xref: /qemu/target/arm/cpu.c (revision 3d881164d4fb2b0f6791cf28d9725926b8ded0d6)
1 /*
2  * QEMU ARM CPU
3  *
4  * Copyright (c) 2012 SUSE LINUX Products GmbH
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version 2
9  * of the License, or (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, see
18  * <http://www.gnu.org/licenses/gpl-2.0.html>
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qemu/qemu-print.h"
23 #include "qemu/timer.h"
24 #include "qemu/log.h"
25 #include "exec/page-vary.h"
26 #include "target/arm/idau.h"
27 #include "qemu/module.h"
28 #include "qapi/error.h"
29 #include "cpu.h"
30 #ifdef CONFIG_TCG
31 #include "exec/translation-block.h"
32 #include "accel/tcg/cpu-ops.h"
33 #endif /* CONFIG_TCG */
34 #include "internals.h"
35 #include "cpu-features.h"
36 #include "exec/exec-all.h"
37 #include "exec/target_page.h"
38 #include "hw/qdev-properties.h"
39 #if !defined(CONFIG_USER_ONLY)
40 #include "hw/loader.h"
41 #include "hw/boards.h"
42 #ifdef CONFIG_TCG
43 #include "hw/intc/armv7m_nvic.h"
44 #endif /* CONFIG_TCG */
45 #endif /* !CONFIG_USER_ONLY */
46 #include "system/tcg.h"
47 #include "system/qtest.h"
48 #include "system/hw_accel.h"
49 #include "kvm_arm.h"
50 #include "disas/capstone.h"
51 #include "fpu/softfloat.h"
52 #include "cpregs.h"
53 #include "target/arm/cpu-qom.h"
54 #include "target/arm/gtimer.h"
55 
56 static void arm_cpu_set_pc(CPUState *cs, vaddr value)
57 {
58     ARMCPU *cpu = ARM_CPU(cs);
59     CPUARMState *env = &cpu->env;
60 
61     if (is_a64(env)) {
62         env->pc = value;
63         env->thumb = false;
64     } else {
65         env->regs[15] = value & ~1;
66         env->thumb = value & 1;
67     }
68 }
69 
70 static vaddr arm_cpu_get_pc(CPUState *cs)
71 {
72     ARMCPU *cpu = ARM_CPU(cs);
73     CPUARMState *env = &cpu->env;
74 
75     if (is_a64(env)) {
76         return env->pc;
77     } else {
78         return env->regs[15];
79     }
80 }
81 
82 #ifdef CONFIG_TCG
83 void arm_cpu_synchronize_from_tb(CPUState *cs,
84                                  const TranslationBlock *tb)
85 {
86     /* The program counter is always up to date with CF_PCREL. */
87     if (!(tb_cflags(tb) & CF_PCREL)) {
88         CPUARMState *env = cpu_env(cs);
89         /*
90          * It's OK to look at env for the current mode here, because it's
91          * never possible for an AArch64 TB to chain to an AArch32 TB.
92          */
93         if (is_a64(env)) {
94             env->pc = tb->pc;
95         } else {
96             env->regs[15] = tb->pc;
97         }
98     }
99 }
100 
101 void arm_restore_state_to_opc(CPUState *cs,
102                               const TranslationBlock *tb,
103                               const uint64_t *data)
104 {
105     CPUARMState *env = cpu_env(cs);
106 
107     if (is_a64(env)) {
108         if (tb_cflags(tb) & CF_PCREL) {
109             env->pc = (env->pc & TARGET_PAGE_MASK) | data[0];
110         } else {
111             env->pc = data[0];
112         }
113         env->condexec_bits = 0;
114         env->exception.syndrome = data[2] << ARM_INSN_START_WORD2_SHIFT;
115     } else {
116         if (tb_cflags(tb) & CF_PCREL) {
117             env->regs[15] = (env->regs[15] & TARGET_PAGE_MASK) | data[0];
118         } else {
119             env->regs[15] = data[0];
120         }
121         env->condexec_bits = data[1];
122         env->exception.syndrome = data[2] << ARM_INSN_START_WORD2_SHIFT;
123     }
124 }
125 
126 int arm_cpu_mmu_index(CPUState *cs, bool ifetch)
127 {
128     return arm_env_mmu_index(cpu_env(cs));
129 }
130 
131 #endif /* CONFIG_TCG */
132 
133 #ifndef CONFIG_USER_ONLY
134 /*
135  * With SCTLR_ELx.NMI == 0, IRQ with Superpriority is masked identically with
136  * IRQ without Superpriority. Moreover, if the GIC is configured so that
137  * FEAT_GICv3_NMI is only set if FEAT_NMI is set, then we won't ever see
138  * CPU_INTERRUPT_*NMI anyway. So we might as well accept NMI here
139  * unconditionally.
140  */
141 static bool arm_cpu_has_work(CPUState *cs)
142 {
143     ARMCPU *cpu = ARM_CPU(cs);
144 
145     return (cpu->power_state != PSCI_OFF)
146         && cs->interrupt_request &
147         (CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
148          | CPU_INTERRUPT_NMI | CPU_INTERRUPT_VINMI | CPU_INTERRUPT_VFNMI
149          | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
150          | CPU_INTERRUPT_EXITTB);
151 }
152 #endif /* !CONFIG_USER_ONLY */
153 
154 void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
155                                  void *opaque)
156 {
157     ARMELChangeHook *entry = g_new0(ARMELChangeHook, 1);
158 
159     entry->hook = hook;
160     entry->opaque = opaque;
161 
162     QLIST_INSERT_HEAD(&cpu->pre_el_change_hooks, entry, node);
163 }
164 
165 void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
166                                  void *opaque)
167 {
168     ARMELChangeHook *entry = g_new0(ARMELChangeHook, 1);
169 
170     entry->hook = hook;
171     entry->opaque = opaque;
172 
173     QLIST_INSERT_HEAD(&cpu->el_change_hooks, entry, node);
174 }
175 
176 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
177 {
178     /* Reset a single ARMCPRegInfo register */
179     ARMCPRegInfo *ri = value;
180     ARMCPU *cpu = opaque;
181 
182     if (ri->type & (ARM_CP_SPECIAL_MASK | ARM_CP_ALIAS)) {
183         return;
184     }
185 
186     if (ri->resetfn) {
187         ri->resetfn(&cpu->env, ri);
188         return;
189     }
190 
191     /* A zero offset is never possible as it would be regs[0]
192      * so we use it to indicate that reset is being handled elsewhere.
193      * This is basically only used for fields in non-core coprocessors
194      * (like the pxa2xx ones).
195      */
196     if (!ri->fieldoffset) {
197         return;
198     }
199 
200     if (cpreg_field_is_64bit(ri)) {
201         CPREG_FIELD64(&cpu->env, ri) = ri->resetvalue;
202     } else {
203         CPREG_FIELD32(&cpu->env, ri) = ri->resetvalue;
204     }
205 }
206 
207 static void cp_reg_check_reset(gpointer key, gpointer value,  gpointer opaque)
208 {
209     /* Purely an assertion check: we've already done reset once,
210      * so now check that running the reset for the cpreg doesn't
211      * change its value. This traps bugs where two different cpregs
212      * both try to reset the same state field but to different values.
213      */
214     ARMCPRegInfo *ri = value;
215     ARMCPU *cpu = opaque;
216     uint64_t oldvalue, newvalue;
217 
218     if (ri->type & (ARM_CP_SPECIAL_MASK | ARM_CP_ALIAS | ARM_CP_NO_RAW)) {
219         return;
220     }
221 
222     oldvalue = read_raw_cp_reg(&cpu->env, ri);
223     cp_reg_reset(key, value, opaque);
224     newvalue = read_raw_cp_reg(&cpu->env, ri);
225     assert(oldvalue == newvalue);
226 }
227 
228 static void arm_cpu_reset_hold(Object *obj, ResetType type)
229 {
230     CPUState *cs = CPU(obj);
231     ARMCPU *cpu = ARM_CPU(cs);
232     ARMCPUClass *acc = ARM_CPU_GET_CLASS(obj);
233     CPUARMState *env = &cpu->env;
234 
235     if (acc->parent_phases.hold) {
236         acc->parent_phases.hold(obj, type);
237     }
238 
239     memset(env, 0, offsetof(CPUARMState, end_reset_fields));
240 
241     g_hash_table_foreach(cpu->cp_regs, cp_reg_reset, cpu);
242     g_hash_table_foreach(cpu->cp_regs, cp_reg_check_reset, cpu);
243 
244     env->vfp.xregs[ARM_VFP_FPSID] = cpu->reset_fpsid;
245     env->vfp.xregs[ARM_VFP_MVFR0] = cpu->isar.mvfr0;
246     env->vfp.xregs[ARM_VFP_MVFR1] = cpu->isar.mvfr1;
247     env->vfp.xregs[ARM_VFP_MVFR2] = cpu->isar.mvfr2;
248 
249     cpu->power_state = cs->start_powered_off ? PSCI_OFF : PSCI_ON;
250 
251     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
252         env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
253     }
254 
255     if (arm_feature(env, ARM_FEATURE_AARCH64)) {
256         /* 64 bit CPUs always start in 64 bit mode */
257         env->aarch64 = true;
258 #if defined(CONFIG_USER_ONLY)
259         env->pstate = PSTATE_MODE_EL0t;
260         /* Userspace expects access to DC ZVA, CTL_EL0 and the cache ops */
261         env->cp15.sctlr_el[1] |= SCTLR_UCT | SCTLR_UCI | SCTLR_DZE;
262         /* Enable all PAC keys.  */
263         env->cp15.sctlr_el[1] |= (SCTLR_EnIA | SCTLR_EnIB |
264                                   SCTLR_EnDA | SCTLR_EnDB);
265         /* Trap on btype=3 for PACIxSP. */
266         env->cp15.sctlr_el[1] |= SCTLR_BT0;
267         /* Trap on implementation defined registers. */
268         if (cpu_isar_feature(aa64_tidcp1, cpu)) {
269             env->cp15.sctlr_el[1] |= SCTLR_TIDCP;
270         }
271         /* and to the FP/Neon instructions */
272         env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
273                                          CPACR_EL1, FPEN, 3);
274         /* and to the SVE instructions, with default vector length */
275         if (cpu_isar_feature(aa64_sve, cpu)) {
276             env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
277                                              CPACR_EL1, ZEN, 3);
278             env->vfp.zcr_el[1] = cpu->sve_default_vq - 1;
279         }
280         /* and for SME instructions, with default vector length, and TPIDR2 */
281         if (cpu_isar_feature(aa64_sme, cpu)) {
282             env->cp15.sctlr_el[1] |= SCTLR_EnTP2;
283             env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
284                                              CPACR_EL1, SMEN, 3);
285             env->vfp.smcr_el[1] = cpu->sme_default_vq - 1;
286             if (cpu_isar_feature(aa64_sme_fa64, cpu)) {
287                 env->vfp.smcr_el[1] = FIELD_DP64(env->vfp.smcr_el[1],
288                                                  SMCR, FA64, 1);
289             }
290         }
291         /*
292          * Enable 48-bit address space (TODO: take reserved_va into account).
293          * Enable TBI0 but not TBI1.
294          * Note that this must match useronly_clean_ptr.
295          */
296         env->cp15.tcr_el[1] = 5 | (1ULL << 37);
297 
298         /* Enable MTE */
299         if (cpu_isar_feature(aa64_mte, cpu)) {
300             /* Enable tag access, but leave TCF0 as No Effect (0). */
301             env->cp15.sctlr_el[1] |= SCTLR_ATA0;
302             /*
303              * Exclude all tags, so that tag 0 is always used.
304              * This corresponds to Linux current->thread.gcr_incl = 0.
305              *
306              * Set RRND, so that helper_irg() will generate a seed later.
307              * Here in cpu_reset(), the crypto subsystem has not yet been
308              * initialized.
309              */
310             env->cp15.gcr_el1 = 0x1ffff;
311         }
312         /*
313          * Disable access to SCXTNUM_EL0 from CSV2_1p2.
314          * This is not yet exposed from the Linux kernel in any way.
315          */
316         env->cp15.sctlr_el[1] |= SCTLR_TSCXT;
317         /* Disable access to Debug Communication Channel (DCC). */
318         env->cp15.mdscr_el1 |= 1 << 12;
319         /* Enable FEAT_MOPS */
320         env->cp15.sctlr_el[1] |= SCTLR_MSCEN;
321 #else
322         /* Reset into the highest available EL */
323         if (arm_feature(env, ARM_FEATURE_EL3)) {
324             env->pstate = PSTATE_MODE_EL3h;
325         } else if (arm_feature(env, ARM_FEATURE_EL2)) {
326             env->pstate = PSTATE_MODE_EL2h;
327         } else {
328             env->pstate = PSTATE_MODE_EL1h;
329         }
330 
331         /* Sample rvbar at reset.  */
332         env->cp15.rvbar = cpu->rvbar_prop;
333         env->pc = env->cp15.rvbar;
334 #endif
335     } else {
336 #if defined(CONFIG_USER_ONLY)
337         /* Userspace expects access to cp10 and cp11 for FP/Neon */
338         env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
339                                          CPACR, CP10, 3);
340         env->cp15.cpacr_el1 = FIELD_DP64(env->cp15.cpacr_el1,
341                                          CPACR, CP11, 3);
342 #endif
343         if (arm_feature(env, ARM_FEATURE_V8)) {
344             env->cp15.rvbar = cpu->rvbar_prop;
345             env->regs[15] = cpu->rvbar_prop;
346         }
347     }
348 
349 #if defined(CONFIG_USER_ONLY)
350     env->uncached_cpsr = ARM_CPU_MODE_USR;
351     /* For user mode we must enable access to coprocessors */
352     env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
353     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
354         env->cp15.c15_cpar = 3;
355     } else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
356         env->cp15.c15_cpar = 1;
357     }
358 #else
359 
360     /*
361      * If the highest available EL is EL2, AArch32 will start in Hyp
362      * mode; otherwise it starts in SVC. Note that if we start in
363      * AArch64 then these values in the uncached_cpsr will be ignored.
364      */
365     if (arm_feature(env, ARM_FEATURE_EL2) &&
366         !arm_feature(env, ARM_FEATURE_EL3)) {
367         env->uncached_cpsr = ARM_CPU_MODE_HYP;
368     } else {
369         env->uncached_cpsr = ARM_CPU_MODE_SVC;
370     }
371     env->daif = PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F;
372 
373     /* AArch32 has a hard highvec setting of 0xFFFF0000.  If we are currently
374      * executing as AArch32 then check if highvecs are enabled and
375      * adjust the PC accordingly.
376      */
377     if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
378         env->regs[15] = 0xFFFF0000;
379     }
380 
381     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
382 #endif
383 
384     if (arm_feature(env, ARM_FEATURE_M)) {
385 #ifndef CONFIG_USER_ONLY
386         uint32_t initial_msp; /* Loaded from 0x0 */
387         uint32_t initial_pc; /* Loaded from 0x4 */
388         uint8_t *rom;
389         uint32_t vecbase;
390 #endif
391 
392         if (cpu_isar_feature(aa32_lob, cpu)) {
393             /*
394              * LTPSIZE is constant 4 if MVE not implemented, and resets
395              * to an UNKNOWN value if MVE is implemented. We choose to
396              * always reset to 4.
397              */
398             env->v7m.ltpsize = 4;
399             /* The LTPSIZE field in FPDSCR is constant and reads as 4. */
400             env->v7m.fpdscr[M_REG_NS] = 4 << FPCR_LTPSIZE_SHIFT;
401             env->v7m.fpdscr[M_REG_S] = 4 << FPCR_LTPSIZE_SHIFT;
402         }
403 
404         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
405             env->v7m.secure = true;
406         } else {
407             /* This bit resets to 0 if security is supported, but 1 if
408              * it is not. The bit is not present in v7M, but we set it
409              * here so we can avoid having to make checks on it conditional
410              * on ARM_FEATURE_V8 (we don't let the guest see the bit).
411              */
412             env->v7m.aircr = R_V7M_AIRCR_BFHFNMINS_MASK;
413             /*
414              * Set NSACR to indicate "NS access permitted to everything";
415              * this avoids having to have all the tests of it being
416              * conditional on ARM_FEATURE_M_SECURITY. Note also that from
417              * v8.1M the guest-visible value of NSACR in a CPU without the
418              * Security Extension is 0xcff.
419              */
420             env->v7m.nsacr = 0xcff;
421         }
422 
423         /* In v7M the reset value of this bit is IMPDEF, but ARM recommends
424          * that it resets to 1, so QEMU always does that rather than making
425          * it dependent on CPU model. In v8M it is RES1.
426          */
427         env->v7m.ccr[M_REG_NS] = R_V7M_CCR_STKALIGN_MASK;
428         env->v7m.ccr[M_REG_S] = R_V7M_CCR_STKALIGN_MASK;
429         if (arm_feature(env, ARM_FEATURE_V8)) {
430             /* in v8M the NONBASETHRDENA bit [0] is RES1 */
431             env->v7m.ccr[M_REG_NS] |= R_V7M_CCR_NONBASETHRDENA_MASK;
432             env->v7m.ccr[M_REG_S] |= R_V7M_CCR_NONBASETHRDENA_MASK;
433         }
434         if (!arm_feature(env, ARM_FEATURE_M_MAIN)) {
435             env->v7m.ccr[M_REG_NS] |= R_V7M_CCR_UNALIGN_TRP_MASK;
436             env->v7m.ccr[M_REG_S] |= R_V7M_CCR_UNALIGN_TRP_MASK;
437         }
438 
439         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
440             env->v7m.fpccr[M_REG_NS] = R_V7M_FPCCR_ASPEN_MASK;
441             env->v7m.fpccr[M_REG_S] = R_V7M_FPCCR_ASPEN_MASK |
442                 R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK;
443         }
444 
445 #ifndef CONFIG_USER_ONLY
446         /* Unlike A/R profile, M profile defines the reset LR value */
447         env->regs[14] = 0xffffffff;
448 
449         env->v7m.vecbase[M_REG_S] = cpu->init_svtor & 0xffffff80;
450         env->v7m.vecbase[M_REG_NS] = cpu->init_nsvtor & 0xffffff80;
451 
452         /* Load the initial SP and PC from offset 0 and 4 in the vector table */
453         vecbase = env->v7m.vecbase[env->v7m.secure];
454         rom = rom_ptr_for_as(cs->as, vecbase, 8);
455         if (rom) {
456             /* Address zero is covered by ROM which hasn't yet been
457              * copied into physical memory.
458              */
459             initial_msp = ldl_p(rom);
460             initial_pc = ldl_p(rom + 4);
461         } else {
462             /* Address zero not covered by a ROM blob, or the ROM blob
463              * is in non-modifiable memory and this is a second reset after
464              * it got copied into memory. In the latter case, rom_ptr
465              * will return a NULL pointer and we should use ldl_phys instead.
466              */
467             initial_msp = ldl_phys(cs->as, vecbase);
468             initial_pc = ldl_phys(cs->as, vecbase + 4);
469         }
470 
471         qemu_log_mask(CPU_LOG_INT,
472                       "Loaded reset SP 0x%x PC 0x%x from vector table\n",
473                       initial_msp, initial_pc);
474 
475         env->regs[13] = initial_msp & 0xFFFFFFFC;
476         env->regs[15] = initial_pc & ~1;
477         env->thumb = initial_pc & 1;
478 #else
479         /*
480          * For user mode we run non-secure and with access to the FPU.
481          * The FPU context is active (ie does not need further setup)
482          * and is owned by non-secure.
483          */
484         env->v7m.secure = false;
485         env->v7m.nsacr = 0xcff;
486         env->v7m.cpacr[M_REG_NS] = 0xf0ffff;
487         env->v7m.fpccr[M_REG_S] &=
488             ~(R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK);
489         env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
490 #endif
491     }
492 
493     /* M profile requires that reset clears the exclusive monitor;
494      * A profile does not, but clearing it makes more sense than having it
495      * set with an exclusive access on address zero.
496      */
497     arm_clear_exclusive(env);
498 
499     if (arm_feature(env, ARM_FEATURE_PMSA)) {
500         if (cpu->pmsav7_dregion > 0) {
501             if (arm_feature(env, ARM_FEATURE_V8)) {
502                 memset(env->pmsav8.rbar[M_REG_NS], 0,
503                        sizeof(*env->pmsav8.rbar[M_REG_NS])
504                        * cpu->pmsav7_dregion);
505                 memset(env->pmsav8.rlar[M_REG_NS], 0,
506                        sizeof(*env->pmsav8.rlar[M_REG_NS])
507                        * cpu->pmsav7_dregion);
508                 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
509                     memset(env->pmsav8.rbar[M_REG_S], 0,
510                            sizeof(*env->pmsav8.rbar[M_REG_S])
511                            * cpu->pmsav7_dregion);
512                     memset(env->pmsav8.rlar[M_REG_S], 0,
513                            sizeof(*env->pmsav8.rlar[M_REG_S])
514                            * cpu->pmsav7_dregion);
515                 }
516             } else if (arm_feature(env, ARM_FEATURE_V7)) {
517                 memset(env->pmsav7.drbar, 0,
518                        sizeof(*env->pmsav7.drbar) * cpu->pmsav7_dregion);
519                 memset(env->pmsav7.drsr, 0,
520                        sizeof(*env->pmsav7.drsr) * cpu->pmsav7_dregion);
521                 memset(env->pmsav7.dracr, 0,
522                        sizeof(*env->pmsav7.dracr) * cpu->pmsav7_dregion);
523             }
524         }
525 
526         if (cpu->pmsav8r_hdregion > 0) {
527             memset(env->pmsav8.hprbar, 0,
528                    sizeof(*env->pmsav8.hprbar) * cpu->pmsav8r_hdregion);
529             memset(env->pmsav8.hprlar, 0,
530                    sizeof(*env->pmsav8.hprlar) * cpu->pmsav8r_hdregion);
531         }
532 
533         env->pmsav7.rnr[M_REG_NS] = 0;
534         env->pmsav7.rnr[M_REG_S] = 0;
535         env->pmsav8.mair0[M_REG_NS] = 0;
536         env->pmsav8.mair0[M_REG_S] = 0;
537         env->pmsav8.mair1[M_REG_NS] = 0;
538         env->pmsav8.mair1[M_REG_S] = 0;
539     }
540 
541     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
542         if (cpu->sau_sregion > 0) {
543             memset(env->sau.rbar, 0, sizeof(*env->sau.rbar) * cpu->sau_sregion);
544             memset(env->sau.rlar, 0, sizeof(*env->sau.rlar) * cpu->sau_sregion);
545         }
546         env->sau.rnr = 0;
547         /* SAU_CTRL reset value is IMPDEF; we choose 0, which is what
548          * the Cortex-M33 does.
549          */
550         env->sau.ctrl = 0;
551     }
552 
553     set_flush_to_zero(1, &env->vfp.fp_status[FPST_STD]);
554     set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_STD]);
555     set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD]);
556     set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
557     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32]);
558     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
559     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
560     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32_F16]);
561     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
562     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
563     arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH]);
564     set_flush_to_zero(1, &env->vfp.fp_status[FPST_AH]);
565     set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_AH]);
566     arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH_F16]);
567 
568 #ifndef CONFIG_USER_ONLY
569     if (kvm_enabled()) {
570         kvm_arm_reset_vcpu(cpu);
571     }
572 #endif
573 
574     if (tcg_enabled()) {
575         hw_breakpoint_update_all(cpu);
576         hw_watchpoint_update_all(cpu);
577 
578         arm_rebuild_hflags(env);
579     }
580 }
581 
582 void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
583 {
584     ARMCPU *cpu = ARM_CPU(cpustate);
585     CPUARMState *env = &cpu->env;
586     bool have_el3 = arm_feature(env, ARM_FEATURE_EL3);
587     bool have_el2 = arm_feature(env, ARM_FEATURE_EL2);
588 
589     /*
590      * Check we have the EL we're aiming for. If that is the
591      * highest implemented EL, then cpu_reset has already done
592      * all the work.
593      */
594     switch (target_el) {
595     case 3:
596         assert(have_el3);
597         return;
598     case 2:
599         assert(have_el2);
600         if (!have_el3) {
601             return;
602         }
603         break;
604     case 1:
605         if (!have_el3 && !have_el2) {
606             return;
607         }
608         break;
609     default:
610         g_assert_not_reached();
611     }
612 
613     if (have_el3) {
614         /*
615          * Set the EL3 state so code can run at EL2. This should match
616          * the requirements set by Linux in its booting spec.
617          */
618         if (env->aarch64) {
619             env->cp15.scr_el3 |= SCR_RW;
620             if (cpu_isar_feature(aa64_pauth, cpu)) {
621                 env->cp15.scr_el3 |= SCR_API | SCR_APK;
622             }
623             if (cpu_isar_feature(aa64_mte, cpu)) {
624                 env->cp15.scr_el3 |= SCR_ATA;
625             }
626             if (cpu_isar_feature(aa64_sve, cpu)) {
627                 env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
628                 env->vfp.zcr_el[3] = 0xf;
629             }
630             if (cpu_isar_feature(aa64_sme, cpu)) {
631                 env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
632                 env->cp15.scr_el3 |= SCR_ENTP2;
633                 env->vfp.smcr_el[3] = 0xf;
634             }
635             if (cpu_isar_feature(aa64_hcx, cpu)) {
636                 env->cp15.scr_el3 |= SCR_HXEN;
637             }
638             if (cpu_isar_feature(aa64_fgt, cpu)) {
639                 env->cp15.scr_el3 |= SCR_FGTEN;
640             }
641         }
642 
643         if (target_el == 2) {
644             /* If the guest is at EL2 then Linux expects the HVC insn to work */
645             env->cp15.scr_el3 |= SCR_HCE;
646         }
647 
648         /* Put CPU into non-secure state */
649         env->cp15.scr_el3 |= SCR_NS;
650         /* Set NSACR.{CP11,CP10} so NS can access the FPU */
651         env->cp15.nsacr |= 3 << 10;
652     }
653 
654     if (have_el2 && target_el < 2) {
655         /* Set EL2 state so code can run at EL1. */
656         if (env->aarch64) {
657             env->cp15.hcr_el2 |= HCR_RW;
658         }
659     }
660 
661     /* Set the CPU to the desired state */
662     if (env->aarch64) {
663         env->pstate = aarch64_pstate_mode(target_el, true);
664     } else {
665         static const uint32_t mode_for_el[] = {
666             0,
667             ARM_CPU_MODE_SVC,
668             ARM_CPU_MODE_HYP,
669             ARM_CPU_MODE_SVC,
670         };
671 
672         cpsr_write(env, mode_for_el[target_el], CPSR_M, CPSRWriteRaw);
673     }
674 }
675 
676 
677 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
678 
679 static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
680                                      unsigned int target_el,
681                                      unsigned int cur_el, bool secure,
682                                      uint64_t hcr_el2)
683 {
684     CPUARMState *env = cpu_env(cs);
685     bool pstate_unmasked;
686     bool unmasked = false;
687     bool allIntMask = false;
688 
689     /*
690      * Don't take exceptions if they target a lower EL.
691      * This check should catch any exceptions that would not be taken
692      * but left pending.
693      */
694     if (cur_el > target_el) {
695         return false;
696     }
697 
698     if (cpu_isar_feature(aa64_nmi, env_archcpu(env)) &&
699         env->cp15.sctlr_el[target_el] & SCTLR_NMI && cur_el == target_el) {
700         allIntMask = env->pstate & PSTATE_ALLINT ||
701                      ((env->cp15.sctlr_el[target_el] & SCTLR_SPINTMASK) &&
702                       (env->pstate & PSTATE_SP));
703     }
704 
705     switch (excp_idx) {
706     case EXCP_NMI:
707         pstate_unmasked = !allIntMask;
708         break;
709 
710     case EXCP_VINMI:
711         if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
712             /* VINMIs are only taken when hypervized.  */
713             return false;
714         }
715         return !allIntMask;
716     case EXCP_VFNMI:
717         if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
718             /* VFNMIs are only taken when hypervized.  */
719             return false;
720         }
721         return !allIntMask;
722     case EXCP_FIQ:
723         pstate_unmasked = (!(env->daif & PSTATE_F)) && (!allIntMask);
724         break;
725 
726     case EXCP_IRQ:
727         pstate_unmasked = (!(env->daif & PSTATE_I)) && (!allIntMask);
728         break;
729 
730     case EXCP_VFIQ:
731         if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
732             /* VFIQs are only taken when hypervized.  */
733             return false;
734         }
735         return !(env->daif & PSTATE_F) && (!allIntMask);
736     case EXCP_VIRQ:
737         if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
738             /* VIRQs are only taken when hypervized.  */
739             return false;
740         }
741         return !(env->daif & PSTATE_I) && (!allIntMask);
742     case EXCP_VSERR:
743         if (!(hcr_el2 & HCR_AMO) || (hcr_el2 & HCR_TGE)) {
744             /* VIRQs are only taken when hypervized.  */
745             return false;
746         }
747         return !(env->daif & PSTATE_A);
748     default:
749         g_assert_not_reached();
750     }
751 
752     /*
753      * Use the target EL, current execution state and SCR/HCR settings to
754      * determine whether the corresponding CPSR bit is used to mask the
755      * interrupt.
756      */
757     if ((target_el > cur_el) && (target_el != 1)) {
758         /* Exceptions targeting a higher EL may not be maskable */
759         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
760             switch (target_el) {
761             case 2:
762                 /*
763                  * According to ARM DDI 0487H.a, an interrupt can be masked
764                  * when HCR_E2H and HCR_TGE are both set regardless of the
765                  * current Security state. Note that we need to revisit this
766                  * part again once we need to support NMI.
767                  */
768                 if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
769                         unmasked = true;
770                 }
771                 break;
772             case 3:
773                 /* Interrupt cannot be masked when the target EL is 3 */
774                 unmasked = true;
775                 break;
776             default:
777                 g_assert_not_reached();
778             }
779         } else {
780             /*
781              * The old 32-bit-only environment has a more complicated
782              * masking setup. HCR and SCR bits not only affect interrupt
783              * routing but also change the behaviour of masking.
784              */
785             bool hcr, scr;
786 
787             switch (excp_idx) {
788             case EXCP_FIQ:
789                 /*
790                  * If FIQs are routed to EL3 or EL2 then there are cases where
791                  * we override the CPSR.F in determining if the exception is
792                  * masked or not. If neither of these are set then we fall back
793                  * to the CPSR.F setting otherwise we further assess the state
794                  * below.
795                  */
796                 hcr = hcr_el2 & HCR_FMO;
797                 scr = (env->cp15.scr_el3 & SCR_FIQ);
798 
799                 /*
800                  * When EL3 is 32-bit, the SCR.FW bit controls whether the
801                  * CPSR.F bit masks FIQ interrupts when taken in non-secure
802                  * state. If SCR.FW is set then FIQs can be masked by CPSR.F
803                  * when non-secure but only when FIQs are only routed to EL3.
804                  */
805                 scr = scr && !((env->cp15.scr_el3 & SCR_FW) && !hcr);
806                 break;
807             case EXCP_IRQ:
808                 /*
809                  * When EL3 execution state is 32-bit, if HCR.IMO is set then
810                  * we may override the CPSR.I masking when in non-secure state.
811                  * The SCR.IRQ setting has already been taken into consideration
812                  * when setting the target EL, so it does not have a further
813                  * affect here.
814                  */
815                 hcr = hcr_el2 & HCR_IMO;
816                 scr = false;
817                 break;
818             default:
819                 g_assert_not_reached();
820             }
821 
822             if ((scr || hcr) && !secure) {
823                 unmasked = true;
824             }
825         }
826     }
827 
828     /*
829      * The PSTATE bits only mask the interrupt if we have not overridden the
830      * ability above.
831      */
832     return unmasked || pstate_unmasked;
833 }
834 
835 static bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
836 {
837     CPUARMState *env = cpu_env(cs);
838     uint32_t cur_el = arm_current_el(env);
839     bool secure = arm_is_secure(env);
840     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
841     uint32_t target_el;
842     uint32_t excp_idx;
843 
844     /* The prioritization of interrupts is IMPLEMENTATION DEFINED. */
845 
846     if (cpu_isar_feature(aa64_nmi, env_archcpu(env)) &&
847         (arm_sctlr(env, cur_el) & SCTLR_NMI)) {
848         if (interrupt_request & CPU_INTERRUPT_NMI) {
849             excp_idx = EXCP_NMI;
850             target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
851             if (arm_excp_unmasked(cs, excp_idx, target_el,
852                                   cur_el, secure, hcr_el2)) {
853                 goto found;
854             }
855         }
856         if (interrupt_request & CPU_INTERRUPT_VINMI) {
857             excp_idx = EXCP_VINMI;
858             target_el = 1;
859             if (arm_excp_unmasked(cs, excp_idx, target_el,
860                                   cur_el, secure, hcr_el2)) {
861                 goto found;
862             }
863         }
864         if (interrupt_request & CPU_INTERRUPT_VFNMI) {
865             excp_idx = EXCP_VFNMI;
866             target_el = 1;
867             if (arm_excp_unmasked(cs, excp_idx, target_el,
868                                   cur_el, secure, hcr_el2)) {
869                 goto found;
870             }
871         }
872     } else {
873         /*
874          * NMI disabled: interrupts with superpriority are handled
875          * as if they didn't have it
876          */
877         if (interrupt_request & CPU_INTERRUPT_NMI) {
878             interrupt_request |= CPU_INTERRUPT_HARD;
879         }
880         if (interrupt_request & CPU_INTERRUPT_VINMI) {
881             interrupt_request |= CPU_INTERRUPT_VIRQ;
882         }
883         if (interrupt_request & CPU_INTERRUPT_VFNMI) {
884             interrupt_request |= CPU_INTERRUPT_VFIQ;
885         }
886     }
887 
888     if (interrupt_request & CPU_INTERRUPT_FIQ) {
889         excp_idx = EXCP_FIQ;
890         target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
891         if (arm_excp_unmasked(cs, excp_idx, target_el,
892                               cur_el, secure, hcr_el2)) {
893             goto found;
894         }
895     }
896     if (interrupt_request & CPU_INTERRUPT_HARD) {
897         excp_idx = EXCP_IRQ;
898         target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
899         if (arm_excp_unmasked(cs, excp_idx, target_el,
900                               cur_el, secure, hcr_el2)) {
901             goto found;
902         }
903     }
904     if (interrupt_request & CPU_INTERRUPT_VIRQ) {
905         excp_idx = EXCP_VIRQ;
906         target_el = 1;
907         if (arm_excp_unmasked(cs, excp_idx, target_el,
908                               cur_el, secure, hcr_el2)) {
909             goto found;
910         }
911     }
912     if (interrupt_request & CPU_INTERRUPT_VFIQ) {
913         excp_idx = EXCP_VFIQ;
914         target_el = 1;
915         if (arm_excp_unmasked(cs, excp_idx, target_el,
916                               cur_el, secure, hcr_el2)) {
917             goto found;
918         }
919     }
920     if (interrupt_request & CPU_INTERRUPT_VSERR) {
921         excp_idx = EXCP_VSERR;
922         target_el = 1;
923         if (arm_excp_unmasked(cs, excp_idx, target_el,
924                               cur_el, secure, hcr_el2)) {
925             /* Taking a virtual abort clears HCR_EL2.VSE */
926             env->cp15.hcr_el2 &= ~HCR_VSE;
927             cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
928             goto found;
929         }
930     }
931     return false;
932 
933  found:
934     cs->exception_index = excp_idx;
935     env->exception.target_el = target_el;
936     cs->cc->tcg_ops->do_interrupt(cs);
937     return true;
938 }
939 
940 #endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
941 
942 void arm_cpu_update_virq(ARMCPU *cpu)
943 {
944     /*
945      * Update the interrupt level for VIRQ, which is the logical OR of
946      * the HCR_EL2.VI bit and the input line level from the GIC.
947      */
948     CPUARMState *env = &cpu->env;
949     CPUState *cs = CPU(cpu);
950 
951     bool new_state = ((arm_hcr_el2_eff(env) & HCR_VI) &&
952         !(arm_hcrx_el2_eff(env) & HCRX_VINMI)) ||
953         (env->irq_line_state & CPU_INTERRUPT_VIRQ);
954 
955     if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VIRQ) != 0)) {
956         if (new_state) {
957             cpu_interrupt(cs, CPU_INTERRUPT_VIRQ);
958         } else {
959             cpu_reset_interrupt(cs, CPU_INTERRUPT_VIRQ);
960         }
961     }
962 }
963 
964 void arm_cpu_update_vfiq(ARMCPU *cpu)
965 {
966     /*
967      * Update the interrupt level for VFIQ, which is the logical OR of
968      * the HCR_EL2.VF bit and the input line level from the GIC.
969      */
970     CPUARMState *env = &cpu->env;
971     CPUState *cs = CPU(cpu);
972 
973     bool new_state = ((arm_hcr_el2_eff(env) & HCR_VF) &&
974         !(arm_hcrx_el2_eff(env) & HCRX_VFNMI)) ||
975         (env->irq_line_state & CPU_INTERRUPT_VFIQ);
976 
977     if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VFIQ) != 0)) {
978         if (new_state) {
979             cpu_interrupt(cs, CPU_INTERRUPT_VFIQ);
980         } else {
981             cpu_reset_interrupt(cs, CPU_INTERRUPT_VFIQ);
982         }
983     }
984 }
985 
986 void arm_cpu_update_vinmi(ARMCPU *cpu)
987 {
988     /*
989      * Update the interrupt level for VINMI, which is the logical OR of
990      * the HCRX_EL2.VINMI bit and the input line level from the GIC.
991      */
992     CPUARMState *env = &cpu->env;
993     CPUState *cs = CPU(cpu);
994 
995     bool new_state = ((arm_hcr_el2_eff(env) & HCR_VI) &&
996                       (arm_hcrx_el2_eff(env) & HCRX_VINMI)) ||
997         (env->irq_line_state & CPU_INTERRUPT_VINMI);
998 
999     if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VINMI) != 0)) {
1000         if (new_state) {
1001             cpu_interrupt(cs, CPU_INTERRUPT_VINMI);
1002         } else {
1003             cpu_reset_interrupt(cs, CPU_INTERRUPT_VINMI);
1004         }
1005     }
1006 }
1007 
1008 void arm_cpu_update_vfnmi(ARMCPU *cpu)
1009 {
1010     /*
1011      * Update the interrupt level for VFNMI, which is the HCRX_EL2.VFNMI bit.
1012      */
1013     CPUARMState *env = &cpu->env;
1014     CPUState *cs = CPU(cpu);
1015 
1016     bool new_state = (arm_hcr_el2_eff(env) & HCR_VF) &&
1017                       (arm_hcrx_el2_eff(env) & HCRX_VFNMI);
1018 
1019     if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VFNMI) != 0)) {
1020         if (new_state) {
1021             cpu_interrupt(cs, CPU_INTERRUPT_VFNMI);
1022         } else {
1023             cpu_reset_interrupt(cs, CPU_INTERRUPT_VFNMI);
1024         }
1025     }
1026 }
1027 
1028 void arm_cpu_update_vserr(ARMCPU *cpu)
1029 {
1030     /*
1031      * Update the interrupt level for VSERR, which is the HCR_EL2.VSE bit.
1032      */
1033     CPUARMState *env = &cpu->env;
1034     CPUState *cs = CPU(cpu);
1035 
1036     bool new_state = env->cp15.hcr_el2 & HCR_VSE;
1037 
1038     if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VSERR) != 0)) {
1039         if (new_state) {
1040             cpu_interrupt(cs, CPU_INTERRUPT_VSERR);
1041         } else {
1042             cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
1043         }
1044     }
1045 }
1046 
1047 #ifndef CONFIG_USER_ONLY
1048 static void arm_cpu_set_irq(void *opaque, int irq, int level)
1049 {
1050     ARMCPU *cpu = opaque;
1051     CPUARMState *env = &cpu->env;
1052     CPUState *cs = CPU(cpu);
1053     static const int mask[] = {
1054         [ARM_CPU_IRQ] = CPU_INTERRUPT_HARD,
1055         [ARM_CPU_FIQ] = CPU_INTERRUPT_FIQ,
1056         [ARM_CPU_VIRQ] = CPU_INTERRUPT_VIRQ,
1057         [ARM_CPU_VFIQ] = CPU_INTERRUPT_VFIQ,
1058         [ARM_CPU_NMI] = CPU_INTERRUPT_NMI,
1059         [ARM_CPU_VINMI] = CPU_INTERRUPT_VINMI,
1060     };
1061 
1062     if (!arm_feature(env, ARM_FEATURE_EL2) &&
1063         (irq == ARM_CPU_VIRQ || irq == ARM_CPU_VFIQ)) {
1064         /*
1065          * The GIC might tell us about VIRQ and VFIQ state, but if we don't
1066          * have EL2 support we don't care. (Unless the guest is doing something
1067          * silly this will only be calls saying "level is still 0".)
1068          */
1069         return;
1070     }
1071 
1072     if (level) {
1073         env->irq_line_state |= mask[irq];
1074     } else {
1075         env->irq_line_state &= ~mask[irq];
1076     }
1077 
1078     switch (irq) {
1079     case ARM_CPU_VIRQ:
1080         arm_cpu_update_virq(cpu);
1081         break;
1082     case ARM_CPU_VFIQ:
1083         arm_cpu_update_vfiq(cpu);
1084         break;
1085     case ARM_CPU_VINMI:
1086         arm_cpu_update_vinmi(cpu);
1087         break;
1088     case ARM_CPU_IRQ:
1089     case ARM_CPU_FIQ:
1090     case ARM_CPU_NMI:
1091         if (level) {
1092             cpu_interrupt(cs, mask[irq]);
1093         } else {
1094             cpu_reset_interrupt(cs, mask[irq]);
1095         }
1096         break;
1097     default:
1098         g_assert_not_reached();
1099     }
1100 }
1101 
1102 static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
1103 {
1104 #ifdef CONFIG_KVM
1105     ARMCPU *cpu = opaque;
1106     CPUARMState *env = &cpu->env;
1107     CPUState *cs = CPU(cpu);
1108     uint32_t linestate_bit;
1109     int irq_id;
1110 
1111     switch (irq) {
1112     case ARM_CPU_IRQ:
1113         irq_id = KVM_ARM_IRQ_CPU_IRQ;
1114         linestate_bit = CPU_INTERRUPT_HARD;
1115         break;
1116     case ARM_CPU_FIQ:
1117         irq_id = KVM_ARM_IRQ_CPU_FIQ;
1118         linestate_bit = CPU_INTERRUPT_FIQ;
1119         break;
1120     default:
1121         g_assert_not_reached();
1122     }
1123 
1124     if (level) {
1125         env->irq_line_state |= linestate_bit;
1126     } else {
1127         env->irq_line_state &= ~linestate_bit;
1128     }
1129     kvm_arm_set_irq(cs->cpu_index, KVM_ARM_IRQ_TYPE_CPU, irq_id, !!level);
1130 #endif
1131 }
1132 
1133 static bool arm_cpu_virtio_is_big_endian(CPUState *cs)
1134 {
1135     ARMCPU *cpu = ARM_CPU(cs);
1136     CPUARMState *env = &cpu->env;
1137 
1138     cpu_synchronize_state(cs);
1139     return arm_cpu_data_is_big_endian(env);
1140 }
1141 
1142 #ifdef CONFIG_TCG
1143 bool arm_cpu_exec_halt(CPUState *cs)
1144 {
1145     bool leave_halt = cpu_has_work(cs);
1146 
1147     if (leave_halt) {
1148         /* We're about to come out of WFI/WFE: disable the WFxT timer */
1149         ARMCPU *cpu = ARM_CPU(cs);
1150         if (cpu->wfxt_timer) {
1151             timer_del(cpu->wfxt_timer);
1152         }
1153     }
1154     return leave_halt;
1155 }
1156 #endif
1157 
1158 static void arm_wfxt_timer_cb(void *opaque)
1159 {
1160     ARMCPU *cpu = opaque;
1161     CPUState *cs = CPU(cpu);
1162 
1163     /*
1164      * We expect the CPU to be halted; this will cause arm_cpu_is_work()
1165      * to return true (so we will come out of halt even with no other
1166      * pending interrupt), and the TCG accelerator's cpu_exec_interrupt()
1167      * function auto-clears the CPU_INTERRUPT_EXITTB flag for us.
1168      */
1169     cpu_interrupt(cs, CPU_INTERRUPT_EXITTB);
1170 }
1171 #endif
1172 
1173 static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)
1174 {
1175     ARMCPU *ac = ARM_CPU(cpu);
1176     CPUARMState *env = &ac->env;
1177     bool sctlr_b = arm_sctlr_b(env);
1178 
1179     if (is_a64(env)) {
1180         info->cap_arch = CS_ARCH_ARM64;
1181         info->cap_insn_unit = 4;
1182         info->cap_insn_split = 4;
1183     } else {
1184         int cap_mode;
1185         if (env->thumb) {
1186             info->cap_insn_unit = 2;
1187             info->cap_insn_split = 4;
1188             cap_mode = CS_MODE_THUMB;
1189         } else {
1190             info->cap_insn_unit = 4;
1191             info->cap_insn_split = 4;
1192             cap_mode = CS_MODE_ARM;
1193         }
1194         if (arm_feature(env, ARM_FEATURE_V8)) {
1195             cap_mode |= CS_MODE_V8;
1196         }
1197         if (arm_feature(env, ARM_FEATURE_M)) {
1198             cap_mode |= CS_MODE_MCLASS;
1199         }
1200         info->cap_arch = CS_ARCH_ARM;
1201         info->cap_mode = cap_mode;
1202     }
1203 
1204     info->endian = BFD_ENDIAN_LITTLE;
1205     if (bswap_code(sctlr_b)) {
1206         info->endian = TARGET_BIG_ENDIAN ? BFD_ENDIAN_LITTLE : BFD_ENDIAN_BIG;
1207     }
1208     info->flags &= ~INSN_ARM_BE32;
1209 #ifndef CONFIG_USER_ONLY
1210     if (sctlr_b) {
1211         info->flags |= INSN_ARM_BE32;
1212     }
1213 #endif
1214 }
1215 
1216 #ifdef TARGET_AARCH64
1217 
1218 static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
1219 {
1220     ARMCPU *cpu = ARM_CPU(cs);
1221     CPUARMState *env = &cpu->env;
1222     uint32_t psr = pstate_read(env);
1223     int i, j;
1224     int el = arm_current_el(env);
1225     uint64_t hcr = arm_hcr_el2_eff(env);
1226     const char *ns_status;
1227     bool sve;
1228 
1229     qemu_fprintf(f, " PC=%016" PRIx64 " ", env->pc);
1230     for (i = 0; i < 32; i++) {
1231         if (i == 31) {
1232             qemu_fprintf(f, " SP=%016" PRIx64 "\n", env->xregs[i]);
1233         } else {
1234             qemu_fprintf(f, "X%02d=%016" PRIx64 "%s", i, env->xregs[i],
1235                          (i + 2) % 3 ? " " : "\n");
1236         }
1237     }
1238 
1239     if (arm_feature(env, ARM_FEATURE_EL3) && el != 3) {
1240         ns_status = env->cp15.scr_el3 & SCR_NS ? "NS " : "S ";
1241     } else {
1242         ns_status = "";
1243     }
1244     qemu_fprintf(f, "PSTATE=%08x %c%c%c%c %sEL%d%c",
1245                  psr,
1246                  psr & PSTATE_N ? 'N' : '-',
1247                  psr & PSTATE_Z ? 'Z' : '-',
1248                  psr & PSTATE_C ? 'C' : '-',
1249                  psr & PSTATE_V ? 'V' : '-',
1250                  ns_status,
1251                  el,
1252                  psr & PSTATE_SP ? 'h' : 't');
1253 
1254     if (cpu_isar_feature(aa64_sme, cpu)) {
1255         qemu_fprintf(f, "  SVCR=%08" PRIx64 " %c%c",
1256                      env->svcr,
1257                      (FIELD_EX64(env->svcr, SVCR, ZA) ? 'Z' : '-'),
1258                      (FIELD_EX64(env->svcr, SVCR, SM) ? 'S' : '-'));
1259     }
1260     if (cpu_isar_feature(aa64_bti, cpu)) {
1261         qemu_fprintf(f, "  BTYPE=%d", (psr & PSTATE_BTYPE) >> 10);
1262     }
1263     qemu_fprintf(f, "%s%s%s",
1264                  (hcr & HCR_NV) ? " NV" : "",
1265                  (hcr & HCR_NV1) ? " NV1" : "",
1266                  (hcr & HCR_NV2) ? " NV2" : "");
1267     if (!(flags & CPU_DUMP_FPU)) {
1268         qemu_fprintf(f, "\n");
1269         return;
1270     }
1271     if (fp_exception_el(env, el) != 0) {
1272         qemu_fprintf(f, "    FPU disabled\n");
1273         return;
1274     }
1275     qemu_fprintf(f, "     FPCR=%08x FPSR=%08x\n",
1276                  vfp_get_fpcr(env), vfp_get_fpsr(env));
1277 
1278     if (cpu_isar_feature(aa64_sme, cpu) && FIELD_EX64(env->svcr, SVCR, SM)) {
1279         sve = sme_exception_el(env, el) == 0;
1280     } else if (cpu_isar_feature(aa64_sve, cpu)) {
1281         sve = sve_exception_el(env, el) == 0;
1282     } else {
1283         sve = false;
1284     }
1285 
1286     if (sve) {
1287         int zcr_len = sve_vqm1_for_el(env, el);
1288 
1289         for (i = 0; i <= FFR_PRED_NUM; i++) {
1290             bool eol;
1291             if (i == FFR_PRED_NUM) {
1292                 qemu_fprintf(f, "FFR=");
1293                 /* It's last, so end the line.  */
1294                 eol = true;
1295             } else {
1296                 qemu_fprintf(f, "P%02d=", i);
1297                 switch (zcr_len) {
1298                 case 0:
1299                     eol = i % 8 == 7;
1300                     break;
1301                 case 1:
1302                     eol = i % 6 == 5;
1303                     break;
1304                 case 2:
1305                 case 3:
1306                     eol = i % 3 == 2;
1307                     break;
1308                 default:
1309                     /* More than one quadword per predicate.  */
1310                     eol = true;
1311                     break;
1312                 }
1313             }
1314             for (j = zcr_len / 4; j >= 0; j--) {
1315                 int digits;
1316                 if (j * 4 + 4 <= zcr_len + 1) {
1317                     digits = 16;
1318                 } else {
1319                     digits = (zcr_len % 4 + 1) * 4;
1320                 }
1321                 qemu_fprintf(f, "%0*" PRIx64 "%s", digits,
1322                              env->vfp.pregs[i].p[j],
1323                              j ? ":" : eol ? "\n" : " ");
1324             }
1325         }
1326 
1327         if (zcr_len == 0) {
1328             /*
1329              * With vl=16, there are only 37 columns per register,
1330              * so output two registers per line.
1331              */
1332             for (i = 0; i < 32; i++) {
1333                 qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64 "%s",
1334                              i, env->vfp.zregs[i].d[1],
1335                              env->vfp.zregs[i].d[0], i & 1 ? "\n" : " ");
1336             }
1337         } else {
1338             for (i = 0; i < 32; i++) {
1339                 qemu_fprintf(f, "Z%02d=", i);
1340                 for (j = zcr_len; j >= 0; j--) {
1341                     qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%s",
1342                                  env->vfp.zregs[i].d[j * 2 + 1],
1343                                  env->vfp.zregs[i].d[j * 2 + 0],
1344                                  j ? ":" : "\n");
1345                 }
1346             }
1347         }
1348     } else {
1349         for (i = 0; i < 32; i++) {
1350             uint64_t *q = aa64_vfp_qreg(env, i);
1351             qemu_fprintf(f, "Q%02d=%016" PRIx64 ":%016" PRIx64 "%s",
1352                          i, q[1], q[0], (i & 1 ? "\n" : " "));
1353         }
1354     }
1355 
1356     if (cpu_isar_feature(aa64_sme, cpu) &&
1357         FIELD_EX64(env->svcr, SVCR, ZA) &&
1358         sme_exception_el(env, el) == 0) {
1359         int zcr_len = sve_vqm1_for_el_sm(env, el, true);
1360         int svl = (zcr_len + 1) * 16;
1361         int svl_lg10 = svl < 100 ? 2 : 3;
1362 
1363         for (i = 0; i < svl; i++) {
1364             qemu_fprintf(f, "ZA[%0*d]=", svl_lg10, i);
1365             for (j = zcr_len; j >= 0; --j) {
1366                 qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%c",
1367                              env->zarray[i].d[2 * j + 1],
1368                              env->zarray[i].d[2 * j],
1369                              j ? ':' : '\n');
1370             }
1371         }
1372     }
1373 }
1374 
1375 #else
1376 
1377 static inline void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
1378 {
1379     g_assert_not_reached();
1380 }
1381 
1382 #endif
1383 
1384 static void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
1385 {
1386     ARMCPU *cpu = ARM_CPU(cs);
1387     CPUARMState *env = &cpu->env;
1388     int i;
1389 
1390     if (is_a64(env)) {
1391         aarch64_cpu_dump_state(cs, f, flags);
1392         return;
1393     }
1394 
1395     for (i = 0; i < 16; i++) {
1396         qemu_fprintf(f, "R%02d=%08x", i, env->regs[i]);
1397         if ((i % 4) == 3) {
1398             qemu_fprintf(f, "\n");
1399         } else {
1400             qemu_fprintf(f, " ");
1401         }
1402     }
1403 
1404     if (arm_feature(env, ARM_FEATURE_M)) {
1405         uint32_t xpsr = xpsr_read(env);
1406         const char *mode;
1407         const char *ns_status = "";
1408 
1409         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
1410             ns_status = env->v7m.secure ? "S " : "NS ";
1411         }
1412 
1413         if (xpsr & XPSR_EXCP) {
1414             mode = "handler";
1415         } else {
1416             if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_NPRIV_MASK) {
1417                 mode = "unpriv-thread";
1418             } else {
1419                 mode = "priv-thread";
1420             }
1421         }
1422 
1423         qemu_fprintf(f, "XPSR=%08x %c%c%c%c %c %s%s\n",
1424                      xpsr,
1425                      xpsr & XPSR_N ? 'N' : '-',
1426                      xpsr & XPSR_Z ? 'Z' : '-',
1427                      xpsr & XPSR_C ? 'C' : '-',
1428                      xpsr & XPSR_V ? 'V' : '-',
1429                      xpsr & XPSR_T ? 'T' : 'A',
1430                      ns_status,
1431                      mode);
1432     } else {
1433         uint32_t psr = cpsr_read(env);
1434         const char *ns_status = "";
1435 
1436         if (arm_feature(env, ARM_FEATURE_EL3) &&
1437             (psr & CPSR_M) != ARM_CPU_MODE_MON) {
1438             ns_status = env->cp15.scr_el3 & SCR_NS ? "NS " : "S ";
1439         }
1440 
1441         qemu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%s%d\n",
1442                      psr,
1443                      psr & CPSR_N ? 'N' : '-',
1444                      psr & CPSR_Z ? 'Z' : '-',
1445                      psr & CPSR_C ? 'C' : '-',
1446                      psr & CPSR_V ? 'V' : '-',
1447                      psr & CPSR_T ? 'T' : 'A',
1448                      ns_status,
1449                      aarch32_mode_name(psr), (psr & 0x10) ? 32 : 26);
1450     }
1451 
1452     if (flags & CPU_DUMP_FPU) {
1453         int numvfpregs = 0;
1454         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
1455             numvfpregs = 32;
1456         } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
1457             numvfpregs = 16;
1458         }
1459         for (i = 0; i < numvfpregs; i++) {
1460             uint64_t v = *aa32_vfp_dreg(env, i);
1461             qemu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
1462                          i * 2, (uint32_t)v,
1463                          i * 2 + 1, (uint32_t)(v >> 32),
1464                          i, v);
1465         }
1466         qemu_fprintf(f, "FPSCR: %08x\n", vfp_get_fpscr(env));
1467         if (cpu_isar_feature(aa32_mve, cpu)) {
1468             qemu_fprintf(f, "VPR: %08x\n", env->v7m.vpr);
1469         }
1470     }
1471 }
1472 
1473 uint64_t arm_build_mp_affinity(int idx, uint8_t clustersz)
1474 {
1475     uint32_t Aff1 = idx / clustersz;
1476     uint32_t Aff0 = idx % clustersz;
1477     return (Aff1 << ARM_AFF1_SHIFT) | Aff0;
1478 }
1479 
1480 uint64_t arm_cpu_mp_affinity(ARMCPU *cpu)
1481 {
1482     return cpu->mp_affinity;
1483 }
1484 
1485 static void arm_cpu_initfn(Object *obj)
1486 {
1487     ARMCPU *cpu = ARM_CPU(obj);
1488 
1489     cpu->cp_regs = g_hash_table_new_full(g_direct_hash, g_direct_equal,
1490                                          NULL, g_free);
1491 
1492     QLIST_INIT(&cpu->pre_el_change_hooks);
1493     QLIST_INIT(&cpu->el_change_hooks);
1494 
1495 #ifdef CONFIG_USER_ONLY
1496 # ifdef TARGET_AARCH64
1497     /*
1498      * The linux kernel defaults to 512-bit for SVE, and 256-bit for SME.
1499      * These values were chosen to fit within the default signal frame.
1500      * See documentation for /proc/sys/abi/{sve,sme}_default_vector_length,
1501      * and our corresponding cpu property.
1502      */
1503     cpu->sve_default_vq = 4;
1504     cpu->sme_default_vq = 2;
1505 # endif
1506 #else
1507     /* Our inbound IRQ and FIQ lines */
1508     if (kvm_enabled()) {
1509         /*
1510          * VIRQ, VFIQ, NMI, VINMI are unused with KVM but we add
1511          * them to maintain the same interface as non-KVM CPUs.
1512          */
1513         qdev_init_gpio_in(DEVICE(cpu), arm_cpu_kvm_set_irq, 6);
1514     } else {
1515         qdev_init_gpio_in(DEVICE(cpu), arm_cpu_set_irq, 6);
1516     }
1517 
1518     qdev_init_gpio_out(DEVICE(cpu), cpu->gt_timer_outputs,
1519                        ARRAY_SIZE(cpu->gt_timer_outputs));
1520 
1521     qdev_init_gpio_out_named(DEVICE(cpu), &cpu->gicv3_maintenance_interrupt,
1522                              "gicv3-maintenance-interrupt", 1);
1523     qdev_init_gpio_out_named(DEVICE(cpu), &cpu->pmu_interrupt,
1524                              "pmu-interrupt", 1);
1525 #endif
1526 
1527     /* DTB consumers generally don't in fact care what the 'compatible'
1528      * string is, so always provide some string and trust that a hypothetical
1529      * picky DTB consumer will also provide a helpful error message.
1530      */
1531     cpu->dtb_compatible = "qemu,unknown";
1532     cpu->psci_version = QEMU_PSCI_VERSION_0_1; /* By default assume PSCI v0.1 */
1533     cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
1534 
1535     if (tcg_enabled() || hvf_enabled()) {
1536         /* TCG and HVF implement PSCI 1.1 */
1537         cpu->psci_version = QEMU_PSCI_VERSION_1_1;
1538     }
1539 }
1540 
1541 /*
1542  * 0 means "unset, use the default value". That default might vary depending
1543  * on the CPU type, and is set in the realize fn.
1544  */
1545 static const Property arm_cpu_gt_cntfrq_property =
1546             DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz, 0);
1547 
1548 static const Property arm_cpu_reset_cbar_property =
1549             DEFINE_PROP_UINT64("reset-cbar", ARMCPU, reset_cbar, 0);
1550 
1551 static const Property arm_cpu_reset_hivecs_property =
1552             DEFINE_PROP_BOOL("reset-hivecs", ARMCPU, reset_hivecs, false);
1553 
1554 #ifndef CONFIG_USER_ONLY
1555 static const Property arm_cpu_has_el2_property =
1556             DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);
1557 
1558 static const Property arm_cpu_has_el3_property =
1559             DEFINE_PROP_BOOL("has_el3", ARMCPU, has_el3, true);
1560 #endif
1561 
1562 static const Property arm_cpu_cfgend_property =
1563             DEFINE_PROP_BOOL("cfgend", ARMCPU, cfgend, false);
1564 
1565 static const Property arm_cpu_has_vfp_property =
1566             DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
1567 
1568 static const Property arm_cpu_has_vfp_d32_property =
1569             DEFINE_PROP_BOOL("vfp-d32", ARMCPU, has_vfp_d32, true);
1570 
1571 static const Property arm_cpu_has_neon_property =
1572             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
1573 
1574 static const Property arm_cpu_has_dsp_property =
1575             DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
1576 
1577 static const Property arm_cpu_has_mpu_property =
1578             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
1579 
1580 /* This is like DEFINE_PROP_UINT32 but it doesn't set the default value,
1581  * because the CPU initfn will have already set cpu->pmsav7_dregion to
1582  * the right value for that particular CPU type, and we don't want
1583  * to override that with an incorrect constant value.
1584  */
1585 static const Property arm_cpu_pmsav7_dregion_property =
1586             DEFINE_PROP_UNSIGNED_NODEFAULT("pmsav7-dregion", ARMCPU,
1587                                            pmsav7_dregion,
1588                                            qdev_prop_uint32, uint32_t);
1589 
1590 static bool arm_get_pmu(Object *obj, Error **errp)
1591 {
1592     ARMCPU *cpu = ARM_CPU(obj);
1593 
1594     return cpu->has_pmu;
1595 }
1596 
1597 static void arm_set_pmu(Object *obj, bool value, Error **errp)
1598 {
1599     ARMCPU *cpu = ARM_CPU(obj);
1600 
1601     if (value) {
1602         if (kvm_enabled() && !kvm_arm_pmu_supported()) {
1603             error_setg(errp, "'pmu' feature not supported by KVM on this host");
1604             return;
1605         }
1606         set_feature(&cpu->env, ARM_FEATURE_PMU);
1607     } else {
1608         unset_feature(&cpu->env, ARM_FEATURE_PMU);
1609     }
1610     cpu->has_pmu = value;
1611 }
1612 
1613 unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
1614 {
1615     /*
1616      * The exact approach to calculating guest ticks is:
1617      *
1618      *     muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), cpu->gt_cntfrq_hz,
1619      *              NANOSECONDS_PER_SECOND);
1620      *
1621      * We don't do that. Rather we intentionally use integer division
1622      * truncation below and in the caller for the conversion of host monotonic
1623      * time to guest ticks to provide the exact inverse for the semantics of
1624      * the QEMUTimer scale factor. QEMUTimer's scale facter is an integer, so
1625      * it loses precision when representing frequencies where
1626      * `(NANOSECONDS_PER_SECOND % cpu->gt_cntfrq) > 0` holds. Failing to
1627      * provide an exact inverse leads to scheduling timers with negative
1628      * periods, which in turn leads to sticky behaviour in the guest.
1629      *
1630      * Finally, CNTFRQ is effectively capped at 1GHz to ensure our scale factor
1631      * cannot become zero.
1632      */
1633     return NANOSECONDS_PER_SECOND > cpu->gt_cntfrq_hz ?
1634       NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
1635 }
1636 
1637 static void arm_cpu_propagate_feature_implications(ARMCPU *cpu)
1638 {
1639     CPUARMState *env = &cpu->env;
1640     bool no_aa32 = false;
1641 
1642     /*
1643      * Some features automatically imply others: set the feature
1644      * bits explicitly for these cases.
1645      */
1646 
1647     if (arm_feature(env, ARM_FEATURE_M)) {
1648         set_feature(env, ARM_FEATURE_PMSA);
1649     }
1650 
1651     if (arm_feature(env, ARM_FEATURE_V8)) {
1652         if (arm_feature(env, ARM_FEATURE_M)) {
1653             set_feature(env, ARM_FEATURE_V7);
1654         } else {
1655             set_feature(env, ARM_FEATURE_V7VE);
1656         }
1657     }
1658 
1659     /*
1660      * There exist AArch64 cpus without AArch32 support.  When KVM
1661      * queries ID_ISAR0_EL1 on such a host, the value is UNKNOWN.
1662      * Similarly, we cannot check ID_AA64PFR0 without AArch64 support.
1663      * As a general principle, we also do not make ID register
1664      * consistency checks anywhere unless using TCG, because only
1665      * for TCG would a consistency-check failure be a QEMU bug.
1666      */
1667     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1668         no_aa32 = !cpu_isar_feature(aa64_aa32, cpu);
1669     }
1670 
1671     if (arm_feature(env, ARM_FEATURE_V7VE)) {
1672         /*
1673          * v7 Virtualization Extensions. In real hardware this implies
1674          * EL2 and also the presence of the Security Extensions.
1675          * For QEMU, for backwards-compatibility we implement some
1676          * CPUs or CPU configs which have no actual EL2 or EL3 but do
1677          * include the various other features that V7VE implies.
1678          * Presence of EL2 itself is ARM_FEATURE_EL2, and of the
1679          * Security Extensions is ARM_FEATURE_EL3.
1680          */
1681         assert(!tcg_enabled() || no_aa32 ||
1682                cpu_isar_feature(aa32_arm_div, cpu));
1683         set_feature(env, ARM_FEATURE_LPAE);
1684         set_feature(env, ARM_FEATURE_V7);
1685     }
1686     if (arm_feature(env, ARM_FEATURE_V7)) {
1687         set_feature(env, ARM_FEATURE_VAPA);
1688         set_feature(env, ARM_FEATURE_THUMB2);
1689         set_feature(env, ARM_FEATURE_MPIDR);
1690         if (!arm_feature(env, ARM_FEATURE_M)) {
1691             set_feature(env, ARM_FEATURE_V6K);
1692         } else {
1693             set_feature(env, ARM_FEATURE_V6);
1694         }
1695 
1696         /*
1697          * Always define VBAR for V7 CPUs even if it doesn't exist in
1698          * non-EL3 configs. This is needed by some legacy boards.
1699          */
1700         set_feature(env, ARM_FEATURE_VBAR);
1701     }
1702     if (arm_feature(env, ARM_FEATURE_V6K)) {
1703         set_feature(env, ARM_FEATURE_V6);
1704         set_feature(env, ARM_FEATURE_MVFR);
1705     }
1706     if (arm_feature(env, ARM_FEATURE_V6)) {
1707         set_feature(env, ARM_FEATURE_V5);
1708         if (!arm_feature(env, ARM_FEATURE_M)) {
1709             assert(!tcg_enabled() || no_aa32 ||
1710                    cpu_isar_feature(aa32_jazelle, cpu));
1711             set_feature(env, ARM_FEATURE_AUXCR);
1712         }
1713     }
1714     if (arm_feature(env, ARM_FEATURE_V5)) {
1715         set_feature(env, ARM_FEATURE_V4T);
1716     }
1717     if (arm_feature(env, ARM_FEATURE_LPAE)) {
1718         set_feature(env, ARM_FEATURE_V7MP);
1719     }
1720     if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
1721         set_feature(env, ARM_FEATURE_CBAR);
1722     }
1723     if (arm_feature(env, ARM_FEATURE_THUMB2) &&
1724         !arm_feature(env, ARM_FEATURE_M)) {
1725         set_feature(env, ARM_FEATURE_THUMB_DSP);
1726     }
1727 }
1728 
1729 void arm_cpu_post_init(Object *obj)
1730 {
1731     ARMCPU *cpu = ARM_CPU(obj);
1732 
1733     /*
1734      * Some features imply others. Figure this out now, because we
1735      * are going to look at the feature bits in deciding which
1736      * properties to add.
1737      */
1738     arm_cpu_propagate_feature_implications(cpu);
1739 
1740     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
1741         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
1742         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property);
1743     }
1744 
1745     if (!arm_feature(&cpu->env, ARM_FEATURE_M)) {
1746         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_hivecs_property);
1747     }
1748 
1749     if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
1750         object_property_add_uint64_ptr(obj, "rvbar",
1751                                        &cpu->rvbar_prop,
1752                                        OBJ_PROP_FLAG_READWRITE);
1753     }
1754 
1755 #ifndef CONFIG_USER_ONLY
1756     if (arm_feature(&cpu->env, ARM_FEATURE_EL3)) {
1757         /* Add the has_el3 state CPU property only if EL3 is allowed.  This will
1758          * prevent "has_el3" from existing on CPUs which cannot support EL3.
1759          */
1760         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_el3_property);
1761 
1762         object_property_add_link(obj, "secure-memory",
1763                                  TYPE_MEMORY_REGION,
1764                                  (Object **)&cpu->secure_memory,
1765                                  qdev_prop_allow_set_link_before_realize,
1766                                  OBJ_PROP_LINK_STRONG);
1767     }
1768 
1769     if (arm_feature(&cpu->env, ARM_FEATURE_EL2)) {
1770         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_el2_property);
1771     }
1772 #endif
1773 
1774     if (arm_feature(&cpu->env, ARM_FEATURE_PMU)) {
1775         cpu->has_pmu = true;
1776         object_property_add_bool(obj, "pmu", arm_get_pmu, arm_set_pmu);
1777     }
1778 
1779     /*
1780      * Allow user to turn off VFP and Neon support, but only for TCG --
1781      * KVM does not currently allow us to lie to the guest about its
1782      * ID/feature registers, so the guest always sees what the host has.
1783      */
1784     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1785         if (cpu_isar_feature(aa64_fp_simd, cpu)) {
1786             cpu->has_vfp = true;
1787             cpu->has_vfp_d32 = true;
1788             if (tcg_enabled() || qtest_enabled()) {
1789                 qdev_property_add_static(DEVICE(obj),
1790                                          &arm_cpu_has_vfp_property);
1791             }
1792         }
1793     } else if (cpu_isar_feature(aa32_vfp, cpu)) {
1794         cpu->has_vfp = true;
1795         if (tcg_enabled() || qtest_enabled()) {
1796             qdev_property_add_static(DEVICE(obj),
1797                                      &arm_cpu_has_vfp_property);
1798         }
1799         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
1800             cpu->has_vfp_d32 = true;
1801             /*
1802              * The permitted values of the SIMDReg bits [3:0] on
1803              * Armv8-A are either 0b0000 and 0b0010. On such CPUs,
1804              * make sure that has_vfp_d32 can not be set to false.
1805              */
1806             if ((tcg_enabled() || qtest_enabled())
1807                 && !(arm_feature(&cpu->env, ARM_FEATURE_V8)
1808                      && !arm_feature(&cpu->env, ARM_FEATURE_M))) {
1809                 qdev_property_add_static(DEVICE(obj),
1810                                          &arm_cpu_has_vfp_d32_property);
1811             }
1812         }
1813     }
1814 
1815     if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
1816         cpu->has_neon = true;
1817         if (!kvm_enabled()) {
1818             qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property);
1819         }
1820     }
1821 
1822     if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
1823         arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
1824         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property);
1825     }
1826 
1827     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
1828         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property);
1829         if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
1830             qdev_property_add_static(DEVICE(obj),
1831                                      &arm_cpu_pmsav7_dregion_property);
1832         }
1833     }
1834 
1835     if (arm_feature(&cpu->env, ARM_FEATURE_M_SECURITY)) {
1836         object_property_add_link(obj, "idau", TYPE_IDAU_INTERFACE, &cpu->idau,
1837                                  qdev_prop_allow_set_link_before_realize,
1838                                  OBJ_PROP_LINK_STRONG);
1839         /*
1840          * M profile: initial value of the Secure VTOR. We can't just use
1841          * a simple DEFINE_PROP_UINT32 for this because we want to permit
1842          * the property to be set after realize.
1843          */
1844         object_property_add_uint32_ptr(obj, "init-svtor",
1845                                        &cpu->init_svtor,
1846                                        OBJ_PROP_FLAG_READWRITE);
1847     }
1848     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
1849         /*
1850          * Initial value of the NS VTOR (for cores without the Security
1851          * extension, this is the only VTOR)
1852          */
1853         object_property_add_uint32_ptr(obj, "init-nsvtor",
1854                                        &cpu->init_nsvtor,
1855                                        OBJ_PROP_FLAG_READWRITE);
1856     }
1857 
1858     /* Not DEFINE_PROP_UINT32: we want this to be settable after realize */
1859     object_property_add_uint32_ptr(obj, "psci-conduit",
1860                                    &cpu->psci_conduit,
1861                                    OBJ_PROP_FLAG_READWRITE);
1862 
1863     qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property);
1864 
1865     if (arm_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER)) {
1866         qdev_property_add_static(DEVICE(cpu), &arm_cpu_gt_cntfrq_property);
1867     }
1868 
1869     if (kvm_enabled()) {
1870         kvm_arm_add_vcpu_properties(cpu);
1871     }
1872 
1873 #ifndef CONFIG_USER_ONLY
1874     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) &&
1875         cpu_isar_feature(aa64_mte, cpu)) {
1876         object_property_add_link(obj, "tag-memory",
1877                                  TYPE_MEMORY_REGION,
1878                                  (Object **)&cpu->tag_memory,
1879                                  qdev_prop_allow_set_link_before_realize,
1880                                  OBJ_PROP_LINK_STRONG);
1881 
1882         if (arm_feature(&cpu->env, ARM_FEATURE_EL3)) {
1883             object_property_add_link(obj, "secure-tag-memory",
1884                                      TYPE_MEMORY_REGION,
1885                                      (Object **)&cpu->secure_tag_memory,
1886                                      qdev_prop_allow_set_link_before_realize,
1887                                      OBJ_PROP_LINK_STRONG);
1888         }
1889     }
1890 #endif
1891 }
1892 
1893 static void arm_cpu_finalizefn(Object *obj)
1894 {
1895     ARMCPU *cpu = ARM_CPU(obj);
1896     ARMELChangeHook *hook, *next;
1897 
1898     g_hash_table_destroy(cpu->cp_regs);
1899 
1900     QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
1901         QLIST_REMOVE(hook, node);
1902         g_free(hook);
1903     }
1904     QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
1905         QLIST_REMOVE(hook, node);
1906         g_free(hook);
1907     }
1908 #ifndef CONFIG_USER_ONLY
1909     if (cpu->pmu_timer) {
1910         timer_free(cpu->pmu_timer);
1911     }
1912     if (cpu->wfxt_timer) {
1913         timer_free(cpu->wfxt_timer);
1914     }
1915 #endif
1916 }
1917 
1918 void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
1919 {
1920     Error *local_err = NULL;
1921 
1922 #ifdef TARGET_AARCH64
1923     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
1924         arm_cpu_sve_finalize(cpu, &local_err);
1925         if (local_err != NULL) {
1926             error_propagate(errp, local_err);
1927             return;
1928         }
1929 
1930         /*
1931          * FEAT_SME is not architecturally dependent on FEAT_SVE (unless
1932          * FEAT_SME_FA64 is present). However our implementation currently
1933          * assumes it, so if the user asked for sve=off then turn off SME also.
1934          * (KVM doesn't currently support SME at all.)
1935          */
1936         if (cpu_isar_feature(aa64_sme, cpu) && !cpu_isar_feature(aa64_sve, cpu)) {
1937             object_property_set_bool(OBJECT(cpu), "sme", false, &error_abort);
1938         }
1939 
1940         arm_cpu_sme_finalize(cpu, &local_err);
1941         if (local_err != NULL) {
1942             error_propagate(errp, local_err);
1943             return;
1944         }
1945 
1946         arm_cpu_pauth_finalize(cpu, &local_err);
1947         if (local_err != NULL) {
1948             error_propagate(errp, local_err);
1949             return;
1950         }
1951 
1952         arm_cpu_lpa2_finalize(cpu, &local_err);
1953         if (local_err != NULL) {
1954             error_propagate(errp, local_err);
1955             return;
1956         }
1957     }
1958 #endif
1959 
1960     if (kvm_enabled()) {
1961         kvm_arm_steal_time_finalize(cpu, &local_err);
1962         if (local_err != NULL) {
1963             error_propagate(errp, local_err);
1964             return;
1965         }
1966     }
1967 }
1968 
1969 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
1970 {
1971     CPUState *cs = CPU(dev);
1972     ARMCPU *cpu = ARM_CPU(dev);
1973     ARMCPUClass *acc = ARM_CPU_GET_CLASS(dev);
1974     CPUARMState *env = &cpu->env;
1975     Error *local_err = NULL;
1976 
1977 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
1978     /* Use pc-relative instructions in system-mode */
1979     tcg_cflags_set(cs, CF_PCREL);
1980 #endif
1981 
1982     /* If we needed to query the host kernel for the CPU features
1983      * then it's possible that might have failed in the initfn, but
1984      * this is the first point where we can report it.
1985      */
1986     if (cpu->host_cpu_probe_failed) {
1987         if (!kvm_enabled() && !hvf_enabled()) {
1988             error_setg(errp, "The 'host' CPU type can only be used with KVM or HVF");
1989         } else {
1990             error_setg(errp, "Failed to retrieve host CPU features");
1991         }
1992         return;
1993     }
1994 
1995     if (!cpu->gt_cntfrq_hz) {
1996         /*
1997          * 0 means "the board didn't set a value, use the default". (We also
1998          * get here for the CONFIG_USER_ONLY case.)
1999          * ARMv8.6 and later CPUs architecturally must use a 1GHz timer; before
2000          * that it was an IMPDEF choice, and QEMU initially picked 62.5MHz,
2001          * which gives a 16ns tick period.
2002          *
2003          * We will use the back-compat value:
2004          *  - for QEMU CPU types added before we standardized on 1GHz
2005          *  - for versioned machine types with a version of 9.0 or earlier
2006          */
2007         if (arm_feature(env, ARM_FEATURE_BACKCOMPAT_CNTFRQ) ||
2008             cpu->backcompat_cntfrq) {
2009             cpu->gt_cntfrq_hz = GTIMER_BACKCOMPAT_HZ;
2010         } else {
2011             cpu->gt_cntfrq_hz = GTIMER_DEFAULT_HZ;
2012         }
2013     }
2014 
2015 #ifndef CONFIG_USER_ONLY
2016     /* The NVIC and M-profile CPU are two halves of a single piece of
2017      * hardware; trying to use one without the other is a command line
2018      * error and will result in segfaults if not caught here.
2019      */
2020     if (arm_feature(env, ARM_FEATURE_M)) {
2021         if (!env->nvic) {
2022             error_setg(errp, "This board cannot be used with Cortex-M CPUs");
2023             return;
2024         }
2025     } else {
2026         if (env->nvic) {
2027             error_setg(errp, "This board can only be used with Cortex-M CPUs");
2028             return;
2029         }
2030     }
2031 
2032     if (!tcg_enabled() && !qtest_enabled()) {
2033         /*
2034          * We assume that no accelerator except TCG (and the "not really an
2035          * accelerator" qtest) can handle these features, because Arm hardware
2036          * virtualization can't virtualize them.
2037          *
2038          * Catch all the cases which might cause us to create more than one
2039          * address space for the CPU (otherwise we will assert() later in
2040          * cpu_address_space_init()).
2041          */
2042         if (arm_feature(env, ARM_FEATURE_M)) {
2043             error_setg(errp,
2044                        "Cannot enable %s when using an M-profile guest CPU",
2045                        current_accel_name());
2046             return;
2047         }
2048         if (cpu->has_el3) {
2049             error_setg(errp,
2050                        "Cannot enable %s when guest CPU has EL3 enabled",
2051                        current_accel_name());
2052             return;
2053         }
2054         if (cpu->tag_memory) {
2055             error_setg(errp,
2056                        "Cannot enable %s when guest CPUs has MTE enabled",
2057                        current_accel_name());
2058             return;
2059         }
2060     }
2061 
2062     {
2063         uint64_t scale = gt_cntfrq_period_ns(cpu);
2064 
2065         cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
2066                                                arm_gt_ptimer_cb, cpu);
2067         cpu->gt_timer[GTIMER_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
2068                                                arm_gt_vtimer_cb, cpu);
2069         cpu->gt_timer[GTIMER_HYP] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
2070                                               arm_gt_htimer_cb, cpu);
2071         cpu->gt_timer[GTIMER_SEC] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
2072                                               arm_gt_stimer_cb, cpu);
2073         cpu->gt_timer[GTIMER_HYPVIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
2074                                                   arm_gt_hvtimer_cb, cpu);
2075         cpu->gt_timer[GTIMER_S_EL2_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
2076                                                      arm_gt_sel2timer_cb, cpu);
2077         cpu->gt_timer[GTIMER_S_EL2_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
2078                                                      arm_gt_sel2vtimer_cb, cpu);
2079     }
2080 #endif
2081 
2082     cpu_exec_realizefn(cs, &local_err);
2083     if (local_err != NULL) {
2084         error_propagate(errp, local_err);
2085         return;
2086     }
2087 
2088     arm_cpu_finalize_features(cpu, &local_err);
2089     if (local_err != NULL) {
2090         error_propagate(errp, local_err);
2091         return;
2092     }
2093 
2094 #ifdef CONFIG_USER_ONLY
2095     /*
2096      * User mode relies on IC IVAU instructions to catch modification of
2097      * dual-mapped code.
2098      *
2099      * Clear CTR_EL0.DIC to ensure that software that honors these flags uses
2100      * IC IVAU even if the emulated processor does not normally require it.
2101      */
2102     cpu->ctr = FIELD_DP64(cpu->ctr, CTR_EL0, DIC, 0);
2103 #endif
2104 
2105     if (arm_feature(env, ARM_FEATURE_AARCH64) &&
2106         cpu->has_vfp != cpu->has_neon) {
2107         /*
2108          * This is an architectural requirement for AArch64; AArch32 is
2109          * more flexible and permits VFP-no-Neon and Neon-no-VFP.
2110          */
2111         error_setg(errp,
2112                    "AArch64 CPUs must have both VFP and Neon or neither");
2113         return;
2114     }
2115 
2116     if (cpu->has_vfp_d32 != cpu->has_neon) {
2117         error_setg(errp, "ARM CPUs must have both VFP-D32 and Neon or neither");
2118         return;
2119     }
2120 
2121    if (!cpu->has_vfp_d32) {
2122         uint32_t u;
2123 
2124         u = cpu->isar.mvfr0;
2125         u = FIELD_DP32(u, MVFR0, SIMDREG, 1); /* 16 registers */
2126         cpu->isar.mvfr0 = u;
2127     }
2128 
2129     if (!cpu->has_vfp) {
2130         uint64_t t;
2131         uint32_t u;
2132 
2133         t = cpu->isar.id_aa64isar1;
2134         t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
2135         cpu->isar.id_aa64isar1 = t;
2136 
2137         t = cpu->isar.id_aa64pfr0;
2138         t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
2139         cpu->isar.id_aa64pfr0 = t;
2140 
2141         u = cpu->isar.id_isar6;
2142         u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
2143         u = FIELD_DP32(u, ID_ISAR6, BF16, 0);
2144         cpu->isar.id_isar6 = u;
2145 
2146         u = cpu->isar.mvfr0;
2147         u = FIELD_DP32(u, MVFR0, FPSP, 0);
2148         u = FIELD_DP32(u, MVFR0, FPDP, 0);
2149         u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
2150         u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
2151         u = FIELD_DP32(u, MVFR0, FPROUND, 0);
2152         if (!arm_feature(env, ARM_FEATURE_M)) {
2153             u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
2154             u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
2155         }
2156         cpu->isar.mvfr0 = u;
2157 
2158         u = cpu->isar.mvfr1;
2159         u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
2160         u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
2161         u = FIELD_DP32(u, MVFR1, FPHP, 0);
2162         if (arm_feature(env, ARM_FEATURE_M)) {
2163             u = FIELD_DP32(u, MVFR1, FP16, 0);
2164         }
2165         cpu->isar.mvfr1 = u;
2166 
2167         u = cpu->isar.mvfr2;
2168         u = FIELD_DP32(u, MVFR2, FPMISC, 0);
2169         cpu->isar.mvfr2 = u;
2170     }
2171 
2172     if (!cpu->has_neon) {
2173         uint64_t t;
2174         uint32_t u;
2175 
2176         unset_feature(env, ARM_FEATURE_NEON);
2177 
2178         t = cpu->isar.id_aa64isar0;
2179         t = FIELD_DP64(t, ID_AA64ISAR0, AES, 0);
2180         t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 0);
2181         t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 0);
2182         t = FIELD_DP64(t, ID_AA64ISAR0, SHA3, 0);
2183         t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 0);
2184         t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 0);
2185         t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
2186         cpu->isar.id_aa64isar0 = t;
2187 
2188         t = cpu->isar.id_aa64isar1;
2189         t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
2190         t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 0);
2191         t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 0);
2192         cpu->isar.id_aa64isar1 = t;
2193 
2194         t = cpu->isar.id_aa64pfr0;
2195         t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
2196         cpu->isar.id_aa64pfr0 = t;
2197 
2198         u = cpu->isar.id_isar5;
2199         u = FIELD_DP32(u, ID_ISAR5, AES, 0);
2200         u = FIELD_DP32(u, ID_ISAR5, SHA1, 0);
2201         u = FIELD_DP32(u, ID_ISAR5, SHA2, 0);
2202         u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
2203         u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
2204         cpu->isar.id_isar5 = u;
2205 
2206         u = cpu->isar.id_isar6;
2207         u = FIELD_DP32(u, ID_ISAR6, DP, 0);
2208         u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
2209         u = FIELD_DP32(u, ID_ISAR6, BF16, 0);
2210         u = FIELD_DP32(u, ID_ISAR6, I8MM, 0);
2211         cpu->isar.id_isar6 = u;
2212 
2213         if (!arm_feature(env, ARM_FEATURE_M)) {
2214             u = cpu->isar.mvfr1;
2215             u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
2216             u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
2217             u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
2218             u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
2219             cpu->isar.mvfr1 = u;
2220 
2221             u = cpu->isar.mvfr2;
2222             u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
2223             cpu->isar.mvfr2 = u;
2224         }
2225     }
2226 
2227     if (!cpu->has_neon && !cpu->has_vfp) {
2228         uint64_t t;
2229         uint32_t u;
2230 
2231         t = cpu->isar.id_aa64isar0;
2232         t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
2233         cpu->isar.id_aa64isar0 = t;
2234 
2235         t = cpu->isar.id_aa64isar1;
2236         t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
2237         cpu->isar.id_aa64isar1 = t;
2238 
2239         u = cpu->isar.mvfr0;
2240         u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
2241         cpu->isar.mvfr0 = u;
2242 
2243         /* Despite the name, this field covers both VFP and Neon */
2244         u = cpu->isar.mvfr1;
2245         u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
2246         cpu->isar.mvfr1 = u;
2247     }
2248 
2249     if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
2250         uint32_t u;
2251 
2252         unset_feature(env, ARM_FEATURE_THUMB_DSP);
2253 
2254         u = cpu->isar.id_isar1;
2255         u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
2256         cpu->isar.id_isar1 = u;
2257 
2258         u = cpu->isar.id_isar2;
2259         u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
2260         u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
2261         cpu->isar.id_isar2 = u;
2262 
2263         u = cpu->isar.id_isar3;
2264         u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
2265         u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
2266         cpu->isar.id_isar3 = u;
2267     }
2268 
2269 
2270     /*
2271      * We rely on no XScale CPU having VFP so we can use the same bits in the
2272      * TB flags field for VECSTRIDE and XSCALE_CPAR.
2273      */
2274     assert(arm_feature(env, ARM_FEATURE_AARCH64) ||
2275            !cpu_isar_feature(aa32_vfp_simd, cpu) ||
2276            !arm_feature(env, ARM_FEATURE_XSCALE));
2277 
2278 #ifndef CONFIG_USER_ONLY
2279     {
2280         int pagebits;
2281         if (arm_feature(env, ARM_FEATURE_V7) &&
2282             !arm_feature(env, ARM_FEATURE_M) &&
2283             !arm_feature(env, ARM_FEATURE_PMSA)) {
2284             /*
2285              * v7VMSA drops support for the old ARMv5 tiny pages,
2286              * so we can use 4K pages.
2287              */
2288             pagebits = 12;
2289         } else {
2290             /*
2291              * For CPUs which might have tiny 1K pages, or which have an
2292              * MPU and might have small region sizes, stick with 1K pages.
2293              */
2294             pagebits = 10;
2295         }
2296         if (!set_preferred_target_page_bits(pagebits)) {
2297             /*
2298              * This can only ever happen for hotplugging a CPU, or if
2299              * the board code incorrectly creates a CPU which it has
2300              * promised via minimum_page_size that it will not.
2301              */
2302             error_setg(errp, "This CPU requires a smaller page size "
2303                        "than the system is using");
2304             return;
2305         }
2306     }
2307 #endif
2308 
2309     /* This cpu-id-to-MPIDR affinity is used only for TCG; KVM will override it.
2310      * We don't support setting cluster ID ([16..23]) (known as Aff2
2311      * in later ARM ARM versions), or any of the higher affinity level fields,
2312      * so these bits always RAZ.
2313      */
2314     if (cpu->mp_affinity == ARM64_AFFINITY_INVALID) {
2315         cpu->mp_affinity = arm_build_mp_affinity(cs->cpu_index,
2316                                                  ARM_DEFAULT_CPUS_PER_CLUSTER);
2317     }
2318 
2319     if (cpu->reset_hivecs) {
2320             cpu->reset_sctlr |= (1 << 13);
2321     }
2322 
2323     if (cpu->cfgend) {
2324         if (arm_feature(env, ARM_FEATURE_V7)) {
2325             cpu->reset_sctlr |= SCTLR_EE;
2326         } else {
2327             cpu->reset_sctlr |= SCTLR_B;
2328         }
2329     }
2330 
2331     if (!arm_feature(env, ARM_FEATURE_M) && !cpu->has_el3) {
2332         /* If the has_el3 CPU property is disabled then we need to disable the
2333          * feature.
2334          */
2335         unset_feature(env, ARM_FEATURE_EL3);
2336 
2337         /*
2338          * Disable the security extension feature bits in the processor
2339          * feature registers as well.
2340          */
2341         cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1, ID_PFR1, SECURITY, 0);
2342         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
2343         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
2344                                            ID_AA64PFR0, EL3, 0);
2345 
2346         /* Disable the realm management extension, which requires EL3. */
2347         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
2348                                            ID_AA64PFR0, RME, 0);
2349     }
2350 
2351     if (!cpu->has_el2) {
2352         unset_feature(env, ARM_FEATURE_EL2);
2353     }
2354 
2355     if (!cpu->has_pmu) {
2356         unset_feature(env, ARM_FEATURE_PMU);
2357     }
2358     if (arm_feature(env, ARM_FEATURE_PMU)) {
2359         pmu_init(cpu);
2360 
2361         if (!kvm_enabled()) {
2362             arm_register_pre_el_change_hook(cpu, &pmu_pre_el_change, 0);
2363             arm_register_el_change_hook(cpu, &pmu_post_el_change, 0);
2364         }
2365 
2366 #ifndef CONFIG_USER_ONLY
2367         cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, arm_pmu_timer_cb,
2368                 cpu);
2369 #endif
2370     } else {
2371         cpu->isar.id_aa64dfr0 =
2372             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMUVER, 0);
2373         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, PERFMON, 0);
2374         cpu->pmceid0 = 0;
2375         cpu->pmceid1 = 0;
2376     }
2377 
2378     if (!arm_feature(env, ARM_FEATURE_EL2)) {
2379         /*
2380          * Disable the hypervisor feature bits in the processor feature
2381          * registers if we don't have EL2.
2382          */
2383         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
2384                                            ID_AA64PFR0, EL2, 0);
2385         cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1,
2386                                        ID_PFR1, VIRTUALIZATION, 0);
2387     }
2388 
2389     if (cpu_isar_feature(aa64_mte, cpu)) {
2390         /*
2391          * The architectural range of GM blocksize is 2-6, however qemu
2392          * doesn't support blocksize of 2 (see HELPER(ldgm)).
2393          */
2394         if (tcg_enabled()) {
2395             assert(cpu->gm_blocksize >= 3 && cpu->gm_blocksize <= 6);
2396         }
2397 
2398 #ifndef CONFIG_USER_ONLY
2399         /*
2400          * If we run with TCG and do not have tag-memory provided by
2401          * the machine, then reduce MTE support to instructions enabled at EL0.
2402          * This matches Cortex-A710 BROADCASTMTE input being LOW.
2403          */
2404         if (tcg_enabled() && cpu->tag_memory == NULL) {
2405             cpu->isar.id_aa64pfr1 =
2406                 FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 1);
2407         }
2408 
2409         /*
2410          * If MTE is supported by the host, however it should not be
2411          * enabled on the guest (i.e mte=off), clear guest's MTE bits."
2412          */
2413         if (kvm_enabled() && !cpu->kvm_mte) {
2414                 FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 0);
2415         }
2416 #endif
2417     }
2418 
2419 #ifndef CONFIG_USER_ONLY
2420     if (tcg_enabled() && cpu_isar_feature(aa64_wfxt, cpu)) {
2421         cpu->wfxt_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
2422                                        arm_wfxt_timer_cb, cpu);
2423     }
2424 #endif
2425 
2426     if (tcg_enabled()) {
2427         /*
2428          * Don't report some architectural features in the ID registers
2429          * where TCG does not yet implement it (not even a minimal
2430          * stub version). This avoids guests falling over when they
2431          * try to access the non-existent system registers for them.
2432          */
2433         /* FEAT_SPE (Statistical Profiling Extension) */
2434         cpu->isar.id_aa64dfr0 =
2435             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMSVER, 0);
2436         /* FEAT_TRBE (Trace Buffer Extension) */
2437         cpu->isar.id_aa64dfr0 =
2438             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEBUFFER, 0);
2439         /* FEAT_TRF (Self-hosted Trace Extension) */
2440         cpu->isar.id_aa64dfr0 =
2441             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEFILT, 0);
2442         cpu->isar.id_dfr0 =
2443             FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, TRACEFILT, 0);
2444         /* Trace Macrocell system register access */
2445         cpu->isar.id_aa64dfr0 =
2446             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEVER, 0);
2447         cpu->isar.id_dfr0 =
2448             FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPTRC, 0);
2449         /* Memory mapped trace */
2450         cpu->isar.id_dfr0 =
2451             FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, MMAPTRC, 0);
2452         /* FEAT_AMU (Activity Monitors Extension) */
2453         cpu->isar.id_aa64pfr0 =
2454             FIELD_DP64(cpu->isar.id_aa64pfr0, ID_AA64PFR0, AMU, 0);
2455         cpu->isar.id_pfr0 =
2456             FIELD_DP32(cpu->isar.id_pfr0, ID_PFR0, AMU, 0);
2457         /* FEAT_MPAM (Memory Partitioning and Monitoring Extension) */
2458         cpu->isar.id_aa64pfr0 =
2459             FIELD_DP64(cpu->isar.id_aa64pfr0, ID_AA64PFR0, MPAM, 0);
2460     }
2461 
2462     /* MPU can be configured out of a PMSA CPU either by setting has-mpu
2463      * to false or by setting pmsav7-dregion to 0.
2464      */
2465     if (!cpu->has_mpu || cpu->pmsav7_dregion == 0) {
2466         cpu->has_mpu = false;
2467         cpu->pmsav7_dregion = 0;
2468         cpu->pmsav8r_hdregion = 0;
2469     }
2470 
2471     if (arm_feature(env, ARM_FEATURE_PMSA) &&
2472         arm_feature(env, ARM_FEATURE_V7)) {
2473         uint32_t nr = cpu->pmsav7_dregion;
2474 
2475         if (nr > 0xff) {
2476             error_setg(errp, "PMSAv7 MPU #regions invalid %" PRIu32, nr);
2477             return;
2478         }
2479 
2480         if (nr) {
2481             if (arm_feature(env, ARM_FEATURE_V8)) {
2482                 /* PMSAv8 */
2483                 env->pmsav8.rbar[M_REG_NS] = g_new0(uint32_t, nr);
2484                 env->pmsav8.rlar[M_REG_NS] = g_new0(uint32_t, nr);
2485                 if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2486                     env->pmsav8.rbar[M_REG_S] = g_new0(uint32_t, nr);
2487                     env->pmsav8.rlar[M_REG_S] = g_new0(uint32_t, nr);
2488                 }
2489             } else {
2490                 env->pmsav7.drbar = g_new0(uint32_t, nr);
2491                 env->pmsav7.drsr = g_new0(uint32_t, nr);
2492                 env->pmsav7.dracr = g_new0(uint32_t, nr);
2493             }
2494         }
2495 
2496         if (cpu->pmsav8r_hdregion > 0xff) {
2497             error_setg(errp, "PMSAv8 MPU EL2 #regions invalid %" PRIu32,
2498                               cpu->pmsav8r_hdregion);
2499             return;
2500         }
2501 
2502         if (cpu->pmsav8r_hdregion) {
2503             env->pmsav8.hprbar = g_new0(uint32_t,
2504                                         cpu->pmsav8r_hdregion);
2505             env->pmsav8.hprlar = g_new0(uint32_t,
2506                                         cpu->pmsav8r_hdregion);
2507         }
2508     }
2509 
2510     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
2511         uint32_t nr = cpu->sau_sregion;
2512 
2513         if (nr > 0xff) {
2514             error_setg(errp, "v8M SAU #regions invalid %" PRIu32, nr);
2515             return;
2516         }
2517 
2518         if (nr) {
2519             env->sau.rbar = g_new0(uint32_t, nr);
2520             env->sau.rlar = g_new0(uint32_t, nr);
2521         }
2522     }
2523 
2524     if (arm_feature(env, ARM_FEATURE_EL3)) {
2525         set_feature(env, ARM_FEATURE_VBAR);
2526     }
2527 
2528 #ifndef CONFIG_USER_ONLY
2529     if (tcg_enabled() && cpu_isar_feature(aa64_rme, cpu)) {
2530         arm_register_el_change_hook(cpu, &gt_rme_post_el_change, 0);
2531     }
2532 #endif
2533 
2534     register_cp_regs_for_features(cpu);
2535     arm_cpu_register_gdb_regs_for_features(cpu);
2536     arm_cpu_register_gdb_commands(cpu);
2537 
2538     init_cpreg_list(cpu);
2539 
2540 #ifndef CONFIG_USER_ONLY
2541     MachineState *ms = MACHINE(qdev_get_machine());
2542     unsigned int smp_cpus = ms->smp.cpus;
2543     bool has_secure = cpu->has_el3 || arm_feature(env, ARM_FEATURE_M_SECURITY);
2544 
2545     /*
2546      * We must set cs->num_ases to the final value before
2547      * the first call to cpu_address_space_init.
2548      */
2549     if (cpu->tag_memory != NULL) {
2550         cs->num_ases = 3 + has_secure;
2551     } else {
2552         cs->num_ases = 1 + has_secure;
2553     }
2554 
2555     if (has_secure) {
2556         if (!cpu->secure_memory) {
2557             cpu->secure_memory = cs->memory;
2558         }
2559         cpu_address_space_init(cs, ARMASIdx_S, "cpu-secure-memory",
2560                                cpu->secure_memory);
2561     }
2562 
2563     if (cpu->tag_memory != NULL) {
2564         cpu_address_space_init(cs, ARMASIdx_TagNS, "cpu-tag-memory",
2565                                cpu->tag_memory);
2566         if (has_secure) {
2567             cpu_address_space_init(cs, ARMASIdx_TagS, "cpu-tag-memory",
2568                                    cpu->secure_tag_memory);
2569         }
2570     }
2571 
2572     cpu_address_space_init(cs, ARMASIdx_NS, "cpu-memory", cs->memory);
2573 
2574     /* No core_count specified, default to smp_cpus. */
2575     if (cpu->core_count == -1) {
2576         cpu->core_count = smp_cpus;
2577     }
2578 #endif
2579 
2580     if (tcg_enabled()) {
2581         int dcz_blocklen = 4 << cpu->dcz_blocksize;
2582 
2583         /*
2584          * We only support DCZ blocklen that fits on one page.
2585          *
2586          * Architectually this is always true.  However TARGET_PAGE_SIZE
2587          * is variable and, for compatibility with -machine virt-2.7,
2588          * is only 1KiB, as an artifact of legacy ARMv5 subpage support.
2589          * But even then, while the largest architectural DCZ blocklen
2590          * is 2KiB, no cpu actually uses such a large blocklen.
2591          */
2592         assert(dcz_blocklen <= TARGET_PAGE_SIZE);
2593 
2594         /*
2595          * We only support DCZ blocksize >= 2*TAG_GRANULE, which is to say
2596          * both nibbles of each byte storing tag data may be written at once.
2597          * Since TAG_GRANULE is 16, this means that blocklen must be >= 32.
2598          */
2599         if (cpu_isar_feature(aa64_mte, cpu)) {
2600             assert(dcz_blocklen >= 2 * TAG_GRANULE);
2601         }
2602     }
2603 
2604     qemu_init_vcpu(cs);
2605     cpu_reset(cs);
2606 
2607     acc->parent_realize(dev, errp);
2608 }
2609 
2610 static ObjectClass *arm_cpu_class_by_name(const char *cpu_model)
2611 {
2612     ObjectClass *oc;
2613     char *typename;
2614     char **cpuname;
2615     const char *cpunamestr;
2616 
2617     cpuname = g_strsplit(cpu_model, ",", 1);
2618     cpunamestr = cpuname[0];
2619 #ifdef CONFIG_USER_ONLY
2620     /* For backwards compatibility usermode emulation allows "-cpu any",
2621      * which has the same semantics as "-cpu max".
2622      */
2623     if (!strcmp(cpunamestr, "any")) {
2624         cpunamestr = "max";
2625     }
2626 #endif
2627     typename = g_strdup_printf(ARM_CPU_TYPE_NAME("%s"), cpunamestr);
2628     oc = object_class_by_name(typename);
2629     g_strfreev(cpuname);
2630     g_free(typename);
2631 
2632     return oc;
2633 }
2634 
2635 static const Property arm_cpu_properties[] = {
2636     DEFINE_PROP_UINT64("midr", ARMCPU, midr, 0),
2637     DEFINE_PROP_UINT64("mp-affinity", ARMCPU,
2638                         mp_affinity, ARM64_AFFINITY_INVALID),
2639     DEFINE_PROP_INT32("node-id", ARMCPU, node_id, CPU_UNSET_NUMA_NODE_ID),
2640     DEFINE_PROP_INT32("core-count", ARMCPU, core_count, -1),
2641     /* True to default to the backward-compat old CNTFRQ rather than 1Ghz */
2642     DEFINE_PROP_BOOL("backcompat-cntfrq", ARMCPU, backcompat_cntfrq, false),
2643     DEFINE_PROP_BOOL("backcompat-pauth-default-use-qarma5", ARMCPU,
2644                       backcompat_pauth_default_use_qarma5, false),
2645 };
2646 
2647 static const gchar *arm_gdb_arch_name(CPUState *cs)
2648 {
2649     ARMCPU *cpu = ARM_CPU(cs);
2650     CPUARMState *env = &cpu->env;
2651 
2652     if (arm_gdbstub_is_aarch64(cpu)) {
2653         return "aarch64";
2654     }
2655     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
2656         return "iwmmxt";
2657     }
2658     return "arm";
2659 }
2660 
2661 static const char *arm_gdb_get_core_xml_file(CPUState *cs)
2662 {
2663     ARMCPU *cpu = ARM_CPU(cs);
2664     CPUARMState *env = &cpu->env;
2665 
2666     if (arm_gdbstub_is_aarch64(cpu)) {
2667         return "aarch64-core.xml";
2668     }
2669     if (arm_feature(env, ARM_FEATURE_M)) {
2670         return "arm-m-profile.xml";
2671     }
2672     return "arm-core.xml";
2673 }
2674 
2675 #ifndef CONFIG_USER_ONLY
2676 #include "hw/core/sysemu-cpu-ops.h"
2677 
2678 static const struct SysemuCPUOps arm_sysemu_ops = {
2679     .has_work = arm_cpu_has_work,
2680     .get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug,
2681     .asidx_from_attrs = arm_asidx_from_attrs,
2682     .write_elf32_note = arm_cpu_write_elf32_note,
2683     .write_elf64_note = arm_cpu_write_elf64_note,
2684     .virtio_is_big_endian = arm_cpu_virtio_is_big_endian,
2685     .legacy_vmsd = &vmstate_arm_cpu,
2686 };
2687 #endif
2688 
2689 #ifdef CONFIG_TCG
2690 static const TCGCPUOps arm_tcg_ops = {
2691     .mttcg_supported = true,
2692     /* ARM processors have a weak memory model */
2693     .guest_default_memory_order = 0,
2694 
2695     .initialize = arm_translate_init,
2696     .translate_code = arm_translate_code,
2697     .synchronize_from_tb = arm_cpu_synchronize_from_tb,
2698     .debug_excp_handler = arm_debug_excp_handler,
2699     .restore_state_to_opc = arm_restore_state_to_opc,
2700     .mmu_index = arm_cpu_mmu_index,
2701 
2702 #ifdef CONFIG_USER_ONLY
2703     .record_sigsegv = arm_cpu_record_sigsegv,
2704     .record_sigbus = arm_cpu_record_sigbus,
2705 #else
2706     .tlb_fill_align = arm_cpu_tlb_fill_align,
2707     .cpu_exec_interrupt = arm_cpu_exec_interrupt,
2708     .cpu_exec_halt = arm_cpu_exec_halt,
2709     .do_interrupt = arm_cpu_do_interrupt,
2710     .do_transaction_failed = arm_cpu_do_transaction_failed,
2711     .do_unaligned_access = arm_cpu_do_unaligned_access,
2712     .adjust_watchpoint_address = arm_adjust_watchpoint_address,
2713     .debug_check_watchpoint = arm_debug_check_watchpoint,
2714     .debug_check_breakpoint = arm_debug_check_breakpoint,
2715 #endif /* !CONFIG_USER_ONLY */
2716 };
2717 #endif /* CONFIG_TCG */
2718 
2719 static void arm_cpu_class_init(ObjectClass *oc, const void *data)
2720 {
2721     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
2722     CPUClass *cc = CPU_CLASS(acc);
2723     DeviceClass *dc = DEVICE_CLASS(oc);
2724     ResettableClass *rc = RESETTABLE_CLASS(oc);
2725 
2726     device_class_set_parent_realize(dc, arm_cpu_realizefn,
2727                                     &acc->parent_realize);
2728 
2729     device_class_set_props(dc, arm_cpu_properties);
2730 
2731     resettable_class_set_parent_phases(rc, NULL, arm_cpu_reset_hold, NULL,
2732                                        &acc->parent_phases);
2733 
2734     cc->class_by_name = arm_cpu_class_by_name;
2735     cc->dump_state = arm_cpu_dump_state;
2736     cc->set_pc = arm_cpu_set_pc;
2737     cc->get_pc = arm_cpu_get_pc;
2738     cc->gdb_read_register = arm_cpu_gdb_read_register;
2739     cc->gdb_write_register = arm_cpu_gdb_write_register;
2740 #ifndef CONFIG_USER_ONLY
2741     cc->sysemu_ops = &arm_sysemu_ops;
2742 #endif
2743     cc->gdb_arch_name = arm_gdb_arch_name;
2744     cc->gdb_get_core_xml_file = arm_gdb_get_core_xml_file;
2745     cc->gdb_stop_before_watchpoint = true;
2746     cc->disas_set_info = arm_disas_set_info;
2747 
2748 #ifdef CONFIG_TCG
2749     cc->tcg_ops = &arm_tcg_ops;
2750 #endif /* CONFIG_TCG */
2751 }
2752 
2753 static void arm_cpu_instance_init(Object *obj)
2754 {
2755     ARMCPUClass *acc = ARM_CPU_GET_CLASS(obj);
2756 
2757     acc->info->initfn(obj);
2758     arm_cpu_post_init(obj);
2759 }
2760 
2761 static void cpu_register_class_init(ObjectClass *oc, const void *data)
2762 {
2763     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
2764     CPUClass *cc = CPU_CLASS(acc);
2765 
2766     acc->info = data;
2767     if (acc->info->deprecation_note) {
2768         cc->deprecation_note = acc->info->deprecation_note;
2769     }
2770 }
2771 
2772 void arm_cpu_register(const ARMCPUInfo *info)
2773 {
2774     TypeInfo type_info = {
2775         .parent = TYPE_ARM_CPU,
2776         .instance_init = arm_cpu_instance_init,
2777         .class_init = info->class_init ?: cpu_register_class_init,
2778         .class_data = info,
2779     };
2780 
2781     type_info.name = g_strdup_printf("%s-" TYPE_ARM_CPU, info->name);
2782     type_register_static(&type_info);
2783     g_free((void *)type_info.name);
2784 }
2785 
2786 static const TypeInfo arm_cpu_type_info = {
2787     .name = TYPE_ARM_CPU,
2788     .parent = TYPE_CPU,
2789     .instance_size = sizeof(ARMCPU),
2790     .instance_align = __alignof__(ARMCPU),
2791     .instance_init = arm_cpu_initfn,
2792     .instance_finalize = arm_cpu_finalizefn,
2793     .abstract = true,
2794     .class_size = sizeof(ARMCPUClass),
2795     .class_init = arm_cpu_class_init,
2796 };
2797 
2798 static void arm_cpu_register_types(void)
2799 {
2800     type_register_static(&arm_cpu_type_info);
2801 }
2802 
2803 type_init(arm_cpu_register_types)
2804