from the
7744      * FIQ bank for r8-r14.
7745      */
7746     if (mode == ARM_CPU_MODE_FIQ) {
7747         for (i = 24; i < 31; i++) {
7748             env->xregs[i] = env->regs[i - 16];   /* X[24:30] <- R[8:14] */
7749         }
7750     } else {
7751         for (i = 24; i < 29; i++) {
7752             env->xregs[i] = env->fiq_regs[i - 24];
7753         }
7754         env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
7755         env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)];
7756     }
7757 
7758     env->pc = env->regs[15];
7759 }
7760 
7761 /*
7762  * Function used to synchronize QEMU's AArch32 register set with AArch64
7763  * register set.  This is necessary when switching between AArch32 and AArch64
7764  * execution state.
7765  */
7766 void aarch64_sync_64_to_32(CPUARMState *env)
7767 {
7768     int i;
7769     uint32_t mode = env->uncached_cpsr & CPSR_M;
7770 
7771     /* We can blanket copy X[0:7] to R[0:7] */
7772     for (i = 0; i < 8; i++) {
7773         env->regs[i] = env->xregs[i];
7774     }
7775 
7776     /*
7777      * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
7778      * Otherwise, we copy x8-x12 into the banked user regs.
7779      */
7780     if (mode == ARM_CPU_MODE_FIQ) {
7781         for (i = 8; i < 13; i++) {
7782             env->usr_regs[i - 8] = env->xregs[i];
7783         }
7784     } else {
7785         for (i = 8; i < 13; i++) {
7786             env->regs[i] = env->xregs[i];
7787         }
7788     }
7789 
7790     /*
7791      * Registers r13 & r14 depend on the current mode.
7792      * If we are in a given mode, we copy the corresponding x registers to r13
7793      * and r14.  Otherwise, we copy the x register to the banked r13 and r14
7794      * for the mode.
7795      */
7796     if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
7797         env->regs[13] = env->xregs[13];
7798         env->regs[14] = env->xregs[14];
7799     } else {
7800         env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13];
7801 
7802         /*
7803          * HYP is an exception in that it does not have its own banked r14 but
7804          * shares the USR r14
7805          */
7806         if (mode == ARM_CPU_MODE_HYP) {
7807             env->regs[14] = env->xregs[14];
7808         } else {
7809             env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
7810         }
7811     }
7812 
7813     if (mode == ARM_CPU_MODE_HYP) {
7814         env->regs[13] = env->xregs[15];
7815     } else {
7816         env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15];
7817     }
7818 
7819     if (mode == ARM_CPU_MODE_IRQ) {
7820         env->regs[14] = env->xregs[16];
7821         env->regs[13] = env->xregs[17];
7822     } else {
7823         env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
7824         env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
7825     }
7826 
7827     if (mode == ARM_CPU_MODE_SVC) {
7828         env->regs[14] = env->xregs[18];
7829         env->regs[13] = env->xregs[19];
7830     } else {
7831         env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
7832         env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
7833     }
7834 
7835     if (mode == ARM_CPU_MODE_ABT) {
7836         env->regs[14] = env->xregs[20];
7837         env->regs[13] = env->xregs[21];
7838     } else {
7839         env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
7840         env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
7841     }
7842 
7843     if (mode == ARM_CPU_MODE_UND) {
7844         env->regs[14] = env->xregs[22];
7845         env->regs[13] = env->xregs[23];
7846     } else {
7847         env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
7848         env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
7849     }
7850 
7851     /* Registers x24-x30 are mapped to r8-r14 in FIQ mode.  If we are in FIQ
7852      * mode, then we can copy to r8-r14.  Otherwise, we copy to the
7853      * FIQ bank for r8-r14.
7854      */
7855     if (mode == ARM_CPU_MODE_FIQ) {
7856         for (i = 24; i < 31; i++) {
7857             env->regs[i - 16] = env->xregs[i];   /* X[24:30] -> R[8:14] */
7858         }
7859     } else {
7860         for (i = 24; i < 29; i++) {
7861             env->fiq_regs[i - 24] = env->xregs[i];
7862         }
7863         env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
7864         env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
7865     }
7866 
7867     env->regs[15] = env->pc;
7868 }
7869 
7870 static void take_aarch32_exception(CPUARMState *env, int new_mode,
7871                                    uint32_t mask, uint32_t offset,
7872                                    uint32_t newpc)
7873 {
7874     /* Change the CPU state so as to actually take the exception. */
7875     switch_mode(env, new_mode);
7876     /*
7877      * For exceptions taken to AArch32 we must clear the SS bit in both
7878      * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
7879      */
7880     env->uncached_cpsr &= ~PSTATE_SS;
7881     env->spsr = cpsr_read(env);
7882     /* Clear IT bits.  */
7883     env->condexec_bits = 0;
7884     /* Switch to the new mode, and to the correct instruction set.  */
7885     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
7886     /* Set new mode endianness */
7887     env->uncached_cpsr &= ~CPSR_E;
7888     if (env->cp15.sctlr_el[arm_current_el(env)] & SCTLR_EE) {
7889         env->uncached_cpsr |= CPSR_E;
7890     }
7891     /* J and IL must always be cleared for exception entry */
7892     env->uncached_cpsr &= ~(CPSR_IL | CPSR_J);
7893     env->daif |= mask;
7894 
7895     if (new_mode == ARM_CPU_MODE_HYP) {
7896         env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0;
7897         env->elr_el[2] = env->regs[15];
7898     } else {
7899         /*
7900          * this is a lie, as there was no c1_sys on V4T/V5, but who cares
7901          * and we should just guard the thumb mode on V4
7902          */
7903         if (arm_feature(env, ARM_FEATURE_V4T)) {
7904             env->thumb =
7905                 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0;
7906         }
7907         env->regs[14] = env->regs[15] + offset;
7908     }
7909     env->regs[15] = newpc;
7910 }
7911 
7912 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
7913 {
7914     /*
7915      * Handle exception entry to Hyp mode; this is sufficiently
7916      * different to entry to other AArch32 modes that we handle it
7917      * separately here.
7918      *
7919      * The vector table entry used is always the 0x14 Hyp mode entry point,
7920      * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp.
7921      * The offset applied to the preferred return address is always zero
7922      * (see DDI0487C.a section G1.12.3).
7923      * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values.
7924      */
7925     uint32_t addr, mask;
7926     ARMCPU *cpu = ARM_CPU(cs);
7927     CPUARMState *env = &cpu->env;
7928 
7929     switch (cs->exception_index) {
7930     case EXCP_UDEF:
7931         addr = 0x04;
7932         break;
7933     case EXCP_SWI:
7934         addr = 0x14;
7935         break;
7936     case EXCP_BKPT:
7937         /* Fall through to prefetch abort.  */
7938     case EXCP_PREFETCH_ABORT:
7939         env->cp15.ifar_s = env->exception.vaddress;
7940         qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n",
7941                       (uint32_t)env->exception.vaddress);
7942         addr = 0x0c;
7943         break;
7944     case EXCP_DATA_ABORT:
7945         env->cp15.dfar_s = env->exception.vaddress;
7946         qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n",
7947                       (uint32_t)env->exception.vaddress);
7948         addr = 0x10;
7949         break;
7950     case EXCP_IRQ:
7951         addr = 0x18;
7952         break;
7953     case EXCP_FIQ:
7954         addr = 0x1c;
7955         break;
7956     case EXCP_HVC:
7957         addr = 0x08;
7958         break;
7959     case EXCP_HYP_TRAP:
7960         addr = 0x14;
7961         break;
7962     default:
7963         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
7964     }
7965 
7966     if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) {
7967         if (!arm_feature(env, ARM_FEATURE_V8)) {
7968             /*
7969              * QEMU syndrome values are v8-style. v7 has the IL bit
7970              * UNK/SBZP for "field not valid" cases, where v8 uses RES1.
7971              * If this is a v7 CPU, squash the IL bit in those cases.
7972              */
7973             if (cs->exception_index == EXCP_PREFETCH_ABORT ||
7974                 (cs->exception_index == EXCP_DATA_ABORT &&
7975                  !(env->exception.syndrome & ARM_EL_ISV)) ||
7976                 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) {
7977                 env->exception.syndrome &= ~ARM_EL_IL;
7978             }
7979         }
7980         env->cp15.esr_el[2] = env->exception.syndrome;
7981     }
7982 
7983     if (arm_current_el(env) != 2 && addr < 0x14) {
7984         addr = 0x14;
7985     }
7986 
7987     mask = 0;
7988     if (!(env->cp15.scr_el3 & SCR_EA)) {
7989         mask |= CPSR_A;
7990     }
7991     if (!(env->cp15.scr_el3 & SCR_IRQ)) {
7992         mask |= CPSR_I;
7993     }
7994     if (!(env->cp15.scr_el3 & SCR_FIQ)) {
7995         mask |= CPSR_F;
7996     }
7997 
7998     addr += env->cp15.hvbar;
7999 
8000     take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr);
8001 }
8002 
8003 static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
8004 {
8005     ARMCPU *cpu = ARM_CPU(cs);
8006     CPUARMState *env = &cpu->env;
8007     uint32_t addr;
8008     uint32_t mask;
8009     int new_mode;
8010     uint32_t offset;
8011     uint32_t moe;
8012 
8013     /* If this is a debug exception we must update the DBGDSCR.MOE bits */
8014     switch (syn_get_ec(env->exception.syndrome)) {
8015     case EC_BREAKPOINT:
8016     case EC_BREAKPOINT_SAME_EL:
8017         moe = 1;
8018         break;
8019     case EC_WATCHPOINT:
8020     case EC_WATCHPOINT_SAME_EL:
8021         moe = 10;
8022         break;
8023     case EC_AA32_BKPT:
8024         moe = 3;
8025         break;
8026     case EC_VECTORCATCH:
8027         moe = 5;
8028         break;
8029     default:
8030         moe = 0;
8031         break;
8032     }
8033 
8034     if (moe) {
8035         env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
8036     }
8037 
8038     if (env->exception.target_el == 2) {
8039         arm_cpu_do_interrupt_aarch32_hyp(cs);
8040         return;
8041     }
8042 
8043     switch (cs->exception_index) {
8044     case EXCP_UDEF:
8045         new_mode = ARM_CPU_MODE_UND;
8046         addr = 0x04;
8047         mask = CPSR_I;
8048         if (env->thumb)
8049             offset = 2;
8050         else
8051             offset = 4;
8052         break;
8053     case EXCP_SWI:
8054         new_mode = ARM_CPU_MODE_SVC;
8055         addr = 0x08;
8056         mask = CPSR_I;
8057         /* The PC already points to the next instruction.  */
8058         offset = 0;
8059         break;
8060     case EXCP_BKPT:
8061         /* Fall through to prefetch abort.  */
8062     case EXCP_PREFETCH_ABORT:
8063         A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr);
8064         A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress);
8065         qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
8066                       env->exception.fsr, (uint32_t)env->exception.vaddress);
8067         new_mode = ARM_CPU_MODE_ABT;
8068         addr = 0x0c;
8069         mask = CPSR_A | CPSR_I;
8070         offset = 4;
8071         break;
8072     case EXCP_DATA_ABORT:
8073         A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
8074         A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress);
8075         qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
8076                       env->exception.fsr,
8077                       (uint32_t)env->exception.vaddress);
8078         new_mode = ARM_CPU_MODE_ABT;
8079         addr = 0x10;
8080         mask = CPSR_A | CPSR_I;
8081         offset = 8;
8082         break;
8083     case EXCP_IRQ:
8084         new_mode = ARM_CPU_MODE_IRQ;
8085         addr = 0x18;
8086         /* Disable IRQ and imprecise data aborts.  */
8087         mask = CPSR_A | CPSR_I;
8088         offset = 4;
8089         if (env->cp15.scr_el3 & SCR_IRQ) {
8090             /* IRQ routed to monitor mode */
8091             new_mode = ARM_CPU_MODE_MON;
8092             mask |= CPSR_F;
8093         }
8094         break;
8095     case EXCP_FIQ:
8096         new_mode = ARM_CPU_MODE_FIQ;
8097         addr = 0x1c;
8098         /* Disable FIQ, IRQ and imprecise data aborts.  */
8099         mask = CPSR_A | CPSR_I | CPSR_F;
8100         if (env->cp15.scr_el3 & SCR_FIQ) {
8101             /* FIQ routed to monitor mode */
8102             new_mode = ARM_CPU_MODE_MON;
8103         }
8104         offset = 4;
8105         break;
8106     case EXCP_VIRQ:
8107         new_mode = ARM_CPU_MODE_IRQ;
8108         addr = 0x18;
8109         /* Disable IRQ and imprecise data aborts.  */
8110         mask = CPSR_A | CPSR_I;
8111         offset = 4;
8112         break;
8113     case EXCP_VFIQ:
8114         new_mode = ARM_CPU_MODE_FIQ;
8115         addr = 0x1c;
8116         /* Disable FIQ, IRQ and imprecise data aborts.  */
8117         mask = CPSR_A | CPSR_I | CPSR_F;
8118         offset = 4;
8119         break;
8120     case EXCP_SMC:
8121         new_mode = ARM_CPU_MODE_MON;
8122         addr = 0x08;
8123         mask = CPSR_A | CPSR_I | CPSR_F;
8124         offset = 0;
8125         break;
8126     default:
8127         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8128         return; /* Never happens.  Keep compiler happy.  */
8129     }
8130 
8131     if (new_mode == ARM_CPU_MODE_MON) {
8132         addr += env->cp15.mvbar;
8133     } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
8134         /* High vectors. When enabled, base address cannot be remapped. */
8135         addr += 0xffff0000;
8136     } else {
8137         /* ARM v7 architectures provide a vector base address register to remap
8138          * the interrupt vector table.
8139          * This register is only followed in non-monitor mode, and is banked.
8140          * Note: only bits 31:5 are valid.
8141          */
8142         addr += A32_BANKED_CURRENT_REG_GET(env, vbar);
8143     }
8144 
8145     if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
8146         env->cp15.scr_el3 &= ~SCR_NS;
8147     }
8148 
8149     take_aarch32_exception(env, new_mode, mask, offset, addr);
8150 }
8151 
8152 /* Handle exception entry to a target EL which is using AArch64 */
8153 static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
8154 {
8155     ARMCPU *cpu = ARM_CPU(cs);
8156     CPUARMState *env = &cpu->env;
8157     unsigned int new_el = env->exception.target_el;
8158     target_ulong addr = env->cp15.vbar_el[new_el];
8159     unsigned int new_mode = aarch64_pstate_mode(new_el, true);
8160     unsigned int cur_el = arm_current_el(env);
8161 
8162     /*
8163      * Note that new_el can never be 0.  If cur_el is 0, then
8164      * el0_a64 is is_a64(), else el0_a64 is ignored.
8165      */
8166     aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
8167 
8168     if (cur_el < new_el) {
8169         /* Entry vector offset depends on whether the implemented EL
8170          * immediately lower than the target level is using AArch32 or AArch64
8171          */
8172         bool is_aa64;
8173 
8174         switch (new_el) {
8175         case 3:
8176             is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
8177             break;
8178         case 2:
8179             is_aa64 = (env->cp15.hcr_el2 & HCR_RW) != 0;
8180             break;
8181         case 1:
8182             is_aa64 = is_a64(env);
8183             break;
8184         default:
8185             g_assert_not_reached();
8186         }
8187 
8188         if (is_aa64) {
8189             addr += 0x400;
8190         } else {
8191             addr += 0x600;
8192         }
8193     } else if (pstate_read(env) & PSTATE_SP) {
8194         addr += 0x200;
8195     }
8196 
8197     switch (cs->exception_index) {
8198     case EXCP_PREFETCH_ABORT:
8199     case EXCP_DATA_ABORT:
8200         env->cp15.far_el[new_el] = env->exception.vaddress;
8201         qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n",
8202                       env->cp15.far_el[new_el]);
8203         /* fall through */
8204     case EXCP_BKPT:
8205     case EXCP_UDEF:
8206     case EXCP_SWI:
8207     case EXCP_HVC:
8208     case EXCP_HYP_TRAP:
8209     case EXCP_SMC:
8210         if (syn_get_ec(env->exception.syndrome) == EC_ADVSIMDFPACCESSTRAP) {
8211             /*
8212              * QEMU internal FP/SIMD syndromes from AArch32 include the
8213              * TA and coproc fields which are only exposed if the exception
8214              * is taken to AArch32 Hyp mode. Mask them out to get a valid
8215              * AArch64 format syndrome.
8216              */
8217             env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20);
8218         }
8219         env->cp15.esr_el[new_el] = env->exception.syndrome;
8220         break;
8221     case EXCP_IRQ:
8222     case EXCP_VIRQ:
8223         addr += 0x80;
8224         break;
8225     case EXCP_FIQ:
8226     case EXCP_VFIQ:
8227         addr += 0x100;
8228         break;
8229     case EXCP_SEMIHOST:
8230         qemu_log_mask(CPU_LOG_INT,
8231                       "...handling as semihosting call 0x%" PRIx64 "\n",
8232                       env->xregs[0]);
8233         env->xregs[0] = do_arm_semihosting(env);
8234         return;
8235     default:
8236         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
8237     }
8238 
8239     if (is_a64(env)) {
8240         env->banked_spsr[aarch64_banked_spsr_index(new_el)] = pstate_read(env);
8241         aarch64_save_sp(env, arm_current_el(env));
8242         env->elr_el[new_el] = env->pc;
8243     } else {
8244         env->banked_spsr[aarch64_banked_spsr_index(new_el)] = cpsr_read(env);
8245         env->elr_el[new_el] = env->regs[15];
8246 
8247         aarch64_sync_32_to_64(env);
8248 
8249         env->condexec_bits = 0;
8250     }
8251     qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n",
8252                   env->elr_el[new_el]);
8253 
8254     pstate_write(env, PSTATE_DAIF | new_mode);
8255     env->aarch64 = 1;
8256     aarch64_restore_sp(env, new_el);
8257 
8258     env->pc = addr;
8259 
8260     qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n",
8261                   new_el, env->pc, pstate_read(env));
8262 }
8263 
8264 static inline bool check_for_semihosting(CPUState *cs)
8265 {
8266 #ifdef CONFIG_TCG
8267     /* Check whether this exception is a semihosting call; if so
8268      * then handle it and return true; otherwise return false.
8269      */
8270     ARMCPU *cpu = ARM_CPU(cs);
8271     CPUARMState *env = &cpu->env;
8272 
8273     if (is_a64(env)) {
8274         if (cs->exception_index == EXCP_SEMIHOST) {
8275             /* This is always the 64-bit semihosting exception.
8276              * The "is this usermode" and "is semihosting enabled"
8277              * checks have been done at translate time.
8278              */
8279             qemu_log_mask(CPU_LOG_INT,
8280                           "...handling as semihosting call 0x%" PRIx64 "\n",
8281                           env->xregs[0]);
8282             env->xregs[0] = do_arm_semihosting(env);
8283             return true;
8284         }
8285         return false;
8286     } else {
8287         uint32_t imm;
8288 
8289         /* Only intercept calls from privileged modes, to provide some
8290          * semblance of security.
8291          */
8292         if (cs->exception_index != EXCP_SEMIHOST &&
8293             (!semihosting_enabled() ||
8294              ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) {
8295             return false;
8296         }
8297 
8298         switch (cs->exception_index) {
8299         case EXCP_SEMIHOST:
8300             /* This is always a semihosting call; the "is this usermode"
8301              * and "is semihosting enabled" checks have been done at
8302              * translate time.
8303              */
8304             break;
8305         case EXCP_SWI:
8306             /* Check for semihosting interrupt.  */
8307             if (env->thumb) {
8308                 imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env))
8309                     & 0xff;
8310                 if (imm == 0xab) {
8311                     break;
8312                 }
8313             } else {
8314                 imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env))
8315                     & 0xffffff;
8316                 if (imm == 0x123456) {
8317                     break;
8318                 }
8319             }
8320             return false;
8321         case EXCP_BKPT:
8322             /* See if this is a semihosting syscall.  */
8323             if (env->thumb) {
8324                 imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env))
8325                     & 0xff;
8326                 if (imm == 0xab) {
8327                     env->regs[15] += 2;
8328                     break;
8329                 }
8330             }
8331             return false;
8332         default:
8333             return false;
8334         }
8335 
8336         qemu_log_mask(CPU_LOG_INT,
8337                       "...handling as semihosting call 0x%x\n",
8338                       env->regs[0]);
8339         env->regs[0] = do_arm_semihosting(env);
8340         return true;
8341     }
8342 #else
8343     return false;
8344 #endif
8345 }
8346 
8347 /* Handle a CPU exception for A and R profile CPUs.
8348  * Do any appropriate logging, handle PSCI calls, and then hand off
8349  * to the AArch64-entry or AArch32-entry function depending on the
8350  * target exception level's register width.
8351  */
8352 void arm_cpu_do_interrupt(CPUState *cs)
8353 {
8354     ARMCPU *cpu = ARM_CPU(cs);
8355     CPUARMState *env = &cpu->env;
8356     unsigned int new_el = env->exception.target_el;
8357 
8358     assert(!arm_feature(env, ARM_FEATURE_M));
8359 
8360     arm_log_exception(cs->exception_index);
8361     qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env),
8362                   new_el);
8363     if (qemu_loglevel_mask(CPU_LOG_INT)
8364         && !excp_is_internal(cs->exception_index)) {
8365         qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n",
8366                       syn_get_ec(env->exception.syndrome),
8367                       env->exception.syndrome);
8368     }
8369 
8370     if (arm_is_psci_call(cpu, cs->exception_index)) {
8371         arm_handle_psci_call(cpu);
8372         qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
8373         return;
8374     }
8375 
8376     /* Semihosting semantics depend on the register width of the
8377      * code that caused the exception, not the target exception level,
8378      * so must be handled here.
8379      */
8380     if (check_for_semihosting(cs)) {
8381         return;
8382     }
8383 
8384     /* Hooks may change global state so BQL should be held, also the
8385      * BQL needs to be held for any modification of
8386      * cs->interrupt_request.
8387      */
8388     g_assert(qemu_mutex_iothread_locked());
8389 
8390     arm_call_pre_el_change_hook(cpu);
8391 
8392     assert(!excp_is_internal(cs->exception_index));
8393     if (arm_el_is_aa64(env, new_el)) {
8394         arm_cpu_do_interrupt_aarch64(cs);
8395     } else {
8396         arm_cpu_do_interrupt_aarch32(cs);
8397     }
8398 
8399     arm_call_el_change_hook(cpu);
8400 
8401     if (!kvm_enabled()) {
8402         cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
8403     }
8404 }
8405 #endif /* !CONFIG_USER_ONLY */
8406 
8407 /* Return the exception level which controls this address translation regime */
8408 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
8409 {
8410     switch (mmu_idx) {
8411     case ARMMMUIdx_S2NS:
8412     case ARMMMUIdx_S1E2:
8413         return 2;
8414     case ARMMMUIdx_S1E3:
8415         return 3;
8416     case ARMMMUIdx_S1SE0:
8417         return arm_el_is_aa64(env, 3) ? 1 : 3;
8418     case ARMMMUIdx_S1SE1:
8419     case ARMMMUIdx_S1NSE0:
8420     case ARMMMUIdx_S1NSE1:
8421     case ARMMMUIdx_MPrivNegPri:
8422     case ARMMMUIdx_MUserNegPri:
8423     case ARMMMUIdx_MPriv:
8424     case ARMMMUIdx_MUser:
8425     case ARMMMUIdx_MSPrivNegPri:
8426     case ARMMMUIdx_MSUserNegPri:
8427     case ARMMMUIdx_MSPriv:
8428     case ARMMMUIdx_MSUser:
8429         return 1;
8430     default:
8431         g_assert_not_reached();
8432     }
8433 }
8434 
8435 #ifndef CONFIG_USER_ONLY
8436 
8437 /* Return the SCTLR value which controls this address translation regime */
8438 static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
8439 {
8440     return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
8441 }
8442 
8443 /* Return true if the specified stage of address translation is disabled */
8444 static inline bool regime_translation_disabled(CPUARMState *env,
8445                                                ARMMMUIdx mmu_idx)
8446 {
8447     if (arm_feature(env, ARM_FEATURE_M)) {
8448         switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &
8449                 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
8450         case R_V7M_MPU_CTRL_ENABLE_MASK:
8451             /* Enabled, but not for HardFault and NMI */
8452             return mmu_idx & ARM_MMU_IDX_M_NEGPRI;
8453         case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
8454             /* Enabled for all cases */
8455             return false;
8456         case 0:
8457         default:
8458             /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
8459              * we warned about that in armv7m_nvic.c when the guest set it.
8460              */
8461             return true;
8462         }
8463     }
8464 
8465     if (mmu_idx == ARMMMUIdx_S2NS) {
8466         /* HCR.DC means HCR.VM behaves as 1 */
8467         return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0;
8468     }
8469 
8470     if (env->cp15.hcr_el2 & HCR_TGE) {
8471         /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
8472         if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
8473             return true;
8474         }
8475     }
8476 
8477     if ((env->cp15.hcr_el2 & HCR_DC) &&
8478         (mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1)) {
8479         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
8480         return true;
8481     }
8482 
8483     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
8484 }
8485 
8486 static inline bool regime_translation_big_endian(CPUARMState *env,
8487                                                  ARMMMUIdx mmu_idx)
8488 {
8489     return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
8490 }
8491 
8492 /* Return the TTBR associated with this translation regime */
8493 static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
8494                                    int ttbrn)
8495 {
8496     if (mmu_idx == ARMMMUIdx_S2NS) {
8497         return env->cp15.vttbr_el2;
8498     }
8499     if (ttbrn == 0) {
8500         return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
8501     } else {
8502         return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
8503     }
8504 }
8505 
8506 #endif /* !CONFIG_USER_ONLY */
8507 
8508 /* Return the TCR controlling this translation regime */
8509 static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
8510 {
8511     if (mmu_idx == ARMMMUIdx_S2NS) {
8512         return &env->cp15.vtcr_el2;
8513     }
8514     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
8515 }
8516 
8517 /* Convert a possible stage1+2 MMU index into the appropriate
8518  * stage 1 MMU index
8519  */
8520 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
8521 {
8522     if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
8523         mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0);
8524     }
8525     return mmu_idx;
8526 }
8527 
8528 /* Return true if the translation regime is using LPAE format page tables */
8529 static inline bool regime_using_lpae_format(CPUARMState *env,
8530                                             ARMMMUIdx mmu_idx)
8531 {
8532     int el = regime_el(env, mmu_idx);
8533     if (el == 2 || arm_el_is_aa64(env, el)) {
8534         return true;
8535     }
8536     if (arm_feature(env, ARM_FEATURE_LPAE)
8537         && (regime_tcr(env, mmu_idx)->raw_tcr & TTBCR_EAE)) {
8538         return true;
8539     }
8540     return false;
8541 }
8542 
8543 /* Returns true if the stage 1 translation regime is using LPAE format page
8544  * tables. Used when raising alignment exceptions, whose FSR changes depending
8545  * on whether the long or short descriptor format is in use. */
8546 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
8547 {
8548     mmu_idx = stage_1_mmu_idx(mmu_idx);
8549 
8550     return regime_using_lpae_format(env, mmu_idx);
8551 }
8552 
8553 #ifndef CONFIG_USER_ONLY
8554 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
8555 {
8556     switch (mmu_idx) {
8557     case ARMMMUIdx_S1SE0:
8558     case ARMMMUIdx_S1NSE0:
8559     case ARMMMUIdx_MUser:
8560     case ARMMMUIdx_MSUser:
8561     case ARMMMUIdx_MUserNegPri:
8562     case ARMMMUIdx_MSUserNegPri:
8563         return true;
8564     default:
8565         return false;
8566     case ARMMMUIdx_S12NSE0:
8567     case ARMMMUIdx_S12NSE1:
8568         g_assert_not_reached();
8569     }
8570 }
8571 
8572 /* Translate section/page access permissions to page
8573  * R/W protection flags
8574  *
8575  * @env:         CPUARMState
8576  * @mmu_idx:     MMU index indicating required translation regime
8577  * @ap:          The 3-bit access permissions (AP[2:0])
8578  * @domain_prot: The 2-bit domain access permissions
8579  */
8580 static inline int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
8581                                 int ap, int domain_prot)
8582 {
8583     bool is_user = regime_is_user(env, mmu_idx);
8584 
8585     if (domain_prot == 3) {
8586         return PAGE_READ | PAGE_WRITE;
8587     }
8588 
8589     switch (ap) {
8590     case 0:
8591         if (arm_feature(env, ARM_FEATURE_V7)) {
8592             return 0;
8593         }
8594         switch (regime_sctlr(env, mmu_idx) & (SCTLR_S | SCTLR_R)) {
8595         case SCTLR_S:
8596             return is_user ? 0 : PAGE_READ;
8597         case SCTLR_R:
8598             return PAGE_READ;
8599         default:
8600             return 0;
8601         }
8602     case 1:
8603         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
8604     case 2:
8605         if (is_user) {
8606             return PAGE_READ;
8607         } else {
8608             return PAGE_READ | PAGE_WRITE;
8609         }
8610     case 3:
8611         return PAGE_READ | PAGE_WRITE;
8612     case 4: /* Reserved.  */
8613         return 0;
8614     case 5:
8615         return is_user ? 0 : PAGE_READ;
8616     case 6:
8617         return PAGE_READ;
8618     case 7:
8619         if (!arm_feature(env, ARM_FEATURE_V6K)) {
8620             return 0;
8621         }
8622         return PAGE_READ;
8623     default:
8624         g_assert_not_reached();
8625     }
8626 }
8627 
8628 /* Translate section/page access permissions to page
8629  * R/W protection flags.
8630  *
8631  * @ap:      The 2-bit simple AP (AP[2:1])
8632  * @is_user: TRUE if accessing from PL0
8633  */
8634 static inline int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
8635 {
8636     switch (ap) {
8637     case 0:
8638         return is_user ? 0 : PAGE_READ | PAGE_WRITE;
8639     case 1:
8640         return PAGE_READ | PAGE_WRITE;
8641     case 2:
8642         return is_user ? 0 : PAGE_READ;
8643     case 3:
8644         return PAGE_READ;
8645     default:
8646         g_assert_not_reached();
8647     }
8648 }
8649 
8650 static inline int
8651 simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
8652 {
8653     return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
8654 }
8655 
8656 /* Translate S2 section/page access permissions to protection flags
8657  *
8658  * @env:     CPUARMState
8659  * @s2ap:    The 2-bit stage2 access permissions (S2AP)
8660  * @xn:      XN (execute-never) bit
8661  */
8662 static int get_S2prot(CPUARMState *env, int s2ap, int xn)
8663 {
8664     int prot = 0;
8665 
8666     if (s2ap & 1) {
8667         prot |= PAGE_READ;
8668     }
8669     if (s2ap & 2) {
8670         prot |= PAGE_WRITE;
8671     }
8672     if (!xn) {
8673         if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
8674             prot |= PAGE_EXEC;
8675         }
8676     }
8677     return prot;
8678 }
8679 
8680 /* Translate section/page access permissions to protection flags
8681  *
8682  * @env:     CPUARMState
8683  * @mmu_idx: MMU index indicating required translation regime
8684  * @is_aa64: TRUE if AArch64
8685  * @ap:      The 2-bit simple AP (AP[2:1])
8686  * @ns:      NS (non-secure) bit
8687  * @xn:      XN (execute-never) bit
8688  * @pxn:     PXN (privileged execute-never) bit
8689  */
8690 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
8691                       int ap, int ns, int xn, int pxn)
8692 {
8693     bool is_user = regime_is_user(env, mmu_idx);
8694     int prot_rw, user_rw;
8695     bool have_wxn;
8696     int wxn = 0;
8697 
8698     assert(mmu_idx != ARMMMUIdx_S2NS);
8699 
8700     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
8701     if (is_user) {
8702         prot_rw = user_rw;
8703     } else {
8704         prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
8705     }
8706 
8707     if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
8708         return prot_rw;
8709     }
8710 
8711     /* TODO have_wxn should be replaced with
8712      *   ARM_FEATURE_V8 || (ARM_FEATURE_V7 && ARM_FEATURE_EL2)
8713      * when ARM_FEATURE_EL2 starts getting set. For now we assume all LPAE
8714      * compatible processors have EL2, which is required for [U]WXN.
8715      */
8716     have_wxn = arm_feature(env, ARM_FEATURE_LPAE);
8717 
8718     if (have_wxn) {
8719         wxn = regime_sctlr(env, mmu_idx) & SCTLR_WXN;
8720     }
8721 
8722     if (is_aa64) {
8723         switch (regime_el(env, mmu_idx)) {
8724         case 1:
8725             if (!is_user) {
8726                 xn = pxn || (user_rw & PAGE_WRITE);
8727             }
8728             break;
8729         case 2:
8730         case 3:
8731             break;
8732         }
8733     } else if (arm_feature(env, ARM_FEATURE_V7)) {
8734         switch (regime_el(env, mmu_idx)) {
8735         case 1:
8736         case 3:
8737             if (is_user) {
8738                 xn = xn || !(user_rw & PAGE_READ);
8739             } else {
8740                 int uwxn = 0;
8741                 if (have_wxn) {
8742                     uwxn = regime_sctlr(env, mmu_idx) & SCTLR_UWXN;
8743                 }
8744                 xn = xn || !(prot_rw & PAGE_READ) || pxn ||
8745                      (uwxn && (user_rw & PAGE_WRITE));
8746             }
8747             break;
8748         case 2:
8749             break;
8750         }
8751     } else {
8752         xn = wxn = 0;
8753     }
8754 
8755     if (xn || (wxn && (prot_rw & PAGE_WRITE))) {
8756         return prot_rw;
8757     }
8758     return prot_rw | PAGE_EXEC;
8759 }
8760 
8761 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
8762                                      uint32_t *table, uint32_t address)
8763 {
8764     /* Note that we can only get here for an AArch32 PL0/PL1 lookup */
8765     TCR *tcr = regime_tcr(env, mmu_idx);
8766 
8767     if (address & tcr->mask) {
8768         if (tcr->raw_tcr & TTBCR_PD1) {
8769             /* Translation table walk disabled for TTBR1 */
8770             return false;
8771         }
8772         *table = regime_ttbr(env, mmu_idx, 1) & 0xffffc000;
8773     } else {
8774         if (tcr->raw_tcr & TTBCR_PD0) {
8775             /* Translation table walk disabled for TTBR0 */
8776             return false;
8777         }
8778         *table = regime_ttbr(env, mmu_idx, 0) & tcr->base_mask;
8779     }
8780     *table |= (address >> 18) & 0x3ffc;
8781     return true;
8782 }
8783 
8784 /* Translate a S1 pagetable walk through S2 if needed.  */
8785 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
8786                                hwaddr addr, MemTxAttrs txattrs,
8787                                ARMMMUFaultInfo *fi)
8788 {
8789     if ((mmu_idx == ARMMMUIdx_S1NSE0 || mmu_idx == ARMMMUIdx_S1NSE1) &&
8790         !regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
8791         target_ulong s2size;
8792         hwaddr s2pa;
8793         int s2prot;
8794         int ret;
8795         ARMCacheAttrs cacheattrs = {};
8796         ARMCacheAttrs *pcacheattrs = NULL;
8797 
8798         if (env->cp15.hcr_el2 & HCR_PTW) {
8799             /*
8800              * PTW means we must fault if this S1 walk touches S2 Device
8801              * memory; otherwise we don't care about the attributes and can
8802              * save the S2 translation the effort of computing them.
8803              */
8804             pcacheattrs = &cacheattrs;
8805         }
8806 
8807         ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
8808                                  &txattrs, &s2prot, &s2size, fi, pcacheattrs);
8809         if (ret) {
8810             assert(fi->type != ARMFault_None);
8811             fi->s2addr = addr;
8812             fi->stage2 = true;
8813             fi->s1ptw = true;
8814             return ~0;
8815         }
8816         if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) {
8817             /* Access was to Device memory: generate Permission fault */
8818             fi->type = ARMFault_Permission;
8819             fi->s2addr = addr;
8820             fi->stage2 = true;
8821             fi->s1ptw = true;
8822             return ~0;
8823         }
8824         addr = s2pa;
8825     }
8826     return addr;
8827 }
8828 
8829 /* All loads done in the course of a page table walk go through here. */
8830 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
8831                             ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
8832 {
8833     ARMCPU *cpu = ARM_CPU(cs);
8834     CPUARMState *env = &cpu->env;
8835     MemTxAttrs attrs = {};
8836     MemTxResult result = MEMTX_OK;
8837     AddressSpace *as;
8838     uint32_t data;
8839 
8840     attrs.secure = is_secure;
8841     as = arm_addressspace(cs, attrs);
8842     addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
8843     if (fi->s1ptw) {
8844         return 0;
8845     }
8846     if (regime_translation_big_endian(env, mmu_idx)) {
8847         data = address_space_ldl_be(as, addr, attrs, &result);
8848     } else {
8849         data = address_space_ldl_le(as, addr, attrs, &result);
8850     }
8851     if (result == MEMTX_OK) {
8852         return data;
8853     }
8854     fi->type = ARMFault_SyncExternalOnWalk;
8855     fi->ea = arm_extabort_type(result);
8856     return 0;
8857 }
8858 
8859 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
8860                             ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
8861 {
8862     ARMCPU *cpu = ARM_CPU(cs);
8863     CPUARMState *env = &cpu->env;
8864     MemTxAttrs attrs = {};
8865     MemTxResult result = MEMTX_OK;
8866     AddressSpace *as;
8867     uint64_t data;
8868 
8869     attrs.secure = is_secure;
8870     as = arm_addressspace(cs, attrs);
8871     addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
8872     if (fi->s1ptw) {
8873         return 0;
8874     }
8875     if (regime_translation_big_endian(env, mmu_idx)) {
8876         data = address_space_ldq_be(as, addr, attrs, &result);
8877     } else {
8878         data = address_space_ldq_le(as, addr, attrs, &result);
8879     }
8880     if (result == MEMTX_OK) {
8881         return data;
8882     }
8883     fi->type = ARMFault_SyncExternalOnWalk;
8884     fi->ea = arm_extabort_type(result);
8885     return 0;
8886 }
8887 
8888 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
8889                              MMUAccessType access_type, ARMMMUIdx mmu_idx,
8890                              hwaddr *phys_ptr, int *prot,
8891                              target_ulong *page_size,
8892                              ARMMMUFaultInfo *fi)
8893 {
8894     CPUState *cs = env_cpu(env);
8895     int level = 1;
8896     uint32_t table;
8897     uint32_t desc;
8898     int type;
8899     int ap;
8900     int domain = 0;
8901     int domain_prot;
8902     hwaddr phys_addr;
8903     uint32_t dacr;
8904 
8905     /* Pagetable walk.  */
8906     /* Lookup l1 descriptor.  */
8907     if (!get_level1_table_address(env, mmu_idx, &table, address)) {
8908         /* Section translation fault if page walk is disabled by PD0 or PD1 */
8909         fi->type = ARMFault_Translation;
8910         goto do_fault;
8911     }
8912     desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
8913                        mmu_idx, fi);
8914     if (fi->type != ARMFault_None) {
8915         goto do_fault;
8916     }
8917     type = (desc & 3);
8918     domain = (desc >> 5) & 0x0f;
8919     if (regime_el(env, mmu_idx) == 1) {
8920         dacr = env->cp15.dacr_ns;
8921     } else {
8922         dacr = env->cp15.dacr_s;
8923     }
8924     domain_prot = (dacr >> (domain * 2)) & 3;
8925     if (type == 0) {
8926         /* Section translation fault.  */
8927         fi->type = ARMFault_Translation;
8928         goto do_fault;
8929     }
8930     if (type != 2) {
8931         level = 2;
8932     }
8933     if (domain_prot == 0 || domain_prot == 2) {
8934         fi->type = ARMFault_Domain;
8935         goto do_fault;
8936     }
8937     if (type == 2) {
8938         /* 1Mb section.  */
8939         phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
8940         ap = (desc >> 10) & 3;
8941         *page_size = 1024 * 1024;
8942     } else {
8943         /* Lookup l2 entry.  */
8944         if (type == 1) {
8945             /* Coarse pagetable.  */
8946             table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
8947         } else {
8948             /* Fine pagetable.  */
8949             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
8950         }
8951         desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
8952                            mmu_idx, fi);
8953         if (fi->type != ARMFault_None) {
8954             goto do_fault;
8955         }
8956         switch (desc & 3) {
8957         case 0: /* Page translation fault.  */
8958             fi->type = ARMFault_Translation;
8959             goto do_fault;
8960         case 1: /* 64k page.  */
8961             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
8962             ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
8963             *page_size = 0x10000;
8964             break;
8965         case 2: /* 4k page.  */
8966             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
8967             ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
8968             *page_size = 0x1000;
8969             break;
8970         case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
8971             if (type == 1) {
8972                 /* ARMv6/XScale extended small page format */
8973                 if (arm_feature(env, ARM_FEATURE_XSCALE)
8974                     || arm_feature(env, ARM_FEATURE_V6)) {
8975                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
8976                     *page_size = 0x1000;
8977                 } else {
8978                     /* UNPREDICTABLE in ARMv5; we choose to take a
8979                      * page translation fault.
8980                      */
8981                     fi->type = ARMFault_Translation;
8982                     goto do_fault;
8983                 }
8984             } else {
8985                 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
8986                 *page_size = 0x400;
8987             }
8988             ap = (desc >> 4) & 3;
8989             break;
8990         default:
8991             /* Never happens, but compiler isn't smart enough to tell.  */
8992             abort();
8993         }
8994     }
8995     *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
8996     *prot |= *prot ? PAGE_EXEC : 0;
8997     if (!(*prot & (1 << access_type))) {
8998         /* Access permission fault.  */
8999         fi->type = ARMFault_Permission;
9000         goto do_fault;
9001     }
9002     *phys_ptr = phys_addr;
9003     return false;
9004 do_fault:
9005     fi->domain = domain;
9006     fi->level = level;
9007     return true;
9008 }
9009 
9010 static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
9011                              MMUAccessType access_type, ARMMMUIdx mmu_idx,
9012                              hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
9013                              target_ulong *page_size, ARMMMUFaultInfo *fi)
9014 {
9015     CPUState *cs = env_cpu(env);
9016     int level = 1;
9017     uint32_t table;
9018     uint32_t desc;
9019     uint32_t xn;
9020     uint32_t pxn = 0;
9021     int type;
9022     int ap;
9023     int domain = 0;
9024     int domain_prot;
9025     hwaddr phys_addr;
9026     uint32_t dacr;
9027     bool ns;
9028 
9029     /* Pagetable walk.  */
9030     /* Lookup l1 descriptor.  */
9031     if (!get_level1_table_address(env, mmu_idx, &table, address)) {
9032         /* Section translation fault if page walk is disabled by PD0 or PD1 */
9033         fi->type = ARMFault_Translation;
9034         goto do_fault;
9035     }
9036     desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9037                        mmu_idx, fi);
9038     if (fi->type != ARMFault_None) {
9039         goto do_fault;
9040     }
9041     type = (desc & 3);
9042     if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
9043         /* Section translation fault, or attempt to use the encoding
9044          * which is Reserved on implementations without PXN.
9045          */
9046         fi->type = ARMFault_Translation;
9047         goto do_fault;
9048     }
9049     if ((type == 1) || !(desc & (1 << 18))) {
9050         /* Page or Section.  */
9051         domain = (desc >> 5) & 0x0f;
9052     }
9053     if (regime_el(env, mmu_idx) == 1) {
9054         dacr = env->cp15.dacr_ns;
9055     } else {
9056         dacr = env->cp15.dacr_s;
9057     }
9058     if (type == 1) {
9059         level = 2;
9060     }
9061     domain_prot = (dacr >> (domain * 2)) & 3;
9062     if (domain_prot == 0 || domain_prot == 2) {
9063         /* Section or Page domain fault */
9064         fi->type = ARMFault_Domain;
9065         goto do_fault;
9066     }
9067     if (type != 1) {
9068         if (desc & (1 << 18)) {
9069             /* Supersection.  */
9070             phys_addr = (desc & 0xff000000) | (address & 0x00ffffff);
9071             phys_addr |= (uint64_t)extract32(desc, 20, 4) << 32;
9072             phys_addr |= (uint64_t)extract32(desc, 5, 4) << 36;
9073             *page_size = 0x1000000;
9074         } else {
9075             /* Section.  */
9076             phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
9077             *page_size = 0x100000;
9078         }
9079         ap = ((desc >> 10) & 3) | ((desc >> 13) & 4);
9080         xn = desc & (1 << 4);
9081         pxn = desc & 1;
9082         ns = extract32(desc, 19, 1);
9083     } else {
9084         if (arm_feature(env, ARM_FEATURE_PXN)) {
9085             pxn = (desc >> 2) & 1;
9086         }
9087         ns = extract32(desc, 3, 1);
9088         /* Lookup l2 entry.  */
9089         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
9090         desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
9091                            mmu_idx, fi);
9092         if (fi->type != ARMFault_None) {
9093             goto do_fault;
9094         }
9095         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
9096         switch (desc & 3) {
9097         case 0: /* Page translation fault.  */
9098             fi->type = ARMFault_Translation;
9099             goto do_fault;
9100         case 1: /* 64k page.  */
9101             phys_addr = (desc & 0xffff0000) | (address & 0xffff);
9102             xn = desc & (1 << 15);
9103             *page_size = 0x10000;
9104             break;
9105         case 2: case 3: /* 4k page.  */
9106             phys_addr = (desc & 0xfffff000) | (address & 0xfff);
9107             xn = desc & 1;
9108             *page_size = 0x1000;
9109             break;
9110         default:
9111             /* Never happens, but compiler isn't smart enough to tell.  */
9112             abort();
9113         }
9114     }
9115     if (domain_prot == 3) {
9116         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
9117     } else {
9118         if (pxn && !regime_is_user(env, mmu_idx)) {
9119             xn = 1;
9120         }
9121         if (xn && access_type == MMU_INST_FETCH) {
9122             fi->type = ARMFault_Permission;
9123             goto do_fault;
9124         }
9125 
9126         if (arm_feature(env, ARM_FEATURE_V6K) &&
9127                 (regime_sctlr(env, mmu_idx) & SCTLR_AFE)) {
9128             /* The simplified model uses AP[0] as an access control bit.  */
9129             if ((ap & 1) == 0) {
9130                 /* Access flag fault.  */
9131                 fi->type = ARMFault_AccessFlag;
9132                 goto do_fault;
9133             }
9134             *prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
9135         } else {
9136             *prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
9137         }
9138         if (*prot && !xn) {
9139             *prot |= PAGE_EXEC;
9140         }
9141         if (!(*prot & (1 << access_type))) {
9142             /* Access permission fault.  */
9143             fi->type = ARMFault_Permission;
9144             goto do_fault;
9145         }
9146     }
9147     if (ns) {
9148         /* The NS bit will (as required by the architecture) have no effect if
9149          * the CPU doesn't support TZ or this is a non-secure translation
9150          * regime, because the attribute will already be non-secure.
9151          */
9152         attrs->secure = false;
9153     }
9154     *phys_ptr = phys_addr;
9155     return false;
9156 do_fault:
9157     fi->domain = domain;
9158     fi->level = level;
9159     return true;
9160 }
9161 
9162 /*
9163  * check_s2_mmu_setup
9164  * @cpu:        ARMCPU
9165  * @is_aa64:    True if the translation regime is in AArch64 state
9166  * @startlevel: Suggested starting level
9167  * @inputsize:  Bitsize of IPAs
9168  * @stride:     Page-table stride (See the ARM ARM)
9169  *
9170  * Returns true if the suggested S2 translation parameters are OK and
9171  * false otherwise.
9172  */
9173 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
9174                                int inputsize, int stride)
9175 {
9176     const int grainsize = stride + 3;
9177     int startsizecheck;
9178 
9179     /* Negative levels are never allowed.  */
9180     if (level < 0) {
9181         return false;
9182     }
9183 
9184     startsizecheck = inputsize - ((3 - level) * stride + grainsize);
9185     if (startsizecheck < 1 || startsizecheck > stride + 4) {
9186         return false;
9187     }
9188 
9189     if (is_aa64) {
9190         CPUARMState *env = &cpu->env;
9191         unsigned int pamax = arm_pamax(cpu);
9192 
9193         switch (stride) {
9194         case 13: /* 64KB Pages.  */
9195             if (level == 0 || (level == 1 && pamax <= 42)) {
9196                 return false;
9197             }
9198             break;
9199         case 11: /* 16KB Pages.  */
9200             if (level == 0 || (level == 1 && pamax <= 40)) {
9201                 return false;
9202             }
9203             break;
9204         case 9: /* 4KB Pages.  */
9205             if (level == 0 && pamax <= 42) {
9206                 return false;
9207             }
9208             break;
9209         default:
9210             g_assert_not_reached();
9211         }
9212 
9213         /* Inputsize checks.  */
9214         if (inputsize > pamax &&
9215             (arm_el_is_aa64(env, 1) || inputsize > 40)) {
9216             /* This is CONSTRAINED UNPREDICTABLE and we choose to fault.  */
9217             return false;
9218         }
9219     } else {
9220         /* AArch32 only supports 4KB pages. Assert on that.  */
9221         assert(stride == 9);
9222 
9223         if (level == 0) {
9224             return false;
9225         }
9226     }
9227     return true;
9228 }
9229 
9230 /* Translate from the 4-bit stage 2 representation of
9231  * memory attributes (without cache-allocation hints) to
9232  * the 8-bit representation of the stage 1 MAIR registers
9233  * (which includes allocation hints).
9234  *
9235  * ref: shared/translation/attrs/S2AttrDecode()
9236  *      .../S2ConvertAttrsHints()
9237  */
9238 static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
9239 {
9240     uint8_t hiattr = extract32(s2attrs, 2, 2);
9241     uint8_t loattr = extract32(s2attrs, 0, 2);
9242     uint8_t hihint = 0, lohint = 0;
9243 
9244     if (hiattr != 0) { /* normal memory */
9245         if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
9246             hiattr = loattr = 1; /* non-cacheable */
9247         } else {
9248             if (hiattr != 1) { /* Write-through or write-back */
9249                 hihint = 3; /* RW allocate */
9250             }
9251             if (loattr != 1) { /* Write-through or write-back */
9252                 lohint = 3; /* RW allocate */
9253             }
9254         }
9255     }
9256 
9257     return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
9258 }
9259 #endif /* !CONFIG_USER_ONLY */
9260 
9261 ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va,
9262                                         ARMMMUIdx mmu_idx)
9263 {
9264     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
9265     uint32_t el = regime_el(env, mmu_idx);
9266     bool tbi, tbid, epd, hpd, using16k, using64k;
9267     int select, tsz;
9268 
9269     /*
9270      * Bit 55 is always between the two regions, and is canonical for
9271      * determining if address tagging is enabled.
9272      */
9273     select = extract64(va, 55, 1);
9274 
9275     if (el > 1) {
9276         tsz = extract32(tcr, 0, 6);
9277         using64k = extract32(tcr, 14, 1);
9278         using16k = extract32(tcr, 15, 1);
9279         if (mmu_idx == ARMMMUIdx_S2NS) {
9280             /* VTCR_EL2 */
9281             tbi = tbid = hpd = false;
9282         } else {
9283             tbi = extract32(tcr, 20, 1);
9284             hpd = extract32(tcr, 24, 1);
9285             tbid = extract32(tcr, 29, 1);
9286         }
9287         epd = false;
9288     } else if (!select) {
9289         tsz = extract32(tcr, 0, 6);
9290         epd = extract32(tcr, 7, 1);
9291         using64k = extract32(tcr, 14, 1);
9292         using16k = extract32(tcr, 15, 1);
9293         tbi = extract64(tcr, 37, 1);
9294         hpd = extract64(tcr, 41, 1);
9295         tbid = extract64(tcr, 51, 1);
9296     } else {
9297         int tg = extract32(tcr, 30, 2);
9298         using16k = tg == 1;
9299         using64k = tg == 3;
9300         tsz = extract32(tcr, 16, 6);
9301         epd = extract32(tcr, 23, 1);
9302         tbi = extract64(tcr, 38, 1);
9303         hpd = extract64(tcr, 42, 1);
9304         tbid = extract64(tcr, 52, 1);
9305     }
9306     tsz = MIN(tsz, 39);  /* TODO: ARMv8.4-TTST */
9307     tsz = MAX(tsz, 16);  /* TODO: ARMv8.2-LVA  */
9308 
9309     return (ARMVAParameters) {
9310         .tsz = tsz,
9311         .select = select,
9312         .tbi = tbi,
9313         .tbid = tbid,
9314         .epd = epd,
9315         .hpd = hpd,
9316         .using16k = using16k,
9317         .using64k = using64k,
9318     };
9319 }
9320 
9321 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
9322                                    ARMMMUIdx mmu_idx, bool data)
9323 {
9324     ARMVAParameters ret = aa64_va_parameters_both(env, va, mmu_idx);
9325 
9326     /* Present TBI as a composite with TBID.  */
9327     ret.tbi &= (data || !ret.tbid);
9328     return ret;
9329 }
9330 
9331 #ifndef CONFIG_USER_ONLY
9332 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
9333                                           ARMMMUIdx mmu_idx)
9334 {
9335     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
9336     uint32_t el = regime_el(env, mmu_idx);
9337     int select, tsz;
9338     bool epd, hpd;
9339 
9340     if (mmu_idx == ARMMMUIdx_S2NS) {
9341         /* VTCR */
9342         bool sext = extract32(tcr, 4, 1);
9343         bool sign = extract32(tcr, 3, 1);
9344 
9345         /*
9346          * If the sign-extend bit is not the same as t0sz[3], the result
9347          * is unpredictable. Flag this as a guest error.
9348          */
9349         if (sign != sext) {
9350             qemu_log_mask(LOG_GUEST_ERROR,
9351                           "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
9352         }
9353         tsz = sextract32(tcr, 0, 4) + 8;
9354         select = 0;
9355         hpd = false;
9356         epd = false;
9357     } else if (el == 2) {
9358         /* HTCR */
9359         tsz = extract32(tcr, 0, 3);
9360         select = 0;
9361         hpd = extract64(tcr, 24, 1);
9362         epd = false;
9363     } else {
9364         int t0sz = extract32(tcr, 0, 3);
9365         int t1sz = extract32(tcr, 16, 3);
9366 
9367         if (t1sz == 0) {
9368             select = va > (0xffffffffu >> t0sz);
9369         } else {
9370             /* Note that we will detect errors later.  */
9371             select = va >= ~(0xffffffffu >> t1sz);
9372         }
9373         if (!select) {
9374             tsz = t0sz;
9375             epd = extract32(tcr, 7, 1);
9376             hpd = extract64(tcr, 41, 1);
9377         } else {
9378             tsz = t1sz;
9379             epd = extract32(tcr, 23, 1);
9380             hpd = extract64(tcr, 42, 1);
9381         }
9382         /* For aarch32, hpd0 is not enabled without t2e as well.  */
9383         hpd &= extract32(tcr, 6, 1);
9384     }
9385 
9386     return (ARMVAParameters) {
9387         .tsz = tsz,
9388         .select = select,
9389         .epd = epd,
9390         .hpd = hpd,
9391     };
9392 }
9393 
9394 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
9395                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
9396                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
9397                                target_ulong *page_size_ptr,
9398                                ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
9399 {
9400     ARMCPU *cpu = env_archcpu(env);
9401     CPUState *cs = CPU(cpu);
9402     /* Read an LPAE long-descriptor translation table. */
9403     ARMFaultType fault_type = ARMFault_Translation;
9404     uint32_t level;
9405     ARMVAParameters param;
9406     uint64_t ttbr;
9407     hwaddr descaddr, indexmask, indexmask_grainsize;
9408     uint32_t tableattrs;
9409     target_ulong page_size;
9410     uint32_t attrs;
9411     int32_t stride;
9412     int addrsize, inputsize;
9413     TCR *tcr = regime_tcr(env, mmu_idx);
9414     int ap, ns, xn, pxn;
9415     uint32_t el = regime_el(env, mmu_idx);
9416     bool ttbr1_valid;
9417     uint64_t descaddrmask;
9418     bool aarch64 = arm_el_is_aa64(env, el);
9419     bool guarded = false;
9420 
9421     /* TODO:
9422      * This code does not handle the different format TCR for VTCR_EL2.
9423      * This code also does not support shareability levels.
9424      * Attribute and permission bit handling should also be checked when adding
9425      * support for those page table walks.
9426      */
9427     if (aarch64) {
9428         param = aa64_va_parameters(env, address, mmu_idx,
9429                                    access_type != MMU_INST_FETCH);
9430         level = 0;
9431         /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
9432          * invalid.
9433          */
9434         ttbr1_valid = (el < 2);
9435         addrsize = 64 - 8 * param.tbi;
9436         inputsize = 64 - param.tsz;
9437     } else {
9438         param = aa32_va_parameters(env, address, mmu_idx);
9439         level = 1;
9440         /* There is no TTBR1 for EL2 */
9441         ttbr1_valid = (el != 2);
9442         addrsize = (mmu_idx == ARMMMUIdx_S2NS ? 40 : 32);
9443         inputsize = addrsize - param.tsz;
9444     }
9445 
9446     /*
9447      * We determined the region when collecting the parameters, but we
9448      * have not yet validated that the address is valid for the region.
9449      * Extract the top bits and verify that they all match select.
9450      *
9451      * For aa32, if inputsize == addrsize, then we have selected the
9452      * region by exclusion in aa32_va_parameters and there is no more
9453      * validation to do here.
9454      */
9455     if (inputsize < addrsize) {
9456         target_ulong top_bits = sextract64(address, inputsize,
9457                                            addrsize - inputsize);
9458         if (-top_bits != param.select || (param.select && !ttbr1_valid)) {
9459             /* The gap between the two regions is a Translation fault */
9460             fault_type = ARMFault_Translation;
9461             goto do_fault;
9462         }
9463     }
9464 
9465     if (param.using64k) {
9466         stride = 13;
9467     } else if (param.using16k) {
9468         stride = 11;
9469     } else {
9470         stride = 9;
9471     }
9472 
9473     /* Note that QEMU ignores shareability and cacheability attributes,
9474      * so we don't need to do anything with the SH, ORGN, IRGN fields
9475      * in the TTBCR.  Similarly, TTBCR:A1 selects whether we get the
9476      * ASID from TTBR0 or TTBR1, but QEMU's TLB doesn't currently
9477      * implement any ASID-like capability so we can ignore it (instead
9478      * we will always flush the TLB any time the ASID is changed).
9479      */
9480     ttbr = regime_ttbr(env, mmu_idx, param.select);
9481 
9482     /* Here we should have set up all the parameters for the translation:
9483      * inputsize, ttbr, epd, stride, tbi
9484      */
9485 
9486     if (param.epd) {
9487         /* Translation table walk disabled => Translation fault on TLB miss
9488          * Note: This is always 0 on 64-bit EL2 and EL3.
9489          */
9490         goto do_fault;
9491     }
9492 
9493     if (mmu_idx != ARMMMUIdx_S2NS) {
9494         /* The starting level depends on the virtual address size (which can
9495          * be up to 48 bits) and the translation granule size. It indicates
9496          * the number of strides (stride bits at a time) needed to
9497          * consume the bits of the input address. In the pseudocode this is:
9498          *  level = 4 - RoundUp((inputsize - grainsize) / stride)
9499          * where their 'inputsize' is our 'inputsize', 'grainsize' is
9500          * our 'stride + 3' and 'stride' is our 'stride'.
9501          * Applying the usual "rounded up m/n is (m+n-1)/n" and simplifying:
9502          * = 4 - (inputsize - stride - 3 + stride - 1) / stride
9503          * = 4 - (inputsize - 4) / stride;
9504          */
9505         level = 4 - (inputsize - 4) / stride;
9506     } else {
9507         /* For stage 2 translations the starting level is specified by the
9508          * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
9509          */
9510         uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2);
9511         uint32_t startlevel;
9512         bool ok;
9513 
9514         if (!aarch64 || stride == 9) {
9515             /* AArch32 or 4KB pages */
9516             startlevel = 2 - sl0;
9517         } else {
9518             /* 16KB or 64KB pages */
9519             startlevel = 3 - sl0;
9520         }
9521 
9522         /* Check that the starting level is valid. */
9523         ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
9524                                 inputsize, stride);
9525         if (!ok) {
9526             fault_type = ARMFault_Translation;
9527             goto do_fault;
9528         }
9529         level = startlevel;
9530     }
9531 
9532     indexmask_grainsize = (1ULL << (stride + 3)) - 1;
9533     indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
9534 
9535     /* Now we can extract the actual base address from the TTBR */
9536     descaddr = extract64(ttbr, 0, 48);
9537     descaddr &= ~indexmask;
9538 
9539     /* The address field in the descriptor goes up to bit 39 for ARMv7
9540      * but up to bit 47 for ARMv8, but we use the descaddrmask
9541      * up to bit 39 for AArch32, because we don't need other bits in that case
9542      * to construct next descriptor address (anyway they should be all zeroes).
9543      */
9544     descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) &
9545                    ~indexmask_grainsize;
9546 
9547     /* Secure accesses start with the page table in secure memory and
9548      * can be downgraded to non-secure at any step. Non-secure accesses
9549      * remain non-secure. We implement this by just ORing in the NSTable/NS
9550      * bits at each step.
9551      */
9552     tableattrs = regime_is_secure(env, mmu_idx) ? 0 : (1 << 4);
9553     for (;;) {
9554         uint64_t descriptor;
9555         bool nstable;
9556 
9557         descaddr |= (address >> (stride * (4 - level))) & indexmask;
9558         descaddr &= ~7ULL;
9559         nstable = extract32(tableattrs, 4, 1);
9560         descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi);
9561         if (fi->type != ARMFault_None) {
9562             goto do_fault;
9563         }
9564 
9565         if (!(descriptor & 1) ||
9566             (!(descriptor & 2) && (level == 3))) {
9567             /* Invalid, or the Reserved level 3 encoding */
9568             goto do_fault;
9569         }
9570         descaddr = descriptor & descaddrmask;
9571 
9572         if ((descriptor & 2) && (level < 3)) {
9573             /* Table entry. The top five bits are attributes which may
9574              * propagate down through lower levels of the table (and
9575              * which are all arranged so that 0 means "no effect", so
9576              * we can gather them up by ORing in the bits at each level).
9577              */
9578             tableattrs |= extract64(descriptor, 59, 5);
9579             level++;
9580             indexmask = indexmask_grainsize;
9581             continue;
9582         }
9583         /* Block entry at level 1 or 2, or page entry at level 3.
9584          * These are basically the same thing, although the number
9585          * of bits we pull in from the vaddr varies.
9586          */
9587         page_size = (1ULL << ((stride * (4 - level)) + 3));
9588         descaddr |= (address & (page_size - 1));
9589         /* Extract attributes from the descriptor */
9590         attrs = extract64(descriptor, 2, 10)
9591             | (extract64(descriptor, 52, 12) << 10);
9592 
9593         if (mmu_idx == ARMMMUIdx_S2NS) {
9594             /* Stage 2 table descriptors do not include any attribute fields */
9595             break;
9596         }
9597         /* Merge in attributes from table descriptors */
9598         attrs |= nstable << 3; /* NS */
9599         guarded = extract64(descriptor, 50, 1);  /* GP */
9600         if (param.hpd) {
9601             /* HPD disables all the table attributes except NSTable.  */
9602             break;
9603         }
9604         attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
9605         /* The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
9606          * means "force PL1 access only", which means forcing AP[1] to 0.
9607          */
9608         attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
9609         attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
9610         break;
9611     }
9612     /* Here descaddr is the final physical address, and attributes
9613      * are all in attrs.
9614      */
9615     fault_type = ARMFault_AccessFlag;
9616     if ((attrs & (1 << 8)) == 0) {
9617         /* Access flag */
9618         goto do_fault;
9619     }
9620 
9621     ap = extract32(attrs, 4, 2);
9622     xn = extract32(attrs, 12, 1);
9623 
9624     if (mmu_idx == ARMMMUIdx_S2NS) {
9625         ns = true;
9626         *prot = get_S2prot(env, ap, xn);
9627     } else {
9628         ns = extract32(attrs, 3, 1);
9629         pxn = extract32(attrs, 11, 1);
9630         *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
9631     }
9632 
9633     fault_type = ARMFault_Permission;
9634     if (!(*prot & (1 << access_type))) {
9635         goto do_fault;
9636     }
9637 
9638     if (ns) {
9639         /* The NS bit will (as required by the architecture) have no effect if
9640          * the CPU doesn't support TZ or this is a non-secure translation
9641          * regime, because the attribute will already be non-secure.
9642          */
9643         txattrs->secure = false;
9644     }
9645     /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB.  */
9646     if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) {
9647         txattrs->target_tlb_bit0 = true;
9648     }
9649 
9650     if (cacheattrs != NULL) {
9651         if (mmu_idx == ARMMMUIdx_S2NS) {
9652             cacheattrs->attrs = convert_stage2_attrs(env,
9653                                                      extract32(attrs, 0, 4));
9654         } else {
9655             /* Index into MAIR registers for cache attributes */
9656             uint8_t attrindx = extract32(attrs, 0, 3);
9657             uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
9658             assert(attrindx <= 7);
9659             cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
9660         }
9661         cacheattrs->shareability = extract32(attrs, 6, 2);
9662     }
9663 
9664     *phys_ptr = descaddr;
9665     *page_size_ptr = page_size;
9666     return false;
9667 
9668 do_fault:
9669     fi->type = fault_type;
9670     fi->level = level;
9671     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
9672     fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_S2NS);
9673     return true;
9674 }
9675 
9676 static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
9677                                                 ARMMMUIdx mmu_idx,
9678                                                 int32_t address, int *prot)
9679 {
9680     if (!arm_feature(env, ARM_FEATURE_M)) {
9681         *prot = PAGE_READ | PAGE_WRITE;
9682         switch (address) {
9683         case 0xF0000000 ... 0xFFFFFFFF:
9684             if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
9685                 /* hivecs execing is ok */
9686                 *prot |= PAGE_EXEC;
9687             }
9688             break;
9689         case 0x00000000 ... 0x7FFFFFFF:
9690             *prot |= PAGE_EXEC;
9691             break;
9692         }
9693     } else {
9694         /* Default system address map for M profile cores.
9695          * The architecture specifies which regions are execute-never;
9696          * at the MPU level no other checks are defined.
9697          */
9698         switch (address) {
9699         case 0x00000000 ... 0x1fffffff: /* ROM */
9700         case 0x20000000 ... 0x3fffffff: /* SRAM */
9701         case 0x60000000 ... 0x7fffffff: /* RAM */
9702         case 0x80000000 ... 0x9fffffff: /* RAM */
9703             *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
9704             break;
9705         case 0x40000000 ... 0x5fffffff: /* Peripheral */
9706         case 0xa0000000 ... 0xbfffffff: /* Device */
9707         case 0xc0000000 ... 0xdfffffff: /* Device */
9708         case 0xe0000000 ... 0xffffffff: /* System */
9709             *prot = PAGE_READ | PAGE_WRITE;
9710             break;
9711         default:
9712             g_assert_not_reached();
9713         }
9714     }
9715 }
9716 
9717 static bool pmsav7_use_background_region(ARMCPU *cpu,
9718                                          ARMMMUIdx mmu_idx, bool is_user)
9719 {
9720     /* Return true if we should use the default memory map as a
9721      * "background" region if there are no hits against any MPU regions.
9722      */
9723     CPUARMState *env = &cpu->env;
9724 
9725     if (is_user) {
9726         return false;
9727     }
9728 
9729     if (arm_feature(env, ARM_FEATURE_M)) {
9730         return env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)]
9731             & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
9732     } else {
9733         return regime_sctlr(env, mmu_idx) & SCTLR_BR;
9734     }
9735 }
9736 
9737 static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
9738 {
9739     /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
9740     return arm_feature(env, ARM_FEATURE_M) &&
9741         extract32(address, 20, 12) == 0xe00;
9742 }
9743 
9744 static inline bool m_is_system_region(CPUARMState *env, uint32_t address)
9745 {
9746     /* True if address is in the M profile system region
9747      * 0xe0000000 - 0xffffffff
9748      */
9749     return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
9750 }
9751 
9752 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
9753                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
9754                                  hwaddr *phys_ptr, int *prot,
9755                                  target_ulong *page_size,
9756                                  ARMMMUFaultInfo *fi)
9757 {
9758     ARMCPU *cpu = env_archcpu(env);
9759     int n;
9760     bool is_user = regime_is_user(env, mmu_idx);
9761 
9762     *phys_ptr = address;
9763     *page_size = TARGET_PAGE_SIZE;
9764     *prot = 0;
9765 
9766     if (regime_translation_disabled(env, mmu_idx) ||
9767         m_is_ppb_region(env, address)) {
9768         /* MPU disabled or M profile PPB access: use default memory map.
9769          * The other case which uses the default memory map in the
9770          * v7M ARM ARM pseudocode is exception vector reads from the vector
9771          * table. In QEMU those accesses are done in arm_v7m_load_vector(),
9772          * which always does a direct read using address_space_ldl(), rather
9773          * than going via this function, so we don't need to check that here.
9774          */
9775         get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
9776     } else { /* MPU enabled */
9777         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
9778             /* region search */
9779             uint32_t base = env->pmsav7.drbar[n];
9780             uint32_t rsize = extract32(env->pmsav7.drsr[n], 1, 5);
9781             uint32_t rmask;
9782             bool srdis = false;
9783 
9784             if (!(env->pmsav7.drsr[n] & 0x1)) {
9785                 continue;
9786             }
9787 
9788             if (!rsize) {
9789                 qemu_log_mask(LOG_GUEST_ERROR,
9790                               "DRSR[%d]: Rsize field cannot be 0\n", n);
9791                 continue;
9792             }
9793             rsize++;
9794             rmask = (1ull << rsize) - 1;
9795 
9796             if (base & rmask) {
9797                 qemu_log_mask(LOG_GUEST_ERROR,
9798                               "DRBAR[%d]: 0x%" PRIx32 " misaligned "
9799                               "to DRSR region size, mask = 0x%" PRIx32 "\n",
9800                               n, base, rmask);
9801                 continue;
9802             }
9803 
9804             if (address < base || address > base + rmask) {
9805                 /*
9806                  * Address not in this region. We must check whether the
9807                  * region covers addresses in the same page as our address.
9808                  * In that case we must not report a size that covers the
9809                  * whole page for a subsequent hit against a different MPU
9810                  * region or the background region, because it would result in
9811                  * incorrect TLB hits for subsequent accesses to addresses that
9812                  * are in this MPU region.
9813                  */
9814                 if (ranges_overlap(base, rmask,
9815                                    address & TARGET_PAGE_MASK,
9816                                    TARGET_PAGE_SIZE)) {
9817                     *page_size = 1;
9818                 }
9819                 continue;
9820             }
9821 
9822             /* Region matched */
9823 
9824             if (rsize >= 8) { /* no subregions for regions < 256 bytes */
9825                 int i, snd;
9826                 uint32_t srdis_mask;
9827 
9828                 rsize -= 3; /* sub region size (power of 2) */
9829                 snd = ((address - base) >> rsize) & 0x7;
9830                 srdis = extract32(env->pmsav7.drsr[n], snd + 8, 1);
9831 
9832                 srdis_mask = srdis ? 0x3 : 0x0;
9833                 for (i = 2; i <= 8 && rsize < TARGET_PAGE_BITS; i *= 2) {
9834                     /* This will check in groups of 2, 4 and then 8, whether
9835                      * the subregion bits are consistent. rsize is incremented
9836                      * back up to give the region size, considering consistent
9837                      * adjacent subregions as one region. Stop testing if rsize
9838                      * is already big enough for an entire QEMU page.
9839                      */
9840                     int snd_rounded = snd & ~(i - 1);
9841                     uint32_t srdis_multi = extract32(env->pmsav7.drsr[n],
9842                                                      snd_rounded + 8, i);
9843                     if (srdis_mask ^ srdis_multi) {
9844                         break;
9845                     }
9846                     srdis_mask = (srdis_mask << i) | srdis_mask;
9847                     rsize++;
9848                 }
9849             }
9850             if (srdis) {
9851                 continue;
9852             }
9853             if (rsize < TARGET_PAGE_BITS) {
9854                 *page_size = 1 << rsize;
9855             }
9856             break;
9857         }
9858 
9859         if (n == -1) { /* no hits */
9860             if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
9861                 /* background fault */
9862                 fi->type = ARMFault_Background;
9863                 return true;
9864             }
9865             get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
9866         } else { /* a MPU hit! */
9867             uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
9868             uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
9869 
9870             if (m_is_system_region(env, address)) {
9871                 /* System space is always execute never */
9872                 xn = 1;
9873             }
9874 
9875             if (is_user) { /* User mode AP bit decoding */
9876                 switch (ap) {
9877                 case 0:
9878                 case 1:
9879                 case 5:
9880                     break; /* no access */
9881                 case 3:
9882                     *prot |= PAGE_WRITE;
9883                     /* fall through */
9884                 case 2:
9885                 case 6:
9886                     *prot |= PAGE_READ | PAGE_EXEC;
9887                     break;
9888                 case 7:
9889                     /* for v7M, same as 6; for R profile a reserved value */
9890                     if (arm_feature(env, ARM_FEATURE_M)) {
9891                         *prot |= PAGE_READ | PAGE_EXEC;
9892                         break;
9893                     }
9894                     /* fall through */
9895                 default:
9896                     qemu_log_mask(LOG_GUEST_ERROR,
9897                                   "DRACR[%d]: Bad value for AP bits: 0x%"
9898                                   PRIx32 "\n", n, ap);
9899                 }
9900             } else { /* Priv. mode AP bits decoding */
9901                 switch (ap) {
9902                 case 0:
9903                     break; /* no access */
9904                 case 1:
9905                 case 2:
9906                 case 3:
9907                     *prot |= PAGE_WRITE;
9908                     /* fall through */
9909                 case 5:
9910                 case 6:
9911                     *prot |= PAGE_READ | PAGE_EXEC;
9912                     break;
9913                 case 7:
9914                     /* for v7M, same as 6; for R profile a reserved value */
9915                     if (arm_feature(env, ARM_FEATURE_M)) {
9916                         *prot |= PAGE_READ | PAGE_EXEC;
9917                         break;
9918                     }
9919                     /* fall through */
9920                 default:
9921                     qemu_log_mask(LOG_GUEST_ERROR,
9922                                   "DRACR[%d]: Bad value for AP bits: 0x%"
9923                                   PRIx32 "\n", n, ap);
9924                 }
9925             }
9926 
9927             /* execute never */
9928             if (xn) {
9929                 *prot &= ~PAGE_EXEC;
9930             }
9931         }
9932     }
9933 
9934     fi->type = ARMFault_Permission;
9935     fi->level = 1;
9936     return !(*prot & (1 << access_type));
9937 }
9938 
9939 static bool v8m_is_sau_exempt(CPUARMState *env,
9940                               uint32_t address, MMUAccessType access_type)
9941 {
9942     /* The architecture specifies that certain address ranges are
9943      * exempt from v8M SAU/IDAU checks.
9944      */
9945     return
9946         (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
9947         (address >= 0xe0000000 && address <= 0xe0002fff) ||
9948         (address >= 0xe000e000 && address <= 0xe000efff) ||
9949         (address >= 0xe002e000 && address <= 0xe002efff) ||
9950         (address >= 0xe0040000 && address <= 0xe0041fff) ||
9951         (address >= 0xe00ff000 && address <= 0xe00fffff);
9952 }
9953 
9954 void v8m_security_lookup(CPUARMState *env, uint32_t address,
9955                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
9956                                 V8M_SAttributes *sattrs)
9957 {
9958     /* Look up the security attributes for this address. Compare the
9959      * pseudocode SecurityCheck() function.
9960      * We assume the caller has zero-initialized *sattrs.
9961      */
9962     ARMCPU *cpu = env_archcpu(env);
9963     int r;
9964     bool idau_exempt = false, idau_ns = true, idau_nsc = true;
9965     int idau_region = IREGION_NOTVALID;
9966     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
9967     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
9968 
9969     if (cpu->idau) {
9970         IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);
9971         IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);
9972 
9973         iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,
9974                    &idau_nsc);
9975     }
9976 
9977     if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
9978         /* 0xf0000000..0xffffffff is always S for insn fetches */
9979         return;
9980     }
9981 
9982     if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {
9983         sattrs->ns = !regime_is_secure(env, mmu_idx);
9984         return;
9985     }
9986 
9987     if (idau_region != IREGION_NOTVALID) {
9988         sattrs->irvalid = true;
9989         sattrs->iregion = idau_region;
9990     }
9991 
9992     switch (env->sau.ctrl & 3) {
9993     case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
9994         break;
9995     case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
9996         sattrs->ns = true;
9997         break;
9998     default: /* SAU.ENABLE == 1 */
9999         for (r = 0; r < cpu->sau_sregion; r++) {
10000             if (env->sau.rlar[r] & 1) {
10001                 uint32_t base = env->sau.rbar[r] & ~0x1f;
10002                 uint32_t limit = env->sau.rlar[r] | 0x1f;
10003 
10004                 if (base <= address && limit >= address) {
10005                     if (base > addr_page_base || limit < addr_page_limit) {
10006                         sattrs->subpage = true;
10007                     }
10008                     if (sattrs->srvalid) {
10009                         /* If we hit in more than one region then we must report
10010                          * as Secure, not NS-Callable, with no valid region
10011                          * number info.
10012                          */
10013                         sattrs->ns = false;
10014                         sattrs->nsc = false;
10015                         sattrs->sregion = 0;
10016                         sattrs->srvalid = false;
10017                         break;
10018                     } else {
10019                         if (env->sau.rlar[r] & 2) {
10020                             sattrs->nsc = true;
10021                         } else {
10022                             sattrs->ns = true;
10023                         }
10024                         sattrs->srvalid = true;
10025                         sattrs->sregion = r;
10026                     }
10027                 } else {
10028                     /*
10029                      * Address not in this region. We must check whether the
10030                      * region covers addresses in the same page as our address.
10031                      * In that case we must not report a size that covers the
10032                      * whole page for a subsequent hit against a different MPU
10033                      * region or the background region, because it would result
10034                      * in incorrect TLB hits for subsequent accesses to
10035                      * addresses that are in this MPU region.
10036                      */
10037                     if (limit >= base &&
10038                         ranges_overlap(base, limit - base + 1,
10039                                        addr_page_base,
10040                                        TARGET_PAGE_SIZE)) {
10041                         sattrs->subpage = true;
10042                     }
10043                 }
10044             }
10045         }
10046         break;
10047     }
10048 
10049     /*
10050      * The IDAU will override the SAU lookup results if it specifies
10051      * higher security than the SAU does.
10052      */
10053     if (!idau_ns) {
10054         if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {
10055             sattrs->ns = false;
10056             sattrs->nsc = idau_nsc;
10057         }
10058     }
10059 }
10060 
10061 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
10062                               MMUAccessType access_type, ARMMMUIdx mmu_idx,
10063                               hwaddr *phys_ptr, MemTxAttrs *txattrs,
10064                               int *prot, bool *is_subpage,
10065                               ARMMMUFaultInfo *fi, uint32_t *mregion)
10066 {
10067     /* Perform a PMSAv8 MPU lookup (without also doing the SAU check
10068      * that a full phys-to-virt translation does).
10069      * mregion is (if not NULL) set to the region number which matched,
10070      * or -1 if no region number is returned (MPU off, address did not
10071      * hit a region, address hit in multiple regions).
10072      * We set is_subpage to true if the region hit doesn't cover the
10073      * entire TARGET_PAGE the address is within.
10074      */
10075     ARMCPU *cpu = env_archcpu(env);
10076     bool is_user = regime_is_user(env, mmu_idx);
10077     uint32_t secure = regime_is_secure(env, mmu_idx);
10078     int n;
10079     int matchregion = -1;
10080     bool hit = false;
10081     uint32_t addr_page_base = address & TARGET_PAGE_MASK;
10082     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
10083 
10084     *is_subpage = false;
10085     *phys_ptr = address;
10086     *prot = 0;
10087     if (mregion) {
10088         *mregion = -1;
10089     }
10090 
10091     /* Unlike the ARM ARM pseudocode, we don't need to check whether this
10092      * was an exception vector read from the vector table (which is always
10093      * done using the default system address map), because those accesses
10094      * are done in arm_v7m_load_vector(), which always does a direct
10095      * read using address_space_ldl(), rather than going via this function.
10096      */
10097     if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
10098         hit = true;
10099     } else if (m_is_ppb_region(env, address)) {
10100         hit = true;
10101     } else {
10102         if (pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
10103             hit = true;
10104         }
10105 
10106         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
10107             /* region search */
10108             /* Note that the base address is bits [31:5] from the register
10109              * with bits [4:0] all zeroes, but the limit address is bits
10110              * [31:5] from the register with bits [4:0] all ones.
10111              */
10112             uint32_t base = env->pmsav8.rbar[secure][n] & ~0x1f;
10113             uint32_t limit = env->pmsav8.rlar[secure][n] | 0x1f;
10114 
10115             if (!(env->pmsav8.rlar[secure][n] & 0x1)) {
10116                 /* Region disabled */
10117                 continue;
10118             }
10119 
10120             if (address < base || address > limit) {
10121                 /*
10122                  * Address not in this region. We must check whether the
10123                  * region covers addresses in the same page as our address.
10124                  * In that case we must not report a size that covers the
10125                  * whole page for a subsequent hit against a different MPU
10126                  * region or the background region, because it would result in
10127                  * incorrect TLB hits for subsequent accesses to addresses that
10128                  * are in this MPU region.
10129                  */
10130                 if (limit >= base &&
10131                     ranges_overlap(base, limit - base + 1,
10132                                    addr_page_base,
10133                                    TARGET_PAGE_SIZE)) {
10134                     *is_subpage = true;
10135                 }
10136                 continue;
10137             }
10138 
10139             if (base > addr_page_base || limit < addr_page_limit) {
10140                 *is_subpage = true;
10141             }
10142 
10143             if (matchregion != -1) {
10144                 /* Multiple regions match -- always a failure (unlike
10145                  * PMSAv7 where highest-numbered-region wins)
10146                  */
10147                 fi->type = ARMFault_Permission;
10148                 fi->level = 1;
10149                 return true;
10150             }
10151 
10152             matchregion = n;
10153             hit = true;
10154         }
10155     }
10156 
10157     if (!hit) {
10158         /* background fault */
10159         fi->type = ARMFault_Background;
10160         return true;
10161     }
10162 
10163     if (matchregion == -1) {
10164         /* hit using the background region */
10165         get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
10166     } else {
10167         uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
10168         uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
10169 
10170         if (m_is_system_region(env, address)) {
10171             /* System space is always execute never */
10172             xn = 1;
10173         }
10174 
10175         *prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
10176         if (*prot && !xn) {
10177             *prot |= PAGE_EXEC;
10178         }
10179         /* We don't need to look the attribute up in the MAIR0/MAIR1
10180          * registers because that only tells us about cacheability.
10181          */
10182         if (mregion) {
10183             *mregion = matchregion;
10184         }
10185     }
10186 
10187     fi->type = ARMFault_Permission;
10188     fi->level = 1;
10189     return !(*prot & (1 << access_type));
10190 }
10191 
10192 
10193 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
10194                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
10195                                  hwaddr *phys_ptr, MemTxAttrs *txattrs,
10196                                  int *prot, target_ulong *page_size,
10197                                  ARMMMUFaultInfo *fi)
10198 {
10199     uint32_t secure = regime_is_secure(env, mmu_idx);
10200     V8M_SAttributes sattrs = {};
10201     bool ret;
10202     bool mpu_is_subpage;
10203 
10204     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
10205         v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs);
10206         if (access_type == MMU_INST_FETCH) {
10207             /* Instruction fetches always use the MMU bank and the
10208              * transaction attribute determined by the fetch address,
10209              * regardless of CPU state. This is painful for QEMU
10210              * to handle, because it would mean we need to encode
10211              * into the mmu_idx not just the (user, negpri) information
10212              * for the current security state but also that for the
10213              * other security state, which would balloon the number
10214              * of mmu_idx values needed alarmingly.
10215              * Fortunately we can avoid this because it's not actually
10216              * possible to arbitrarily execute code from memory with
10217              * the wrong security attribute: it will always generate
10218              * an exception of some kind or another, apart from the
10219              * special case of an NS CPU executing an SG instruction
10220              * in S&NSC memory. So we always just fail the translation
10221              * here and sort things out in the exception handler
10222              * (including possibly emulating an SG instruction).
10223              */
10224             if (sattrs.ns != !secure) {
10225                 if (sattrs.nsc) {
10226                     fi->type = ARMFault_QEMU_NSCExec;
10227                 } else {
10228                     fi->type = ARMFault_QEMU_SFault;
10229                 }
10230                 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
10231                 *phys_ptr = address;
10232                 *prot = 0;
10233                 return true;
10234             }
10235         } else {
10236             /* For data accesses we always use the MMU bank indicated
10237              * by the current CPU state, but the security attributes
10238              * might downgrade a secure access to nonsecure.
10239              */
10240             if (sattrs.ns) {
10241                 txattrs->secure = false;
10242             } else if (!secure) {
10243                 /* NS access to S memory must fault.
10244                  * Architecturally we should first check whether the
10245                  * MPU information for this address indicates that we
10246                  * are doing an unaligned access to Device memory, which
10247                  * should generate a UsageFault instead. QEMU does not
10248                  * currently check for that kind of unaligned access though.
10249                  * If we added it we would need to do so as a special case
10250                  * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
10251                  */
10252                 fi->type = ARMFault_QEMU_SFault;
10253                 *page_size = sattrs.subpage ? 1 : TARGET_PAGE_SIZE;
10254                 *phys_ptr = address;
10255                 *prot = 0;
10256                 return true;
10257             }
10258         }
10259     }
10260 
10261     ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr,
10262                             txattrs, prot, &mpu_is_subpage, fi, NULL);
10263     *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE;
10264     return ret;
10265 }
10266 
10267 static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
10268                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
10269                                  hwaddr *phys_ptr, int *prot,
10270                                  ARMMMUFaultInfo *fi)
10271 {
10272     int n;
10273     uint32_t mask;
10274     uint32_t base;
10275     bool is_user = regime_is_user(env, mmu_idx);
10276 
10277     if (regime_translation_disabled(env, mmu_idx)) {
10278         /* MPU disabled.  */
10279         *phys_ptr = address;
10280         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10281         return false;
10282     }
10283 
10284     *phys_ptr = address;
10285     for (n = 7; n >= 0; n--) {
10286         base = env->cp15.c6_region[n];
10287         if ((base & 1) == 0) {
10288             continue;
10289         }
10290         mask = 1 << ((base >> 1) & 0x1f);
10291         /* Keep this shift separate from the above to avoid an
10292            (undefined) << 32.  */
10293         mask = (mask << 1) - 1;
10294         if (((base ^ address) & ~mask) == 0) {
10295             break;
10296         }
10297     }
10298     if (n < 0) {
10299         fi->type = ARMFault_Background;
10300         return true;
10301     }
10302 
10303     if (access_type == MMU_INST_FETCH) {
10304         mask = env->cp15.pmsav5_insn_ap;
10305     } else {
10306         mask = env->cp15.pmsav5_data_ap;
10307     }
10308     mask = (mask >> (n * 4)) & 0xf;
10309     switch (mask) {
10310     case 0:
10311         fi->type = ARMFault_Permission;
10312         fi->level = 1;
10313         return true;
10314     case 1:
10315         if (is_user) {
10316             fi->type = ARMFault_Permission;
10317             fi->level = 1;
10318             return true;
10319         }
10320         *prot = PAGE_READ | PAGE_WRITE;
10321         break;
10322     case 2:
10323         *prot = PAGE_READ;
10324         if (!is_user) {
10325             *prot |= PAGE_WRITE;
10326         }
10327         break;
10328     case 3:
10329         *prot = PAGE_READ | PAGE_WRITE;
10330         break;
10331     case 5:
10332         if (is_user) {
10333             fi->type = ARMFault_Permission;
10334             fi->level = 1;
10335             return true;
10336         }
10337         *prot = PAGE_READ;
10338         break;
10339     case 6:
10340         *prot = PAGE_READ;
10341         break;
10342     default:
10343         /* Bad permission.  */
10344         fi->type = ARMFault_Permission;
10345         fi->level = 1;
10346         return true;
10347     }
10348     *prot |= PAGE_EXEC;
10349     return false;
10350 }
10351 
10352 /* Combine either inner or outer cacheability attributes for normal
10353  * memory, according to table D4-42 and pseudocode procedure
10354  * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
10355  *
10356  * NB: only stage 1 includes allocation hints (RW bits), leading to
10357  * some asymmetry.
10358  */
10359 static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
10360 {
10361     if (s1 == 4 || s2 == 4) {
10362         /* non-cacheable has precedence */
10363         return 4;
10364     } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
10365         /* stage 1 write-through takes precedence */
10366         return s1;
10367     } else if (extract32(s2, 2, 2) == 2) {
10368         /* stage 2 write-through takes precedence, but the allocation hint
10369          * is still taken from stage 1
10370          */
10371         return (2 << 2) | extract32(s1, 0, 2);
10372     } else { /* write-back */
10373         return s1;
10374     }
10375 }
10376 
10377 /* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
10378  * and CombineS1S2Desc()
10379  *
10380  * @s1:      Attributes from stage 1 walk
10381  * @s2:      Attributes from stage 2 walk
10382  */
10383 static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
10384 {
10385     uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
10386     uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
10387     ARMCacheAttrs ret;
10388 
10389     /* Combine shareability attributes (table D4-43) */
10390     if (s1.shareability == 2 || s2.shareability == 2) {
10391         /* if either are outer-shareable, the result is outer-shareable */
10392         ret.shareability = 2;
10393     } else if (s1.shareability == 3 || s2.shareability == 3) {
10394         /* if either are inner-shareable, the result is inner-shareable */
10395         ret.shareability = 3;
10396     } else {
10397         /* both non-shareable */
10398         ret.shareability = 0;
10399     }
10400 
10401     /* Combine memory type and cacheability attributes */
10402     if (s1hi == 0 || s2hi == 0) {
10403         /* Device has precedence over normal */
10404         if (s1lo == 0 || s2lo == 0) {
10405             /* nGnRnE has precedence over anything */
10406             ret.attrs = 0;
10407         } else if (s1lo == 4 || s2lo == 4) {
10408             /* non-Reordering has precedence over Reordering */
10409             ret.attrs = 4;  /* nGnRE */
10410         } else if (s1lo == 8 || s2lo == 8) {
10411             /* non-Gathering has precedence over Gathering */
10412             ret.attrs = 8;  /* nGRE */
10413         } else {
10414             ret.attrs = 0xc; /* GRE */
10415         }
10416 
10417         /* Any location for which the resultant memory type is any
10418          * type of Device memory is always treated as Outer Shareable.
10419          */
10420         ret.shareability = 2;
10421     } else { /* Normal memory */
10422         /* Outer/inner cacheability combine independently */
10423         ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
10424                   | combine_cacheattr_nibble(s1lo, s2lo);
10425 
10426         if (ret.attrs == 0x44) {
10427             /* Any location for which the resultant memory type is Normal
10428              * Inner Non-cacheable, Outer Non-cacheable is always treated
10429              * as Outer Shareable.
10430              */
10431             ret.shareability = 2;
10432         }
10433     }
10434 
10435     return ret;
10436 }
10437 
10438 
10439 /* get_phys_addr - get the physical address for this virtual address
10440  *
10441  * Find the physical address corresponding to the given virtual address,
10442  * by doing a translation table walk on MMU based systems or using the
10443  * MPU state on MPU based systems.
10444  *
10445  * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
10446  * prot and page_size may not be filled in, and the populated fsr value provides
10447  * information on why the translation aborted, in the format of a
10448  * DFSR/IFSR fault register, with the following caveats:
10449  *  * we honour the short vs long DFSR format differences.
10450  *  * the WnR bit is never set (the caller must do this).
10451  *  * for PSMAv5 based systems we don't bother to return a full FSR format
10452  *    value.
10453  *
10454  * @env: CPUARMState
10455  * @address: virtual address to get physical address for
10456  * @access_type: 0 for read, 1 for write, 2 for execute
10457  * @mmu_idx: MMU index indicating required translation regime
10458  * @phys_ptr: set to the physical address corresponding to the virtual address
10459  * @attrs: set to the memory transaction attributes to use
10460  * @prot: set to the permissions for the page containing phys_ptr
10461  * @page_size: set to the size of the page containing phys_ptr
10462  * @fi: set to fault info if the translation fails
10463  * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
10464  */
10465 bool get_phys_addr(CPUARMState *env, target_ulong address,
10466                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
10467                    hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
10468                    target_ulong *page_size,
10469                    ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
10470 {
10471     if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
10472         /* Call ourselves recursively to do the stage 1 and then stage 2
10473          * translations.
10474          */
10475         if (arm_feature(env, ARM_FEATURE_EL2)) {
10476             hwaddr ipa;
10477             int s2_prot;
10478             int ret;
10479             ARMCacheAttrs cacheattrs2 = {};
10480 
10481             ret = get_phys_addr(env, address, access_type,
10482                                 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
10483                                 prot, page_size, fi, cacheattrs);
10484 
10485             /* If S1 fails or S2 is disabled, return early.  */
10486             if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
10487                 *phys_ptr = ipa;
10488                 return ret;
10489             }
10490 
10491             /* S1 is done. Now do S2 translation.  */
10492             ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
10493                                      phys_ptr, attrs, &s2_prot,
10494                                      page_size, fi,
10495                                      cacheattrs != NULL ? &cacheattrs2 : NULL);
10496             fi->s2addr = ipa;
10497             /* Combine the S1 and S2 perms.  */
10498             *prot &= s2_prot;
10499 
10500             /* Combine the S1 and S2 cache attributes, if needed */
10501             if (!ret && cacheattrs != NULL) {
10502                 if (env->cp15.hcr_el2 & HCR_DC) {
10503                     /*
10504                      * HCR.DC forces the first stage attributes to
10505                      *  Normal Non-Shareable,
10506                      *  Inner Write-Back Read-Allocate Write-Allocate,
10507                      *  Outer Write-Back Read-Allocate Write-Allocate.
10508                      */
10509                     cacheattrs->attrs = 0xff;
10510                     cacheattrs->shareability = 0;
10511                 }
10512                 *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
10513             }
10514 
10515             return ret;
10516         } else {
10517             /*
10518              * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
10519              */
10520             mmu_idx = stage_1_mmu_idx(mmu_idx);
10521         }
10522     }
10523 
10524     /* The page table entries may downgrade secure to non-secure, but
10525      * cannot upgrade an non-secure translation regime's attributes
10526      * to secure.
10527      */
10528     attrs->secure = regime_is_secure(env, mmu_idx);
10529     attrs->user = regime_is_user(env, mmu_idx);
10530 
10531     /* Fast Context Switch Extension. This doesn't exist at all in v8.
10532      * In v7 and earlier it affects all stage 1 translations.
10533      */
10534     if (address < 0x02000000 && mmu_idx != ARMMMUIdx_S2NS
10535         && !arm_feature(env, ARM_FEATURE_V8)) {
10536         if (regime_el(env, mmu_idx) == 3) {
10537             address += env->cp15.fcseidr_s;
10538         } else {
10539             address += env->cp15.fcseidr_ns;
10540         }
10541     }
10542 
10543     if (arm_feature(env, ARM_FEATURE_PMSA)) {
10544         bool ret;
10545         *page_size = TARGET_PAGE_SIZE;
10546 
10547         if (arm_feature(env, ARM_FEATURE_V8)) {
10548             /* PMSAv8 */
10549             ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
10550                                        phys_ptr, attrs, prot, page_size, fi);
10551         } else if (arm_feature(env, ARM_FEATURE_V7)) {
10552             /* PMSAv7 */
10553             ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
10554                                        phys_ptr, prot, page_size, fi);
10555         } else {
10556             /* Pre-v7 MPU */
10557             ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
10558                                        phys_ptr, prot, fi);
10559         }
10560         qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
10561                       " mmu_idx %u -> %s (prot %c%c%c)\n",
10562                       access_type == MMU_DATA_LOAD ? "reading" :
10563                       (access_type == MMU_DATA_STORE ? "writing" : "execute"),
10564                       (uint32_t)address, mmu_idx,
10565                       ret ? "Miss" : "Hit",
10566                       *prot & PAGE_READ ? 'r' : '-',
10567                       *prot & PAGE_WRITE ? 'w' : '-',
10568                       *prot & PAGE_EXEC ? 'x' : '-');
10569 
10570         return ret;
10571     }
10572 
10573     /* Definitely a real MMU, not an MPU */
10574 
10575     if (regime_translation_disabled(env, mmu_idx)) {
10576         /* MMU disabled. */
10577         *phys_ptr = address;
10578         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
10579         *page_size = TARGET_PAGE_SIZE;
10580         return 0;
10581     }
10582 
10583     if (regime_using_lpae_format(env, mmu_idx)) {
10584         return get_phys_addr_lpae(env, address, access_type, mmu_idx,
10585                                   phys_ptr, attrs, prot, page_size,
10586                                   fi, cacheattrs);
10587     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
10588         return get_phys_addr_v6(env, address, access_type, mmu_idx,
10589                                 phys_ptr, attrs, prot, page_size, fi);
10590     } else {
10591         return get_phys_addr_v5(env, address, access_type, mmu_idx,
10592                                     phys_ptr, prot, page_size, fi);
10593     }
10594 }
10595 
10596 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
10597                                          MemTxAttrs *attrs)
10598 {
10599     ARMCPU *cpu = ARM_CPU(cs);
10600     CPUARMState *env = &cpu->env;
10601     hwaddr phys_addr;
10602     target_ulong page_size;
10603     int prot;
10604     bool ret;
10605     ARMMMUFaultInfo fi = {};
10606     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
10607 
10608     *attrs = (MemTxAttrs) {};
10609 
10610     ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
10611                         attrs, &prot, &page_size, &fi, NULL);
10612 
10613     if (ret) {
10614         return -1;
10615     }
10616     return phys_addr;
10617 }
10618 
10619 #endif
10620 
10621 /* Note that signed overflow is undefined in C.  The following routines are
10622    careful to use unsigned types where modulo arithmetic is required.
10623    Failure to do so _will_ break on newer gcc.  */
10624 
10625 /* Signed saturating arithmetic.  */
10626 
10627 /* Perform 16-bit signed saturating addition.  */
10628 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
10629 {
10630     uint16_t res;
10631 
10632     res = a + b;
10633     if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
10634         if (a & 0x8000)
10635             res = 0x8000;
10636         else
10637             res = 0x7fff;
10638     }
10639     return res;
10640 }
10641 
10642 /* Perform 8-bit signed saturating addition.  */
10643 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
10644 {
10645     uint8_t res;
10646 
10647     res = a + b;
10648     if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
10649         if (a & 0x80)
10650             res = 0x80;
10651         else
10652             res = 0x7f;
10653     }
10654     return res;
10655 }
10656 
10657 /* Perform 16-bit signed saturating subtraction.  */
10658 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
10659 {
10660     uint16_t res;
10661 
10662     res = a - b;
10663     if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
10664         if (a & 0x8000)
10665             res = 0x8000;
10666         else
10667             res = 0x7fff;
10668     }
10669     return res;
10670 }
10671 
10672 /* Perform 8-bit signed saturating subtraction.  */
10673 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
10674 {
10675     uint8_t res;
10676 
10677     res = a - b;
10678     if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
10679         if (a & 0x80)
10680             res = 0x80;
10681         else
10682             res = 0x7f;
10683     }
10684     return res;
10685 }
10686 
10687 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
10688 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
10689 #define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
10690 #define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
10691 #define PFX q
10692 
10693 #include "op_addsub.h"
10694 
10695 /* Unsigned saturating arithmetic.  */
10696 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
10697 {
10698     uint16_t res;
10699     res = a + b;
10700     if (res < a)
10701         res = 0xffff;
10702     return res;
10703 }
10704 
10705 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
10706 {
10707     if (a > b)
10708         return a - b;
10709     else
10710         return 0;
10711 }
10712 
10713 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
10714 {
10715     uint8_t res;
10716     res = a + b;
10717     if (res < a)
10718         res = 0xff;
10719     return res;
10720 }
10721 
10722 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
10723 {
10724     if (a > b)
10725         return a - b;
10726     else
10727         return 0;
10728 }
10729 
10730 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
10731 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
10732 #define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
10733 #define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
10734 #define PFX uq
10735 
10736 #include "op_addsub.h"
10737 
10738 /* Signed modulo arithmetic.  */
10739 #define SARITH16(a, b, n, op) do { \
10740     int32_t sum; \
10741     sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
10742     RESULT(sum, n, 16); \
10743     if (sum >= 0) \
10744         ge |= 3 << (n * 2); \
10745     } while(0)
10746 
10747 #define SARITH8(a, b, n, op) do { \
10748     int32_t sum; \
10749     sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
10750     RESULT(sum, n, 8); \
10751     if (sum >= 0) \
10752         ge |= 1 << n; \
10753     } while(0)
10754 
10755 
10756 #define ADD16(a, b, n) SARITH16(a, b, n, +)
10757 #define SUB16(a, b, n) SARITH16(a, b, n, -)
10758 #define ADD8(a, b, n)  SARITH8(a, b, n, +)
10759 #define SUB8(a, b, n)  SARITH8(a, b, n, -)
10760 #define PFX s
10761 #define ARITH_GE
10762 
10763 #include "op_addsub.h"
10764 
10765 /* Unsigned modulo arithmetic.  */
10766 #define ADD16(a, b, n) do { \
10767     uint32_t sum; \
10768     sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
10769     RESULT(sum, n, 16); \
10770     if ((sum >> 16) == 1) \
10771         ge |= 3 << (n * 2); \
10772     } while(0)
10773 
10774 #define ADD8(a, b, n) do { \
10775     uint32_t sum; \
10776     sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
10777     RESULT(sum, n, 8); \
10778     if ((sum >> 8) == 1) \
10779         ge |= 1 << n; \
10780     } while(0)
10781 
10782 #define SUB16(a, b, n) do { \
10783     uint32_t sum; \
10784     sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
10785     RESULT(sum, n, 16); \
10786     if ((sum >> 16) == 0) \
10787         ge |= 3 << (n * 2); \
10788     } while(0)
10789 
10790 #define SUB8(a, b, n) do { \
10791     uint32_t sum; \
10792     sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
10793     RESULT(sum, n, 8); \
10794     if ((sum >> 8) == 0) \
10795         ge |= 1 << n; \
10796     } while(0)
10797 
10798 #define PFX u
10799 #define ARITH_GE
10800 
10801 #include "op_addsub.h"
10802 
10803 /* Halved signed arithmetic.  */
10804 #define ADD16(a, b, n) \
10805   RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
10806 #define SUB16(a, b, n) \
10807   RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
10808 #define ADD8(a, b, n) \
10809   RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
10810 #define SUB8(a, b, n) \
10811   RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
10812 #define PFX sh
10813 
10814 #include "op_addsub.h"
10815 
10816 /* Halved unsigned arithmetic.  */
10817 #define ADD16(a, b, n) \
10818   RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
10819 #define SUB16(a, b, n) \
10820   RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
10821 #define ADD8(a, b, n) \
10822   RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
10823 #define SUB8(a, b, n) \
10824   RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
10825 #define PFX uh
10826 
10827 #include "op_addsub.h"
10828 
10829 static inline uint8_t do_usad(uint8_t a, uint8_t b)
10830 {
10831     if (a > b)
10832         return a - b;
10833     else
10834         return b - a;
10835 }
10836 
10837 /* Unsigned sum of absolute byte differences.  */
10838 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
10839 {
10840     uint32_t sum;
10841     sum = do_usad(a, b);
10842     sum += do_usad(a >> 8, b >> 8);
10843     sum += do_usad(a >> 16, b >>16);
10844     sum += do_usad(a >> 24, b >> 24);
10845     return sum;
10846 }
10847 
10848 /* For ARMv6 SEL instruction.  */
10849 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
10850 {
10851     uint32_t mask;
10852 
10853     mask = 0;
10854     if (flags & 1)
10855         mask |= 0xff;
10856     if (flags & 2)
10857         mask |= 0xff00;
10858     if (flags & 4)
10859         mask |= 0xff0000;
10860     if (flags & 8)
10861         mask |= 0xff000000;
10862     return (a & mask) | (b & ~mask);
10863 }
10864 
10865 /* CRC helpers.
10866  * The upper bytes of val (above the number specified by 'bytes') must have
10867  * been zeroed out by the caller.
10868  */
10869 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
10870 {
10871     uint8_t buf[4];
10872 
10873     stl_le_p(buf, val);
10874 
10875     /* zlib crc32 converts the accumulator and output to one's complement.  */
10876     return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
10877 }
10878 
10879 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
10880 {
10881     uint8_t buf[4];
10882 
10883     stl_le_p(buf, val);
10884 
10885     /* Linux crc32c converts the output to one's complement.  */
10886     return crc32c(acc, buf, bytes) ^ 0xffffffff;
10887 }
10888 
10889 /* Return the exception level to which FP-disabled exceptions should
10890  * be taken, or 0 if FP is enabled.
10891  */
10892 int fp_exception_el(CPUARMState *env, int cur_el)
10893 {
10894 #ifndef CONFIG_USER_ONLY
10895     int fpen;
10896 
10897     /* CPACR and the CPTR registers don't exist before v6, so FP is
10898      * always accessible
10899      */
10900     if (!arm_feature(env, ARM_FEATURE_V6)) {
10901         return 0;
10902     }
10903 
10904     if (arm_feature(env, ARM_FEATURE_M)) {
10905         /* CPACR can cause a NOCP UsageFault taken to current security state */
10906         if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) {
10907             return 1;
10908         }
10909 
10910         if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) {
10911             if (!extract32(env->v7m.nsacr, 10, 1)) {
10912                 /* FP insns cause a NOCP UsageFault taken to Secure */
10913                 return 3;
10914             }
10915         }
10916 
10917         return 0;
10918     }
10919 
10920     /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
10921      * 0, 2 : trap EL0 and EL1/PL1 accesses
10922      * 1    : trap only EL0 accesses
10923      * 3    : trap no accesses
10924      */
10925     fpen = extract32(env->cp15.cpacr_el1, 20, 2);
10926     switch (fpen) {
10927     case 0:
10928     case 2:
10929         if (cur_el == 0 || cur_el == 1) {
10930             /* Trap to PL1, which might be EL1 or EL3 */
10931             if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
10932                 return 3;
10933             }
10934             return 1;
10935         }
10936         if (cur_el == 3 && !is_a64(env)) {
10937             /* Secure PL1 running at EL3 */
10938             return 3;
10939         }
10940         break;
10941     case 1:
10942         if (cur_el == 0) {
10943             return 1;
10944         }
10945         break;
10946     case 3:
10947         break;
10948     }
10949 
10950     /*
10951      * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode
10952      * to control non-secure access to the FPU. It doesn't have any
10953      * effect if EL3 is AArch64 or if EL3 doesn't exist at all.
10954      */
10955     if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
10956          cur_el <= 2 && !arm_is_secure_below_el3(env))) {
10957         if (!extract32(env->cp15.nsacr, 10, 1)) {
10958             /* FP insns act as UNDEF */
10959             return cur_el == 2 ? 2 : 1;
10960         }
10961     }
10962 
10963     /* For the CPTR registers we don't need to guard with an ARM_FEATURE
10964      * check because zero bits in the registers mean "don't trap".
10965      */
10966 
10967     /* CPTR_EL2 : present in v7VE or v8 */
10968     if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
10969         && !arm_is_secure_below_el3(env)) {
10970         /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
10971         return 2;
10972     }
10973 
10974     /* CPTR_EL3 : present in v8 */
10975     if (extract32(env->cp15.cptr_el[3], 10, 1)) {
10976         /* Trap all FP ops to EL3 */
10977         return 3;
10978     }
10979 #endif
10980     return 0;
10981 }
10982 
10983 #ifndef CONFIG_TCG
10984 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
10985 {
10986     g_assert_not_reached();
10987 }
10988 #endif
10989 
10990 ARMMMUIdx arm_mmu_idx(CPUARMState *env)
10991 {
10992     int el;
10993 
10994     if (arm_feature(env, ARM_FEATURE_M)) {
10995         return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
10996     }
10997 
10998     el = arm_current_el(env);
10999     if (el < 2 && arm_is_secure_below_el3(env)) {
11000         return ARMMMUIdx_S1SE0 + el;
11001     } else {
11002         return ARMMMUIdx_S12NSE0 + el;
11003     }
11004 }
11005 
11006 int cpu_mmu_index(CPUARMState *env, bool ifetch)
11007 {
11008     return arm_to_core_mmu_idx(arm_mmu_idx(env));
11009 }
11010 
11011 #ifndef CONFIG_USER_ONLY
11012 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
11013 {
11014     return stage_1_mmu_idx(arm_mmu_idx(env));
11015 }
11016 #endif
11017 
11018 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
11019                           target_ulong *cs_base, uint32_t *pflags)
11020 {
11021     ARMMMUIdx mmu_idx = arm_mmu_idx(env);
11022     int current_el = arm_current_el(env);
11023     int fp_el = fp_exception_el(env, current_el);
11024     uint32_t flags = 0;
11025 
11026     if (is_a64(env)) {
11027         ARMCPU *cpu = env_archcpu(env);
11028         uint64_t sctlr;
11029 
11030         *pc = env->pc;
11031         flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1);
11032 
11033         /* Get control bits for tagged addresses.  */
11034         {
11035             ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
11036             ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1);
11037             int tbii, tbid;
11038 
11039             /* FIXME: ARMv8.1-VHE S2 translation regime.  */
11040             if (regime_el(env, stage1) < 2) {
11041                 ARMVAParameters p1 = aa64_va_parameters_both(env, -1, stage1);
11042                 tbid = (p1.tbi << 1) | p0.tbi;
11043                 tbii = tbid & ~((p1.tbid << 1) | p0.tbid);
11044             } else {
11045                 tbid = p0.tbi;
11046                 tbii = tbid & !p0.tbid;
11047             }
11048 
11049             flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
11050             flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
11051         }
11052 
11053         if (cpu_isar_feature(aa64_sve, cpu)) {
11054             int sve_el = sve_exception_el(env, current_el);
11055             uint32_t zcr_len;
11056 
11057             /* If SVE is disabled, but FP is enabled,
11058              * then the effective len is 0.
11059              */
11060             if (sve_el != 0 && fp_el == 0) {
11061                 zcr_len = 0;
11062             } else {
11063                 zcr_len = sve_zcr_len_for_el(env, current_el);
11064             }
11065             flags = FIELD_DP32(flags, TBFLAG_A64, SVEEXC_EL, sve_el);
11066             flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len);
11067         }
11068 
11069         sctlr = arm_sctlr(env, current_el);
11070 
11071         if (cpu_isar_feature(aa64_pauth, cpu)) {
11072             /*
11073              * In order to save space in flags, we record only whether
11074              * pauth is "inactive", meaning all insns are implemented as
11075              * a nop, or "active" when some action must be performed.
11076              * The decision of which action to take is left to a helper.
11077              */
11078             if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
11079                 flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1);
11080             }
11081         }
11082 
11083         if (cpu_isar_feature(aa64_bti, cpu)) {
11084             /* Note that SCTLR_EL[23].BT == SCTLR_BT1.  */
11085             if (sctlr & (current_el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
11086                 flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1);
11087             }
11088             flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype);
11089         }
11090     } else {
11091         *pc = env->regs[15];
11092         flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb);
11093         flags = FIELD_DP32(flags, TBFLAG_A32, VECLEN, env->vfp.vec_len);
11094         flags = FIELD_DP32(flags, TBFLAG_A32, VECSTRIDE, env->vfp.vec_stride);
11095         flags = FIELD_DP32(flags, TBFLAG_A32, CONDEXEC, env->condexec_bits);
11096         flags = FIELD_DP32(flags, TBFLAG_A32, SCTLR_B, arm_sctlr_b(env));
11097         flags = FIELD_DP32(flags, TBFLAG_A32, NS, !access_secure_reg(env));
11098         if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
11099             || arm_el_is_aa64(env, 1) || arm_feature(env, ARM_FEATURE_M)) {
11100             flags = FIELD_DP32(flags, TBFLAG_A32, VFPEN, 1);
11101         }
11102         /* Note that XSCALE_CPAR shares bits with VECSTRIDE */
11103         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
11104             flags = FIELD_DP32(flags, TBFLAG_A32,
11105                                XSCALE_CPAR, env->cp15.c15_cpar);
11106         }
11107     }
11108 
11109     flags = FIELD_DP32(flags, TBFLAG_ANY, MMUIDX, arm_to_core_mmu_idx(mmu_idx));
11110 
11111     /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
11112      * states defined in the ARM ARM for software singlestep:
11113      *  SS_ACTIVE   PSTATE.SS   State
11114      *     0            x       Inactive (the TB flag for SS is always 0)
11115      *     1            0       Active-pending
11116      *     1            1       Active-not-pending
11117      */
11118     if (arm_singlestep_active(env)) {
11119         flags = FIELD_DP32(flags, TBFLAG_ANY, SS_ACTIVE, 1);
11120         if (is_a64(env)) {
11121             if (env->pstate & PSTATE_SS) {
11122                 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
11123             }
11124         } else {
11125             if (env->uncached_cpsr & PSTATE_SS) {
11126                 flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);
11127             }
11128         }
11129     }
11130     if (arm_cpu_data_is_big_endian(env)) {
11131         flags = FIELD_DP32(flags, TBFLAG_ANY, BE_DATA, 1);
11132     }
11133     flags = FIELD_DP32(flags, TBFLAG_ANY, FPEXC_EL, fp_el);
11134 
11135     if (arm_v7m_is_handler_mode(env)) {
11136         flags = FIELD_DP32(flags, TBFLAG_A32, HANDLER, 1);
11137     }
11138 
11139     /* v8M always applies stack limit checks unless CCR.STKOFHFNMIGN is
11140      * suppressing them because the requested execution priority is less than 0.
11141      */
11142     if (arm_feature(env, ARM_FEATURE_V8) &&
11143         arm_feature(env, ARM_FEATURE_M) &&
11144         !((mmu_idx  & ARM_MMU_IDX_M_NEGPRI) &&
11145           (env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_STKOFHFNMIGN_MASK))) {
11146         flags = FIELD_DP32(flags, TBFLAG_A32, STACKCHECK, 1);
11147     }
11148 
11149     if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
11150         FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S) != env->v7m.secure) {
11151         flags = FIELD_DP32(flags, TBFLAG_A32, FPCCR_S_WRONG, 1);
11152     }
11153 
11154     if (arm_feature(env, ARM_FEATURE_M) &&
11155         (env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) &&
11156         (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) ||
11157          (env->v7m.secure &&
11158           !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) {
11159         /*
11160          * ASPEN is set, but FPCA/SFPA indicate that there is no active
11161          * FP context; we must create a new FP context before executing
11162          * any FP insn.
11163          */
11164         flags = FIELD_DP32(flags, TBFLAG_A32, NEW_FP_CTXT_NEEDED, 1);
11165     }
11166 
11167     if (arm_feature(env, ARM_FEATURE_M)) {
11168         bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
11169 
11170         if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
11171             flags = FIELD_DP32(flags, TBFLAG_A32, LSPACT, 1);
11172         }
11173     }
11174 
11175     *pflags = flags;
11176     *cs_base = 0;
11177 }
11178 
11179 #ifdef TARGET_AARCH64
11180 /*
11181  * The manual says that when SVE is enabled and VQ is widened the
11182  * implementation is allowed to zero the previously inaccessible
11183  * portion of the registers.  The corollary to that is that when
11184  * SVE is enabled and VQ is narrowed we are also allowed to zero
11185  * the now inaccessible portion of the registers.
11186  *
11187  * The intent of this is that no predicate bit beyond VQ is ever set.
11188  * Which means that some operations on predicate registers themselves
11189  * may operate on full uint64_t or even unrolled across the maximum
11190  * uint64_t[4].  Performing 4 bits of host arithmetic unconditionally
11191  * may well be cheaper than conditionals to restrict the operation
11192  * to the relevant portion of a uint16_t[16].
11193  */
11194 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
11195 {
11196     int i, j;
11197     uint64_t pmask;
11198 
11199     assert(vq >= 1 && vq <= ARM_MAX_VQ);
11200     assert(vq <= env_archcpu(env)->sve_max_vq);
11201 
11202     /* Zap the high bits of the zregs.  */
11203     for (i = 0; i < 32; i++) {
11204         memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq));
11205     }
11206 
11207     /* Zap the high bits of the pregs and ffr.  */
11208     pmask = 0;
11209     if (vq & 3) {
11210         pmask = ~(-1ULL << (16 * (vq & 3)));
11211     }
11212     for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) {
11213         for (i = 0; i < 17; ++i) {
11214             env->vfp.pregs[i].p[j] &= pmask;
11215         }
11216         pmask = 0;
11217     }
11218 }
11219 
11220 /*
11221  * Notice a change in SVE vector size when changing EL.
11222  */
11223 void aarch64_sve_change_el(CPUARMState *env, int old_el,
11224                            int new_el, bool el0_a64)
11225 {
11226     ARMCPU *cpu = env_archcpu(env);
11227     int old_len, new_len;
11228     bool old_a64, new_a64;
11229 
11230     /* Nothing to do if no SVE.  */
11231     if (!cpu_isar_feature(aa64_sve, cpu)) {
11232         return;
11233     }
11234 
11235     /* Nothing to do if FP is disabled in either EL.  */
11236     if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) {
11237         return;
11238     }
11239 
11240     /*
11241      * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped
11242      * at ELx, or not available because the EL is in AArch32 state, then
11243      * for all purposes other than a direct read, the ZCR_ELx.LEN field
11244      * has an effective value of 0".
11245      *
11246      * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0).
11247      * If we ignore aa32 state, we would fail to see the vq4->vq0 transition
11248      * from EL2->EL1.  Thus we go ahead and narrow when entering aa32 so that
11249      * we already have the correct register contents when encountering the
11250      * vq0->vq0 transition between EL0->EL1.
11251      */
11252     old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64;
11253     old_len = (old_a64 && !sve_exception_el(env, old_el)
11254                ? sve_zcr_len_for_el(env, old_el) : 0);
11255     new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64;
11256     new_len = (new_a64 && !sve_exception_el(env, new_el)
11257                ? sve_zcr_len_for_el(env, new_el) : 0);
11258 
11259     /* When changing vector length, clear inaccessible state.  */
11260     if (new_len < old_len) {
11261         aarch64_sve_narrow_vq(env, new_len + 1);
11262     }
11263 }
11264 #endif
11265