1 /* 2 * ARM generic helpers. 3 * 4 * This code is licensed under the GNU GPL v2 or later. 5 * 6 * SPDX-License-Identifier: GPL-2.0-or-later 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "trace.h" 12 #include "cpu.h" 13 #include "internals.h" 14 #include "cpu-features.h" 15 #include "exec/page-protection.h" 16 #include "exec/mmap-lock.h" 17 #include "qemu/main-loop.h" 18 #include "qemu/timer.h" 19 #include "qemu/bitops.h" 20 #include "qemu/qemu-print.h" 21 #include "exec/cputlb.h" 22 #include "exec/translation-block.h" 23 #include "hw/irq.h" 24 #include "system/cpu-timers.h" 25 #include "exec/icount.h" 26 #include "system/kvm.h" 27 #include "system/tcg.h" 28 #include "qapi/error.h" 29 #include "qemu/guest-random.h" 30 #ifdef CONFIG_TCG 31 #include "accel/tcg/probe.h" 32 #include "accel/tcg/getpc.h" 33 #include "semihosting/common-semi.h" 34 #endif 35 #include "cpregs.h" 36 #include "target/arm/gtimer.h" 37 38 #define HELPER_H "tcg/helper.h" 39 #include "exec/helper-proto.h.inc" 40 41 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */ 42 43 static void switch_mode(CPUARMState *env, int mode); 44 45 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri) 46 { 47 assert(ri->fieldoffset); 48 if (cpreg_field_is_64bit(ri)) { 49 return CPREG_FIELD64(env, ri); 50 } else { 51 return CPREG_FIELD32(env, ri); 52 } 53 } 54 55 void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 56 { 57 assert(ri->fieldoffset); 58 if (cpreg_field_is_64bit(ri)) { 59 CPREG_FIELD64(env, ri) = value; 60 } else { 61 CPREG_FIELD32(env, ri) = value; 62 } 63 } 64 65 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri) 66 { 67 return (char *)env + ri->fieldoffset; 68 } 69 70 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri) 71 { 72 /* Raw read of a coprocessor register (as needed for migration, etc). */ 73 if (ri->type & ARM_CP_CONST) { 74 return ri->resetvalue; 75 } else if (ri->raw_readfn) { 76 return ri->raw_readfn(env, ri); 77 } else if (ri->readfn) { 78 return ri->readfn(env, ri); 79 } else { 80 return raw_read(env, ri); 81 } 82 } 83 84 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri, 85 uint64_t v) 86 { 87 /* 88 * Raw write of a coprocessor register (as needed for migration, etc). 89 * Note that constant registers are treated as write-ignored; the 90 * caller should check for success by whether a readback gives the 91 * value written. 92 */ 93 if (ri->type & ARM_CP_CONST) { 94 return; 95 } else if (ri->raw_writefn) { 96 ri->raw_writefn(env, ri, v); 97 } else if (ri->writefn) { 98 ri->writefn(env, ri, v); 99 } else { 100 raw_write(env, ri, v); 101 } 102 } 103 104 static bool raw_accessors_invalid(const ARMCPRegInfo *ri) 105 { 106 /* 107 * Return true if the regdef would cause an assertion if you called 108 * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a 109 * program bug for it not to have the NO_RAW flag). 110 * NB that returning false here doesn't necessarily mean that calling 111 * read/write_raw_cp_reg() is safe, because we can't distinguish "has 112 * read/write access functions which are safe for raw use" from "has 113 * read/write access functions which have side effects but has forgotten 114 * to provide raw access functions". 115 * The tests here line up with the conditions in read/write_raw_cp_reg() 116 * and assertions in raw_read()/raw_write(). 117 */ 118 if ((ri->type & ARM_CP_CONST) || 119 ri->fieldoffset || 120 ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) { 121 return false; 122 } 123 return true; 124 } 125 126 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync) 127 { 128 /* Write the coprocessor state from cpu->env to the (index,value) list. */ 129 int i; 130 bool ok = true; 131 132 for (i = 0; i < cpu->cpreg_array_len; i++) { 133 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 134 const ARMCPRegInfo *ri; 135 uint64_t newval; 136 137 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 138 if (!ri) { 139 ok = false; 140 continue; 141 } 142 if (ri->type & ARM_CP_NO_RAW) { 143 continue; 144 } 145 146 newval = read_raw_cp_reg(&cpu->env, ri); 147 if (kvm_sync) { 148 /* 149 * Only sync if the previous list->cpustate sync succeeded. 150 * Rather than tracking the success/failure state for every 151 * item in the list, we just recheck "does the raw write we must 152 * have made in write_list_to_cpustate() read back OK" here. 153 */ 154 uint64_t oldval = cpu->cpreg_values[i]; 155 156 if (oldval == newval) { 157 continue; 158 } 159 160 write_raw_cp_reg(&cpu->env, ri, oldval); 161 if (read_raw_cp_reg(&cpu->env, ri) != oldval) { 162 continue; 163 } 164 165 write_raw_cp_reg(&cpu->env, ri, newval); 166 } 167 cpu->cpreg_values[i] = newval; 168 } 169 return ok; 170 } 171 172 bool write_list_to_cpustate(ARMCPU *cpu) 173 { 174 int i; 175 bool ok = true; 176 177 for (i = 0; i < cpu->cpreg_array_len; i++) { 178 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]); 179 uint64_t v = cpu->cpreg_values[i]; 180 const ARMCPRegInfo *ri; 181 182 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 183 if (!ri) { 184 ok = false; 185 continue; 186 } 187 if (ri->type & ARM_CP_NO_RAW) { 188 continue; 189 } 190 /* 191 * Write value and confirm it reads back as written 192 * (to catch read-only registers and partially read-only 193 * registers where the incoming migration value doesn't match) 194 */ 195 write_raw_cp_reg(&cpu->env, ri, v); 196 if (read_raw_cp_reg(&cpu->env, ri) != v) { 197 ok = false; 198 } 199 } 200 return ok; 201 } 202 203 static void add_cpreg_to_list(gpointer key, gpointer opaque) 204 { 205 ARMCPU *cpu = opaque; 206 uint32_t regidx = (uintptr_t)key; 207 const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, regidx); 208 209 if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) { 210 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx); 211 /* The value array need not be initialized at this point */ 212 cpu->cpreg_array_len++; 213 } 214 } 215 216 static void count_cpreg(gpointer key, gpointer opaque) 217 { 218 ARMCPU *cpu = opaque; 219 const ARMCPRegInfo *ri; 220 221 ri = g_hash_table_lookup(cpu->cp_regs, key); 222 223 if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) { 224 cpu->cpreg_array_len++; 225 } 226 } 227 228 static gint cpreg_key_compare(gconstpointer a, gconstpointer b, gpointer d) 229 { 230 uint64_t aidx = cpreg_to_kvm_id((uintptr_t)a); 231 uint64_t bidx = cpreg_to_kvm_id((uintptr_t)b); 232 233 if (aidx > bidx) { 234 return 1; 235 } 236 if (aidx < bidx) { 237 return -1; 238 } 239 return 0; 240 } 241 242 void init_cpreg_list(ARMCPU *cpu) 243 { 244 /* 245 * Initialise the cpreg_tuples[] array based on the cp_regs hash. 246 * Note that we require cpreg_tuples[] to be sorted by key ID. 247 */ 248 GList *keys; 249 int arraylen; 250 251 keys = g_hash_table_get_keys(cpu->cp_regs); 252 keys = g_list_sort_with_data(keys, cpreg_key_compare, NULL); 253 254 cpu->cpreg_array_len = 0; 255 256 g_list_foreach(keys, count_cpreg, cpu); 257 258 arraylen = cpu->cpreg_array_len; 259 cpu->cpreg_indexes = g_new(uint64_t, arraylen); 260 cpu->cpreg_values = g_new(uint64_t, arraylen); 261 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen); 262 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen); 263 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len; 264 cpu->cpreg_array_len = 0; 265 266 g_list_foreach(keys, add_cpreg_to_list, cpu); 267 268 assert(cpu->cpreg_array_len == arraylen); 269 270 g_list_free(keys); 271 } 272 273 static bool arm_pan_enabled(CPUARMState *env) 274 { 275 if (is_a64(env)) { 276 if ((arm_hcr_el2_eff(env) & (HCR_NV | HCR_NV1)) == (HCR_NV | HCR_NV1)) { 277 return false; 278 } 279 return env->pstate & PSTATE_PAN; 280 } else { 281 return env->uncached_cpsr & CPSR_PAN; 282 } 283 } 284 285 /* 286 * Some registers are not accessible from AArch32 EL3 if SCR.NS == 0. 287 */ 288 static CPAccessResult access_el3_aa32ns(CPUARMState *env, 289 const ARMCPRegInfo *ri, 290 bool isread) 291 { 292 if (!is_a64(env) && arm_current_el(env) == 3 && 293 arm_is_secure_below_el3(env)) { 294 return CP_ACCESS_UNDEFINED; 295 } 296 return CP_ACCESS_OK; 297 } 298 299 /* 300 * Some secure-only AArch32 registers trap to EL3 if used from 301 * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts). 302 * Note that an access from Secure EL1 can only happen if EL3 is AArch64. 303 * We assume that the .access field is set to PL1_RW. 304 */ 305 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, 306 const ARMCPRegInfo *ri, 307 bool isread) 308 { 309 if (arm_current_el(env) == 3) { 310 return CP_ACCESS_OK; 311 } 312 if (arm_is_secure_below_el3(env)) { 313 if (env->cp15.scr_el3 & SCR_EEL2) { 314 return CP_ACCESS_TRAP_EL2; 315 } 316 return CP_ACCESS_TRAP_EL3; 317 } 318 /* This will be EL1 NS and EL2 NS, which just UNDEF */ 319 return CP_ACCESS_UNDEFINED; 320 } 321 322 /* 323 * Check for traps to performance monitor registers, which are controlled 324 * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3. 325 */ 326 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri, 327 bool isread) 328 { 329 int el = arm_current_el(env); 330 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 331 332 if (el < 2 && (mdcr_el2 & MDCR_TPM)) { 333 return CP_ACCESS_TRAP_EL2; 334 } 335 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 336 return CP_ACCESS_TRAP_EL3; 337 } 338 return CP_ACCESS_OK; 339 } 340 341 /* Check for traps from EL1 due to HCR_EL2.TVM and HCR_EL2.TRVM. */ 342 CPAccessResult access_tvm_trvm(CPUARMState *env, const ARMCPRegInfo *ri, 343 bool isread) 344 { 345 if (arm_current_el(env) == 1) { 346 uint64_t trap = isread ? HCR_TRVM : HCR_TVM; 347 if (arm_hcr_el2_eff(env) & trap) { 348 return CP_ACCESS_TRAP_EL2; 349 } 350 } 351 return CP_ACCESS_OK; 352 } 353 354 /* Check for traps from EL1 due to HCR_EL2.TSW. */ 355 static CPAccessResult access_tsw(CPUARMState *env, const ARMCPRegInfo *ri, 356 bool isread) 357 { 358 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TSW)) { 359 return CP_ACCESS_TRAP_EL2; 360 } 361 return CP_ACCESS_OK; 362 } 363 364 /* Check for traps from EL1 due to HCR_EL2.TACR. */ 365 static CPAccessResult access_tacr(CPUARMState *env, const ARMCPRegInfo *ri, 366 bool isread) 367 { 368 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TACR)) { 369 return CP_ACCESS_TRAP_EL2; 370 } 371 return CP_ACCESS_OK; 372 } 373 374 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 375 { 376 ARMCPU *cpu = env_archcpu(env); 377 378 raw_write(env, ri, value); 379 tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */ 380 } 381 382 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 383 { 384 ARMCPU *cpu = env_archcpu(env); 385 386 if (raw_read(env, ri) != value) { 387 /* 388 * Unlike real hardware the qemu TLB uses virtual addresses, 389 * not modified virtual addresses, so this causes a TLB flush. 390 */ 391 tlb_flush(CPU(cpu)); 392 raw_write(env, ri, value); 393 } 394 } 395 396 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri, 397 uint64_t value) 398 { 399 ARMCPU *cpu = env_archcpu(env); 400 401 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA) 402 && !extended_addresses_enabled(env)) { 403 /* 404 * For VMSA (when not using the LPAE long descriptor page table 405 * format) this register includes the ASID, so do a TLB flush. 406 * For PMSA it is purely a process ID and no action is needed. 407 */ 408 tlb_flush(CPU(cpu)); 409 } 410 raw_write(env, ri, value); 411 } 412 413 int alle1_tlbmask(CPUARMState *env) 414 { 415 /* 416 * Note that the 'ALL' scope must invalidate both stage 1 and 417 * stage 2 translations, whereas most other scopes only invalidate 418 * stage 1 translations. 419 * 420 * For AArch32 this is only used for TLBIALLNSNH and VTTBR 421 * writes, so only needs to apply to NS PL1&0, not S PL1&0. 422 */ 423 return (ARMMMUIdxBit_E10_1 | 424 ARMMMUIdxBit_E10_1_PAN | 425 ARMMMUIdxBit_E10_0 | 426 ARMMMUIdxBit_Stage2 | 427 ARMMMUIdxBit_Stage2_S); 428 } 429 430 static const ARMCPRegInfo cp_reginfo[] = { 431 /* 432 * Define the secure and non-secure FCSE identifier CP registers 433 * separately because there is no secure bank in V8 (no _EL3). This allows 434 * the secure register to be properly reset and migrated. There is also no 435 * v8 EL1 version of the register so the non-secure instance stands alone. 436 */ 437 { .name = "FCSEIDR", 438 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 439 .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS, 440 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns), 441 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 442 { .name = "FCSEIDR_S", 443 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0, 444 .access = PL1_RW, .secure = ARM_CP_SECSTATE_S, 445 .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s), 446 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, }, 447 /* 448 * Define the secure and non-secure context identifier CP registers 449 * separately because there is no secure bank in V8 (no _EL3). This allows 450 * the secure register to be properly reset and migrated. In the 451 * non-secure case, the 32-bit register will have reset and migration 452 * disabled during registration as it is handled by the 64-bit instance. 453 */ 454 { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH, 455 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 456 .access = PL1_RW, .accessfn = access_tvm_trvm, 457 .fgt = FGT_CONTEXTIDR_EL1, 458 .nv2_redirect_offset = 0x108 | NV2_REDIR_NV1, 459 .secure = ARM_CP_SECSTATE_NS, 460 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]), 461 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 462 { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32, 463 .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1, 464 .access = PL1_RW, .accessfn = access_tvm_trvm, 465 .secure = ARM_CP_SECSTATE_S, 466 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s), 467 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, }, 468 }; 469 470 static const ARMCPRegInfo not_v8_cp_reginfo[] = { 471 /* 472 * NB: Some of these registers exist in v8 but with more precise 473 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]). 474 */ 475 /* MMU Domain access control / MPU write buffer control */ 476 { .name = "DACR", 477 .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY, 478 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 479 .writefn = dacr_write, .raw_writefn = raw_write, 480 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 481 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 482 /* 483 * ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs. 484 * For v6 and v5, these mappings are overly broad. 485 */ 486 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0, 487 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 488 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1, 489 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 490 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4, 491 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 492 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8, 493 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP }, 494 /* Cache maintenance ops; some of this space may be overridden later. */ 495 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 496 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 497 .type = ARM_CP_NOP | ARM_CP_OVERRIDE }, 498 }; 499 500 static const ARMCPRegInfo not_v6_cp_reginfo[] = { 501 /* 502 * Not all pre-v6 cores implemented this WFI, so this is slightly 503 * over-broad. 504 */ 505 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2, 506 .access = PL1_W, .type = ARM_CP_WFI }, 507 }; 508 509 static const ARMCPRegInfo not_v7_cp_reginfo[] = { 510 /* 511 * Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which 512 * is UNPREDICTABLE; we choose to NOP as most implementations do). 513 */ 514 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 515 .access = PL1_W, .type = ARM_CP_WFI }, 516 /* 517 * L1 cache lockdown. Not architectural in v6 and earlier but in practice 518 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and 519 * OMAPCP will override this space. 520 */ 521 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0, 522 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data), 523 .resetvalue = 0 }, 524 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1, 525 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn), 526 .resetvalue = 0 }, 527 /* v6 doesn't have the cache ID registers but Linux reads them anyway */ 528 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY, 529 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 530 .resetvalue = 0 }, 531 /* 532 * We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR; 533 * implementing it as RAZ means the "debug architecture version" bits 534 * will read as a reserved value, which should cause Linux to not try 535 * to use the debug hardware. 536 */ 537 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, 538 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 539 { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2, 540 .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP }, 541 { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2, 542 .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP }, 543 }; 544 545 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri, 546 uint64_t value) 547 { 548 uint32_t mask = 0; 549 550 /* In ARMv8 most bits of CPACR_EL1 are RES0. */ 551 if (!arm_feature(env, ARM_FEATURE_V8)) { 552 /* 553 * ARMv7 defines bits for unimplemented coprocessors as RAZ/WI. 554 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP. 555 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell. 556 */ 557 if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) { 558 /* VFP coprocessor: cp10 & cp11 [23:20] */ 559 mask |= R_CPACR_ASEDIS_MASK | 560 R_CPACR_D32DIS_MASK | 561 R_CPACR_CP11_MASK | 562 R_CPACR_CP10_MASK; 563 564 if (!arm_feature(env, ARM_FEATURE_NEON)) { 565 /* ASEDIS [31] bit is RAO/WI */ 566 value |= R_CPACR_ASEDIS_MASK; 567 } 568 569 /* 570 * VFPv3 and upwards with NEON implement 32 double precision 571 * registers (D0-D31). 572 */ 573 if (!cpu_isar_feature(aa32_simd_r32, env_archcpu(env))) { 574 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */ 575 value |= R_CPACR_D32DIS_MASK; 576 } 577 } 578 value &= mask; 579 } 580 581 /* 582 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 583 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 584 */ 585 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 586 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 587 mask = R_CPACR_CP11_MASK | R_CPACR_CP10_MASK; 588 value = (value & ~mask) | (env->cp15.cpacr_el1 & mask); 589 } 590 591 env->cp15.cpacr_el1 = value; 592 } 593 594 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri) 595 { 596 /* 597 * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10 598 * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00. 599 */ 600 uint64_t value = env->cp15.cpacr_el1; 601 602 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 603 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 604 value = ~(R_CPACR_CP11_MASK | R_CPACR_CP10_MASK); 605 } 606 return value; 607 } 608 609 610 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 611 { 612 /* 613 * Call cpacr_write() so that we reset with the correct RAO bits set 614 * for our CPU features. 615 */ 616 cpacr_write(env, ri, 0); 617 } 618 619 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 620 bool isread) 621 { 622 if (arm_feature(env, ARM_FEATURE_V8)) { 623 /* Check if CPACR accesses are to be trapped to EL2 */ 624 if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) && 625 FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TCPAC)) { 626 return CP_ACCESS_TRAP_EL2; 627 /* Check if CPACR accesses are to be trapped to EL3 */ 628 } else if (arm_current_el(env) < 3 && 629 FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) { 630 return CP_ACCESS_TRAP_EL3; 631 } 632 } 633 634 return CP_ACCESS_OK; 635 } 636 637 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri, 638 bool isread) 639 { 640 /* Check if CPTR accesses are set to trap to EL3 */ 641 if (arm_current_el(env) == 2 && 642 FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) { 643 return CP_ACCESS_TRAP_EL3; 644 } 645 646 return CP_ACCESS_OK; 647 } 648 649 static const ARMCPRegInfo v6_cp_reginfo[] = { 650 /* prefetch by MVA in v6, NOP in v7 */ 651 { .name = "MVA_prefetch", 652 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1, 653 .access = PL1_W, .type = ARM_CP_NOP }, 654 /* 655 * We need to break the TB after ISB to execute self-modifying code 656 * correctly and also to take any pending interrupts immediately. 657 * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag. 658 */ 659 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4, 660 .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore }, 661 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4, 662 .access = PL0_W, .type = ARM_CP_NOP }, 663 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5, 664 .access = PL0_W, .type = ARM_CP_NOP }, 665 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2, 666 .access = PL1_RW, .accessfn = access_tvm_trvm, 667 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s), 668 offsetof(CPUARMState, cp15.ifar_ns) }, 669 .resetvalue = 0, }, 670 /* 671 * Watchpoint Fault Address Register : should actually only be present 672 * for 1136, 1176, 11MPCore. 673 */ 674 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1, 675 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, }, 676 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, 677 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access, 678 .fgt = FGT_CPACR_EL1, 679 .nv2_redirect_offset = 0x100 | NV2_REDIR_NV1, 680 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1), 681 .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read }, 682 }; 683 684 typedef struct pm_event { 685 uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */ 686 /* If the event is supported on this CPU (used to generate PMCEID[01]) */ 687 bool (*supported)(CPUARMState *); 688 /* 689 * Retrieve the current count of the underlying event. The programmed 690 * counters hold a difference from the return value from this function 691 */ 692 uint64_t (*get_count)(CPUARMState *); 693 /* 694 * Return how many nanoseconds it will take (at a minimum) for count events 695 * to occur. A negative value indicates the counter will never overflow, or 696 * that the counter has otherwise arranged for the overflow bit to be set 697 * and the PMU interrupt to be raised on overflow. 698 */ 699 int64_t (*ns_per_count)(uint64_t); 700 } pm_event; 701 702 static bool event_always_supported(CPUARMState *env) 703 { 704 return true; 705 } 706 707 static uint64_t swinc_get_count(CPUARMState *env) 708 { 709 /* 710 * SW_INCR events are written directly to the pmevcntr's by writes to 711 * PMSWINC, so there is no underlying count maintained by the PMU itself 712 */ 713 return 0; 714 } 715 716 static int64_t swinc_ns_per(uint64_t ignored) 717 { 718 return -1; 719 } 720 721 /* 722 * Return the underlying cycle count for the PMU cycle counters. If we're in 723 * usermode, simply return 0. 724 */ 725 static uint64_t cycles_get_count(CPUARMState *env) 726 { 727 #ifndef CONFIG_USER_ONLY 728 return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 729 ARM_CPU_FREQ, NANOSECONDS_PER_SECOND); 730 #else 731 return cpu_get_host_ticks(); 732 #endif 733 } 734 735 #ifndef CONFIG_USER_ONLY 736 static int64_t cycles_ns_per(uint64_t cycles) 737 { 738 return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles; 739 } 740 741 static bool instructions_supported(CPUARMState *env) 742 { 743 /* Precise instruction counting */ 744 return icount_enabled() == ICOUNT_PRECISE; 745 } 746 747 static uint64_t instructions_get_count(CPUARMState *env) 748 { 749 assert(icount_enabled() == ICOUNT_PRECISE); 750 return (uint64_t)icount_get_raw(); 751 } 752 753 static int64_t instructions_ns_per(uint64_t icount) 754 { 755 assert(icount_enabled() == ICOUNT_PRECISE); 756 return icount_to_ns((int64_t)icount); 757 } 758 #endif 759 760 static bool pmuv3p1_events_supported(CPUARMState *env) 761 { 762 /* For events which are supported in any v8.1 PMU */ 763 return cpu_isar_feature(any_pmuv3p1, env_archcpu(env)); 764 } 765 766 static bool pmuv3p4_events_supported(CPUARMState *env) 767 { 768 /* For events which are supported in any v8.1 PMU */ 769 return cpu_isar_feature(any_pmuv3p4, env_archcpu(env)); 770 } 771 772 static uint64_t zero_event_get_count(CPUARMState *env) 773 { 774 /* For events which on QEMU never fire, so their count is always zero */ 775 return 0; 776 } 777 778 static int64_t zero_event_ns_per(uint64_t cycles) 779 { 780 /* An event which never fires can never overflow */ 781 return -1; 782 } 783 784 static const pm_event pm_events[] = { 785 { .number = 0x000, /* SW_INCR */ 786 .supported = event_always_supported, 787 .get_count = swinc_get_count, 788 .ns_per_count = swinc_ns_per, 789 }, 790 #ifndef CONFIG_USER_ONLY 791 { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */ 792 .supported = instructions_supported, 793 .get_count = instructions_get_count, 794 .ns_per_count = instructions_ns_per, 795 }, 796 { .number = 0x011, /* CPU_CYCLES, Cycle */ 797 .supported = event_always_supported, 798 .get_count = cycles_get_count, 799 .ns_per_count = cycles_ns_per, 800 }, 801 #endif 802 { .number = 0x023, /* STALL_FRONTEND */ 803 .supported = pmuv3p1_events_supported, 804 .get_count = zero_event_get_count, 805 .ns_per_count = zero_event_ns_per, 806 }, 807 { .number = 0x024, /* STALL_BACKEND */ 808 .supported = pmuv3p1_events_supported, 809 .get_count = zero_event_get_count, 810 .ns_per_count = zero_event_ns_per, 811 }, 812 { .number = 0x03c, /* STALL */ 813 .supported = pmuv3p4_events_supported, 814 .get_count = zero_event_get_count, 815 .ns_per_count = zero_event_ns_per, 816 }, 817 }; 818 819 /* 820 * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of 821 * events (i.e. the statistical profiling extension), this implementation 822 * should first be updated to something sparse instead of the current 823 * supported_event_map[] array. 824 */ 825 #define MAX_EVENT_ID 0x3c 826 #define UNSUPPORTED_EVENT UINT16_MAX 827 static uint16_t supported_event_map[MAX_EVENT_ID + 1]; 828 829 /* 830 * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map 831 * of ARM event numbers to indices in our pm_events array. 832 * 833 * Note: Events in the 0x40XX range are not currently supported. 834 */ 835 void pmu_init(ARMCPU *cpu) 836 { 837 unsigned int i; 838 839 /* 840 * Empty supported_event_map and cpu->pmceid[01] before adding supported 841 * events to them 842 */ 843 for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) { 844 supported_event_map[i] = UNSUPPORTED_EVENT; 845 } 846 cpu->pmceid0 = 0; 847 cpu->pmceid1 = 0; 848 849 for (i = 0; i < ARRAY_SIZE(pm_events); i++) { 850 const pm_event *cnt = &pm_events[i]; 851 assert(cnt->number <= MAX_EVENT_ID); 852 /* We do not currently support events in the 0x40xx range */ 853 assert(cnt->number <= 0x3f); 854 855 if (cnt->supported(&cpu->env)) { 856 supported_event_map[cnt->number] = i; 857 uint64_t event_mask = 1ULL << (cnt->number & 0x1f); 858 if (cnt->number & 0x20) { 859 cpu->pmceid1 |= event_mask; 860 } else { 861 cpu->pmceid0 |= event_mask; 862 } 863 } 864 } 865 } 866 867 /* 868 * Check at runtime whether a PMU event is supported for the current machine 869 */ 870 static bool event_supported(uint16_t number) 871 { 872 if (number > MAX_EVENT_ID) { 873 return false; 874 } 875 return supported_event_map[number] != UNSUPPORTED_EVENT; 876 } 877 878 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri, 879 bool isread) 880 { 881 /* 882 * Performance monitor registers user accessibility is controlled 883 * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable 884 * trapping to EL2 or EL3 for other accesses. 885 */ 886 int el = arm_current_el(env); 887 uint64_t mdcr_el2 = arm_mdcr_el2_eff(env); 888 889 if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) { 890 return CP_ACCESS_TRAP_EL1; 891 } 892 if (el < 2 && (mdcr_el2 & MDCR_TPM)) { 893 return CP_ACCESS_TRAP_EL2; 894 } 895 if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) { 896 return CP_ACCESS_TRAP_EL3; 897 } 898 899 return CP_ACCESS_OK; 900 } 901 902 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env, 903 const ARMCPRegInfo *ri, 904 bool isread) 905 { 906 /* ER: event counter read trap control */ 907 if (arm_feature(env, ARM_FEATURE_V8) 908 && arm_current_el(env) == 0 909 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0 910 && isread) { 911 return CP_ACCESS_OK; 912 } 913 914 return pmreg_access(env, ri, isread); 915 } 916 917 static CPAccessResult pmreg_access_swinc(CPUARMState *env, 918 const ARMCPRegInfo *ri, 919 bool isread) 920 { 921 /* SW: software increment write trap control */ 922 if (arm_feature(env, ARM_FEATURE_V8) 923 && arm_current_el(env) == 0 924 && (env->cp15.c9_pmuserenr & (1 << 1)) != 0 925 && !isread) { 926 return CP_ACCESS_OK; 927 } 928 929 return pmreg_access(env, ri, isread); 930 } 931 932 static CPAccessResult pmreg_access_selr(CPUARMState *env, 933 const ARMCPRegInfo *ri, 934 bool isread) 935 { 936 /* ER: event counter read trap control */ 937 if (arm_feature(env, ARM_FEATURE_V8) 938 && arm_current_el(env) == 0 939 && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) { 940 return CP_ACCESS_OK; 941 } 942 943 return pmreg_access(env, ri, isread); 944 } 945 946 static CPAccessResult pmreg_access_ccntr(CPUARMState *env, 947 const ARMCPRegInfo *ri, 948 bool isread) 949 { 950 /* CR: cycle counter read trap control */ 951 if (arm_feature(env, ARM_FEATURE_V8) 952 && arm_current_el(env) == 0 953 && (env->cp15.c9_pmuserenr & (1 << 2)) != 0 954 && isread) { 955 return CP_ACCESS_OK; 956 } 957 958 return pmreg_access(env, ri, isread); 959 } 960 961 /* 962 * Bits in MDCR_EL2 and MDCR_EL3 which pmu_counter_enabled() looks at. 963 * We use these to decide whether we need to wrap a write to MDCR_EL2 964 * or MDCR_EL3 in pmu_op_start()/pmu_op_finish() calls. 965 */ 966 #define MDCR_EL2_PMU_ENABLE_BITS \ 967 (MDCR_HPME | MDCR_HPMD | MDCR_HPMN | MDCR_HCCD | MDCR_HLP) 968 #define MDCR_EL3_PMU_ENABLE_BITS (MDCR_SPME | MDCR_SCCD) 969 970 /* 971 * Returns true if the counter (pass 31 for PMCCNTR) should count events using 972 * the current EL, security state, and register configuration. 973 */ 974 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter) 975 { 976 uint64_t filter; 977 bool e, p, u, nsk, nsu, nsh, m; 978 bool enabled, prohibited = false, filtered; 979 bool secure = arm_is_secure(env); 980 int el = arm_current_el(env); 981 uint64_t mdcr_el2; 982 uint8_t hpmn; 983 984 /* 985 * We might be called for M-profile cores where MDCR_EL2 doesn't 986 * exist and arm_mdcr_el2_eff() will assert, so this early-exit check 987 * must be before we read that value. 988 */ 989 if (!arm_feature(env, ARM_FEATURE_PMU)) { 990 return false; 991 } 992 993 mdcr_el2 = arm_mdcr_el2_eff(env); 994 hpmn = mdcr_el2 & MDCR_HPMN; 995 996 if (!arm_feature(env, ARM_FEATURE_EL2) || 997 (counter < hpmn || counter == 31)) { 998 e = env->cp15.c9_pmcr & PMCRE; 999 } else { 1000 e = mdcr_el2 & MDCR_HPME; 1001 } 1002 enabled = e && (env->cp15.c9_pmcnten & (1 << counter)); 1003 1004 /* Is event counting prohibited? */ 1005 if (el == 2 && (counter < hpmn || counter == 31)) { 1006 prohibited = mdcr_el2 & MDCR_HPMD; 1007 } 1008 if (secure) { 1009 prohibited = prohibited || !(env->cp15.mdcr_el3 & MDCR_SPME); 1010 } 1011 1012 if (counter == 31) { 1013 /* 1014 * The cycle counter defaults to running. PMCR.DP says "disable 1015 * the cycle counter when event counting is prohibited". 1016 * Some MDCR bits disable the cycle counter specifically. 1017 */ 1018 prohibited = prohibited && env->cp15.c9_pmcr & PMCRDP; 1019 if (cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1020 if (secure) { 1021 prohibited = prohibited || (env->cp15.mdcr_el3 & MDCR_SCCD); 1022 } 1023 if (el == 2) { 1024 prohibited = prohibited || (mdcr_el2 & MDCR_HCCD); 1025 } 1026 } 1027 } 1028 1029 if (counter == 31) { 1030 filter = env->cp15.pmccfiltr_el0; 1031 } else { 1032 filter = env->cp15.c14_pmevtyper[counter]; 1033 } 1034 1035 p = filter & PMXEVTYPER_P; 1036 u = filter & PMXEVTYPER_U; 1037 nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK); 1038 nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU); 1039 nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH); 1040 m = arm_el_is_aa64(env, 1) && 1041 arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M); 1042 1043 if (el == 0) { 1044 filtered = secure ? u : u != nsu; 1045 } else if (el == 1) { 1046 filtered = secure ? p : p != nsk; 1047 } else if (el == 2) { 1048 filtered = !nsh; 1049 } else { /* EL3 */ 1050 filtered = m != p; 1051 } 1052 1053 if (counter != 31) { 1054 /* 1055 * If not checking PMCCNTR, ensure the counter is setup to an event we 1056 * support 1057 */ 1058 uint16_t event = filter & PMXEVTYPER_EVTCOUNT; 1059 if (!event_supported(event)) { 1060 return false; 1061 } 1062 } 1063 1064 return enabled && !prohibited && !filtered; 1065 } 1066 1067 static void pmu_update_irq(CPUARMState *env) 1068 { 1069 ARMCPU *cpu = env_archcpu(env); 1070 qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) && 1071 (env->cp15.c9_pminten & env->cp15.c9_pmovsr)); 1072 } 1073 1074 static bool pmccntr_clockdiv_enabled(CPUARMState *env) 1075 { 1076 /* 1077 * Return true if the clock divider is enabled and the cycle counter 1078 * is supposed to tick only once every 64 clock cycles. This is 1079 * controlled by PMCR.D, but if PMCR.LC is set to enable the long 1080 * (64-bit) cycle counter PMCR.D has no effect. 1081 */ 1082 return (env->cp15.c9_pmcr & (PMCRD | PMCRLC)) == PMCRD; 1083 } 1084 1085 static bool pmevcntr_is_64_bit(CPUARMState *env, int counter) 1086 { 1087 /* Return true if the specified event counter is configured to be 64 bit */ 1088 1089 /* This isn't intended to be used with the cycle counter */ 1090 assert(counter < 31); 1091 1092 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1093 return false; 1094 } 1095 1096 if (arm_feature(env, ARM_FEATURE_EL2)) { 1097 /* 1098 * MDCR_EL2.HLP still applies even when EL2 is disabled in the 1099 * current security state, so we don't use arm_mdcr_el2_eff() here. 1100 */ 1101 bool hlp = env->cp15.mdcr_el2 & MDCR_HLP; 1102 int hpmn = env->cp15.mdcr_el2 & MDCR_HPMN; 1103 1104 if (counter >= hpmn) { 1105 return hlp; 1106 } 1107 } 1108 return env->cp15.c9_pmcr & PMCRLP; 1109 } 1110 1111 /* 1112 * Ensure c15_ccnt is the guest-visible count so that operations such as 1113 * enabling/disabling the counter or filtering, modifying the count itself, 1114 * etc. can be done logically. This is essentially a no-op if the counter is 1115 * not enabled at the time of the call. 1116 */ 1117 static void pmccntr_op_start(CPUARMState *env) 1118 { 1119 uint64_t cycles = cycles_get_count(env); 1120 1121 if (pmu_counter_enabled(env, 31)) { 1122 uint64_t eff_cycles = cycles; 1123 if (pmccntr_clockdiv_enabled(env)) { 1124 eff_cycles /= 64; 1125 } 1126 1127 uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta; 1128 1129 uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \ 1130 1ull << 63 : 1ull << 31; 1131 if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) { 1132 env->cp15.c9_pmovsr |= (1ULL << 31); 1133 pmu_update_irq(env); 1134 } 1135 1136 env->cp15.c15_ccnt = new_pmccntr; 1137 } 1138 env->cp15.c15_ccnt_delta = cycles; 1139 } 1140 1141 /* 1142 * If PMCCNTR is enabled, recalculate the delta between the clock and the 1143 * guest-visible count. A call to pmccntr_op_finish should follow every call to 1144 * pmccntr_op_start. 1145 */ 1146 static void pmccntr_op_finish(CPUARMState *env) 1147 { 1148 if (pmu_counter_enabled(env, 31)) { 1149 #ifndef CONFIG_USER_ONLY 1150 /* Calculate when the counter will next overflow */ 1151 uint64_t remaining_cycles = -env->cp15.c15_ccnt; 1152 if (!(env->cp15.c9_pmcr & PMCRLC)) { 1153 remaining_cycles = (uint32_t)remaining_cycles; 1154 } 1155 int64_t overflow_in = cycles_ns_per(remaining_cycles); 1156 1157 if (overflow_in > 0) { 1158 int64_t overflow_at; 1159 1160 if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1161 overflow_in, &overflow_at)) { 1162 ARMCPU *cpu = env_archcpu(env); 1163 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1164 } 1165 } 1166 #endif 1167 1168 uint64_t prev_cycles = env->cp15.c15_ccnt_delta; 1169 if (pmccntr_clockdiv_enabled(env)) { 1170 prev_cycles /= 64; 1171 } 1172 env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt; 1173 } 1174 } 1175 1176 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter) 1177 { 1178 1179 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1180 uint64_t count = 0; 1181 if (event_supported(event)) { 1182 uint16_t event_idx = supported_event_map[event]; 1183 count = pm_events[event_idx].get_count(env); 1184 } 1185 1186 if (pmu_counter_enabled(env, counter)) { 1187 uint64_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter]; 1188 uint64_t overflow_mask = pmevcntr_is_64_bit(env, counter) ? 1189 1ULL << 63 : 1ULL << 31; 1190 1191 if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & overflow_mask) { 1192 env->cp15.c9_pmovsr |= (1 << counter); 1193 pmu_update_irq(env); 1194 } 1195 env->cp15.c14_pmevcntr[counter] = new_pmevcntr; 1196 } 1197 env->cp15.c14_pmevcntr_delta[counter] = count; 1198 } 1199 1200 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter) 1201 { 1202 if (pmu_counter_enabled(env, counter)) { 1203 #ifndef CONFIG_USER_ONLY 1204 uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT; 1205 uint16_t event_idx = supported_event_map[event]; 1206 uint64_t delta = -(env->cp15.c14_pmevcntr[counter] + 1); 1207 int64_t overflow_in; 1208 1209 if (!pmevcntr_is_64_bit(env, counter)) { 1210 delta = (uint32_t)delta; 1211 } 1212 overflow_in = pm_events[event_idx].ns_per_count(delta); 1213 1214 if (overflow_in > 0) { 1215 int64_t overflow_at; 1216 1217 if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), 1218 overflow_in, &overflow_at)) { 1219 ARMCPU *cpu = env_archcpu(env); 1220 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at); 1221 } 1222 } 1223 #endif 1224 1225 env->cp15.c14_pmevcntr_delta[counter] -= 1226 env->cp15.c14_pmevcntr[counter]; 1227 } 1228 } 1229 1230 void pmu_op_start(CPUARMState *env) 1231 { 1232 unsigned int i; 1233 pmccntr_op_start(env); 1234 for (i = 0; i < pmu_num_counters(env); i++) { 1235 pmevcntr_op_start(env, i); 1236 } 1237 } 1238 1239 void pmu_op_finish(CPUARMState *env) 1240 { 1241 unsigned int i; 1242 pmccntr_op_finish(env); 1243 for (i = 0; i < pmu_num_counters(env); i++) { 1244 pmevcntr_op_finish(env, i); 1245 } 1246 } 1247 1248 void pmu_pre_el_change(ARMCPU *cpu, void *ignored) 1249 { 1250 pmu_op_start(&cpu->env); 1251 } 1252 1253 void pmu_post_el_change(ARMCPU *cpu, void *ignored) 1254 { 1255 pmu_op_finish(&cpu->env); 1256 } 1257 1258 void arm_pmu_timer_cb(void *opaque) 1259 { 1260 ARMCPU *cpu = opaque; 1261 1262 /* 1263 * Update all the counter values based on the current underlying counts, 1264 * triggering interrupts to be raised, if necessary. pmu_op_finish() also 1265 * has the effect of setting the cpu->pmu_timer to the next earliest time a 1266 * counter may expire. 1267 */ 1268 pmu_op_start(&cpu->env); 1269 pmu_op_finish(&cpu->env); 1270 } 1271 1272 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1273 uint64_t value) 1274 { 1275 pmu_op_start(env); 1276 1277 if (value & PMCRC) { 1278 /* The counter has been reset */ 1279 env->cp15.c15_ccnt = 0; 1280 } 1281 1282 if (value & PMCRP) { 1283 unsigned int i; 1284 for (i = 0; i < pmu_num_counters(env); i++) { 1285 env->cp15.c14_pmevcntr[i] = 0; 1286 } 1287 } 1288 1289 env->cp15.c9_pmcr &= ~PMCR_WRITABLE_MASK; 1290 env->cp15.c9_pmcr |= (value & PMCR_WRITABLE_MASK); 1291 1292 pmu_op_finish(env); 1293 } 1294 1295 static uint64_t pmcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1296 { 1297 uint64_t pmcr = env->cp15.c9_pmcr; 1298 1299 /* 1300 * If EL2 is implemented and enabled for the current security state, reads 1301 * of PMCR.N from EL1 or EL0 return the value of MDCR_EL2.HPMN or HDCR.HPMN. 1302 */ 1303 if (arm_current_el(env) <= 1 && arm_is_el2_enabled(env)) { 1304 pmcr &= ~PMCRN_MASK; 1305 pmcr |= (env->cp15.mdcr_el2 & MDCR_HPMN) << PMCRN_SHIFT; 1306 } 1307 1308 return pmcr; 1309 } 1310 1311 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri, 1312 uint64_t value) 1313 { 1314 unsigned int i; 1315 uint64_t overflow_mask, new_pmswinc; 1316 1317 for (i = 0; i < pmu_num_counters(env); i++) { 1318 /* Increment a counter's count iff: */ 1319 if ((value & (1 << i)) && /* counter's bit is set */ 1320 /* counter is enabled and not filtered */ 1321 pmu_counter_enabled(env, i) && 1322 /* counter is SW_INCR */ 1323 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) { 1324 pmevcntr_op_start(env, i); 1325 1326 /* 1327 * Detect if this write causes an overflow since we can't predict 1328 * PMSWINC overflows like we can for other events 1329 */ 1330 new_pmswinc = env->cp15.c14_pmevcntr[i] + 1; 1331 1332 overflow_mask = pmevcntr_is_64_bit(env, i) ? 1333 1ULL << 63 : 1ULL << 31; 1334 1335 if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & overflow_mask) { 1336 env->cp15.c9_pmovsr |= (1 << i); 1337 pmu_update_irq(env); 1338 } 1339 1340 env->cp15.c14_pmevcntr[i] = new_pmswinc; 1341 1342 pmevcntr_op_finish(env, i); 1343 } 1344 } 1345 } 1346 1347 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1348 { 1349 uint64_t ret; 1350 pmccntr_op_start(env); 1351 ret = env->cp15.c15_ccnt; 1352 pmccntr_op_finish(env); 1353 return ret; 1354 } 1355 1356 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1357 uint64_t value) 1358 { 1359 /* 1360 * The value of PMSELR.SEL affects the behavior of PMXEVTYPER and 1361 * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the 1362 * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are 1363 * accessed. 1364 */ 1365 env->cp15.c9_pmselr = value & 0x1f; 1366 } 1367 1368 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1369 uint64_t value) 1370 { 1371 pmccntr_op_start(env); 1372 env->cp15.c15_ccnt = value; 1373 pmccntr_op_finish(env); 1374 } 1375 1376 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri, 1377 uint64_t value) 1378 { 1379 uint64_t cur_val = pmccntr_read(env, NULL); 1380 1381 pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value)); 1382 } 1383 1384 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1385 uint64_t value) 1386 { 1387 pmccntr_op_start(env); 1388 env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0; 1389 pmccntr_op_finish(env); 1390 } 1391 1392 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri, 1393 uint64_t value) 1394 { 1395 pmccntr_op_start(env); 1396 /* M is not accessible from AArch32 */ 1397 env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) | 1398 (value & PMCCFILTR); 1399 pmccntr_op_finish(env); 1400 } 1401 1402 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri) 1403 { 1404 /* M is not visible in AArch32 */ 1405 return env->cp15.pmccfiltr_el0 & PMCCFILTR; 1406 } 1407 1408 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1409 uint64_t value) 1410 { 1411 pmu_op_start(env); 1412 value &= pmu_counter_mask(env); 1413 env->cp15.c9_pmcnten |= value; 1414 pmu_op_finish(env); 1415 } 1416 1417 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1418 uint64_t value) 1419 { 1420 pmu_op_start(env); 1421 value &= pmu_counter_mask(env); 1422 env->cp15.c9_pmcnten &= ~value; 1423 pmu_op_finish(env); 1424 } 1425 1426 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1427 uint64_t value) 1428 { 1429 value &= pmu_counter_mask(env); 1430 env->cp15.c9_pmovsr &= ~value; 1431 pmu_update_irq(env); 1432 } 1433 1434 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1435 uint64_t value) 1436 { 1437 value &= pmu_counter_mask(env); 1438 env->cp15.c9_pmovsr |= value; 1439 pmu_update_irq(env); 1440 } 1441 1442 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1443 uint64_t value, const uint8_t counter) 1444 { 1445 if (counter == 31) { 1446 pmccfiltr_write(env, ri, value); 1447 } else if (counter < pmu_num_counters(env)) { 1448 pmevcntr_op_start(env, counter); 1449 1450 /* 1451 * If this counter's event type is changing, store the current 1452 * underlying count for the new type in c14_pmevcntr_delta[counter] so 1453 * pmevcntr_op_finish has the correct baseline when it converts back to 1454 * a delta. 1455 */ 1456 uint16_t old_event = env->cp15.c14_pmevtyper[counter] & 1457 PMXEVTYPER_EVTCOUNT; 1458 uint16_t new_event = value & PMXEVTYPER_EVTCOUNT; 1459 if (old_event != new_event) { 1460 uint64_t count = 0; 1461 if (event_supported(new_event)) { 1462 uint16_t event_idx = supported_event_map[new_event]; 1463 count = pm_events[event_idx].get_count(env); 1464 } 1465 env->cp15.c14_pmevcntr_delta[counter] = count; 1466 } 1467 1468 env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK; 1469 pmevcntr_op_finish(env, counter); 1470 } 1471 /* 1472 * Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when 1473 * PMSELR value is equal to or greater than the number of implemented 1474 * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI. 1475 */ 1476 } 1477 1478 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri, 1479 const uint8_t counter) 1480 { 1481 if (counter == 31) { 1482 return env->cp15.pmccfiltr_el0; 1483 } else if (counter < pmu_num_counters(env)) { 1484 return env->cp15.c14_pmevtyper[counter]; 1485 } else { 1486 /* 1487 * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER 1488 * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write(). 1489 */ 1490 return 0; 1491 } 1492 } 1493 1494 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1495 uint64_t value) 1496 { 1497 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1498 pmevtyper_write(env, ri, value, counter); 1499 } 1500 1501 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1502 uint64_t value) 1503 { 1504 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1505 env->cp15.c14_pmevtyper[counter] = value; 1506 1507 /* 1508 * pmevtyper_rawwrite is called between a pair of pmu_op_start and 1509 * pmu_op_finish calls when loading saved state for a migration. Because 1510 * we're potentially updating the type of event here, the value written to 1511 * c14_pmevcntr_delta by the preceding pmu_op_start call may be for a 1512 * different counter type. Therefore, we need to set this value to the 1513 * current count for the counter type we're writing so that pmu_op_finish 1514 * has the correct count for its calculation. 1515 */ 1516 uint16_t event = value & PMXEVTYPER_EVTCOUNT; 1517 if (event_supported(event)) { 1518 uint16_t event_idx = supported_event_map[event]; 1519 env->cp15.c14_pmevcntr_delta[counter] = 1520 pm_events[event_idx].get_count(env); 1521 } 1522 } 1523 1524 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1525 { 1526 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1527 return pmevtyper_read(env, ri, counter); 1528 } 1529 1530 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri, 1531 uint64_t value) 1532 { 1533 pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31); 1534 } 1535 1536 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri) 1537 { 1538 return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31); 1539 } 1540 1541 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1542 uint64_t value, uint8_t counter) 1543 { 1544 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1545 /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */ 1546 value &= MAKE_64BIT_MASK(0, 32); 1547 } 1548 if (counter < pmu_num_counters(env)) { 1549 pmevcntr_op_start(env, counter); 1550 env->cp15.c14_pmevcntr[counter] = value; 1551 pmevcntr_op_finish(env, counter); 1552 } 1553 /* 1554 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1555 * are CONSTRAINED UNPREDICTABLE. 1556 */ 1557 } 1558 1559 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri, 1560 uint8_t counter) 1561 { 1562 if (counter < pmu_num_counters(env)) { 1563 uint64_t ret; 1564 pmevcntr_op_start(env, counter); 1565 ret = env->cp15.c14_pmevcntr[counter]; 1566 pmevcntr_op_finish(env, counter); 1567 if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) { 1568 /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */ 1569 ret &= MAKE_64BIT_MASK(0, 32); 1570 } 1571 return ret; 1572 } else { 1573 /* 1574 * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR 1575 * are CONSTRAINED UNPREDICTABLE. 1576 */ 1577 return 0; 1578 } 1579 } 1580 1581 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri, 1582 uint64_t value) 1583 { 1584 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1585 pmevcntr_write(env, ri, value, counter); 1586 } 1587 1588 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 1589 { 1590 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1591 return pmevcntr_read(env, ri, counter); 1592 } 1593 1594 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri, 1595 uint64_t value) 1596 { 1597 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1598 assert(counter < pmu_num_counters(env)); 1599 env->cp15.c14_pmevcntr[counter] = value; 1600 pmevcntr_write(env, ri, value, counter); 1601 } 1602 1603 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri) 1604 { 1605 uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7); 1606 assert(counter < pmu_num_counters(env)); 1607 return env->cp15.c14_pmevcntr[counter]; 1608 } 1609 1610 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1611 uint64_t value) 1612 { 1613 pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31); 1614 } 1615 1616 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1617 { 1618 return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31); 1619 } 1620 1621 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1622 uint64_t value) 1623 { 1624 if (arm_feature(env, ARM_FEATURE_V8)) { 1625 env->cp15.c9_pmuserenr = value & 0xf; 1626 } else { 1627 env->cp15.c9_pmuserenr = value & 1; 1628 } 1629 } 1630 1631 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri, 1632 uint64_t value) 1633 { 1634 /* We have no event counters so only the C bit can be changed */ 1635 value &= pmu_counter_mask(env); 1636 env->cp15.c9_pminten |= value; 1637 pmu_update_irq(env); 1638 } 1639 1640 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1641 uint64_t value) 1642 { 1643 value &= pmu_counter_mask(env); 1644 env->cp15.c9_pminten &= ~value; 1645 pmu_update_irq(env); 1646 } 1647 1648 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 1649 uint64_t value) 1650 { 1651 /* 1652 * Note that even though the AArch64 view of this register has bits 1653 * [10:0] all RES0 we can only mask the bottom 5, to comply with the 1654 * architectural requirements for bits which are RES0 only in some 1655 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7 1656 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.) 1657 */ 1658 raw_write(env, ri, value & ~0x1FULL); 1659 } 1660 1661 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 1662 { 1663 /* Begin with base v8.0 state. */ 1664 uint64_t valid_mask = 0x3fff; 1665 ARMCPU *cpu = env_archcpu(env); 1666 uint64_t changed; 1667 1668 /* 1669 * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always 1670 * passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64. 1671 * Instead, choose the format based on the mode of EL3. 1672 */ 1673 if (arm_el_is_aa64(env, 3)) { 1674 value |= SCR_FW | SCR_AW; /* RES1 */ 1675 valid_mask &= ~SCR_NET; /* RES0 */ 1676 1677 if (!cpu_isar_feature(aa64_aa32_el1, cpu) && 1678 !cpu_isar_feature(aa64_aa32_el2, cpu)) { 1679 value |= SCR_RW; /* RAO/WI */ 1680 } 1681 if (cpu_isar_feature(aa64_ras, cpu)) { 1682 valid_mask |= SCR_TERR; 1683 } 1684 if (cpu_isar_feature(aa64_lor, cpu)) { 1685 valid_mask |= SCR_TLOR; 1686 } 1687 if (cpu_isar_feature(aa64_pauth, cpu)) { 1688 valid_mask |= SCR_API | SCR_APK; 1689 } 1690 if (cpu_isar_feature(aa64_sel2, cpu)) { 1691 valid_mask |= SCR_EEL2; 1692 } else if (cpu_isar_feature(aa64_rme, cpu)) { 1693 /* With RME and without SEL2, NS is RES1 (R_GSWWH, I_DJJQJ). */ 1694 value |= SCR_NS; 1695 } 1696 if (cpu_isar_feature(aa64_mte, cpu)) { 1697 valid_mask |= SCR_ATA; 1698 } 1699 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 1700 valid_mask |= SCR_ENSCXT; 1701 } 1702 if (cpu_isar_feature(aa64_doublefault, cpu)) { 1703 valid_mask |= SCR_EASE | SCR_NMEA; 1704 } 1705 if (cpu_isar_feature(aa64_sme, cpu)) { 1706 valid_mask |= SCR_ENTP2; 1707 } 1708 if (cpu_isar_feature(aa64_hcx, cpu)) { 1709 valid_mask |= SCR_HXEN; 1710 } 1711 if (cpu_isar_feature(aa64_fgt, cpu)) { 1712 valid_mask |= SCR_FGTEN; 1713 } 1714 if (cpu_isar_feature(aa64_rme, cpu)) { 1715 valid_mask |= SCR_NSE | SCR_GPF; 1716 } 1717 if (cpu_isar_feature(aa64_ecv, cpu)) { 1718 valid_mask |= SCR_ECVEN; 1719 } 1720 } else { 1721 valid_mask &= ~(SCR_RW | SCR_ST); 1722 if (cpu_isar_feature(aa32_ras, cpu)) { 1723 valid_mask |= SCR_TERR; 1724 } 1725 } 1726 1727 if (!arm_feature(env, ARM_FEATURE_EL2)) { 1728 valid_mask &= ~SCR_HCE; 1729 1730 /* 1731 * On ARMv7, SMD (or SCD as it is called in v7) is only 1732 * supported if EL2 exists. The bit is UNK/SBZP when 1733 * EL2 is unavailable. In QEMU ARMv7, we force it to always zero 1734 * when EL2 is unavailable. 1735 * On ARMv8, this bit is always available. 1736 */ 1737 if (arm_feature(env, ARM_FEATURE_V7) && 1738 !arm_feature(env, ARM_FEATURE_V8)) { 1739 valid_mask &= ~SCR_SMD; 1740 } 1741 } 1742 1743 /* Clear all-context RES0 bits. */ 1744 value &= valid_mask; 1745 changed = env->cp15.scr_el3 ^ value; 1746 env->cp15.scr_el3 = value; 1747 1748 /* 1749 * If SCR_EL3.{NS,NSE} changes, i.e. change of security state, 1750 * we must invalidate all TLBs below EL3. 1751 */ 1752 if (changed & (SCR_NS | SCR_NSE)) { 1753 tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 | 1754 ARMMMUIdxBit_E20_0 | 1755 ARMMMUIdxBit_E10_1 | 1756 ARMMMUIdxBit_E20_2 | 1757 ARMMMUIdxBit_E10_1_PAN | 1758 ARMMMUIdxBit_E20_2_PAN | 1759 ARMMMUIdxBit_E2)); 1760 } 1761 } 1762 1763 static void scr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 1764 { 1765 /* 1766 * scr_write will set the RES1 bits on an AArch64-only CPU. 1767 * The reset value will be 0x30 on an AArch64-only CPU and 0 otherwise. 1768 */ 1769 scr_write(env, ri, 0); 1770 } 1771 1772 static CPAccessResult access_tid4(CPUARMState *env, 1773 const ARMCPRegInfo *ri, 1774 bool isread) 1775 { 1776 if (arm_current_el(env) == 1 && 1777 (arm_hcr_el2_eff(env) & (HCR_TID2 | HCR_TID4))) { 1778 return CP_ACCESS_TRAP_EL2; 1779 } 1780 1781 return CP_ACCESS_OK; 1782 } 1783 1784 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1785 { 1786 ARMCPU *cpu = env_archcpu(env); 1787 1788 /* 1789 * Acquire the CSSELR index from the bank corresponding to the CCSIDR 1790 * bank 1791 */ 1792 uint32_t index = A32_BANKED_REG_GET(env, csselr, 1793 ri->secure & ARM_CP_SECSTATE_S); 1794 1795 return cpu->ccsidr[index]; 1796 } 1797 1798 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 1799 uint64_t value) 1800 { 1801 raw_write(env, ri, value & 0xf); 1802 } 1803 1804 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri) 1805 { 1806 CPUState *cs = env_cpu(env); 1807 bool el1 = arm_current_el(env) == 1; 1808 uint64_t hcr_el2 = el1 ? arm_hcr_el2_eff(env) : 0; 1809 uint64_t ret = 0; 1810 1811 if (hcr_el2 & HCR_IMO) { 1812 if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) { 1813 ret |= CPSR_I; 1814 } 1815 if (cs->interrupt_request & CPU_INTERRUPT_VINMI) { 1816 ret |= ISR_IS; 1817 ret |= CPSR_I; 1818 } 1819 } else { 1820 if (cs->interrupt_request & CPU_INTERRUPT_HARD) { 1821 ret |= CPSR_I; 1822 } 1823 1824 if (cs->interrupt_request & CPU_INTERRUPT_NMI) { 1825 ret |= ISR_IS; 1826 ret |= CPSR_I; 1827 } 1828 } 1829 1830 if (hcr_el2 & HCR_FMO) { 1831 if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) { 1832 ret |= CPSR_F; 1833 } 1834 if (cs->interrupt_request & CPU_INTERRUPT_VFNMI) { 1835 ret |= ISR_FS; 1836 ret |= CPSR_F; 1837 } 1838 } else { 1839 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) { 1840 ret |= CPSR_F; 1841 } 1842 } 1843 1844 if (hcr_el2 & HCR_AMO) { 1845 if (cs->interrupt_request & CPU_INTERRUPT_VSERR) { 1846 ret |= CPSR_A; 1847 } 1848 } 1849 1850 return ret; 1851 } 1852 1853 static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 1854 bool isread) 1855 { 1856 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) { 1857 return CP_ACCESS_TRAP_EL2; 1858 } 1859 1860 return CP_ACCESS_OK; 1861 } 1862 1863 static CPAccessResult access_aa32_tid1(CPUARMState *env, const ARMCPRegInfo *ri, 1864 bool isread) 1865 { 1866 if (arm_feature(env, ARM_FEATURE_V8)) { 1867 return access_aa64_tid1(env, ri, isread); 1868 } 1869 1870 return CP_ACCESS_OK; 1871 } 1872 1873 static const ARMCPRegInfo v7_cp_reginfo[] = { 1874 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */ 1875 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4, 1876 .access = PL1_W, .type = ARM_CP_NOP }, 1877 /* 1878 * Performance monitors are implementation defined in v7, 1879 * but with an ARM recommended set of registers, which we 1880 * follow. 1881 * 1882 * Performance registers fall into three categories: 1883 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR) 1884 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR) 1885 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others) 1886 * For the cases controlled by PMUSERENR we must set .access to PL0_RW 1887 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn. 1888 */ 1889 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1, 1890 .access = PL0_RW, .type = ARM_CP_ALIAS | ARM_CP_IO, 1891 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1892 .writefn = pmcntenset_write, 1893 .accessfn = pmreg_access, 1894 .fgt = FGT_PMCNTEN, 1895 .raw_writefn = raw_write }, 1896 { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, .type = ARM_CP_IO, 1897 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1, 1898 .access = PL0_RW, .accessfn = pmreg_access, 1899 .fgt = FGT_PMCNTEN, 1900 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0, 1901 .writefn = pmcntenset_write, .raw_writefn = raw_write }, 1902 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2, 1903 .access = PL0_RW, 1904 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten), 1905 .accessfn = pmreg_access, 1906 .fgt = FGT_PMCNTEN, 1907 .writefn = pmcntenclr_write, .raw_writefn = raw_write, 1908 .type = ARM_CP_ALIAS | ARM_CP_IO }, 1909 { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64, 1910 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2, 1911 .access = PL0_RW, .accessfn = pmreg_access, 1912 .fgt = FGT_PMCNTEN, 1913 .type = ARM_CP_ALIAS | ARM_CP_IO, 1914 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), 1915 .writefn = pmcntenclr_write, .raw_writefn = raw_write }, 1916 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3, 1917 .access = PL0_RW, .type = ARM_CP_IO, 1918 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 1919 .accessfn = pmreg_access, 1920 .fgt = FGT_PMOVS, 1921 .writefn = pmovsr_write, 1922 .raw_writefn = raw_write }, 1923 { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, 1924 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, 1925 .access = PL0_RW, .accessfn = pmreg_access, 1926 .fgt = FGT_PMOVS, 1927 .type = ARM_CP_ALIAS | ARM_CP_IO, 1928 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 1929 .writefn = pmovsr_write, 1930 .raw_writefn = raw_write }, 1931 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, 1932 .access = PL0_W, .accessfn = pmreg_access_swinc, 1933 .fgt = FGT_PMSWINC_EL0, 1934 .type = ARM_CP_NO_RAW | ARM_CP_IO, 1935 .writefn = pmswinc_write }, 1936 { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64, 1937 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4, 1938 .access = PL0_W, .accessfn = pmreg_access_swinc, 1939 .fgt = FGT_PMSWINC_EL0, 1940 .type = ARM_CP_NO_RAW | ARM_CP_IO, 1941 .writefn = pmswinc_write }, 1942 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5, 1943 .access = PL0_RW, .type = ARM_CP_ALIAS, 1944 .fgt = FGT_PMSELR_EL0, 1945 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr), 1946 .accessfn = pmreg_access_selr, .writefn = pmselr_write, 1947 .raw_writefn = raw_write}, 1948 { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64, 1949 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5, 1950 .access = PL0_RW, .accessfn = pmreg_access_selr, 1951 .fgt = FGT_PMSELR_EL0, 1952 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr), 1953 .writefn = pmselr_write, .raw_writefn = raw_write, }, 1954 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0, 1955 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO, 1956 .fgt = FGT_PMCCNTR_EL0, 1957 .readfn = pmccntr_read, .writefn = pmccntr_write32, 1958 .accessfn = pmreg_access_ccntr }, 1959 { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64, 1960 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0, 1961 .access = PL0_RW, .accessfn = pmreg_access_ccntr, 1962 .fgt = FGT_PMCCNTR_EL0, 1963 .type = ARM_CP_IO, 1964 .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt), 1965 .readfn = pmccntr_read, .writefn = pmccntr_write, 1966 .raw_readfn = raw_read, .raw_writefn = raw_write, }, 1967 { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7, 1968 .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32, 1969 .access = PL0_RW, .accessfn = pmreg_access, 1970 .fgt = FGT_PMCCFILTR_EL0, 1971 .type = ARM_CP_ALIAS | ARM_CP_IO, 1972 .resetvalue = 0, }, 1973 { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64, 1974 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7, 1975 .writefn = pmccfiltr_write, .raw_writefn = raw_write, 1976 .access = PL0_RW, .accessfn = pmreg_access, 1977 .fgt = FGT_PMCCFILTR_EL0, 1978 .type = ARM_CP_IO, 1979 .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0), 1980 .resetvalue = 0, }, 1981 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1, 1982 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 1983 .accessfn = pmreg_access, 1984 .fgt = FGT_PMEVTYPERN_EL0, 1985 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 1986 { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64, 1987 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1, 1988 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 1989 .accessfn = pmreg_access, 1990 .fgt = FGT_PMEVTYPERN_EL0, 1991 .writefn = pmxevtyper_write, .readfn = pmxevtyper_read }, 1992 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2, 1993 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 1994 .accessfn = pmreg_access_xevcntr, 1995 .fgt = FGT_PMEVCNTRN_EL0, 1996 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 1997 { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64, 1998 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2, 1999 .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO, 2000 .accessfn = pmreg_access_xevcntr, 2001 .fgt = FGT_PMEVCNTRN_EL0, 2002 .writefn = pmxevcntr_write, .readfn = pmxevcntr_read }, 2003 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0, 2004 .access = PL0_R | PL1_RW, .accessfn = access_tpm, 2005 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr), 2006 .resetvalue = 0, 2007 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2008 { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, 2009 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, 2010 .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS, 2011 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), 2012 .resetvalue = 0, 2013 .writefn = pmuserenr_write, .raw_writefn = raw_write }, 2014 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, 2015 .access = PL1_RW, .accessfn = access_tpm, 2016 .fgt = FGT_PMINTEN, 2017 .type = ARM_CP_ALIAS | ARM_CP_IO, 2018 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten), 2019 .resetvalue = 0, 2020 .writefn = pmintenset_write, .raw_writefn = raw_write }, 2021 { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64, 2022 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1, 2023 .access = PL1_RW, .accessfn = access_tpm, 2024 .fgt = FGT_PMINTEN, 2025 .type = ARM_CP_IO, 2026 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2027 .writefn = pmintenset_write, .raw_writefn = raw_write, 2028 .resetvalue = 0x0 }, 2029 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2, 2030 .access = PL1_RW, .accessfn = access_tpm, 2031 .fgt = FGT_PMINTEN, 2032 .type = ARM_CP_ALIAS | ARM_CP_IO, 2033 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2034 .writefn = pmintenclr_write, .raw_writefn = raw_write }, 2035 { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, 2036 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, 2037 .access = PL1_RW, .accessfn = access_tpm, 2038 .fgt = FGT_PMINTEN, 2039 .type = ARM_CP_ALIAS | ARM_CP_IO, 2040 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), 2041 .writefn = pmintenclr_write, .raw_writefn = raw_write }, 2042 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH, 2043 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0, 2044 .access = PL1_R, 2045 .accessfn = access_tid4, 2046 .fgt = FGT_CCSIDR_EL1, 2047 .readfn = ccsidr_read, .type = ARM_CP_NO_RAW }, 2048 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH, 2049 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0, 2050 .access = PL1_RW, 2051 .accessfn = access_tid4, 2052 .fgt = FGT_CSSELR_EL1, 2053 .writefn = csselr_write, .resetvalue = 0, 2054 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s), 2055 offsetof(CPUARMState, cp15.csselr_ns) } }, 2056 /* 2057 * Auxiliary ID register: this actually has an IMPDEF value but for now 2058 * just RAZ for all cores: 2059 */ 2060 { .name = "AIDR", .state = ARM_CP_STATE_BOTH, 2061 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7, 2062 .access = PL1_R, .type = ARM_CP_CONST, 2063 .accessfn = access_aa64_tid1, 2064 .fgt = FGT_AIDR_EL1, 2065 .resetvalue = 0 }, 2066 /* 2067 * Auxiliary fault status registers: these also are IMPDEF, and we 2068 * choose to RAZ/WI for all cores. 2069 */ 2070 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH, 2071 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0, 2072 .access = PL1_RW, .accessfn = access_tvm_trvm, 2073 .fgt = FGT_AFSR0_EL1, 2074 .nv2_redirect_offset = 0x128 | NV2_REDIR_NV1, 2075 .type = ARM_CP_CONST, .resetvalue = 0 }, 2076 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH, 2077 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1, 2078 .access = PL1_RW, .accessfn = access_tvm_trvm, 2079 .fgt = FGT_AFSR1_EL1, 2080 .nv2_redirect_offset = 0x130 | NV2_REDIR_NV1, 2081 .type = ARM_CP_CONST, .resetvalue = 0 }, 2082 /* 2083 * MAIR can just read-as-written because we don't implement caches 2084 * and so don't need to care about memory attributes. 2085 */ 2086 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64, 2087 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2088 .access = PL1_RW, .accessfn = access_tvm_trvm, 2089 .fgt = FGT_MAIR_EL1, 2090 .nv2_redirect_offset = 0x140 | NV2_REDIR_NV1, 2091 .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]), 2092 .resetvalue = 0 }, 2093 { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64, 2094 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0, 2095 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]), 2096 .resetvalue = 0 }, 2097 /* 2098 * For non-long-descriptor page tables these are PRRR and NMRR; 2099 * regardless they still act as reads-as-written for QEMU. 2100 */ 2101 /* 2102 * MAIR0/1 are defined separately from their 64-bit counterpart which 2103 * allows them to assign the correct fieldoffset based on the endianness 2104 * handled in the field definitions. 2105 */ 2106 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, 2107 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, 2108 .access = PL1_RW, .accessfn = access_tvm_trvm, 2109 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s), 2110 offsetof(CPUARMState, cp15.mair0_ns) }, 2111 .resetfn = arm_cp_reset_ignore }, 2112 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, 2113 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, 2114 .access = PL1_RW, .accessfn = access_tvm_trvm, 2115 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s), 2116 offsetof(CPUARMState, cp15.mair1_ns) }, 2117 .resetfn = arm_cp_reset_ignore }, 2118 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH, 2119 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0, 2120 .fgt = FGT_ISR_EL1, 2121 .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read }, 2122 }; 2123 2124 static const ARMCPRegInfo pmovsset_cp_reginfo[] = { 2125 /* PMOVSSET is not implemented in v7 before v7ve */ 2126 { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3, 2127 .access = PL0_RW, .accessfn = pmreg_access, 2128 .fgt = FGT_PMOVS, 2129 .type = ARM_CP_ALIAS | ARM_CP_IO, 2130 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr), 2131 .writefn = pmovsset_write, 2132 .raw_writefn = raw_write }, 2133 { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64, 2134 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3, 2135 .access = PL0_RW, .accessfn = pmreg_access, 2136 .fgt = FGT_PMOVS, 2137 .type = ARM_CP_ALIAS | ARM_CP_IO, 2138 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), 2139 .writefn = pmovsset_write, 2140 .raw_writefn = raw_write }, 2141 }; 2142 2143 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri, 2144 uint64_t value) 2145 { 2146 value &= 1; 2147 env->teecr = value; 2148 } 2149 2150 static CPAccessResult teecr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2151 bool isread) 2152 { 2153 /* 2154 * HSTR.TTEE only exists in v7A, not v8A, but v8A doesn't have T2EE 2155 * at all, so we don't need to check whether we're v8A. 2156 */ 2157 if (arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) && 2158 (env->cp15.hstr_el2 & HSTR_TTEE)) { 2159 return CP_ACCESS_TRAP_EL2; 2160 } 2161 return CP_ACCESS_OK; 2162 } 2163 2164 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri, 2165 bool isread) 2166 { 2167 if (arm_current_el(env) == 0 && (env->teecr & 1)) { 2168 return CP_ACCESS_TRAP_EL1; 2169 } 2170 return teecr_access(env, ri, isread); 2171 } 2172 2173 static const ARMCPRegInfo t2ee_cp_reginfo[] = { 2174 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0, 2175 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr), 2176 .resetvalue = 0, 2177 .writefn = teecr_write, .accessfn = teecr_access }, 2178 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0, 2179 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr), 2180 .accessfn = teehbr_access, .resetvalue = 0 }, 2181 }; 2182 2183 static const ARMCPRegInfo v6k_cp_reginfo[] = { 2184 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64, 2185 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0, 2186 .access = PL0_RW, 2187 .fgt = FGT_TPIDR_EL0, 2188 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 }, 2189 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2, 2190 .access = PL0_RW, 2191 .fgt = FGT_TPIDR_EL0, 2192 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s), 2193 offsetoflow32(CPUARMState, cp15.tpidrurw_ns) }, 2194 .resetfn = arm_cp_reset_ignore }, 2195 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64, 2196 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0, 2197 .access = PL0_R | PL1_W, 2198 .fgt = FGT_TPIDRRO_EL0, 2199 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]), 2200 .resetvalue = 0}, 2201 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3, 2202 .access = PL0_R | PL1_W, 2203 .fgt = FGT_TPIDRRO_EL0, 2204 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s), 2205 offsetoflow32(CPUARMState, cp15.tpidruro_ns) }, 2206 .resetfn = arm_cp_reset_ignore }, 2207 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64, 2208 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0, 2209 .access = PL1_RW, 2210 .fgt = FGT_TPIDR_EL1, 2211 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 }, 2212 { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4, 2213 .access = PL1_RW, 2214 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s), 2215 offsetoflow32(CPUARMState, cp15.tpidrprw_ns) }, 2216 .resetvalue = 0 }, 2217 }; 2218 2219 static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque) 2220 { 2221 ARMCPU *cpu = env_archcpu(env); 2222 2223 cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz; 2224 } 2225 2226 #ifndef CONFIG_USER_ONLY 2227 2228 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, 2229 bool isread) 2230 { 2231 /* 2232 * CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. 2233 * Writable only at the highest implemented exception level. 2234 */ 2235 int el = arm_current_el(env); 2236 uint64_t hcr; 2237 uint32_t cntkctl; 2238 2239 switch (el) { 2240 case 0: 2241 hcr = arm_hcr_el2_eff(env); 2242 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2243 cntkctl = env->cp15.cnthctl_el2; 2244 } else { 2245 cntkctl = env->cp15.c14_cntkctl; 2246 } 2247 if (!extract32(cntkctl, 0, 2)) { 2248 return CP_ACCESS_TRAP_EL1; 2249 } 2250 break; 2251 case 1: 2252 if (!isread && ri->state == ARM_CP_STATE_AA32 && 2253 arm_is_secure_below_el3(env)) { 2254 /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ 2255 return CP_ACCESS_UNDEFINED; 2256 } 2257 break; 2258 case 2: 2259 case 3: 2260 break; 2261 } 2262 2263 if (!isread && el < arm_highest_el(env)) { 2264 return CP_ACCESS_UNDEFINED; 2265 } 2266 2267 return CP_ACCESS_OK; 2268 } 2269 2270 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, 2271 bool isread) 2272 { 2273 unsigned int cur_el = arm_current_el(env); 2274 bool has_el2 = arm_is_el2_enabled(env); 2275 uint64_t hcr = arm_hcr_el2_eff(env); 2276 2277 switch (cur_el) { 2278 case 0: 2279 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]CTEN. */ 2280 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2281 return (extract32(env->cp15.cnthctl_el2, timeridx, 1) 2282 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2283 } 2284 2285 /* CNT[PV]CT: not visible from PL0 if EL0[PV]CTEN is zero */ 2286 if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) { 2287 return CP_ACCESS_TRAP_EL1; 2288 } 2289 /* fall through */ 2290 case 1: 2291 /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */ 2292 if (has_el2 && timeridx == GTIMER_PHYS && 2293 (hcr & HCR_E2H 2294 ? !extract32(env->cp15.cnthctl_el2, 10, 1) 2295 : !extract32(env->cp15.cnthctl_el2, 0, 1))) { 2296 return CP_ACCESS_TRAP_EL2; 2297 } 2298 if (has_el2 && timeridx == GTIMER_VIRT) { 2299 if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) { 2300 return CP_ACCESS_TRAP_EL2; 2301 } 2302 } 2303 break; 2304 } 2305 return CP_ACCESS_OK; 2306 } 2307 2308 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx, 2309 bool isread) 2310 { 2311 unsigned int cur_el = arm_current_el(env); 2312 bool has_el2 = arm_is_el2_enabled(env); 2313 uint64_t hcr = arm_hcr_el2_eff(env); 2314 2315 switch (cur_el) { 2316 case 0: 2317 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2318 /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]TEN. */ 2319 return (extract32(env->cp15.cnthctl_el2, 9 - timeridx, 1) 2320 ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2); 2321 } 2322 2323 /* 2324 * CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from 2325 * EL0 if EL0[PV]TEN is zero. 2326 */ 2327 if (!extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) { 2328 return CP_ACCESS_TRAP_EL1; 2329 } 2330 /* fall through */ 2331 2332 case 1: 2333 if (has_el2 && timeridx == GTIMER_PHYS) { 2334 if (hcr & HCR_E2H) { 2335 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */ 2336 if (!extract32(env->cp15.cnthctl_el2, 11, 1)) { 2337 return CP_ACCESS_TRAP_EL2; 2338 } 2339 } else { 2340 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ 2341 if (!extract32(env->cp15.cnthctl_el2, 1, 1)) { 2342 return CP_ACCESS_TRAP_EL2; 2343 } 2344 } 2345 } 2346 if (has_el2 && timeridx == GTIMER_VIRT) { 2347 if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) { 2348 return CP_ACCESS_TRAP_EL2; 2349 } 2350 } 2351 break; 2352 } 2353 return CP_ACCESS_OK; 2354 } 2355 2356 static CPAccessResult gt_pct_access(CPUARMState *env, 2357 const ARMCPRegInfo *ri, 2358 bool isread) 2359 { 2360 return gt_counter_access(env, GTIMER_PHYS, isread); 2361 } 2362 2363 static CPAccessResult gt_vct_access(CPUARMState *env, 2364 const ARMCPRegInfo *ri, 2365 bool isread) 2366 { 2367 return gt_counter_access(env, GTIMER_VIRT, isread); 2368 } 2369 2370 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2371 bool isread) 2372 { 2373 return gt_timer_access(env, GTIMER_PHYS, isread); 2374 } 2375 2376 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri, 2377 bool isread) 2378 { 2379 return gt_timer_access(env, GTIMER_VIRT, isread); 2380 } 2381 2382 static CPAccessResult gt_stimer_access(CPUARMState *env, 2383 const ARMCPRegInfo *ri, 2384 bool isread) 2385 { 2386 /* 2387 * The AArch64 register view of the secure physical timer is 2388 * always accessible from EL3, and configurably accessible from 2389 * Secure EL1. 2390 */ 2391 switch (arm_current_el(env)) { 2392 case 1: 2393 if (!arm_is_secure(env)) { 2394 return CP_ACCESS_UNDEFINED; 2395 } 2396 if (arm_is_el2_enabled(env)) { 2397 return CP_ACCESS_UNDEFINED; 2398 } 2399 if (!(env->cp15.scr_el3 & SCR_ST)) { 2400 return CP_ACCESS_TRAP_EL3; 2401 } 2402 return CP_ACCESS_OK; 2403 case 0: 2404 case 2: 2405 return CP_ACCESS_UNDEFINED; 2406 case 3: 2407 return CP_ACCESS_OK; 2408 default: 2409 g_assert_not_reached(); 2410 } 2411 } 2412 2413 static CPAccessResult gt_sel2timer_access(CPUARMState *env, 2414 const ARMCPRegInfo *ri, 2415 bool isread) 2416 { 2417 /* 2418 * The AArch64 register view of the secure EL2 timers are mostly 2419 * accessible from EL3 and EL2 although can also be trapped to EL2 2420 * from EL1 depending on nested virt config. 2421 */ 2422 switch (arm_current_el(env)) { 2423 case 0: /* UNDEFINED */ 2424 return CP_ACCESS_UNDEFINED; 2425 case 1: 2426 if (!arm_is_secure(env)) { 2427 /* UNDEFINED */ 2428 return CP_ACCESS_UNDEFINED; 2429 } else if (arm_hcr_el2_eff(env) & HCR_NV) { 2430 /* Aarch64.SystemAccessTrap(EL2, 0x18) */ 2431 return CP_ACCESS_TRAP_EL2; 2432 } 2433 /* UNDEFINED */ 2434 return CP_ACCESS_UNDEFINED; 2435 case 2: 2436 if (!arm_is_secure(env)) { 2437 /* UNDEFINED */ 2438 return CP_ACCESS_UNDEFINED; 2439 } 2440 return CP_ACCESS_OK; 2441 case 3: 2442 if (env->cp15.scr_el3 & SCR_EEL2) { 2443 return CP_ACCESS_OK; 2444 } else { 2445 return CP_ACCESS_UNDEFINED; 2446 } 2447 default: 2448 g_assert_not_reached(); 2449 } 2450 } 2451 2452 uint64_t gt_get_countervalue(CPUARMState *env) 2453 { 2454 ARMCPU *cpu = env_archcpu(env); 2455 2456 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu); 2457 } 2458 2459 static void gt_update_irq(ARMCPU *cpu, int timeridx) 2460 { 2461 CPUARMState *env = &cpu->env; 2462 uint64_t cnthctl = env->cp15.cnthctl_el2; 2463 ARMSecuritySpace ss = arm_security_space(env); 2464 /* ISTATUS && !IMASK */ 2465 int irqstate = (env->cp15.c14_timer[timeridx].ctl & 6) == 4; 2466 2467 /* 2468 * If bit CNTHCTL_EL2.CNT[VP]MASK is set, it overrides IMASK. 2469 * It is RES0 in Secure and NonSecure state. 2470 */ 2471 if ((ss == ARMSS_Root || ss == ARMSS_Realm) && 2472 ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) || 2473 (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) { 2474 irqstate = 0; 2475 } 2476 2477 qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate); 2478 trace_arm_gt_update_irq(timeridx, irqstate); 2479 } 2480 2481 void gt_rme_post_el_change(ARMCPU *cpu, void *ignored) 2482 { 2483 /* 2484 * Changing security state between Root and Secure/NonSecure, which may 2485 * happen when switching EL, can change the effective value of CNTHCTL_EL2 2486 * mask bits. Update the IRQ state accordingly. 2487 */ 2488 gt_update_irq(cpu, GTIMER_VIRT); 2489 gt_update_irq(cpu, GTIMER_PHYS); 2490 } 2491 2492 static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env) 2493 { 2494 if ((env->cp15.scr_el3 & SCR_ECVEN) && 2495 FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) && 2496 arm_is_el2_enabled(env) && 2497 (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 2498 return env->cp15.cntpoff_el2; 2499 } 2500 return 0; 2501 } 2502 2503 static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx) 2504 { 2505 /* 2506 * Return the timer offset to use for indirect accesses to the timer. 2507 * This is the Offset value as defined in D12.2.4.1 "Operation of the 2508 * CompareValue views of the timers". 2509 * 2510 * The condition here is not always the same as the condition for 2511 * whether to apply an offset register when doing a direct read of 2512 * the counter sysreg; those conditions are described in the 2513 * access pseudocode for each counter register. 2514 */ 2515 switch (timeridx) { 2516 case GTIMER_PHYS: 2517 return gt_phys_raw_cnt_offset(env); 2518 case GTIMER_VIRT: 2519 return env->cp15.cntvoff_el2; 2520 case GTIMER_HYP: 2521 case GTIMER_SEC: 2522 case GTIMER_HYPVIRT: 2523 case GTIMER_S_EL2_PHYS: 2524 case GTIMER_S_EL2_VIRT: 2525 return 0; 2526 default: 2527 g_assert_not_reached(); 2528 } 2529 } 2530 2531 uint64_t gt_direct_access_timer_offset(CPUARMState *env, int timeridx) 2532 { 2533 /* 2534 * Return the timer offset to use for direct accesses to the 2535 * counter registers CNTPCT and CNTVCT, and for direct accesses 2536 * to the CNT*_TVAL registers. 2537 * 2538 * This isn't exactly the same as the indirect-access offset, 2539 * because here we also care about what EL the register access 2540 * is being made from. 2541 * 2542 * This corresponds to the access pseudocode for the registers. 2543 */ 2544 uint64_t hcr; 2545 2546 switch (timeridx) { 2547 case GTIMER_PHYS: 2548 if (arm_current_el(env) >= 2) { 2549 return 0; 2550 } 2551 return gt_phys_raw_cnt_offset(env); 2552 case GTIMER_VIRT: 2553 switch (arm_current_el(env)) { 2554 case 2: 2555 hcr = arm_hcr_el2_eff(env); 2556 if (hcr & HCR_E2H) { 2557 return 0; 2558 } 2559 break; 2560 case 0: 2561 hcr = arm_hcr_el2_eff(env); 2562 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 2563 return 0; 2564 } 2565 break; 2566 } 2567 return env->cp15.cntvoff_el2; 2568 case GTIMER_HYP: 2569 case GTIMER_SEC: 2570 case GTIMER_HYPVIRT: 2571 case GTIMER_S_EL2_PHYS: 2572 case GTIMER_S_EL2_VIRT: 2573 return 0; 2574 default: 2575 g_assert_not_reached(); 2576 } 2577 } 2578 2579 static void gt_recalc_timer(ARMCPU *cpu, int timeridx) 2580 { 2581 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx]; 2582 2583 if (gt->ctl & 1) { 2584 /* 2585 * Timer enabled: calculate and set current ISTATUS, irq, and 2586 * reset timer to when ISTATUS next has to change 2587 */ 2588 uint64_t offset = gt_indirect_access_timer_offset(&cpu->env, timeridx); 2589 uint64_t count = gt_get_countervalue(&cpu->env); 2590 /* Note that this must be unsigned 64 bit arithmetic: */ 2591 int istatus = count - offset >= gt->cval; 2592 uint64_t nexttick; 2593 2594 gt->ctl = deposit32(gt->ctl, 2, 1, istatus); 2595 2596 if (istatus) { 2597 /* 2598 * Next transition is when (count - offset) rolls back over to 0. 2599 * If offset > count then this is when count == offset; 2600 * if offset <= count then this is when count == offset + 2^64 2601 * For the latter case we set nexttick to an "as far in future 2602 * as possible" value and let the code below handle it. 2603 */ 2604 if (offset > count) { 2605 nexttick = offset; 2606 } else { 2607 nexttick = UINT64_MAX; 2608 } 2609 } else { 2610 /* 2611 * Next transition is when (count - offset) == cval, i.e. 2612 * when count == (cval + offset). 2613 * If that would overflow, then again we set up the next interrupt 2614 * for "as far in the future as possible" for the code below. 2615 */ 2616 if (uadd64_overflow(gt->cval, offset, &nexttick)) { 2617 nexttick = UINT64_MAX; 2618 } 2619 } 2620 /* 2621 * Note that the desired next expiry time might be beyond the 2622 * signed-64-bit range of a QEMUTimer -- in this case we just 2623 * set the timer for as far in the future as possible. When the 2624 * timer expires we will reset the timer for any remaining period. 2625 */ 2626 if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) { 2627 timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX); 2628 } else { 2629 timer_mod(cpu->gt_timer[timeridx], nexttick); 2630 } 2631 trace_arm_gt_recalc(timeridx, nexttick); 2632 } else { 2633 /* Timer disabled: ISTATUS and timer output always clear */ 2634 gt->ctl &= ~4; 2635 timer_del(cpu->gt_timer[timeridx]); 2636 trace_arm_gt_recalc_disabled(timeridx); 2637 } 2638 gt_update_irq(cpu, timeridx); 2639 } 2640 2641 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri, 2642 int timeridx) 2643 { 2644 ARMCPU *cpu = env_archcpu(env); 2645 2646 timer_del(cpu->gt_timer[timeridx]); 2647 } 2648 2649 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2650 { 2651 uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_PHYS); 2652 return gt_get_countervalue(env) - offset; 2653 } 2654 2655 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 2656 { 2657 uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_VIRT); 2658 return gt_get_countervalue(env) - offset; 2659 } 2660 2661 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2662 int timeridx, 2663 uint64_t value) 2664 { 2665 trace_arm_gt_cval_write(timeridx, value); 2666 env->cp15.c14_timer[timeridx].cval = value; 2667 gt_recalc_timer(env_archcpu(env), timeridx); 2668 } 2669 2670 static uint64_t do_tval_read(CPUARMState *env, int timeridx, uint64_t offset) 2671 { 2672 return (uint32_t)(env->cp15.c14_timer[timeridx].cval - 2673 (gt_get_countervalue(env) - offset)); 2674 } 2675 2676 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri, 2677 int timeridx) 2678 { 2679 uint64_t offset = gt_direct_access_timer_offset(env, timeridx); 2680 2681 return do_tval_read(env, timeridx, offset); 2682 } 2683 2684 static void do_tval_write(CPUARMState *env, int timeridx, uint64_t value, 2685 uint64_t offset) 2686 { 2687 trace_arm_gt_tval_write(timeridx, value); 2688 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset + 2689 sextract64(value, 0, 32); 2690 gt_recalc_timer(env_archcpu(env), timeridx); 2691 } 2692 2693 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2694 int timeridx, 2695 uint64_t value) 2696 { 2697 uint64_t offset = gt_direct_access_timer_offset(env, timeridx); 2698 2699 do_tval_write(env, timeridx, value, offset); 2700 } 2701 2702 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2703 int timeridx, 2704 uint64_t value) 2705 { 2706 ARMCPU *cpu = env_archcpu(env); 2707 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl; 2708 2709 trace_arm_gt_ctl_write(timeridx, value); 2710 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value); 2711 if ((oldval ^ value) & 1) { 2712 /* Enable toggled */ 2713 gt_recalc_timer(cpu, timeridx); 2714 } else if ((oldval ^ value) & 2) { 2715 /* 2716 * IMASK toggled: don't need to recalculate, 2717 * just set the interrupt line based on ISTATUS 2718 */ 2719 trace_arm_gt_imask_toggle(timeridx); 2720 gt_update_irq(cpu, timeridx); 2721 } 2722 } 2723 2724 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2725 { 2726 gt_timer_reset(env, ri, GTIMER_PHYS); 2727 } 2728 2729 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2730 uint64_t value) 2731 { 2732 gt_cval_write(env, ri, GTIMER_PHYS, value); 2733 } 2734 2735 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2736 { 2737 return gt_tval_read(env, ri, GTIMER_PHYS); 2738 } 2739 2740 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2741 uint64_t value) 2742 { 2743 gt_tval_write(env, ri, GTIMER_PHYS, value); 2744 } 2745 2746 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2747 uint64_t value) 2748 { 2749 gt_ctl_write(env, ri, GTIMER_PHYS, value); 2750 } 2751 2752 static int gt_phys_redir_timeridx(CPUARMState *env) 2753 { 2754 switch (arm_mmu_idx(env)) { 2755 case ARMMMUIdx_E20_0: 2756 case ARMMMUIdx_E20_2: 2757 case ARMMMUIdx_E20_2_PAN: 2758 return GTIMER_HYP; 2759 default: 2760 return GTIMER_PHYS; 2761 } 2762 } 2763 2764 static int gt_virt_redir_timeridx(CPUARMState *env) 2765 { 2766 switch (arm_mmu_idx(env)) { 2767 case ARMMMUIdx_E20_0: 2768 case ARMMMUIdx_E20_2: 2769 case ARMMMUIdx_E20_2_PAN: 2770 return GTIMER_HYPVIRT; 2771 default: 2772 return GTIMER_VIRT; 2773 } 2774 } 2775 2776 static uint64_t gt_phys_redir_cval_read(CPUARMState *env, 2777 const ARMCPRegInfo *ri) 2778 { 2779 int timeridx = gt_phys_redir_timeridx(env); 2780 return env->cp15.c14_timer[timeridx].cval; 2781 } 2782 2783 static void gt_phys_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2784 uint64_t value) 2785 { 2786 int timeridx = gt_phys_redir_timeridx(env); 2787 gt_cval_write(env, ri, timeridx, value); 2788 } 2789 2790 static uint64_t gt_phys_redir_tval_read(CPUARMState *env, 2791 const ARMCPRegInfo *ri) 2792 { 2793 int timeridx = gt_phys_redir_timeridx(env); 2794 return gt_tval_read(env, ri, timeridx); 2795 } 2796 2797 static void gt_phys_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2798 uint64_t value) 2799 { 2800 int timeridx = gt_phys_redir_timeridx(env); 2801 gt_tval_write(env, ri, timeridx, value); 2802 } 2803 2804 static uint64_t gt_phys_redir_ctl_read(CPUARMState *env, 2805 const ARMCPRegInfo *ri) 2806 { 2807 int timeridx = gt_phys_redir_timeridx(env); 2808 return env->cp15.c14_timer[timeridx].ctl; 2809 } 2810 2811 static void gt_phys_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2812 uint64_t value) 2813 { 2814 int timeridx = gt_phys_redir_timeridx(env); 2815 gt_ctl_write(env, ri, timeridx, value); 2816 } 2817 2818 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2819 { 2820 gt_timer_reset(env, ri, GTIMER_VIRT); 2821 } 2822 2823 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2824 uint64_t value) 2825 { 2826 gt_cval_write(env, ri, GTIMER_VIRT, value); 2827 } 2828 2829 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2830 { 2831 /* 2832 * This is CNTV_TVAL_EL02; unlike the underlying CNTV_TVAL_EL0 2833 * we always apply CNTVOFF_EL2. Special case that here rather 2834 * than going into the generic gt_tval_read() and then having 2835 * to re-detect that it's this register. 2836 * Note that the accessfn/perms mean we know we're at EL2 or EL3 here. 2837 */ 2838 return do_tval_read(env, GTIMER_VIRT, env->cp15.cntvoff_el2); 2839 } 2840 2841 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2842 uint64_t value) 2843 { 2844 /* Similarly for writes to CNTV_TVAL_EL02 */ 2845 do_tval_write(env, GTIMER_VIRT, value, env->cp15.cntvoff_el2); 2846 } 2847 2848 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2849 uint64_t value) 2850 { 2851 gt_ctl_write(env, ri, GTIMER_VIRT, value); 2852 } 2853 2854 static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2855 uint64_t value) 2856 { 2857 ARMCPU *cpu = env_archcpu(env); 2858 uint32_t oldval = env->cp15.cnthctl_el2; 2859 uint32_t valid_mask = 2860 R_CNTHCTL_EL0PCTEN_E2H1_MASK | 2861 R_CNTHCTL_EL0VCTEN_E2H1_MASK | 2862 R_CNTHCTL_EVNTEN_MASK | 2863 R_CNTHCTL_EVNTDIR_MASK | 2864 R_CNTHCTL_EVNTI_MASK | 2865 R_CNTHCTL_EL0VTEN_MASK | 2866 R_CNTHCTL_EL0PTEN_MASK | 2867 R_CNTHCTL_EL1PCTEN_E2H1_MASK | 2868 R_CNTHCTL_EL1PTEN_MASK; 2869 2870 if (cpu_isar_feature(aa64_rme, cpu)) { 2871 valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK; 2872 } 2873 if (cpu_isar_feature(aa64_ecv_traps, cpu)) { 2874 valid_mask |= 2875 R_CNTHCTL_EL1TVT_MASK | 2876 R_CNTHCTL_EL1TVCT_MASK | 2877 R_CNTHCTL_EL1NVPCT_MASK | 2878 R_CNTHCTL_EL1NVVCT_MASK | 2879 R_CNTHCTL_EVNTIS_MASK; 2880 } 2881 if (cpu_isar_feature(aa64_ecv, cpu)) { 2882 valid_mask |= R_CNTHCTL_ECV_MASK; 2883 } 2884 2885 /* Clear RES0 bits */ 2886 value &= valid_mask; 2887 2888 raw_write(env, ri, value); 2889 2890 if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) { 2891 gt_update_irq(cpu, GTIMER_VIRT); 2892 } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) { 2893 gt_update_irq(cpu, GTIMER_PHYS); 2894 } 2895 } 2896 2897 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 2898 uint64_t value) 2899 { 2900 ARMCPU *cpu = env_archcpu(env); 2901 2902 trace_arm_gt_cntvoff_write(value); 2903 raw_write(env, ri, value); 2904 gt_recalc_timer(cpu, GTIMER_VIRT); 2905 } 2906 2907 static uint64_t gt_virt_redir_cval_read(CPUARMState *env, 2908 const ARMCPRegInfo *ri) 2909 { 2910 int timeridx = gt_virt_redir_timeridx(env); 2911 return env->cp15.c14_timer[timeridx].cval; 2912 } 2913 2914 static void gt_virt_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2915 uint64_t value) 2916 { 2917 int timeridx = gt_virt_redir_timeridx(env); 2918 gt_cval_write(env, ri, timeridx, value); 2919 } 2920 2921 static uint64_t gt_virt_redir_tval_read(CPUARMState *env, 2922 const ARMCPRegInfo *ri) 2923 { 2924 int timeridx = gt_virt_redir_timeridx(env); 2925 return gt_tval_read(env, ri, timeridx); 2926 } 2927 2928 static void gt_virt_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2929 uint64_t value) 2930 { 2931 int timeridx = gt_virt_redir_timeridx(env); 2932 gt_tval_write(env, ri, timeridx, value); 2933 } 2934 2935 static uint64_t gt_virt_redir_ctl_read(CPUARMState *env, 2936 const ARMCPRegInfo *ri) 2937 { 2938 int timeridx = gt_virt_redir_timeridx(env); 2939 return env->cp15.c14_timer[timeridx].ctl; 2940 } 2941 2942 static void gt_virt_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2943 uint64_t value) 2944 { 2945 int timeridx = gt_virt_redir_timeridx(env); 2946 gt_ctl_write(env, ri, timeridx, value); 2947 } 2948 2949 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2950 { 2951 gt_timer_reset(env, ri, GTIMER_HYP); 2952 } 2953 2954 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2955 uint64_t value) 2956 { 2957 gt_cval_write(env, ri, GTIMER_HYP, value); 2958 } 2959 2960 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2961 { 2962 return gt_tval_read(env, ri, GTIMER_HYP); 2963 } 2964 2965 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2966 uint64_t value) 2967 { 2968 gt_tval_write(env, ri, GTIMER_HYP, value); 2969 } 2970 2971 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 2972 uint64_t value) 2973 { 2974 gt_ctl_write(env, ri, GTIMER_HYP, value); 2975 } 2976 2977 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 2978 { 2979 gt_timer_reset(env, ri, GTIMER_SEC); 2980 } 2981 2982 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2983 uint64_t value) 2984 { 2985 gt_cval_write(env, ri, GTIMER_SEC, value); 2986 } 2987 2988 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 2989 { 2990 return gt_tval_read(env, ri, GTIMER_SEC); 2991 } 2992 2993 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 2994 uint64_t value) 2995 { 2996 gt_tval_write(env, ri, GTIMER_SEC, value); 2997 } 2998 2999 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3000 uint64_t value) 3001 { 3002 gt_ctl_write(env, ri, GTIMER_SEC, value); 3003 } 3004 3005 static void gt_sec_pel2_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3006 { 3007 gt_timer_reset(env, ri, GTIMER_S_EL2_PHYS); 3008 } 3009 3010 static void gt_sec_pel2_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3011 uint64_t value) 3012 { 3013 gt_cval_write(env, ri, GTIMER_S_EL2_PHYS, value); 3014 } 3015 3016 static uint64_t gt_sec_pel2_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 3017 { 3018 return gt_tval_read(env, ri, GTIMER_S_EL2_PHYS); 3019 } 3020 3021 static void gt_sec_pel2_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3022 uint64_t value) 3023 { 3024 gt_tval_write(env, ri, GTIMER_S_EL2_PHYS, value); 3025 } 3026 3027 static void gt_sec_pel2_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3028 uint64_t value) 3029 { 3030 gt_ctl_write(env, ri, GTIMER_S_EL2_PHYS, value); 3031 } 3032 3033 static void gt_sec_vel2_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3034 { 3035 gt_timer_reset(env, ri, GTIMER_S_EL2_VIRT); 3036 } 3037 3038 static void gt_sec_vel2_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3039 uint64_t value) 3040 { 3041 gt_cval_write(env, ri, GTIMER_S_EL2_VIRT, value); 3042 } 3043 3044 static uint64_t gt_sec_vel2_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 3045 { 3046 return gt_tval_read(env, ri, GTIMER_S_EL2_VIRT); 3047 } 3048 3049 static void gt_sec_vel2_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3050 uint64_t value) 3051 { 3052 gt_tval_write(env, ri, GTIMER_S_EL2_VIRT, value); 3053 } 3054 3055 static void gt_sec_vel2_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3056 uint64_t value) 3057 { 3058 gt_ctl_write(env, ri, GTIMER_S_EL2_VIRT, value); 3059 } 3060 3061 static void gt_hv_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri) 3062 { 3063 gt_timer_reset(env, ri, GTIMER_HYPVIRT); 3064 } 3065 3066 static void gt_hv_cval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3067 uint64_t value) 3068 { 3069 gt_cval_write(env, ri, GTIMER_HYPVIRT, value); 3070 } 3071 3072 static uint64_t gt_hv_tval_read(CPUARMState *env, const ARMCPRegInfo *ri) 3073 { 3074 return gt_tval_read(env, ri, GTIMER_HYPVIRT); 3075 } 3076 3077 static void gt_hv_tval_write(CPUARMState *env, const ARMCPRegInfo *ri, 3078 uint64_t value) 3079 { 3080 gt_tval_write(env, ri, GTIMER_HYPVIRT, value); 3081 } 3082 3083 static void gt_hv_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri, 3084 uint64_t value) 3085 { 3086 gt_ctl_write(env, ri, GTIMER_HYPVIRT, value); 3087 } 3088 3089 void arm_gt_ptimer_cb(void *opaque) 3090 { 3091 ARMCPU *cpu = opaque; 3092 3093 gt_recalc_timer(cpu, GTIMER_PHYS); 3094 } 3095 3096 void arm_gt_vtimer_cb(void *opaque) 3097 { 3098 ARMCPU *cpu = opaque; 3099 3100 gt_recalc_timer(cpu, GTIMER_VIRT); 3101 } 3102 3103 void arm_gt_htimer_cb(void *opaque) 3104 { 3105 ARMCPU *cpu = opaque; 3106 3107 gt_recalc_timer(cpu, GTIMER_HYP); 3108 } 3109 3110 void arm_gt_stimer_cb(void *opaque) 3111 { 3112 ARMCPU *cpu = opaque; 3113 3114 gt_recalc_timer(cpu, GTIMER_SEC); 3115 } 3116 3117 void arm_gt_sel2timer_cb(void *opaque) 3118 { 3119 ARMCPU *cpu = opaque; 3120 3121 gt_recalc_timer(cpu, GTIMER_S_EL2_PHYS); 3122 } 3123 3124 void arm_gt_sel2vtimer_cb(void *opaque) 3125 { 3126 ARMCPU *cpu = opaque; 3127 3128 gt_recalc_timer(cpu, GTIMER_S_EL2_VIRT); 3129 } 3130 3131 void arm_gt_hvtimer_cb(void *opaque) 3132 { 3133 ARMCPU *cpu = opaque; 3134 3135 gt_recalc_timer(cpu, GTIMER_HYPVIRT); 3136 } 3137 3138 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 3139 /* 3140 * Note that CNTFRQ is purely reads-as-written for the benefit 3141 * of software; writing it doesn't actually change the timer frequency. 3142 * Our reset value matches the fixed frequency we implement the timer at. 3143 */ 3144 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0, 3145 .type = ARM_CP_ALIAS, 3146 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 3147 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq), 3148 }, 3149 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 3150 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 3151 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access, 3152 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 3153 .resetfn = arm_gt_cntfrq_reset, 3154 }, 3155 /* overall control: mostly access permissions */ 3156 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH, 3157 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0, 3158 .access = PL1_RW, 3159 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl), 3160 .resetvalue = 0, 3161 }, 3162 /* per-timer control */ 3163 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 3164 .secure = ARM_CP_SECSTATE_NS, 3165 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3166 .accessfn = gt_ptimer_access, 3167 .fieldoffset = offsetoflow32(CPUARMState, 3168 cp15.c14_timer[GTIMER_PHYS].ctl), 3169 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3170 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3171 }, 3172 { .name = "CNTP_CTL_S", 3173 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1, 3174 .secure = ARM_CP_SECSTATE_S, 3175 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3176 .accessfn = gt_ptimer_access, 3177 .fieldoffset = offsetoflow32(CPUARMState, 3178 cp15.c14_timer[GTIMER_SEC].ctl), 3179 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3180 }, 3181 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64, 3182 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1, 3183 .type = ARM_CP_IO, .access = PL0_RW, 3184 .accessfn = gt_ptimer_access, 3185 .nv2_redirect_offset = 0x180 | NV2_REDIR_NV1, 3186 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 3187 .resetvalue = 0, 3188 .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read, 3189 .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write, 3190 }, 3191 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1, 3192 .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW, 3193 .accessfn = gt_vtimer_access, 3194 .fieldoffset = offsetoflow32(CPUARMState, 3195 cp15.c14_timer[GTIMER_VIRT].ctl), 3196 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3197 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3198 }, 3199 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64, 3200 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1, 3201 .type = ARM_CP_IO, .access = PL0_RW, 3202 .accessfn = gt_vtimer_access, 3203 .nv2_redirect_offset = 0x170 | NV2_REDIR_NV1, 3204 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 3205 .resetvalue = 0, 3206 .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read, 3207 .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write, 3208 }, 3209 /* TimerValue views: a 32 bit downcounting view of the underlying state */ 3210 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3211 .secure = ARM_CP_SECSTATE_NS, 3212 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3213 .accessfn = gt_ptimer_access, 3214 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3215 }, 3216 { .name = "CNTP_TVAL_S", 3217 .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0, 3218 .secure = ARM_CP_SECSTATE_S, 3219 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3220 .accessfn = gt_ptimer_access, 3221 .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write, 3222 }, 3223 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3224 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0, 3225 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3226 .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset, 3227 .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write, 3228 }, 3229 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0, 3230 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3231 .accessfn = gt_vtimer_access, 3232 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3233 }, 3234 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64, 3235 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0, 3236 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW, 3237 .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset, 3238 .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write, 3239 }, 3240 /* The counter itself */ 3241 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0, 3242 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3243 .accessfn = gt_pct_access, 3244 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 3245 }, 3246 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64, 3247 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1, 3248 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3249 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 3250 }, 3251 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1, 3252 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3253 .accessfn = gt_vct_access, 3254 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 3255 }, 3256 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3257 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3258 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3259 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 3260 }, 3261 /* Comparison value, indicating when the timer goes off */ 3262 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2, 3263 .secure = ARM_CP_SECSTATE_NS, 3264 .access = PL0_RW, 3265 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3266 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3267 .accessfn = gt_ptimer_access, 3268 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3269 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3270 }, 3271 { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2, 3272 .secure = ARM_CP_SECSTATE_S, 3273 .access = PL0_RW, 3274 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3275 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3276 .accessfn = gt_ptimer_access, 3277 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3278 }, 3279 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3280 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2, 3281 .access = PL0_RW, 3282 .type = ARM_CP_IO, 3283 .nv2_redirect_offset = 0x178 | NV2_REDIR_NV1, 3284 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 3285 .resetvalue = 0, .accessfn = gt_ptimer_access, 3286 .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read, 3287 .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write, 3288 }, 3289 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3, 3290 .access = PL0_RW, 3291 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS, 3292 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3293 .accessfn = gt_vtimer_access, 3294 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3295 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3296 }, 3297 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64, 3298 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2, 3299 .access = PL0_RW, 3300 .type = ARM_CP_IO, 3301 .nv2_redirect_offset = 0x168 | NV2_REDIR_NV1, 3302 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 3303 .resetvalue = 0, .accessfn = gt_vtimer_access, 3304 .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read, 3305 .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write, 3306 }, 3307 /* 3308 * Secure timer -- this is actually restricted to only EL3 3309 * and configurably Secure-EL1 via the accessfn. 3310 */ 3311 { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64, 3312 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0, 3313 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW, 3314 .accessfn = gt_stimer_access, 3315 .readfn = gt_sec_tval_read, 3316 .writefn = gt_sec_tval_write, 3317 .resetfn = gt_sec_timer_reset, 3318 }, 3319 { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64, 3320 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1, 3321 .type = ARM_CP_IO, .access = PL1_RW, 3322 .accessfn = gt_stimer_access, 3323 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl), 3324 .resetvalue = 0, 3325 .writefn = gt_sec_ctl_write, .raw_writefn = raw_write, 3326 }, 3327 { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64, 3328 .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2, 3329 .type = ARM_CP_IO, .access = PL1_RW, 3330 .accessfn = gt_stimer_access, 3331 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval), 3332 .writefn = gt_sec_cval_write, .raw_writefn = raw_write, 3333 }, 3334 }; 3335 3336 /* 3337 * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which 3338 * are "self-synchronizing". For QEMU all sysregs are self-synchronizing, 3339 * so our implementations here are identical to the normal registers. 3340 */ 3341 static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = { 3342 { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9, 3343 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3344 .accessfn = gt_vct_access, 3345 .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore, 3346 }, 3347 { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64, 3348 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6, 3349 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3350 .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read, 3351 }, 3352 { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8, 3353 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO, 3354 .accessfn = gt_pct_access, 3355 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore, 3356 }, 3357 { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64, 3358 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5, 3359 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3360 .accessfn = gt_pct_access, .readfn = gt_cnt_read, 3361 }, 3362 }; 3363 3364 static CPAccessResult gt_cntpoff_access(CPUARMState *env, 3365 const ARMCPRegInfo *ri, 3366 bool isread) 3367 { 3368 if (arm_current_el(env) == 2 && arm_feature(env, ARM_FEATURE_EL3) && 3369 !(env->cp15.scr_el3 & SCR_ECVEN)) { 3370 return CP_ACCESS_TRAP_EL3; 3371 } 3372 return CP_ACCESS_OK; 3373 } 3374 3375 static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri, 3376 uint64_t value) 3377 { 3378 ARMCPU *cpu = env_archcpu(env); 3379 3380 trace_arm_gt_cntpoff_write(value); 3381 raw_write(env, ri, value); 3382 gt_recalc_timer(cpu, GTIMER_PHYS); 3383 } 3384 3385 static const ARMCPRegInfo gen_timer_cntpoff_reginfo = { 3386 .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64, 3387 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6, 3388 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 3389 .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write, 3390 .nv2_redirect_offset = 0x1a8, 3391 .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2), 3392 }; 3393 #else 3394 3395 /* 3396 * In user-mode most of the generic timer registers are inaccessible 3397 * however modern kernels (4.12+) allow access to cntvct_el0 3398 */ 3399 3400 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) 3401 { 3402 ARMCPU *cpu = env_archcpu(env); 3403 3404 /* 3405 * Currently we have no support for QEMUTimer in linux-user so we 3406 * can't call gt_get_countervalue(env), instead we directly 3407 * call the lower level functions. 3408 */ 3409 return cpu_get_clock() / gt_cntfrq_period_ns(cpu); 3410 } 3411 3412 static const ARMCPRegInfo generic_timer_cp_reginfo[] = { 3413 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, 3414 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, 3415 .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, 3416 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), 3417 .resetfn = arm_gt_cntfrq_reset, 3418 }, 3419 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64, 3420 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2, 3421 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3422 .readfn = gt_virt_cnt_read, 3423 }, 3424 }; 3425 3426 /* 3427 * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also 3428 * is exposed to userspace by Linux. 3429 */ 3430 static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = { 3431 { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64, 3432 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6, 3433 .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO, 3434 .readfn = gt_virt_cnt_read, 3435 }, 3436 }; 3437 3438 #endif 3439 3440 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3441 { 3442 if (arm_feature(env, ARM_FEATURE_LPAE)) { 3443 raw_write(env, ri, value); 3444 } else if (arm_feature(env, ARM_FEATURE_V7)) { 3445 raw_write(env, ri, value & 0xfffff6ff); 3446 } else { 3447 raw_write(env, ri, value & 0xfffff1ff); 3448 } 3449 } 3450 3451 #ifndef CONFIG_USER_ONLY 3452 /* get_phys_addr() isn't present for user-mode-only targets */ 3453 3454 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, 3455 bool isread) 3456 { 3457 if (ri->opc2 & 4) { 3458 /* 3459 * The ATS12NSO* operations must trap to EL3 or EL2 if executed in 3460 * Secure EL1 (which can only happen if EL3 is AArch64). 3461 * They are simply UNDEF if executed from NS EL1. 3462 * They function normally from EL2 or EL3. 3463 */ 3464 if (arm_current_el(env) == 1) { 3465 if (arm_is_secure_below_el3(env)) { 3466 if (env->cp15.scr_el3 & SCR_EEL2) { 3467 return CP_ACCESS_TRAP_EL2; 3468 } 3469 return CP_ACCESS_TRAP_EL3; 3470 } 3471 return CP_ACCESS_UNDEFINED; 3472 } 3473 } 3474 return CP_ACCESS_OK; 3475 } 3476 3477 #ifdef CONFIG_TCG 3478 static int par_el1_shareability(GetPhysAddrResult *res) 3479 { 3480 /* 3481 * The PAR_EL1.SH field must be 0b10 for Device or Normal-NC 3482 * memory -- see pseudocode PAREncodeShareability(). 3483 */ 3484 if (((res->cacheattrs.attrs & 0xf0) == 0) || 3485 res->cacheattrs.attrs == 0x44 || res->cacheattrs.attrs == 0x40) { 3486 return 2; 3487 } 3488 return res->cacheattrs.shareability; 3489 } 3490 3491 static uint64_t do_ats_write(CPUARMState *env, uint64_t value, 3492 MMUAccessType access_type, ARMMMUIdx mmu_idx, 3493 ARMSecuritySpace ss) 3494 { 3495 bool ret; 3496 uint64_t par64; 3497 bool format64 = false; 3498 ARMMMUFaultInfo fi = {}; 3499 GetPhysAddrResult res = {}; 3500 3501 /* 3502 * I_MXTJT: Granule protection checks are not performed on the final 3503 * address of a successful translation. This is a translation not a 3504 * memory reference, so "memop = none = 0". 3505 */ 3506 ret = get_phys_addr_with_space_nogpc(env, value, access_type, 0, 3507 mmu_idx, ss, &res, &fi); 3508 3509 /* 3510 * ATS operations only do S1 or S1+S2 translations, so we never 3511 * have to deal with the ARMCacheAttrs format for S2 only. 3512 */ 3513 assert(!res.cacheattrs.is_s2_format); 3514 3515 if (ret) { 3516 /* 3517 * Some kinds of translation fault must cause exceptions rather 3518 * than being reported in the PAR. 3519 */ 3520 int current_el = arm_current_el(env); 3521 int target_el; 3522 uint32_t syn, fsr, fsc; 3523 bool take_exc = false; 3524 3525 if (fi.s1ptw && current_el == 1 3526 && arm_mmu_idx_is_stage1_of_2(mmu_idx)) { 3527 /* 3528 * Synchronous stage 2 fault on an access made as part of the 3529 * translation table walk for AT S1E0* or AT S1E1* insn 3530 * executed from NS EL1. If this is a synchronous external abort 3531 * and SCR_EL3.EA == 1, then we take a synchronous external abort 3532 * to EL3. Otherwise the fault is taken as an exception to EL2, 3533 * and HPFAR_EL2 holds the faulting IPA. 3534 */ 3535 if (fi.type == ARMFault_SyncExternalOnWalk && 3536 (env->cp15.scr_el3 & SCR_EA)) { 3537 target_el = 3; 3538 } else { 3539 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4; 3540 if (arm_is_secure_below_el3(env) && fi.s1ns) { 3541 env->cp15.hpfar_el2 |= HPFAR_NS; 3542 } 3543 target_el = 2; 3544 } 3545 take_exc = true; 3546 } else if (fi.type == ARMFault_SyncExternalOnWalk) { 3547 /* 3548 * Synchronous external aborts during a translation table walk 3549 * are taken as Data Abort exceptions. 3550 */ 3551 if (fi.stage2) { 3552 if (current_el == 3) { 3553 target_el = 3; 3554 } else { 3555 target_el = 2; 3556 } 3557 } else { 3558 target_el = exception_target_el(env); 3559 } 3560 take_exc = true; 3561 } 3562 3563 if (take_exc) { 3564 /* Construct FSR and FSC using same logic as arm_deliver_fault() */ 3565 if (target_el == 2 || arm_el_is_aa64(env, target_el) || 3566 arm_s1_regime_using_lpae_format(env, mmu_idx)) { 3567 fsr = arm_fi_to_lfsc(&fi); 3568 fsc = extract32(fsr, 0, 6); 3569 } else { 3570 fsr = arm_fi_to_sfsc(&fi); 3571 fsc = 0x3f; 3572 } 3573 /* 3574 * Report exception with ESR indicating a fault due to a 3575 * translation table walk for a cache maintenance instruction. 3576 */ 3577 syn = syn_data_abort_no_iss(current_el == target_el, 0, 3578 fi.ea, 1, fi.s1ptw, 1, fsc); 3579 env->exception.vaddress = value; 3580 env->exception.fsr = fsr; 3581 raise_exception(env, EXCP_DATA_ABORT, syn, target_el); 3582 } 3583 } 3584 3585 if (is_a64(env)) { 3586 format64 = true; 3587 } else if (arm_feature(env, ARM_FEATURE_LPAE)) { 3588 /* 3589 * ATS1Cxx: 3590 * * TTBCR.EAE determines whether the result is returned using the 3591 * 32-bit or the 64-bit PAR format 3592 * * Instructions executed in Hyp mode always use the 64bit format 3593 * 3594 * ATS1S2NSOxx uses the 64bit format if any of the following is true: 3595 * * The Non-secure TTBCR.EAE bit is set to 1 3596 * * The implementation includes EL2, and the value of HCR.VM is 1 3597 * 3598 * (Note that HCR.DC makes HCR.VM behave as if it is 1.) 3599 * 3600 * ATS1Hx always uses the 64bit format. 3601 */ 3602 format64 = arm_s1_regime_using_lpae_format(env, mmu_idx); 3603 3604 if (arm_feature(env, ARM_FEATURE_EL2)) { 3605 if (mmu_idx == ARMMMUIdx_E10_0 || 3606 mmu_idx == ARMMMUIdx_E10_1 || 3607 mmu_idx == ARMMMUIdx_E10_1_PAN) { 3608 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC); 3609 } else { 3610 format64 |= arm_current_el(env) == 2; 3611 } 3612 } 3613 } 3614 3615 if (format64) { 3616 /* Create a 64-bit PAR */ 3617 par64 = (1 << 11); /* LPAE bit always set */ 3618 if (!ret) { 3619 par64 |= res.f.phys_addr & ~0xfffULL; 3620 if (!res.f.attrs.secure) { 3621 par64 |= (1 << 9); /* NS */ 3622 } 3623 par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */ 3624 par64 |= par_el1_shareability(&res) << 7; /* SH */ 3625 } else { 3626 uint32_t fsr = arm_fi_to_lfsc(&fi); 3627 3628 par64 |= 1; /* F */ 3629 par64 |= (fsr & 0x3f) << 1; /* FS */ 3630 if (fi.stage2) { 3631 par64 |= (1 << 9); /* S */ 3632 } 3633 if (fi.s1ptw) { 3634 par64 |= (1 << 8); /* PTW */ 3635 } 3636 } 3637 } else { 3638 /* 3639 * fsr is a DFSR/IFSR value for the short descriptor 3640 * translation table format (with WnR always clear). 3641 * Convert it to a 32-bit PAR. 3642 */ 3643 if (!ret) { 3644 /* We do not set any attribute bits in the PAR */ 3645 if (res.f.lg_page_size == 24 3646 && arm_feature(env, ARM_FEATURE_V7)) { 3647 par64 = (res.f.phys_addr & 0xff000000) | (1 << 1); 3648 } else { 3649 par64 = res.f.phys_addr & 0xfffff000; 3650 } 3651 if (!res.f.attrs.secure) { 3652 par64 |= (1 << 9); /* NS */ 3653 } 3654 } else { 3655 uint32_t fsr = arm_fi_to_sfsc(&fi); 3656 3657 par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) | 3658 ((fsr & 0xf) << 1) | 1; 3659 } 3660 } 3661 return par64; 3662 } 3663 #endif /* CONFIG_TCG */ 3664 3665 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 3666 { 3667 #ifdef CONFIG_TCG 3668 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3669 uint64_t par64; 3670 ARMMMUIdx mmu_idx; 3671 int el = arm_current_el(env); 3672 ARMSecuritySpace ss = arm_security_space(env); 3673 3674 switch (ri->opc2 & 6) { 3675 case 0: 3676 /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */ 3677 switch (el) { 3678 case 3: 3679 if (ri->crm == 9 && arm_pan_enabled(env)) { 3680 mmu_idx = ARMMMUIdx_E30_3_PAN; 3681 } else { 3682 mmu_idx = ARMMMUIdx_E3; 3683 } 3684 break; 3685 case 2: 3686 g_assert(ss != ARMSS_Secure); /* ARMv8.4-SecEL2 is 64-bit only */ 3687 /* fall through */ 3688 case 1: 3689 if (ri->crm == 9 && arm_pan_enabled(env)) { 3690 mmu_idx = ARMMMUIdx_Stage1_E1_PAN; 3691 } else { 3692 mmu_idx = ARMMMUIdx_Stage1_E1; 3693 } 3694 break; 3695 default: 3696 g_assert_not_reached(); 3697 } 3698 break; 3699 case 2: 3700 /* stage 1 current state PL0: ATS1CUR, ATS1CUW */ 3701 switch (el) { 3702 case 3: 3703 mmu_idx = ARMMMUIdx_E30_0; 3704 break; 3705 case 2: 3706 g_assert(ss != ARMSS_Secure); /* ARMv8.4-SecEL2 is 64-bit only */ 3707 mmu_idx = ARMMMUIdx_Stage1_E0; 3708 break; 3709 case 1: 3710 mmu_idx = ARMMMUIdx_Stage1_E0; 3711 break; 3712 default: 3713 g_assert_not_reached(); 3714 } 3715 break; 3716 case 4: 3717 /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */ 3718 mmu_idx = ARMMMUIdx_E10_1; 3719 ss = ARMSS_NonSecure; 3720 break; 3721 case 6: 3722 /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */ 3723 mmu_idx = ARMMMUIdx_E10_0; 3724 ss = ARMSS_NonSecure; 3725 break; 3726 default: 3727 g_assert_not_reached(); 3728 } 3729 3730 par64 = do_ats_write(env, value, access_type, mmu_idx, ss); 3731 3732 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3733 #else 3734 /* Handled by hardware accelerator. */ 3735 g_assert_not_reached(); 3736 #endif /* CONFIG_TCG */ 3737 } 3738 3739 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, 3740 uint64_t value) 3741 { 3742 #ifdef CONFIG_TCG 3743 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3744 uint64_t par64; 3745 3746 /* There is no SecureEL2 for AArch32. */ 3747 par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2, 3748 ARMSS_NonSecure); 3749 3750 A32_BANKED_CURRENT_REG_SET(env, par, par64); 3751 #else 3752 /* Handled by hardware accelerator. */ 3753 g_assert_not_reached(); 3754 #endif /* CONFIG_TCG */ 3755 } 3756 3757 static CPAccessResult at_e012_access(CPUARMState *env, const ARMCPRegInfo *ri, 3758 bool isread) 3759 { 3760 /* 3761 * R_NYXTL: instruction is UNDEFINED if it applies to an Exception level 3762 * lower than EL3 and the combination SCR_EL3.{NSE,NS} is reserved. This can 3763 * only happen when executing at EL3 because that combination also causes an 3764 * illegal exception return. We don't need to check FEAT_RME either, because 3765 * scr_write() ensures that the NSE bit is not set otherwise. 3766 */ 3767 if ((env->cp15.scr_el3 & (SCR_NSE | SCR_NS)) == SCR_NSE) { 3768 return CP_ACCESS_UNDEFINED; 3769 } 3770 return CP_ACCESS_OK; 3771 } 3772 3773 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, 3774 bool isread) 3775 { 3776 if (arm_current_el(env) == 3 && 3777 !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) { 3778 return CP_ACCESS_UNDEFINED; 3779 } 3780 return at_e012_access(env, ri, isread); 3781 } 3782 3783 static CPAccessResult at_s1e01_access(CPUARMState *env, const ARMCPRegInfo *ri, 3784 bool isread) 3785 { 3786 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_AT)) { 3787 return CP_ACCESS_TRAP_EL2; 3788 } 3789 return at_e012_access(env, ri, isread); 3790 } 3791 3792 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, 3793 uint64_t value) 3794 { 3795 #ifdef CONFIG_TCG 3796 MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; 3797 ARMMMUIdx mmu_idx; 3798 uint64_t hcr_el2 = arm_hcr_el2_eff(env); 3799 bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE); 3800 bool for_el3 = false; 3801 ARMSecuritySpace ss; 3802 3803 switch (ri->opc2 & 6) { 3804 case 0: 3805 switch (ri->opc1) { 3806 case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */ 3807 if (ri->crm == 9 && arm_pan_enabled(env)) { 3808 mmu_idx = regime_e20 ? 3809 ARMMMUIdx_E20_2_PAN : ARMMMUIdx_Stage1_E1_PAN; 3810 } else { 3811 mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1; 3812 } 3813 break; 3814 case 4: /* AT S1E2R, AT S1E2W */ 3815 mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2; 3816 break; 3817 case 6: /* AT S1E3R, AT S1E3W */ 3818 mmu_idx = ARMMMUIdx_E3; 3819 for_el3 = true; 3820 break; 3821 default: 3822 g_assert_not_reached(); 3823 } 3824 break; 3825 case 2: /* AT S1E0R, AT S1E0W */ 3826 mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_Stage1_E0; 3827 break; 3828 case 4: /* AT S12E1R, AT S12E1W */ 3829 mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_E10_1; 3830 break; 3831 case 6: /* AT S12E0R, AT S12E0W */ 3832 mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_E10_0; 3833 break; 3834 default: 3835 g_assert_not_reached(); 3836 } 3837 3838 ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env); 3839 env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss); 3840 #else 3841 /* Handled by hardware accelerator. */ 3842 g_assert_not_reached(); 3843 #endif /* CONFIG_TCG */ 3844 } 3845 #endif 3846 3847 /* Return basic MPU access permission bits. */ 3848 static uint32_t simple_mpu_ap_bits(uint32_t val) 3849 { 3850 uint32_t ret; 3851 uint32_t mask; 3852 int i; 3853 ret = 0; 3854 mask = 3; 3855 for (i = 0; i < 16; i += 2) { 3856 ret |= (val >> i) & mask; 3857 mask <<= 2; 3858 } 3859 return ret; 3860 } 3861 3862 /* Pad basic MPU access permission bits to extended format. */ 3863 static uint32_t extended_mpu_ap_bits(uint32_t val) 3864 { 3865 uint32_t ret; 3866 uint32_t mask; 3867 int i; 3868 ret = 0; 3869 mask = 3; 3870 for (i = 0; i < 16; i += 2) { 3871 ret |= (val & mask) << i; 3872 mask <<= 2; 3873 } 3874 return ret; 3875 } 3876 3877 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3878 uint64_t value) 3879 { 3880 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value); 3881 } 3882 3883 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3884 { 3885 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap); 3886 } 3887 3888 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri, 3889 uint64_t value) 3890 { 3891 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value); 3892 } 3893 3894 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri) 3895 { 3896 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap); 3897 } 3898 3899 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri) 3900 { 3901 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3902 3903 if (!u32p) { 3904 return 0; 3905 } 3906 3907 u32p += env->pmsav7.rnr[M_REG_NS]; 3908 return *u32p; 3909 } 3910 3911 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri, 3912 uint64_t value) 3913 { 3914 ARMCPU *cpu = env_archcpu(env); 3915 uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri); 3916 3917 if (!u32p) { 3918 return; 3919 } 3920 3921 u32p += env->pmsav7.rnr[M_REG_NS]; 3922 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3923 *u32p = value; 3924 } 3925 3926 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3927 uint64_t value) 3928 { 3929 ARMCPU *cpu = env_archcpu(env); 3930 uint32_t nrgs = cpu->pmsav7_dregion; 3931 3932 if (value >= nrgs) { 3933 qemu_log_mask(LOG_GUEST_ERROR, 3934 "PMSAv7 RGNR write >= # supported regions, %" PRIu32 3935 " > %" PRIu32 "\n", (uint32_t)value, nrgs); 3936 return; 3937 } 3938 3939 raw_write(env, ri, value); 3940 } 3941 3942 static void prbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3943 uint64_t value) 3944 { 3945 ARMCPU *cpu = env_archcpu(env); 3946 3947 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3948 env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value; 3949 } 3950 3951 static uint64_t prbar_read(CPUARMState *env, const ARMCPRegInfo *ri) 3952 { 3953 return env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]]; 3954 } 3955 3956 static void prlar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3957 uint64_t value) 3958 { 3959 ARMCPU *cpu = env_archcpu(env); 3960 3961 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3962 env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value; 3963 } 3964 3965 static uint64_t prlar_read(CPUARMState *env, const ARMCPRegInfo *ri) 3966 { 3967 return env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]]; 3968 } 3969 3970 static void prselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 3971 uint64_t value) 3972 { 3973 ARMCPU *cpu = env_archcpu(env); 3974 3975 /* 3976 * Ignore writes that would select not implemented region. 3977 * This is architecturally UNPREDICTABLE. 3978 */ 3979 if (value >= cpu->pmsav7_dregion) { 3980 return; 3981 } 3982 3983 env->pmsav7.rnr[M_REG_NS] = value; 3984 } 3985 3986 static void hprbar_write(CPUARMState *env, const ARMCPRegInfo *ri, 3987 uint64_t value) 3988 { 3989 ARMCPU *cpu = env_archcpu(env); 3990 3991 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 3992 env->pmsav8.hprbar[env->pmsav8.hprselr] = value; 3993 } 3994 3995 static uint64_t hprbar_read(CPUARMState *env, const ARMCPRegInfo *ri) 3996 { 3997 return env->pmsav8.hprbar[env->pmsav8.hprselr]; 3998 } 3999 4000 static void hprlar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4001 uint64_t value) 4002 { 4003 ARMCPU *cpu = env_archcpu(env); 4004 4005 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4006 env->pmsav8.hprlar[env->pmsav8.hprselr] = value; 4007 } 4008 4009 static uint64_t hprlar_read(CPUARMState *env, const ARMCPRegInfo *ri) 4010 { 4011 return env->pmsav8.hprlar[env->pmsav8.hprselr]; 4012 } 4013 4014 static void hprenr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4015 uint64_t value) 4016 { 4017 uint32_t n; 4018 uint32_t bit; 4019 ARMCPU *cpu = env_archcpu(env); 4020 4021 /* Ignore writes to unimplemented regions */ 4022 int rmax = MIN(cpu->pmsav8r_hdregion, 32); 4023 value &= MAKE_64BIT_MASK(0, rmax); 4024 4025 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4026 4027 /* Register alias is only valid for first 32 indexes */ 4028 for (n = 0; n < rmax; ++n) { 4029 bit = extract32(value, n, 1); 4030 env->pmsav8.hprlar[n] = deposit32( 4031 env->pmsav8.hprlar[n], 0, 1, bit); 4032 } 4033 } 4034 4035 static uint64_t hprenr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4036 { 4037 uint32_t n; 4038 uint32_t result = 0x0; 4039 ARMCPU *cpu = env_archcpu(env); 4040 4041 /* Register alias is only valid for first 32 indexes */ 4042 for (n = 0; n < MIN(cpu->pmsav8r_hdregion, 32); ++n) { 4043 if (env->pmsav8.hprlar[n] & 0x1) { 4044 result |= (0x1 << n); 4045 } 4046 } 4047 return result; 4048 } 4049 4050 static void hprselr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4051 uint64_t value) 4052 { 4053 ARMCPU *cpu = env_archcpu(env); 4054 4055 /* 4056 * Ignore writes that would select not implemented region. 4057 * This is architecturally UNPREDICTABLE. 4058 */ 4059 if (value >= cpu->pmsav8r_hdregion) { 4060 return; 4061 } 4062 4063 env->pmsav8.hprselr = value; 4064 } 4065 4066 static void pmsav8r_regn_write(CPUARMState *env, const ARMCPRegInfo *ri, 4067 uint64_t value) 4068 { 4069 ARMCPU *cpu = env_archcpu(env); 4070 uint8_t index = (extract32(ri->opc0, 0, 1) << 4) | 4071 (extract32(ri->crm, 0, 3) << 1) | extract32(ri->opc2, 2, 1); 4072 4073 tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */ 4074 4075 if (ri->opc1 & 4) { 4076 if (index >= cpu->pmsav8r_hdregion) { 4077 return; 4078 } 4079 if (ri->opc2 & 0x1) { 4080 env->pmsav8.hprlar[index] = value; 4081 } else { 4082 env->pmsav8.hprbar[index] = value; 4083 } 4084 } else { 4085 if (index >= cpu->pmsav7_dregion) { 4086 return; 4087 } 4088 if (ri->opc2 & 0x1) { 4089 env->pmsav8.rlar[M_REG_NS][index] = value; 4090 } else { 4091 env->pmsav8.rbar[M_REG_NS][index] = value; 4092 } 4093 } 4094 } 4095 4096 static uint64_t pmsav8r_regn_read(CPUARMState *env, const ARMCPRegInfo *ri) 4097 { 4098 ARMCPU *cpu = env_archcpu(env); 4099 uint8_t index = (extract32(ri->opc0, 0, 1) << 4) | 4100 (extract32(ri->crm, 0, 3) << 1) | extract32(ri->opc2, 2, 1); 4101 4102 if (ri->opc1 & 4) { 4103 if (index >= cpu->pmsav8r_hdregion) { 4104 return 0x0; 4105 } 4106 if (ri->opc2 & 0x1) { 4107 return env->pmsav8.hprlar[index]; 4108 } else { 4109 return env->pmsav8.hprbar[index]; 4110 } 4111 } else { 4112 if (index >= cpu->pmsav7_dregion) { 4113 return 0x0; 4114 } 4115 if (ri->opc2 & 0x1) { 4116 return env->pmsav8.rlar[M_REG_NS][index]; 4117 } else { 4118 return env->pmsav8.rbar[M_REG_NS][index]; 4119 } 4120 } 4121 } 4122 4123 static const ARMCPRegInfo pmsav8r_cp_reginfo[] = { 4124 { .name = "PRBAR", 4125 .cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 0, 4126 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4127 .accessfn = access_tvm_trvm, 4128 .readfn = prbar_read, .writefn = prbar_write }, 4129 { .name = "PRLAR", 4130 .cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 1, 4131 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4132 .accessfn = access_tvm_trvm, 4133 .readfn = prlar_read, .writefn = prlar_write }, 4134 { .name = "PRSELR", .resetvalue = 0, 4135 .cp = 15, .opc1 = 0, .crn = 6, .crm = 2, .opc2 = 1, 4136 .access = PL1_RW, .accessfn = access_tvm_trvm, 4137 .writefn = prselr_write, 4138 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]) }, 4139 { .name = "HPRBAR", .resetvalue = 0, 4140 .cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 0, 4141 .access = PL2_RW, .type = ARM_CP_NO_RAW, 4142 .readfn = hprbar_read, .writefn = hprbar_write }, 4143 { .name = "HPRLAR", 4144 .cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 1, 4145 .access = PL2_RW, .type = ARM_CP_NO_RAW, 4146 .readfn = hprlar_read, .writefn = hprlar_write }, 4147 { .name = "HPRSELR", .resetvalue = 0, 4148 .cp = 15, .opc1 = 4, .crn = 6, .crm = 2, .opc2 = 1, 4149 .access = PL2_RW, 4150 .writefn = hprselr_write, 4151 .fieldoffset = offsetof(CPUARMState, pmsav8.hprselr) }, 4152 { .name = "HPRENR", 4153 .cp = 15, .opc1 = 4, .crn = 6, .crm = 1, .opc2 = 1, 4154 .access = PL2_RW, .type = ARM_CP_NO_RAW, 4155 .readfn = hprenr_read, .writefn = hprenr_write }, 4156 }; 4157 4158 static const ARMCPRegInfo pmsav7_cp_reginfo[] = { 4159 /* 4160 * Reset for all these registers is handled in arm_cpu_reset(), 4161 * because the PMSAv7 is also used by M-profile CPUs, which do 4162 * not register cpregs but still need the state to be reset. 4163 */ 4164 { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0, 4165 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4166 .fieldoffset = offsetof(CPUARMState, pmsav7.drbar), 4167 .readfn = pmsav7_read, .writefn = pmsav7_write, 4168 .resetfn = arm_cp_reset_ignore }, 4169 { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2, 4170 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4171 .fieldoffset = offsetof(CPUARMState, pmsav7.drsr), 4172 .readfn = pmsav7_read, .writefn = pmsav7_write, 4173 .resetfn = arm_cp_reset_ignore }, 4174 { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4, 4175 .access = PL1_RW, .type = ARM_CP_NO_RAW, 4176 .fieldoffset = offsetof(CPUARMState, pmsav7.dracr), 4177 .readfn = pmsav7_read, .writefn = pmsav7_write, 4178 .resetfn = arm_cp_reset_ignore }, 4179 { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0, 4180 .access = PL1_RW, 4181 .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]), 4182 .writefn = pmsav7_rgnr_write, 4183 .resetfn = arm_cp_reset_ignore }, 4184 }; 4185 4186 static const ARMCPRegInfo pmsav5_cp_reginfo[] = { 4187 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 4188 .access = PL1_RW, .type = ARM_CP_ALIAS, 4189 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 4190 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, }, 4191 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 4192 .access = PL1_RW, .type = ARM_CP_ALIAS, 4193 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 4194 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, }, 4195 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2, 4196 .access = PL1_RW, 4197 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap), 4198 .resetvalue = 0, }, 4199 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3, 4200 .access = PL1_RW, 4201 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap), 4202 .resetvalue = 0, }, 4203 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, 4204 .access = PL1_RW, 4205 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, }, 4206 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1, 4207 .access = PL1_RW, 4208 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, }, 4209 /* Protection region base and size registers */ 4210 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, 4211 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4212 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) }, 4213 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0, 4214 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4215 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) }, 4216 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0, 4217 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4218 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) }, 4219 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0, 4220 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4221 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) }, 4222 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0, 4223 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4224 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) }, 4225 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0, 4226 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4227 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) }, 4228 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0, 4229 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4230 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) }, 4231 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0, 4232 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0, 4233 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) }, 4234 }; 4235 4236 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4237 uint64_t value) 4238 { 4239 ARMCPU *cpu = env_archcpu(env); 4240 4241 if (!arm_feature(env, ARM_FEATURE_V8)) { 4242 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) { 4243 /* 4244 * Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when 4245 * using Long-descriptor translation table format 4246 */ 4247 value &= ~((7 << 19) | (3 << 14) | (0xf << 3)); 4248 } else if (arm_feature(env, ARM_FEATURE_EL3)) { 4249 /* 4250 * In an implementation that includes the Security Extensions 4251 * TTBCR has additional fields PD0 [4] and PD1 [5] for 4252 * Short-descriptor translation table format. 4253 */ 4254 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N; 4255 } else { 4256 value &= TTBCR_N; 4257 } 4258 } 4259 4260 if (arm_feature(env, ARM_FEATURE_LPAE)) { 4261 /* 4262 * With LPAE the TTBCR could result in a change of ASID 4263 * via the TTBCR.A1 bit, so do a TLB flush. 4264 */ 4265 tlb_flush(CPU(cpu)); 4266 } 4267 raw_write(env, ri, value); 4268 } 4269 4270 static void vmsa_tcr_el12_write(CPUARMState *env, const ARMCPRegInfo *ri, 4271 uint64_t value) 4272 { 4273 ARMCPU *cpu = env_archcpu(env); 4274 4275 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */ 4276 tlb_flush(CPU(cpu)); 4277 raw_write(env, ri, value); 4278 } 4279 4280 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4281 uint64_t value) 4282 { 4283 /* If the ASID changes (with a 64-bit write), we must flush the TLB. */ 4284 if (cpreg_field_is_64bit(ri) && 4285 extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 4286 ARMCPU *cpu = env_archcpu(env); 4287 tlb_flush(CPU(cpu)); 4288 } 4289 raw_write(env, ri, value); 4290 } 4291 4292 static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4293 uint64_t value) 4294 { 4295 /* 4296 * If we are running with E2&0 regime, then an ASID is active. 4297 * Flush if that might be changing. Note we're not checking 4298 * TCR_EL2.A1 to know if this is really the TTBRx_EL2 that 4299 * holds the active ASID, only checking the field that might. 4300 */ 4301 if (extract64(raw_read(env, ri) ^ value, 48, 16) && 4302 (arm_hcr_el2_eff(env) & HCR_E2H)) { 4303 uint16_t mask = ARMMMUIdxBit_E20_2 | 4304 ARMMMUIdxBit_E20_2_PAN | 4305 ARMMMUIdxBit_E20_0; 4306 tlb_flush_by_mmuidx(env_cpu(env), mask); 4307 } 4308 raw_write(env, ri, value); 4309 } 4310 4311 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4312 uint64_t value) 4313 { 4314 ARMCPU *cpu = env_archcpu(env); 4315 CPUState *cs = CPU(cpu); 4316 4317 /* 4318 * A change in VMID to the stage2 page table (Stage2) invalidates 4319 * the stage2 and combined stage 1&2 tlbs (EL10_1 and EL10_0). 4320 */ 4321 if (extract64(raw_read(env, ri) ^ value, 48, 16) != 0) { 4322 tlb_flush_by_mmuidx(cs, alle1_tlbmask(env)); 4323 } 4324 raw_write(env, ri, value); 4325 } 4326 4327 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = { 4328 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0, 4329 .access = PL1_RW, .accessfn = access_tvm_trvm, .type = ARM_CP_ALIAS, 4330 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s), 4331 offsetoflow32(CPUARMState, cp15.dfsr_ns) }, }, 4332 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1, 4333 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 4334 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s), 4335 offsetoflow32(CPUARMState, cp15.ifsr_ns) } }, 4336 { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0, 4337 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 4338 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s), 4339 offsetof(CPUARMState, cp15.dfar_ns) } }, 4340 { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64, 4341 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0, 4342 .access = PL1_RW, .accessfn = access_tvm_trvm, 4343 .fgt = FGT_FAR_EL1, 4344 .nv2_redirect_offset = 0x220 | NV2_REDIR_NV1, 4345 .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]), 4346 .resetvalue = 0, }, 4347 }; 4348 4349 static const ARMCPRegInfo vmsa_cp_reginfo[] = { 4350 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64, 4351 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0, 4352 .access = PL1_RW, .accessfn = access_tvm_trvm, 4353 .fgt = FGT_ESR_EL1, 4354 .nv2_redirect_offset = 0x138 | NV2_REDIR_NV1, 4355 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, }, 4356 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH, 4357 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0, 4358 .access = PL1_RW, .accessfn = access_tvm_trvm, 4359 .fgt = FGT_TTBR0_EL1, 4360 .nv2_redirect_offset = 0x200 | NV2_REDIR_NV1, 4361 .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write, 4362 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 4363 offsetof(CPUARMState, cp15.ttbr0_ns) } }, 4364 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH, 4365 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1, 4366 .access = PL1_RW, .accessfn = access_tvm_trvm, 4367 .fgt = FGT_TTBR1_EL1, 4368 .nv2_redirect_offset = 0x210 | NV2_REDIR_NV1, 4369 .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write, 4370 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 4371 offsetof(CPUARMState, cp15.ttbr1_ns) } }, 4372 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64, 4373 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 4374 .access = PL1_RW, .accessfn = access_tvm_trvm, 4375 .fgt = FGT_TCR_EL1, 4376 .nv2_redirect_offset = 0x120 | NV2_REDIR_NV1, 4377 .writefn = vmsa_tcr_el12_write, 4378 .raw_writefn = raw_write, 4379 .resetvalue = 0, 4380 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) }, 4381 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2, 4382 .access = PL1_RW, .accessfn = access_tvm_trvm, 4383 .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write, 4384 .raw_writefn = raw_write, 4385 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]), 4386 offsetoflow32(CPUARMState, cp15.tcr_el[1])} }, 4387 }; 4388 4389 /* 4390 * Note that unlike TTBCR, writing to TTBCR2 does not require flushing 4391 * qemu tlbs nor adjusting cached masks. 4392 */ 4393 static const ARMCPRegInfo ttbcr2_reginfo = { 4394 .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3, 4395 .access = PL1_RW, .accessfn = access_tvm_trvm, 4396 .type = ARM_CP_ALIAS, 4397 .bank_fieldoffsets = { 4398 offsetofhigh32(CPUARMState, cp15.tcr_el[3]), 4399 offsetofhigh32(CPUARMState, cp15.tcr_el[1]), 4400 }, 4401 }; 4402 4403 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri, 4404 uint64_t value) 4405 { 4406 env->cp15.c15_ticonfig = value & 0xe7; 4407 /* The OS_TYPE bit in this register changes the reported CPUID! */ 4408 env->cp15.c0_cpuid = (value & (1 << 5)) ? 4409 ARM_CPUID_TI915T : ARM_CPUID_TI925T; 4410 } 4411 4412 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri, 4413 uint64_t value) 4414 { 4415 env->cp15.c15_threadid = value & 0xffff; 4416 } 4417 4418 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri, 4419 uint64_t value) 4420 { 4421 /* Wait-for-interrupt (deprecated) */ 4422 cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT); 4423 } 4424 4425 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri, 4426 uint64_t value) 4427 { 4428 /* 4429 * On OMAP there are registers indicating the max/min index of dcache lines 4430 * containing a dirty line; cache flush operations have to reset these. 4431 */ 4432 env->cp15.c15_i_max = 0x000; 4433 env->cp15.c15_i_min = 0xff0; 4434 } 4435 4436 static const ARMCPRegInfo omap_cp_reginfo[] = { 4437 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY, 4438 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE, 4439 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]), 4440 .resetvalue = 0, }, 4441 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, 4442 .access = PL1_RW, .type = ARM_CP_NOP }, 4443 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, 4444 .access = PL1_RW, 4445 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0, 4446 .writefn = omap_ticonfig_write }, 4447 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0, 4448 .access = PL1_RW, 4449 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, }, 4450 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0, 4451 .access = PL1_RW, .resetvalue = 0xff0, 4452 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) }, 4453 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0, 4454 .access = PL1_RW, 4455 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0, 4456 .writefn = omap_threadid_write }, 4457 { .name = "TI925T_STATUS", .cp = 15, .crn = 15, 4458 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 4459 .type = ARM_CP_NO_RAW, 4460 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, }, 4461 /* 4462 * TODO: Peripheral port remap register: 4463 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller 4464 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff), 4465 * when MMU is off. 4466 */ 4467 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY, 4468 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W, 4469 .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW, 4470 .writefn = omap_cachemaint_write }, 4471 { .name = "C9", .cp = 15, .crn = 9, 4472 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, 4473 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 }, 4474 }; 4475 4476 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri, 4477 uint64_t value) 4478 { 4479 env->cp15.c15_cpar = value & 0x3fff; 4480 } 4481 4482 static const ARMCPRegInfo xscale_cp_reginfo[] = { 4483 { .name = "XSCALE_CPAR", 4484 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW, 4485 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0, 4486 .writefn = xscale_cpar_write, }, 4487 { .name = "XSCALE_AUXCR", 4488 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW, 4489 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr), 4490 .resetvalue = 0, }, 4491 /* 4492 * XScale specific cache-lockdown: since we have no cache we NOP these 4493 * and hope the guest does not really rely on cache behaviour. 4494 */ 4495 { .name = "XSCALE_LOCK_ICACHE_LINE", 4496 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0, 4497 .access = PL1_W, .type = ARM_CP_NOP }, 4498 { .name = "XSCALE_UNLOCK_ICACHE", 4499 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1, 4500 .access = PL1_W, .type = ARM_CP_NOP }, 4501 { .name = "XSCALE_DCACHE_LOCK", 4502 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0, 4503 .access = PL1_RW, .type = ARM_CP_NOP }, 4504 { .name = "XSCALE_UNLOCK_DCACHE", 4505 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1, 4506 .access = PL1_W, .type = ARM_CP_NOP }, 4507 }; 4508 4509 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = { 4510 /* 4511 * RAZ/WI the whole crn=15 space, when we don't have a more specific 4512 * implementation of this implementation-defined space. 4513 * Ideally this should eventually disappear in favour of actually 4514 * implementing the correct behaviour for all cores. 4515 */ 4516 { .name = "C15_IMPDEF", .cp = 15, .crn = 15, 4517 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4518 .access = PL1_RW, 4519 .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE, 4520 .resetvalue = 0 }, 4521 }; 4522 4523 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = { 4524 /* Cache status: RAZ because we have no cache so it's always clean */ 4525 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6, 4526 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4527 .resetvalue = 0 }, 4528 }; 4529 4530 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = { 4531 /* We never have a block transfer operation in progress */ 4532 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4, 4533 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4534 .resetvalue = 0 }, 4535 /* The cache ops themselves: these all NOP for QEMU */ 4536 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0, 4537 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4538 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0, 4539 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4540 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0, 4541 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4542 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1, 4543 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4544 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2, 4545 .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4546 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0, 4547 .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT }, 4548 }; 4549 4550 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = { 4551 /* 4552 * The cache test-and-clean instructions always return (1 << 30) 4553 * to indicate that there are no dirty cache lines. 4554 */ 4555 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3, 4556 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4557 .resetvalue = (1 << 30) }, 4558 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3, 4559 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW, 4560 .resetvalue = (1 << 30) }, 4561 }; 4562 4563 static const ARMCPRegInfo strongarm_cp_reginfo[] = { 4564 /* Ignore ReadBuffer accesses */ 4565 { .name = "C9_READBUFFER", .cp = 15, .crn = 9, 4566 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, 4567 .access = PL1_RW, .resetvalue = 0, 4568 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW }, 4569 }; 4570 4571 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4572 { 4573 unsigned int cur_el = arm_current_el(env); 4574 4575 if (arm_is_el2_enabled(env) && cur_el == 1) { 4576 return env->cp15.vpidr_el2; 4577 } 4578 return raw_read(env, ri); 4579 } 4580 4581 static uint64_t mpidr_read_val(CPUARMState *env) 4582 { 4583 ARMCPU *cpu = env_archcpu(env); 4584 uint64_t mpidr = cpu->mp_affinity; 4585 4586 if (arm_feature(env, ARM_FEATURE_V7MP)) { 4587 mpidr |= (1U << 31); 4588 /* 4589 * Cores which are uniprocessor (non-coherent) 4590 * but still implement the MP extensions set 4591 * bit 30. (For instance, Cortex-R5). 4592 */ 4593 if (cpu->mp_is_up) { 4594 mpidr |= (1u << 30); 4595 } 4596 } 4597 return mpidr; 4598 } 4599 4600 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4601 { 4602 unsigned int cur_el = arm_current_el(env); 4603 4604 if (arm_is_el2_enabled(env) && cur_el == 1) { 4605 return env->cp15.vmpidr_el2; 4606 } 4607 return mpidr_read_val(env); 4608 } 4609 4610 static const ARMCPRegInfo lpae_cp_reginfo[] = { 4611 /* NOP AMAIR0/1 */ 4612 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH, 4613 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0, 4614 .access = PL1_RW, .accessfn = access_tvm_trvm, 4615 .fgt = FGT_AMAIR_EL1, 4616 .nv2_redirect_offset = 0x148 | NV2_REDIR_NV1, 4617 .type = ARM_CP_CONST, .resetvalue = 0 }, 4618 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */ 4619 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1, 4620 .access = PL1_RW, .accessfn = access_tvm_trvm, 4621 .type = ARM_CP_CONST, .resetvalue = 0 }, 4622 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0, 4623 .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0, 4624 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s), 4625 offsetof(CPUARMState, cp15.par_ns)} }, 4626 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0, 4627 .access = PL1_RW, .accessfn = access_tvm_trvm, 4628 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4629 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s), 4630 offsetof(CPUARMState, cp15.ttbr0_ns) }, 4631 .writefn = vmsa_ttbr_write, .raw_writefn = raw_write }, 4632 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1, 4633 .access = PL1_RW, .accessfn = access_tvm_trvm, 4634 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 4635 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s), 4636 offsetof(CPUARMState, cp15.ttbr1_ns) }, 4637 .writefn = vmsa_ttbr_write, .raw_writefn = raw_write }, 4638 }; 4639 4640 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4641 { 4642 return vfp_get_fpcr(env); 4643 } 4644 4645 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4646 uint64_t value) 4647 { 4648 vfp_set_fpcr(env, value); 4649 } 4650 4651 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri) 4652 { 4653 return vfp_get_fpsr(env); 4654 } 4655 4656 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4657 uint64_t value) 4658 { 4659 vfp_set_fpsr(env, value); 4660 } 4661 4662 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri, 4663 bool isread) 4664 { 4665 if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UMA)) { 4666 return CP_ACCESS_TRAP_EL1; 4667 } 4668 return CP_ACCESS_OK; 4669 } 4670 4671 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri, 4672 uint64_t value) 4673 { 4674 env->daif = value & PSTATE_DAIF; 4675 } 4676 4677 static uint64_t aa64_pan_read(CPUARMState *env, const ARMCPRegInfo *ri) 4678 { 4679 return env->pstate & PSTATE_PAN; 4680 } 4681 4682 static void aa64_pan_write(CPUARMState *env, const ARMCPRegInfo *ri, 4683 uint64_t value) 4684 { 4685 env->pstate = (env->pstate & ~PSTATE_PAN) | (value & PSTATE_PAN); 4686 } 4687 4688 static const ARMCPRegInfo pan_reginfo = { 4689 .name = "PAN", .state = ARM_CP_STATE_AA64, 4690 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 3, 4691 .type = ARM_CP_NO_RAW, .access = PL1_RW, 4692 .readfn = aa64_pan_read, .writefn = aa64_pan_write 4693 }; 4694 4695 static uint64_t aa64_uao_read(CPUARMState *env, const ARMCPRegInfo *ri) 4696 { 4697 return env->pstate & PSTATE_UAO; 4698 } 4699 4700 static void aa64_uao_write(CPUARMState *env, const ARMCPRegInfo *ri, 4701 uint64_t value) 4702 { 4703 env->pstate = (env->pstate & ~PSTATE_UAO) | (value & PSTATE_UAO); 4704 } 4705 4706 static const ARMCPRegInfo uao_reginfo = { 4707 .name = "UAO", .state = ARM_CP_STATE_AA64, 4708 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 4, 4709 .type = ARM_CP_NO_RAW, .access = PL1_RW, 4710 .readfn = aa64_uao_read, .writefn = aa64_uao_write 4711 }; 4712 4713 static uint64_t aa64_dit_read(CPUARMState *env, const ARMCPRegInfo *ri) 4714 { 4715 return env->pstate & PSTATE_DIT; 4716 } 4717 4718 static void aa64_dit_write(CPUARMState *env, const ARMCPRegInfo *ri, 4719 uint64_t value) 4720 { 4721 env->pstate = (env->pstate & ~PSTATE_DIT) | (value & PSTATE_DIT); 4722 } 4723 4724 static const ARMCPRegInfo dit_reginfo = { 4725 .name = "DIT", .state = ARM_CP_STATE_AA64, 4726 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 5, 4727 .type = ARM_CP_NO_RAW, .access = PL0_RW, 4728 .readfn = aa64_dit_read, .writefn = aa64_dit_write 4729 }; 4730 4731 static uint64_t aa64_ssbs_read(CPUARMState *env, const ARMCPRegInfo *ri) 4732 { 4733 return env->pstate & PSTATE_SSBS; 4734 } 4735 4736 static void aa64_ssbs_write(CPUARMState *env, const ARMCPRegInfo *ri, 4737 uint64_t value) 4738 { 4739 env->pstate = (env->pstate & ~PSTATE_SSBS) | (value & PSTATE_SSBS); 4740 } 4741 4742 static const ARMCPRegInfo ssbs_reginfo = { 4743 .name = "SSBS", .state = ARM_CP_STATE_AA64, 4744 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 6, 4745 .type = ARM_CP_NO_RAW, .access = PL0_RW, 4746 .readfn = aa64_ssbs_read, .writefn = aa64_ssbs_write 4747 }; 4748 4749 static CPAccessResult aa64_cacheop_poc_access(CPUARMState *env, 4750 const ARMCPRegInfo *ri, 4751 bool isread) 4752 { 4753 /* Cache invalidate/clean to Point of Coherency or Persistence... */ 4754 switch (arm_current_el(env)) { 4755 case 0: 4756 /* ... EL0 must trap to EL1 unless SCTLR_EL1.UCI is set. */ 4757 if (!(arm_sctlr(env, 0) & SCTLR_UCI)) { 4758 return CP_ACCESS_TRAP_EL1; 4759 } 4760 /* fall through */ 4761 case 1: 4762 /* ... EL1 must trap to EL2 if HCR_EL2.TPCP is set. */ 4763 if (arm_hcr_el2_eff(env) & HCR_TPCP) { 4764 return CP_ACCESS_TRAP_EL2; 4765 } 4766 break; 4767 } 4768 return CP_ACCESS_OK; 4769 } 4770 4771 static CPAccessResult do_cacheop_pou_access(CPUARMState *env, uint64_t hcrflags) 4772 { 4773 /* Cache invalidate/clean to Point of Unification... */ 4774 switch (arm_current_el(env)) { 4775 case 0: 4776 /* ... EL0 must trap to EL1 unless SCTLR_EL1.UCI is set. */ 4777 if (!(arm_sctlr(env, 0) & SCTLR_UCI)) { 4778 return CP_ACCESS_TRAP_EL1; 4779 } 4780 /* fall through */ 4781 case 1: 4782 /* ... EL1 must trap to EL2 if relevant HCR_EL2 flags are set. */ 4783 if (arm_hcr_el2_eff(env) & hcrflags) { 4784 return CP_ACCESS_TRAP_EL2; 4785 } 4786 break; 4787 } 4788 return CP_ACCESS_OK; 4789 } 4790 4791 static CPAccessResult access_ticab(CPUARMState *env, const ARMCPRegInfo *ri, 4792 bool isread) 4793 { 4794 return do_cacheop_pou_access(env, HCR_TICAB | HCR_TPU); 4795 } 4796 4797 static CPAccessResult access_tocu(CPUARMState *env, const ARMCPRegInfo *ri, 4798 bool isread) 4799 { 4800 return do_cacheop_pou_access(env, HCR_TOCU | HCR_TPU); 4801 } 4802 4803 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri, 4804 bool isread) 4805 { 4806 int cur_el = arm_current_el(env); 4807 4808 if (cur_el < 2) { 4809 uint64_t hcr = arm_hcr_el2_eff(env); 4810 4811 if (cur_el == 0) { 4812 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 4813 if (!(env->cp15.sctlr_el[2] & SCTLR_DZE)) { 4814 return CP_ACCESS_TRAP_EL2; 4815 } 4816 } else { 4817 if (!(env->cp15.sctlr_el[1] & SCTLR_DZE)) { 4818 return CP_ACCESS_TRAP_EL1; 4819 } 4820 if (hcr & HCR_TDZ) { 4821 return CP_ACCESS_TRAP_EL2; 4822 } 4823 } 4824 } else if (hcr & HCR_TDZ) { 4825 return CP_ACCESS_TRAP_EL2; 4826 } 4827 } 4828 return CP_ACCESS_OK; 4829 } 4830 4831 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri) 4832 { 4833 ARMCPU *cpu = env_archcpu(env); 4834 int dzp_bit = 1 << 4; 4835 4836 /* DZP indicates whether DC ZVA access is allowed */ 4837 if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) { 4838 dzp_bit = 0; 4839 } 4840 return cpu->dcz_blocksize | dzp_bit; 4841 } 4842 4843 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 4844 bool isread) 4845 { 4846 if (!(env->pstate & PSTATE_SP)) { 4847 /* 4848 * Access to SP_EL0 is undefined if it's being used as 4849 * the stack pointer. 4850 */ 4851 return CP_ACCESS_UNDEFINED; 4852 } 4853 return CP_ACCESS_OK; 4854 } 4855 4856 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri) 4857 { 4858 return env->pstate & PSTATE_SP; 4859 } 4860 4861 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 4862 { 4863 update_spsel(env, val); 4864 } 4865 4866 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4867 uint64_t value) 4868 { 4869 ARMCPU *cpu = env_archcpu(env); 4870 4871 if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) { 4872 /* M bit is RAZ/WI for PMSA with no MPU implemented */ 4873 value &= ~SCTLR_M; 4874 } 4875 4876 /* ??? Lots of these bits are not implemented. */ 4877 4878 if (ri->state == ARM_CP_STATE_AA64 && !cpu_isar_feature(aa64_mte, cpu)) { 4879 if (ri->opc1 == 6) { /* SCTLR_EL3 */ 4880 value &= ~(SCTLR_ITFSB | SCTLR_TCF | SCTLR_ATA); 4881 } else { 4882 value &= ~(SCTLR_ITFSB | SCTLR_TCF0 | SCTLR_TCF | 4883 SCTLR_ATA0 | SCTLR_ATA); 4884 } 4885 } 4886 4887 if (raw_read(env, ri) == value) { 4888 /* 4889 * Skip the TLB flush if nothing actually changed; Linux likes 4890 * to do a lot of pointless SCTLR writes. 4891 */ 4892 return; 4893 } 4894 4895 raw_write(env, ri, value); 4896 4897 /* This may enable/disable the MMU, so do a TLB flush. */ 4898 tlb_flush(CPU(cpu)); 4899 4900 if (tcg_enabled() && ri->type & ARM_CP_SUPPRESS_TB_END) { 4901 /* 4902 * Normally we would always end the TB on an SCTLR write; see the 4903 * comment in ARMCPRegInfo sctlr initialization below for why Xscale 4904 * is special. Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild 4905 * of hflags from the translator, so do it here. 4906 */ 4907 arm_rebuild_hflags(env); 4908 } 4909 } 4910 4911 static void mdcr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri, 4912 uint64_t value) 4913 { 4914 /* 4915 * Some MDCR_EL3 bits affect whether PMU counters are running: 4916 * if we are trying to change any of those then we must 4917 * bracket this update with PMU start/finish calls. 4918 */ 4919 bool pmu_op = (env->cp15.mdcr_el3 ^ value) & MDCR_EL3_PMU_ENABLE_BITS; 4920 4921 if (pmu_op) { 4922 pmu_op_start(env); 4923 } 4924 env->cp15.mdcr_el3 = value; 4925 if (pmu_op) { 4926 pmu_op_finish(env); 4927 } 4928 } 4929 4930 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 4931 uint64_t value) 4932 { 4933 /* Not all bits defined for MDCR_EL3 exist in the AArch32 SDCR */ 4934 mdcr_el3_write(env, ri, value & SDCR_VALID_MASK); 4935 } 4936 4937 static void mdcr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 4938 uint64_t value) 4939 { 4940 /* 4941 * Some MDCR_EL2 bits affect whether PMU counters are running: 4942 * if we are trying to change any of those then we must 4943 * bracket this update with PMU start/finish calls. 4944 */ 4945 bool pmu_op = (env->cp15.mdcr_el2 ^ value) & MDCR_EL2_PMU_ENABLE_BITS; 4946 4947 if (pmu_op) { 4948 pmu_op_start(env); 4949 } 4950 env->cp15.mdcr_el2 = value; 4951 if (pmu_op) { 4952 pmu_op_finish(env); 4953 } 4954 } 4955 4956 static CPAccessResult access_nv1(CPUARMState *env, const ARMCPRegInfo *ri, 4957 bool isread) 4958 { 4959 if (arm_current_el(env) == 1) { 4960 uint64_t hcr_nv = arm_hcr_el2_eff(env) & (HCR_NV | HCR_NV1 | HCR_NV2); 4961 4962 if (hcr_nv == (HCR_NV | HCR_NV1)) { 4963 return CP_ACCESS_TRAP_EL2; 4964 } 4965 } 4966 return CP_ACCESS_OK; 4967 } 4968 4969 #ifdef CONFIG_USER_ONLY 4970 /* 4971 * `IC IVAU` is handled to improve compatibility with JITs that dual-map their 4972 * code to get around W^X restrictions, where one region is writable and the 4973 * other is executable. 4974 * 4975 * Since the executable region is never written to we cannot detect code 4976 * changes when running in user mode, and rely on the emulated JIT telling us 4977 * that the code has changed by executing this instruction. 4978 */ 4979 static void ic_ivau_write(CPUARMState *env, const ARMCPRegInfo *ri, 4980 uint64_t value) 4981 { 4982 uint64_t icache_line_mask, start_address, end_address; 4983 const ARMCPU *cpu; 4984 4985 cpu = env_archcpu(env); 4986 4987 icache_line_mask = (4 << extract32(cpu->ctr, 0, 4)) - 1; 4988 start_address = value & ~icache_line_mask; 4989 end_address = value | icache_line_mask; 4990 4991 mmap_lock(); 4992 4993 tb_invalidate_phys_range(env_cpu(env), start_address, end_address); 4994 4995 mmap_unlock(); 4996 } 4997 #endif 4998 4999 static const ARMCPRegInfo v8_cp_reginfo[] = { 5000 /* 5001 * Minimal set of EL0-visible registers. This will need to be expanded 5002 * significantly for system emulation of AArch64 CPUs. 5003 */ 5004 { .name = "NZCV", .state = ARM_CP_STATE_AA64, 5005 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2, 5006 .access = PL0_RW, .type = ARM_CP_NZCV }, 5007 { .name = "DAIF", .state = ARM_CP_STATE_AA64, 5008 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2, 5009 .type = ARM_CP_NO_RAW, 5010 .access = PL0_RW, .accessfn = aa64_daif_access, 5011 .fieldoffset = offsetof(CPUARMState, daif), 5012 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore }, 5013 { .name = "FPCR", .state = ARM_CP_STATE_AA64, 5014 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4, 5015 .access = PL0_RW, .type = ARM_CP_FPU, 5016 .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write }, 5017 { .name = "FPSR", .state = ARM_CP_STATE_AA64, 5018 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4, 5019 .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END, 5020 .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write }, 5021 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64, 5022 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0, 5023 .access = PL0_R, .type = ARM_CP_NO_RAW, 5024 .fgt = FGT_DCZID_EL0, 5025 .readfn = aa64_dczid_read }, 5026 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64, 5027 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1, 5028 .access = PL0_W, .type = ARM_CP_DC_ZVA, 5029 #ifndef CONFIG_USER_ONLY 5030 /* Avoid overhead of an access check that always passes in user-mode */ 5031 .accessfn = aa64_zva_access, 5032 .fgt = FGT_DCZVA, 5033 #endif 5034 }, 5035 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64, 5036 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2, 5037 .access = PL1_R, .type = ARM_CP_CURRENTEL }, 5038 /* 5039 * Instruction cache ops. All of these except `IC IVAU` NOP because we 5040 * don't emulate caches. 5041 */ 5042 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64, 5043 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 5044 .access = PL1_W, .type = ARM_CP_NOP, 5045 .fgt = FGT_ICIALLUIS, 5046 .accessfn = access_ticab }, 5047 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64, 5048 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 5049 .access = PL1_W, .type = ARM_CP_NOP, 5050 .fgt = FGT_ICIALLU, 5051 .accessfn = access_tocu }, 5052 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64, 5053 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1, 5054 .access = PL0_W, 5055 .fgt = FGT_ICIVAU, 5056 .accessfn = access_tocu, 5057 #ifdef CONFIG_USER_ONLY 5058 .type = ARM_CP_NO_RAW, 5059 .writefn = ic_ivau_write 5060 #else 5061 .type = ARM_CP_NOP 5062 #endif 5063 }, 5064 /* Cache ops: all NOPs since we don't emulate caches */ 5065 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64, 5066 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 5067 .access = PL1_W, .accessfn = aa64_cacheop_poc_access, 5068 .fgt = FGT_DCIVAC, 5069 .type = ARM_CP_NOP }, 5070 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64, 5071 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 5072 .fgt = FGT_DCISW, 5073 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5074 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64, 5075 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1, 5076 .access = PL0_W, .type = ARM_CP_NOP, 5077 .fgt = FGT_DCCVAC, 5078 .accessfn = aa64_cacheop_poc_access }, 5079 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64, 5080 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 5081 .fgt = FGT_DCCSW, 5082 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5083 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64, 5084 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1, 5085 .access = PL0_W, .type = ARM_CP_NOP, 5086 .fgt = FGT_DCCVAU, 5087 .accessfn = access_tocu }, 5088 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64, 5089 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1, 5090 .access = PL0_W, .type = ARM_CP_NOP, 5091 .fgt = FGT_DCCIVAC, 5092 .accessfn = aa64_cacheop_poc_access }, 5093 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64, 5094 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 5095 .fgt = FGT_DCCISW, 5096 .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP }, 5097 #ifndef CONFIG_USER_ONLY 5098 /* 64 bit address translation operations */ 5099 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64, 5100 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0, 5101 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5102 .fgt = FGT_ATS1E1R, 5103 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 5104 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64, 5105 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1, 5106 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5107 .fgt = FGT_ATS1E1W, 5108 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 5109 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64, 5110 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2, 5111 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5112 .fgt = FGT_ATS1E0R, 5113 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 5114 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64, 5115 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3, 5116 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5117 .fgt = FGT_ATS1E0W, 5118 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 5119 { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64, 5120 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4, 5121 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5122 .accessfn = at_e012_access, .writefn = ats_write64 }, 5123 { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64, 5124 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5, 5125 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5126 .accessfn = at_e012_access, .writefn = ats_write64 }, 5127 { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64, 5128 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6, 5129 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5130 .accessfn = at_e012_access, .writefn = ats_write64 }, 5131 { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64, 5132 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7, 5133 .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5134 .accessfn = at_e012_access, .writefn = ats_write64 }, 5135 /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */ 5136 { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64, 5137 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0, 5138 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5139 .writefn = ats_write64 }, 5140 { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64, 5141 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1, 5142 .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 5143 .writefn = ats_write64 }, 5144 { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64, 5145 .type = ARM_CP_ALIAS, 5146 .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0, 5147 .access = PL1_RW, .resetvalue = 0, 5148 .fgt = FGT_PAR_EL1, 5149 .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]), 5150 .writefn = par_write }, 5151 #endif 5152 /* 32 bit cache operations */ 5153 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0, 5154 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_ticab }, 5155 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6, 5156 .type = ARM_CP_NOP, .access = PL1_W }, 5157 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0, 5158 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5159 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1, 5160 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5161 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6, 5162 .type = ARM_CP_NOP, .access = PL1_W }, 5163 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7, 5164 .type = ARM_CP_NOP, .access = PL1_W }, 5165 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1, 5166 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5167 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2, 5168 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5169 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1, 5170 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5171 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2, 5172 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5173 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1, 5174 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu }, 5175 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1, 5176 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access }, 5177 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2, 5178 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 5179 /* MMU Domain access control / MPU write buffer control */ 5180 { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0, 5181 .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0, 5182 .writefn = dacr_write, .raw_writefn = raw_write, 5183 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s), 5184 offsetoflow32(CPUARMState, cp15.dacr_ns) } }, 5185 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64, 5186 .type = ARM_CP_ALIAS, 5187 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1, 5188 .access = PL1_RW, .accessfn = access_nv1, 5189 .nv2_redirect_offset = 0x230 | NV2_REDIR_NV1, 5190 .fieldoffset = offsetof(CPUARMState, elr_el[1]) }, 5191 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64, 5192 .type = ARM_CP_ALIAS, 5193 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0, 5194 .access = PL1_RW, .accessfn = access_nv1, 5195 .nv2_redirect_offset = 0x160 | NV2_REDIR_NV1, 5196 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) }, 5197 /* 5198 * We rely on the access checks not allowing the guest to write to the 5199 * state field when SPSel indicates that it's being used as the stack 5200 * pointer. 5201 */ 5202 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64, 5203 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0, 5204 .access = PL1_RW, .accessfn = sp_el0_access, 5205 .type = ARM_CP_ALIAS, 5206 .fieldoffset = offsetof(CPUARMState, sp_el[0]) }, 5207 { .name = "SP_EL1", .state = ARM_CP_STATE_AA64, 5208 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0, 5209 .nv2_redirect_offset = 0x240, 5210 .access = PL2_RW, .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_KEEP, 5211 .fieldoffset = offsetof(CPUARMState, sp_el[1]) }, 5212 { .name = "SPSel", .state = ARM_CP_STATE_AA64, 5213 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0, 5214 .type = ARM_CP_NO_RAW, 5215 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write }, 5216 { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64, 5217 .type = ARM_CP_ALIAS, 5218 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0, 5219 .access = PL2_RW, 5220 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) }, 5221 { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64, 5222 .type = ARM_CP_ALIAS, 5223 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1, 5224 .access = PL2_RW, 5225 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) }, 5226 { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64, 5227 .type = ARM_CP_ALIAS, 5228 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2, 5229 .access = PL2_RW, 5230 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) }, 5231 { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64, 5232 .type = ARM_CP_ALIAS, 5233 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3, 5234 .access = PL2_RW, 5235 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) }, 5236 { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64, 5237 .type = ARM_CP_IO, 5238 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1, 5239 .resetvalue = 0, 5240 .access = PL3_RW, 5241 .writefn = mdcr_el3_write, 5242 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) }, 5243 { .name = "SDCR", .type = ARM_CP_ALIAS | ARM_CP_IO, 5244 .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1, 5245 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5246 .writefn = sdcr_write, 5247 .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) }, 5248 }; 5249 5250 /* These are present only when EL1 supports AArch32 */ 5251 static const ARMCPRegInfo v8_aa32_el1_reginfo[] = { 5252 { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64, 5253 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0, 5254 .access = PL2_RW, 5255 .type = ARM_CP_ALIAS | ARM_CP_FPU | ARM_CP_EL3_NO_EL2_KEEP, 5256 .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]) }, 5257 { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64, 5258 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0, 5259 .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP, 5260 .writefn = dacr_write, .raw_writefn = raw_write, 5261 .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) }, 5262 { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64, 5263 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1, 5264 .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP, 5265 .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) }, 5266 }; 5267 5268 static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask) 5269 { 5270 ARMCPU *cpu = env_archcpu(env); 5271 5272 if (arm_feature(env, ARM_FEATURE_V8)) { 5273 valid_mask |= MAKE_64BIT_MASK(0, 34); /* ARMv8.0 */ 5274 } else { 5275 valid_mask |= MAKE_64BIT_MASK(0, 28); /* ARMv7VE */ 5276 } 5277 5278 if (arm_feature(env, ARM_FEATURE_EL3)) { 5279 valid_mask &= ~HCR_HCD; 5280 } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) { 5281 /* 5282 * Architecturally HCR.TSC is RES0 if EL3 is not implemented. 5283 * However, if we're using the SMC PSCI conduit then QEMU is 5284 * effectively acting like EL3 firmware and so the guest at 5285 * EL2 should retain the ability to prevent EL1 from being 5286 * able to make SMC calls into the ersatz firmware, so in 5287 * that case HCR.TSC should be read/write. 5288 */ 5289 valid_mask &= ~HCR_TSC; 5290 } 5291 5292 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 5293 if (cpu_isar_feature(aa64_vh, cpu)) { 5294 valid_mask |= HCR_E2H; 5295 } 5296 if (cpu_isar_feature(aa64_ras, cpu)) { 5297 valid_mask |= HCR_TERR | HCR_TEA; 5298 } 5299 if (cpu_isar_feature(aa64_lor, cpu)) { 5300 valid_mask |= HCR_TLOR; 5301 } 5302 if (cpu_isar_feature(aa64_pauth, cpu)) { 5303 valid_mask |= HCR_API | HCR_APK; 5304 } 5305 if (cpu_isar_feature(aa64_mte, cpu)) { 5306 valid_mask |= HCR_ATA | HCR_DCT | HCR_TID5; 5307 } 5308 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 5309 valid_mask |= HCR_ENSCXT; 5310 } 5311 if (cpu_isar_feature(aa64_fwb, cpu)) { 5312 valid_mask |= HCR_FWB; 5313 } 5314 if (cpu_isar_feature(aa64_rme, cpu)) { 5315 valid_mask |= HCR_GPF; 5316 } 5317 if (cpu_isar_feature(aa64_nv, cpu)) { 5318 valid_mask |= HCR_NV | HCR_NV1 | HCR_AT; 5319 } 5320 if (cpu_isar_feature(aa64_nv2, cpu)) { 5321 valid_mask |= HCR_NV2; 5322 } 5323 } 5324 5325 if (cpu_isar_feature(any_evt, cpu)) { 5326 valid_mask |= HCR_TTLBIS | HCR_TTLBOS | HCR_TICAB | HCR_TOCU | HCR_TID4; 5327 } else if (cpu_isar_feature(any_half_evt, cpu)) { 5328 valid_mask |= HCR_TICAB | HCR_TOCU | HCR_TID4; 5329 } 5330 5331 /* Clear RES0 bits. */ 5332 value &= valid_mask; 5333 5334 /* RW is RAO/WI if EL1 is AArch64 only */ 5335 if (!cpu_isar_feature(aa64_aa32_el1, cpu)) { 5336 value |= HCR_RW; 5337 } 5338 5339 /* 5340 * These bits change the MMU setup: 5341 * HCR_VM enables stage 2 translation 5342 * HCR_PTW forbids certain page-table setups 5343 * HCR_DC disables stage1 and enables stage2 translation 5344 * HCR_DCT enables tagging on (disabled) stage1 translation 5345 * HCR_FWB changes the interpretation of stage2 descriptor bits 5346 * HCR_NV and HCR_NV1 affect interpretation of descriptor bits 5347 */ 5348 if ((env->cp15.hcr_el2 ^ value) & 5349 (HCR_VM | HCR_PTW | HCR_DC | HCR_DCT | HCR_FWB | HCR_NV | HCR_NV1)) { 5350 tlb_flush(CPU(cpu)); 5351 } 5352 env->cp15.hcr_el2 = value; 5353 5354 /* 5355 * Updates to VI and VF require us to update the status of 5356 * virtual interrupts, which are the logical OR of these bits 5357 * and the state of the input lines from the GIC. (This requires 5358 * that we have the BQL, which is done by marking the 5359 * reginfo structs as ARM_CP_IO.) 5360 * Note that if a write to HCR pends a VIRQ or VFIQ or VINMI or 5361 * VFNMI, it is never possible for it to be taken immediately 5362 * because VIRQ, VFIQ, VINMI and VFNMI are masked unless running 5363 * at EL0 or EL1, and HCR can only be written at EL2. 5364 */ 5365 g_assert(bql_locked()); 5366 arm_cpu_update_virq(cpu); 5367 arm_cpu_update_vfiq(cpu); 5368 arm_cpu_update_vserr(cpu); 5369 if (cpu_isar_feature(aa64_nmi, cpu)) { 5370 arm_cpu_update_vinmi(cpu); 5371 arm_cpu_update_vfnmi(cpu); 5372 } 5373 } 5374 5375 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) 5376 { 5377 do_hcr_write(env, value, 0); 5378 } 5379 5380 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri, 5381 uint64_t value) 5382 { 5383 /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */ 5384 value = deposit64(env->cp15.hcr_el2, 32, 32, value); 5385 do_hcr_write(env, value, MAKE_64BIT_MASK(0, 32)); 5386 } 5387 5388 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri, 5389 uint64_t value) 5390 { 5391 /* Handle HCR write, i.e. write to low half of HCR_EL2 */ 5392 value = deposit64(env->cp15.hcr_el2, 0, 32, value); 5393 do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32)); 5394 } 5395 5396 static void hcr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 5397 { 5398 /* hcr_write will set the RES1 bits on an AArch64-only CPU */ 5399 hcr_write(env, ri, 0); 5400 } 5401 5402 /* 5403 * Return the effective value of HCR_EL2, at the given security state. 5404 * Bits that are not included here: 5405 * RW (read from SCR_EL3.RW as needed) 5406 */ 5407 uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space) 5408 { 5409 uint64_t ret = env->cp15.hcr_el2; 5410 5411 assert(space != ARMSS_Root); 5412 5413 if (!arm_is_el2_enabled_secstate(env, space)) { 5414 /* 5415 * "This register has no effect if EL2 is not enabled in the 5416 * current Security state". This is ARMv8.4-SecEL2 speak for 5417 * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1). 5418 * 5419 * Prior to that, the language was "In an implementation that 5420 * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves 5421 * as if this field is 0 for all purposes other than a direct 5422 * read or write access of HCR_EL2". With lots of enumeration 5423 * on a per-field basis. In current QEMU, this is condition 5424 * is arm_is_secure_below_el3. 5425 * 5426 * Since the v8.4 language applies to the entire register, and 5427 * appears to be backward compatible, use that. 5428 */ 5429 return 0; 5430 } 5431 5432 /* 5433 * For a cpu that supports both aarch64 and aarch32, we can set bits 5434 * in HCR_EL2 (e.g. via EL3) that are RES0 when we enter EL2 as aa32. 5435 * Ignore all of the bits in HCR+HCR2 that are not valid for aarch32. 5436 */ 5437 if (!arm_el_is_aa64(env, 2)) { 5438 uint64_t aa32_valid; 5439 5440 /* 5441 * These bits are up-to-date as of ARMv8.6. 5442 * For HCR, it's easiest to list just the 2 bits that are invalid. 5443 * For HCR2, list those that are valid. 5444 */ 5445 aa32_valid = MAKE_64BIT_MASK(0, 32) & ~(HCR_RW | HCR_TDZ); 5446 aa32_valid |= (HCR_CD | HCR_ID | HCR_TERR | HCR_TEA | HCR_MIOCNCE | 5447 HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_TTLBIS); 5448 ret &= aa32_valid; 5449 } 5450 5451 if (ret & HCR_TGE) { 5452 /* These bits are up-to-date as of ARMv8.6. */ 5453 if (ret & HCR_E2H) { 5454 ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO | 5455 HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE | 5456 HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU | 5457 HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE | 5458 HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_ENSCXT | 5459 HCR_TTLBIS | HCR_TTLBOS | HCR_TID5); 5460 } else { 5461 ret |= HCR_FMO | HCR_IMO | HCR_AMO; 5462 } 5463 ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE | 5464 HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR | 5465 HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM | 5466 HCR_TLOR); 5467 } 5468 5469 return ret; 5470 } 5471 5472 uint64_t arm_hcr_el2_eff(CPUARMState *env) 5473 { 5474 if (arm_feature(env, ARM_FEATURE_M)) { 5475 return 0; 5476 } 5477 return arm_hcr_el2_eff_secstate(env, arm_security_space_below_el3(env)); 5478 } 5479 5480 /* 5481 * Corresponds to ARM pseudocode function ELIsInHost(). 5482 */ 5483 bool el_is_in_host(CPUARMState *env, int el) 5484 { 5485 uint64_t mask; 5486 5487 /* 5488 * Since we only care about E2H and TGE, we can skip arm_hcr_el2_eff(). 5489 * Perform the simplest bit tests first, and validate EL2 afterward. 5490 */ 5491 if (el & 1) { 5492 return false; /* EL1 or EL3 */ 5493 } 5494 5495 /* 5496 * Note that hcr_write() checks isar_feature_aa64_vh(), 5497 * aka HaveVirtHostExt(), in allowing HCR_E2H to be set. 5498 */ 5499 mask = el ? HCR_E2H : HCR_E2H | HCR_TGE; 5500 if ((env->cp15.hcr_el2 & mask) != mask) { 5501 return false; 5502 } 5503 5504 /* TGE and/or E2H set: double check those bits are currently legal. */ 5505 return arm_is_el2_enabled(env) && arm_el_is_aa64(env, 2); 5506 } 5507 5508 static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri, 5509 uint64_t value) 5510 { 5511 ARMCPU *cpu = env_archcpu(env); 5512 uint64_t valid_mask = 0; 5513 5514 /* FEAT_MOPS adds MSCEn and MCE2 */ 5515 if (cpu_isar_feature(aa64_mops, cpu)) { 5516 valid_mask |= HCRX_MSCEN | HCRX_MCE2; 5517 } 5518 5519 /* FEAT_NMI adds TALLINT, VINMI and VFNMI */ 5520 if (cpu_isar_feature(aa64_nmi, cpu)) { 5521 valid_mask |= HCRX_TALLINT | HCRX_VINMI | HCRX_VFNMI; 5522 } 5523 /* FEAT_CMOW adds CMOW */ 5524 if (cpu_isar_feature(aa64_cmow, cpu)) { 5525 valid_mask |= HCRX_CMOW; 5526 } 5527 /* FEAT_XS adds FGTnXS, FnXS */ 5528 if (cpu_isar_feature(aa64_xs, cpu)) { 5529 valid_mask |= HCRX_FGTNXS | HCRX_FNXS; 5530 } 5531 5532 /* Clear RES0 bits. */ 5533 env->cp15.hcrx_el2 = value & valid_mask; 5534 5535 /* 5536 * Updates to VINMI and VFNMI require us to update the status of 5537 * virtual NMI, which are the logical OR of these bits 5538 * and the state of the input lines from the GIC. (This requires 5539 * that we have the BQL, which is done by marking the 5540 * reginfo structs as ARM_CP_IO.) 5541 * Note that if a write to HCRX pends a VINMI or VFNMI it is never 5542 * possible for it to be taken immediately, because VINMI and 5543 * VFNMI are masked unless running at EL0 or EL1, and HCRX 5544 * can only be written at EL2. 5545 */ 5546 if (cpu_isar_feature(aa64_nmi, cpu)) { 5547 g_assert(bql_locked()); 5548 arm_cpu_update_vinmi(cpu); 5549 arm_cpu_update_vfnmi(cpu); 5550 } 5551 } 5552 5553 static CPAccessResult access_hxen(CPUARMState *env, const ARMCPRegInfo *ri, 5554 bool isread) 5555 { 5556 if (arm_current_el(env) == 2 5557 && arm_feature(env, ARM_FEATURE_EL3) 5558 && !(env->cp15.scr_el3 & SCR_HXEN)) { 5559 return CP_ACCESS_TRAP_EL3; 5560 } 5561 return CP_ACCESS_OK; 5562 } 5563 5564 static const ARMCPRegInfo hcrx_el2_reginfo = { 5565 .name = "HCRX_EL2", .state = ARM_CP_STATE_AA64, 5566 .type = ARM_CP_IO, 5567 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 2, 5568 .access = PL2_RW, .writefn = hcrx_write, .accessfn = access_hxen, 5569 .nv2_redirect_offset = 0xa0, 5570 .fieldoffset = offsetof(CPUARMState, cp15.hcrx_el2), 5571 }; 5572 5573 /* Return the effective value of HCRX_EL2. */ 5574 uint64_t arm_hcrx_el2_eff(CPUARMState *env) 5575 { 5576 /* 5577 * The bits in this register behave as 0 for all purposes other than 5578 * direct reads of the register if SCR_EL3.HXEn is 0. 5579 * If EL2 is not enabled in the current security state, then the 5580 * bit may behave as if 0, or as if 1, depending on the bit. 5581 * For the moment, we treat the EL2-disabled case as taking 5582 * priority over the HXEn-disabled case. This is true for the only 5583 * bit for a feature which we implement where the answer is different 5584 * for the two cases (MSCEn for FEAT_MOPS). 5585 * This may need to be revisited for future bits. 5586 */ 5587 if (!arm_is_el2_enabled(env)) { 5588 uint64_t hcrx = 0; 5589 if (cpu_isar_feature(aa64_mops, env_archcpu(env))) { 5590 /* MSCEn behaves as 1 if EL2 is not enabled */ 5591 hcrx |= HCRX_MSCEN; 5592 } 5593 return hcrx; 5594 } 5595 if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_HXEN)) { 5596 return 0; 5597 } 5598 return env->cp15.hcrx_el2; 5599 } 5600 5601 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, 5602 uint64_t value) 5603 { 5604 /* 5605 * For A-profile AArch32 EL3, if NSACR.CP10 5606 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 5607 */ 5608 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 5609 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 5610 uint64_t mask = R_HCPTR_TCP11_MASK | R_HCPTR_TCP10_MASK; 5611 value = (value & ~mask) | (env->cp15.cptr_el[2] & mask); 5612 } 5613 env->cp15.cptr_el[2] = value; 5614 } 5615 5616 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri) 5617 { 5618 /* 5619 * For A-profile AArch32 EL3, if NSACR.CP10 5620 * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1. 5621 */ 5622 uint64_t value = env->cp15.cptr_el[2]; 5623 5624 if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 5625 !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) { 5626 value |= R_HCPTR_TCP11_MASK | R_HCPTR_TCP10_MASK; 5627 } 5628 return value; 5629 } 5630 5631 static const ARMCPRegInfo el2_cp_reginfo[] = { 5632 { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64, 5633 .type = ARM_CP_IO, 5634 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 5635 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 5636 .nv2_redirect_offset = 0x78, 5637 .resetfn = hcr_reset, 5638 .writefn = hcr_write, .raw_writefn = raw_write }, 5639 { .name = "HCR", .state = ARM_CP_STATE_AA32, 5640 .type = ARM_CP_ALIAS | ARM_CP_IO, 5641 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0, 5642 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2), 5643 .writefn = hcr_writelow }, 5644 { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH, 5645 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7, 5646 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 5647 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64, 5648 .type = ARM_CP_ALIAS | ARM_CP_NV2_REDIRECT, 5649 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1, 5650 .access = PL2_RW, 5651 .fieldoffset = offsetof(CPUARMState, elr_el[2]) }, 5652 { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH, 5653 .type = ARM_CP_NV2_REDIRECT, 5654 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0, 5655 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) }, 5656 { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH, 5657 .type = ARM_CP_NV2_REDIRECT, 5658 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0, 5659 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) }, 5660 { .name = "HIFAR", .state = ARM_CP_STATE_AA32, 5661 .type = ARM_CP_ALIAS, 5662 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2, 5663 .access = PL2_RW, 5664 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) }, 5665 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64, 5666 .type = ARM_CP_ALIAS | ARM_CP_NV2_REDIRECT, 5667 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0, 5668 .access = PL2_RW, 5669 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) }, 5670 { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH, 5671 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0, 5672 .access = PL2_RW, .writefn = vbar_write, 5673 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]), 5674 .resetvalue = 0 }, 5675 { .name = "SP_EL2", .state = ARM_CP_STATE_AA64, 5676 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0, 5677 .access = PL3_RW, .type = ARM_CP_ALIAS, 5678 .fieldoffset = offsetof(CPUARMState, sp_el[2]) }, 5679 { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH, 5680 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2, 5681 .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0, 5682 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]), 5683 .readfn = cptr_el2_read, .writefn = cptr_el2_write }, 5684 { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH, 5685 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0, 5686 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]), 5687 .resetvalue = 0 }, 5688 { .name = "HMAIR1", .state = ARM_CP_STATE_AA32, 5689 .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1, 5690 .access = PL2_RW, .type = ARM_CP_ALIAS, 5691 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) }, 5692 { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH, 5693 .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0, 5694 .access = PL2_RW, .type = ARM_CP_CONST, 5695 .resetvalue = 0 }, 5696 /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */ 5697 { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32, 5698 .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, 5699 .access = PL2_RW, .type = ARM_CP_CONST, 5700 .resetvalue = 0 }, 5701 { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH, 5702 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0, 5703 .access = PL2_RW, .type = ARM_CP_CONST, 5704 .resetvalue = 0 }, 5705 { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH, 5706 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1, 5707 .access = PL2_RW, .type = ARM_CP_CONST, 5708 .resetvalue = 0 }, 5709 { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH, 5710 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2, 5711 .access = PL2_RW, .writefn = vmsa_tcr_el12_write, 5712 .raw_writefn = raw_write, 5713 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) }, 5714 { .name = "VTCR", .state = ARM_CP_STATE_AA32, 5715 .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 5716 .type = ARM_CP_ALIAS, 5717 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5718 .fieldoffset = offsetoflow32(CPUARMState, cp15.vtcr_el2) }, 5719 { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64, 5720 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2, 5721 .access = PL2_RW, 5722 .nv2_redirect_offset = 0x40, 5723 /* no .writefn needed as this can't cause an ASID change */ 5724 .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) }, 5725 { .name = "VTTBR", .state = ARM_CP_STATE_AA32, 5726 .cp = 15, .opc1 = 6, .crm = 2, 5727 .type = ARM_CP_64BIT | ARM_CP_ALIAS, 5728 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5729 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2), 5730 .writefn = vttbr_write, .raw_writefn = raw_write }, 5731 { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64, 5732 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0, 5733 .access = PL2_RW, .writefn = vttbr_write, .raw_writefn = raw_write, 5734 .nv2_redirect_offset = 0x20, 5735 .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) }, 5736 { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH, 5737 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0, 5738 .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write, 5739 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) }, 5740 { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH, 5741 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2, 5742 .access = PL2_RW, .resetvalue = 0, 5743 .nv2_redirect_offset = 0x90, 5744 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) }, 5745 { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64, 5746 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 5747 .access = PL2_RW, .resetvalue = 0, 5748 .writefn = vmsa_tcr_ttbr_el2_write, .raw_writefn = raw_write, 5749 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 5750 { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2, 5751 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS, 5752 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) }, 5753 #ifndef CONFIG_USER_ONLY 5754 /* 5755 * Unlike the other EL2-related AT operations, these must 5756 * UNDEF from EL3 if EL2 is not implemented, which is why we 5757 * define them here rather than with the rest of the AT ops. 5758 */ 5759 { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64, 5760 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 5761 .access = PL2_W, .accessfn = at_s1e2_access, 5762 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF, 5763 .writefn = ats_write64 }, 5764 { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64, 5765 .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 5766 .access = PL2_W, .accessfn = at_s1e2_access, 5767 .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF, 5768 .writefn = ats_write64 }, 5769 /* 5770 * The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE 5771 * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3 5772 * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose 5773 * to behave as if SCR.NS was 1. 5774 */ 5775 { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0, 5776 .access = PL2_W, 5777 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 5778 { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1, 5779 .access = PL2_W, 5780 .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 5781 { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH, 5782 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0, 5783 /* 5784 * ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the 5785 * reset values as IMPDEF. We choose to reset to 3 to comply with 5786 * both ARMv7 and ARMv8. 5787 */ 5788 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 3, 5789 .writefn = gt_cnthctl_write, .raw_writefn = raw_write, 5790 .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) }, 5791 { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64, 5792 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3, 5793 .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0, 5794 .writefn = gt_cntvoff_write, 5795 .nv2_redirect_offset = 0x60, 5796 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 5797 { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14, 5798 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO, 5799 .writefn = gt_cntvoff_write, 5800 .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) }, 5801 { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64, 5802 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2, 5803 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 5804 .type = ARM_CP_IO, .access = PL2_RW, 5805 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 5806 { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14, 5807 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval), 5808 .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO, 5809 .writefn = gt_hyp_cval_write, .raw_writefn = raw_write }, 5810 { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 5811 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0, 5812 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 5813 .resetfn = gt_hyp_timer_reset, 5814 .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write }, 5815 { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH, 5816 .type = ARM_CP_IO, 5817 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1, 5818 .access = PL2_RW, 5819 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl), 5820 .resetvalue = 0, 5821 .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write }, 5822 #endif 5823 { .name = "HPFAR", .state = ARM_CP_STATE_AA32, 5824 .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 5825 .access = PL2_RW, .accessfn = access_el3_aa32ns, 5826 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 5827 { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64, 5828 .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, 5829 .access = PL2_RW, 5830 .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) }, 5831 { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH, 5832 .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3, 5833 .access = PL2_RW, 5834 .nv2_redirect_offset = 0x80, 5835 .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) }, 5836 }; 5837 5838 static const ARMCPRegInfo el2_v8_cp_reginfo[] = { 5839 { .name = "HCR2", .state = ARM_CP_STATE_AA32, 5840 .type = ARM_CP_ALIAS | ARM_CP_IO, 5841 .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 5842 .access = PL2_RW, 5843 .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2), 5844 .writefn = hcr_writehigh }, 5845 }; 5846 5847 static CPAccessResult sel2_access(CPUARMState *env, const ARMCPRegInfo *ri, 5848 bool isread) 5849 { 5850 if (arm_current_el(env) == 3 || arm_is_secure_below_el3(env)) { 5851 return CP_ACCESS_OK; 5852 } 5853 return CP_ACCESS_UNDEFINED; 5854 } 5855 5856 static const ARMCPRegInfo el2_sec_cp_reginfo[] = { 5857 { .name = "VSTTBR_EL2", .state = ARM_CP_STATE_AA64, 5858 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 0, 5859 .access = PL2_RW, .accessfn = sel2_access, 5860 .nv2_redirect_offset = 0x30, 5861 .fieldoffset = offsetof(CPUARMState, cp15.vsttbr_el2) }, 5862 { .name = "VSTCR_EL2", .state = ARM_CP_STATE_AA64, 5863 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2, 5864 .access = PL2_RW, .accessfn = sel2_access, 5865 .nv2_redirect_offset = 0x48, 5866 .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) }, 5867 #ifndef CONFIG_USER_ONLY 5868 /* Secure EL2 Physical Timer */ 5869 { .name = "CNTHPS_TVAL_EL2", .state = ARM_CP_STATE_AA64, 5870 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 0, 5871 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 5872 .accessfn = gt_sel2timer_access, 5873 .readfn = gt_sec_pel2_tval_read, 5874 .writefn = gt_sec_pel2_tval_write, 5875 .resetfn = gt_sec_pel2_timer_reset, 5876 }, 5877 { .name = "CNTHPS_CTL_EL2", .state = ARM_CP_STATE_AA64, 5878 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 1, 5879 .type = ARM_CP_IO, .access = PL2_RW, 5880 .accessfn = gt_sel2timer_access, 5881 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_PHYS].ctl), 5882 .resetvalue = 0, 5883 .writefn = gt_sec_pel2_ctl_write, .raw_writefn = raw_write, 5884 }, 5885 { .name = "CNTHPS_CVAL_EL2", .state = ARM_CP_STATE_AA64, 5886 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 2, 5887 .type = ARM_CP_IO, .access = PL2_RW, 5888 .accessfn = gt_sel2timer_access, 5889 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_PHYS].cval), 5890 .writefn = gt_sec_pel2_cval_write, .raw_writefn = raw_write, 5891 }, 5892 /* Secure EL2 Virtual Timer */ 5893 { .name = "CNTHVS_TVAL_EL2", .state = ARM_CP_STATE_AA64, 5894 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 0, 5895 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 5896 .accessfn = gt_sel2timer_access, 5897 .readfn = gt_sec_vel2_tval_read, 5898 .writefn = gt_sec_vel2_tval_write, 5899 .resetfn = gt_sec_vel2_timer_reset, 5900 }, 5901 { .name = "CNTHVS_CTL_EL2", .state = ARM_CP_STATE_AA64, 5902 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 1, 5903 .type = ARM_CP_IO, .access = PL2_RW, 5904 .accessfn = gt_sel2timer_access, 5905 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_VIRT].ctl), 5906 .resetvalue = 0, 5907 .writefn = gt_sec_vel2_ctl_write, .raw_writefn = raw_write, 5908 }, 5909 { .name = "CNTHVS_CVAL_EL2", .state = ARM_CP_STATE_AA64, 5910 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 2, 5911 .type = ARM_CP_IO, .access = PL2_RW, 5912 .accessfn = gt_sel2timer_access, 5913 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_VIRT].cval), 5914 .writefn = gt_sec_vel2_cval_write, .raw_writefn = raw_write, 5915 }, 5916 #endif 5917 }; 5918 5919 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri, 5920 bool isread) 5921 { 5922 /* 5923 * The NSACR is RW at EL3, and RO for NS EL1 and NS EL2. 5924 * At Secure EL1 it traps to EL3 or EL2. 5925 */ 5926 if (arm_current_el(env) == 3) { 5927 return CP_ACCESS_OK; 5928 } 5929 if (arm_is_secure_below_el3(env)) { 5930 if (env->cp15.scr_el3 & SCR_EEL2) { 5931 return CP_ACCESS_TRAP_EL2; 5932 } 5933 return CP_ACCESS_TRAP_EL3; 5934 } 5935 /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */ 5936 if (isread) { 5937 return CP_ACCESS_OK; 5938 } 5939 return CP_ACCESS_UNDEFINED; 5940 } 5941 5942 static const ARMCPRegInfo el3_cp_reginfo[] = { 5943 { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64, 5944 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0, 5945 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3), 5946 .resetfn = scr_reset, .writefn = scr_write, .raw_writefn = raw_write }, 5947 { .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL, 5948 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0, 5949 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5950 .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3), 5951 .writefn = scr_write, .raw_writefn = raw_write }, 5952 { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64, 5953 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1, 5954 .access = PL3_RW, .resetvalue = 0, 5955 .fieldoffset = offsetof(CPUARMState, cp15.sder) }, 5956 { .name = "SDER", 5957 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1, 5958 .access = PL3_RW, .resetvalue = 0, 5959 .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) }, 5960 { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 5961 .access = PL1_RW, .accessfn = access_trap_aa32s_el1, 5962 .writefn = vbar_write, .resetvalue = 0, 5963 .fieldoffset = offsetof(CPUARMState, cp15.mvbar) }, 5964 { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64, 5965 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0, 5966 .access = PL3_RW, .resetvalue = 0, 5967 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) }, 5968 { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64, 5969 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2, 5970 .access = PL3_RW, 5971 /* no .writefn needed as this can't cause an ASID change */ 5972 .resetvalue = 0, 5973 .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) }, 5974 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64, 5975 .type = ARM_CP_ALIAS, 5976 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1, 5977 .access = PL3_RW, 5978 .fieldoffset = offsetof(CPUARMState, elr_el[3]) }, 5979 { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64, 5980 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0, 5981 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) }, 5982 { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64, 5983 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0, 5984 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) }, 5985 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64, 5986 .type = ARM_CP_ALIAS, 5987 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0, 5988 .access = PL3_RW, 5989 .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) }, 5990 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64, 5991 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0, 5992 .access = PL3_RW, .writefn = vbar_write, 5993 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]), 5994 .resetvalue = 0 }, 5995 { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64, 5996 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2, 5997 .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0, 5998 .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) }, 5999 { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64, 6000 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2, 6001 .access = PL3_RW, .resetvalue = 0, 6002 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) }, 6003 { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64, 6004 .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0, 6005 .access = PL3_RW, .type = ARM_CP_CONST, 6006 .resetvalue = 0 }, 6007 { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH, 6008 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0, 6009 .access = PL3_RW, .type = ARM_CP_CONST, 6010 .resetvalue = 0 }, 6011 { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH, 6012 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1, 6013 .access = PL3_RW, .type = ARM_CP_CONST, 6014 .resetvalue = 0 }, 6015 }; 6016 6017 #ifndef CONFIG_USER_ONLY 6018 6019 static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri, 6020 bool isread) 6021 { 6022 if (arm_current_el(env) == 1) { 6023 /* This must be a FEAT_NV access */ 6024 return CP_ACCESS_OK; 6025 } 6026 if (!(arm_hcr_el2_eff(env) & HCR_E2H)) { 6027 return CP_ACCESS_UNDEFINED; 6028 } 6029 return CP_ACCESS_OK; 6030 } 6031 6032 static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri, 6033 bool isread) 6034 { 6035 if (arm_current_el(env) == 1) { 6036 /* This must be a FEAT_NV access with NVx == 101 */ 6037 if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) { 6038 return CP_ACCESS_TRAP_EL2; 6039 } 6040 } 6041 return e2h_access(env, ri, isread); 6042 } 6043 6044 static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri, 6045 bool isread) 6046 { 6047 if (arm_current_el(env) == 1) { 6048 /* This must be a FEAT_NV access with NVx == 101 */ 6049 if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) { 6050 return CP_ACCESS_TRAP_EL2; 6051 } 6052 } 6053 return e2h_access(env, ri, isread); 6054 } 6055 6056 /* Test if system register redirection is to occur in the current state. */ 6057 static bool redirect_for_e2h(CPUARMState *env) 6058 { 6059 return arm_current_el(env) == 2 && (arm_hcr_el2_eff(env) & HCR_E2H); 6060 } 6061 6062 static uint64_t el2_e2h_read(CPUARMState *env, const ARMCPRegInfo *ri) 6063 { 6064 CPReadFn *readfn; 6065 6066 if (redirect_for_e2h(env)) { 6067 /* Switch to the saved EL2 version of the register. */ 6068 ri = ri->opaque; 6069 readfn = ri->readfn; 6070 } else { 6071 readfn = ri->orig_readfn; 6072 } 6073 if (readfn == NULL) { 6074 readfn = raw_read; 6075 } 6076 return readfn(env, ri); 6077 } 6078 6079 static void el2_e2h_write(CPUARMState *env, const ARMCPRegInfo *ri, 6080 uint64_t value) 6081 { 6082 CPWriteFn *writefn; 6083 6084 if (redirect_for_e2h(env)) { 6085 /* Switch to the saved EL2 version of the register. */ 6086 ri = ri->opaque; 6087 writefn = ri->writefn; 6088 } else { 6089 writefn = ri->orig_writefn; 6090 } 6091 if (writefn == NULL) { 6092 writefn = raw_write; 6093 } 6094 writefn(env, ri, value); 6095 } 6096 6097 static uint64_t el2_e2h_e12_read(CPUARMState *env, const ARMCPRegInfo *ri) 6098 { 6099 /* Pass the EL1 register accessor its ri, not the EL12 alias ri */ 6100 return ri->orig_readfn(env, ri->opaque); 6101 } 6102 6103 static void el2_e2h_e12_write(CPUARMState *env, const ARMCPRegInfo *ri, 6104 uint64_t value) 6105 { 6106 /* Pass the EL1 register accessor its ri, not the EL12 alias ri */ 6107 return ri->orig_writefn(env, ri->opaque, value); 6108 } 6109 6110 static CPAccessResult el2_e2h_e12_access(CPUARMState *env, 6111 const ARMCPRegInfo *ri, 6112 bool isread) 6113 { 6114 if (arm_current_el(env) == 1) { 6115 /* 6116 * This must be a FEAT_NV access (will either trap or redirect 6117 * to memory). None of the registers with _EL12 aliases want to 6118 * apply their trap controls for this kind of access, so don't 6119 * call the orig_accessfn or do the "UNDEF when E2H is 0" check. 6120 */ 6121 return CP_ACCESS_OK; 6122 } 6123 /* FOO_EL12 aliases only exist when E2H is 1; otherwise they UNDEF */ 6124 if (!(arm_hcr_el2_eff(env) & HCR_E2H)) { 6125 return CP_ACCESS_UNDEFINED; 6126 } 6127 if (ri->orig_accessfn) { 6128 return ri->orig_accessfn(env, ri->opaque, isread); 6129 } 6130 return CP_ACCESS_OK; 6131 } 6132 6133 static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu) 6134 { 6135 struct E2HAlias { 6136 uint32_t src_key, dst_key, new_key; 6137 const char *src_name, *dst_name, *new_name; 6138 bool (*feature)(const ARMISARegisters *id); 6139 }; 6140 6141 #define K(op0, op1, crn, crm, op2) \ 6142 ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2) 6143 6144 static const struct E2HAlias aliases[] = { 6145 { K(3, 0, 1, 0, 0), K(3, 4, 1, 0, 0), K(3, 5, 1, 0, 0), 6146 "SCTLR", "SCTLR_EL2", "SCTLR_EL12" }, 6147 { K(3, 0, 1, 0, 2), K(3, 4, 1, 1, 2), K(3, 5, 1, 0, 2), 6148 "CPACR", "CPTR_EL2", "CPACR_EL12" }, 6149 { K(3, 0, 2, 0, 0), K(3, 4, 2, 0, 0), K(3, 5, 2, 0, 0), 6150 "TTBR0_EL1", "TTBR0_EL2", "TTBR0_EL12" }, 6151 { K(3, 0, 2, 0, 1), K(3, 4, 2, 0, 1), K(3, 5, 2, 0, 1), 6152 "TTBR1_EL1", "TTBR1_EL2", "TTBR1_EL12" }, 6153 { K(3, 0, 2, 0, 2), K(3, 4, 2, 0, 2), K(3, 5, 2, 0, 2), 6154 "TCR_EL1", "TCR_EL2", "TCR_EL12" }, 6155 { K(3, 0, 4, 0, 0), K(3, 4, 4, 0, 0), K(3, 5, 4, 0, 0), 6156 "SPSR_EL1", "SPSR_EL2", "SPSR_EL12" }, 6157 { K(3, 0, 4, 0, 1), K(3, 4, 4, 0, 1), K(3, 5, 4, 0, 1), 6158 "ELR_EL1", "ELR_EL2", "ELR_EL12" }, 6159 { K(3, 0, 5, 1, 0), K(3, 4, 5, 1, 0), K(3, 5, 5, 1, 0), 6160 "AFSR0_EL1", "AFSR0_EL2", "AFSR0_EL12" }, 6161 { K(3, 0, 5, 1, 1), K(3, 4, 5, 1, 1), K(3, 5, 5, 1, 1), 6162 "AFSR1_EL1", "AFSR1_EL2", "AFSR1_EL12" }, 6163 { K(3, 0, 5, 2, 0), K(3, 4, 5, 2, 0), K(3, 5, 5, 2, 0), 6164 "ESR_EL1", "ESR_EL2", "ESR_EL12" }, 6165 { K(3, 0, 6, 0, 0), K(3, 4, 6, 0, 0), K(3, 5, 6, 0, 0), 6166 "FAR_EL1", "FAR_EL2", "FAR_EL12" }, 6167 { K(3, 0, 10, 2, 0), K(3, 4, 10, 2, 0), K(3, 5, 10, 2, 0), 6168 "MAIR_EL1", "MAIR_EL2", "MAIR_EL12" }, 6169 { K(3, 0, 10, 3, 0), K(3, 4, 10, 3, 0), K(3, 5, 10, 3, 0), 6170 "AMAIR0", "AMAIR_EL2", "AMAIR_EL12" }, 6171 { K(3, 0, 12, 0, 0), K(3, 4, 12, 0, 0), K(3, 5, 12, 0, 0), 6172 "VBAR", "VBAR_EL2", "VBAR_EL12" }, 6173 { K(3, 0, 13, 0, 1), K(3, 4, 13, 0, 1), K(3, 5, 13, 0, 1), 6174 "CONTEXTIDR_EL1", "CONTEXTIDR_EL2", "CONTEXTIDR_EL12" }, 6175 { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0), 6176 "CNTKCTL", "CNTHCTL_EL2", "CNTKCTL_EL12" }, 6177 6178 /* 6179 * Note that redirection of ZCR is mentioned in the description 6180 * of ZCR_EL2, and aliasing in the description of ZCR_EL1, but 6181 * not in the summary table. 6182 */ 6183 { K(3, 0, 1, 2, 0), K(3, 4, 1, 2, 0), K(3, 5, 1, 2, 0), 6184 "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve }, 6185 { K(3, 0, 1, 2, 6), K(3, 4, 1, 2, 6), K(3, 5, 1, 2, 6), 6186 "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme }, 6187 6188 { K(3, 0, 5, 6, 0), K(3, 4, 5, 6, 0), K(3, 5, 5, 6, 0), 6189 "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte }, 6190 6191 { K(3, 0, 13, 0, 7), K(3, 4, 13, 0, 7), K(3, 5, 13, 0, 7), 6192 "SCXTNUM_EL1", "SCXTNUM_EL2", "SCXTNUM_EL12", 6193 isar_feature_aa64_scxtnum }, 6194 6195 /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */ 6196 /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */ 6197 }; 6198 #undef K 6199 6200 size_t i; 6201 6202 for (i = 0; i < ARRAY_SIZE(aliases); i++) { 6203 const struct E2HAlias *a = &aliases[i]; 6204 ARMCPRegInfo *src_reg, *dst_reg, *new_reg; 6205 bool ok; 6206 6207 if (a->feature && !a->feature(&cpu->isar)) { 6208 continue; 6209 } 6210 6211 src_reg = g_hash_table_lookup(cpu->cp_regs, 6212 (gpointer)(uintptr_t)a->src_key); 6213 dst_reg = g_hash_table_lookup(cpu->cp_regs, 6214 (gpointer)(uintptr_t)a->dst_key); 6215 g_assert(src_reg != NULL); 6216 g_assert(dst_reg != NULL); 6217 6218 /* Cross-compare names to detect typos in the keys. */ 6219 g_assert(strcmp(src_reg->name, a->src_name) == 0); 6220 g_assert(strcmp(dst_reg->name, a->dst_name) == 0); 6221 6222 /* None of the core system registers use opaque; we will. */ 6223 g_assert(src_reg->opaque == NULL); 6224 6225 /* Create alias before redirection so we dup the right data. */ 6226 new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo)); 6227 6228 new_reg->name = a->new_name; 6229 new_reg->type |= ARM_CP_ALIAS; 6230 /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place. */ 6231 new_reg->access &= PL2_RW | PL3_RW; 6232 /* The new_reg op fields are as per new_key, not the target reg */ 6233 new_reg->crn = (a->new_key & CP_REG_ARM64_SYSREG_CRN_MASK) 6234 >> CP_REG_ARM64_SYSREG_CRN_SHIFT; 6235 new_reg->crm = (a->new_key & CP_REG_ARM64_SYSREG_CRM_MASK) 6236 >> CP_REG_ARM64_SYSREG_CRM_SHIFT; 6237 new_reg->opc0 = (a->new_key & CP_REG_ARM64_SYSREG_OP0_MASK) 6238 >> CP_REG_ARM64_SYSREG_OP0_SHIFT; 6239 new_reg->opc1 = (a->new_key & CP_REG_ARM64_SYSREG_OP1_MASK) 6240 >> CP_REG_ARM64_SYSREG_OP1_SHIFT; 6241 new_reg->opc2 = (a->new_key & CP_REG_ARM64_SYSREG_OP2_MASK) 6242 >> CP_REG_ARM64_SYSREG_OP2_SHIFT; 6243 new_reg->opaque = src_reg; 6244 new_reg->orig_readfn = src_reg->readfn ?: raw_read; 6245 new_reg->orig_writefn = src_reg->writefn ?: raw_write; 6246 new_reg->orig_accessfn = src_reg->accessfn; 6247 if (!new_reg->raw_readfn) { 6248 new_reg->raw_readfn = raw_read; 6249 } 6250 if (!new_reg->raw_writefn) { 6251 new_reg->raw_writefn = raw_write; 6252 } 6253 new_reg->readfn = el2_e2h_e12_read; 6254 new_reg->writefn = el2_e2h_e12_write; 6255 new_reg->accessfn = el2_e2h_e12_access; 6256 6257 /* 6258 * If the _EL1 register is redirected to memory by FEAT_NV2, 6259 * then it shares the offset with the _EL12 register, 6260 * and which one is redirected depends on HCR_EL2.NV1. 6261 */ 6262 if (new_reg->nv2_redirect_offset) { 6263 assert(new_reg->nv2_redirect_offset & NV2_REDIR_NV1); 6264 new_reg->nv2_redirect_offset &= ~NV2_REDIR_NV1; 6265 new_reg->nv2_redirect_offset |= NV2_REDIR_NO_NV1; 6266 } 6267 6268 ok = g_hash_table_insert(cpu->cp_regs, 6269 (gpointer)(uintptr_t)a->new_key, new_reg); 6270 g_assert(ok); 6271 6272 src_reg->opaque = dst_reg; 6273 src_reg->orig_readfn = src_reg->readfn ?: raw_read; 6274 src_reg->orig_writefn = src_reg->writefn ?: raw_write; 6275 if (!src_reg->raw_readfn) { 6276 src_reg->raw_readfn = raw_read; 6277 } 6278 if (!src_reg->raw_writefn) { 6279 src_reg->raw_writefn = raw_write; 6280 } 6281 src_reg->readfn = el2_e2h_read; 6282 src_reg->writefn = el2_e2h_write; 6283 } 6284 } 6285 #endif 6286 6287 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri, 6288 bool isread) 6289 { 6290 int cur_el = arm_current_el(env); 6291 6292 if (cur_el < 2) { 6293 uint64_t hcr = arm_hcr_el2_eff(env); 6294 6295 if (cur_el == 0) { 6296 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 6297 if (!(env->cp15.sctlr_el[2] & SCTLR_UCT)) { 6298 return CP_ACCESS_TRAP_EL2; 6299 } 6300 } else { 6301 if (!(env->cp15.sctlr_el[1] & SCTLR_UCT)) { 6302 return CP_ACCESS_TRAP_EL1; 6303 } 6304 if (hcr & HCR_TID2) { 6305 return CP_ACCESS_TRAP_EL2; 6306 } 6307 } 6308 } else if (hcr & HCR_TID2) { 6309 return CP_ACCESS_TRAP_EL2; 6310 } 6311 } 6312 6313 if (arm_current_el(env) < 2 && arm_hcr_el2_eff(env) & HCR_TID2) { 6314 return CP_ACCESS_TRAP_EL2; 6315 } 6316 6317 return CP_ACCESS_OK; 6318 } 6319 6320 /* 6321 * Check for traps to RAS registers, which are controlled 6322 * by HCR_EL2.TERR and SCR_EL3.TERR. 6323 */ 6324 static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri, 6325 bool isread) 6326 { 6327 int el = arm_current_el(env); 6328 6329 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) { 6330 return CP_ACCESS_TRAP_EL2; 6331 } 6332 if (!arm_is_el3_or_mon(env) && (env->cp15.scr_el3 & SCR_TERR)) { 6333 return CP_ACCESS_TRAP_EL3; 6334 } 6335 return CP_ACCESS_OK; 6336 } 6337 6338 static uint64_t disr_read(CPUARMState *env, const ARMCPRegInfo *ri) 6339 { 6340 int el = arm_current_el(env); 6341 6342 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) { 6343 return env->cp15.vdisr_el2; 6344 } 6345 if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) { 6346 return 0; /* RAZ/WI */ 6347 } 6348 return env->cp15.disr_el1; 6349 } 6350 6351 static void disr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 6352 { 6353 int el = arm_current_el(env); 6354 6355 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) { 6356 env->cp15.vdisr_el2 = val; 6357 return; 6358 } 6359 if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) { 6360 return; /* RAZ/WI */ 6361 } 6362 env->cp15.disr_el1 = val; 6363 } 6364 6365 /* 6366 * Minimal RAS implementation with no Error Records. 6367 * Which means that all of the Error Record registers: 6368 * ERXADDR_EL1 6369 * ERXCTLR_EL1 6370 * ERXFR_EL1 6371 * ERXMISC0_EL1 6372 * ERXMISC1_EL1 6373 * ERXMISC2_EL1 6374 * ERXMISC3_EL1 6375 * ERXPFGCDN_EL1 (RASv1p1) 6376 * ERXPFGCTL_EL1 (RASv1p1) 6377 * ERXPFGF_EL1 (RASv1p1) 6378 * ERXSTATUS_EL1 6379 * and 6380 * ERRSELR_EL1 6381 * may generate UNDEFINED, which is the effect we get by not 6382 * listing them at all. 6383 * 6384 * These registers have fine-grained trap bits, but UNDEF-to-EL1 6385 * is higher priority than FGT-to-EL2 so we do not need to list them 6386 * in order to check for an FGT. 6387 */ 6388 static const ARMCPRegInfo minimal_ras_reginfo[] = { 6389 { .name = "DISR_EL1", .state = ARM_CP_STATE_BOTH, 6390 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 1, 6391 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.disr_el1), 6392 .readfn = disr_read, .writefn = disr_write, .raw_writefn = raw_write }, 6393 { .name = "ERRIDR_EL1", .state = ARM_CP_STATE_BOTH, 6394 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 3, .opc2 = 0, 6395 .access = PL1_R, .accessfn = access_terr, 6396 .fgt = FGT_ERRIDR_EL1, 6397 .type = ARM_CP_CONST, .resetvalue = 0 }, 6398 { .name = "VDISR_EL2", .state = ARM_CP_STATE_BOTH, 6399 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 1, .opc2 = 1, 6400 .nv2_redirect_offset = 0x500, 6401 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vdisr_el2) }, 6402 { .name = "VSESR_EL2", .state = ARM_CP_STATE_BOTH, 6403 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 3, 6404 .nv2_redirect_offset = 0x508, 6405 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vsesr_el2) }, 6406 }; 6407 6408 /* 6409 * Return the exception level to which exceptions should be taken 6410 * via SVEAccessTrap. This excludes the check for whether the exception 6411 * should be routed through AArch64.AdvSIMDFPAccessTrap. That can easily 6412 * be found by testing 0 < fp_exception_el < sve_exception_el. 6413 * 6414 * C.f. the ARM pseudocode function CheckSVEEnabled. Note that the 6415 * pseudocode does *not* separate out the FP trap checks, but has them 6416 * all in one function. 6417 */ 6418 int sve_exception_el(CPUARMState *env, int el) 6419 { 6420 #ifndef CONFIG_USER_ONLY 6421 if (el <= 1 && !el_is_in_host(env, el)) { 6422 switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, ZEN)) { 6423 case 1: 6424 if (el != 0) { 6425 break; 6426 } 6427 /* fall through */ 6428 case 0: 6429 case 2: 6430 return 1; 6431 } 6432 } 6433 6434 if (el <= 2 && arm_is_el2_enabled(env)) { 6435 /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */ 6436 if (env->cp15.hcr_el2 & HCR_E2H) { 6437 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, ZEN)) { 6438 case 1: 6439 if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) { 6440 break; 6441 } 6442 /* fall through */ 6443 case 0: 6444 case 2: 6445 return 2; 6446 } 6447 } else { 6448 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TZ)) { 6449 return 2; 6450 } 6451 } 6452 } 6453 6454 /* CPTR_EL3. Since EZ is negative we must check for EL3. */ 6455 if (arm_feature(env, ARM_FEATURE_EL3) 6456 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, EZ)) { 6457 return 3; 6458 } 6459 #endif 6460 return 0; 6461 } 6462 6463 /* 6464 * Return the exception level to which exceptions should be taken for SME. 6465 * C.f. the ARM pseudocode function CheckSMEAccess. 6466 */ 6467 int sme_exception_el(CPUARMState *env, int el) 6468 { 6469 #ifndef CONFIG_USER_ONLY 6470 if (el <= 1 && !el_is_in_host(env, el)) { 6471 switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) { 6472 case 1: 6473 if (el != 0) { 6474 break; 6475 } 6476 /* fall through */ 6477 case 0: 6478 case 2: 6479 return 1; 6480 } 6481 } 6482 6483 if (el <= 2 && arm_is_el2_enabled(env)) { 6484 /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */ 6485 if (env->cp15.hcr_el2 & HCR_E2H) { 6486 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) { 6487 case 1: 6488 if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) { 6489 break; 6490 } 6491 /* fall through */ 6492 case 0: 6493 case 2: 6494 return 2; 6495 } 6496 } else { 6497 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) { 6498 return 2; 6499 } 6500 } 6501 } 6502 6503 /* CPTR_EL3. Since ESM is negative we must check for EL3. */ 6504 if (arm_feature(env, ARM_FEATURE_EL3) 6505 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) { 6506 return 3; 6507 } 6508 #endif 6509 return 0; 6510 } 6511 6512 /* 6513 * Given that SVE is enabled, return the vector length for EL. 6514 */ 6515 uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm) 6516 { 6517 ARMCPU *cpu = env_archcpu(env); 6518 uint64_t *cr = env->vfp.zcr_el; 6519 uint32_t map = cpu->sve_vq.map; 6520 uint32_t len = ARM_MAX_VQ - 1; 6521 6522 if (sm) { 6523 cr = env->vfp.smcr_el; 6524 map = cpu->sme_vq.map; 6525 } 6526 6527 if (el <= 1 && !el_is_in_host(env, el)) { 6528 len = MIN(len, 0xf & (uint32_t)cr[1]); 6529 } 6530 if (el <= 2 && arm_is_el2_enabled(env)) { 6531 len = MIN(len, 0xf & (uint32_t)cr[2]); 6532 } 6533 if (arm_feature(env, ARM_FEATURE_EL3)) { 6534 len = MIN(len, 0xf & (uint32_t)cr[3]); 6535 } 6536 6537 map &= MAKE_64BIT_MASK(0, len + 1); 6538 if (map != 0) { 6539 return 31 - clz32(map); 6540 } 6541 6542 /* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */ 6543 assert(sm); 6544 return ctz32(cpu->sme_vq.map); 6545 } 6546 6547 uint32_t sve_vqm1_for_el(CPUARMState *env, int el) 6548 { 6549 return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM)); 6550 } 6551 6552 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6553 uint64_t value) 6554 { 6555 int cur_el = arm_current_el(env); 6556 int old_len = sve_vqm1_for_el(env, cur_el); 6557 int new_len; 6558 6559 /* Bits other than [3:0] are RAZ/WI. */ 6560 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16); 6561 raw_write(env, ri, value & 0xf); 6562 6563 /* 6564 * Because we arrived here, we know both FP and SVE are enabled; 6565 * otherwise we would have trapped access to the ZCR_ELn register. 6566 */ 6567 new_len = sve_vqm1_for_el(env, cur_el); 6568 if (new_len < old_len) { 6569 aarch64_sve_narrow_vq(env, new_len + 1); 6570 } 6571 } 6572 6573 static const ARMCPRegInfo zcr_reginfo[] = { 6574 { .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64, 6575 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0, 6576 .nv2_redirect_offset = 0x1e0 | NV2_REDIR_NV1, 6577 .access = PL1_RW, .type = ARM_CP_SVE, 6578 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]), 6579 .writefn = zcr_write, .raw_writefn = raw_write }, 6580 { .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64, 6581 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0, 6582 .access = PL2_RW, .type = ARM_CP_SVE, 6583 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]), 6584 .writefn = zcr_write, .raw_writefn = raw_write }, 6585 { .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64, 6586 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0, 6587 .access = PL3_RW, .type = ARM_CP_SVE, 6588 .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]), 6589 .writefn = zcr_write, .raw_writefn = raw_write }, 6590 }; 6591 6592 static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri, 6593 bool isread) 6594 { 6595 int el = arm_current_el(env); 6596 6597 if (el == 0) { 6598 uint64_t sctlr = arm_sctlr(env, el); 6599 if (!(sctlr & SCTLR_EnTP2)) { 6600 return CP_ACCESS_TRAP_EL1; 6601 } 6602 } 6603 /* TODO: FEAT_FGT */ 6604 if (el < 3 6605 && arm_feature(env, ARM_FEATURE_EL3) 6606 && !(env->cp15.scr_el3 & SCR_ENTP2)) { 6607 return CP_ACCESS_TRAP_EL3; 6608 } 6609 return CP_ACCESS_OK; 6610 } 6611 6612 static CPAccessResult access_smprimap(CPUARMState *env, const ARMCPRegInfo *ri, 6613 bool isread) 6614 { 6615 /* If EL1 this is a FEAT_NV access and CPTR_EL3.ESM doesn't apply */ 6616 if (arm_current_el(env) == 2 6617 && arm_feature(env, ARM_FEATURE_EL3) 6618 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) { 6619 return CP_ACCESS_TRAP_EL3; 6620 } 6621 return CP_ACCESS_OK; 6622 } 6623 6624 static CPAccessResult access_smpri(CPUARMState *env, const ARMCPRegInfo *ri, 6625 bool isread) 6626 { 6627 if (arm_current_el(env) < 3 6628 && arm_feature(env, ARM_FEATURE_EL3) 6629 && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) { 6630 return CP_ACCESS_TRAP_EL3; 6631 } 6632 return CP_ACCESS_OK; 6633 } 6634 6635 /* ResetSVEState */ 6636 static void arm_reset_sve_state(CPUARMState *env) 6637 { 6638 memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs)); 6639 /* Recall that FFR is stored as pregs[16]. */ 6640 memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs)); 6641 vfp_set_fpsr(env, 0x0800009f); 6642 } 6643 6644 void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask) 6645 { 6646 uint64_t change = (env->svcr ^ new) & mask; 6647 6648 if (change == 0) { 6649 return; 6650 } 6651 env->svcr ^= change; 6652 6653 if (change & R_SVCR_SM_MASK) { 6654 arm_reset_sve_state(env); 6655 } 6656 6657 /* 6658 * ResetSMEState. 6659 * 6660 * SetPSTATE_ZA zeros on enable and disable. We can zero this only 6661 * on enable: while disabled, the storage is inaccessible and the 6662 * value does not matter. We're not saving the storage in vmstate 6663 * when disabled either. 6664 */ 6665 if (change & new & R_SVCR_ZA_MASK) { 6666 memset(&env->za_state, 0, sizeof(env->za_state)); 6667 } 6668 6669 if (tcg_enabled()) { 6670 arm_rebuild_hflags(env); 6671 } 6672 } 6673 6674 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6675 uint64_t value) 6676 { 6677 aarch64_set_svcr(env, value, -1); 6678 } 6679 6680 static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6681 uint64_t value) 6682 { 6683 int cur_el = arm_current_el(env); 6684 int old_len = sve_vqm1_for_el(env, cur_el); 6685 uint64_t valid_mask = R_SMCR_LEN_MASK | R_SMCR_FA64_MASK; 6686 int new_len; 6687 6688 QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1); 6689 if (cpu_isar_feature(aa64_sme2, env_archcpu(env))) { 6690 valid_mask |= R_SMCR_EZT0_MASK; 6691 } 6692 value &= valid_mask; 6693 raw_write(env, ri, value); 6694 6695 /* 6696 * Note that it is CONSTRAINED UNPREDICTABLE what happens to ZA storage 6697 * when SVL is widened (old values kept, or zeros). Choose to keep the 6698 * current values for simplicity. But for QEMU internals, we must still 6699 * apply the narrower SVL to the Zregs and Pregs -- see the comment 6700 * above aarch64_sve_narrow_vq. 6701 */ 6702 new_len = sve_vqm1_for_el(env, cur_el); 6703 if (new_len < old_len) { 6704 aarch64_sve_narrow_vq(env, new_len + 1); 6705 } 6706 } 6707 6708 static const ARMCPRegInfo sme_reginfo[] = { 6709 { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64, 6710 .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5, 6711 .access = PL0_RW, .accessfn = access_tpidr2, 6712 .fgt = FGT_NTPIDR2_EL0, 6713 .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) }, 6714 { .name = "SVCR", .state = ARM_CP_STATE_AA64, 6715 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 2, 6716 .access = PL0_RW, .type = ARM_CP_SME, 6717 .fieldoffset = offsetof(CPUARMState, svcr), 6718 .writefn = svcr_write, .raw_writefn = raw_write }, 6719 { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64, 6720 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6, 6721 .nv2_redirect_offset = 0x1f0 | NV2_REDIR_NV1, 6722 .access = PL1_RW, .type = ARM_CP_SME, 6723 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]), 6724 .writefn = smcr_write, .raw_writefn = raw_write }, 6725 { .name = "SMCR_EL2", .state = ARM_CP_STATE_AA64, 6726 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 6, 6727 .access = PL2_RW, .type = ARM_CP_SME, 6728 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[2]), 6729 .writefn = smcr_write, .raw_writefn = raw_write }, 6730 { .name = "SMCR_EL3", .state = ARM_CP_STATE_AA64, 6731 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 6, 6732 .access = PL3_RW, .type = ARM_CP_SME, 6733 .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]), 6734 .writefn = smcr_write, .raw_writefn = raw_write }, 6735 { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64, 6736 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6, 6737 .access = PL1_R, .accessfn = access_aa64_tid1, 6738 /* 6739 * IMPLEMENTOR = 0 (software) 6740 * REVISION = 0 (implementation defined) 6741 * SMPS = 0 (no streaming execution priority in QEMU) 6742 * AFFINITY = 0 (streaming sve mode not shared with other PEs) 6743 */ 6744 .type = ARM_CP_CONST, .resetvalue = 0, }, 6745 /* 6746 * Because SMIDR_EL1.SMPS is 0, SMPRI_EL1 and SMPRIMAP_EL2 are RES 0. 6747 */ 6748 { .name = "SMPRI_EL1", .state = ARM_CP_STATE_AA64, 6749 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 4, 6750 .access = PL1_RW, .accessfn = access_smpri, 6751 .fgt = FGT_NSMPRI_EL1, 6752 .type = ARM_CP_CONST, .resetvalue = 0 }, 6753 { .name = "SMPRIMAP_EL2", .state = ARM_CP_STATE_AA64, 6754 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 5, 6755 .nv2_redirect_offset = 0x1f8, 6756 .access = PL2_RW, .accessfn = access_smprimap, 6757 .type = ARM_CP_CONST, .resetvalue = 0 }, 6758 }; 6759 6760 static void gpccr_write(CPUARMState *env, const ARMCPRegInfo *ri, 6761 uint64_t value) 6762 { 6763 /* L0GPTSZ is RO; other bits not mentioned are RES0. */ 6764 uint64_t rw_mask = R_GPCCR_PPS_MASK | R_GPCCR_IRGN_MASK | 6765 R_GPCCR_ORGN_MASK | R_GPCCR_SH_MASK | R_GPCCR_PGS_MASK | 6766 R_GPCCR_GPC_MASK | R_GPCCR_GPCP_MASK; 6767 6768 env->cp15.gpccr_el3 = (value & rw_mask) | (env->cp15.gpccr_el3 & ~rw_mask); 6769 } 6770 6771 static void gpccr_reset(CPUARMState *env, const ARMCPRegInfo *ri) 6772 { 6773 env->cp15.gpccr_el3 = FIELD_DP64(0, GPCCR, L0GPTSZ, 6774 env_archcpu(env)->reset_l0gptsz); 6775 } 6776 6777 static const ARMCPRegInfo rme_reginfo[] = { 6778 { .name = "GPCCR_EL3", .state = ARM_CP_STATE_AA64, 6779 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 6, 6780 .access = PL3_RW, .writefn = gpccr_write, .resetfn = gpccr_reset, 6781 .fieldoffset = offsetof(CPUARMState, cp15.gpccr_el3) }, 6782 { .name = "GPTBR_EL3", .state = ARM_CP_STATE_AA64, 6783 .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 4, 6784 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.gptbr_el3) }, 6785 { .name = "MFAR_EL3", .state = ARM_CP_STATE_AA64, 6786 .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 5, 6787 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mfar_el3) }, 6788 { .name = "DC_CIPAPA", .state = ARM_CP_STATE_AA64, 6789 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 1, 6790 .access = PL3_W, .type = ARM_CP_NOP }, 6791 }; 6792 6793 static const ARMCPRegInfo rme_mte_reginfo[] = { 6794 { .name = "DC_CIGDPAPA", .state = ARM_CP_STATE_AA64, 6795 .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 5, 6796 .access = PL3_W, .type = ARM_CP_NOP }, 6797 }; 6798 6799 static void aa64_allint_write(CPUARMState *env, const ARMCPRegInfo *ri, 6800 uint64_t value) 6801 { 6802 env->pstate = (env->pstate & ~PSTATE_ALLINT) | (value & PSTATE_ALLINT); 6803 } 6804 6805 static uint64_t aa64_allint_read(CPUARMState *env, const ARMCPRegInfo *ri) 6806 { 6807 return env->pstate & PSTATE_ALLINT; 6808 } 6809 6810 static CPAccessResult aa64_allint_access(CPUARMState *env, 6811 const ARMCPRegInfo *ri, bool isread) 6812 { 6813 if (!isread && arm_current_el(env) == 1 && 6814 (arm_hcrx_el2_eff(env) & HCRX_TALLINT)) { 6815 return CP_ACCESS_TRAP_EL2; 6816 } 6817 return CP_ACCESS_OK; 6818 } 6819 6820 static const ARMCPRegInfo nmi_reginfo[] = { 6821 { .name = "ALLINT", .state = ARM_CP_STATE_AA64, 6822 .opc0 = 3, .opc1 = 0, .opc2 = 0, .crn = 4, .crm = 3, 6823 .type = ARM_CP_NO_RAW, 6824 .access = PL1_RW, .accessfn = aa64_allint_access, 6825 .fieldoffset = offsetof(CPUARMState, pstate), 6826 .writefn = aa64_allint_write, .readfn = aa64_allint_read, 6827 .resetfn = arm_cp_reset_ignore }, 6828 }; 6829 6830 static void define_pmu_regs(ARMCPU *cpu) 6831 { 6832 /* 6833 * v7 performance monitor control register: same implementor 6834 * field as main ID register, and we implement four counters in 6835 * addition to the cycle count register. 6836 */ 6837 unsigned int i, pmcrn = pmu_num_counters(&cpu->env); 6838 ARMCPRegInfo pmcr = { 6839 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0, 6840 .access = PL0_RW, 6841 .fgt = FGT_PMCR_EL0, 6842 .type = ARM_CP_IO | ARM_CP_ALIAS, 6843 .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr), 6844 .accessfn = pmreg_access, 6845 .readfn = pmcr_read, .raw_readfn = raw_read, 6846 .writefn = pmcr_write, .raw_writefn = raw_write, 6847 }; 6848 ARMCPRegInfo pmcr64 = { 6849 .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64, 6850 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0, 6851 .access = PL0_RW, .accessfn = pmreg_access, 6852 .fgt = FGT_PMCR_EL0, 6853 .type = ARM_CP_IO, 6854 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr), 6855 .resetvalue = cpu->isar.reset_pmcr_el0, 6856 .readfn = pmcr_read, .raw_readfn = raw_read, 6857 .writefn = pmcr_write, .raw_writefn = raw_write, 6858 }; 6859 6860 define_one_arm_cp_reg(cpu, &pmcr); 6861 define_one_arm_cp_reg(cpu, &pmcr64); 6862 for (i = 0; i < pmcrn; i++) { 6863 char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i); 6864 char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i); 6865 char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i); 6866 char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i); 6867 ARMCPRegInfo pmev_regs[] = { 6868 { .name = pmevcntr_name, .cp = 15, .crn = 14, 6869 .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6870 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6871 .fgt = FGT_PMEVCNTRN_EL0, 6872 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6873 .accessfn = pmreg_access_xevcntr }, 6874 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64, 6875 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)), 6876 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access_xevcntr, 6877 .type = ARM_CP_IO, 6878 .fgt = FGT_PMEVCNTRN_EL0, 6879 .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn, 6880 .raw_readfn = pmevcntr_rawread, 6881 .raw_writefn = pmevcntr_rawwrite }, 6882 { .name = pmevtyper_name, .cp = 15, .crn = 14, 6883 .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7, 6884 .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS, 6885 .fgt = FGT_PMEVTYPERN_EL0, 6886 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6887 .accessfn = pmreg_access }, 6888 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64, 6889 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)), 6890 .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access, 6891 .fgt = FGT_PMEVTYPERN_EL0, 6892 .type = ARM_CP_IO, 6893 .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn, 6894 .raw_writefn = pmevtyper_rawwrite }, 6895 }; 6896 define_arm_cp_regs(cpu, pmev_regs); 6897 g_free(pmevcntr_name); 6898 g_free(pmevcntr_el0_name); 6899 g_free(pmevtyper_name); 6900 g_free(pmevtyper_el0_name); 6901 } 6902 if (cpu_isar_feature(aa32_pmuv3p1, cpu)) { 6903 ARMCPRegInfo v81_pmu_regs[] = { 6904 { .name = "PMCEID2", .state = ARM_CP_STATE_AA32, 6905 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4, 6906 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6907 .fgt = FGT_PMCEIDN_EL0, 6908 .resetvalue = extract64(cpu->pmceid0, 32, 32) }, 6909 { .name = "PMCEID3", .state = ARM_CP_STATE_AA32, 6910 .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5, 6911 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6912 .fgt = FGT_PMCEIDN_EL0, 6913 .resetvalue = extract64(cpu->pmceid1, 32, 32) }, 6914 }; 6915 define_arm_cp_regs(cpu, v81_pmu_regs); 6916 } 6917 if (cpu_isar_feature(any_pmuv3p4, cpu)) { 6918 static const ARMCPRegInfo v84_pmmir = { 6919 .name = "PMMIR_EL1", .state = ARM_CP_STATE_BOTH, 6920 .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 6, 6921 .access = PL1_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 6922 .fgt = FGT_PMMIR_EL1, 6923 .resetvalue = 0 6924 }; 6925 define_one_arm_cp_reg(cpu, &v84_pmmir); 6926 } 6927 } 6928 6929 #ifndef CONFIG_USER_ONLY 6930 /* 6931 * We don't know until after realize whether there's a GICv3 6932 * attached, and that is what registers the gicv3 sysregs. 6933 * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1 6934 * at runtime. 6935 */ 6936 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri) 6937 { 6938 ARMCPU *cpu = env_archcpu(env); 6939 uint64_t pfr1 = GET_IDREG(&cpu->isar, ID_PFR1); 6940 6941 if (env->gicv3state) { 6942 pfr1 |= 1 << 28; 6943 } 6944 return pfr1; 6945 } 6946 6947 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri) 6948 { 6949 ARMCPU *cpu = env_archcpu(env); 6950 uint64_t pfr0 = GET_IDREG(&cpu->isar, ID_AA64PFR0); 6951 6952 if (env->gicv3state) { 6953 pfr0 |= 1 << 24; 6954 } 6955 return pfr0; 6956 } 6957 #endif 6958 6959 /* 6960 * Shared logic between LORID and the rest of the LOR* registers. 6961 * Secure state exclusion has already been dealt with. 6962 */ 6963 static CPAccessResult access_lor_ns(CPUARMState *env, 6964 const ARMCPRegInfo *ri, bool isread) 6965 { 6966 int el = arm_current_el(env); 6967 6968 if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) { 6969 return CP_ACCESS_TRAP_EL2; 6970 } 6971 if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) { 6972 return CP_ACCESS_TRAP_EL3; 6973 } 6974 return CP_ACCESS_OK; 6975 } 6976 6977 static CPAccessResult access_lor_other(CPUARMState *env, 6978 const ARMCPRegInfo *ri, bool isread) 6979 { 6980 if (arm_is_secure_below_el3(env)) { 6981 /* UNDEF if SCR_EL3.NS == 0 */ 6982 return CP_ACCESS_UNDEFINED; 6983 } 6984 return access_lor_ns(env, ri, isread); 6985 } 6986 6987 /* 6988 * A trivial implementation of ARMv8.1-LOR leaves all of these 6989 * registers fixed at 0, which indicates that there are zero 6990 * supported Limited Ordering regions. 6991 */ 6992 static const ARMCPRegInfo lor_reginfo[] = { 6993 { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64, 6994 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0, 6995 .access = PL1_RW, .accessfn = access_lor_other, 6996 .fgt = FGT_LORSA_EL1, 6997 .type = ARM_CP_CONST, .resetvalue = 0 }, 6998 { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64, 6999 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1, 7000 .access = PL1_RW, .accessfn = access_lor_other, 7001 .fgt = FGT_LOREA_EL1, 7002 .type = ARM_CP_CONST, .resetvalue = 0 }, 7003 { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64, 7004 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2, 7005 .access = PL1_RW, .accessfn = access_lor_other, 7006 .fgt = FGT_LORN_EL1, 7007 .type = ARM_CP_CONST, .resetvalue = 0 }, 7008 { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64, 7009 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3, 7010 .access = PL1_RW, .accessfn = access_lor_other, 7011 .fgt = FGT_LORC_EL1, 7012 .type = ARM_CP_CONST, .resetvalue = 0 }, 7013 { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64, 7014 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7, 7015 .access = PL1_R, .accessfn = access_lor_ns, 7016 .fgt = FGT_LORID_EL1, 7017 .type = ARM_CP_CONST, .resetvalue = 0 }, 7018 }; 7019 7020 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri, 7021 bool isread) 7022 { 7023 int el = arm_current_el(env); 7024 7025 if (el < 2 && 7026 arm_is_el2_enabled(env) && 7027 !(arm_hcr_el2_eff(env) & HCR_APK)) { 7028 return CP_ACCESS_TRAP_EL2; 7029 } 7030 if (el < 3 && 7031 arm_feature(env, ARM_FEATURE_EL3) && 7032 !(env->cp15.scr_el3 & SCR_APK)) { 7033 return CP_ACCESS_TRAP_EL3; 7034 } 7035 return CP_ACCESS_OK; 7036 } 7037 7038 static const ARMCPRegInfo pauth_reginfo[] = { 7039 { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7040 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0, 7041 .access = PL1_RW, .accessfn = access_pauth, 7042 .fgt = FGT_APDAKEY, 7043 .fieldoffset = offsetof(CPUARMState, keys.apda.lo) }, 7044 { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7045 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1, 7046 .access = PL1_RW, .accessfn = access_pauth, 7047 .fgt = FGT_APDAKEY, 7048 .fieldoffset = offsetof(CPUARMState, keys.apda.hi) }, 7049 { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7050 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2, 7051 .access = PL1_RW, .accessfn = access_pauth, 7052 .fgt = FGT_APDBKEY, 7053 .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) }, 7054 { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7055 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3, 7056 .access = PL1_RW, .accessfn = access_pauth, 7057 .fgt = FGT_APDBKEY, 7058 .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) }, 7059 { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7060 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0, 7061 .access = PL1_RW, .accessfn = access_pauth, 7062 .fgt = FGT_APGAKEY, 7063 .fieldoffset = offsetof(CPUARMState, keys.apga.lo) }, 7064 { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7065 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1, 7066 .access = PL1_RW, .accessfn = access_pauth, 7067 .fgt = FGT_APGAKEY, 7068 .fieldoffset = offsetof(CPUARMState, keys.apga.hi) }, 7069 { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7070 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0, 7071 .access = PL1_RW, .accessfn = access_pauth, 7072 .fgt = FGT_APIAKEY, 7073 .fieldoffset = offsetof(CPUARMState, keys.apia.lo) }, 7074 { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7075 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1, 7076 .access = PL1_RW, .accessfn = access_pauth, 7077 .fgt = FGT_APIAKEY, 7078 .fieldoffset = offsetof(CPUARMState, keys.apia.hi) }, 7079 { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64, 7080 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2, 7081 .access = PL1_RW, .accessfn = access_pauth, 7082 .fgt = FGT_APIBKEY, 7083 .fieldoffset = offsetof(CPUARMState, keys.apib.lo) }, 7084 { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64, 7085 .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3, 7086 .access = PL1_RW, .accessfn = access_pauth, 7087 .fgt = FGT_APIBKEY, 7088 .fieldoffset = offsetof(CPUARMState, keys.apib.hi) }, 7089 }; 7090 7091 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri) 7092 { 7093 Error *err = NULL; 7094 uint64_t ret; 7095 7096 /* Success sets NZCV = 0000. */ 7097 env->NF = env->CF = env->VF = 0, env->ZF = 1; 7098 7099 if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) { 7100 /* 7101 * ??? Failed, for unknown reasons in the crypto subsystem. 7102 * The best we can do is log the reason and return the 7103 * timed-out indication to the guest. There is no reason 7104 * we know to expect this failure to be transitory, so the 7105 * guest may well hang retrying the operation. 7106 */ 7107 qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s", 7108 ri->name, error_get_pretty(err)); 7109 error_free(err); 7110 7111 env->ZF = 0; /* NZCF = 0100 */ 7112 return 0; 7113 } 7114 return ret; 7115 } 7116 7117 /* We do not support re-seeding, so the two registers operate the same. */ 7118 static const ARMCPRegInfo rndr_reginfo[] = { 7119 { .name = "RNDR", .state = ARM_CP_STATE_AA64, 7120 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 7121 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0, 7122 .access = PL0_R, .readfn = rndr_readfn }, 7123 { .name = "RNDRRS", .state = ARM_CP_STATE_AA64, 7124 .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO, 7125 .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1, 7126 .access = PL0_R, .readfn = rndr_readfn }, 7127 }; 7128 7129 static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque, 7130 uint64_t value) 7131 { 7132 #ifdef CONFIG_TCG 7133 ARMCPU *cpu = env_archcpu(env); 7134 /* CTR_EL0 System register -> DminLine, bits [19:16] */ 7135 uint64_t dline_size = 4 << ((cpu->ctr >> 16) & 0xF); 7136 uint64_t vaddr_in = (uint64_t) value; 7137 uint64_t vaddr = vaddr_in & ~(dline_size - 1); 7138 void *haddr; 7139 int mem_idx = arm_env_mmu_index(env); 7140 7141 /* This won't be crossing page boundaries */ 7142 haddr = probe_read(env, vaddr, dline_size, mem_idx, GETPC()); 7143 if (haddr) { 7144 #ifndef CONFIG_USER_ONLY 7145 7146 ram_addr_t offset; 7147 MemoryRegion *mr; 7148 7149 /* RCU lock is already being held */ 7150 mr = memory_region_from_host(haddr, &offset); 7151 7152 if (mr) { 7153 memory_region_writeback(mr, offset, dline_size); 7154 } 7155 #endif /*CONFIG_USER_ONLY*/ 7156 } 7157 #else 7158 /* Handled by hardware accelerator. */ 7159 g_assert_not_reached(); 7160 #endif /* CONFIG_TCG */ 7161 } 7162 7163 static const ARMCPRegInfo dcpop_reg[] = { 7164 { .name = "DC_CVAP", .state = ARM_CP_STATE_AA64, 7165 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1, 7166 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 7167 .fgt = FGT_DCCVAP, 7168 .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn }, 7169 }; 7170 7171 static const ARMCPRegInfo dcpodp_reg[] = { 7172 { .name = "DC_CVADP", .state = ARM_CP_STATE_AA64, 7173 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1, 7174 .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END, 7175 .fgt = FGT_DCCVADP, 7176 .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn }, 7177 }; 7178 7179 static CPAccessResult access_aa64_tid5(CPUARMState *env, const ARMCPRegInfo *ri, 7180 bool isread) 7181 { 7182 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID5)) { 7183 return CP_ACCESS_TRAP_EL2; 7184 } 7185 7186 return CP_ACCESS_OK; 7187 } 7188 7189 static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri, 7190 bool isread) 7191 { 7192 int el = arm_current_el(env); 7193 if (el < 2 && arm_is_el2_enabled(env)) { 7194 uint64_t hcr = arm_hcr_el2_eff(env); 7195 if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) { 7196 return CP_ACCESS_TRAP_EL2; 7197 } 7198 } 7199 if (el < 3 && 7200 arm_feature(env, ARM_FEATURE_EL3) && 7201 !(env->cp15.scr_el3 & SCR_ATA)) { 7202 return CP_ACCESS_TRAP_EL3; 7203 } 7204 return CP_ACCESS_OK; 7205 } 7206 7207 static CPAccessResult access_tfsr_el1(CPUARMState *env, const ARMCPRegInfo *ri, 7208 bool isread) 7209 { 7210 CPAccessResult nv1 = access_nv1(env, ri, isread); 7211 7212 if (nv1 != CP_ACCESS_OK) { 7213 return nv1; 7214 } 7215 return access_mte(env, ri, isread); 7216 } 7217 7218 static CPAccessResult access_tfsr_el2(CPUARMState *env, const ARMCPRegInfo *ri, 7219 bool isread) 7220 { 7221 /* 7222 * TFSR_EL2: similar to generic access_mte(), but we need to 7223 * account for FEAT_NV. At EL1 this must be a FEAT_NV access; 7224 * if NV2 is enabled then we will redirect this to TFSR_EL1 7225 * after doing the HCR and SCR ATA traps; otherwise this will 7226 * be a trap to EL2 and the HCR/SCR traps do not apply. 7227 */ 7228 int el = arm_current_el(env); 7229 7230 if (el == 1 && (arm_hcr_el2_eff(env) & HCR_NV2)) { 7231 return CP_ACCESS_OK; 7232 } 7233 if (el < 2 && arm_is_el2_enabled(env)) { 7234 uint64_t hcr = arm_hcr_el2_eff(env); 7235 if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) { 7236 return CP_ACCESS_TRAP_EL2; 7237 } 7238 } 7239 if (el < 3 && 7240 arm_feature(env, ARM_FEATURE_EL3) && 7241 !(env->cp15.scr_el3 & SCR_ATA)) { 7242 return CP_ACCESS_TRAP_EL3; 7243 } 7244 return CP_ACCESS_OK; 7245 } 7246 7247 static uint64_t tco_read(CPUARMState *env, const ARMCPRegInfo *ri) 7248 { 7249 return env->pstate & PSTATE_TCO; 7250 } 7251 7252 static void tco_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val) 7253 { 7254 env->pstate = (env->pstate & ~PSTATE_TCO) | (val & PSTATE_TCO); 7255 } 7256 7257 static const ARMCPRegInfo mte_reginfo[] = { 7258 { .name = "TFSRE0_EL1", .state = ARM_CP_STATE_AA64, 7259 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 1, 7260 .access = PL1_RW, .accessfn = access_mte, 7261 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[0]) }, 7262 { .name = "TFSR_EL1", .state = ARM_CP_STATE_AA64, 7263 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 0, 7264 .access = PL1_RW, .accessfn = access_tfsr_el1, 7265 .nv2_redirect_offset = 0x190 | NV2_REDIR_NV1, 7266 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[1]) }, 7267 { .name = "TFSR_EL2", .state = ARM_CP_STATE_AA64, 7268 .type = ARM_CP_NV2_REDIRECT, 7269 .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 6, .opc2 = 0, 7270 .access = PL2_RW, .accessfn = access_tfsr_el2, 7271 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[2]) }, 7272 { .name = "TFSR_EL3", .state = ARM_CP_STATE_AA64, 7273 .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 6, .opc2 = 0, 7274 .access = PL3_RW, 7275 .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[3]) }, 7276 { .name = "RGSR_EL1", .state = ARM_CP_STATE_AA64, 7277 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 5, 7278 .access = PL1_RW, .accessfn = access_mte, 7279 .fieldoffset = offsetof(CPUARMState, cp15.rgsr_el1) }, 7280 { .name = "GCR_EL1", .state = ARM_CP_STATE_AA64, 7281 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 6, 7282 .access = PL1_RW, .accessfn = access_mte, 7283 .fieldoffset = offsetof(CPUARMState, cp15.gcr_el1) }, 7284 { .name = "TCO", .state = ARM_CP_STATE_AA64, 7285 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7, 7286 .type = ARM_CP_NO_RAW, 7287 .access = PL0_RW, .readfn = tco_read, .writefn = tco_write }, 7288 { .name = "DC_IGVAC", .state = ARM_CP_STATE_AA64, 7289 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 3, 7290 .type = ARM_CP_NOP, .access = PL1_W, 7291 .fgt = FGT_DCIVAC, 7292 .accessfn = aa64_cacheop_poc_access }, 7293 { .name = "DC_IGSW", .state = ARM_CP_STATE_AA64, 7294 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 4, 7295 .fgt = FGT_DCISW, 7296 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7297 { .name = "DC_IGDVAC", .state = ARM_CP_STATE_AA64, 7298 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 5, 7299 .type = ARM_CP_NOP, .access = PL1_W, 7300 .fgt = FGT_DCIVAC, 7301 .accessfn = aa64_cacheop_poc_access }, 7302 { .name = "DC_IGDSW", .state = ARM_CP_STATE_AA64, 7303 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 6, 7304 .fgt = FGT_DCISW, 7305 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7306 { .name = "DC_CGSW", .state = ARM_CP_STATE_AA64, 7307 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 4, 7308 .fgt = FGT_DCCSW, 7309 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7310 { .name = "DC_CGDSW", .state = ARM_CP_STATE_AA64, 7311 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 6, 7312 .fgt = FGT_DCCSW, 7313 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7314 { .name = "DC_CIGSW", .state = ARM_CP_STATE_AA64, 7315 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 4, 7316 .fgt = FGT_DCCISW, 7317 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7318 { .name = "DC_CIGDSW", .state = ARM_CP_STATE_AA64, 7319 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 6, 7320 .fgt = FGT_DCCISW, 7321 .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw }, 7322 }; 7323 7324 static const ARMCPRegInfo mte_tco_ro_reginfo[] = { 7325 { .name = "TCO", .state = ARM_CP_STATE_AA64, 7326 .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7, 7327 .type = ARM_CP_CONST, .access = PL0_RW, }, 7328 }; 7329 7330 static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = { 7331 { .name = "DC_CGVAC", .state = ARM_CP_STATE_AA64, 7332 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 3, 7333 .type = ARM_CP_NOP, .access = PL0_W, 7334 .fgt = FGT_DCCVAC, 7335 .accessfn = aa64_cacheop_poc_access }, 7336 { .name = "DC_CGDVAC", .state = ARM_CP_STATE_AA64, 7337 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 5, 7338 .type = ARM_CP_NOP, .access = PL0_W, 7339 .fgt = FGT_DCCVAC, 7340 .accessfn = aa64_cacheop_poc_access }, 7341 { .name = "DC_CGVAP", .state = ARM_CP_STATE_AA64, 7342 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 3, 7343 .type = ARM_CP_NOP, .access = PL0_W, 7344 .fgt = FGT_DCCVAP, 7345 .accessfn = aa64_cacheop_poc_access }, 7346 { .name = "DC_CGDVAP", .state = ARM_CP_STATE_AA64, 7347 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 5, 7348 .type = ARM_CP_NOP, .access = PL0_W, 7349 .fgt = FGT_DCCVAP, 7350 .accessfn = aa64_cacheop_poc_access }, 7351 { .name = "DC_CGVADP", .state = ARM_CP_STATE_AA64, 7352 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 3, 7353 .type = ARM_CP_NOP, .access = PL0_W, 7354 .fgt = FGT_DCCVADP, 7355 .accessfn = aa64_cacheop_poc_access }, 7356 { .name = "DC_CGDVADP", .state = ARM_CP_STATE_AA64, 7357 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 5, 7358 .type = ARM_CP_NOP, .access = PL0_W, 7359 .fgt = FGT_DCCVADP, 7360 .accessfn = aa64_cacheop_poc_access }, 7361 { .name = "DC_CIGVAC", .state = ARM_CP_STATE_AA64, 7362 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 3, 7363 .type = ARM_CP_NOP, .access = PL0_W, 7364 .fgt = FGT_DCCIVAC, 7365 .accessfn = aa64_cacheop_poc_access }, 7366 { .name = "DC_CIGDVAC", .state = ARM_CP_STATE_AA64, 7367 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 5, 7368 .type = ARM_CP_NOP, .access = PL0_W, 7369 .fgt = FGT_DCCIVAC, 7370 .accessfn = aa64_cacheop_poc_access }, 7371 { .name = "DC_GVA", .state = ARM_CP_STATE_AA64, 7372 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 3, 7373 .access = PL0_W, .type = ARM_CP_DC_GVA, 7374 #ifndef CONFIG_USER_ONLY 7375 /* Avoid overhead of an access check that always passes in user-mode */ 7376 .accessfn = aa64_zva_access, 7377 .fgt = FGT_DCZVA, 7378 #endif 7379 }, 7380 { .name = "DC_GZVA", .state = ARM_CP_STATE_AA64, 7381 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 4, 7382 .access = PL0_W, .type = ARM_CP_DC_GZVA, 7383 #ifndef CONFIG_USER_ONLY 7384 /* Avoid overhead of an access check that always passes in user-mode */ 7385 .accessfn = aa64_zva_access, 7386 .fgt = FGT_DCZVA, 7387 #endif 7388 }, 7389 }; 7390 7391 static CPAccessResult access_scxtnum(CPUARMState *env, const ARMCPRegInfo *ri, 7392 bool isread) 7393 { 7394 uint64_t hcr = arm_hcr_el2_eff(env); 7395 int el = arm_current_el(env); 7396 7397 if (el == 0 && !((hcr & HCR_E2H) && (hcr & HCR_TGE))) { 7398 if (env->cp15.sctlr_el[1] & SCTLR_TSCXT) { 7399 if (hcr & HCR_TGE) { 7400 return CP_ACCESS_TRAP_EL2; 7401 } 7402 return CP_ACCESS_TRAP_EL1; 7403 } 7404 } else if (el < 2 && (env->cp15.sctlr_el[2] & SCTLR_TSCXT)) { 7405 return CP_ACCESS_TRAP_EL2; 7406 } 7407 if (el < 2 && arm_is_el2_enabled(env) && !(hcr & HCR_ENSCXT)) { 7408 return CP_ACCESS_TRAP_EL2; 7409 } 7410 if (el < 3 7411 && arm_feature(env, ARM_FEATURE_EL3) 7412 && !(env->cp15.scr_el3 & SCR_ENSCXT)) { 7413 return CP_ACCESS_TRAP_EL3; 7414 } 7415 return CP_ACCESS_OK; 7416 } 7417 7418 static CPAccessResult access_scxtnum_el1(CPUARMState *env, 7419 const ARMCPRegInfo *ri, 7420 bool isread) 7421 { 7422 CPAccessResult nv1 = access_nv1(env, ri, isread); 7423 7424 if (nv1 != CP_ACCESS_OK) { 7425 return nv1; 7426 } 7427 return access_scxtnum(env, ri, isread); 7428 } 7429 7430 static const ARMCPRegInfo scxtnum_reginfo[] = { 7431 { .name = "SCXTNUM_EL0", .state = ARM_CP_STATE_AA64, 7432 .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 7, 7433 .access = PL0_RW, .accessfn = access_scxtnum, 7434 .fgt = FGT_SCXTNUM_EL0, 7435 .fieldoffset = offsetof(CPUARMState, scxtnum_el[0]) }, 7436 { .name = "SCXTNUM_EL1", .state = ARM_CP_STATE_AA64, 7437 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 7, 7438 .access = PL1_RW, .accessfn = access_scxtnum_el1, 7439 .fgt = FGT_SCXTNUM_EL1, 7440 .nv2_redirect_offset = 0x188 | NV2_REDIR_NV1, 7441 .fieldoffset = offsetof(CPUARMState, scxtnum_el[1]) }, 7442 { .name = "SCXTNUM_EL2", .state = ARM_CP_STATE_AA64, 7443 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 7, 7444 .access = PL2_RW, .accessfn = access_scxtnum, 7445 .fieldoffset = offsetof(CPUARMState, scxtnum_el[2]) }, 7446 { .name = "SCXTNUM_EL3", .state = ARM_CP_STATE_AA64, 7447 .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 7, 7448 .access = PL3_RW, 7449 .fieldoffset = offsetof(CPUARMState, scxtnum_el[3]) }, 7450 }; 7451 7452 static CPAccessResult access_fgt(CPUARMState *env, const ARMCPRegInfo *ri, 7453 bool isread) 7454 { 7455 if (arm_current_el(env) == 2 && 7456 arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_FGTEN)) { 7457 return CP_ACCESS_TRAP_EL3; 7458 } 7459 return CP_ACCESS_OK; 7460 } 7461 7462 static const ARMCPRegInfo fgt_reginfo[] = { 7463 { .name = "HFGRTR_EL2", .state = ARM_CP_STATE_AA64, 7464 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4, 7465 .nv2_redirect_offset = 0x1b8, 7466 .access = PL2_RW, .accessfn = access_fgt, 7467 .fieldoffset = offsetof(CPUARMState, cp15.fgt_read[FGTREG_HFGRTR]) }, 7468 { .name = "HFGWTR_EL2", .state = ARM_CP_STATE_AA64, 7469 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 5, 7470 .nv2_redirect_offset = 0x1c0, 7471 .access = PL2_RW, .accessfn = access_fgt, 7472 .fieldoffset = offsetof(CPUARMState, cp15.fgt_write[FGTREG_HFGWTR]) }, 7473 { .name = "HDFGRTR_EL2", .state = ARM_CP_STATE_AA64, 7474 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 1, .opc2 = 4, 7475 .nv2_redirect_offset = 0x1d0, 7476 .access = PL2_RW, .accessfn = access_fgt, 7477 .fieldoffset = offsetof(CPUARMState, cp15.fgt_read[FGTREG_HDFGRTR]) }, 7478 { .name = "HDFGWTR_EL2", .state = ARM_CP_STATE_AA64, 7479 .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 1, .opc2 = 5, 7480 .nv2_redirect_offset = 0x1d8, 7481 .access = PL2_RW, .accessfn = access_fgt, 7482 .fieldoffset = offsetof(CPUARMState, cp15.fgt_write[FGTREG_HDFGWTR]) }, 7483 { .name = "HFGITR_EL2", .state = ARM_CP_STATE_AA64, 7484 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 6, 7485 .nv2_redirect_offset = 0x1c8, 7486 .access = PL2_RW, .accessfn = access_fgt, 7487 .fieldoffset = offsetof(CPUARMState, cp15.fgt_exec[FGTREG_HFGITR]) }, 7488 }; 7489 7490 static void vncr_write(CPUARMState *env, const ARMCPRegInfo *ri, 7491 uint64_t value) 7492 { 7493 /* 7494 * Clear the RES0 bottom 12 bits; this means at runtime we can guarantee 7495 * that VNCR_EL2 + offset is 64-bit aligned. We don't need to do anything 7496 * about the RESS bits at the top -- we choose the "generate an EL2 7497 * translation abort on use" CONSTRAINED UNPREDICTABLE option (i.e. let 7498 * the ptw.c code detect the resulting invalid address). 7499 */ 7500 env->cp15.vncr_el2 = value & ~0xfffULL; 7501 } 7502 7503 static const ARMCPRegInfo nv2_reginfo[] = { 7504 { .name = "VNCR_EL2", .state = ARM_CP_STATE_AA64, 7505 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 2, .opc2 = 0, 7506 .access = PL2_RW, 7507 .writefn = vncr_write, 7508 .nv2_redirect_offset = 0xb0, 7509 .fieldoffset = offsetof(CPUARMState, cp15.vncr_el2) }, 7510 }; 7511 7512 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri, 7513 bool isread) 7514 { 7515 int el = arm_current_el(env); 7516 7517 if (el == 0) { 7518 uint64_t sctlr = arm_sctlr(env, el); 7519 if (!(sctlr & SCTLR_EnRCTX)) { 7520 return CP_ACCESS_TRAP_EL1; 7521 } 7522 } else if (el == 1) { 7523 uint64_t hcr = arm_hcr_el2_eff(env); 7524 if (hcr & HCR_NV) { 7525 return CP_ACCESS_TRAP_EL2; 7526 } 7527 } 7528 return CP_ACCESS_OK; 7529 } 7530 7531 static const ARMCPRegInfo predinv_reginfo[] = { 7532 { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64, 7533 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4, 7534 .fgt = FGT_CFPRCTX, 7535 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7536 { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64, 7537 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5, 7538 .fgt = FGT_DVPRCTX, 7539 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7540 { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64, 7541 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7, 7542 .fgt = FGT_CPPRCTX, 7543 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7544 /* 7545 * Note the AArch32 opcodes have a different OPC1. 7546 */ 7547 { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32, 7548 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4, 7549 .fgt = FGT_CFPRCTX, 7550 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7551 { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32, 7552 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5, 7553 .fgt = FGT_DVPRCTX, 7554 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7555 { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32, 7556 .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7, 7557 .fgt = FGT_CPPRCTX, 7558 .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv }, 7559 }; 7560 7561 static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri) 7562 { 7563 /* Read the high 32 bits of the current CCSIDR */ 7564 return extract64(ccsidr_read(env, ri), 32, 32); 7565 } 7566 7567 static const ARMCPRegInfo ccsidr2_reginfo[] = { 7568 { .name = "CCSIDR2", .state = ARM_CP_STATE_BOTH, 7569 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 2, 7570 .access = PL1_R, 7571 .accessfn = access_tid4, 7572 .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW }, 7573 }; 7574 7575 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 7576 bool isread) 7577 { 7578 if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) { 7579 return CP_ACCESS_TRAP_EL2; 7580 } 7581 7582 return CP_ACCESS_OK; 7583 } 7584 7585 static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri, 7586 bool isread) 7587 { 7588 if (arm_feature(env, ARM_FEATURE_V8)) { 7589 return access_aa64_tid3(env, ri, isread); 7590 } 7591 7592 return CP_ACCESS_OK; 7593 } 7594 7595 static CPAccessResult access_jazelle(CPUARMState *env, const ARMCPRegInfo *ri, 7596 bool isread) 7597 { 7598 if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID0)) { 7599 return CP_ACCESS_TRAP_EL2; 7600 } 7601 7602 return CP_ACCESS_OK; 7603 } 7604 7605 static CPAccessResult access_joscr_jmcr(CPUARMState *env, 7606 const ARMCPRegInfo *ri, bool isread) 7607 { 7608 /* 7609 * HSTR.TJDBX traps JOSCR and JMCR accesses, but it exists only 7610 * in v7A, not in v8A. 7611 */ 7612 if (!arm_feature(env, ARM_FEATURE_V8) && 7613 arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) && 7614 (env->cp15.hstr_el2 & HSTR_TJDBX)) { 7615 return CP_ACCESS_TRAP_EL2; 7616 } 7617 return CP_ACCESS_OK; 7618 } 7619 7620 static const ARMCPRegInfo jazelle_regs[] = { 7621 { .name = "JIDR", 7622 .cp = 14, .crn = 0, .crm = 0, .opc1 = 7, .opc2 = 0, 7623 .access = PL1_R, .accessfn = access_jazelle, 7624 .type = ARM_CP_CONST, .resetvalue = 0 }, 7625 { .name = "JOSCR", 7626 .cp = 14, .crn = 1, .crm = 0, .opc1 = 7, .opc2 = 0, 7627 .accessfn = access_joscr_jmcr, 7628 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 7629 { .name = "JMCR", 7630 .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0, 7631 .accessfn = access_joscr_jmcr, 7632 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, 7633 }; 7634 7635 static const ARMCPRegInfo contextidr_el2 = { 7636 .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64, 7637 .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1, 7638 .access = PL2_RW, 7639 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2]) 7640 }; 7641 7642 static const ARMCPRegInfo vhe_reginfo[] = { 7643 { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64, 7644 .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1, 7645 .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write, 7646 .raw_writefn = raw_write, 7647 .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) }, 7648 #ifndef CONFIG_USER_ONLY 7649 { .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64, 7650 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 2, 7651 .fieldoffset = 7652 offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].cval), 7653 .type = ARM_CP_IO, .access = PL2_RW, 7654 .writefn = gt_hv_cval_write, .raw_writefn = raw_write }, 7655 { .name = "CNTHV_TVAL_EL2", .state = ARM_CP_STATE_BOTH, 7656 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 0, 7657 .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW, 7658 .resetfn = gt_hv_timer_reset, 7659 .readfn = gt_hv_tval_read, .writefn = gt_hv_tval_write }, 7660 { .name = "CNTHV_CTL_EL2", .state = ARM_CP_STATE_BOTH, 7661 .type = ARM_CP_IO, 7662 .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 1, 7663 .access = PL2_RW, 7664 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].ctl), 7665 .writefn = gt_hv_ctl_write, .raw_writefn = raw_write }, 7666 { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64, 7667 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1, 7668 .type = ARM_CP_IO | ARM_CP_ALIAS, 7669 .access = PL2_RW, .accessfn = access_el1nvpct, 7670 .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1, 7671 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl), 7672 .writefn = gt_phys_ctl_write, .raw_writefn = raw_write }, 7673 { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64, 7674 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1, 7675 .type = ARM_CP_IO | ARM_CP_ALIAS, 7676 .access = PL2_RW, .accessfn = access_el1nvvct, 7677 .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1, 7678 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl), 7679 .writefn = gt_virt_ctl_write, .raw_writefn = raw_write }, 7680 { .name = "CNTP_TVAL_EL02", .state = ARM_CP_STATE_AA64, 7681 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 0, 7682 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 7683 .access = PL2_RW, .accessfn = e2h_access, 7684 .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write }, 7685 { .name = "CNTV_TVAL_EL02", .state = ARM_CP_STATE_AA64, 7686 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 0, 7687 .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS, 7688 .access = PL2_RW, .accessfn = e2h_access, 7689 .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write }, 7690 { .name = "CNTP_CVAL_EL02", .state = ARM_CP_STATE_AA64, 7691 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 2, 7692 .type = ARM_CP_IO | ARM_CP_ALIAS, 7693 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval), 7694 .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1, 7695 .access = PL2_RW, .accessfn = access_el1nvpct, 7696 .writefn = gt_phys_cval_write, .raw_writefn = raw_write }, 7697 { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64, 7698 .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2, 7699 .type = ARM_CP_IO | ARM_CP_ALIAS, 7700 .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1, 7701 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval), 7702 .access = PL2_RW, .accessfn = access_el1nvvct, 7703 .writefn = gt_virt_cval_write, .raw_writefn = raw_write }, 7704 #endif 7705 }; 7706 7707 #ifndef CONFIG_USER_ONLY 7708 static const ARMCPRegInfo ats1e1_reginfo[] = { 7709 { .name = "AT_S1E1RP", .state = ARM_CP_STATE_AA64, 7710 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0, 7711 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 7712 .fgt = FGT_ATS1E1RP, 7713 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 7714 { .name = "AT_S1E1WP", .state = ARM_CP_STATE_AA64, 7715 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1, 7716 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 7717 .fgt = FGT_ATS1E1WP, 7718 .accessfn = at_s1e01_access, .writefn = ats_write64 }, 7719 }; 7720 7721 static const ARMCPRegInfo ats1cp_reginfo[] = { 7722 { .name = "ATS1CPRP", 7723 .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0, 7724 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 7725 .writefn = ats_write }, 7726 { .name = "ATS1CPWP", 7727 .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1, 7728 .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, 7729 .writefn = ats_write }, 7730 }; 7731 #endif 7732 7733 /* 7734 * ACTLR2 and HACTLR2 map to ACTLR_EL1[63:32] and 7735 * ACTLR_EL2[63:32]. They exist only if the ID_MMFR4.AC2 field 7736 * is non-zero, which is never for ARMv7, optionally in ARMv8 7737 * and mandatorily for ARMv8.2 and up. 7738 * ACTLR2 is banked for S and NS if EL3 is AArch32. Since QEMU's 7739 * implementation is RAZ/WI we can ignore this detail, as we 7740 * do for ACTLR. 7741 */ 7742 static const ARMCPRegInfo actlr2_hactlr2_reginfo[] = { 7743 { .name = "ACTLR2", .state = ARM_CP_STATE_AA32, 7744 .cp = 15, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 3, 7745 .access = PL1_RW, .accessfn = access_tacr, 7746 .type = ARM_CP_CONST, .resetvalue = 0 }, 7747 { .name = "HACTLR2", .state = ARM_CP_STATE_AA32, 7748 .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3, 7749 .access = PL2_RW, .type = ARM_CP_CONST, 7750 .resetvalue = 0 }, 7751 }; 7752 7753 void register_cp_regs_for_features(ARMCPU *cpu) 7754 { 7755 /* Register all the coprocessor registers based on feature bits */ 7756 CPUARMState *env = &cpu->env; 7757 ARMISARegisters *isar = &cpu->isar; 7758 7759 if (arm_feature(env, ARM_FEATURE_M)) { 7760 /* M profile has no coprocessor registers */ 7761 return; 7762 } 7763 7764 define_arm_cp_regs(cpu, cp_reginfo); 7765 if (!arm_feature(env, ARM_FEATURE_V8)) { 7766 /* 7767 * Must go early as it is full of wildcards that may be 7768 * overridden by later definitions. 7769 */ 7770 define_arm_cp_regs(cpu, not_v8_cp_reginfo); 7771 } 7772 7773 #ifndef CONFIG_USER_ONLY 7774 define_tlb_insn_regs(cpu); 7775 #endif 7776 7777 if (arm_feature(env, ARM_FEATURE_V6)) { 7778 /* The ID registers all have impdef reset values */ 7779 ARMCPRegInfo v6_idregs[] = { 7780 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH, 7781 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, 7782 .access = PL1_R, .type = ARM_CP_CONST, 7783 .accessfn = access_aa32_tid3, 7784 .resetvalue = GET_IDREG(isar, ID_PFR0)}, 7785 /* 7786 * ID_PFR1 is not a plain ARM_CP_CONST because we don't know 7787 * the value of the GIC field until after we define these regs. 7788 */ 7789 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH, 7790 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1, 7791 .access = PL1_R, .type = ARM_CP_NO_RAW, 7792 .accessfn = access_aa32_tid3, 7793 #ifdef CONFIG_USER_ONLY 7794 .type = ARM_CP_CONST, 7795 .resetvalue = GET_IDREG(isar, ID_PFR1), 7796 #else 7797 .type = ARM_CP_NO_RAW, 7798 .accessfn = access_aa32_tid3, 7799 .readfn = id_pfr1_read, 7800 .writefn = arm_cp_write_ignore 7801 #endif 7802 }, 7803 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH, 7804 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2, 7805 .access = PL1_R, .type = ARM_CP_CONST, 7806 .accessfn = access_aa32_tid3, 7807 .resetvalue = GET_IDREG(isar, ID_DFR0)}, 7808 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH, 7809 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3, 7810 .access = PL1_R, .type = ARM_CP_CONST, 7811 .accessfn = access_aa32_tid3, 7812 .resetvalue = cpu->id_afr0 }, 7813 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH, 7814 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4, 7815 .access = PL1_R, .type = ARM_CP_CONST, 7816 .accessfn = access_aa32_tid3, 7817 .resetvalue = GET_IDREG(isar, ID_MMFR0)}, 7818 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH, 7819 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5, 7820 .access = PL1_R, .type = ARM_CP_CONST, 7821 .accessfn = access_aa32_tid3, 7822 .resetvalue = GET_IDREG(isar, ID_MMFR1)}, 7823 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH, 7824 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6, 7825 .access = PL1_R, .type = ARM_CP_CONST, 7826 .accessfn = access_aa32_tid3, 7827 .resetvalue = GET_IDREG(isar, ID_MMFR2)}, 7828 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH, 7829 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7, 7830 .access = PL1_R, .type = ARM_CP_CONST, 7831 .accessfn = access_aa32_tid3, 7832 .resetvalue = GET_IDREG(isar, ID_MMFR3)}, 7833 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH, 7834 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0, 7835 .access = PL1_R, .type = ARM_CP_CONST, 7836 .accessfn = access_aa32_tid3, 7837 .resetvalue = GET_IDREG(isar, ID_ISAR0)}, 7838 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH, 7839 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1, 7840 .access = PL1_R, .type = ARM_CP_CONST, 7841 .accessfn = access_aa32_tid3, 7842 .resetvalue = GET_IDREG(isar, ID_ISAR1)}, 7843 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH, 7844 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, 7845 .access = PL1_R, .type = ARM_CP_CONST, 7846 .accessfn = access_aa32_tid3, 7847 .resetvalue = GET_IDREG(isar, ID_ISAR2)}, 7848 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH, 7849 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3, 7850 .access = PL1_R, .type = ARM_CP_CONST, 7851 .accessfn = access_aa32_tid3, 7852 .resetvalue = GET_IDREG(isar, ID_ISAR3) }, 7853 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH, 7854 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4, 7855 .access = PL1_R, .type = ARM_CP_CONST, 7856 .accessfn = access_aa32_tid3, 7857 .resetvalue = GET_IDREG(isar, ID_ISAR4) }, 7858 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH, 7859 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5, 7860 .access = PL1_R, .type = ARM_CP_CONST, 7861 .accessfn = access_aa32_tid3, 7862 .resetvalue = GET_IDREG(isar, ID_ISAR5) }, 7863 { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH, 7864 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6, 7865 .access = PL1_R, .type = ARM_CP_CONST, 7866 .accessfn = access_aa32_tid3, 7867 .resetvalue = GET_IDREG(isar, ID_MMFR4)}, 7868 { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH, 7869 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7, 7870 .access = PL1_R, .type = ARM_CP_CONST, 7871 .accessfn = access_aa32_tid3, 7872 .resetvalue = GET_IDREG(isar, ID_ISAR6) }, 7873 }; 7874 define_arm_cp_regs(cpu, v6_idregs); 7875 define_arm_cp_regs(cpu, v6_cp_reginfo); 7876 } else { 7877 define_arm_cp_regs(cpu, not_v6_cp_reginfo); 7878 } 7879 if (arm_feature(env, ARM_FEATURE_V6K)) { 7880 define_arm_cp_regs(cpu, v6k_cp_reginfo); 7881 } 7882 if (arm_feature(env, ARM_FEATURE_V7VE)) { 7883 define_arm_cp_regs(cpu, pmovsset_cp_reginfo); 7884 } 7885 if (arm_feature(env, ARM_FEATURE_V7)) { 7886 ARMCPRegInfo clidr = { 7887 .name = "CLIDR", .state = ARM_CP_STATE_BOTH, 7888 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1, 7889 .access = PL1_R, .type = ARM_CP_CONST, 7890 .accessfn = access_tid4, 7891 .fgt = FGT_CLIDR_EL1, 7892 .resetvalue = cpu->clidr 7893 }; 7894 define_one_arm_cp_reg(cpu, &clidr); 7895 define_arm_cp_regs(cpu, v7_cp_reginfo); 7896 define_debug_regs(cpu); 7897 define_pmu_regs(cpu); 7898 } else { 7899 define_arm_cp_regs(cpu, not_v7_cp_reginfo); 7900 } 7901 if (arm_feature(env, ARM_FEATURE_V8)) { 7902 /* 7903 * v8 ID registers, which all have impdef reset values. 7904 * Note that within the ID register ranges the unused slots 7905 * must all RAZ, not UNDEF; future architecture versions may 7906 * define new registers here. 7907 * ID registers which are AArch64 views of the AArch32 ID registers 7908 * which already existed in v6 and v7 are handled elsewhere, 7909 * in v6_idregs[]. 7910 */ 7911 int i; 7912 ARMCPRegInfo v8_idregs[] = { 7913 /* 7914 * ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST in system 7915 * emulation because we don't know the right value for the 7916 * GIC field until after we define these regs. 7917 */ 7918 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64, 7919 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0, 7920 .access = PL1_R, 7921 #ifdef CONFIG_USER_ONLY 7922 .type = ARM_CP_CONST, 7923 .resetvalue = GET_IDREG(isar, ID_AA64PFR0) 7924 #else 7925 .type = ARM_CP_NO_RAW, 7926 .accessfn = access_aa64_tid3, 7927 .readfn = id_aa64pfr0_read, 7928 .writefn = arm_cp_write_ignore 7929 #endif 7930 }, 7931 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64, 7932 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1, 7933 .access = PL1_R, .type = ARM_CP_CONST, 7934 .accessfn = access_aa64_tid3, 7935 .resetvalue = GET_IDREG(isar, ID_AA64PFR1)}, 7936 { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7937 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2, 7938 .access = PL1_R, .type = ARM_CP_CONST, 7939 .accessfn = access_aa64_tid3, 7940 .resetvalue = 0 }, 7941 { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7942 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3, 7943 .access = PL1_R, .type = ARM_CP_CONST, 7944 .accessfn = access_aa64_tid3, 7945 .resetvalue = 0 }, 7946 { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64, 7947 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4, 7948 .access = PL1_R, .type = ARM_CP_CONST, 7949 .accessfn = access_aa64_tid3, 7950 .resetvalue = GET_IDREG(isar, ID_AA64ZFR0)}, 7951 { .name = "ID_AA64SMFR0_EL1", .state = ARM_CP_STATE_AA64, 7952 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5, 7953 .access = PL1_R, .type = ARM_CP_CONST, 7954 .accessfn = access_aa64_tid3, 7955 .resetvalue = GET_IDREG(isar, ID_AA64SMFR0)}, 7956 { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7957 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6, 7958 .access = PL1_R, .type = ARM_CP_CONST, 7959 .accessfn = access_aa64_tid3, 7960 .resetvalue = 0 }, 7961 { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7962 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7, 7963 .access = PL1_R, .type = ARM_CP_CONST, 7964 .accessfn = access_aa64_tid3, 7965 .resetvalue = 0 }, 7966 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64, 7967 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0, 7968 .access = PL1_R, .type = ARM_CP_CONST, 7969 .accessfn = access_aa64_tid3, 7970 .resetvalue = GET_IDREG(isar, ID_AA64DFR0) }, 7971 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64, 7972 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1, 7973 .access = PL1_R, .type = ARM_CP_CONST, 7974 .accessfn = access_aa64_tid3, 7975 .resetvalue = GET_IDREG(isar, ID_AA64DFR1) }, 7976 { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7977 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2, 7978 .access = PL1_R, .type = ARM_CP_CONST, 7979 .accessfn = access_aa64_tid3, 7980 .resetvalue = 0 }, 7981 { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7982 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3, 7983 .access = PL1_R, .type = ARM_CP_CONST, 7984 .accessfn = access_aa64_tid3, 7985 .resetvalue = 0 }, 7986 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64, 7987 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4, 7988 .access = PL1_R, .type = ARM_CP_CONST, 7989 .accessfn = access_aa64_tid3, 7990 .resetvalue = cpu->id_aa64afr0 }, 7991 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64, 7992 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5, 7993 .access = PL1_R, .type = ARM_CP_CONST, 7994 .accessfn = access_aa64_tid3, 7995 .resetvalue = cpu->id_aa64afr1 }, 7996 { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 7997 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6, 7998 .access = PL1_R, .type = ARM_CP_CONST, 7999 .accessfn = access_aa64_tid3, 8000 .resetvalue = 0 }, 8001 { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8002 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7, 8003 .access = PL1_R, .type = ARM_CP_CONST, 8004 .accessfn = access_aa64_tid3, 8005 .resetvalue = 0 }, 8006 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64, 8007 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0, 8008 .access = PL1_R, .type = ARM_CP_CONST, 8009 .accessfn = access_aa64_tid3, 8010 .resetvalue = GET_IDREG(isar, ID_AA64ISAR0)}, 8011 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64, 8012 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1, 8013 .access = PL1_R, .type = ARM_CP_CONST, 8014 .accessfn = access_aa64_tid3, 8015 .resetvalue = GET_IDREG(isar, ID_AA64ISAR1)}, 8016 { .name = "ID_AA64ISAR2_EL1", .state = ARM_CP_STATE_AA64, 8017 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2, 8018 .access = PL1_R, .type = ARM_CP_CONST, 8019 .accessfn = access_aa64_tid3, 8020 .resetvalue = GET_IDREG(isar, ID_AA64ISAR2)}, 8021 { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8022 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3, 8023 .access = PL1_R, .type = ARM_CP_CONST, 8024 .accessfn = access_aa64_tid3, 8025 .resetvalue = 0 }, 8026 { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8027 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4, 8028 .access = PL1_R, .type = ARM_CP_CONST, 8029 .accessfn = access_aa64_tid3, 8030 .resetvalue = 0 }, 8031 { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8032 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5, 8033 .access = PL1_R, .type = ARM_CP_CONST, 8034 .accessfn = access_aa64_tid3, 8035 .resetvalue = 0 }, 8036 { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8037 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6, 8038 .access = PL1_R, .type = ARM_CP_CONST, 8039 .accessfn = access_aa64_tid3, 8040 .resetvalue = 0 }, 8041 { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8042 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7, 8043 .access = PL1_R, .type = ARM_CP_CONST, 8044 .accessfn = access_aa64_tid3, 8045 .resetvalue = 0 }, 8046 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64, 8047 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, 8048 .access = PL1_R, .type = ARM_CP_CONST, 8049 .accessfn = access_aa64_tid3, 8050 .resetvalue = GET_IDREG(isar, ID_AA64MMFR0)}, 8051 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64, 8052 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1, 8053 .access = PL1_R, .type = ARM_CP_CONST, 8054 .accessfn = access_aa64_tid3, 8055 .resetvalue = GET_IDREG(isar, ID_AA64MMFR1) }, 8056 { .name = "ID_AA64MMFR2_EL1", .state = ARM_CP_STATE_AA64, 8057 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2, 8058 .access = PL1_R, .type = ARM_CP_CONST, 8059 .accessfn = access_aa64_tid3, 8060 .resetvalue = GET_IDREG(isar, ID_AA64MMFR2) }, 8061 { .name = "ID_AA64MMFR3_EL1", .state = ARM_CP_STATE_AA64, 8062 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3, 8063 .access = PL1_R, .type = ARM_CP_CONST, 8064 .accessfn = access_aa64_tid3, 8065 .resetvalue = GET_IDREG(isar, ID_AA64MMFR3) }, 8066 { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8067 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4, 8068 .access = PL1_R, .type = ARM_CP_CONST, 8069 .accessfn = access_aa64_tid3, 8070 .resetvalue = 0 }, 8071 { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8072 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5, 8073 .access = PL1_R, .type = ARM_CP_CONST, 8074 .accessfn = access_aa64_tid3, 8075 .resetvalue = 0 }, 8076 { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8077 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6, 8078 .access = PL1_R, .type = ARM_CP_CONST, 8079 .accessfn = access_aa64_tid3, 8080 .resetvalue = 0 }, 8081 { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64, 8082 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7, 8083 .access = PL1_R, .type = ARM_CP_CONST, 8084 .accessfn = access_aa64_tid3, 8085 .resetvalue = 0 }, 8086 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64, 8087 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 8088 .access = PL1_R, .type = ARM_CP_CONST, 8089 .accessfn = access_aa64_tid3, 8090 .resetvalue = cpu->isar.mvfr0 }, 8091 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64, 8092 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 8093 .access = PL1_R, .type = ARM_CP_CONST, 8094 .accessfn = access_aa64_tid3, 8095 .resetvalue = cpu->isar.mvfr1 }, 8096 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64, 8097 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 8098 .access = PL1_R, .type = ARM_CP_CONST, 8099 .accessfn = access_aa64_tid3, 8100 .resetvalue = cpu->isar.mvfr2 }, 8101 /* 8102 * "0, c0, c3, {0,1,2}" are the encodings corresponding to 8103 * AArch64 MVFR[012]_EL1. Define the STATE_AA32 encoding 8104 * as RAZ, since it is in the "reserved for future ID 8105 * registers, RAZ" part of the AArch32 encoding space. 8106 */ 8107 { .name = "RES_0_C0_C3_0", .state = ARM_CP_STATE_AA32, 8108 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0, 8109 .access = PL1_R, .type = ARM_CP_CONST, 8110 .accessfn = access_aa64_tid3, 8111 .resetvalue = 0 }, 8112 { .name = "RES_0_C0_C3_1", .state = ARM_CP_STATE_AA32, 8113 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1, 8114 .access = PL1_R, .type = ARM_CP_CONST, 8115 .accessfn = access_aa64_tid3, 8116 .resetvalue = 0 }, 8117 { .name = "RES_0_C0_C3_2", .state = ARM_CP_STATE_AA32, 8118 .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, 8119 .access = PL1_R, .type = ARM_CP_CONST, 8120 .accessfn = access_aa64_tid3, 8121 .resetvalue = 0 }, 8122 /* 8123 * Other encodings in "0, c0, c3, ..." are STATE_BOTH because 8124 * they're also RAZ for AArch64, and in v8 are gradually 8125 * being filled with AArch64-view-of-AArch32-ID-register 8126 * for new ID registers. 8127 */ 8128 { .name = "RES_0_C0_C3_3", .state = ARM_CP_STATE_BOTH, 8129 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3, 8130 .access = PL1_R, .type = ARM_CP_CONST, 8131 .accessfn = access_aa64_tid3, 8132 .resetvalue = 0 }, 8133 { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH, 8134 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4, 8135 .access = PL1_R, .type = ARM_CP_CONST, 8136 .accessfn = access_aa64_tid3, 8137 .resetvalue = GET_IDREG(isar, ID_PFR2)}, 8138 { .name = "ID_DFR1", .state = ARM_CP_STATE_BOTH, 8139 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5, 8140 .access = PL1_R, .type = ARM_CP_CONST, 8141 .accessfn = access_aa64_tid3, 8142 .resetvalue = GET_IDREG(isar, ID_DFR1)}, 8143 { .name = "ID_MMFR5", .state = ARM_CP_STATE_BOTH, 8144 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6, 8145 .access = PL1_R, .type = ARM_CP_CONST, 8146 .accessfn = access_aa64_tid3, 8147 .resetvalue = GET_IDREG(isar, ID_MMFR5)}, 8148 { .name = "RES_0_C0_C3_7", .state = ARM_CP_STATE_BOTH, 8149 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7, 8150 .access = PL1_R, .type = ARM_CP_CONST, 8151 .accessfn = access_aa64_tid3, 8152 .resetvalue = 0 }, 8153 { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, 8154 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, 8155 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 8156 .fgt = FGT_PMCEIDN_EL0, 8157 .resetvalue = extract64(cpu->pmceid0, 0, 32) }, 8158 { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, 8159 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, 8160 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 8161 .fgt = FGT_PMCEIDN_EL0, 8162 .resetvalue = cpu->pmceid0 }, 8163 { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, 8164 .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, 8165 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 8166 .fgt = FGT_PMCEIDN_EL0, 8167 .resetvalue = extract64(cpu->pmceid1, 0, 32) }, 8168 { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, 8169 .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, 8170 .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, 8171 .fgt = FGT_PMCEIDN_EL0, 8172 .resetvalue = cpu->pmceid1 }, 8173 }; 8174 #ifdef CONFIG_USER_ONLY 8175 static const ARMCPRegUserSpaceInfo v8_user_idregs[] = { 8176 { .name = "ID_AA64PFR0_EL1", 8177 .exported_bits = R_ID_AA64PFR0_FP_MASK | 8178 R_ID_AA64PFR0_ADVSIMD_MASK | 8179 R_ID_AA64PFR0_SVE_MASK | 8180 R_ID_AA64PFR0_DIT_MASK, 8181 .fixed_bits = (0x1u << R_ID_AA64PFR0_EL0_SHIFT) | 8182 (0x1u << R_ID_AA64PFR0_EL1_SHIFT) }, 8183 { .name = "ID_AA64PFR1_EL1", 8184 .exported_bits = R_ID_AA64PFR1_BT_MASK | 8185 R_ID_AA64PFR1_SSBS_MASK | 8186 R_ID_AA64PFR1_MTE_MASK | 8187 R_ID_AA64PFR1_SME_MASK }, 8188 { .name = "ID_AA64PFR*_EL1_RESERVED", 8189 .is_glob = true }, 8190 { .name = "ID_AA64ZFR0_EL1", 8191 .exported_bits = R_ID_AA64ZFR0_SVEVER_MASK | 8192 R_ID_AA64ZFR0_AES_MASK | 8193 R_ID_AA64ZFR0_BITPERM_MASK | 8194 R_ID_AA64ZFR0_BFLOAT16_MASK | 8195 R_ID_AA64ZFR0_B16B16_MASK | 8196 R_ID_AA64ZFR0_SHA3_MASK | 8197 R_ID_AA64ZFR0_SM4_MASK | 8198 R_ID_AA64ZFR0_I8MM_MASK | 8199 R_ID_AA64ZFR0_F32MM_MASK | 8200 R_ID_AA64ZFR0_F64MM_MASK }, 8201 { .name = "ID_AA64SMFR0_EL1", 8202 .exported_bits = R_ID_AA64SMFR0_F32F32_MASK | 8203 R_ID_AA64SMFR0_BI32I32_MASK | 8204 R_ID_AA64SMFR0_B16F32_MASK | 8205 R_ID_AA64SMFR0_F16F32_MASK | 8206 R_ID_AA64SMFR0_I8I32_MASK | 8207 R_ID_AA64SMFR0_F16F16_MASK | 8208 R_ID_AA64SMFR0_B16B16_MASK | 8209 R_ID_AA64SMFR0_I16I32_MASK | 8210 R_ID_AA64SMFR0_F64F64_MASK | 8211 R_ID_AA64SMFR0_I16I64_MASK | 8212 R_ID_AA64SMFR0_SMEVER_MASK | 8213 R_ID_AA64SMFR0_FA64_MASK }, 8214 { .name = "ID_AA64MMFR0_EL1", 8215 .exported_bits = R_ID_AA64MMFR0_ECV_MASK, 8216 .fixed_bits = (0xfu << R_ID_AA64MMFR0_TGRAN64_SHIFT) | 8217 (0xfu << R_ID_AA64MMFR0_TGRAN4_SHIFT) }, 8218 { .name = "ID_AA64MMFR1_EL1", 8219 .exported_bits = R_ID_AA64MMFR1_AFP_MASK }, 8220 { .name = "ID_AA64MMFR2_EL1", 8221 .exported_bits = R_ID_AA64MMFR2_AT_MASK }, 8222 { .name = "ID_AA64MMFR3_EL1", 8223 .exported_bits = 0 }, 8224 { .name = "ID_AA64MMFR*_EL1_RESERVED", 8225 .is_glob = true }, 8226 { .name = "ID_AA64DFR0_EL1", 8227 .fixed_bits = (0x6u << R_ID_AA64DFR0_DEBUGVER_SHIFT) }, 8228 { .name = "ID_AA64DFR1_EL1" }, 8229 { .name = "ID_AA64DFR*_EL1_RESERVED", 8230 .is_glob = true }, 8231 { .name = "ID_AA64AFR*", 8232 .is_glob = true }, 8233 { .name = "ID_AA64ISAR0_EL1", 8234 .exported_bits = R_ID_AA64ISAR0_AES_MASK | 8235 R_ID_AA64ISAR0_SHA1_MASK | 8236 R_ID_AA64ISAR0_SHA2_MASK | 8237 R_ID_AA64ISAR0_CRC32_MASK | 8238 R_ID_AA64ISAR0_ATOMIC_MASK | 8239 R_ID_AA64ISAR0_RDM_MASK | 8240 R_ID_AA64ISAR0_SHA3_MASK | 8241 R_ID_AA64ISAR0_SM3_MASK | 8242 R_ID_AA64ISAR0_SM4_MASK | 8243 R_ID_AA64ISAR0_DP_MASK | 8244 R_ID_AA64ISAR0_FHM_MASK | 8245 R_ID_AA64ISAR0_TS_MASK | 8246 R_ID_AA64ISAR0_RNDR_MASK }, 8247 { .name = "ID_AA64ISAR1_EL1", 8248 .exported_bits = R_ID_AA64ISAR1_DPB_MASK | 8249 R_ID_AA64ISAR1_APA_MASK | 8250 R_ID_AA64ISAR1_API_MASK | 8251 R_ID_AA64ISAR1_JSCVT_MASK | 8252 R_ID_AA64ISAR1_FCMA_MASK | 8253 R_ID_AA64ISAR1_LRCPC_MASK | 8254 R_ID_AA64ISAR1_GPA_MASK | 8255 R_ID_AA64ISAR1_GPI_MASK | 8256 R_ID_AA64ISAR1_FRINTTS_MASK | 8257 R_ID_AA64ISAR1_SB_MASK | 8258 R_ID_AA64ISAR1_BF16_MASK | 8259 R_ID_AA64ISAR1_DGH_MASK | 8260 R_ID_AA64ISAR1_I8MM_MASK }, 8261 { .name = "ID_AA64ISAR2_EL1", 8262 .exported_bits = R_ID_AA64ISAR2_WFXT_MASK | 8263 R_ID_AA64ISAR2_RPRES_MASK | 8264 R_ID_AA64ISAR2_GPA3_MASK | 8265 R_ID_AA64ISAR2_APA3_MASK | 8266 R_ID_AA64ISAR2_MOPS_MASK | 8267 R_ID_AA64ISAR2_BC_MASK | 8268 R_ID_AA64ISAR2_RPRFM_MASK | 8269 R_ID_AA64ISAR2_CSSC_MASK }, 8270 { .name = "ID_AA64ISAR*_EL1_RESERVED", 8271 .is_glob = true }, 8272 }; 8273 modify_arm_cp_regs(v8_idregs, v8_user_idregs); 8274 #endif 8275 /* 8276 * RVBAR_EL1 and RMR_EL1 only implemented if EL1 is the highest EL. 8277 * TODO: For RMR, a write with bit 1 set should do something with 8278 * cpu_reset(). In the meantime, "the bit is strictly a request", 8279 * so we are in spec just ignoring writes. 8280 */ 8281 if (!arm_feature(env, ARM_FEATURE_EL3) && 8282 !arm_feature(env, ARM_FEATURE_EL2)) { 8283 ARMCPRegInfo el1_reset_regs[] = { 8284 { .name = "RVBAR_EL1", .state = ARM_CP_STATE_BOTH, 8285 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 8286 .access = PL1_R, 8287 .fieldoffset = offsetof(CPUARMState, cp15.rvbar) }, 8288 { .name = "RMR_EL1", .state = ARM_CP_STATE_BOTH, 8289 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2, 8290 .access = PL1_RW, .type = ARM_CP_CONST, 8291 .resetvalue = arm_feature(env, ARM_FEATURE_AARCH64) } 8292 }; 8293 define_arm_cp_regs(cpu, el1_reset_regs); 8294 } 8295 define_arm_cp_regs(cpu, v8_idregs); 8296 define_arm_cp_regs(cpu, v8_cp_reginfo); 8297 if (cpu_isar_feature(aa64_aa32_el1, cpu)) { 8298 define_arm_cp_regs(cpu, v8_aa32_el1_reginfo); 8299 } 8300 8301 for (i = 4; i < 16; i++) { 8302 /* 8303 * Encodings in "0, c0, {c4-c7}, {0-7}" are RAZ for AArch32. 8304 * For pre-v8 cores there are RAZ patterns for these in 8305 * id_pre_v8_midr_cp_reginfo[]; for v8 we do that here. 8306 * v8 extends the "must RAZ" part of the ID register space 8307 * to also cover c0, 0, c{8-15}, {0-7}. 8308 * These are STATE_AA32 because in the AArch64 sysreg space 8309 * c4-c7 is where the AArch64 ID registers live (and we've 8310 * already defined those in v8_idregs[]), and c8-c15 are not 8311 * "must RAZ" for AArch64. 8312 */ 8313 g_autofree char *name = g_strdup_printf("RES_0_C0_C%d_X", i); 8314 ARMCPRegInfo v8_aa32_raz_idregs = { 8315 .name = name, 8316 .state = ARM_CP_STATE_AA32, 8317 .cp = 15, .opc1 = 0, .crn = 0, .crm = i, .opc2 = CP_ANY, 8318 .access = PL1_R, .type = ARM_CP_CONST, 8319 .accessfn = access_aa64_tid3, 8320 .resetvalue = 0 }; 8321 define_one_arm_cp_reg(cpu, &v8_aa32_raz_idregs); 8322 } 8323 } 8324 8325 /* 8326 * Register the base EL2 cpregs. 8327 * Pre v8, these registers are implemented only as part of the 8328 * Virtualization Extensions (EL2 present). Beginning with v8, 8329 * if EL2 is missing but EL3 is enabled, mostly these become 8330 * RES0 from EL3, with some specific exceptions. 8331 */ 8332 if (arm_feature(env, ARM_FEATURE_EL2) 8333 || (arm_feature(env, ARM_FEATURE_EL3) 8334 && arm_feature(env, ARM_FEATURE_V8))) { 8335 uint64_t vmpidr_def = mpidr_read_val(env); 8336 ARMCPRegInfo vpidr_regs[] = { 8337 { .name = "VPIDR", .state = ARM_CP_STATE_AA32, 8338 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 8339 .access = PL2_RW, .accessfn = access_el3_aa32ns, 8340 .resetvalue = cpu->midr, 8341 .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ, 8342 .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) }, 8343 { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64, 8344 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0, 8345 .access = PL2_RW, .resetvalue = cpu->midr, 8346 .type = ARM_CP_EL3_NO_EL2_C_NZ, 8347 .nv2_redirect_offset = 0x88, 8348 .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) }, 8349 { .name = "VMPIDR", .state = ARM_CP_STATE_AA32, 8350 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 8351 .access = PL2_RW, .accessfn = access_el3_aa32ns, 8352 .resetvalue = vmpidr_def, 8353 .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ, 8354 .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) }, 8355 { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64, 8356 .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5, 8357 .access = PL2_RW, .resetvalue = vmpidr_def, 8358 .type = ARM_CP_EL3_NO_EL2_C_NZ, 8359 .nv2_redirect_offset = 0x50, 8360 .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) }, 8361 }; 8362 /* 8363 * The only field of MDCR_EL2 that has a defined architectural reset 8364 * value is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N. 8365 */ 8366 ARMCPRegInfo mdcr_el2 = { 8367 .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, .type = ARM_CP_IO, 8368 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, 8369 .writefn = mdcr_el2_write, 8370 .access = PL2_RW, .resetvalue = pmu_num_counters(env), 8371 .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), 8372 }; 8373 define_one_arm_cp_reg(cpu, &mdcr_el2); 8374 define_arm_cp_regs(cpu, vpidr_regs); 8375 define_arm_cp_regs(cpu, el2_cp_reginfo); 8376 if (arm_feature(env, ARM_FEATURE_V8)) { 8377 define_arm_cp_regs(cpu, el2_v8_cp_reginfo); 8378 } 8379 if (cpu_isar_feature(aa64_sel2, cpu)) { 8380 define_arm_cp_regs(cpu, el2_sec_cp_reginfo); 8381 } 8382 /* 8383 * RVBAR_EL2 and RMR_EL2 only implemented if EL2 is the highest EL. 8384 * See commentary near RMR_EL1. 8385 */ 8386 if (!arm_feature(env, ARM_FEATURE_EL3)) { 8387 static const ARMCPRegInfo el2_reset_regs[] = { 8388 { .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64, 8389 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1, 8390 .access = PL2_R, 8391 .fieldoffset = offsetof(CPUARMState, cp15.rvbar) }, 8392 { .name = "RVBAR", .type = ARM_CP_ALIAS, 8393 .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1, 8394 .access = PL2_R, 8395 .fieldoffset = offsetof(CPUARMState, cp15.rvbar) }, 8396 { .name = "RMR_EL2", .state = ARM_CP_STATE_AA64, 8397 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 2, 8398 .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 1 }, 8399 }; 8400 define_arm_cp_regs(cpu, el2_reset_regs); 8401 } 8402 } 8403 8404 /* Register the base EL3 cpregs. */ 8405 if (arm_feature(env, ARM_FEATURE_EL3)) { 8406 define_arm_cp_regs(cpu, el3_cp_reginfo); 8407 ARMCPRegInfo el3_regs[] = { 8408 { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64, 8409 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1, 8410 .access = PL3_R, 8411 .fieldoffset = offsetof(CPUARMState, cp15.rvbar), }, 8412 { .name = "RMR_EL3", .state = ARM_CP_STATE_AA64, 8413 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 2, 8414 .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 1 }, 8415 { .name = "RMR", .state = ARM_CP_STATE_AA32, 8416 .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2, 8417 .access = PL3_RW, .type = ARM_CP_CONST, 8418 .resetvalue = arm_feature(env, ARM_FEATURE_AARCH64) }, 8419 { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64, 8420 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0, 8421 .access = PL3_RW, 8422 .raw_writefn = raw_write, .writefn = sctlr_write, 8423 .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]), 8424 .resetvalue = cpu->reset_sctlr }, 8425 }; 8426 8427 define_arm_cp_regs(cpu, el3_regs); 8428 } 8429 /* 8430 * The behaviour of NSACR is sufficiently various that we don't 8431 * try to describe it in a single reginfo: 8432 * if EL3 is 64 bit, then trap to EL3 from S EL1, 8433 * reads as constant 0xc00 from NS EL1 and NS EL2 8434 * if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2 8435 * if v7 without EL3, register doesn't exist 8436 * if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2 8437 */ 8438 if (arm_feature(env, ARM_FEATURE_EL3)) { 8439 if (arm_feature(env, ARM_FEATURE_AARCH64)) { 8440 static const ARMCPRegInfo nsacr = { 8441 .name = "NSACR", .type = ARM_CP_CONST, 8442 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 8443 .access = PL1_RW, .accessfn = nsacr_access, 8444 .resetvalue = 0xc00 8445 }; 8446 define_one_arm_cp_reg(cpu, &nsacr); 8447 } else { 8448 static const ARMCPRegInfo nsacr = { 8449 .name = "NSACR", 8450 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 8451 .access = PL3_RW | PL1_R, 8452 .resetvalue = 0, 8453 .fieldoffset = offsetof(CPUARMState, cp15.nsacr) 8454 }; 8455 define_one_arm_cp_reg(cpu, &nsacr); 8456 } 8457 } else { 8458 if (arm_feature(env, ARM_FEATURE_V8)) { 8459 static const ARMCPRegInfo nsacr = { 8460 .name = "NSACR", .type = ARM_CP_CONST, 8461 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2, 8462 .access = PL1_R, 8463 .resetvalue = 0xc00 8464 }; 8465 define_one_arm_cp_reg(cpu, &nsacr); 8466 } 8467 } 8468 8469 if (arm_feature(env, ARM_FEATURE_PMSA)) { 8470 if (arm_feature(env, ARM_FEATURE_V6)) { 8471 /* PMSAv6 not implemented */ 8472 assert(arm_feature(env, ARM_FEATURE_V7)); 8473 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 8474 define_arm_cp_regs(cpu, pmsav7_cp_reginfo); 8475 } else { 8476 define_arm_cp_regs(cpu, pmsav5_cp_reginfo); 8477 } 8478 } else { 8479 define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo); 8480 define_arm_cp_regs(cpu, vmsa_cp_reginfo); 8481 /* TTCBR2 is introduced with ARMv8.2-AA32HPD. */ 8482 if (cpu_isar_feature(aa32_hpd, cpu)) { 8483 define_one_arm_cp_reg(cpu, &ttbcr2_reginfo); 8484 } 8485 } 8486 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) { 8487 define_arm_cp_regs(cpu, t2ee_cp_reginfo); 8488 } 8489 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) { 8490 define_arm_cp_regs(cpu, generic_timer_cp_reginfo); 8491 } 8492 if (cpu_isar_feature(aa64_ecv_traps, cpu)) { 8493 define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo); 8494 } 8495 #ifndef CONFIG_USER_ONLY 8496 if (cpu_isar_feature(aa64_ecv, cpu)) { 8497 define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo); 8498 } 8499 #endif 8500 if (arm_feature(env, ARM_FEATURE_VAPA)) { 8501 ARMCPRegInfo vapa_cp_reginfo[] = { 8502 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0, 8503 .access = PL1_RW, .resetvalue = 0, 8504 .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s), 8505 offsetoflow32(CPUARMState, cp15.par_ns) }, 8506 .writefn = par_write}, 8507 #ifndef CONFIG_USER_ONLY 8508 /* This underdecoding is safe because the reginfo is NO_RAW. */ 8509 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY, 8510 .access = PL1_W, .accessfn = ats_access, 8511 .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC }, 8512 #endif 8513 }; 8514 8515 /* 8516 * When LPAE exists this 32-bit PAR register is an alias of the 8517 * 64-bit AArch32 PAR register defined in lpae_cp_reginfo[] 8518 */ 8519 if (arm_feature(env, ARM_FEATURE_LPAE)) { 8520 vapa_cp_reginfo[0].type = ARM_CP_ALIAS | ARM_CP_NO_GDB; 8521 } 8522 define_arm_cp_regs(cpu, vapa_cp_reginfo); 8523 } 8524 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) { 8525 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo); 8526 } 8527 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) { 8528 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo); 8529 } 8530 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) { 8531 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo); 8532 } 8533 if (arm_feature(env, ARM_FEATURE_OMAPCP)) { 8534 define_arm_cp_regs(cpu, omap_cp_reginfo); 8535 } 8536 if (arm_feature(env, ARM_FEATURE_STRONGARM)) { 8537 define_arm_cp_regs(cpu, strongarm_cp_reginfo); 8538 } 8539 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 8540 define_arm_cp_regs(cpu, xscale_cp_reginfo); 8541 } 8542 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) { 8543 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo); 8544 } 8545 if (arm_feature(env, ARM_FEATURE_LPAE)) { 8546 define_arm_cp_regs(cpu, lpae_cp_reginfo); 8547 } 8548 if (cpu_isar_feature(aa32_jazelle, cpu)) { 8549 define_arm_cp_regs(cpu, jazelle_regs); 8550 } 8551 /* 8552 * Slightly awkwardly, the OMAP and StrongARM cores need all of 8553 * cp15 crn=0 to be writes-ignored, whereas for other cores they should 8554 * be read-only (ie write causes UNDEF exception). 8555 */ 8556 { 8557 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = { 8558 /* 8559 * Pre-v8 MIDR space. 8560 * Note that the MIDR isn't a simple constant register because 8561 * of the TI925 behaviour where writes to another register can 8562 * cause the MIDR value to change. 8563 * 8564 * Unimplemented registers in the c15 0 0 0 space default to 8565 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR 8566 * and friends override accordingly. 8567 */ 8568 { .name = "MIDR", 8569 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY, 8570 .access = PL1_R, .resetvalue = cpu->midr, 8571 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write, 8572 .readfn = midr_read, 8573 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 8574 .type = ARM_CP_OVERRIDE }, 8575 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */ 8576 { .name = "DUMMY", 8577 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY, 8578 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8579 { .name = "DUMMY", 8580 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY, 8581 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8582 { .name = "DUMMY", 8583 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY, 8584 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8585 { .name = "DUMMY", 8586 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY, 8587 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8588 { .name = "DUMMY", 8589 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY, 8590 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, 8591 }; 8592 ARMCPRegInfo id_v8_midr_cp_reginfo[] = { 8593 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH, 8594 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0, 8595 .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr, 8596 .fgt = FGT_MIDR_EL1, 8597 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid), 8598 .readfn = midr_read }, 8599 /* crn = 0 op1 = 0 crm = 0 op2 = 7 : AArch32 aliases of MIDR */ 8600 { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST, 8601 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7, 8602 .access = PL1_R, .resetvalue = cpu->midr }, 8603 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH, 8604 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6, 8605 .access = PL1_R, 8606 .accessfn = access_aa64_tid1, 8607 .fgt = FGT_REVIDR_EL1, 8608 .type = ARM_CP_CONST, .resetvalue = cpu->revidr }, 8609 }; 8610 ARMCPRegInfo id_v8_midr_alias_cp_reginfo = { 8611 .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST | ARM_CP_NO_GDB, 8612 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 8613 .access = PL1_R, .resetvalue = cpu->midr 8614 }; 8615 ARMCPRegInfo id_cp_reginfo[] = { 8616 /* These are common to v8 and pre-v8 */ 8617 { .name = "CTR", 8618 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1, 8619 .access = PL1_R, .accessfn = ctr_el0_access, 8620 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 8621 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64, 8622 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0, 8623 .access = PL0_R, .accessfn = ctr_el0_access, 8624 .fgt = FGT_CTR_EL0, 8625 .type = ARM_CP_CONST, .resetvalue = cpu->ctr }, 8626 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */ 8627 { .name = "TCMTR", 8628 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2, 8629 .access = PL1_R, 8630 .accessfn = access_aa32_tid1, 8631 .type = ARM_CP_CONST, .resetvalue = 0 }, 8632 }; 8633 /* TLBTR is specific to VMSA */ 8634 ARMCPRegInfo id_tlbtr_reginfo = { 8635 .name = "TLBTR", 8636 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3, 8637 .access = PL1_R, 8638 .accessfn = access_aa32_tid1, 8639 .type = ARM_CP_CONST, .resetvalue = 0, 8640 }; 8641 /* MPUIR is specific to PMSA V6+ */ 8642 ARMCPRegInfo id_mpuir_reginfo = { 8643 .name = "MPUIR", 8644 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4, 8645 .access = PL1_R, .type = ARM_CP_CONST, 8646 .resetvalue = cpu->pmsav7_dregion << 8 8647 }; 8648 /* HMPUIR is specific to PMSA V8 */ 8649 ARMCPRegInfo id_hmpuir_reginfo = { 8650 .name = "HMPUIR", 8651 .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 4, 8652 .access = PL2_R, .type = ARM_CP_CONST, 8653 .resetvalue = cpu->pmsav8r_hdregion 8654 }; 8655 static const ARMCPRegInfo crn0_wi_reginfo = { 8656 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY, 8657 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W, 8658 .type = ARM_CP_NOP | ARM_CP_OVERRIDE 8659 }; 8660 #ifdef CONFIG_USER_ONLY 8661 static const ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = { 8662 { .name = "MIDR_EL1", 8663 .exported_bits = R_MIDR_EL1_REVISION_MASK | 8664 R_MIDR_EL1_PARTNUM_MASK | 8665 R_MIDR_EL1_ARCHITECTURE_MASK | 8666 R_MIDR_EL1_VARIANT_MASK | 8667 R_MIDR_EL1_IMPLEMENTER_MASK }, 8668 { .name = "REVIDR_EL1" }, 8669 }; 8670 modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo); 8671 #endif 8672 if (arm_feature(env, ARM_FEATURE_OMAPCP) || 8673 arm_feature(env, ARM_FEATURE_STRONGARM)) { 8674 size_t i; 8675 /* 8676 * Register the blanket "writes ignored" value first to cover the 8677 * whole space. Then update the specific ID registers to allow write 8678 * access, so that they ignore writes rather than causing them to 8679 * UNDEF. 8680 */ 8681 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo); 8682 for (i = 0; i < ARRAY_SIZE(id_pre_v8_midr_cp_reginfo); ++i) { 8683 id_pre_v8_midr_cp_reginfo[i].access = PL1_RW; 8684 } 8685 for (i = 0; i < ARRAY_SIZE(id_cp_reginfo); ++i) { 8686 id_cp_reginfo[i].access = PL1_RW; 8687 } 8688 id_mpuir_reginfo.access = PL1_RW; 8689 id_tlbtr_reginfo.access = PL1_RW; 8690 } 8691 if (arm_feature(env, ARM_FEATURE_V8)) { 8692 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo); 8693 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 8694 define_one_arm_cp_reg(cpu, &id_v8_midr_alias_cp_reginfo); 8695 } 8696 } else { 8697 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo); 8698 } 8699 define_arm_cp_regs(cpu, id_cp_reginfo); 8700 if (!arm_feature(env, ARM_FEATURE_PMSA)) { 8701 define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo); 8702 } else if (arm_feature(env, ARM_FEATURE_PMSA) && 8703 arm_feature(env, ARM_FEATURE_V8)) { 8704 uint32_t i = 0; 8705 char *tmp_string; 8706 8707 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 8708 define_one_arm_cp_reg(cpu, &id_hmpuir_reginfo); 8709 define_arm_cp_regs(cpu, pmsav8r_cp_reginfo); 8710 8711 /* Register alias is only valid for first 32 indexes */ 8712 for (i = 0; i < MIN(cpu->pmsav7_dregion, 32); ++i) { 8713 uint8_t crm = 0b1000 | extract32(i, 1, 3); 8714 uint8_t opc1 = extract32(i, 4, 1); 8715 uint8_t opc2 = extract32(i, 0, 1) << 2; 8716 8717 tmp_string = g_strdup_printf("PRBAR%u", i); 8718 ARMCPRegInfo tmp_prbarn_reginfo = { 8719 .name = tmp_string, .type = ARM_CP_ALIAS | ARM_CP_NO_RAW, 8720 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 8721 .access = PL1_RW, .resetvalue = 0, 8722 .accessfn = access_tvm_trvm, 8723 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 8724 }; 8725 define_one_arm_cp_reg(cpu, &tmp_prbarn_reginfo); 8726 g_free(tmp_string); 8727 8728 opc2 = extract32(i, 0, 1) << 2 | 0x1; 8729 tmp_string = g_strdup_printf("PRLAR%u", i); 8730 ARMCPRegInfo tmp_prlarn_reginfo = { 8731 .name = tmp_string, .type = ARM_CP_ALIAS | ARM_CP_NO_RAW, 8732 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 8733 .access = PL1_RW, .resetvalue = 0, 8734 .accessfn = access_tvm_trvm, 8735 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 8736 }; 8737 define_one_arm_cp_reg(cpu, &tmp_prlarn_reginfo); 8738 g_free(tmp_string); 8739 } 8740 8741 /* Register alias is only valid for first 32 indexes */ 8742 for (i = 0; i < MIN(cpu->pmsav8r_hdregion, 32); ++i) { 8743 uint8_t crm = 0b1000 | extract32(i, 1, 3); 8744 uint8_t opc1 = 0b100 | extract32(i, 4, 1); 8745 uint8_t opc2 = extract32(i, 0, 1) << 2; 8746 8747 tmp_string = g_strdup_printf("HPRBAR%u", i); 8748 ARMCPRegInfo tmp_hprbarn_reginfo = { 8749 .name = tmp_string, 8750 .type = ARM_CP_NO_RAW, 8751 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 8752 .access = PL2_RW, .resetvalue = 0, 8753 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 8754 }; 8755 define_one_arm_cp_reg(cpu, &tmp_hprbarn_reginfo); 8756 g_free(tmp_string); 8757 8758 opc2 = extract32(i, 0, 1) << 2 | 0x1; 8759 tmp_string = g_strdup_printf("HPRLAR%u", i); 8760 ARMCPRegInfo tmp_hprlarn_reginfo = { 8761 .name = tmp_string, 8762 .type = ARM_CP_NO_RAW, 8763 .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2, 8764 .access = PL2_RW, .resetvalue = 0, 8765 .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read 8766 }; 8767 define_one_arm_cp_reg(cpu, &tmp_hprlarn_reginfo); 8768 g_free(tmp_string); 8769 } 8770 } else if (arm_feature(env, ARM_FEATURE_V7)) { 8771 define_one_arm_cp_reg(cpu, &id_mpuir_reginfo); 8772 } 8773 } 8774 8775 if (arm_feature(env, ARM_FEATURE_MPIDR)) { 8776 ARMCPRegInfo mpidr_cp_reginfo[] = { 8777 { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH, 8778 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5, 8779 .fgt = FGT_MPIDR_EL1, 8780 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW }, 8781 }; 8782 #ifdef CONFIG_USER_ONLY 8783 static const ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = { 8784 { .name = "MPIDR_EL1", 8785 .fixed_bits = 0x0000000080000000 }, 8786 }; 8787 modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo); 8788 #endif 8789 define_arm_cp_regs(cpu, mpidr_cp_reginfo); 8790 } 8791 8792 if (arm_feature(env, ARM_FEATURE_AUXCR)) { 8793 ARMCPRegInfo auxcr_reginfo[] = { 8794 { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH, 8795 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1, 8796 .access = PL1_RW, .accessfn = access_tacr, 8797 .nv2_redirect_offset = 0x118, 8798 .type = ARM_CP_CONST, .resetvalue = cpu->reset_auxcr }, 8799 { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH, 8800 .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1, 8801 .access = PL2_RW, .type = ARM_CP_CONST, 8802 .resetvalue = 0 }, 8803 { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64, 8804 .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1, 8805 .access = PL3_RW, .type = ARM_CP_CONST, 8806 .resetvalue = 0 }, 8807 }; 8808 define_arm_cp_regs(cpu, auxcr_reginfo); 8809 if (cpu_isar_feature(aa32_ac2, cpu)) { 8810 define_arm_cp_regs(cpu, actlr2_hactlr2_reginfo); 8811 } 8812 } 8813 8814 if (arm_feature(env, ARM_FEATURE_CBAR)) { 8815 /* 8816 * CBAR is IMPDEF, but common on Arm Cortex-A implementations. 8817 * There are two flavours: 8818 * (1) older 32-bit only cores have a simple 32-bit CBAR 8819 * (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a 8820 * 32-bit register visible to AArch32 at a different encoding 8821 * to the "flavour 1" register and with the bits rearranged to 8822 * be able to squash a 64-bit address into the 32-bit view. 8823 * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but 8824 * in future if we support AArch32-only configs of some of the 8825 * AArch64 cores we might need to add a specific feature flag 8826 * to indicate cores with "flavour 2" CBAR. 8827 */ 8828 if (arm_feature(env, ARM_FEATURE_V8)) { 8829 /* 32 bit view is [31:18] 0...0 [43:32]. */ 8830 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18) 8831 | extract64(cpu->reset_cbar, 32, 12); 8832 ARMCPRegInfo cbar_reginfo[] = { 8833 { .name = "CBAR", 8834 .type = ARM_CP_CONST, 8835 .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0, 8836 .access = PL1_R, .resetvalue = cbar32 }, 8837 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64, 8838 .type = ARM_CP_CONST, 8839 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0, 8840 .access = PL1_R, .resetvalue = cpu->reset_cbar }, 8841 }; 8842 /* We don't implement a r/w 64 bit CBAR currently */ 8843 assert(arm_feature(env, ARM_FEATURE_CBAR_RO)); 8844 define_arm_cp_regs(cpu, cbar_reginfo); 8845 } else { 8846 ARMCPRegInfo cbar = { 8847 .name = "CBAR", 8848 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0, 8849 .access = PL1_R | PL3_W, .resetvalue = cpu->reset_cbar, 8850 .fieldoffset = offsetof(CPUARMState, 8851 cp15.c15_config_base_address) 8852 }; 8853 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { 8854 cbar.access = PL1_R; 8855 cbar.fieldoffset = 0; 8856 cbar.type = ARM_CP_CONST; 8857 } 8858 define_one_arm_cp_reg(cpu, &cbar); 8859 } 8860 } 8861 8862 if (arm_feature(env, ARM_FEATURE_VBAR)) { 8863 static const ARMCPRegInfo vbar_cp_reginfo[] = { 8864 { .name = "VBAR", .state = ARM_CP_STATE_BOTH, 8865 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, 8866 .access = PL1_RW, .writefn = vbar_write, 8867 .accessfn = access_nv1, 8868 .fgt = FGT_VBAR_EL1, 8869 .nv2_redirect_offset = 0x250 | NV2_REDIR_NV1, 8870 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s), 8871 offsetof(CPUARMState, cp15.vbar_ns) }, 8872 .resetvalue = 0 }, 8873 }; 8874 define_arm_cp_regs(cpu, vbar_cp_reginfo); 8875 } 8876 8877 /* Generic registers whose values depend on the implementation */ 8878 { 8879 ARMCPRegInfo sctlr = { 8880 .name = "SCTLR", .state = ARM_CP_STATE_BOTH, 8881 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, 8882 .access = PL1_RW, .accessfn = access_tvm_trvm, 8883 .fgt = FGT_SCTLR_EL1, 8884 .nv2_redirect_offset = 0x110 | NV2_REDIR_NV1, 8885 .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s), 8886 offsetof(CPUARMState, cp15.sctlr_ns) }, 8887 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr, 8888 .raw_writefn = raw_write, 8889 }; 8890 if (arm_feature(env, ARM_FEATURE_XSCALE)) { 8891 /* 8892 * Normally we would always end the TB on an SCTLR write, but Linux 8893 * arch/arm/mach-pxa/sleep.S expects two instructions following 8894 * an MMU enable to execute from cache. Imitate this behaviour. 8895 */ 8896 sctlr.type |= ARM_CP_SUPPRESS_TB_END; 8897 } 8898 define_one_arm_cp_reg(cpu, &sctlr); 8899 8900 if (arm_feature(env, ARM_FEATURE_PMSA) && 8901 arm_feature(env, ARM_FEATURE_V8)) { 8902 ARMCPRegInfo vsctlr = { 8903 .name = "VSCTLR", .state = ARM_CP_STATE_AA32, 8904 .cp = 15, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0, 8905 .access = PL2_RW, .resetvalue = 0x0, 8906 .fieldoffset = offsetoflow32(CPUARMState, cp15.vsctlr), 8907 }; 8908 define_one_arm_cp_reg(cpu, &vsctlr); 8909 } 8910 } 8911 8912 if (cpu_isar_feature(aa64_lor, cpu)) { 8913 define_arm_cp_regs(cpu, lor_reginfo); 8914 } 8915 if (cpu_isar_feature(aa64_pan, cpu)) { 8916 define_one_arm_cp_reg(cpu, &pan_reginfo); 8917 } 8918 #ifndef CONFIG_USER_ONLY 8919 if (cpu_isar_feature(aa64_ats1e1, cpu)) { 8920 define_arm_cp_regs(cpu, ats1e1_reginfo); 8921 } 8922 if (cpu_isar_feature(aa32_ats1e1, cpu)) { 8923 define_arm_cp_regs(cpu, ats1cp_reginfo); 8924 } 8925 #endif 8926 if (cpu_isar_feature(aa64_uao, cpu)) { 8927 define_one_arm_cp_reg(cpu, &uao_reginfo); 8928 } 8929 8930 if (cpu_isar_feature(aa64_dit, cpu)) { 8931 define_one_arm_cp_reg(cpu, &dit_reginfo); 8932 } 8933 if (cpu_isar_feature(aa64_ssbs, cpu)) { 8934 define_one_arm_cp_reg(cpu, &ssbs_reginfo); 8935 } 8936 if (cpu_isar_feature(any_ras, cpu)) { 8937 define_arm_cp_regs(cpu, minimal_ras_reginfo); 8938 } 8939 8940 if (cpu_isar_feature(aa64_vh, cpu) || 8941 cpu_isar_feature(aa64_debugv8p2, cpu)) { 8942 define_one_arm_cp_reg(cpu, &contextidr_el2); 8943 } 8944 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 8945 define_arm_cp_regs(cpu, vhe_reginfo); 8946 } 8947 8948 if (cpu_isar_feature(aa64_sve, cpu)) { 8949 define_arm_cp_regs(cpu, zcr_reginfo); 8950 } 8951 8952 if (cpu_isar_feature(aa64_hcx, cpu)) { 8953 define_one_arm_cp_reg(cpu, &hcrx_el2_reginfo); 8954 } 8955 8956 if (cpu_isar_feature(aa64_sme, cpu)) { 8957 define_arm_cp_regs(cpu, sme_reginfo); 8958 } 8959 if (cpu_isar_feature(aa64_pauth, cpu)) { 8960 define_arm_cp_regs(cpu, pauth_reginfo); 8961 } 8962 if (cpu_isar_feature(aa64_rndr, cpu)) { 8963 define_arm_cp_regs(cpu, rndr_reginfo); 8964 } 8965 /* Data Cache clean instructions up to PoP */ 8966 if (cpu_isar_feature(aa64_dcpop, cpu)) { 8967 define_one_arm_cp_reg(cpu, dcpop_reg); 8968 8969 if (cpu_isar_feature(aa64_dcpodp, cpu)) { 8970 define_one_arm_cp_reg(cpu, dcpodp_reg); 8971 } 8972 } 8973 8974 /* 8975 * If full MTE is enabled, add all of the system registers. 8976 * If only "instructions available at EL0" are enabled, 8977 * then define only a RAZ/WI version of PSTATE.TCO. 8978 */ 8979 if (cpu_isar_feature(aa64_mte, cpu)) { 8980 ARMCPRegInfo gmid_reginfo = { 8981 .name = "GMID_EL1", .state = ARM_CP_STATE_AA64, 8982 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 4, 8983 .access = PL1_R, .accessfn = access_aa64_tid5, 8984 .type = ARM_CP_CONST, .resetvalue = cpu->gm_blocksize, 8985 }; 8986 define_one_arm_cp_reg(cpu, &gmid_reginfo); 8987 define_arm_cp_regs(cpu, mte_reginfo); 8988 define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo); 8989 } else if (cpu_isar_feature(aa64_mte_insn_reg, cpu)) { 8990 define_arm_cp_regs(cpu, mte_tco_ro_reginfo); 8991 define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo); 8992 } 8993 8994 if (cpu_isar_feature(aa64_scxtnum, cpu)) { 8995 define_arm_cp_regs(cpu, scxtnum_reginfo); 8996 } 8997 8998 if (cpu_isar_feature(aa64_fgt, cpu)) { 8999 define_arm_cp_regs(cpu, fgt_reginfo); 9000 } 9001 9002 if (cpu_isar_feature(aa64_rme, cpu)) { 9003 define_arm_cp_regs(cpu, rme_reginfo); 9004 if (cpu_isar_feature(aa64_mte, cpu)) { 9005 define_arm_cp_regs(cpu, rme_mte_reginfo); 9006 } 9007 } 9008 9009 if (cpu_isar_feature(aa64_nv2, cpu)) { 9010 define_arm_cp_regs(cpu, nv2_reginfo); 9011 } 9012 9013 if (cpu_isar_feature(aa64_nmi, cpu)) { 9014 define_arm_cp_regs(cpu, nmi_reginfo); 9015 } 9016 9017 if (cpu_isar_feature(any_predinv, cpu)) { 9018 define_arm_cp_regs(cpu, predinv_reginfo); 9019 } 9020 9021 if (cpu_isar_feature(any_ccidx, cpu)) { 9022 define_arm_cp_regs(cpu, ccsidr2_reginfo); 9023 } 9024 9025 #ifndef CONFIG_USER_ONLY 9026 /* 9027 * Register redirections and aliases must be done last, 9028 * after the registers from the other extensions have been defined. 9029 */ 9030 if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) { 9031 define_arm_vh_e2h_redirects_aliases(cpu); 9032 } 9033 #endif 9034 } 9035 9036 /* 9037 * Private utility function for define_one_arm_cp_reg_with_opaque(): 9038 * add a single reginfo struct to the hash table. 9039 */ 9040 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r, 9041 void *opaque, CPState state, 9042 CPSecureState secstate, 9043 int crm, int opc1, int opc2, 9044 const char *name) 9045 { 9046 CPUARMState *env = &cpu->env; 9047 uint32_t key; 9048 ARMCPRegInfo *r2; 9049 bool is64 = r->type & ARM_CP_64BIT; 9050 bool ns = secstate & ARM_CP_SECSTATE_NS; 9051 int cp = r->cp; 9052 size_t name_len; 9053 bool make_const; 9054 9055 switch (state) { 9056 case ARM_CP_STATE_AA32: 9057 /* We assume it is a cp15 register if the .cp field is left unset. */ 9058 if (cp == 0 && r->state == ARM_CP_STATE_BOTH) { 9059 cp = 15; 9060 } 9061 key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2); 9062 break; 9063 case ARM_CP_STATE_AA64: 9064 /* 9065 * To allow abbreviation of ARMCPRegInfo definitions, we treat 9066 * cp == 0 as equivalent to the value for "standard guest-visible 9067 * sysreg". STATE_BOTH definitions are also always "standard sysreg" 9068 * in their AArch64 view (the .cp value may be non-zero for the 9069 * benefit of the AArch32 view). 9070 */ 9071 if (cp == 0 || r->state == ARM_CP_STATE_BOTH) { 9072 cp = CP_REG_ARM64_SYSREG_CP; 9073 } 9074 key = ENCODE_AA64_CP_REG(cp, r->crn, crm, r->opc0, opc1, opc2); 9075 break; 9076 default: 9077 g_assert_not_reached(); 9078 } 9079 9080 /* Overriding of an existing definition must be explicitly requested. */ 9081 if (!(r->type & ARM_CP_OVERRIDE)) { 9082 const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key); 9083 if (oldreg) { 9084 assert(oldreg->type & ARM_CP_OVERRIDE); 9085 } 9086 } 9087 9088 /* 9089 * Eliminate registers that are not present because the EL is missing. 9090 * Doing this here makes it easier to put all registers for a given 9091 * feature into the same ARMCPRegInfo array and define them all at once. 9092 */ 9093 make_const = false; 9094 if (arm_feature(env, ARM_FEATURE_EL3)) { 9095 /* 9096 * An EL2 register without EL2 but with EL3 is (usually) RES0. 9097 * See rule RJFFP in section D1.1.3 of DDI0487H.a. 9098 */ 9099 int min_el = ctz32(r->access) / 2; 9100 if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) { 9101 if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) { 9102 return; 9103 } 9104 make_const = !(r->type & ARM_CP_EL3_NO_EL2_KEEP); 9105 } 9106 } else { 9107 CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2) 9108 ? PL2_RW : PL1_RW); 9109 if ((r->access & max_el) == 0) { 9110 return; 9111 } 9112 } 9113 9114 /* Combine cpreg and name into one allocation. */ 9115 name_len = strlen(name) + 1; 9116 r2 = g_malloc(sizeof(*r2) + name_len); 9117 *r2 = *r; 9118 r2->name = memcpy(r2 + 1, name, name_len); 9119 9120 /* 9121 * Update fields to match the instantiation, overwiting wildcards 9122 * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH. 9123 */ 9124 r2->cp = cp; 9125 r2->crm = crm; 9126 r2->opc1 = opc1; 9127 r2->opc2 = opc2; 9128 r2->state = state; 9129 r2->secure = secstate; 9130 if (opaque) { 9131 r2->opaque = opaque; 9132 } 9133 9134 if (make_const) { 9135 /* This should not have been a very special register to begin. */ 9136 int old_special = r2->type & ARM_CP_SPECIAL_MASK; 9137 assert(old_special == 0 || old_special == ARM_CP_NOP); 9138 /* 9139 * Set the special function to CONST, retaining the other flags. 9140 * This is important for e.g. ARM_CP_SVE so that we still 9141 * take the SVE trap if CPTR_EL3.EZ == 0. 9142 */ 9143 r2->type = (r2->type & ~ARM_CP_SPECIAL_MASK) | ARM_CP_CONST; 9144 /* 9145 * Usually, these registers become RES0, but there are a few 9146 * special cases like VPIDR_EL2 which have a constant non-zero 9147 * value with writes ignored. 9148 */ 9149 if (!(r->type & ARM_CP_EL3_NO_EL2_C_NZ)) { 9150 r2->resetvalue = 0; 9151 } 9152 /* 9153 * ARM_CP_CONST has precedence, so removing the callbacks and 9154 * offsets are not strictly necessary, but it is potentially 9155 * less confusing to debug later. 9156 */ 9157 r2->readfn = NULL; 9158 r2->writefn = NULL; 9159 r2->raw_readfn = NULL; 9160 r2->raw_writefn = NULL; 9161 r2->resetfn = NULL; 9162 r2->fieldoffset = 0; 9163 r2->bank_fieldoffsets[0] = 0; 9164 r2->bank_fieldoffsets[1] = 0; 9165 } else { 9166 bool isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1]; 9167 9168 if (isbanked) { 9169 /* 9170 * Register is banked (using both entries in array). 9171 * Overwriting fieldoffset as the array is only used to define 9172 * banked registers but later only fieldoffset is used. 9173 */ 9174 r2->fieldoffset = r->bank_fieldoffsets[ns]; 9175 } 9176 if (state == ARM_CP_STATE_AA32) { 9177 if (isbanked) { 9178 /* 9179 * If the register is banked then we don't need to migrate or 9180 * reset the 32-bit instance in certain cases: 9181 * 9182 * 1) If the register has both 32-bit and 64-bit instances 9183 * then we can count on the 64-bit instance taking care 9184 * of the non-secure bank. 9185 * 2) If ARMv8 is enabled then we can count on a 64-bit 9186 * version taking care of the secure bank. This requires 9187 * that separate 32 and 64-bit definitions are provided. 9188 */ 9189 if ((r->state == ARM_CP_STATE_BOTH && ns) || 9190 (arm_feature(env, ARM_FEATURE_V8) && !ns)) { 9191 r2->type |= ARM_CP_ALIAS; 9192 } 9193 } else if ((secstate != r->secure) && !ns) { 9194 /* 9195 * The register is not banked so we only want to allow 9196 * migration of the non-secure instance. 9197 */ 9198 r2->type |= ARM_CP_ALIAS; 9199 } 9200 9201 if (HOST_BIG_ENDIAN && 9202 r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) { 9203 r2->fieldoffset += sizeof(uint32_t); 9204 } 9205 } 9206 } 9207 9208 /* 9209 * By convention, for wildcarded registers only the first 9210 * entry is used for migration; the others are marked as 9211 * ALIAS so we don't try to transfer the register 9212 * multiple times. Special registers (ie NOP/WFI) are 9213 * never migratable and not even raw-accessible. 9214 */ 9215 if (r2->type & ARM_CP_SPECIAL_MASK) { 9216 r2->type |= ARM_CP_NO_RAW; 9217 } 9218 if (((r->crm == CP_ANY) && crm != 0) || 9219 ((r->opc1 == CP_ANY) && opc1 != 0) || 9220 ((r->opc2 == CP_ANY) && opc2 != 0)) { 9221 r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB; 9222 } 9223 9224 /* 9225 * Check that raw accesses are either forbidden or handled. Note that 9226 * we can't assert this earlier because the setup of fieldoffset for 9227 * banked registers has to be done first. 9228 */ 9229 if (!(r2->type & ARM_CP_NO_RAW)) { 9230 assert(!raw_accessors_invalid(r2)); 9231 } 9232 9233 g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2); 9234 } 9235 9236 9237 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, 9238 const ARMCPRegInfo *r, void *opaque) 9239 { 9240 /* 9241 * Define implementations of coprocessor registers. 9242 * We store these in a hashtable because typically 9243 * there are less than 150 registers in a space which 9244 * is 16*16*16*8*8 = 262144 in size. 9245 * Wildcarding is supported for the crm, opc1 and opc2 fields. 9246 * If a register is defined twice then the second definition is 9247 * used, so this can be used to define some generic registers and 9248 * then override them with implementation specific variations. 9249 * At least one of the original and the second definition should 9250 * include ARM_CP_OVERRIDE in its type bits -- this is just a guard 9251 * against accidental use. 9252 * 9253 * The state field defines whether the register is to be 9254 * visible in the AArch32 or AArch64 execution state. If the 9255 * state is set to ARM_CP_STATE_BOTH then we synthesise a 9256 * reginfo structure for the AArch32 view, which sees the lower 9257 * 32 bits of the 64 bit register. 9258 * 9259 * Only registers visible in AArch64 may set r->opc0; opc0 cannot 9260 * be wildcarded. AArch64 registers are always considered to be 64 9261 * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of 9262 * the register, if any. 9263 */ 9264 int crm, opc1, opc2; 9265 int crmmin = (r->crm == CP_ANY) ? 0 : r->crm; 9266 int crmmax = (r->crm == CP_ANY) ? 15 : r->crm; 9267 int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1; 9268 int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1; 9269 int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2; 9270 int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2; 9271 CPState state; 9272 9273 /* 64 bit registers have only CRm and Opc1 fields */ 9274 assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn))); 9275 /* op0 only exists in the AArch64 encodings */ 9276 assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0)); 9277 /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */ 9278 assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT)); 9279 /* 9280 * This API is only for Arm's system coprocessors (14 and 15) or 9281 * (M-profile or v7A-and-earlier only) for implementation defined 9282 * coprocessors in the range 0..7. Our decode assumes this, since 9283 * 8..13 can be used for other insns including VFP and Neon. See 9284 * valid_cp() in translate.c. Assert here that we haven't tried 9285 * to use an invalid coprocessor number. 9286 */ 9287 switch (r->state) { 9288 case ARM_CP_STATE_BOTH: 9289 /* 0 has a special meaning, but otherwise the same rules as AA32. */ 9290 if (r->cp == 0) { 9291 break; 9292 } 9293 /* fall through */ 9294 case ARM_CP_STATE_AA32: 9295 if (arm_feature(&cpu->env, ARM_FEATURE_V8) && 9296 !arm_feature(&cpu->env, ARM_FEATURE_M)) { 9297 assert(r->cp >= 14 && r->cp <= 15); 9298 } else { 9299 assert(r->cp < 8 || (r->cp >= 14 && r->cp <= 15)); 9300 } 9301 break; 9302 case ARM_CP_STATE_AA64: 9303 assert(r->cp == 0 || r->cp == CP_REG_ARM64_SYSREG_CP); 9304 break; 9305 default: 9306 g_assert_not_reached(); 9307 } 9308 /* 9309 * The AArch64 pseudocode CheckSystemAccess() specifies that op1 9310 * encodes a minimum access level for the register. We roll this 9311 * runtime check into our general permission check code, so check 9312 * here that the reginfo's specified permissions are strict enough 9313 * to encompass the generic architectural permission check. 9314 */ 9315 if (r->state != ARM_CP_STATE_AA32) { 9316 CPAccessRights mask; 9317 switch (r->opc1) { 9318 case 0: 9319 /* min_EL EL1, but some accessible to EL0 via kernel ABI */ 9320 mask = PL0U_R | PL1_RW; 9321 break; 9322 case 1: case 2: 9323 /* min_EL EL1 */ 9324 mask = PL1_RW; 9325 break; 9326 case 3: 9327 /* min_EL EL0 */ 9328 mask = PL0_RW; 9329 break; 9330 case 4: 9331 case 5: 9332 /* min_EL EL2 */ 9333 mask = PL2_RW; 9334 break; 9335 case 6: 9336 /* min_EL EL3 */ 9337 mask = PL3_RW; 9338 break; 9339 case 7: 9340 /* min_EL EL1, secure mode only (we don't check the latter) */ 9341 mask = PL1_RW; 9342 break; 9343 default: 9344 /* broken reginfo with out-of-range opc1 */ 9345 g_assert_not_reached(); 9346 } 9347 /* assert our permissions are not too lax (stricter is fine) */ 9348 assert((r->access & ~mask) == 0); 9349 } 9350 9351 /* 9352 * Check that the register definition has enough info to handle 9353 * reads and writes if they are permitted. 9354 */ 9355 if (!(r->type & (ARM_CP_SPECIAL_MASK | ARM_CP_CONST))) { 9356 if (r->access & PL3_R) { 9357 assert((r->fieldoffset || 9358 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 9359 r->readfn); 9360 } 9361 if (r->access & PL3_W) { 9362 assert((r->fieldoffset || 9363 (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) || 9364 r->writefn); 9365 } 9366 } 9367 9368 for (crm = crmmin; crm <= crmmax; crm++) { 9369 for (opc1 = opc1min; opc1 <= opc1max; opc1++) { 9370 for (opc2 = opc2min; opc2 <= opc2max; opc2++) { 9371 for (state = ARM_CP_STATE_AA32; 9372 state <= ARM_CP_STATE_AA64; state++) { 9373 if (r->state != state && r->state != ARM_CP_STATE_BOTH) { 9374 continue; 9375 } 9376 if ((r->type & ARM_CP_ADD_TLBI_NXS) && 9377 cpu_isar_feature(aa64_xs, cpu)) { 9378 /* 9379 * This is a TLBI insn which has an NXS variant. The 9380 * NXS variant is at the same encoding except that 9381 * crn is +1, and has the same behaviour except for 9382 * fine-grained trapping. Add the NXS insn here and 9383 * then fall through to add the normal register. 9384 * add_cpreg_to_hashtable() copies the cpreg struct 9385 * and name that it is passed, so it's OK to use 9386 * a local struct here. 9387 */ 9388 ARMCPRegInfo nxs_ri = *r; 9389 g_autofree char *name = g_strdup_printf("%sNXS", r->name); 9390 9391 assert(state == ARM_CP_STATE_AA64); 9392 assert(nxs_ri.crn < 0xf); 9393 nxs_ri.crn++; 9394 if (nxs_ri.fgt) { 9395 nxs_ri.fgt |= R_FGT_NXS_MASK; 9396 } 9397 add_cpreg_to_hashtable(cpu, &nxs_ri, opaque, state, 9398 ARM_CP_SECSTATE_NS, 9399 crm, opc1, opc2, name); 9400 } 9401 if (state == ARM_CP_STATE_AA32) { 9402 /* 9403 * Under AArch32 CP registers can be common 9404 * (same for secure and non-secure world) or banked. 9405 */ 9406 char *name; 9407 9408 switch (r->secure) { 9409 case ARM_CP_SECSTATE_S: 9410 case ARM_CP_SECSTATE_NS: 9411 add_cpreg_to_hashtable(cpu, r, opaque, state, 9412 r->secure, crm, opc1, opc2, 9413 r->name); 9414 break; 9415 case ARM_CP_SECSTATE_BOTH: 9416 name = g_strdup_printf("%s_S", r->name); 9417 add_cpreg_to_hashtable(cpu, r, opaque, state, 9418 ARM_CP_SECSTATE_S, 9419 crm, opc1, opc2, name); 9420 g_free(name); 9421 add_cpreg_to_hashtable(cpu, r, opaque, state, 9422 ARM_CP_SECSTATE_NS, 9423 crm, opc1, opc2, r->name); 9424 break; 9425 default: 9426 g_assert_not_reached(); 9427 } 9428 } else { 9429 /* 9430 * AArch64 registers get mapped to non-secure instance 9431 * of AArch32 9432 */ 9433 add_cpreg_to_hashtable(cpu, r, opaque, state, 9434 ARM_CP_SECSTATE_NS, 9435 crm, opc1, opc2, r->name); 9436 } 9437 } 9438 } 9439 } 9440 } 9441 } 9442 9443 /* Define a whole list of registers */ 9444 void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs, 9445 void *opaque, size_t len) 9446 { 9447 size_t i; 9448 for (i = 0; i < len; ++i) { 9449 define_one_arm_cp_reg_with_opaque(cpu, regs + i, opaque); 9450 } 9451 } 9452 9453 /* 9454 * Modify ARMCPRegInfo for access from userspace. 9455 * 9456 * This is a data driven modification directed by 9457 * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as 9458 * user-space cannot alter any values and dynamic values pertaining to 9459 * execution state are hidden from user space view anyway. 9460 */ 9461 void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len, 9462 const ARMCPRegUserSpaceInfo *mods, 9463 size_t mods_len) 9464 { 9465 for (size_t mi = 0; mi < mods_len; ++mi) { 9466 const ARMCPRegUserSpaceInfo *m = mods + mi; 9467 GPatternSpec *pat = NULL; 9468 9469 if (m->is_glob) { 9470 pat = g_pattern_spec_new(m->name); 9471 } 9472 for (size_t ri = 0; ri < regs_len; ++ri) { 9473 ARMCPRegInfo *r = regs + ri; 9474 9475 if (pat && g_pattern_match_string(pat, r->name)) { 9476 r->type = ARM_CP_CONST; 9477 r->access = PL0U_R; 9478 r->resetvalue = 0; 9479 /* continue */ 9480 } else if (strcmp(r->name, m->name) == 0) { 9481 r->type = ARM_CP_CONST; 9482 r->access = PL0U_R; 9483 r->resetvalue &= m->exported_bits; 9484 r->resetvalue |= m->fixed_bits; 9485 break; 9486 } 9487 } 9488 if (pat) { 9489 g_pattern_spec_free(pat); 9490 } 9491 } 9492 } 9493 9494 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp) 9495 { 9496 return g_hash_table_lookup(cpregs, (gpointer)(uintptr_t)encoded_cp); 9497 } 9498 9499 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 9500 uint64_t value) 9501 { 9502 /* Helper coprocessor write function for write-ignore registers */ 9503 } 9504 9505 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri) 9506 { 9507 /* Helper coprocessor write function for read-as-zero registers */ 9508 return 0; 9509 } 9510 9511 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque) 9512 { 9513 /* Helper coprocessor reset function for do-nothing-on-reset registers */ 9514 } 9515 9516 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type) 9517 { 9518 /* 9519 * Return true if it is not valid for us to switch to 9520 * this CPU mode (ie all the UNPREDICTABLE cases in 9521 * the ARM ARM CPSRWriteByInstr pseudocode). 9522 */ 9523 9524 /* Changes to or from Hyp via MSR and CPS are illegal. */ 9525 if (write_type == CPSRWriteByInstr && 9526 ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP || 9527 mode == ARM_CPU_MODE_HYP)) { 9528 return 1; 9529 } 9530 9531 switch (mode) { 9532 case ARM_CPU_MODE_USR: 9533 return 0; 9534 case ARM_CPU_MODE_SYS: 9535 case ARM_CPU_MODE_SVC: 9536 case ARM_CPU_MODE_ABT: 9537 case ARM_CPU_MODE_UND: 9538 case ARM_CPU_MODE_IRQ: 9539 case ARM_CPU_MODE_FIQ: 9540 /* 9541 * Note that we don't implement the IMPDEF NSACR.RFR which in v7 9542 * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.) 9543 */ 9544 /* 9545 * If HCR.TGE is set then changes from Monitor to NS PL1 via MSR 9546 * and CPS are treated as illegal mode changes. 9547 */ 9548 if (write_type == CPSRWriteByInstr && 9549 (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON && 9550 (arm_hcr_el2_eff(env) & HCR_TGE)) { 9551 return 1; 9552 } 9553 return 0; 9554 case ARM_CPU_MODE_HYP: 9555 return !arm_is_el2_enabled(env) || arm_current_el(env) < 2; 9556 case ARM_CPU_MODE_MON: 9557 return arm_current_el(env) < 3; 9558 default: 9559 return 1; 9560 } 9561 } 9562 9563 uint32_t cpsr_read(CPUARMState *env) 9564 { 9565 int ZF; 9566 ZF = (env->ZF == 0); 9567 return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) | 9568 (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27) 9569 | (env->thumb << 5) | ((env->condexec_bits & 3) << 25) 9570 | ((env->condexec_bits & 0xfc) << 8) 9571 | (env->GE << 16) | (env->daif & CPSR_AIF); 9572 } 9573 9574 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask, 9575 CPSRWriteType write_type) 9576 { 9577 uint32_t changed_daif; 9578 bool rebuild_hflags = (write_type != CPSRWriteRaw) && 9579 (mask & (CPSR_M | CPSR_E | CPSR_IL)); 9580 9581 if (mask & CPSR_NZCV) { 9582 env->ZF = (~val) & CPSR_Z; 9583 env->NF = val; 9584 env->CF = (val >> 29) & 1; 9585 env->VF = (val << 3) & 0x80000000; 9586 } 9587 if (mask & CPSR_Q) { 9588 env->QF = ((val & CPSR_Q) != 0); 9589 } 9590 if (mask & CPSR_T) { 9591 env->thumb = ((val & CPSR_T) != 0); 9592 } 9593 if (mask & CPSR_IT_0_1) { 9594 env->condexec_bits &= ~3; 9595 env->condexec_bits |= (val >> 25) & 3; 9596 } 9597 if (mask & CPSR_IT_2_7) { 9598 env->condexec_bits &= 3; 9599 env->condexec_bits |= (val >> 8) & 0xfc; 9600 } 9601 if (mask & CPSR_GE) { 9602 env->GE = (val >> 16) & 0xf; 9603 } 9604 9605 /* 9606 * In a V7 implementation that includes the security extensions but does 9607 * not include Virtualization Extensions the SCR.FW and SCR.AW bits control 9608 * whether non-secure software is allowed to change the CPSR_F and CPSR_A 9609 * bits respectively. 9610 * 9611 * In a V8 implementation, it is permitted for privileged software to 9612 * change the CPSR A/F bits regardless of the SCR.AW/FW bits. 9613 */ 9614 if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) && 9615 arm_feature(env, ARM_FEATURE_EL3) && 9616 !arm_feature(env, ARM_FEATURE_EL2) && 9617 !arm_is_secure(env)) { 9618 9619 changed_daif = (env->daif ^ val) & mask; 9620 9621 if (changed_daif & CPSR_A) { 9622 /* 9623 * Check to see if we are allowed to change the masking of async 9624 * abort exceptions from a non-secure state. 9625 */ 9626 if (!(env->cp15.scr_el3 & SCR_AW)) { 9627 qemu_log_mask(LOG_GUEST_ERROR, 9628 "Ignoring attempt to switch CPSR_A flag from " 9629 "non-secure world with SCR.AW bit clear\n"); 9630 mask &= ~CPSR_A; 9631 } 9632 } 9633 9634 if (changed_daif & CPSR_F) { 9635 /* 9636 * Check to see if we are allowed to change the masking of FIQ 9637 * exceptions from a non-secure state. 9638 */ 9639 if (!(env->cp15.scr_el3 & SCR_FW)) { 9640 qemu_log_mask(LOG_GUEST_ERROR, 9641 "Ignoring attempt to switch CPSR_F flag from " 9642 "non-secure world with SCR.FW bit clear\n"); 9643 mask &= ~CPSR_F; 9644 } 9645 9646 /* 9647 * Check whether non-maskable FIQ (NMFI) support is enabled. 9648 * If this bit is set software is not allowed to mask 9649 * FIQs, but is allowed to set CPSR_F to 0. 9650 */ 9651 if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) && 9652 (val & CPSR_F)) { 9653 qemu_log_mask(LOG_GUEST_ERROR, 9654 "Ignoring attempt to enable CPSR_F flag " 9655 "(non-maskable FIQ [NMFI] support enabled)\n"); 9656 mask &= ~CPSR_F; 9657 } 9658 } 9659 } 9660 9661 env->daif &= ~(CPSR_AIF & mask); 9662 env->daif |= val & CPSR_AIF & mask; 9663 9664 if (write_type != CPSRWriteRaw && 9665 ((env->uncached_cpsr ^ val) & mask & CPSR_M)) { 9666 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) { 9667 /* 9668 * Note that we can only get here in USR mode if this is a 9669 * gdb stub write; for this case we follow the architectural 9670 * behaviour for guest writes in USR mode of ignoring an attempt 9671 * to switch mode. (Those are caught by translate.c for writes 9672 * triggered by guest instructions.) 9673 */ 9674 mask &= ~CPSR_M; 9675 } else if (bad_mode_switch(env, val & CPSR_M, write_type)) { 9676 /* 9677 * Attempt to switch to an invalid mode: this is UNPREDICTABLE in 9678 * v7, and has defined behaviour in v8: 9679 * + leave CPSR.M untouched 9680 * + allow changes to the other CPSR fields 9681 * + set PSTATE.IL 9682 * For user changes via the GDB stub, we don't set PSTATE.IL, 9683 * as this would be unnecessarily harsh for a user error. 9684 */ 9685 mask &= ~CPSR_M; 9686 if (write_type != CPSRWriteByGDBStub && 9687 arm_feature(env, ARM_FEATURE_V8)) { 9688 mask |= CPSR_IL; 9689 val |= CPSR_IL; 9690 } 9691 qemu_log_mask(LOG_GUEST_ERROR, 9692 "Illegal AArch32 mode switch attempt from %s to %s\n", 9693 aarch32_mode_name(env->uncached_cpsr), 9694 aarch32_mode_name(val)); 9695 } else { 9696 qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n", 9697 write_type == CPSRWriteExceptionReturn ? 9698 "Exception return from AArch32" : 9699 "AArch32 mode switch from", 9700 aarch32_mode_name(env->uncached_cpsr), 9701 aarch32_mode_name(val), env->regs[15]); 9702 switch_mode(env, val & CPSR_M); 9703 } 9704 } 9705 mask &= ~CACHED_CPSR_BITS; 9706 env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask); 9707 if (tcg_enabled() && rebuild_hflags) { 9708 arm_rebuild_hflags(env); 9709 } 9710 } 9711 9712 #ifdef CONFIG_USER_ONLY 9713 9714 static void switch_mode(CPUARMState *env, int mode) 9715 { 9716 ARMCPU *cpu = env_archcpu(env); 9717 9718 if (mode != ARM_CPU_MODE_USR) { 9719 cpu_abort(CPU(cpu), "Tried to switch out of user mode\n"); 9720 } 9721 } 9722 9723 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 9724 uint32_t cur_el, bool secure) 9725 { 9726 return 1; 9727 } 9728 9729 void aarch64_sync_64_to_32(CPUARMState *env) 9730 { 9731 g_assert_not_reached(); 9732 } 9733 9734 #else 9735 9736 static void switch_mode(CPUARMState *env, int mode) 9737 { 9738 int old_mode; 9739 int i; 9740 9741 old_mode = env->uncached_cpsr & CPSR_M; 9742 if (mode == old_mode) { 9743 return; 9744 } 9745 9746 if (old_mode == ARM_CPU_MODE_FIQ) { 9747 memcpy(env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t)); 9748 memcpy(env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t)); 9749 } else if (mode == ARM_CPU_MODE_FIQ) { 9750 memcpy(env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t)); 9751 memcpy(env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t)); 9752 } 9753 9754 i = bank_number(old_mode); 9755 env->banked_r13[i] = env->regs[13]; 9756 env->banked_spsr[i] = env->spsr; 9757 9758 i = bank_number(mode); 9759 env->regs[13] = env->banked_r13[i]; 9760 env->spsr = env->banked_spsr[i]; 9761 9762 env->banked_r14[r14_bank_number(old_mode)] = env->regs[14]; 9763 env->regs[14] = env->banked_r14[r14_bank_number(mode)]; 9764 } 9765 9766 /* 9767 * Physical Interrupt Target EL Lookup Table 9768 * 9769 * [ From ARM ARM section G1.13.4 (Table G1-15) ] 9770 * 9771 * The below multi-dimensional table is used for looking up the target 9772 * exception level given numerous condition criteria. Specifically, the 9773 * target EL is based on SCR and HCR routing controls as well as the 9774 * currently executing EL and secure state. 9775 * 9776 * Dimensions: 9777 * target_el_table[2][2][2][2][2][4] 9778 * | | | | | +--- Current EL 9779 * | | | | +------ Non-secure(0)/Secure(1) 9780 * | | | +--------- HCR mask override 9781 * | | +------------ SCR exec state control 9782 * | +--------------- SCR mask override 9783 * +------------------ 32-bit(0)/64-bit(1) EL3 9784 * 9785 * The table values are as such: 9786 * 0-3 = EL0-EL3 9787 * -1 = Cannot occur 9788 * 9789 * The ARM ARM target EL table includes entries indicating that an "exception 9790 * is not taken". The two cases where this is applicable are: 9791 * 1) An exception is taken from EL3 but the SCR does not have the exception 9792 * routed to EL3. 9793 * 2) An exception is taken from EL2 but the HCR does not have the exception 9794 * routed to EL2. 9795 * In these two cases, the below table contain a target of EL1. This value is 9796 * returned as it is expected that the consumer of the table data will check 9797 * for "target EL >= current EL" to ensure the exception is not taken. 9798 * 9799 * SCR HCR 9800 * 64 EA AMO From 9801 * BIT IRQ IMO Non-secure Secure 9802 * EL3 FIQ RW FMO EL0 EL1 EL2 EL3 EL0 EL1 EL2 EL3 9803 */ 9804 static const int8_t target_el_table[2][2][2][2][2][4] = { 9805 {{{{/* 0 0 0 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 9806 {/* 0 0 0 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},}, 9807 {{/* 0 0 1 0 */{ 1, 1, 2, -1 },{ 3, -1, -1, 3 },}, 9808 {/* 0 0 1 1 */{ 2, 2, 2, -1 },{ 3, -1, -1, 3 },},},}, 9809 {{{/* 0 1 0 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 9810 {/* 0 1 0 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},}, 9811 {{/* 0 1 1 0 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },}, 9812 {/* 0 1 1 1 */{ 3, 3, 3, -1 },{ 3, -1, -1, 3 },},},},}, 9813 {{{{/* 1 0 0 0 */{ 1, 1, 2, -1 },{ 1, 1, -1, 1 },}, 9814 {/* 1 0 0 1 */{ 2, 2, 2, -1 },{ 2, 2, -1, 1 },},}, 9815 {{/* 1 0 1 0 */{ 1, 1, 1, -1 },{ 1, 1, 1, 1 },}, 9816 {/* 1 0 1 1 */{ 2, 2, 2, -1 },{ 2, 2, 2, 1 },},},}, 9817 {{{/* 1 1 0 0 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },}, 9818 {/* 1 1 0 1 */{ 3, 3, 3, -1 },{ 3, 3, -1, 3 },},}, 9819 {{/* 1 1 1 0 */{ 3, 3, 3, -1 },{ 3, 3, 3, 3 },}, 9820 {/* 1 1 1 1 */{ 3, 3, 3, -1 },{ 3, 3, 3, 3 },},},},}, 9821 }; 9822 9823 /* 9824 * Determine the target EL for physical exceptions 9825 */ 9826 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, 9827 uint32_t cur_el, bool secure) 9828 { 9829 CPUARMState *env = cpu_env(cs); 9830 bool rw; 9831 bool scr; 9832 bool hcr; 9833 int target_el; 9834 /* Is the highest EL AArch64? */ 9835 bool is64 = arm_feature(env, ARM_FEATURE_AARCH64); 9836 uint64_t hcr_el2; 9837 9838 if (arm_feature(env, ARM_FEATURE_EL3)) { 9839 rw = arm_scr_rw_eff(env); 9840 } else { 9841 /* 9842 * Either EL2 is the highest EL (and so the EL2 register width 9843 * is given by is64); or there is no EL2 or EL3, in which case 9844 * the value of 'rw' does not affect the table lookup anyway. 9845 */ 9846 rw = is64; 9847 } 9848 9849 hcr_el2 = arm_hcr_el2_eff(env); 9850 switch (excp_idx) { 9851 case EXCP_IRQ: 9852 case EXCP_NMI: 9853 scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ); 9854 hcr = hcr_el2 & HCR_IMO; 9855 break; 9856 case EXCP_FIQ: 9857 scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ); 9858 hcr = hcr_el2 & HCR_FMO; 9859 break; 9860 default: 9861 scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA); 9862 hcr = hcr_el2 & HCR_AMO; 9863 break; 9864 }; 9865 9866 /* 9867 * For these purposes, TGE and AMO/IMO/FMO both force the 9868 * interrupt to EL2. Fold TGE into the bit extracted above. 9869 */ 9870 hcr |= (hcr_el2 & HCR_TGE) != 0; 9871 9872 /* Perform a table-lookup for the target EL given the current state */ 9873 target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el]; 9874 9875 assert(target_el > 0); 9876 9877 return target_el; 9878 } 9879 9880 void arm_log_exception(CPUState *cs) 9881 { 9882 int idx = cs->exception_index; 9883 9884 if (qemu_loglevel_mask(CPU_LOG_INT)) { 9885 const char *exc = NULL; 9886 static const char * const excnames[] = { 9887 [EXCP_UDEF] = "Undefined Instruction", 9888 [EXCP_SWI] = "SVC", 9889 [EXCP_PREFETCH_ABORT] = "Prefetch Abort", 9890 [EXCP_DATA_ABORT] = "Data Abort", 9891 [EXCP_IRQ] = "IRQ", 9892 [EXCP_FIQ] = "FIQ", 9893 [EXCP_BKPT] = "Breakpoint", 9894 [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit", 9895 [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage", 9896 [EXCP_HVC] = "Hypervisor Call", 9897 [EXCP_HYP_TRAP] = "Hypervisor Trap", 9898 [EXCP_SMC] = "Secure Monitor Call", 9899 [EXCP_VIRQ] = "Virtual IRQ", 9900 [EXCP_VFIQ] = "Virtual FIQ", 9901 [EXCP_SEMIHOST] = "Semihosting call", 9902 [EXCP_NOCP] = "v7M NOCP UsageFault", 9903 [EXCP_INVSTATE] = "v7M INVSTATE UsageFault", 9904 [EXCP_STKOF] = "v8M STKOF UsageFault", 9905 [EXCP_LAZYFP] = "v7M exception during lazy FP stacking", 9906 [EXCP_LSERR] = "v8M LSERR UsageFault", 9907 [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault", 9908 [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault", 9909 [EXCP_VSERR] = "Virtual SERR", 9910 [EXCP_GPC] = "Granule Protection Check", 9911 [EXCP_NMI] = "NMI", 9912 [EXCP_VINMI] = "Virtual IRQ NMI", 9913 [EXCP_VFNMI] = "Virtual FIQ NMI", 9914 [EXCP_MON_TRAP] = "Monitor Trap", 9915 }; 9916 9917 if (idx >= 0 && idx < ARRAY_SIZE(excnames)) { 9918 exc = excnames[idx]; 9919 } 9920 if (!exc) { 9921 exc = "unknown"; 9922 } 9923 qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s] on CPU %d\n", 9924 idx, exc, cs->cpu_index); 9925 } 9926 } 9927 9928 /* 9929 * Function used to synchronize QEMU's AArch64 register set with AArch32 9930 * register set. This is necessary when switching between AArch32 and AArch64 9931 * execution state. 9932 */ 9933 void aarch64_sync_32_to_64(CPUARMState *env) 9934 { 9935 int i; 9936 uint32_t mode = env->uncached_cpsr & CPSR_M; 9937 9938 /* We can blanket copy R[0:7] to X[0:7] */ 9939 for (i = 0; i < 8; i++) { 9940 env->xregs[i] = env->regs[i]; 9941 } 9942 9943 /* 9944 * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12. 9945 * Otherwise, they come from the banked user regs. 9946 */ 9947 if (mode == ARM_CPU_MODE_FIQ) { 9948 for (i = 8; i < 13; i++) { 9949 env->xregs[i] = env->usr_regs[i - 8]; 9950 } 9951 } else { 9952 for (i = 8; i < 13; i++) { 9953 env->xregs[i] = env->regs[i]; 9954 } 9955 } 9956 9957 /* 9958 * Registers x13-x23 are the various mode SP and FP registers. Registers 9959 * r13 and r14 are only copied if we are in that mode, otherwise we copy 9960 * from the mode banked register. 9961 */ 9962 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 9963 env->xregs[13] = env->regs[13]; 9964 env->xregs[14] = env->regs[14]; 9965 } else { 9966 env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)]; 9967 /* HYP is an exception in that it is copied from r14 */ 9968 if (mode == ARM_CPU_MODE_HYP) { 9969 env->xregs[14] = env->regs[14]; 9970 } else { 9971 env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)]; 9972 } 9973 } 9974 9975 if (mode == ARM_CPU_MODE_HYP) { 9976 env->xregs[15] = env->regs[13]; 9977 } else { 9978 env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)]; 9979 } 9980 9981 if (mode == ARM_CPU_MODE_IRQ) { 9982 env->xregs[16] = env->regs[14]; 9983 env->xregs[17] = env->regs[13]; 9984 } else { 9985 env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)]; 9986 env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)]; 9987 } 9988 9989 if (mode == ARM_CPU_MODE_SVC) { 9990 env->xregs[18] = env->regs[14]; 9991 env->xregs[19] = env->regs[13]; 9992 } else { 9993 env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)]; 9994 env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)]; 9995 } 9996 9997 if (mode == ARM_CPU_MODE_ABT) { 9998 env->xregs[20] = env->regs[14]; 9999 env->xregs[21] = env->regs[13]; 10000 } else { 10001 env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)]; 10002 env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)]; 10003 } 10004 10005 if (mode == ARM_CPU_MODE_UND) { 10006 env->xregs[22] = env->regs[14]; 10007 env->xregs[23] = env->regs[13]; 10008 } else { 10009 env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)]; 10010 env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)]; 10011 } 10012 10013 /* 10014 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 10015 * mode, then we can copy from r8-r14. Otherwise, we copy from the 10016 * FIQ bank for r8-r14. 10017 */ 10018 if (mode == ARM_CPU_MODE_FIQ) { 10019 for (i = 24; i < 31; i++) { 10020 env->xregs[i] = env->regs[i - 16]; /* X[24:30] <- R[8:14] */ 10021 } 10022 } else { 10023 for (i = 24; i < 29; i++) { 10024 env->xregs[i] = env->fiq_regs[i - 24]; 10025 } 10026 env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)]; 10027 env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)]; 10028 } 10029 10030 env->pc = env->regs[15]; 10031 } 10032 10033 /* 10034 * Function used to synchronize QEMU's AArch32 register set with AArch64 10035 * register set. This is necessary when switching between AArch32 and AArch64 10036 * execution state. 10037 */ 10038 void aarch64_sync_64_to_32(CPUARMState *env) 10039 { 10040 int i; 10041 uint32_t mode = env->uncached_cpsr & CPSR_M; 10042 10043 /* We can blanket copy X[0:7] to R[0:7] */ 10044 for (i = 0; i < 8; i++) { 10045 env->regs[i] = env->xregs[i]; 10046 } 10047 10048 /* 10049 * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12. 10050 * Otherwise, we copy x8-x12 into the banked user regs. 10051 */ 10052 if (mode == ARM_CPU_MODE_FIQ) { 10053 for (i = 8; i < 13; i++) { 10054 env->usr_regs[i - 8] = env->xregs[i]; 10055 } 10056 } else { 10057 for (i = 8; i < 13; i++) { 10058 env->regs[i] = env->xregs[i]; 10059 } 10060 } 10061 10062 /* 10063 * Registers r13 & r14 depend on the current mode. 10064 * If we are in a given mode, we copy the corresponding x registers to r13 10065 * and r14. Otherwise, we copy the x register to the banked r13 and r14 10066 * for the mode. 10067 */ 10068 if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) { 10069 env->regs[13] = env->xregs[13]; 10070 env->regs[14] = env->xregs[14]; 10071 } else { 10072 env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13]; 10073 10074 /* 10075 * HYP is an exception in that it does not have its own banked r14 but 10076 * shares the USR r14 10077 */ 10078 if (mode == ARM_CPU_MODE_HYP) { 10079 env->regs[14] = env->xregs[14]; 10080 } else { 10081 env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14]; 10082 } 10083 } 10084 10085 if (mode == ARM_CPU_MODE_HYP) { 10086 env->regs[13] = env->xregs[15]; 10087 } else { 10088 env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15]; 10089 } 10090 10091 if (mode == ARM_CPU_MODE_IRQ) { 10092 env->regs[14] = env->xregs[16]; 10093 env->regs[13] = env->xregs[17]; 10094 } else { 10095 env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16]; 10096 env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17]; 10097 } 10098 10099 if (mode == ARM_CPU_MODE_SVC) { 10100 env->regs[14] = env->xregs[18]; 10101 env->regs[13] = env->xregs[19]; 10102 } else { 10103 env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18]; 10104 env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19]; 10105 } 10106 10107 if (mode == ARM_CPU_MODE_ABT) { 10108 env->regs[14] = env->xregs[20]; 10109 env->regs[13] = env->xregs[21]; 10110 } else { 10111 env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20]; 10112 env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21]; 10113 } 10114 10115 if (mode == ARM_CPU_MODE_UND) { 10116 env->regs[14] = env->xregs[22]; 10117 env->regs[13] = env->xregs[23]; 10118 } else { 10119 env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22]; 10120 env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23]; 10121 } 10122 10123 /* 10124 * Registers x24-x30 are mapped to r8-r14 in FIQ mode. If we are in FIQ 10125 * mode, then we can copy to r8-r14. Otherwise, we copy to the 10126 * FIQ bank for r8-r14. 10127 */ 10128 if (mode == ARM_CPU_MODE_FIQ) { 10129 for (i = 24; i < 31; i++) { 10130 env->regs[i - 16] = env->xregs[i]; /* X[24:30] -> R[8:14] */ 10131 } 10132 } else { 10133 for (i = 24; i < 29; i++) { 10134 env->fiq_regs[i - 24] = env->xregs[i]; 10135 } 10136 env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29]; 10137 env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30]; 10138 } 10139 10140 env->regs[15] = env->pc; 10141 } 10142 10143 static void take_aarch32_exception(CPUARMState *env, int new_mode, 10144 uint32_t mask, uint32_t offset, 10145 uint32_t newpc) 10146 { 10147 int new_el; 10148 10149 /* Change the CPU state so as to actually take the exception. */ 10150 switch_mode(env, new_mode); 10151 10152 /* 10153 * For exceptions taken to AArch32 we must clear the SS bit in both 10154 * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now. 10155 */ 10156 env->pstate &= ~PSTATE_SS; 10157 env->spsr = cpsr_read(env); 10158 /* Clear IT bits. */ 10159 env->condexec_bits = 0; 10160 /* Switch to the new mode, and to the correct instruction set. */ 10161 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode; 10162 10163 /* This must be after mode switching. */ 10164 new_el = arm_current_el(env); 10165 10166 /* Set new mode endianness */ 10167 env->uncached_cpsr &= ~CPSR_E; 10168 if (env->cp15.sctlr_el[new_el] & SCTLR_EE) { 10169 env->uncached_cpsr |= CPSR_E; 10170 } 10171 /* J and IL must always be cleared for exception entry */ 10172 env->uncached_cpsr &= ~(CPSR_IL | CPSR_J); 10173 env->daif |= mask; 10174 10175 if (cpu_isar_feature(aa32_ssbs, env_archcpu(env))) { 10176 if (env->cp15.sctlr_el[new_el] & SCTLR_DSSBS_32) { 10177 env->uncached_cpsr |= CPSR_SSBS; 10178 } else { 10179 env->uncached_cpsr &= ~CPSR_SSBS; 10180 } 10181 } 10182 10183 if (new_mode == ARM_CPU_MODE_HYP) { 10184 env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0; 10185 env->elr_el[2] = env->regs[15]; 10186 } else { 10187 /* CPSR.PAN is normally preserved preserved unless... */ 10188 if (cpu_isar_feature(aa32_pan, env_archcpu(env))) { 10189 switch (new_el) { 10190 case 3: 10191 if (!arm_is_secure_below_el3(env)) { 10192 /* ... the target is EL3, from non-secure state. */ 10193 env->uncached_cpsr &= ~CPSR_PAN; 10194 break; 10195 } 10196 /* ... the target is EL3, from secure state ... */ 10197 /* fall through */ 10198 case 1: 10199 /* ... the target is EL1 and SCTLR.SPAN is 0. */ 10200 if (!(env->cp15.sctlr_el[new_el] & SCTLR_SPAN)) { 10201 env->uncached_cpsr |= CPSR_PAN; 10202 } 10203 break; 10204 } 10205 } 10206 /* 10207 * this is a lie, as there was no c1_sys on V4T/V5, but who cares 10208 * and we should just guard the thumb mode on V4 10209 */ 10210 if (arm_feature(env, ARM_FEATURE_V4T)) { 10211 env->thumb = 10212 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0; 10213 } 10214 env->regs[14] = env->regs[15] + offset; 10215 } 10216 env->regs[15] = newpc; 10217 10218 if (tcg_enabled()) { 10219 arm_rebuild_hflags(env); 10220 } 10221 } 10222 10223 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs) 10224 { 10225 /* 10226 * Handle exception entry to Hyp mode; this is sufficiently 10227 * different to entry to other AArch32 modes that we handle it 10228 * separately here. 10229 * 10230 * The vector table entry used is always the 0x14 Hyp mode entry point, 10231 * unless this is an UNDEF/SVC/HVC/abort taken from Hyp to Hyp. 10232 * The offset applied to the preferred return address is always zero 10233 * (see DDI0487C.a section G1.12.3). 10234 * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values. 10235 */ 10236 uint32_t addr, mask; 10237 ARMCPU *cpu = ARM_CPU(cs); 10238 CPUARMState *env = &cpu->env; 10239 10240 switch (cs->exception_index) { 10241 case EXCP_UDEF: 10242 addr = 0x04; 10243 break; 10244 case EXCP_SWI: 10245 addr = 0x08; 10246 break; 10247 case EXCP_BKPT: 10248 /* Fall through to prefetch abort. */ 10249 case EXCP_PREFETCH_ABORT: 10250 env->cp15.ifar_s = env->exception.vaddress; 10251 qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n", 10252 (uint32_t)env->exception.vaddress); 10253 addr = 0x0c; 10254 break; 10255 case EXCP_DATA_ABORT: 10256 env->cp15.dfar_s = env->exception.vaddress; 10257 qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n", 10258 (uint32_t)env->exception.vaddress); 10259 addr = 0x10; 10260 break; 10261 case EXCP_IRQ: 10262 addr = 0x18; 10263 break; 10264 case EXCP_FIQ: 10265 addr = 0x1c; 10266 break; 10267 case EXCP_HVC: 10268 addr = 0x08; 10269 break; 10270 case EXCP_HYP_TRAP: 10271 addr = 0x14; 10272 break; 10273 default: 10274 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 10275 } 10276 10277 if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) { 10278 if (!arm_feature(env, ARM_FEATURE_V8)) { 10279 /* 10280 * QEMU syndrome values are v8-style. v7 has the IL bit 10281 * UNK/SBZP for "field not valid" cases, where v8 uses RES1. 10282 * If this is a v7 CPU, squash the IL bit in those cases. 10283 */ 10284 if (cs->exception_index == EXCP_PREFETCH_ABORT || 10285 (cs->exception_index == EXCP_DATA_ABORT && 10286 !(env->exception.syndrome & ARM_EL_ISV)) || 10287 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) { 10288 env->exception.syndrome &= ~ARM_EL_IL; 10289 } 10290 } 10291 env->cp15.esr_el[2] = env->exception.syndrome; 10292 } 10293 10294 if (arm_current_el(env) != 2 && addr < 0x14) { 10295 addr = 0x14; 10296 } 10297 10298 mask = 0; 10299 if (!(env->cp15.scr_el3 & SCR_EA)) { 10300 mask |= CPSR_A; 10301 } 10302 if (!(env->cp15.scr_el3 & SCR_IRQ)) { 10303 mask |= CPSR_I; 10304 } 10305 if (!(env->cp15.scr_el3 & SCR_FIQ)) { 10306 mask |= CPSR_F; 10307 } 10308 10309 addr += env->cp15.hvbar; 10310 10311 take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr); 10312 } 10313 10314 static void arm_cpu_do_interrupt_aarch32(CPUState *cs) 10315 { 10316 ARMCPU *cpu = ARM_CPU(cs); 10317 CPUARMState *env = &cpu->env; 10318 uint32_t addr; 10319 uint32_t mask; 10320 int new_mode; 10321 uint32_t offset; 10322 uint32_t moe; 10323 10324 /* If this is a debug exception we must update the DBGDSCR.MOE bits */ 10325 switch (syn_get_ec(env->exception.syndrome)) { 10326 case EC_BREAKPOINT: 10327 case EC_BREAKPOINT_SAME_EL: 10328 moe = 1; 10329 break; 10330 case EC_WATCHPOINT: 10331 case EC_WATCHPOINT_SAME_EL: 10332 moe = 10; 10333 break; 10334 case EC_AA32_BKPT: 10335 moe = 3; 10336 break; 10337 case EC_VECTORCATCH: 10338 moe = 5; 10339 break; 10340 default: 10341 moe = 0; 10342 break; 10343 } 10344 10345 if (moe) { 10346 env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe); 10347 } 10348 10349 if (env->exception.target_el == 2) { 10350 /* Debug exceptions are reported differently on AArch32 */ 10351 switch (syn_get_ec(env->exception.syndrome)) { 10352 case EC_BREAKPOINT: 10353 case EC_BREAKPOINT_SAME_EL: 10354 case EC_AA32_BKPT: 10355 case EC_VECTORCATCH: 10356 env->exception.syndrome = syn_insn_abort(arm_current_el(env) == 2, 10357 0, 0, 0x22); 10358 break; 10359 case EC_WATCHPOINT: 10360 env->exception.syndrome = syn_set_ec(env->exception.syndrome, 10361 EC_DATAABORT); 10362 break; 10363 case EC_WATCHPOINT_SAME_EL: 10364 env->exception.syndrome = syn_set_ec(env->exception.syndrome, 10365 EC_DATAABORT_SAME_EL); 10366 break; 10367 } 10368 arm_cpu_do_interrupt_aarch32_hyp(cs); 10369 return; 10370 } 10371 10372 switch (cs->exception_index) { 10373 case EXCP_UDEF: 10374 new_mode = ARM_CPU_MODE_UND; 10375 addr = 0x04; 10376 mask = CPSR_I; 10377 if (env->thumb) { 10378 offset = 2; 10379 } else { 10380 offset = 4; 10381 } 10382 break; 10383 case EXCP_SWI: 10384 new_mode = ARM_CPU_MODE_SVC; 10385 addr = 0x08; 10386 mask = CPSR_I; 10387 /* The PC already points to the next instruction. */ 10388 offset = 0; 10389 break; 10390 case EXCP_BKPT: 10391 /* Fall through to prefetch abort. */ 10392 case EXCP_PREFETCH_ABORT: 10393 A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr); 10394 A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress); 10395 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n", 10396 env->exception.fsr, (uint32_t)env->exception.vaddress); 10397 new_mode = ARM_CPU_MODE_ABT; 10398 addr = 0x0c; 10399 mask = CPSR_A | CPSR_I; 10400 offset = 4; 10401 break; 10402 case EXCP_DATA_ABORT: 10403 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 10404 A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress); 10405 qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n", 10406 env->exception.fsr, 10407 (uint32_t)env->exception.vaddress); 10408 new_mode = ARM_CPU_MODE_ABT; 10409 addr = 0x10; 10410 mask = CPSR_A | CPSR_I; 10411 offset = 8; 10412 break; 10413 case EXCP_IRQ: 10414 new_mode = ARM_CPU_MODE_IRQ; 10415 addr = 0x18; 10416 /* Disable IRQ and imprecise data aborts. */ 10417 mask = CPSR_A | CPSR_I; 10418 offset = 4; 10419 if (env->cp15.scr_el3 & SCR_IRQ) { 10420 /* IRQ routed to monitor mode */ 10421 new_mode = ARM_CPU_MODE_MON; 10422 mask |= CPSR_F; 10423 } 10424 break; 10425 case EXCP_FIQ: 10426 new_mode = ARM_CPU_MODE_FIQ; 10427 addr = 0x1c; 10428 /* Disable FIQ, IRQ and imprecise data aborts. */ 10429 mask = CPSR_A | CPSR_I | CPSR_F; 10430 if (env->cp15.scr_el3 & SCR_FIQ) { 10431 /* FIQ routed to monitor mode */ 10432 new_mode = ARM_CPU_MODE_MON; 10433 } 10434 offset = 4; 10435 break; 10436 case EXCP_VIRQ: 10437 new_mode = ARM_CPU_MODE_IRQ; 10438 addr = 0x18; 10439 /* Disable IRQ and imprecise data aborts. */ 10440 mask = CPSR_A | CPSR_I; 10441 offset = 4; 10442 break; 10443 case EXCP_VFIQ: 10444 new_mode = ARM_CPU_MODE_FIQ; 10445 addr = 0x1c; 10446 /* Disable FIQ, IRQ and imprecise data aborts. */ 10447 mask = CPSR_A | CPSR_I | CPSR_F; 10448 offset = 4; 10449 break; 10450 case EXCP_VSERR: 10451 { 10452 /* 10453 * Note that this is reported as a data abort, but the DFAR 10454 * has an UNKNOWN value. Construct the SError syndrome from 10455 * AET and ExT fields. 10456 */ 10457 ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal, }; 10458 10459 if (extended_addresses_enabled(env)) { 10460 env->exception.fsr = arm_fi_to_lfsc(&fi); 10461 } else { 10462 env->exception.fsr = arm_fi_to_sfsc(&fi); 10463 } 10464 env->exception.fsr |= env->cp15.vsesr_el2 & 0xd000; 10465 A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr); 10466 qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x\n", 10467 env->exception.fsr); 10468 10469 new_mode = ARM_CPU_MODE_ABT; 10470 addr = 0x10; 10471 mask = CPSR_A | CPSR_I; 10472 offset = 8; 10473 } 10474 break; 10475 case EXCP_SMC: 10476 new_mode = ARM_CPU_MODE_MON; 10477 addr = 0x08; 10478 mask = CPSR_A | CPSR_I | CPSR_F; 10479 offset = 0; 10480 break; 10481 case EXCP_MON_TRAP: 10482 new_mode = ARM_CPU_MODE_MON; 10483 addr = 0x04; 10484 mask = CPSR_A | CPSR_I | CPSR_F; 10485 if (env->thumb) { 10486 offset = 2; 10487 } else { 10488 offset = 4; 10489 } 10490 break; 10491 default: 10492 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 10493 return; /* Never happens. Keep compiler happy. */ 10494 } 10495 10496 if (new_mode == ARM_CPU_MODE_MON) { 10497 addr += env->cp15.mvbar; 10498 } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) { 10499 /* High vectors. When enabled, base address cannot be remapped. */ 10500 addr += 0xffff0000; 10501 } else { 10502 /* 10503 * ARM v7 architectures provide a vector base address register to remap 10504 * the interrupt vector table. 10505 * This register is only followed in non-monitor mode, and is banked. 10506 * Note: only bits 31:5 are valid. 10507 */ 10508 addr += A32_BANKED_CURRENT_REG_GET(env, vbar); 10509 } 10510 10511 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 10512 env->cp15.scr_el3 &= ~SCR_NS; 10513 } 10514 10515 take_aarch32_exception(env, new_mode, mask, offset, addr); 10516 } 10517 10518 static int aarch64_regnum(CPUARMState *env, int aarch32_reg) 10519 { 10520 /* 10521 * Return the register number of the AArch64 view of the AArch32 10522 * register @aarch32_reg. The CPUARMState CPSR is assumed to still 10523 * be that of the AArch32 mode the exception came from. 10524 */ 10525 int mode = env->uncached_cpsr & CPSR_M; 10526 10527 switch (aarch32_reg) { 10528 case 0 ... 7: 10529 return aarch32_reg; 10530 case 8 ... 12: 10531 return mode == ARM_CPU_MODE_FIQ ? aarch32_reg + 16 : aarch32_reg; 10532 case 13: 10533 switch (mode) { 10534 case ARM_CPU_MODE_USR: 10535 case ARM_CPU_MODE_SYS: 10536 return 13; 10537 case ARM_CPU_MODE_HYP: 10538 return 15; 10539 case ARM_CPU_MODE_IRQ: 10540 return 17; 10541 case ARM_CPU_MODE_SVC: 10542 return 19; 10543 case ARM_CPU_MODE_ABT: 10544 return 21; 10545 case ARM_CPU_MODE_UND: 10546 return 23; 10547 case ARM_CPU_MODE_FIQ: 10548 return 29; 10549 default: 10550 g_assert_not_reached(); 10551 } 10552 case 14: 10553 switch (mode) { 10554 case ARM_CPU_MODE_USR: 10555 case ARM_CPU_MODE_SYS: 10556 case ARM_CPU_MODE_HYP: 10557 return 14; 10558 case ARM_CPU_MODE_IRQ: 10559 return 16; 10560 case ARM_CPU_MODE_SVC: 10561 return 18; 10562 case ARM_CPU_MODE_ABT: 10563 return 20; 10564 case ARM_CPU_MODE_UND: 10565 return 22; 10566 case ARM_CPU_MODE_FIQ: 10567 return 30; 10568 default: 10569 g_assert_not_reached(); 10570 } 10571 case 15: 10572 return 31; 10573 default: 10574 g_assert_not_reached(); 10575 } 10576 } 10577 10578 static uint32_t cpsr_read_for_spsr_elx(CPUARMState *env) 10579 { 10580 uint32_t ret = cpsr_read(env); 10581 10582 /* Move DIT to the correct location for SPSR_ELx */ 10583 if (ret & CPSR_DIT) { 10584 ret &= ~CPSR_DIT; 10585 ret |= PSTATE_DIT; 10586 } 10587 /* Merge PSTATE.SS into SPSR_ELx */ 10588 ret |= env->pstate & PSTATE_SS; 10589 10590 return ret; 10591 } 10592 10593 static bool syndrome_is_sync_extabt(uint32_t syndrome) 10594 { 10595 /* Return true if this syndrome value is a synchronous external abort */ 10596 switch (syn_get_ec(syndrome)) { 10597 case EC_INSNABORT: 10598 case EC_INSNABORT_SAME_EL: 10599 case EC_DATAABORT: 10600 case EC_DATAABORT_SAME_EL: 10601 /* Look at fault status code for all the synchronous ext abort cases */ 10602 switch (syndrome & 0x3f) { 10603 case 0x10: 10604 case 0x13: 10605 case 0x14: 10606 case 0x15: 10607 case 0x16: 10608 case 0x17: 10609 return true; 10610 default: 10611 return false; 10612 } 10613 default: 10614 return false; 10615 } 10616 } 10617 10618 /* Handle exception entry to a target EL which is using AArch64 */ 10619 static void arm_cpu_do_interrupt_aarch64(CPUState *cs) 10620 { 10621 ARMCPU *cpu = ARM_CPU(cs); 10622 CPUARMState *env = &cpu->env; 10623 unsigned int new_el = env->exception.target_el; 10624 vaddr addr = env->cp15.vbar_el[new_el]; 10625 unsigned int new_mode = aarch64_pstate_mode(new_el, true); 10626 unsigned int old_mode; 10627 unsigned int cur_el = arm_current_el(env); 10628 int rt; 10629 10630 if (tcg_enabled()) { 10631 /* 10632 * Note that new_el can never be 0. If cur_el is 0, then 10633 * el0_a64 is is_a64(), else el0_a64 is ignored. 10634 */ 10635 aarch64_sve_change_el(env, cur_el, new_el, is_a64(env)); 10636 } 10637 10638 if (cur_el < new_el) { 10639 /* 10640 * Entry vector offset depends on whether the implemented EL 10641 * immediately lower than the target level is using AArch32 or AArch64 10642 */ 10643 bool is_aa64; 10644 uint64_t hcr; 10645 10646 switch (new_el) { 10647 case 3: 10648 is_aa64 = arm_scr_rw_eff(env); 10649 break; 10650 case 2: 10651 hcr = arm_hcr_el2_eff(env); 10652 if ((hcr & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 10653 is_aa64 = (hcr & HCR_RW) != 0; 10654 break; 10655 } 10656 /* fall through */ 10657 case 1: 10658 is_aa64 = is_a64(env); 10659 break; 10660 default: 10661 g_assert_not_reached(); 10662 } 10663 10664 if (is_aa64) { 10665 addr += 0x400; 10666 } else { 10667 addr += 0x600; 10668 } 10669 } else if (pstate_read(env) & PSTATE_SP) { 10670 addr += 0x200; 10671 } 10672 10673 switch (cs->exception_index) { 10674 case EXCP_GPC: 10675 qemu_log_mask(CPU_LOG_INT, "...with MFAR 0x%" PRIx64 "\n", 10676 env->cp15.mfar_el3); 10677 /* fall through */ 10678 case EXCP_PREFETCH_ABORT: 10679 case EXCP_DATA_ABORT: 10680 /* 10681 * FEAT_DoubleFault allows synchronous external aborts taken to EL3 10682 * to be taken to the SError vector entrypoint. 10683 */ 10684 if (new_el == 3 && (env->cp15.scr_el3 & SCR_EASE) && 10685 syndrome_is_sync_extabt(env->exception.syndrome)) { 10686 addr += 0x180; 10687 } 10688 env->cp15.far_el[new_el] = env->exception.vaddress; 10689 qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n", 10690 env->cp15.far_el[new_el]); 10691 /* fall through */ 10692 case EXCP_BKPT: 10693 case EXCP_UDEF: 10694 case EXCP_SWI: 10695 case EXCP_HVC: 10696 case EXCP_HYP_TRAP: 10697 case EXCP_SMC: 10698 switch (syn_get_ec(env->exception.syndrome)) { 10699 case EC_ADVSIMDFPACCESSTRAP: 10700 /* 10701 * QEMU internal FP/SIMD syndromes from AArch32 include the 10702 * TA and coproc fields which are only exposed if the exception 10703 * is taken to AArch32 Hyp mode. Mask them out to get a valid 10704 * AArch64 format syndrome. 10705 */ 10706 env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20); 10707 break; 10708 case EC_CP14RTTRAP: 10709 case EC_CP15RTTRAP: 10710 case EC_CP14DTTRAP: 10711 /* 10712 * For a trap on AArch32 MRC/MCR/LDC/STC the Rt field is currently 10713 * the raw register field from the insn; when taking this to 10714 * AArch64 we must convert it to the AArch64 view of the register 10715 * number. Notice that we read a 4-bit AArch32 register number and 10716 * write back a 5-bit AArch64 one. 10717 */ 10718 rt = extract32(env->exception.syndrome, 5, 4); 10719 rt = aarch64_regnum(env, rt); 10720 env->exception.syndrome = deposit32(env->exception.syndrome, 10721 5, 5, rt); 10722 break; 10723 case EC_CP15RRTTRAP: 10724 case EC_CP14RRTTRAP: 10725 /* Similarly for MRRC/MCRR traps for Rt and Rt2 fields */ 10726 rt = extract32(env->exception.syndrome, 5, 4); 10727 rt = aarch64_regnum(env, rt); 10728 env->exception.syndrome = deposit32(env->exception.syndrome, 10729 5, 5, rt); 10730 rt = extract32(env->exception.syndrome, 10, 4); 10731 rt = aarch64_regnum(env, rt); 10732 env->exception.syndrome = deposit32(env->exception.syndrome, 10733 10, 5, rt); 10734 break; 10735 } 10736 env->cp15.esr_el[new_el] = env->exception.syndrome; 10737 break; 10738 case EXCP_IRQ: 10739 case EXCP_VIRQ: 10740 case EXCP_NMI: 10741 case EXCP_VINMI: 10742 addr += 0x80; 10743 break; 10744 case EXCP_FIQ: 10745 case EXCP_VFIQ: 10746 case EXCP_VFNMI: 10747 addr += 0x100; 10748 break; 10749 case EXCP_VSERR: 10750 addr += 0x180; 10751 /* Construct the SError syndrome from IDS and ISS fields. */ 10752 env->exception.syndrome = syn_serror(env->cp15.vsesr_el2 & 0x1ffffff); 10753 env->cp15.esr_el[new_el] = env->exception.syndrome; 10754 break; 10755 default: 10756 cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index); 10757 } 10758 10759 if (is_a64(env)) { 10760 old_mode = pstate_read(env); 10761 aarch64_save_sp(env, arm_current_el(env)); 10762 env->elr_el[new_el] = env->pc; 10763 10764 if (cur_el == 1 && new_el == 1) { 10765 uint64_t hcr = arm_hcr_el2_eff(env); 10766 if ((hcr & (HCR_NV | HCR_NV1 | HCR_NV2)) == HCR_NV || 10767 (hcr & (HCR_NV | HCR_NV2)) == (HCR_NV | HCR_NV2)) { 10768 /* 10769 * FEAT_NV, FEAT_NV2 may need to report EL2 in the SPSR 10770 * by setting M[3:2] to 0b10. 10771 * If NV2 is disabled, change SPSR when NV,NV1 == 1,0 (I_ZJRNN) 10772 * If NV2 is enabled, change SPSR when NV is 1 (I_DBTLM) 10773 */ 10774 old_mode = deposit32(old_mode, 2, 2, 2); 10775 } 10776 } 10777 } else { 10778 old_mode = cpsr_read_for_spsr_elx(env); 10779 env->elr_el[new_el] = env->regs[15]; 10780 10781 aarch64_sync_32_to_64(env); 10782 10783 env->condexec_bits = 0; 10784 } 10785 env->banked_spsr[aarch64_banked_spsr_index(new_el)] = old_mode; 10786 10787 qemu_log_mask(CPU_LOG_INT, "...with SPSR 0x%x\n", old_mode); 10788 qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n", 10789 env->elr_el[new_el]); 10790 10791 if (cpu_isar_feature(aa64_pan, cpu)) { 10792 /* The value of PSTATE.PAN is normally preserved, except when ... */ 10793 new_mode |= old_mode & PSTATE_PAN; 10794 switch (new_el) { 10795 case 2: 10796 /* ... the target is EL2 with HCR_EL2.{E2H,TGE} == '11' ... */ 10797 if ((arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) 10798 != (HCR_E2H | HCR_TGE)) { 10799 break; 10800 } 10801 /* fall through */ 10802 case 1: 10803 /* ... the target is EL1 ... */ 10804 /* ... and SCTLR_ELx.SPAN == 0, then set to 1. */ 10805 if ((env->cp15.sctlr_el[new_el] & SCTLR_SPAN) == 0) { 10806 new_mode |= PSTATE_PAN; 10807 } 10808 break; 10809 } 10810 } 10811 if (cpu_isar_feature(aa64_mte, cpu)) { 10812 new_mode |= PSTATE_TCO; 10813 } 10814 10815 if (cpu_isar_feature(aa64_ssbs, cpu)) { 10816 if (env->cp15.sctlr_el[new_el] & SCTLR_DSSBS_64) { 10817 new_mode |= PSTATE_SSBS; 10818 } else { 10819 new_mode &= ~PSTATE_SSBS; 10820 } 10821 } 10822 10823 if (cpu_isar_feature(aa64_nmi, cpu)) { 10824 if (!(env->cp15.sctlr_el[new_el] & SCTLR_SPINTMASK)) { 10825 new_mode |= PSTATE_ALLINT; 10826 } else { 10827 new_mode &= ~PSTATE_ALLINT; 10828 } 10829 } 10830 10831 pstate_write(env, PSTATE_DAIF | new_mode); 10832 env->aarch64 = true; 10833 aarch64_restore_sp(env, new_el); 10834 10835 if (tcg_enabled()) { 10836 helper_rebuild_hflags_a64(env, new_el); 10837 } 10838 10839 env->pc = addr; 10840 10841 qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n", 10842 new_el, env->pc, pstate_read(env)); 10843 } 10844 10845 /* 10846 * Do semihosting call and set the appropriate return value. All the 10847 * permission and validity checks have been done at translate time. 10848 * 10849 * We only see semihosting exceptions in TCG only as they are not 10850 * trapped to the hypervisor in KVM. 10851 */ 10852 #ifdef CONFIG_TCG 10853 static void tcg_handle_semihosting(CPUState *cs) 10854 { 10855 ARMCPU *cpu = ARM_CPU(cs); 10856 CPUARMState *env = &cpu->env; 10857 10858 if (is_a64(env)) { 10859 qemu_log_mask(CPU_LOG_INT, 10860 "...handling as semihosting call 0x%" PRIx64 "\n", 10861 env->xregs[0]); 10862 do_common_semihosting(cs); 10863 env->pc += 4; 10864 } else { 10865 qemu_log_mask(CPU_LOG_INT, 10866 "...handling as semihosting call 0x%x\n", 10867 env->regs[0]); 10868 do_common_semihosting(cs); 10869 env->regs[15] += env->thumb ? 2 : 4; 10870 } 10871 } 10872 #endif 10873 10874 /* 10875 * Handle a CPU exception for A and R profile CPUs. 10876 * Do any appropriate logging, handle PSCI calls, and then hand off 10877 * to the AArch64-entry or AArch32-entry function depending on the 10878 * target exception level's register width. 10879 * 10880 * Note: this is used for both TCG (as the do_interrupt tcg op), 10881 * and KVM to re-inject guest debug exceptions, and to 10882 * inject a Synchronous-External-Abort. 10883 */ 10884 void arm_cpu_do_interrupt(CPUState *cs) 10885 { 10886 ARMCPU *cpu = ARM_CPU(cs); 10887 CPUARMState *env = &cpu->env; 10888 unsigned int new_el = env->exception.target_el; 10889 10890 assert(!arm_feature(env, ARM_FEATURE_M)); 10891 10892 arm_log_exception(cs); 10893 qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env), 10894 new_el); 10895 if (qemu_loglevel_mask(CPU_LOG_INT) 10896 && !excp_is_internal(cs->exception_index)) { 10897 qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n", 10898 syn_get_ec(env->exception.syndrome), 10899 env->exception.syndrome); 10900 } 10901 10902 if (tcg_enabled() && arm_is_psci_call(cpu, cs->exception_index)) { 10903 arm_handle_psci_call(cpu); 10904 qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n"); 10905 return; 10906 } 10907 10908 /* 10909 * Semihosting semantics depend on the register width of the code 10910 * that caused the exception, not the target exception level, so 10911 * must be handled here. 10912 */ 10913 #ifdef CONFIG_TCG 10914 if (cs->exception_index == EXCP_SEMIHOST) { 10915 tcg_handle_semihosting(cs); 10916 return; 10917 } 10918 #endif 10919 10920 /* 10921 * Hooks may change global state so BQL should be held, also the 10922 * BQL needs to be held for any modification of 10923 * cs->interrupt_request. 10924 */ 10925 g_assert(bql_locked()); 10926 10927 arm_call_pre_el_change_hook(cpu); 10928 10929 assert(!excp_is_internal(cs->exception_index)); 10930 if (arm_el_is_aa64(env, new_el)) { 10931 arm_cpu_do_interrupt_aarch64(cs); 10932 } else { 10933 arm_cpu_do_interrupt_aarch32(cs); 10934 } 10935 10936 arm_call_el_change_hook(cpu); 10937 10938 if (!kvm_enabled()) { 10939 cs->interrupt_request |= CPU_INTERRUPT_EXITTB; 10940 } 10941 } 10942 #endif /* !CONFIG_USER_ONLY */ 10943 10944 uint64_t arm_sctlr(CPUARMState *env, int el) 10945 { 10946 /* Only EL0 needs to be adjusted for EL1&0 or EL2&0 or EL3&0 */ 10947 if (el == 0) { 10948 ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0); 10949 switch (mmu_idx) { 10950 case ARMMMUIdx_E20_0: 10951 el = 2; 10952 break; 10953 case ARMMMUIdx_E30_0: 10954 el = 3; 10955 break; 10956 default: 10957 el = 1; 10958 break; 10959 } 10960 } 10961 return env->cp15.sctlr_el[el]; 10962 } 10963 10964 int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx) 10965 { 10966 if (regime_has_2_ranges(mmu_idx)) { 10967 return extract64(tcr, 37, 2); 10968 } else if (regime_is_stage2(mmu_idx)) { 10969 return 0; /* VTCR_EL2 */ 10970 } else { 10971 /* Replicate the single TBI bit so we always have 2 bits. */ 10972 return extract32(tcr, 20, 1) * 3; 10973 } 10974 } 10975 10976 int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx) 10977 { 10978 if (regime_has_2_ranges(mmu_idx)) { 10979 return extract64(tcr, 51, 2); 10980 } else if (regime_is_stage2(mmu_idx)) { 10981 return 0; /* VTCR_EL2 */ 10982 } else { 10983 /* Replicate the single TBID bit so we always have 2 bits. */ 10984 return extract32(tcr, 29, 1) * 3; 10985 } 10986 } 10987 10988 int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx) 10989 { 10990 if (regime_has_2_ranges(mmu_idx)) { 10991 return extract64(tcr, 57, 2); 10992 } else { 10993 /* Replicate the single TCMA bit so we always have 2 bits. */ 10994 return extract32(tcr, 30, 1) * 3; 10995 } 10996 } 10997 10998 static ARMGranuleSize tg0_to_gran_size(int tg) 10999 { 11000 switch (tg) { 11001 case 0: 11002 return Gran4K; 11003 case 1: 11004 return Gran64K; 11005 case 2: 11006 return Gran16K; 11007 default: 11008 return GranInvalid; 11009 } 11010 } 11011 11012 static ARMGranuleSize tg1_to_gran_size(int tg) 11013 { 11014 switch (tg) { 11015 case 1: 11016 return Gran16K; 11017 case 2: 11018 return Gran4K; 11019 case 3: 11020 return Gran64K; 11021 default: 11022 return GranInvalid; 11023 } 11024 } 11025 11026 static inline bool have4k(ARMCPU *cpu, bool stage2) 11027 { 11028 return stage2 ? cpu_isar_feature(aa64_tgran4_2, cpu) 11029 : cpu_isar_feature(aa64_tgran4, cpu); 11030 } 11031 11032 static inline bool have16k(ARMCPU *cpu, bool stage2) 11033 { 11034 return stage2 ? cpu_isar_feature(aa64_tgran16_2, cpu) 11035 : cpu_isar_feature(aa64_tgran16, cpu); 11036 } 11037 11038 static inline bool have64k(ARMCPU *cpu, bool stage2) 11039 { 11040 return stage2 ? cpu_isar_feature(aa64_tgran64_2, cpu) 11041 : cpu_isar_feature(aa64_tgran64, cpu); 11042 } 11043 11044 static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran, 11045 bool stage2) 11046 { 11047 switch (gran) { 11048 case Gran4K: 11049 if (have4k(cpu, stage2)) { 11050 return gran; 11051 } 11052 break; 11053 case Gran16K: 11054 if (have16k(cpu, stage2)) { 11055 return gran; 11056 } 11057 break; 11058 case Gran64K: 11059 if (have64k(cpu, stage2)) { 11060 return gran; 11061 } 11062 break; 11063 case GranInvalid: 11064 break; 11065 } 11066 /* 11067 * If the guest selects a granule size that isn't implemented, 11068 * the architecture requires that we behave as if it selected one 11069 * that is (with an IMPDEF choice of which one to pick). We choose 11070 * to implement the smallest supported granule size. 11071 */ 11072 if (have4k(cpu, stage2)) { 11073 return Gran4K; 11074 } 11075 if (have16k(cpu, stage2)) { 11076 return Gran16K; 11077 } 11078 assert(have64k(cpu, stage2)); 11079 return Gran64K; 11080 } 11081 11082 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, 11083 ARMMMUIdx mmu_idx, bool data, 11084 bool el1_is_aa32) 11085 { 11086 uint64_t tcr = regime_tcr(env, mmu_idx); 11087 bool epd, hpd, tsz_oob, ds, ha, hd; 11088 int select, tsz, tbi, max_tsz, min_tsz, ps, sh; 11089 ARMGranuleSize gran; 11090 ARMCPU *cpu = env_archcpu(env); 11091 bool stage2 = regime_is_stage2(mmu_idx); 11092 11093 if (!regime_has_2_ranges(mmu_idx)) { 11094 select = 0; 11095 tsz = extract32(tcr, 0, 6); 11096 gran = tg0_to_gran_size(extract32(tcr, 14, 2)); 11097 if (stage2) { 11098 /* VTCR_EL2 */ 11099 hpd = false; 11100 } else { 11101 hpd = extract32(tcr, 24, 1); 11102 } 11103 epd = false; 11104 sh = extract32(tcr, 12, 2); 11105 ps = extract32(tcr, 16, 3); 11106 ha = extract32(tcr, 21, 1) && cpu_isar_feature(aa64_hafs, cpu); 11107 hd = extract32(tcr, 22, 1) && cpu_isar_feature(aa64_hdbs, cpu); 11108 ds = extract64(tcr, 32, 1); 11109 } else { 11110 bool e0pd; 11111 11112 /* 11113 * Bit 55 is always between the two regions, and is canonical for 11114 * determining if address tagging is enabled. 11115 */ 11116 select = extract64(va, 55, 1); 11117 if (!select) { 11118 tsz = extract32(tcr, 0, 6); 11119 gran = tg0_to_gran_size(extract32(tcr, 14, 2)); 11120 epd = extract32(tcr, 7, 1); 11121 sh = extract32(tcr, 12, 2); 11122 hpd = extract64(tcr, 41, 1); 11123 e0pd = extract64(tcr, 55, 1); 11124 } else { 11125 tsz = extract32(tcr, 16, 6); 11126 gran = tg1_to_gran_size(extract32(tcr, 30, 2)); 11127 epd = extract32(tcr, 23, 1); 11128 sh = extract32(tcr, 28, 2); 11129 hpd = extract64(tcr, 42, 1); 11130 e0pd = extract64(tcr, 56, 1); 11131 } 11132 ps = extract64(tcr, 32, 3); 11133 ha = extract64(tcr, 39, 1) && cpu_isar_feature(aa64_hafs, cpu); 11134 hd = extract64(tcr, 40, 1) && cpu_isar_feature(aa64_hdbs, cpu); 11135 ds = extract64(tcr, 59, 1); 11136 11137 if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) && 11138 regime_is_user(env, mmu_idx)) { 11139 epd = true; 11140 } 11141 } 11142 11143 gran = sanitize_gran_size(cpu, gran, stage2); 11144 11145 if (cpu_isar_feature(aa64_st, cpu)) { 11146 max_tsz = 48 - (gran == Gran64K); 11147 } else { 11148 max_tsz = 39; 11149 } 11150 11151 /* 11152 * DS is RES0 unless FEAT_LPA2 is supported for the given page size; 11153 * adjust the effective value of DS, as documented. 11154 */ 11155 min_tsz = 16; 11156 if (gran == Gran64K) { 11157 if (cpu_isar_feature(aa64_lva, cpu)) { 11158 min_tsz = 12; 11159 } 11160 ds = false; 11161 } else if (ds) { 11162 if (regime_is_stage2(mmu_idx)) { 11163 if (gran == Gran16K) { 11164 ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu); 11165 } else { 11166 ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu); 11167 } 11168 } else { 11169 if (gran == Gran16K) { 11170 ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu); 11171 } else { 11172 ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu); 11173 } 11174 } 11175 if (ds) { 11176 min_tsz = 12; 11177 } 11178 } 11179 11180 if (stage2 && el1_is_aa32) { 11181 /* 11182 * For AArch32 EL1 the min txsz (and thus max IPA size) requirements 11183 * are loosened: a configured IPA of 40 bits is permitted even if 11184 * the implemented PA is less than that (and so a 40 bit IPA would 11185 * fault for an AArch64 EL1). See R_DTLMN. 11186 */ 11187 min_tsz = MIN(min_tsz, 24); 11188 } 11189 11190 if (tsz > max_tsz) { 11191 tsz = max_tsz; 11192 tsz_oob = true; 11193 } else if (tsz < min_tsz) { 11194 tsz = min_tsz; 11195 tsz_oob = true; 11196 } else { 11197 tsz_oob = false; 11198 } 11199 11200 /* Present TBI as a composite with TBID. */ 11201 tbi = aa64_va_parameter_tbi(tcr, mmu_idx); 11202 if (!data) { 11203 tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx); 11204 } 11205 tbi = (tbi >> select) & 1; 11206 11207 return (ARMVAParameters) { 11208 .tsz = tsz, 11209 .ps = ps, 11210 .sh = sh, 11211 .select = select, 11212 .tbi = tbi, 11213 .epd = epd, 11214 .hpd = hpd, 11215 .tsz_oob = tsz_oob, 11216 .ds = ds, 11217 .ha = ha, 11218 .hd = ha && hd, 11219 .gran = gran, 11220 }; 11221 } 11222 11223 11224 /* 11225 * Return the exception level to which FP-disabled exceptions should 11226 * be taken, or 0 if FP is enabled. 11227 */ 11228 int fp_exception_el(CPUARMState *env, int cur_el) 11229 { 11230 #ifndef CONFIG_USER_ONLY 11231 uint64_t hcr_el2; 11232 11233 /* 11234 * CPACR and the CPTR registers don't exist before v6, so FP is 11235 * always accessible 11236 */ 11237 if (!arm_feature(env, ARM_FEATURE_V6)) { 11238 return 0; 11239 } 11240 11241 if (arm_feature(env, ARM_FEATURE_M)) { 11242 /* CPACR can cause a NOCP UsageFault taken to current security state */ 11243 if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) { 11244 return 1; 11245 } 11246 11247 if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) { 11248 if (!extract32(env->v7m.nsacr, 10, 1)) { 11249 /* FP insns cause a NOCP UsageFault taken to Secure */ 11250 return 3; 11251 } 11252 } 11253 11254 return 0; 11255 } 11256 11257 hcr_el2 = arm_hcr_el2_eff(env); 11258 11259 /* 11260 * The CPACR controls traps to EL1, or PL1 if we're 32 bit: 11261 * 0, 2 : trap EL0 and EL1/PL1 accesses 11262 * 1 : trap only EL0 accesses 11263 * 3 : trap no accesses 11264 * This register is ignored if E2H+TGE are both set. 11265 */ 11266 if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) { 11267 int fpen = FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, FPEN); 11268 11269 switch (fpen) { 11270 case 1: 11271 if (cur_el != 0) { 11272 break; 11273 } 11274 /* fall through */ 11275 case 0: 11276 case 2: 11277 /* Trap from Secure PL0 or PL1 to Secure PL1. */ 11278 if (!arm_el_is_aa64(env, 3) 11279 && (cur_el == 3 || arm_is_secure_below_el3(env))) { 11280 return 3; 11281 } 11282 if (cur_el <= 1) { 11283 return 1; 11284 } 11285 break; 11286 } 11287 } 11288 11289 /* 11290 * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode 11291 * to control non-secure access to the FPU. It doesn't have any 11292 * effect if EL3 is AArch64 or if EL3 doesn't exist at all. 11293 */ 11294 if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) && 11295 cur_el <= 2 && !arm_is_secure_below_el3(env))) { 11296 if (!extract32(env->cp15.nsacr, 10, 1)) { 11297 /* FP insns act as UNDEF */ 11298 return cur_el == 2 ? 2 : 1; 11299 } 11300 } 11301 11302 /* 11303 * CPTR_EL2 is present in v7VE or v8, and changes format 11304 * with HCR_EL2.E2H (regardless of TGE). 11305 */ 11306 if (cur_el <= 2) { 11307 if (hcr_el2 & HCR_E2H) { 11308 switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, FPEN)) { 11309 case 1: 11310 if (cur_el != 0 || !(hcr_el2 & HCR_TGE)) { 11311 break; 11312 } 11313 /* fall through */ 11314 case 0: 11315 case 2: 11316 return 2; 11317 } 11318 } else if (arm_is_el2_enabled(env)) { 11319 if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TFP)) { 11320 return 2; 11321 } 11322 } 11323 } 11324 11325 /* CPTR_EL3 : present in v8 */ 11326 if (FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TFP)) { 11327 /* Trap all FP ops to EL3 */ 11328 return 3; 11329 } 11330 #endif 11331 return 0; 11332 } 11333 11334 /* Return the exception level we're running at if this is our mmu_idx */ 11335 int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx) 11336 { 11337 if (mmu_idx & ARM_MMU_IDX_M) { 11338 return mmu_idx & ARM_MMU_IDX_M_PRIV; 11339 } 11340 11341 switch (mmu_idx) { 11342 case ARMMMUIdx_E10_0: 11343 case ARMMMUIdx_E20_0: 11344 case ARMMMUIdx_E30_0: 11345 return 0; 11346 case ARMMMUIdx_E10_1: 11347 case ARMMMUIdx_E10_1_PAN: 11348 return 1; 11349 case ARMMMUIdx_E2: 11350 case ARMMMUIdx_E20_2: 11351 case ARMMMUIdx_E20_2_PAN: 11352 return 2; 11353 case ARMMMUIdx_E3: 11354 case ARMMMUIdx_E30_3_PAN: 11355 return 3; 11356 default: 11357 g_assert_not_reached(); 11358 } 11359 } 11360 11361 #ifndef CONFIG_TCG 11362 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate) 11363 { 11364 g_assert_not_reached(); 11365 } 11366 #endif 11367 11368 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el) 11369 { 11370 ARMMMUIdx idx; 11371 uint64_t hcr; 11372 11373 if (arm_feature(env, ARM_FEATURE_M)) { 11374 return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure); 11375 } 11376 11377 /* See ARM pseudo-function ELIsInHost. */ 11378 switch (el) { 11379 case 0: 11380 hcr = arm_hcr_el2_eff(env); 11381 if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) { 11382 idx = ARMMMUIdx_E20_0; 11383 } else if (arm_is_secure_below_el3(env) && 11384 !arm_el_is_aa64(env, 3)) { 11385 idx = ARMMMUIdx_E30_0; 11386 } else { 11387 idx = ARMMMUIdx_E10_0; 11388 } 11389 break; 11390 case 1: 11391 if (arm_pan_enabled(env)) { 11392 idx = ARMMMUIdx_E10_1_PAN; 11393 } else { 11394 idx = ARMMMUIdx_E10_1; 11395 } 11396 break; 11397 case 2: 11398 /* Note that TGE does not apply at EL2. */ 11399 if (arm_hcr_el2_eff(env) & HCR_E2H) { 11400 if (arm_pan_enabled(env)) { 11401 idx = ARMMMUIdx_E20_2_PAN; 11402 } else { 11403 idx = ARMMMUIdx_E20_2; 11404 } 11405 } else { 11406 idx = ARMMMUIdx_E2; 11407 } 11408 break; 11409 case 3: 11410 if (!arm_el_is_aa64(env, 3) && arm_pan_enabled(env)) { 11411 return ARMMMUIdx_E30_3_PAN; 11412 } 11413 return ARMMMUIdx_E3; 11414 default: 11415 g_assert_not_reached(); 11416 } 11417 11418 return idx; 11419 } 11420 11421 ARMMMUIdx arm_mmu_idx(CPUARMState *env) 11422 { 11423 return arm_mmu_idx_el(env, arm_current_el(env)); 11424 } 11425 11426 /* 11427 * The manual says that when SVE is enabled and VQ is widened the 11428 * implementation is allowed to zero the previously inaccessible 11429 * portion of the registers. The corollary to that is that when 11430 * SVE is enabled and VQ is narrowed we are also allowed to zero 11431 * the now inaccessible portion of the registers. 11432 * 11433 * The intent of this is that no predicate bit beyond VQ is ever set. 11434 * Which means that some operations on predicate registers themselves 11435 * may operate on full uint64_t or even unrolled across the maximum 11436 * uint64_t[4]. Performing 4 bits of host arithmetic unconditionally 11437 * may well be cheaper than conditionals to restrict the operation 11438 * to the relevant portion of a uint16_t[16]. 11439 */ 11440 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) 11441 { 11442 int i, j; 11443 uint64_t pmask; 11444 11445 assert(vq >= 1 && vq <= ARM_MAX_VQ); 11446 assert(vq <= env_archcpu(env)->sve_max_vq); 11447 11448 /* Zap the high bits of the zregs. */ 11449 for (i = 0; i < 32; i++) { 11450 memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq)); 11451 } 11452 11453 /* Zap the high bits of the pregs and ffr. */ 11454 pmask = 0; 11455 if (vq & 3) { 11456 pmask = ~(-1ULL << (16 * (vq & 3))); 11457 } 11458 for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) { 11459 for (i = 0; i < 17; ++i) { 11460 env->vfp.pregs[i].p[j] &= pmask; 11461 } 11462 pmask = 0; 11463 } 11464 } 11465 11466 static uint32_t sve_vqm1_for_el_sm_ena(CPUARMState *env, int el, bool sm) 11467 { 11468 int exc_el; 11469 11470 if (sm) { 11471 exc_el = sme_exception_el(env, el); 11472 } else { 11473 exc_el = sve_exception_el(env, el); 11474 } 11475 if (exc_el) { 11476 return 0; /* disabled */ 11477 } 11478 return sve_vqm1_for_el_sm(env, el, sm); 11479 } 11480 11481 /* 11482 * Notice a change in SVE vector size when changing EL. 11483 */ 11484 void aarch64_sve_change_el(CPUARMState *env, int old_el, 11485 int new_el, bool el0_a64) 11486 { 11487 ARMCPU *cpu = env_archcpu(env); 11488 int old_len, new_len; 11489 bool old_a64, new_a64, sm; 11490 11491 /* Nothing to do if no SVE. */ 11492 if (!cpu_isar_feature(aa64_sve, cpu)) { 11493 return; 11494 } 11495 11496 /* Nothing to do if FP is disabled in either EL. */ 11497 if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) { 11498 return; 11499 } 11500 11501 old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64; 11502 new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64; 11503 11504 /* 11505 * Both AArch64.TakeException and AArch64.ExceptionReturn 11506 * invoke ResetSVEState when taking an exception from, or 11507 * returning to, AArch32 state when PSTATE.SM is enabled. 11508 */ 11509 sm = FIELD_EX64(env->svcr, SVCR, SM); 11510 if (old_a64 != new_a64 && sm) { 11511 arm_reset_sve_state(env); 11512 return; 11513 } 11514 11515 /* 11516 * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped 11517 * at ELx, or not available because the EL is in AArch32 state, then 11518 * for all purposes other than a direct read, the ZCR_ELx.LEN field 11519 * has an effective value of 0". 11520 * 11521 * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0). 11522 * If we ignore aa32 state, we would fail to see the vq4->vq0 transition 11523 * from EL2->EL1. Thus we go ahead and narrow when entering aa32 so that 11524 * we already have the correct register contents when encountering the 11525 * vq0->vq0 transition between EL0->EL1. 11526 */ 11527 old_len = new_len = 0; 11528 if (old_a64) { 11529 old_len = sve_vqm1_for_el_sm_ena(env, old_el, sm); 11530 } 11531 if (new_a64) { 11532 new_len = sve_vqm1_for_el_sm_ena(env, new_el, sm); 11533 } 11534 11535 /* When changing vector length, clear inaccessible state. */ 11536 if (new_len < old_len) { 11537 aarch64_sve_narrow_vq(env, new_len + 1); 11538 } 11539 } 11540 11541 #ifndef CONFIG_USER_ONLY 11542 ARMSecuritySpace arm_security_space(CPUARMState *env) 11543 { 11544 if (arm_feature(env, ARM_FEATURE_M)) { 11545 return arm_secure_to_space(env->v7m.secure); 11546 } 11547 11548 /* 11549 * If EL3 is not supported then the secure state is implementation 11550 * defined, in which case QEMU defaults to non-secure. 11551 */ 11552 if (!arm_feature(env, ARM_FEATURE_EL3)) { 11553 return ARMSS_NonSecure; 11554 } 11555 11556 /* Check for AArch64 EL3 or AArch32 Mon. */ 11557 if (is_a64(env)) { 11558 if (extract32(env->pstate, 2, 2) == 3) { 11559 if (cpu_isar_feature(aa64_rme, env_archcpu(env))) { 11560 return ARMSS_Root; 11561 } else { 11562 return ARMSS_Secure; 11563 } 11564 } 11565 } else { 11566 if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) { 11567 return ARMSS_Secure; 11568 } 11569 } 11570 11571 return arm_security_space_below_el3(env); 11572 } 11573 11574 ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env) 11575 { 11576 assert(!arm_feature(env, ARM_FEATURE_M)); 11577 11578 /* 11579 * If EL3 is not supported then the secure state is implementation 11580 * defined, in which case QEMU defaults to non-secure. 11581 */ 11582 if (!arm_feature(env, ARM_FEATURE_EL3)) { 11583 return ARMSS_NonSecure; 11584 } 11585 11586 /* 11587 * Note NSE cannot be set without RME, and NSE & !NS is Reserved. 11588 * Ignoring NSE when !NS retains consistency without having to 11589 * modify other predicates. 11590 */ 11591 if (!(env->cp15.scr_el3 & SCR_NS)) { 11592 return ARMSS_Secure; 11593 } else if (env->cp15.scr_el3 & SCR_NSE) { 11594 return ARMSS_Realm; 11595 } else { 11596 return ARMSS_NonSecure; 11597 } 11598 } 11599 #endif /* !CONFIG_USER_ONLY */ 11600