xref: /qemu/target/arm/helper.c (revision 374cdc8e)
1 /*
2  * ARM generic helpers.
3  *
4  * This code is licensed under the GNU GPL v2 or later.
5  *
6  * SPDX-License-Identifier: GPL-2.0-or-later
7  */
8 
9 #include "qemu/osdep.h"
10 #include "qemu/log.h"
11 #include "trace.h"
12 #include "cpu.h"
13 #include "internals.h"
14 #include "cpu-features.h"
15 #include "exec/helper-proto.h"
16 #include "qemu/main-loop.h"
17 #include "qemu/timer.h"
18 #include "qemu/bitops.h"
19 #include "qemu/crc32c.h"
20 #include "qemu/qemu-print.h"
21 #include "exec/exec-all.h"
22 #include <zlib.h> /* for crc32 */
23 #include "hw/irq.h"
24 #include "sysemu/cpu-timers.h"
25 #include "sysemu/kvm.h"
26 #include "sysemu/tcg.h"
27 #include "qapi/error.h"
28 #include "qemu/guest-random.h"
29 #ifdef CONFIG_TCG
30 #include "semihosting/common-semi.h"
31 #endif
32 #include "cpregs.h"
33 #include "target/arm/gtimer.h"
34 
35 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
36 
37 static void switch_mode(CPUARMState *env, int mode);
38 
raw_read(CPUARMState * env,const ARMCPRegInfo * ri)39 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
40 {
41     assert(ri->fieldoffset);
42     if (cpreg_field_is_64bit(ri)) {
43         return CPREG_FIELD64(env, ri);
44     } else {
45         return CPREG_FIELD32(env, ri);
46     }
47 }
48 
raw_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)49 void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
50 {
51     assert(ri->fieldoffset);
52     if (cpreg_field_is_64bit(ri)) {
53         CPREG_FIELD64(env, ri) = value;
54     } else {
55         CPREG_FIELD32(env, ri) = value;
56     }
57 }
58 
raw_ptr(CPUARMState * env,const ARMCPRegInfo * ri)59 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
60 {
61     return (char *)env + ri->fieldoffset;
62 }
63 
read_raw_cp_reg(CPUARMState * env,const ARMCPRegInfo * ri)64 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
65 {
66     /* Raw read of a coprocessor register (as needed for migration, etc). */
67     if (ri->type & ARM_CP_CONST) {
68         return ri->resetvalue;
69     } else if (ri->raw_readfn) {
70         return ri->raw_readfn(env, ri);
71     } else if (ri->readfn) {
72         return ri->readfn(env, ri);
73     } else {
74         return raw_read(env, ri);
75     }
76 }
77 
write_raw_cp_reg(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t v)78 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
79                              uint64_t v)
80 {
81     /*
82      * Raw write of a coprocessor register (as needed for migration, etc).
83      * Note that constant registers are treated as write-ignored; the
84      * caller should check for success by whether a readback gives the
85      * value written.
86      */
87     if (ri->type & ARM_CP_CONST) {
88         return;
89     } else if (ri->raw_writefn) {
90         ri->raw_writefn(env, ri, v);
91     } else if (ri->writefn) {
92         ri->writefn(env, ri, v);
93     } else {
94         raw_write(env, ri, v);
95     }
96 }
97 
raw_accessors_invalid(const ARMCPRegInfo * ri)98 static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
99 {
100    /*
101     * Return true if the regdef would cause an assertion if you called
102     * read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
103     * program bug for it not to have the NO_RAW flag).
104     * NB that returning false here doesn't necessarily mean that calling
105     * read/write_raw_cp_reg() is safe, because we can't distinguish "has
106     * read/write access functions which are safe for raw use" from "has
107     * read/write access functions which have side effects but has forgotten
108     * to provide raw access functions".
109     * The tests here line up with the conditions in read/write_raw_cp_reg()
110     * and assertions in raw_read()/raw_write().
111     */
112     if ((ri->type & ARM_CP_CONST) ||
113         ri->fieldoffset ||
114         ((ri->raw_writefn || ri->writefn) && (ri->raw_readfn || ri->readfn))) {
115         return false;
116     }
117     return true;
118 }
119 
write_cpustate_to_list(ARMCPU * cpu,bool kvm_sync)120 bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
121 {
122     /* Write the coprocessor state from cpu->env to the (index,value) list. */
123     int i;
124     bool ok = true;
125 
126     for (i = 0; i < cpu->cpreg_array_len; i++) {
127         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
128         const ARMCPRegInfo *ri;
129         uint64_t newval;
130 
131         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
132         if (!ri) {
133             ok = false;
134             continue;
135         }
136         if (ri->type & ARM_CP_NO_RAW) {
137             continue;
138         }
139 
140         newval = read_raw_cp_reg(&cpu->env, ri);
141         if (kvm_sync) {
142             /*
143              * Only sync if the previous list->cpustate sync succeeded.
144              * Rather than tracking the success/failure state for every
145              * item in the list, we just recheck "does the raw write we must
146              * have made in write_list_to_cpustate() read back OK" here.
147              */
148             uint64_t oldval = cpu->cpreg_values[i];
149 
150             if (oldval == newval) {
151                 continue;
152             }
153 
154             write_raw_cp_reg(&cpu->env, ri, oldval);
155             if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
156                 continue;
157             }
158 
159             write_raw_cp_reg(&cpu->env, ri, newval);
160         }
161         cpu->cpreg_values[i] = newval;
162     }
163     return ok;
164 }
165 
write_list_to_cpustate(ARMCPU * cpu)166 bool write_list_to_cpustate(ARMCPU *cpu)
167 {
168     int i;
169     bool ok = true;
170 
171     for (i = 0; i < cpu->cpreg_array_len; i++) {
172         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
173         uint64_t v = cpu->cpreg_values[i];
174         const ARMCPRegInfo *ri;
175 
176         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
177         if (!ri) {
178             ok = false;
179             continue;
180         }
181         if (ri->type & ARM_CP_NO_RAW) {
182             continue;
183         }
184         /*
185          * Write value and confirm it reads back as written
186          * (to catch read-only registers and partially read-only
187          * registers where the incoming migration value doesn't match)
188          */
189         write_raw_cp_reg(&cpu->env, ri, v);
190         if (read_raw_cp_reg(&cpu->env, ri) != v) {
191             ok = false;
192         }
193     }
194     return ok;
195 }
196 
add_cpreg_to_list(gpointer key,gpointer opaque)197 static void add_cpreg_to_list(gpointer key, gpointer opaque)
198 {
199     ARMCPU *cpu = opaque;
200     uint32_t regidx = (uintptr_t)key;
201     const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
202 
203     if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) {
204         cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
205         /* The value array need not be initialized at this point */
206         cpu->cpreg_array_len++;
207     }
208 }
209 
count_cpreg(gpointer key,gpointer opaque)210 static void count_cpreg(gpointer key, gpointer opaque)
211 {
212     ARMCPU *cpu = opaque;
213     const ARMCPRegInfo *ri;
214 
215     ri = g_hash_table_lookup(cpu->cp_regs, key);
216 
217     if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) {
218         cpu->cpreg_array_len++;
219     }
220 }
221 
cpreg_key_compare(gconstpointer a,gconstpointer b)222 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
223 {
224     uint64_t aidx = cpreg_to_kvm_id((uintptr_t)a);
225     uint64_t bidx = cpreg_to_kvm_id((uintptr_t)b);
226 
227     if (aidx > bidx) {
228         return 1;
229     }
230     if (aidx < bidx) {
231         return -1;
232     }
233     return 0;
234 }
235 
init_cpreg_list(ARMCPU * cpu)236 void init_cpreg_list(ARMCPU *cpu)
237 {
238     /*
239      * Initialise the cpreg_tuples[] array based on the cp_regs hash.
240      * Note that we require cpreg_tuples[] to be sorted by key ID.
241      */
242     GList *keys;
243     int arraylen;
244 
245     keys = g_hash_table_get_keys(cpu->cp_regs);
246     keys = g_list_sort(keys, cpreg_key_compare);
247 
248     cpu->cpreg_array_len = 0;
249 
250     g_list_foreach(keys, count_cpreg, cpu);
251 
252     arraylen = cpu->cpreg_array_len;
253     cpu->cpreg_indexes = g_new(uint64_t, arraylen);
254     cpu->cpreg_values = g_new(uint64_t, arraylen);
255     cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
256     cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
257     cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
258     cpu->cpreg_array_len = 0;
259 
260     g_list_foreach(keys, add_cpreg_to_list, cpu);
261 
262     assert(cpu->cpreg_array_len == arraylen);
263 
264     g_list_free(keys);
265 }
266 
arm_pan_enabled(CPUARMState * env)267 static bool arm_pan_enabled(CPUARMState *env)
268 {
269     if (is_a64(env)) {
270         if ((arm_hcr_el2_eff(env) & (HCR_NV | HCR_NV1)) == (HCR_NV | HCR_NV1)) {
271             return false;
272         }
273         return env->pstate & PSTATE_PAN;
274     } else {
275         return env->uncached_cpsr & CPSR_PAN;
276     }
277 }
278 
279 /*
280  * Some registers are not accessible from AArch32 EL3 if SCR.NS == 0.
281  */
access_el3_aa32ns(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)282 static CPAccessResult access_el3_aa32ns(CPUARMState *env,
283                                         const ARMCPRegInfo *ri,
284                                         bool isread)
285 {
286     if (!is_a64(env) && arm_current_el(env) == 3 &&
287         arm_is_secure_below_el3(env)) {
288         return CP_ACCESS_TRAP_UNCATEGORIZED;
289     }
290     return CP_ACCESS_OK;
291 }
292 
293 /*
294  * Some secure-only AArch32 registers trap to EL3 if used from
295  * Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).
296  * Note that an access from Secure EL1 can only happen if EL3 is AArch64.
297  * We assume that the .access field is set to PL1_RW.
298  */
access_trap_aa32s_el1(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)299 static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
300                                             const ARMCPRegInfo *ri,
301                                             bool isread)
302 {
303     if (arm_current_el(env) == 3) {
304         return CP_ACCESS_OK;
305     }
306     if (arm_is_secure_below_el3(env)) {
307         if (env->cp15.scr_el3 & SCR_EEL2) {
308             return CP_ACCESS_TRAP_EL2;
309         }
310         return CP_ACCESS_TRAP_EL3;
311     }
312     /* This will be EL1 NS and EL2 NS, which just UNDEF */
313     return CP_ACCESS_TRAP_UNCATEGORIZED;
314 }
315 
316 /*
317  * Check for traps to performance monitor registers, which are controlled
318  * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
319  */
access_tpm(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)320 static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
321                                  bool isread)
322 {
323     int el = arm_current_el(env);
324     uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
325 
326     if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
327         return CP_ACCESS_TRAP_EL2;
328     }
329     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
330         return CP_ACCESS_TRAP_EL3;
331     }
332     return CP_ACCESS_OK;
333 }
334 
335 /* Check for traps from EL1 due to HCR_EL2.TVM and HCR_EL2.TRVM.  */
access_tvm_trvm(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)336 CPAccessResult access_tvm_trvm(CPUARMState *env, const ARMCPRegInfo *ri,
337                                bool isread)
338 {
339     if (arm_current_el(env) == 1) {
340         uint64_t trap = isread ? HCR_TRVM : HCR_TVM;
341         if (arm_hcr_el2_eff(env) & trap) {
342             return CP_ACCESS_TRAP_EL2;
343         }
344     }
345     return CP_ACCESS_OK;
346 }
347 
348 /* Check for traps from EL1 due to HCR_EL2.TSW.  */
access_tsw(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)349 static CPAccessResult access_tsw(CPUARMState *env, const ARMCPRegInfo *ri,
350                                  bool isread)
351 {
352     if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TSW)) {
353         return CP_ACCESS_TRAP_EL2;
354     }
355     return CP_ACCESS_OK;
356 }
357 
358 /* Check for traps from EL1 due to HCR_EL2.TACR.  */
access_tacr(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)359 static CPAccessResult access_tacr(CPUARMState *env, const ARMCPRegInfo *ri,
360                                   bool isread)
361 {
362     if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TACR)) {
363         return CP_ACCESS_TRAP_EL2;
364     }
365     return CP_ACCESS_OK;
366 }
367 
368 /* Check for traps from EL1 due to HCR_EL2.TTLB. */
access_ttlb(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)369 static CPAccessResult access_ttlb(CPUARMState *env, const ARMCPRegInfo *ri,
370                                   bool isread)
371 {
372     if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TTLB)) {
373         return CP_ACCESS_TRAP_EL2;
374     }
375     return CP_ACCESS_OK;
376 }
377 
378 /* Check for traps from EL1 due to HCR_EL2.TTLB or TTLBIS. */
access_ttlbis(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)379 static CPAccessResult access_ttlbis(CPUARMState *env, const ARMCPRegInfo *ri,
380                                     bool isread)
381 {
382     if (arm_current_el(env) == 1 &&
383         (arm_hcr_el2_eff(env) & (HCR_TTLB | HCR_TTLBIS))) {
384         return CP_ACCESS_TRAP_EL2;
385     }
386     return CP_ACCESS_OK;
387 }
388 
389 #ifdef TARGET_AARCH64
390 /* Check for traps from EL1 due to HCR_EL2.TTLB or TTLBOS. */
access_ttlbos(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)391 static CPAccessResult access_ttlbos(CPUARMState *env, const ARMCPRegInfo *ri,
392                                     bool isread)
393 {
394     if (arm_current_el(env) == 1 &&
395         (arm_hcr_el2_eff(env) & (HCR_TTLB | HCR_TTLBOS))) {
396         return CP_ACCESS_TRAP_EL2;
397     }
398     return CP_ACCESS_OK;
399 }
400 #endif
401 
dacr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)402 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
403 {
404     ARMCPU *cpu = env_archcpu(env);
405 
406     raw_write(env, ri, value);
407     tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */
408 }
409 
fcse_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)410 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
411 {
412     ARMCPU *cpu = env_archcpu(env);
413 
414     if (raw_read(env, ri) != value) {
415         /*
416          * Unlike real hardware the qemu TLB uses virtual addresses,
417          * not modified virtual addresses, so this causes a TLB flush.
418          */
419         tlb_flush(CPU(cpu));
420         raw_write(env, ri, value);
421     }
422 }
423 
contextidr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)424 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
425                              uint64_t value)
426 {
427     ARMCPU *cpu = env_archcpu(env);
428 
429     if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
430         && !extended_addresses_enabled(env)) {
431         /*
432          * For VMSA (when not using the LPAE long descriptor page table
433          * format) this register includes the ASID, so do a TLB flush.
434          * For PMSA it is purely a process ID and no action is needed.
435          */
436         tlb_flush(CPU(cpu));
437     }
438     raw_write(env, ri, value);
439 }
440 
alle1_tlbmask(CPUARMState * env)441 static int alle1_tlbmask(CPUARMState *env)
442 {
443     /*
444      * Note that the 'ALL' scope must invalidate both stage 1 and
445      * stage 2 translations, whereas most other scopes only invalidate
446      * stage 1 translations.
447      *
448      * For AArch32 this is only used for TLBIALLNSNH and VTTBR
449      * writes, so only needs to apply to NS PL1&0, not S PL1&0.
450      */
451     return (ARMMMUIdxBit_E10_1 |
452             ARMMMUIdxBit_E10_1_PAN |
453             ARMMMUIdxBit_E10_0 |
454             ARMMMUIdxBit_Stage2 |
455             ARMMMUIdxBit_Stage2_S);
456 }
457 
458 
459 /* IS variants of TLB operations must affect all cores */
tlbiall_is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)460 static void tlbiall_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
461                              uint64_t value)
462 {
463     CPUState *cs = env_cpu(env);
464 
465     tlb_flush_all_cpus_synced(cs);
466 }
467 
tlbiasid_is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)468 static void tlbiasid_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
469                              uint64_t value)
470 {
471     CPUState *cs = env_cpu(env);
472 
473     tlb_flush_all_cpus_synced(cs);
474 }
475 
tlbimva_is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)476 static void tlbimva_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
477                              uint64_t value)
478 {
479     CPUState *cs = env_cpu(env);
480 
481     tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
482 }
483 
tlbimvaa_is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)484 static void tlbimvaa_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
485                              uint64_t value)
486 {
487     CPUState *cs = env_cpu(env);
488 
489     tlb_flush_page_all_cpus_synced(cs, value & TARGET_PAGE_MASK);
490 }
491 
492 /*
493  * Non-IS variants of TLB operations are upgraded to
494  * IS versions if we are at EL1 and HCR_EL2.FB is effectively set to
495  * force broadcast of these operations.
496  */
tlb_force_broadcast(CPUARMState * env)497 static bool tlb_force_broadcast(CPUARMState *env)
498 {
499     return arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_FB);
500 }
501 
tlbiall_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)502 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
503                           uint64_t value)
504 {
505     /* Invalidate all (TLBIALL) */
506     CPUState *cs = env_cpu(env);
507 
508     if (tlb_force_broadcast(env)) {
509         tlb_flush_all_cpus_synced(cs);
510     } else {
511         tlb_flush(cs);
512     }
513 }
514 
tlbimva_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)515 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
516                           uint64_t value)
517 {
518     /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
519     CPUState *cs = env_cpu(env);
520 
521     value &= TARGET_PAGE_MASK;
522     if (tlb_force_broadcast(env)) {
523         tlb_flush_page_all_cpus_synced(cs, value);
524     } else {
525         tlb_flush_page(cs, value);
526     }
527 }
528 
tlbiasid_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)529 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
530                            uint64_t value)
531 {
532     /* Invalidate by ASID (TLBIASID) */
533     CPUState *cs = env_cpu(env);
534 
535     if (tlb_force_broadcast(env)) {
536         tlb_flush_all_cpus_synced(cs);
537     } else {
538         tlb_flush(cs);
539     }
540 }
541 
tlbimvaa_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)542 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
543                            uint64_t value)
544 {
545     /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
546     CPUState *cs = env_cpu(env);
547 
548     value &= TARGET_PAGE_MASK;
549     if (tlb_force_broadcast(env)) {
550         tlb_flush_page_all_cpus_synced(cs, value);
551     } else {
552         tlb_flush_page(cs, value);
553     }
554 }
555 
tlbiall_nsnh_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)556 static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
557                                uint64_t value)
558 {
559     CPUState *cs = env_cpu(env);
560 
561     tlb_flush_by_mmuidx(cs, alle1_tlbmask(env));
562 }
563 
tlbiall_nsnh_is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)564 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
565                                   uint64_t value)
566 {
567     CPUState *cs = env_cpu(env);
568 
569     tlb_flush_by_mmuidx_all_cpus_synced(cs, alle1_tlbmask(env));
570 }
571 
572 
tlbiall_hyp_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)573 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
574                               uint64_t value)
575 {
576     CPUState *cs = env_cpu(env);
577 
578     tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2);
579 }
580 
tlbiall_hyp_is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)581 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
582                                  uint64_t value)
583 {
584     CPUState *cs = env_cpu(env);
585 
586     tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E2);
587 }
588 
tlbimva_hyp_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)589 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
590                               uint64_t value)
591 {
592     CPUState *cs = env_cpu(env);
593     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
594 
595     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E2);
596 }
597 
tlbimva_hyp_is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)598 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
599                                  uint64_t value)
600 {
601     CPUState *cs = env_cpu(env);
602     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
603 
604     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
605                                              ARMMMUIdxBit_E2);
606 }
607 
tlbiipas2_hyp_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)608 static void tlbiipas2_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
609                                 uint64_t value)
610 {
611     CPUState *cs = env_cpu(env);
612     uint64_t pageaddr = (value & MAKE_64BIT_MASK(0, 28)) << 12;
613 
614     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2);
615 }
616 
tlbiipas2is_hyp_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)617 static void tlbiipas2is_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
618                                 uint64_t value)
619 {
620     CPUState *cs = env_cpu(env);
621     uint64_t pageaddr = (value & MAKE_64BIT_MASK(0, 28)) << 12;
622 
623     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, ARMMMUIdxBit_Stage2);
624 }
625 
626 static const ARMCPRegInfo cp_reginfo[] = {
627     /*
628      * Define the secure and non-secure FCSE identifier CP registers
629      * separately because there is no secure bank in V8 (no _EL3).  This allows
630      * the secure register to be properly reset and migrated. There is also no
631      * v8 EL1 version of the register so the non-secure instance stands alone.
632      */
633     { .name = "FCSEIDR",
634       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
635       .access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
636       .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
637       .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
638     { .name = "FCSEIDR_S",
639       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
640       .access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
641       .fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
642       .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
643     /*
644      * Define the secure and non-secure context identifier CP registers
645      * separately because there is no secure bank in V8 (no _EL3).  This allows
646      * the secure register to be properly reset and migrated.  In the
647      * non-secure case, the 32-bit register will have reset and migration
648      * disabled during registration as it is handled by the 64-bit instance.
649      */
650     { .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
651       .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
652       .access = PL1_RW, .accessfn = access_tvm_trvm,
653       .fgt = FGT_CONTEXTIDR_EL1,
654       .nv2_redirect_offset = 0x108 | NV2_REDIR_NV1,
655       .secure = ARM_CP_SECSTATE_NS,
656       .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
657       .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
658     { .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32,
659       .cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
660       .access = PL1_RW, .accessfn = access_tvm_trvm,
661       .secure = ARM_CP_SECSTATE_S,
662       .fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
663       .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
664 };
665 
666 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
667     /*
668      * NB: Some of these registers exist in v8 but with more precise
669      * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
670      */
671     /* MMU Domain access control / MPU write buffer control */
672     { .name = "DACR",
673       .cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
674       .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0,
675       .writefn = dacr_write, .raw_writefn = raw_write,
676       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
677                              offsetoflow32(CPUARMState, cp15.dacr_ns) } },
678     /*
679      * ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
680      * For v6 and v5, these mappings are overly broad.
681      */
682     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
683       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
684     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
685       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
686     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
687       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
688     { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
689       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
690     /* Cache maintenance ops; some of this space may be overridden later. */
691     { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
692       .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
693       .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
694 };
695 
696 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
697     /*
698      * Not all pre-v6 cores implemented this WFI, so this is slightly
699      * over-broad.
700      */
701     { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
702       .access = PL1_W, .type = ARM_CP_WFI },
703 };
704 
705 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
706     /*
707      * Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
708      * is UNPREDICTABLE; we choose to NOP as most implementations do).
709      */
710     { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
711       .access = PL1_W, .type = ARM_CP_WFI },
712     /*
713      * L1 cache lockdown. Not architectural in v6 and earlier but in practice
714      * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
715      * OMAPCP will override this space.
716      */
717     { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
718       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
719       .resetvalue = 0 },
720     { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
721       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
722       .resetvalue = 0 },
723     /* v6 doesn't have the cache ID registers but Linux reads them anyway */
724     { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
725       .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
726       .resetvalue = 0 },
727     /*
728      * We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
729      * implementing it as RAZ means the "debug architecture version" bits
730      * will read as a reserved value, which should cause Linux to not try
731      * to use the debug hardware.
732      */
733     { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
734       .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
735     /*
736      * MMU TLB control. Note that the wildcarding means we cover not just
737      * the unified TLB ops but also the dside/iside/inner-shareable variants.
738      */
739     { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
740       .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
741       .type = ARM_CP_NO_RAW },
742     { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
743       .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
744       .type = ARM_CP_NO_RAW },
745     { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
746       .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
747       .type = ARM_CP_NO_RAW },
748     { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
749       .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
750       .type = ARM_CP_NO_RAW },
751     { .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
752       .opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
753     { .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
754       .opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
755 };
756 
cpacr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)757 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
758                         uint64_t value)
759 {
760     uint32_t mask = 0;
761 
762     /* In ARMv8 most bits of CPACR_EL1 are RES0. */
763     if (!arm_feature(env, ARM_FEATURE_V8)) {
764         /*
765          * ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
766          * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
767          * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
768          */
769         if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
770             /* VFP coprocessor: cp10 & cp11 [23:20] */
771             mask |= R_CPACR_ASEDIS_MASK |
772                     R_CPACR_D32DIS_MASK |
773                     R_CPACR_CP11_MASK |
774                     R_CPACR_CP10_MASK;
775 
776             if (!arm_feature(env, ARM_FEATURE_NEON)) {
777                 /* ASEDIS [31] bit is RAO/WI */
778                 value |= R_CPACR_ASEDIS_MASK;
779             }
780 
781             /*
782              * VFPv3 and upwards with NEON implement 32 double precision
783              * registers (D0-D31).
784              */
785             if (!cpu_isar_feature(aa32_simd_r32, env_archcpu(env))) {
786                 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
787                 value |= R_CPACR_D32DIS_MASK;
788             }
789         }
790         value &= mask;
791     }
792 
793     /*
794      * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
795      * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
796      */
797     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
798         !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
799         mask = R_CPACR_CP11_MASK | R_CPACR_CP10_MASK;
800         value = (value & ~mask) | (env->cp15.cpacr_el1 & mask);
801     }
802 
803     env->cp15.cpacr_el1 = value;
804 }
805 
cpacr_read(CPUARMState * env,const ARMCPRegInfo * ri)806 static uint64_t cpacr_read(CPUARMState *env, const ARMCPRegInfo *ri)
807 {
808     /*
809      * For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
810      * is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
811      */
812     uint64_t value = env->cp15.cpacr_el1;
813 
814     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
815         !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
816         value = ~(R_CPACR_CP11_MASK | R_CPACR_CP10_MASK);
817     }
818     return value;
819 }
820 
821 
cpacr_reset(CPUARMState * env,const ARMCPRegInfo * ri)822 static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
823 {
824     /*
825      * Call cpacr_write() so that we reset with the correct RAO bits set
826      * for our CPU features.
827      */
828     cpacr_write(env, ri, 0);
829 }
830 
cpacr_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)831 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
832                                    bool isread)
833 {
834     if (arm_feature(env, ARM_FEATURE_V8)) {
835         /* Check if CPACR accesses are to be trapped to EL2 */
836         if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) &&
837             FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TCPAC)) {
838             return CP_ACCESS_TRAP_EL2;
839         /* Check if CPACR accesses are to be trapped to EL3 */
840         } else if (arm_current_el(env) < 3 &&
841                    FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) {
842             return CP_ACCESS_TRAP_EL3;
843         }
844     }
845 
846     return CP_ACCESS_OK;
847 }
848 
cptr_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)849 static CPAccessResult cptr_access(CPUARMState *env, const ARMCPRegInfo *ri,
850                                   bool isread)
851 {
852     /* Check if CPTR accesses are set to trap to EL3 */
853     if (arm_current_el(env) == 2 &&
854         FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) {
855         return CP_ACCESS_TRAP_EL3;
856     }
857 
858     return CP_ACCESS_OK;
859 }
860 
861 static const ARMCPRegInfo v6_cp_reginfo[] = {
862     /* prefetch by MVA in v6, NOP in v7 */
863     { .name = "MVA_prefetch",
864       .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
865       .access = PL1_W, .type = ARM_CP_NOP },
866     /*
867      * We need to break the TB after ISB to execute self-modifying code
868      * correctly and also to take any pending interrupts immediately.
869      * So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag.
870      */
871     { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
872       .access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore },
873     { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
874       .access = PL0_W, .type = ARM_CP_NOP },
875     { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
876       .access = PL0_W, .type = ARM_CP_NOP },
877     { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
878       .access = PL1_RW, .accessfn = access_tvm_trvm,
879       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
880                              offsetof(CPUARMState, cp15.ifar_ns) },
881       .resetvalue = 0, },
882     /*
883      * Watchpoint Fault Address Register : should actually only be present
884      * for 1136, 1176, 11MPCore.
885      */
886     { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
887       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
888     { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
889       .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
890       .fgt = FGT_CPACR_EL1,
891       .nv2_redirect_offset = 0x100 | NV2_REDIR_NV1,
892       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
893       .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
894 };
895 
896 typedef struct pm_event {
897     uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */
898     /* If the event is supported on this CPU (used to generate PMCEID[01]) */
899     bool (*supported)(CPUARMState *);
900     /*
901      * Retrieve the current count of the underlying event. The programmed
902      * counters hold a difference from the return value from this function
903      */
904     uint64_t (*get_count)(CPUARMState *);
905     /*
906      * Return how many nanoseconds it will take (at a minimum) for count events
907      * to occur. A negative value indicates the counter will never overflow, or
908      * that the counter has otherwise arranged for the overflow bit to be set
909      * and the PMU interrupt to be raised on overflow.
910      */
911     int64_t (*ns_per_count)(uint64_t);
912 } pm_event;
913 
event_always_supported(CPUARMState * env)914 static bool event_always_supported(CPUARMState *env)
915 {
916     return true;
917 }
918 
swinc_get_count(CPUARMState * env)919 static uint64_t swinc_get_count(CPUARMState *env)
920 {
921     /*
922      * SW_INCR events are written directly to the pmevcntr's by writes to
923      * PMSWINC, so there is no underlying count maintained by the PMU itself
924      */
925     return 0;
926 }
927 
swinc_ns_per(uint64_t ignored)928 static int64_t swinc_ns_per(uint64_t ignored)
929 {
930     return -1;
931 }
932 
933 /*
934  * Return the underlying cycle count for the PMU cycle counters. If we're in
935  * usermode, simply return 0.
936  */
cycles_get_count(CPUARMState * env)937 static uint64_t cycles_get_count(CPUARMState *env)
938 {
939 #ifndef CONFIG_USER_ONLY
940     return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
941                    ARM_CPU_FREQ, NANOSECONDS_PER_SECOND);
942 #else
943     return cpu_get_host_ticks();
944 #endif
945 }
946 
947 #ifndef CONFIG_USER_ONLY
cycles_ns_per(uint64_t cycles)948 static int64_t cycles_ns_per(uint64_t cycles)
949 {
950     return (ARM_CPU_FREQ / NANOSECONDS_PER_SECOND) * cycles;
951 }
952 
instructions_supported(CPUARMState * env)953 static bool instructions_supported(CPUARMState *env)
954 {
955     /* Precise instruction counting */
956     return icount_enabled() == ICOUNT_PRECISE;
957 }
958 
instructions_get_count(CPUARMState * env)959 static uint64_t instructions_get_count(CPUARMState *env)
960 {
961     assert(icount_enabled() == ICOUNT_PRECISE);
962     return (uint64_t)icount_get_raw();
963 }
964 
instructions_ns_per(uint64_t icount)965 static int64_t instructions_ns_per(uint64_t icount)
966 {
967     assert(icount_enabled() == ICOUNT_PRECISE);
968     return icount_to_ns((int64_t)icount);
969 }
970 #endif
971 
pmuv3p1_events_supported(CPUARMState * env)972 static bool pmuv3p1_events_supported(CPUARMState *env)
973 {
974     /* For events which are supported in any v8.1 PMU */
975     return cpu_isar_feature(any_pmuv3p1, env_archcpu(env));
976 }
977 
pmuv3p4_events_supported(CPUARMState * env)978 static bool pmuv3p4_events_supported(CPUARMState *env)
979 {
980     /* For events which are supported in any v8.1 PMU */
981     return cpu_isar_feature(any_pmuv3p4, env_archcpu(env));
982 }
983 
zero_event_get_count(CPUARMState * env)984 static uint64_t zero_event_get_count(CPUARMState *env)
985 {
986     /* For events which on QEMU never fire, so their count is always zero */
987     return 0;
988 }
989 
zero_event_ns_per(uint64_t cycles)990 static int64_t zero_event_ns_per(uint64_t cycles)
991 {
992     /* An event which never fires can never overflow */
993     return -1;
994 }
995 
996 static const pm_event pm_events[] = {
997     { .number = 0x000, /* SW_INCR */
998       .supported = event_always_supported,
999       .get_count = swinc_get_count,
1000       .ns_per_count = swinc_ns_per,
1001     },
1002 #ifndef CONFIG_USER_ONLY
1003     { .number = 0x008, /* INST_RETIRED, Instruction architecturally executed */
1004       .supported = instructions_supported,
1005       .get_count = instructions_get_count,
1006       .ns_per_count = instructions_ns_per,
1007     },
1008     { .number = 0x011, /* CPU_CYCLES, Cycle */
1009       .supported = event_always_supported,
1010       .get_count = cycles_get_count,
1011       .ns_per_count = cycles_ns_per,
1012     },
1013 #endif
1014     { .number = 0x023, /* STALL_FRONTEND */
1015       .supported = pmuv3p1_events_supported,
1016       .get_count = zero_event_get_count,
1017       .ns_per_count = zero_event_ns_per,
1018     },
1019     { .number = 0x024, /* STALL_BACKEND */
1020       .supported = pmuv3p1_events_supported,
1021       .get_count = zero_event_get_count,
1022       .ns_per_count = zero_event_ns_per,
1023     },
1024     { .number = 0x03c, /* STALL */
1025       .supported = pmuv3p4_events_supported,
1026       .get_count = zero_event_get_count,
1027       .ns_per_count = zero_event_ns_per,
1028     },
1029 };
1030 
1031 /*
1032  * Note: Before increasing MAX_EVENT_ID beyond 0x3f into the 0x40xx range of
1033  * events (i.e. the statistical profiling extension), this implementation
1034  * should first be updated to something sparse instead of the current
1035  * supported_event_map[] array.
1036  */
1037 #define MAX_EVENT_ID 0x3c
1038 #define UNSUPPORTED_EVENT UINT16_MAX
1039 static uint16_t supported_event_map[MAX_EVENT_ID + 1];
1040 
1041 /*
1042  * Called upon CPU initialization to initialize PMCEID[01]_EL0 and build a map
1043  * of ARM event numbers to indices in our pm_events array.
1044  *
1045  * Note: Events in the 0x40XX range are not currently supported.
1046  */
pmu_init(ARMCPU * cpu)1047 void pmu_init(ARMCPU *cpu)
1048 {
1049     unsigned int i;
1050 
1051     /*
1052      * Empty supported_event_map and cpu->pmceid[01] before adding supported
1053      * events to them
1054      */
1055     for (i = 0; i < ARRAY_SIZE(supported_event_map); i++) {
1056         supported_event_map[i] = UNSUPPORTED_EVENT;
1057     }
1058     cpu->pmceid0 = 0;
1059     cpu->pmceid1 = 0;
1060 
1061     for (i = 0; i < ARRAY_SIZE(pm_events); i++) {
1062         const pm_event *cnt = &pm_events[i];
1063         assert(cnt->number <= MAX_EVENT_ID);
1064         /* We do not currently support events in the 0x40xx range */
1065         assert(cnt->number <= 0x3f);
1066 
1067         if (cnt->supported(&cpu->env)) {
1068             supported_event_map[cnt->number] = i;
1069             uint64_t event_mask = 1ULL << (cnt->number & 0x1f);
1070             if (cnt->number & 0x20) {
1071                 cpu->pmceid1 |= event_mask;
1072             } else {
1073                 cpu->pmceid0 |= event_mask;
1074             }
1075         }
1076     }
1077 }
1078 
1079 /*
1080  * Check at runtime whether a PMU event is supported for the current machine
1081  */
event_supported(uint16_t number)1082 static bool event_supported(uint16_t number)
1083 {
1084     if (number > MAX_EVENT_ID) {
1085         return false;
1086     }
1087     return supported_event_map[number] != UNSUPPORTED_EVENT;
1088 }
1089 
pmreg_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1090 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
1091                                    bool isread)
1092 {
1093     /*
1094      * Performance monitor registers user accessibility is controlled
1095      * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
1096      * trapping to EL2 or EL3 for other accesses.
1097      */
1098     int el = arm_current_el(env);
1099     uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
1100 
1101     if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
1102         return CP_ACCESS_TRAP;
1103     }
1104     if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
1105         return CP_ACCESS_TRAP_EL2;
1106     }
1107     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
1108         return CP_ACCESS_TRAP_EL3;
1109     }
1110 
1111     return CP_ACCESS_OK;
1112 }
1113 
pmreg_access_xevcntr(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1114 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env,
1115                                            const ARMCPRegInfo *ri,
1116                                            bool isread)
1117 {
1118     /* ER: event counter read trap control */
1119     if (arm_feature(env, ARM_FEATURE_V8)
1120         && arm_current_el(env) == 0
1121         && (env->cp15.c9_pmuserenr & (1 << 3)) != 0
1122         && isread) {
1123         return CP_ACCESS_OK;
1124     }
1125 
1126     return pmreg_access(env, ri, isread);
1127 }
1128 
pmreg_access_swinc(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1129 static CPAccessResult pmreg_access_swinc(CPUARMState *env,
1130                                          const ARMCPRegInfo *ri,
1131                                          bool isread)
1132 {
1133     /* SW: software increment write trap control */
1134     if (arm_feature(env, ARM_FEATURE_V8)
1135         && arm_current_el(env) == 0
1136         && (env->cp15.c9_pmuserenr & (1 << 1)) != 0
1137         && !isread) {
1138         return CP_ACCESS_OK;
1139     }
1140 
1141     return pmreg_access(env, ri, isread);
1142 }
1143 
pmreg_access_selr(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1144 static CPAccessResult pmreg_access_selr(CPUARMState *env,
1145                                         const ARMCPRegInfo *ri,
1146                                         bool isread)
1147 {
1148     /* ER: event counter read trap control */
1149     if (arm_feature(env, ARM_FEATURE_V8)
1150         && arm_current_el(env) == 0
1151         && (env->cp15.c9_pmuserenr & (1 << 3)) != 0) {
1152         return CP_ACCESS_OK;
1153     }
1154 
1155     return pmreg_access(env, ri, isread);
1156 }
1157 
pmreg_access_ccntr(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1158 static CPAccessResult pmreg_access_ccntr(CPUARMState *env,
1159                                          const ARMCPRegInfo *ri,
1160                                          bool isread)
1161 {
1162     /* CR: cycle counter read trap control */
1163     if (arm_feature(env, ARM_FEATURE_V8)
1164         && arm_current_el(env) == 0
1165         && (env->cp15.c9_pmuserenr & (1 << 2)) != 0
1166         && isread) {
1167         return CP_ACCESS_OK;
1168     }
1169 
1170     return pmreg_access(env, ri, isread);
1171 }
1172 
1173 /*
1174  * Bits in MDCR_EL2 and MDCR_EL3 which pmu_counter_enabled() looks at.
1175  * We use these to decide whether we need to wrap a write to MDCR_EL2
1176  * or MDCR_EL3 in pmu_op_start()/pmu_op_finish() calls.
1177  */
1178 #define MDCR_EL2_PMU_ENABLE_BITS \
1179     (MDCR_HPME | MDCR_HPMD | MDCR_HPMN | MDCR_HCCD | MDCR_HLP)
1180 #define MDCR_EL3_PMU_ENABLE_BITS (MDCR_SPME | MDCR_SCCD)
1181 
1182 /*
1183  * Returns true if the counter (pass 31 for PMCCNTR) should count events using
1184  * the current EL, security state, and register configuration.
1185  */
pmu_counter_enabled(CPUARMState * env,uint8_t counter)1186 static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
1187 {
1188     uint64_t filter;
1189     bool e, p, u, nsk, nsu, nsh, m;
1190     bool enabled, prohibited = false, filtered;
1191     bool secure = arm_is_secure(env);
1192     int el = arm_current_el(env);
1193     uint64_t mdcr_el2;
1194     uint8_t hpmn;
1195 
1196     /*
1197      * We might be called for M-profile cores where MDCR_EL2 doesn't
1198      * exist and arm_mdcr_el2_eff() will assert, so this early-exit check
1199      * must be before we read that value.
1200      */
1201     if (!arm_feature(env, ARM_FEATURE_PMU)) {
1202         return false;
1203     }
1204 
1205     mdcr_el2 = arm_mdcr_el2_eff(env);
1206     hpmn = mdcr_el2 & MDCR_HPMN;
1207 
1208     if (!arm_feature(env, ARM_FEATURE_EL2) ||
1209             (counter < hpmn || counter == 31)) {
1210         e = env->cp15.c9_pmcr & PMCRE;
1211     } else {
1212         e = mdcr_el2 & MDCR_HPME;
1213     }
1214     enabled = e && (env->cp15.c9_pmcnten & (1 << counter));
1215 
1216     /* Is event counting prohibited? */
1217     if (el == 2 && (counter < hpmn || counter == 31)) {
1218         prohibited = mdcr_el2 & MDCR_HPMD;
1219     }
1220     if (secure) {
1221         prohibited = prohibited || !(env->cp15.mdcr_el3 & MDCR_SPME);
1222     }
1223 
1224     if (counter == 31) {
1225         /*
1226          * The cycle counter defaults to running. PMCR.DP says "disable
1227          * the cycle counter when event counting is prohibited".
1228          * Some MDCR bits disable the cycle counter specifically.
1229          */
1230         prohibited = prohibited && env->cp15.c9_pmcr & PMCRDP;
1231         if (cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
1232             if (secure) {
1233                 prohibited = prohibited || (env->cp15.mdcr_el3 & MDCR_SCCD);
1234             }
1235             if (el == 2) {
1236                 prohibited = prohibited || (mdcr_el2 & MDCR_HCCD);
1237             }
1238         }
1239     }
1240 
1241     if (counter == 31) {
1242         filter = env->cp15.pmccfiltr_el0;
1243     } else {
1244         filter = env->cp15.c14_pmevtyper[counter];
1245     }
1246 
1247     p   = filter & PMXEVTYPER_P;
1248     u   = filter & PMXEVTYPER_U;
1249     nsk = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSK);
1250     nsu = arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_NSU);
1251     nsh = arm_feature(env, ARM_FEATURE_EL2) && (filter & PMXEVTYPER_NSH);
1252     m   = arm_el_is_aa64(env, 1) &&
1253               arm_feature(env, ARM_FEATURE_EL3) && (filter & PMXEVTYPER_M);
1254 
1255     if (el == 0) {
1256         filtered = secure ? u : u != nsu;
1257     } else if (el == 1) {
1258         filtered = secure ? p : p != nsk;
1259     } else if (el == 2) {
1260         filtered = !nsh;
1261     } else { /* EL3 */
1262         filtered = m != p;
1263     }
1264 
1265     if (counter != 31) {
1266         /*
1267          * If not checking PMCCNTR, ensure the counter is setup to an event we
1268          * support
1269          */
1270         uint16_t event = filter & PMXEVTYPER_EVTCOUNT;
1271         if (!event_supported(event)) {
1272             return false;
1273         }
1274     }
1275 
1276     return enabled && !prohibited && !filtered;
1277 }
1278 
pmu_update_irq(CPUARMState * env)1279 static void pmu_update_irq(CPUARMState *env)
1280 {
1281     ARMCPU *cpu = env_archcpu(env);
1282     qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) &&
1283             (env->cp15.c9_pminten & env->cp15.c9_pmovsr));
1284 }
1285 
pmccntr_clockdiv_enabled(CPUARMState * env)1286 static bool pmccntr_clockdiv_enabled(CPUARMState *env)
1287 {
1288     /*
1289      * Return true if the clock divider is enabled and the cycle counter
1290      * is supposed to tick only once every 64 clock cycles. This is
1291      * controlled by PMCR.D, but if PMCR.LC is set to enable the long
1292      * (64-bit) cycle counter PMCR.D has no effect.
1293      */
1294     return (env->cp15.c9_pmcr & (PMCRD | PMCRLC)) == PMCRD;
1295 }
1296 
pmevcntr_is_64_bit(CPUARMState * env,int counter)1297 static bool pmevcntr_is_64_bit(CPUARMState *env, int counter)
1298 {
1299     /* Return true if the specified event counter is configured to be 64 bit */
1300 
1301     /* This isn't intended to be used with the cycle counter */
1302     assert(counter < 31);
1303 
1304     if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
1305         return false;
1306     }
1307 
1308     if (arm_feature(env, ARM_FEATURE_EL2)) {
1309         /*
1310          * MDCR_EL2.HLP still applies even when EL2 is disabled in the
1311          * current security state, so we don't use arm_mdcr_el2_eff() here.
1312          */
1313         bool hlp = env->cp15.mdcr_el2 & MDCR_HLP;
1314         int hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
1315 
1316         if (counter >= hpmn) {
1317             return hlp;
1318         }
1319     }
1320     return env->cp15.c9_pmcr & PMCRLP;
1321 }
1322 
1323 /*
1324  * Ensure c15_ccnt is the guest-visible count so that operations such as
1325  * enabling/disabling the counter or filtering, modifying the count itself,
1326  * etc. can be done logically. This is essentially a no-op if the counter is
1327  * not enabled at the time of the call.
1328  */
pmccntr_op_start(CPUARMState * env)1329 static void pmccntr_op_start(CPUARMState *env)
1330 {
1331     uint64_t cycles = cycles_get_count(env);
1332 
1333     if (pmu_counter_enabled(env, 31)) {
1334         uint64_t eff_cycles = cycles;
1335         if (pmccntr_clockdiv_enabled(env)) {
1336             eff_cycles /= 64;
1337         }
1338 
1339         uint64_t new_pmccntr = eff_cycles - env->cp15.c15_ccnt_delta;
1340 
1341         uint64_t overflow_mask = env->cp15.c9_pmcr & PMCRLC ? \
1342                                  1ull << 63 : 1ull << 31;
1343         if (env->cp15.c15_ccnt & ~new_pmccntr & overflow_mask) {
1344             env->cp15.c9_pmovsr |= (1ULL << 31);
1345             pmu_update_irq(env);
1346         }
1347 
1348         env->cp15.c15_ccnt = new_pmccntr;
1349     }
1350     env->cp15.c15_ccnt_delta = cycles;
1351 }
1352 
1353 /*
1354  * If PMCCNTR is enabled, recalculate the delta between the clock and the
1355  * guest-visible count. A call to pmccntr_op_finish should follow every call to
1356  * pmccntr_op_start.
1357  */
pmccntr_op_finish(CPUARMState * env)1358 static void pmccntr_op_finish(CPUARMState *env)
1359 {
1360     if (pmu_counter_enabled(env, 31)) {
1361 #ifndef CONFIG_USER_ONLY
1362         /* Calculate when the counter will next overflow */
1363         uint64_t remaining_cycles = -env->cp15.c15_ccnt;
1364         if (!(env->cp15.c9_pmcr & PMCRLC)) {
1365             remaining_cycles = (uint32_t)remaining_cycles;
1366         }
1367         int64_t overflow_in = cycles_ns_per(remaining_cycles);
1368 
1369         if (overflow_in > 0) {
1370             int64_t overflow_at;
1371 
1372             if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
1373                                  overflow_in, &overflow_at)) {
1374                 ARMCPU *cpu = env_archcpu(env);
1375                 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
1376             }
1377         }
1378 #endif
1379 
1380         uint64_t prev_cycles = env->cp15.c15_ccnt_delta;
1381         if (pmccntr_clockdiv_enabled(env)) {
1382             prev_cycles /= 64;
1383         }
1384         env->cp15.c15_ccnt_delta = prev_cycles - env->cp15.c15_ccnt;
1385     }
1386 }
1387 
pmevcntr_op_start(CPUARMState * env,uint8_t counter)1388 static void pmevcntr_op_start(CPUARMState *env, uint8_t counter)
1389 {
1390 
1391     uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
1392     uint64_t count = 0;
1393     if (event_supported(event)) {
1394         uint16_t event_idx = supported_event_map[event];
1395         count = pm_events[event_idx].get_count(env);
1396     }
1397 
1398     if (pmu_counter_enabled(env, counter)) {
1399         uint64_t new_pmevcntr = count - env->cp15.c14_pmevcntr_delta[counter];
1400         uint64_t overflow_mask = pmevcntr_is_64_bit(env, counter) ?
1401             1ULL << 63 : 1ULL << 31;
1402 
1403         if (env->cp15.c14_pmevcntr[counter] & ~new_pmevcntr & overflow_mask) {
1404             env->cp15.c9_pmovsr |= (1 << counter);
1405             pmu_update_irq(env);
1406         }
1407         env->cp15.c14_pmevcntr[counter] = new_pmevcntr;
1408     }
1409     env->cp15.c14_pmevcntr_delta[counter] = count;
1410 }
1411 
pmevcntr_op_finish(CPUARMState * env,uint8_t counter)1412 static void pmevcntr_op_finish(CPUARMState *env, uint8_t counter)
1413 {
1414     if (pmu_counter_enabled(env, counter)) {
1415 #ifndef CONFIG_USER_ONLY
1416         uint16_t event = env->cp15.c14_pmevtyper[counter] & PMXEVTYPER_EVTCOUNT;
1417         uint16_t event_idx = supported_event_map[event];
1418         uint64_t delta = -(env->cp15.c14_pmevcntr[counter] + 1);
1419         int64_t overflow_in;
1420 
1421         if (!pmevcntr_is_64_bit(env, counter)) {
1422             delta = (uint32_t)delta;
1423         }
1424         overflow_in = pm_events[event_idx].ns_per_count(delta);
1425 
1426         if (overflow_in > 0) {
1427             int64_t overflow_at;
1428 
1429             if (!sadd64_overflow(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
1430                                  overflow_in, &overflow_at)) {
1431                 ARMCPU *cpu = env_archcpu(env);
1432                 timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
1433             }
1434         }
1435 #endif
1436 
1437         env->cp15.c14_pmevcntr_delta[counter] -=
1438             env->cp15.c14_pmevcntr[counter];
1439     }
1440 }
1441 
pmu_op_start(CPUARMState * env)1442 void pmu_op_start(CPUARMState *env)
1443 {
1444     unsigned int i;
1445     pmccntr_op_start(env);
1446     for (i = 0; i < pmu_num_counters(env); i++) {
1447         pmevcntr_op_start(env, i);
1448     }
1449 }
1450 
pmu_op_finish(CPUARMState * env)1451 void pmu_op_finish(CPUARMState *env)
1452 {
1453     unsigned int i;
1454     pmccntr_op_finish(env);
1455     for (i = 0; i < pmu_num_counters(env); i++) {
1456         pmevcntr_op_finish(env, i);
1457     }
1458 }
1459 
pmu_pre_el_change(ARMCPU * cpu,void * ignored)1460 void pmu_pre_el_change(ARMCPU *cpu, void *ignored)
1461 {
1462     pmu_op_start(&cpu->env);
1463 }
1464 
pmu_post_el_change(ARMCPU * cpu,void * ignored)1465 void pmu_post_el_change(ARMCPU *cpu, void *ignored)
1466 {
1467     pmu_op_finish(&cpu->env);
1468 }
1469 
arm_pmu_timer_cb(void * opaque)1470 void arm_pmu_timer_cb(void *opaque)
1471 {
1472     ARMCPU *cpu = opaque;
1473 
1474     /*
1475      * Update all the counter values based on the current underlying counts,
1476      * triggering interrupts to be raised, if necessary. pmu_op_finish() also
1477      * has the effect of setting the cpu->pmu_timer to the next earliest time a
1478      * counter may expire.
1479      */
1480     pmu_op_start(&cpu->env);
1481     pmu_op_finish(&cpu->env);
1482 }
1483 
pmcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1484 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1485                        uint64_t value)
1486 {
1487     pmu_op_start(env);
1488 
1489     if (value & PMCRC) {
1490         /* The counter has been reset */
1491         env->cp15.c15_ccnt = 0;
1492     }
1493 
1494     if (value & PMCRP) {
1495         unsigned int i;
1496         for (i = 0; i < pmu_num_counters(env); i++) {
1497             env->cp15.c14_pmevcntr[i] = 0;
1498         }
1499     }
1500 
1501     env->cp15.c9_pmcr &= ~PMCR_WRITABLE_MASK;
1502     env->cp15.c9_pmcr |= (value & PMCR_WRITABLE_MASK);
1503 
1504     pmu_op_finish(env);
1505 }
1506 
pmcr_read(CPUARMState * env,const ARMCPRegInfo * ri)1507 static uint64_t pmcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1508 {
1509     uint64_t pmcr = env->cp15.c9_pmcr;
1510 
1511     /*
1512      * If EL2 is implemented and enabled for the current security state, reads
1513      * of PMCR.N from EL1 or EL0 return the value of MDCR_EL2.HPMN or HDCR.HPMN.
1514      */
1515     if (arm_current_el(env) <= 1 && arm_is_el2_enabled(env)) {
1516         pmcr &= ~PMCRN_MASK;
1517         pmcr |= (env->cp15.mdcr_el2 & MDCR_HPMN) << PMCRN_SHIFT;
1518     }
1519 
1520     return pmcr;
1521 }
1522 
pmswinc_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1523 static void pmswinc_write(CPUARMState *env, const ARMCPRegInfo *ri,
1524                           uint64_t value)
1525 {
1526     unsigned int i;
1527     uint64_t overflow_mask, new_pmswinc;
1528 
1529     for (i = 0; i < pmu_num_counters(env); i++) {
1530         /* Increment a counter's count iff: */
1531         if ((value & (1 << i)) && /* counter's bit is set */
1532                 /* counter is enabled and not filtered */
1533                 pmu_counter_enabled(env, i) &&
1534                 /* counter is SW_INCR */
1535                 (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) {
1536             pmevcntr_op_start(env, i);
1537 
1538             /*
1539              * Detect if this write causes an overflow since we can't predict
1540              * PMSWINC overflows like we can for other events
1541              */
1542             new_pmswinc = env->cp15.c14_pmevcntr[i] + 1;
1543 
1544             overflow_mask = pmevcntr_is_64_bit(env, i) ?
1545                 1ULL << 63 : 1ULL << 31;
1546 
1547             if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & overflow_mask) {
1548                 env->cp15.c9_pmovsr |= (1 << i);
1549                 pmu_update_irq(env);
1550             }
1551 
1552             env->cp15.c14_pmevcntr[i] = new_pmswinc;
1553 
1554             pmevcntr_op_finish(env, i);
1555         }
1556     }
1557 }
1558 
pmccntr_read(CPUARMState * env,const ARMCPRegInfo * ri)1559 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1560 {
1561     uint64_t ret;
1562     pmccntr_op_start(env);
1563     ret = env->cp15.c15_ccnt;
1564     pmccntr_op_finish(env);
1565     return ret;
1566 }
1567 
pmselr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1568 static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1569                          uint64_t value)
1570 {
1571     /*
1572      * The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
1573      * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
1574      * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
1575      * accessed.
1576      */
1577     env->cp15.c9_pmselr = value & 0x1f;
1578 }
1579 
pmccntr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1580 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1581                         uint64_t value)
1582 {
1583     pmccntr_op_start(env);
1584     env->cp15.c15_ccnt = value;
1585     pmccntr_op_finish(env);
1586 }
1587 
pmccntr_write32(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1588 static void pmccntr_write32(CPUARMState *env, const ARMCPRegInfo *ri,
1589                             uint64_t value)
1590 {
1591     uint64_t cur_val = pmccntr_read(env, NULL);
1592 
1593     pmccntr_write(env, ri, deposit64(cur_val, 0, 32, value));
1594 }
1595 
pmccfiltr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1596 static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1597                             uint64_t value)
1598 {
1599     pmccntr_op_start(env);
1600     env->cp15.pmccfiltr_el0 = value & PMCCFILTR_EL0;
1601     pmccntr_op_finish(env);
1602 }
1603 
pmccfiltr_write_a32(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1604 static void pmccfiltr_write_a32(CPUARMState *env, const ARMCPRegInfo *ri,
1605                             uint64_t value)
1606 {
1607     pmccntr_op_start(env);
1608     /* M is not accessible from AArch32 */
1609     env->cp15.pmccfiltr_el0 = (env->cp15.pmccfiltr_el0 & PMCCFILTR_M) |
1610         (value & PMCCFILTR);
1611     pmccntr_op_finish(env);
1612 }
1613 
pmccfiltr_read_a32(CPUARMState * env,const ARMCPRegInfo * ri)1614 static uint64_t pmccfiltr_read_a32(CPUARMState *env, const ARMCPRegInfo *ri)
1615 {
1616     /* M is not visible in AArch32 */
1617     return env->cp15.pmccfiltr_el0 & PMCCFILTR;
1618 }
1619 
pmcntenset_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1620 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1621                             uint64_t value)
1622 {
1623     pmu_op_start(env);
1624     value &= pmu_counter_mask(env);
1625     env->cp15.c9_pmcnten |= value;
1626     pmu_op_finish(env);
1627 }
1628 
pmcntenclr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1629 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1630                              uint64_t value)
1631 {
1632     pmu_op_start(env);
1633     value &= pmu_counter_mask(env);
1634     env->cp15.c9_pmcnten &= ~value;
1635     pmu_op_finish(env);
1636 }
1637 
pmovsr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1638 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1639                          uint64_t value)
1640 {
1641     value &= pmu_counter_mask(env);
1642     env->cp15.c9_pmovsr &= ~value;
1643     pmu_update_irq(env);
1644 }
1645 
pmovsset_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1646 static void pmovsset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1647                          uint64_t value)
1648 {
1649     value &= pmu_counter_mask(env);
1650     env->cp15.c9_pmovsr |= value;
1651     pmu_update_irq(env);
1652 }
1653 
pmevtyper_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value,const uint8_t counter)1654 static void pmevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1655                              uint64_t value, const uint8_t counter)
1656 {
1657     if (counter == 31) {
1658         pmccfiltr_write(env, ri, value);
1659     } else if (counter < pmu_num_counters(env)) {
1660         pmevcntr_op_start(env, counter);
1661 
1662         /*
1663          * If this counter's event type is changing, store the current
1664          * underlying count for the new type in c14_pmevcntr_delta[counter] so
1665          * pmevcntr_op_finish has the correct baseline when it converts back to
1666          * a delta.
1667          */
1668         uint16_t old_event = env->cp15.c14_pmevtyper[counter] &
1669             PMXEVTYPER_EVTCOUNT;
1670         uint16_t new_event = value & PMXEVTYPER_EVTCOUNT;
1671         if (old_event != new_event) {
1672             uint64_t count = 0;
1673             if (event_supported(new_event)) {
1674                 uint16_t event_idx = supported_event_map[new_event];
1675                 count = pm_events[event_idx].get_count(env);
1676             }
1677             env->cp15.c14_pmevcntr_delta[counter] = count;
1678         }
1679 
1680         env->cp15.c14_pmevtyper[counter] = value & PMXEVTYPER_MASK;
1681         pmevcntr_op_finish(env, counter);
1682     }
1683     /*
1684      * Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
1685      * PMSELR value is equal to or greater than the number of implemented
1686      * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
1687      */
1688 }
1689 
pmevtyper_read(CPUARMState * env,const ARMCPRegInfo * ri,const uint8_t counter)1690 static uint64_t pmevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri,
1691                                const uint8_t counter)
1692 {
1693     if (counter == 31) {
1694         return env->cp15.pmccfiltr_el0;
1695     } else if (counter < pmu_num_counters(env)) {
1696         return env->cp15.c14_pmevtyper[counter];
1697     } else {
1698       /*
1699        * We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
1700        * are CONSTRAINED UNPREDICTABLE. See comments in pmevtyper_write().
1701        */
1702         return 0;
1703     }
1704 }
1705 
pmevtyper_writefn(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1706 static void pmevtyper_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
1707                               uint64_t value)
1708 {
1709     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1710     pmevtyper_write(env, ri, value, counter);
1711 }
1712 
pmevtyper_rawwrite(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1713 static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
1714                                uint64_t value)
1715 {
1716     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1717     env->cp15.c14_pmevtyper[counter] = value;
1718 
1719     /*
1720      * pmevtyper_rawwrite is called between a pair of pmu_op_start and
1721      * pmu_op_finish calls when loading saved state for a migration. Because
1722      * we're potentially updating the type of event here, the value written to
1723      * c14_pmevcntr_delta by the preceding pmu_op_start call may be for a
1724      * different counter type. Therefore, we need to set this value to the
1725      * current count for the counter type we're writing so that pmu_op_finish
1726      * has the correct count for its calculation.
1727      */
1728     uint16_t event = value & PMXEVTYPER_EVTCOUNT;
1729     if (event_supported(event)) {
1730         uint16_t event_idx = supported_event_map[event];
1731         env->cp15.c14_pmevcntr_delta[counter] =
1732             pm_events[event_idx].get_count(env);
1733     }
1734 }
1735 
pmevtyper_readfn(CPUARMState * env,const ARMCPRegInfo * ri)1736 static uint64_t pmevtyper_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
1737 {
1738     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1739     return pmevtyper_read(env, ri, counter);
1740 }
1741 
pmxevtyper_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1742 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
1743                              uint64_t value)
1744 {
1745     pmevtyper_write(env, ri, value, env->cp15.c9_pmselr & 31);
1746 }
1747 
pmxevtyper_read(CPUARMState * env,const ARMCPRegInfo * ri)1748 static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
1749 {
1750     return pmevtyper_read(env, ri, env->cp15.c9_pmselr & 31);
1751 }
1752 
pmevcntr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value,uint8_t counter)1753 static void pmevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1754                              uint64_t value, uint8_t counter)
1755 {
1756     if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
1757         /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */
1758         value &= MAKE_64BIT_MASK(0, 32);
1759     }
1760     if (counter < pmu_num_counters(env)) {
1761         pmevcntr_op_start(env, counter);
1762         env->cp15.c14_pmevcntr[counter] = value;
1763         pmevcntr_op_finish(env, counter);
1764     }
1765     /*
1766      * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
1767      * are CONSTRAINED UNPREDICTABLE.
1768      */
1769 }
1770 
pmevcntr_read(CPUARMState * env,const ARMCPRegInfo * ri,uint8_t counter)1771 static uint64_t pmevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri,
1772                               uint8_t counter)
1773 {
1774     if (counter < pmu_num_counters(env)) {
1775         uint64_t ret;
1776         pmevcntr_op_start(env, counter);
1777         ret = env->cp15.c14_pmevcntr[counter];
1778         pmevcntr_op_finish(env, counter);
1779         if (!cpu_isar_feature(any_pmuv3p5, env_archcpu(env))) {
1780             /* Before FEAT_PMUv3p5, top 32 bits of event counters are RES0 */
1781             ret &= MAKE_64BIT_MASK(0, 32);
1782         }
1783         return ret;
1784     } else {
1785       /*
1786        * We opt to behave as a RAZ/WI when attempts to access PM[X]EVCNTR
1787        * are CONSTRAINED UNPREDICTABLE.
1788        */
1789         return 0;
1790     }
1791 }
1792 
pmevcntr_writefn(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1793 static void pmevcntr_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
1794                              uint64_t value)
1795 {
1796     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1797     pmevcntr_write(env, ri, value, counter);
1798 }
1799 
pmevcntr_readfn(CPUARMState * env,const ARMCPRegInfo * ri)1800 static uint64_t pmevcntr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
1801 {
1802     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1803     return pmevcntr_read(env, ri, counter);
1804 }
1805 
pmevcntr_rawwrite(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1806 static void pmevcntr_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
1807                              uint64_t value)
1808 {
1809     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1810     assert(counter < pmu_num_counters(env));
1811     env->cp15.c14_pmevcntr[counter] = value;
1812     pmevcntr_write(env, ri, value, counter);
1813 }
1814 
pmevcntr_rawread(CPUARMState * env,const ARMCPRegInfo * ri)1815 static uint64_t pmevcntr_rawread(CPUARMState *env, const ARMCPRegInfo *ri)
1816 {
1817     uint8_t counter = ((ri->crm & 3) << 3) | (ri->opc2 & 7);
1818     assert(counter < pmu_num_counters(env));
1819     return env->cp15.c14_pmevcntr[counter];
1820 }
1821 
pmxevcntr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1822 static void pmxevcntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1823                              uint64_t value)
1824 {
1825     pmevcntr_write(env, ri, value, env->cp15.c9_pmselr & 31);
1826 }
1827 
pmxevcntr_read(CPUARMState * env,const ARMCPRegInfo * ri)1828 static uint64_t pmxevcntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1829 {
1830     return pmevcntr_read(env, ri, env->cp15.c9_pmselr & 31);
1831 }
1832 
pmuserenr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1833 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1834                             uint64_t value)
1835 {
1836     if (arm_feature(env, ARM_FEATURE_V8)) {
1837         env->cp15.c9_pmuserenr = value & 0xf;
1838     } else {
1839         env->cp15.c9_pmuserenr = value & 1;
1840     }
1841 }
1842 
pmintenset_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1843 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
1844                              uint64_t value)
1845 {
1846     /* We have no event counters so only the C bit can be changed */
1847     value &= pmu_counter_mask(env);
1848     env->cp15.c9_pminten |= value;
1849     pmu_update_irq(env);
1850 }
1851 
pmintenclr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1852 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1853                              uint64_t value)
1854 {
1855     value &= pmu_counter_mask(env);
1856     env->cp15.c9_pminten &= ~value;
1857     pmu_update_irq(env);
1858 }
1859 
vbar_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1860 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
1861                        uint64_t value)
1862 {
1863     /*
1864      * Note that even though the AArch64 view of this register has bits
1865      * [10:0] all RES0 we can only mask the bottom 5, to comply with the
1866      * architectural requirements for bits which are RES0 only in some
1867      * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
1868      * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
1869      */
1870     raw_write(env, ri, value & ~0x1FULL);
1871 }
1872 
scr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)1873 static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1874 {
1875     /* Begin with base v8.0 state.  */
1876     uint64_t valid_mask = 0x3fff;
1877     ARMCPU *cpu = env_archcpu(env);
1878     uint64_t changed;
1879 
1880     /*
1881      * Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always
1882      * passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64.
1883      * Instead, choose the format based on the mode of EL3.
1884      */
1885     if (arm_el_is_aa64(env, 3)) {
1886         value |= SCR_FW | SCR_AW;      /* RES1 */
1887         valid_mask &= ~SCR_NET;        /* RES0 */
1888 
1889         if (!cpu_isar_feature(aa64_aa32_el1, cpu) &&
1890             !cpu_isar_feature(aa64_aa32_el2, cpu)) {
1891             value |= SCR_RW;           /* RAO/WI */
1892         }
1893         if (cpu_isar_feature(aa64_ras, cpu)) {
1894             valid_mask |= SCR_TERR;
1895         }
1896         if (cpu_isar_feature(aa64_lor, cpu)) {
1897             valid_mask |= SCR_TLOR;
1898         }
1899         if (cpu_isar_feature(aa64_pauth, cpu)) {
1900             valid_mask |= SCR_API | SCR_APK;
1901         }
1902         if (cpu_isar_feature(aa64_sel2, cpu)) {
1903             valid_mask |= SCR_EEL2;
1904         } else if (cpu_isar_feature(aa64_rme, cpu)) {
1905             /* With RME and without SEL2, NS is RES1 (R_GSWWH, I_DJJQJ). */
1906             value |= SCR_NS;
1907         }
1908         if (cpu_isar_feature(aa64_mte, cpu)) {
1909             valid_mask |= SCR_ATA;
1910         }
1911         if (cpu_isar_feature(aa64_scxtnum, cpu)) {
1912             valid_mask |= SCR_ENSCXT;
1913         }
1914         if (cpu_isar_feature(aa64_doublefault, cpu)) {
1915             valid_mask |= SCR_EASE | SCR_NMEA;
1916         }
1917         if (cpu_isar_feature(aa64_sme, cpu)) {
1918             valid_mask |= SCR_ENTP2;
1919         }
1920         if (cpu_isar_feature(aa64_hcx, cpu)) {
1921             valid_mask |= SCR_HXEN;
1922         }
1923         if (cpu_isar_feature(aa64_fgt, cpu)) {
1924             valid_mask |= SCR_FGTEN;
1925         }
1926         if (cpu_isar_feature(aa64_rme, cpu)) {
1927             valid_mask |= SCR_NSE | SCR_GPF;
1928         }
1929         if (cpu_isar_feature(aa64_ecv, cpu)) {
1930             valid_mask |= SCR_ECVEN;
1931         }
1932     } else {
1933         valid_mask &= ~(SCR_RW | SCR_ST);
1934         if (cpu_isar_feature(aa32_ras, cpu)) {
1935             valid_mask |= SCR_TERR;
1936         }
1937     }
1938 
1939     if (!arm_feature(env, ARM_FEATURE_EL2)) {
1940         valid_mask &= ~SCR_HCE;
1941 
1942         /*
1943          * On ARMv7, SMD (or SCD as it is called in v7) is only
1944          * supported if EL2 exists. The bit is UNK/SBZP when
1945          * EL2 is unavailable. In QEMU ARMv7, we force it to always zero
1946          * when EL2 is unavailable.
1947          * On ARMv8, this bit is always available.
1948          */
1949         if (arm_feature(env, ARM_FEATURE_V7) &&
1950             !arm_feature(env, ARM_FEATURE_V8)) {
1951             valid_mask &= ~SCR_SMD;
1952         }
1953     }
1954 
1955     /* Clear all-context RES0 bits.  */
1956     value &= valid_mask;
1957     changed = env->cp15.scr_el3 ^ value;
1958     env->cp15.scr_el3 = value;
1959 
1960     /*
1961      * If SCR_EL3.{NS,NSE} changes, i.e. change of security state,
1962      * we must invalidate all TLBs below EL3.
1963      */
1964     if (changed & (SCR_NS | SCR_NSE)) {
1965         tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 |
1966                                            ARMMMUIdxBit_E20_0 |
1967                                            ARMMMUIdxBit_E10_1 |
1968                                            ARMMMUIdxBit_E20_2 |
1969                                            ARMMMUIdxBit_E10_1_PAN |
1970                                            ARMMMUIdxBit_E20_2_PAN |
1971                                            ARMMMUIdxBit_E2));
1972     }
1973 }
1974 
scr_reset(CPUARMState * env,const ARMCPRegInfo * ri)1975 static void scr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1976 {
1977     /*
1978      * scr_write will set the RES1 bits on an AArch64-only CPU.
1979      * The reset value will be 0x30 on an AArch64-only CPU and 0 otherwise.
1980      */
1981     scr_write(env, ri, 0);
1982 }
1983 
access_tid4(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)1984 static CPAccessResult access_tid4(CPUARMState *env,
1985                                   const ARMCPRegInfo *ri,
1986                                   bool isread)
1987 {
1988     if (arm_current_el(env) == 1 &&
1989         (arm_hcr_el2_eff(env) & (HCR_TID2 | HCR_TID4))) {
1990         return CP_ACCESS_TRAP_EL2;
1991     }
1992 
1993     return CP_ACCESS_OK;
1994 }
1995 
ccsidr_read(CPUARMState * env,const ARMCPRegInfo * ri)1996 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1997 {
1998     ARMCPU *cpu = env_archcpu(env);
1999 
2000     /*
2001      * Acquire the CSSELR index from the bank corresponding to the CCSIDR
2002      * bank
2003      */
2004     uint32_t index = A32_BANKED_REG_GET(env, csselr,
2005                                         ri->secure & ARM_CP_SECSTATE_S);
2006 
2007     return cpu->ccsidr[index];
2008 }
2009 
csselr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2010 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2011                          uint64_t value)
2012 {
2013     raw_write(env, ri, value & 0xf);
2014 }
2015 
isr_read(CPUARMState * env,const ARMCPRegInfo * ri)2016 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
2017 {
2018     CPUState *cs = env_cpu(env);
2019     bool el1 = arm_current_el(env) == 1;
2020     uint64_t hcr_el2 = el1 ? arm_hcr_el2_eff(env) : 0;
2021     uint64_t ret = 0;
2022 
2023     if (hcr_el2 & HCR_IMO) {
2024         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
2025             ret |= CPSR_I;
2026         }
2027         if (cs->interrupt_request & CPU_INTERRUPT_VINMI) {
2028             ret |= ISR_IS;
2029             ret |= CPSR_I;
2030         }
2031     } else {
2032         if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
2033             ret |= CPSR_I;
2034         }
2035 
2036         if (cs->interrupt_request & CPU_INTERRUPT_NMI) {
2037             ret |= ISR_IS;
2038             ret |= CPSR_I;
2039         }
2040     }
2041 
2042     if (hcr_el2 & HCR_FMO) {
2043         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
2044             ret |= CPSR_F;
2045         }
2046         if (cs->interrupt_request & CPU_INTERRUPT_VFNMI) {
2047             ret |= ISR_FS;
2048             ret |= CPSR_F;
2049         }
2050     } else {
2051         if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
2052             ret |= CPSR_F;
2053         }
2054     }
2055 
2056     if (hcr_el2 & HCR_AMO) {
2057         if (cs->interrupt_request & CPU_INTERRUPT_VSERR) {
2058             ret |= CPSR_A;
2059         }
2060     }
2061 
2062     return ret;
2063 }
2064 
access_aa64_tid1(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2065 static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri,
2066                                        bool isread)
2067 {
2068     if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) {
2069         return CP_ACCESS_TRAP_EL2;
2070     }
2071 
2072     return CP_ACCESS_OK;
2073 }
2074 
access_aa32_tid1(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2075 static CPAccessResult access_aa32_tid1(CPUARMState *env, const ARMCPRegInfo *ri,
2076                                        bool isread)
2077 {
2078     if (arm_feature(env, ARM_FEATURE_V8)) {
2079         return access_aa64_tid1(env, ri, isread);
2080     }
2081 
2082     return CP_ACCESS_OK;
2083 }
2084 
2085 static const ARMCPRegInfo v7_cp_reginfo[] = {
2086     /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
2087     { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
2088       .access = PL1_W, .type = ARM_CP_NOP },
2089     /*
2090      * Performance monitors are implementation defined in v7,
2091      * but with an ARM recommended set of registers, which we
2092      * follow.
2093      *
2094      * Performance registers fall into three categories:
2095      *  (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
2096      *  (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
2097      *  (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
2098      * For the cases controlled by PMUSERENR we must set .access to PL0_RW
2099      * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
2100      */
2101     { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
2102       .access = PL0_RW, .type = ARM_CP_ALIAS | ARM_CP_IO,
2103       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
2104       .writefn = pmcntenset_write,
2105       .accessfn = pmreg_access,
2106       .fgt = FGT_PMCNTEN,
2107       .raw_writefn = raw_write },
2108     { .name = "PMCNTENSET_EL0", .state = ARM_CP_STATE_AA64, .type = ARM_CP_IO,
2109       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 1,
2110       .access = PL0_RW, .accessfn = pmreg_access,
2111       .fgt = FGT_PMCNTEN,
2112       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten), .resetvalue = 0,
2113       .writefn = pmcntenset_write, .raw_writefn = raw_write },
2114     { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
2115       .access = PL0_RW,
2116       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcnten),
2117       .accessfn = pmreg_access,
2118       .fgt = FGT_PMCNTEN,
2119       .writefn = pmcntenclr_write,
2120       .type = ARM_CP_ALIAS | ARM_CP_IO },
2121     { .name = "PMCNTENCLR_EL0", .state = ARM_CP_STATE_AA64,
2122       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 2,
2123       .access = PL0_RW, .accessfn = pmreg_access,
2124       .fgt = FGT_PMCNTEN,
2125       .type = ARM_CP_ALIAS | ARM_CP_IO,
2126       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
2127       .writefn = pmcntenclr_write },
2128     { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
2129       .access = PL0_RW, .type = ARM_CP_IO,
2130       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
2131       .accessfn = pmreg_access,
2132       .fgt = FGT_PMOVS,
2133       .writefn = pmovsr_write,
2134       .raw_writefn = raw_write },
2135     { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64,
2136       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3,
2137       .access = PL0_RW, .accessfn = pmreg_access,
2138       .fgt = FGT_PMOVS,
2139       .type = ARM_CP_ALIAS | ARM_CP_IO,
2140       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
2141       .writefn = pmovsr_write,
2142       .raw_writefn = raw_write },
2143     { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
2144       .access = PL0_W, .accessfn = pmreg_access_swinc,
2145       .fgt = FGT_PMSWINC_EL0,
2146       .type = ARM_CP_NO_RAW | ARM_CP_IO,
2147       .writefn = pmswinc_write },
2148     { .name = "PMSWINC_EL0", .state = ARM_CP_STATE_AA64,
2149       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 4,
2150       .access = PL0_W, .accessfn = pmreg_access_swinc,
2151       .fgt = FGT_PMSWINC_EL0,
2152       .type = ARM_CP_NO_RAW | ARM_CP_IO,
2153       .writefn = pmswinc_write },
2154     { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
2155       .access = PL0_RW, .type = ARM_CP_ALIAS,
2156       .fgt = FGT_PMSELR_EL0,
2157       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
2158       .accessfn = pmreg_access_selr, .writefn = pmselr_write,
2159       .raw_writefn = raw_write},
2160     { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
2161       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
2162       .access = PL0_RW, .accessfn = pmreg_access_selr,
2163       .fgt = FGT_PMSELR_EL0,
2164       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
2165       .writefn = pmselr_write, .raw_writefn = raw_write, },
2166     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
2167       .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
2168       .fgt = FGT_PMCCNTR_EL0,
2169       .readfn = pmccntr_read, .writefn = pmccntr_write32,
2170       .accessfn = pmreg_access_ccntr },
2171     { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
2172       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 0,
2173       .access = PL0_RW, .accessfn = pmreg_access_ccntr,
2174       .fgt = FGT_PMCCNTR_EL0,
2175       .type = ARM_CP_IO,
2176       .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt),
2177       .readfn = pmccntr_read, .writefn = pmccntr_write,
2178       .raw_readfn = raw_read, .raw_writefn = raw_write, },
2179     { .name = "PMCCFILTR", .cp = 15, .opc1 = 0, .crn = 14, .crm = 15, .opc2 = 7,
2180       .writefn = pmccfiltr_write_a32, .readfn = pmccfiltr_read_a32,
2181       .access = PL0_RW, .accessfn = pmreg_access,
2182       .fgt = FGT_PMCCFILTR_EL0,
2183       .type = ARM_CP_ALIAS | ARM_CP_IO,
2184       .resetvalue = 0, },
2185     { .name = "PMCCFILTR_EL0", .state = ARM_CP_STATE_AA64,
2186       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 15, .opc2 = 7,
2187       .writefn = pmccfiltr_write, .raw_writefn = raw_write,
2188       .access = PL0_RW, .accessfn = pmreg_access,
2189       .fgt = FGT_PMCCFILTR_EL0,
2190       .type = ARM_CP_IO,
2191       .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
2192       .resetvalue = 0, },
2193     { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
2194       .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2195       .accessfn = pmreg_access,
2196       .fgt = FGT_PMEVTYPERN_EL0,
2197       .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
2198     { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
2199       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
2200       .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2201       .accessfn = pmreg_access,
2202       .fgt = FGT_PMEVTYPERN_EL0,
2203       .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
2204     { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
2205       .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2206       .accessfn = pmreg_access_xevcntr,
2207       .fgt = FGT_PMEVCNTRN_EL0,
2208       .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
2209     { .name = "PMXEVCNTR_EL0", .state = ARM_CP_STATE_AA64,
2210       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 2,
2211       .access = PL0_RW, .type = ARM_CP_NO_RAW | ARM_CP_IO,
2212       .accessfn = pmreg_access_xevcntr,
2213       .fgt = FGT_PMEVCNTRN_EL0,
2214       .writefn = pmxevcntr_write, .readfn = pmxevcntr_read },
2215     { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
2216       .access = PL0_R | PL1_RW, .accessfn = access_tpm,
2217       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
2218       .resetvalue = 0,
2219       .writefn = pmuserenr_write, .raw_writefn = raw_write },
2220     { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
2221       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0,
2222       .access = PL0_R | PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
2223       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
2224       .resetvalue = 0,
2225       .writefn = pmuserenr_write, .raw_writefn = raw_write },
2226     { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
2227       .access = PL1_RW, .accessfn = access_tpm,
2228       .fgt = FGT_PMINTEN,
2229       .type = ARM_CP_ALIAS | ARM_CP_IO,
2230       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
2231       .resetvalue = 0,
2232       .writefn = pmintenset_write, .raw_writefn = raw_write },
2233     { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
2234       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
2235       .access = PL1_RW, .accessfn = access_tpm,
2236       .fgt = FGT_PMINTEN,
2237       .type = ARM_CP_IO,
2238       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2239       .writefn = pmintenset_write, .raw_writefn = raw_write,
2240       .resetvalue = 0x0 },
2241     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
2242       .access = PL1_RW, .accessfn = access_tpm,
2243       .fgt = FGT_PMINTEN,
2244       .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
2245       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2246       .writefn = pmintenclr_write, },
2247     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
2248       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
2249       .access = PL1_RW, .accessfn = access_tpm,
2250       .fgt = FGT_PMINTEN,
2251       .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
2252       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
2253       .writefn = pmintenclr_write },
2254     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
2255       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
2256       .access = PL1_R,
2257       .accessfn = access_tid4,
2258       .fgt = FGT_CCSIDR_EL1,
2259       .readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
2260     { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
2261       .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
2262       .access = PL1_RW,
2263       .accessfn = access_tid4,
2264       .fgt = FGT_CSSELR_EL1,
2265       .writefn = csselr_write, .resetvalue = 0,
2266       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
2267                              offsetof(CPUARMState, cp15.csselr_ns) } },
2268     /*
2269      * Auxiliary ID register: this actually has an IMPDEF value but for now
2270      * just RAZ for all cores:
2271      */
2272     { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
2273       .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
2274       .access = PL1_R, .type = ARM_CP_CONST,
2275       .accessfn = access_aa64_tid1,
2276       .fgt = FGT_AIDR_EL1,
2277       .resetvalue = 0 },
2278     /*
2279      * Auxiliary fault status registers: these also are IMPDEF, and we
2280      * choose to RAZ/WI for all cores.
2281      */
2282     { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
2283       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
2284       .access = PL1_RW, .accessfn = access_tvm_trvm,
2285       .fgt = FGT_AFSR0_EL1,
2286       .nv2_redirect_offset = 0x128 | NV2_REDIR_NV1,
2287       .type = ARM_CP_CONST, .resetvalue = 0 },
2288     { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
2289       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
2290       .access = PL1_RW, .accessfn = access_tvm_trvm,
2291       .fgt = FGT_AFSR1_EL1,
2292       .nv2_redirect_offset = 0x130 | NV2_REDIR_NV1,
2293       .type = ARM_CP_CONST, .resetvalue = 0 },
2294     /*
2295      * MAIR can just read-as-written because we don't implement caches
2296      * and so don't need to care about memory attributes.
2297      */
2298     { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
2299       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
2300       .access = PL1_RW, .accessfn = access_tvm_trvm,
2301       .fgt = FGT_MAIR_EL1,
2302       .nv2_redirect_offset = 0x140 | NV2_REDIR_NV1,
2303       .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
2304       .resetvalue = 0 },
2305     { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
2306       .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
2307       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
2308       .resetvalue = 0 },
2309     /*
2310      * For non-long-descriptor page tables these are PRRR and NMRR;
2311      * regardless they still act as reads-as-written for QEMU.
2312      */
2313      /*
2314       * MAIR0/1 are defined separately from their 64-bit counterpart which
2315       * allows them to assign the correct fieldoffset based on the endianness
2316       * handled in the field definitions.
2317       */
2318     { .name = "MAIR0", .state = ARM_CP_STATE_AA32,
2319       .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
2320       .access = PL1_RW, .accessfn = access_tvm_trvm,
2321       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
2322                              offsetof(CPUARMState, cp15.mair0_ns) },
2323       .resetfn = arm_cp_reset_ignore },
2324     { .name = "MAIR1", .state = ARM_CP_STATE_AA32,
2325       .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1,
2326       .access = PL1_RW, .accessfn = access_tvm_trvm,
2327       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
2328                              offsetof(CPUARMState, cp15.mair1_ns) },
2329       .resetfn = arm_cp_reset_ignore },
2330     { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
2331       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
2332       .fgt = FGT_ISR_EL1,
2333       .type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
2334     /* 32 bit ITLB invalidates */
2335     { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
2336       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2337       .writefn = tlbiall_write },
2338     { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
2339       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2340       .writefn = tlbimva_write },
2341     { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
2342       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2343       .writefn = tlbiasid_write },
2344     /* 32 bit DTLB invalidates */
2345     { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
2346       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2347       .writefn = tlbiall_write },
2348     { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
2349       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2350       .writefn = tlbimva_write },
2351     { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
2352       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2353       .writefn = tlbiasid_write },
2354     /* 32 bit TLB invalidates */
2355     { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2356       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2357       .writefn = tlbiall_write },
2358     { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2359       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2360       .writefn = tlbimva_write },
2361     { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2362       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2363       .writefn = tlbiasid_write },
2364     { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2365       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
2366       .writefn = tlbimvaa_write },
2367 };
2368 
2369 static const ARMCPRegInfo v7mp_cp_reginfo[] = {
2370     /* 32 bit TLB invalidates, Inner Shareable */
2371     { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2372       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis,
2373       .writefn = tlbiall_is_write },
2374     { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2375       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis,
2376       .writefn = tlbimva_is_write },
2377     { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2378       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis,
2379       .writefn = tlbiasid_is_write },
2380     { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2381       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis,
2382       .writefn = tlbimvaa_is_write },
2383 };
2384 
2385 static const ARMCPRegInfo pmovsset_cp_reginfo[] = {
2386     /* PMOVSSET is not implemented in v7 before v7ve */
2387     { .name = "PMOVSSET", .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 3,
2388       .access = PL0_RW, .accessfn = pmreg_access,
2389       .fgt = FGT_PMOVS,
2390       .type = ARM_CP_ALIAS | ARM_CP_IO,
2391       .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
2392       .writefn = pmovsset_write,
2393       .raw_writefn = raw_write },
2394     { .name = "PMOVSSET_EL0", .state = ARM_CP_STATE_AA64,
2395       .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 3,
2396       .access = PL0_RW, .accessfn = pmreg_access,
2397       .fgt = FGT_PMOVS,
2398       .type = ARM_CP_ALIAS | ARM_CP_IO,
2399       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
2400       .writefn = pmovsset_write,
2401       .raw_writefn = raw_write },
2402 };
2403 
teecr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2404 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2405                         uint64_t value)
2406 {
2407     value &= 1;
2408     env->teecr = value;
2409 }
2410 
teecr_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2411 static CPAccessResult teecr_access(CPUARMState *env, const ARMCPRegInfo *ri,
2412                                    bool isread)
2413 {
2414     /*
2415      * HSTR.TTEE only exists in v7A, not v8A, but v8A doesn't have T2EE
2416      * at all, so we don't need to check whether we're v8A.
2417      */
2418     if (arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) &&
2419         (env->cp15.hstr_el2 & HSTR_TTEE)) {
2420         return CP_ACCESS_TRAP_EL2;
2421     }
2422     return CP_ACCESS_OK;
2423 }
2424 
teehbr_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2425 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri,
2426                                     bool isread)
2427 {
2428     if (arm_current_el(env) == 0 && (env->teecr & 1)) {
2429         return CP_ACCESS_TRAP;
2430     }
2431     return teecr_access(env, ri, isread);
2432 }
2433 
2434 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
2435     { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
2436       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
2437       .resetvalue = 0,
2438       .writefn = teecr_write, .accessfn = teecr_access },
2439     { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
2440       .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
2441       .accessfn = teehbr_access, .resetvalue = 0 },
2442 };
2443 
2444 static const ARMCPRegInfo v6k_cp_reginfo[] = {
2445     { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
2446       .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
2447       .access = PL0_RW,
2448       .fgt = FGT_TPIDR_EL0,
2449       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
2450     { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
2451       .access = PL0_RW,
2452       .fgt = FGT_TPIDR_EL0,
2453       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
2454                              offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
2455       .resetfn = arm_cp_reset_ignore },
2456     { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
2457       .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
2458       .access = PL0_R | PL1_W,
2459       .fgt = FGT_TPIDRRO_EL0,
2460       .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
2461       .resetvalue = 0},
2462     { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
2463       .access = PL0_R | PL1_W,
2464       .fgt = FGT_TPIDRRO_EL0,
2465       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
2466                              offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
2467       .resetfn = arm_cp_reset_ignore },
2468     { .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
2469       .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
2470       .access = PL1_RW,
2471       .fgt = FGT_TPIDR_EL1,
2472       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
2473     { .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
2474       .access = PL1_RW,
2475       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
2476                              offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
2477       .resetvalue = 0 },
2478 };
2479 
arm_gt_cntfrq_reset(CPUARMState * env,const ARMCPRegInfo * opaque)2480 static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)
2481 {
2482     ARMCPU *cpu = env_archcpu(env);
2483 
2484     cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;
2485 }
2486 
2487 #ifndef CONFIG_USER_ONLY
2488 
gt_cntfrq_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2489 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri,
2490                                        bool isread)
2491 {
2492     /*
2493      * CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
2494      * Writable only at the highest implemented exception level.
2495      */
2496     int el = arm_current_el(env);
2497     uint64_t hcr;
2498     uint32_t cntkctl;
2499 
2500     switch (el) {
2501     case 0:
2502         hcr = arm_hcr_el2_eff(env);
2503         if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
2504             cntkctl = env->cp15.cnthctl_el2;
2505         } else {
2506             cntkctl = env->cp15.c14_cntkctl;
2507         }
2508         if (!extract32(cntkctl, 0, 2)) {
2509             return CP_ACCESS_TRAP;
2510         }
2511         break;
2512     case 1:
2513         if (!isread && ri->state == ARM_CP_STATE_AA32 &&
2514             arm_is_secure_below_el3(env)) {
2515             /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */
2516             return CP_ACCESS_TRAP_UNCATEGORIZED;
2517         }
2518         break;
2519     case 2:
2520     case 3:
2521         break;
2522     }
2523 
2524     if (!isread && el < arm_highest_el(env)) {
2525         return CP_ACCESS_TRAP_UNCATEGORIZED;
2526     }
2527 
2528     return CP_ACCESS_OK;
2529 }
2530 
gt_counter_access(CPUARMState * env,int timeridx,bool isread)2531 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
2532                                         bool isread)
2533 {
2534     unsigned int cur_el = arm_current_el(env);
2535     bool has_el2 = arm_is_el2_enabled(env);
2536     uint64_t hcr = arm_hcr_el2_eff(env);
2537 
2538     switch (cur_el) {
2539     case 0:
2540         /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]CTEN. */
2541         if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
2542             return (extract32(env->cp15.cnthctl_el2, timeridx, 1)
2543                     ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2);
2544         }
2545 
2546         /* CNT[PV]CT: not visible from PL0 if EL0[PV]CTEN is zero */
2547         if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
2548             return CP_ACCESS_TRAP;
2549         }
2550         /* fall through */
2551     case 1:
2552         /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */
2553         if (has_el2 && timeridx == GTIMER_PHYS &&
2554             (hcr & HCR_E2H
2555              ? !extract32(env->cp15.cnthctl_el2, 10, 1)
2556              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
2557             return CP_ACCESS_TRAP_EL2;
2558         }
2559         if (has_el2 && timeridx == GTIMER_VIRT) {
2560             if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
2561                 return CP_ACCESS_TRAP_EL2;
2562             }
2563         }
2564         break;
2565     }
2566     return CP_ACCESS_OK;
2567 }
2568 
gt_timer_access(CPUARMState * env,int timeridx,bool isread)2569 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
2570                                       bool isread)
2571 {
2572     unsigned int cur_el = arm_current_el(env);
2573     bool has_el2 = arm_is_el2_enabled(env);
2574     uint64_t hcr = arm_hcr_el2_eff(env);
2575 
2576     switch (cur_el) {
2577     case 0:
2578         if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
2579             /* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]TEN. */
2580             return (extract32(env->cp15.cnthctl_el2, 9 - timeridx, 1)
2581                     ? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2);
2582         }
2583 
2584         /*
2585          * CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from
2586          * EL0 if EL0[PV]TEN is zero.
2587          */
2588         if (!extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
2589             return CP_ACCESS_TRAP;
2590         }
2591         /* fall through */
2592 
2593     case 1:
2594         if (has_el2 && timeridx == GTIMER_PHYS) {
2595             if (hcr & HCR_E2H) {
2596                 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */
2597                 if (!extract32(env->cp15.cnthctl_el2, 11, 1)) {
2598                     return CP_ACCESS_TRAP_EL2;
2599                 }
2600             } else {
2601                 /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */
2602                 if (!extract32(env->cp15.cnthctl_el2, 1, 1)) {
2603                     return CP_ACCESS_TRAP_EL2;
2604                 }
2605             }
2606         }
2607         if (has_el2 && timeridx == GTIMER_VIRT) {
2608             if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
2609                 return CP_ACCESS_TRAP_EL2;
2610             }
2611         }
2612         break;
2613     }
2614     return CP_ACCESS_OK;
2615 }
2616 
gt_pct_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2617 static CPAccessResult gt_pct_access(CPUARMState *env,
2618                                     const ARMCPRegInfo *ri,
2619                                     bool isread)
2620 {
2621     return gt_counter_access(env, GTIMER_PHYS, isread);
2622 }
2623 
gt_vct_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2624 static CPAccessResult gt_vct_access(CPUARMState *env,
2625                                     const ARMCPRegInfo *ri,
2626                                     bool isread)
2627 {
2628     return gt_counter_access(env, GTIMER_VIRT, isread);
2629 }
2630 
gt_ptimer_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2631 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
2632                                        bool isread)
2633 {
2634     return gt_timer_access(env, GTIMER_PHYS, isread);
2635 }
2636 
gt_vtimer_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2637 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri,
2638                                        bool isread)
2639 {
2640     return gt_timer_access(env, GTIMER_VIRT, isread);
2641 }
2642 
gt_stimer_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)2643 static CPAccessResult gt_stimer_access(CPUARMState *env,
2644                                        const ARMCPRegInfo *ri,
2645                                        bool isread)
2646 {
2647     /*
2648      * The AArch64 register view of the secure physical timer is
2649      * always accessible from EL3, and configurably accessible from
2650      * Secure EL1.
2651      */
2652     switch (arm_current_el(env)) {
2653     case 1:
2654         if (!arm_is_secure(env)) {
2655             return CP_ACCESS_TRAP;
2656         }
2657         if (!(env->cp15.scr_el3 & SCR_ST)) {
2658             return CP_ACCESS_TRAP_EL3;
2659         }
2660         return CP_ACCESS_OK;
2661     case 0:
2662     case 2:
2663         return CP_ACCESS_TRAP;
2664     case 3:
2665         return CP_ACCESS_OK;
2666     default:
2667         g_assert_not_reached();
2668     }
2669 }
2670 
gt_get_countervalue(CPUARMState * env)2671 uint64_t gt_get_countervalue(CPUARMState *env)
2672 {
2673     ARMCPU *cpu = env_archcpu(env);
2674 
2675     return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu);
2676 }
2677 
gt_update_irq(ARMCPU * cpu,int timeridx)2678 static void gt_update_irq(ARMCPU *cpu, int timeridx)
2679 {
2680     CPUARMState *env = &cpu->env;
2681     uint64_t cnthctl = env->cp15.cnthctl_el2;
2682     ARMSecuritySpace ss = arm_security_space(env);
2683     /* ISTATUS && !IMASK */
2684     int irqstate = (env->cp15.c14_timer[timeridx].ctl & 6) == 4;
2685 
2686     /*
2687      * If bit CNTHCTL_EL2.CNT[VP]MASK is set, it overrides IMASK.
2688      * It is RES0 in Secure and NonSecure state.
2689      */
2690     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
2691         ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
2692          (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
2693         irqstate = 0;
2694     }
2695 
2696     qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
2697     trace_arm_gt_update_irq(timeridx, irqstate);
2698 }
2699 
gt_rme_post_el_change(ARMCPU * cpu,void * ignored)2700 void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
2701 {
2702     /*
2703      * Changing security state between Root and Secure/NonSecure, which may
2704      * happen when switching EL, can change the effective value of CNTHCTL_EL2
2705      * mask bits. Update the IRQ state accordingly.
2706      */
2707     gt_update_irq(cpu, GTIMER_VIRT);
2708     gt_update_irq(cpu, GTIMER_PHYS);
2709 }
2710 
gt_phys_raw_cnt_offset(CPUARMState * env)2711 static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
2712 {
2713     if ((env->cp15.scr_el3 & SCR_ECVEN) &&
2714         FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
2715         arm_is_el2_enabled(env) &&
2716         (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
2717         return env->cp15.cntpoff_el2;
2718     }
2719     return 0;
2720 }
2721 
gt_phys_cnt_offset(CPUARMState * env)2722 static uint64_t gt_phys_cnt_offset(CPUARMState *env)
2723 {
2724     if (arm_current_el(env) >= 2) {
2725         return 0;
2726     }
2727     return gt_phys_raw_cnt_offset(env);
2728 }
2729 
gt_recalc_timer(ARMCPU * cpu,int timeridx)2730 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
2731 {
2732     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
2733 
2734     if (gt->ctl & 1) {
2735         /*
2736          * Timer enabled: calculate and set current ISTATUS, irq, and
2737          * reset timer to when ISTATUS next has to change
2738          */
2739         uint64_t offset = timeridx == GTIMER_VIRT ?
2740             cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
2741         uint64_t count = gt_get_countervalue(&cpu->env);
2742         /* Note that this must be unsigned 64 bit arithmetic: */
2743         int istatus = count - offset >= gt->cval;
2744         uint64_t nexttick;
2745 
2746         gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
2747 
2748         if (istatus) {
2749             /*
2750              * Next transition is when (count - offset) rolls back over to 0.
2751              * If offset > count then this is when count == offset;
2752              * if offset <= count then this is when count == offset + 2^64
2753              * For the latter case we set nexttick to an "as far in future
2754              * as possible" value and let the code below handle it.
2755              */
2756             if (offset > count) {
2757                 nexttick = offset;
2758             } else {
2759                 nexttick = UINT64_MAX;
2760             }
2761         } else {
2762             /*
2763              * Next transition is when (count - offset) == cval, i.e.
2764              * when count == (cval + offset).
2765              * If that would overflow, then again we set up the next interrupt
2766              * for "as far in the future as possible" for the code below.
2767              */
2768             if (uadd64_overflow(gt->cval, offset, &nexttick)) {
2769                 nexttick = UINT64_MAX;
2770             }
2771         }
2772         /*
2773          * Note that the desired next expiry time might be beyond the
2774          * signed-64-bit range of a QEMUTimer -- in this case we just
2775          * set the timer for as far in the future as possible. When the
2776          * timer expires we will reset the timer for any remaining period.
2777          */
2778         if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {
2779             timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
2780         } else {
2781             timer_mod(cpu->gt_timer[timeridx], nexttick);
2782         }
2783         trace_arm_gt_recalc(timeridx, nexttick);
2784     } else {
2785         /* Timer disabled: ISTATUS and timer output always clear */
2786         gt->ctl &= ~4;
2787         timer_del(cpu->gt_timer[timeridx]);
2788         trace_arm_gt_recalc_disabled(timeridx);
2789     }
2790     gt_update_irq(cpu, timeridx);
2791 }
2792 
gt_timer_reset(CPUARMState * env,const ARMCPRegInfo * ri,int timeridx)2793 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
2794                            int timeridx)
2795 {
2796     ARMCPU *cpu = env_archcpu(env);
2797 
2798     timer_del(cpu->gt_timer[timeridx]);
2799 }
2800 
gt_cnt_read(CPUARMState * env,const ARMCPRegInfo * ri)2801 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2802 {
2803     return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
2804 }
2805 
gt_virt_cnt_offset(CPUARMState * env)2806 uint64_t gt_virt_cnt_offset(CPUARMState *env)
2807 {
2808     uint64_t hcr;
2809 
2810     switch (arm_current_el(env)) {
2811     case 2:
2812         hcr = arm_hcr_el2_eff(env);
2813         if (hcr & HCR_E2H) {
2814             return 0;
2815         }
2816         break;
2817     case 0:
2818         hcr = arm_hcr_el2_eff(env);
2819         if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
2820             return 0;
2821         }
2822         break;
2823     }
2824 
2825     return env->cp15.cntvoff_el2;
2826 }
2827 
gt_virt_cnt_read(CPUARMState * env,const ARMCPRegInfo * ri)2828 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
2829 {
2830     return gt_get_countervalue(env) - gt_virt_cnt_offset(env);
2831 }
2832 
gt_cval_write(CPUARMState * env,const ARMCPRegInfo * ri,int timeridx,uint64_t value)2833 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2834                           int timeridx,
2835                           uint64_t value)
2836 {
2837     trace_arm_gt_cval_write(timeridx, value);
2838     env->cp15.c14_timer[timeridx].cval = value;
2839     gt_recalc_timer(env_archcpu(env), timeridx);
2840 }
2841 
gt_tval_read(CPUARMState * env,const ARMCPRegInfo * ri,int timeridx)2842 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
2843                              int timeridx)
2844 {
2845     uint64_t offset = 0;
2846 
2847     switch (timeridx) {
2848     case GTIMER_VIRT:
2849     case GTIMER_HYPVIRT:
2850         offset = gt_virt_cnt_offset(env);
2851         break;
2852     case GTIMER_PHYS:
2853         offset = gt_phys_cnt_offset(env);
2854         break;
2855     }
2856 
2857     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
2858                       (gt_get_countervalue(env) - offset));
2859 }
2860 
gt_tval_write(CPUARMState * env,const ARMCPRegInfo * ri,int timeridx,uint64_t value)2861 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2862                           int timeridx,
2863                           uint64_t value)
2864 {
2865     uint64_t offset = 0;
2866 
2867     switch (timeridx) {
2868     case GTIMER_VIRT:
2869     case GTIMER_HYPVIRT:
2870         offset = gt_virt_cnt_offset(env);
2871         break;
2872     case GTIMER_PHYS:
2873         offset = gt_phys_cnt_offset(env);
2874         break;
2875     }
2876 
2877     trace_arm_gt_tval_write(timeridx, value);
2878     env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
2879                                          sextract64(value, 0, 32);
2880     gt_recalc_timer(env_archcpu(env), timeridx);
2881 }
2882 
gt_ctl_write(CPUARMState * env,const ARMCPRegInfo * ri,int timeridx,uint64_t value)2883 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2884                          int timeridx,
2885                          uint64_t value)
2886 {
2887     ARMCPU *cpu = env_archcpu(env);
2888     uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
2889 
2890     trace_arm_gt_ctl_write(timeridx, value);
2891     env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
2892     if ((oldval ^ value) & 1) {
2893         /* Enable toggled */
2894         gt_recalc_timer(cpu, timeridx);
2895     } else if ((oldval ^ value) & 2) {
2896         /*
2897          * IMASK toggled: don't need to recalculate,
2898          * just set the interrupt line based on ISTATUS
2899          */
2900         trace_arm_gt_imask_toggle(timeridx);
2901         gt_update_irq(cpu, timeridx);
2902     }
2903 }
2904 
gt_phys_timer_reset(CPUARMState * env,const ARMCPRegInfo * ri)2905 static void gt_phys_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
2906 {
2907     gt_timer_reset(env, ri, GTIMER_PHYS);
2908 }
2909 
gt_phys_cval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2910 static void gt_phys_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2911                                uint64_t value)
2912 {
2913     gt_cval_write(env, ri, GTIMER_PHYS, value);
2914 }
2915 
gt_phys_tval_read(CPUARMState * env,const ARMCPRegInfo * ri)2916 static uint64_t gt_phys_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
2917 {
2918     return gt_tval_read(env, ri, GTIMER_PHYS);
2919 }
2920 
gt_phys_tval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2921 static void gt_phys_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2922                                uint64_t value)
2923 {
2924     gt_tval_write(env, ri, GTIMER_PHYS, value);
2925 }
2926 
gt_phys_ctl_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2927 static void gt_phys_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2928                               uint64_t value)
2929 {
2930     gt_ctl_write(env, ri, GTIMER_PHYS, value);
2931 }
2932 
gt_phys_redir_timeridx(CPUARMState * env)2933 static int gt_phys_redir_timeridx(CPUARMState *env)
2934 {
2935     switch (arm_mmu_idx(env)) {
2936     case ARMMMUIdx_E20_0:
2937     case ARMMMUIdx_E20_2:
2938     case ARMMMUIdx_E20_2_PAN:
2939         return GTIMER_HYP;
2940     default:
2941         return GTIMER_PHYS;
2942     }
2943 }
2944 
gt_virt_redir_timeridx(CPUARMState * env)2945 static int gt_virt_redir_timeridx(CPUARMState *env)
2946 {
2947     switch (arm_mmu_idx(env)) {
2948     case ARMMMUIdx_E20_0:
2949     case ARMMMUIdx_E20_2:
2950     case ARMMMUIdx_E20_2_PAN:
2951         return GTIMER_HYPVIRT;
2952     default:
2953         return GTIMER_VIRT;
2954     }
2955 }
2956 
gt_phys_redir_cval_read(CPUARMState * env,const ARMCPRegInfo * ri)2957 static uint64_t gt_phys_redir_cval_read(CPUARMState *env,
2958                                         const ARMCPRegInfo *ri)
2959 {
2960     int timeridx = gt_phys_redir_timeridx(env);
2961     return env->cp15.c14_timer[timeridx].cval;
2962 }
2963 
gt_phys_redir_cval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2964 static void gt_phys_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2965                                      uint64_t value)
2966 {
2967     int timeridx = gt_phys_redir_timeridx(env);
2968     gt_cval_write(env, ri, timeridx, value);
2969 }
2970 
gt_phys_redir_tval_read(CPUARMState * env,const ARMCPRegInfo * ri)2971 static uint64_t gt_phys_redir_tval_read(CPUARMState *env,
2972                                         const ARMCPRegInfo *ri)
2973 {
2974     int timeridx = gt_phys_redir_timeridx(env);
2975     return gt_tval_read(env, ri, timeridx);
2976 }
2977 
gt_phys_redir_tval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2978 static void gt_phys_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
2979                                      uint64_t value)
2980 {
2981     int timeridx = gt_phys_redir_timeridx(env);
2982     gt_tval_write(env, ri, timeridx, value);
2983 }
2984 
gt_phys_redir_ctl_read(CPUARMState * env,const ARMCPRegInfo * ri)2985 static uint64_t gt_phys_redir_ctl_read(CPUARMState *env,
2986                                        const ARMCPRegInfo *ri)
2987 {
2988     int timeridx = gt_phys_redir_timeridx(env);
2989     return env->cp15.c14_timer[timeridx].ctl;
2990 }
2991 
gt_phys_redir_ctl_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)2992 static void gt_phys_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
2993                                     uint64_t value)
2994 {
2995     int timeridx = gt_phys_redir_timeridx(env);
2996     gt_ctl_write(env, ri, timeridx, value);
2997 }
2998 
gt_virt_timer_reset(CPUARMState * env,const ARMCPRegInfo * ri)2999 static void gt_virt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
3000 {
3001     gt_timer_reset(env, ri, GTIMER_VIRT);
3002 }
3003 
gt_virt_cval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3004 static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3005                                uint64_t value)
3006 {
3007     gt_cval_write(env, ri, GTIMER_VIRT, value);
3008 }
3009 
gt_virt_tval_read(CPUARMState * env,const ARMCPRegInfo * ri)3010 static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
3011 {
3012     return gt_tval_read(env, ri, GTIMER_VIRT);
3013 }
3014 
gt_virt_tval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3015 static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3016                                uint64_t value)
3017 {
3018     gt_tval_write(env, ri, GTIMER_VIRT, value);
3019 }
3020 
gt_virt_ctl_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3021 static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
3022                               uint64_t value)
3023 {
3024     gt_ctl_write(env, ri, GTIMER_VIRT, value);
3025 }
3026 
gt_cnthctl_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3027 static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
3028                              uint64_t value)
3029 {
3030     ARMCPU *cpu = env_archcpu(env);
3031     uint32_t oldval = env->cp15.cnthctl_el2;
3032     uint32_t valid_mask =
3033         R_CNTHCTL_EL0PCTEN_E2H1_MASK |
3034         R_CNTHCTL_EL0VCTEN_E2H1_MASK |
3035         R_CNTHCTL_EVNTEN_MASK |
3036         R_CNTHCTL_EVNTDIR_MASK |
3037         R_CNTHCTL_EVNTI_MASK |
3038         R_CNTHCTL_EL0VTEN_MASK |
3039         R_CNTHCTL_EL0PTEN_MASK |
3040         R_CNTHCTL_EL1PCTEN_E2H1_MASK |
3041         R_CNTHCTL_EL1PTEN_MASK;
3042 
3043     if (cpu_isar_feature(aa64_rme, cpu)) {
3044         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
3045     }
3046     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
3047         valid_mask |=
3048             R_CNTHCTL_EL1TVT_MASK |
3049             R_CNTHCTL_EL1TVCT_MASK |
3050             R_CNTHCTL_EL1NVPCT_MASK |
3051             R_CNTHCTL_EL1NVVCT_MASK |
3052             R_CNTHCTL_EVNTIS_MASK;
3053     }
3054     if (cpu_isar_feature(aa64_ecv, cpu)) {
3055         valid_mask |= R_CNTHCTL_ECV_MASK;
3056     }
3057 
3058     /* Clear RES0 bits */
3059     value &= valid_mask;
3060 
3061     raw_write(env, ri, value);
3062 
3063     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
3064         gt_update_irq(cpu, GTIMER_VIRT);
3065     } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
3066         gt_update_irq(cpu, GTIMER_PHYS);
3067     }
3068 }
3069 
gt_cntvoff_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3070 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
3071                               uint64_t value)
3072 {
3073     ARMCPU *cpu = env_archcpu(env);
3074 
3075     trace_arm_gt_cntvoff_write(value);
3076     raw_write(env, ri, value);
3077     gt_recalc_timer(cpu, GTIMER_VIRT);
3078 }
3079 
gt_virt_redir_cval_read(CPUARMState * env,const ARMCPRegInfo * ri)3080 static uint64_t gt_virt_redir_cval_read(CPUARMState *env,
3081                                         const ARMCPRegInfo *ri)
3082 {
3083     int timeridx = gt_virt_redir_timeridx(env);
3084     return env->cp15.c14_timer[timeridx].cval;
3085 }
3086 
gt_virt_redir_cval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3087 static void gt_virt_redir_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3088                                      uint64_t value)
3089 {
3090     int timeridx = gt_virt_redir_timeridx(env);
3091     gt_cval_write(env, ri, timeridx, value);
3092 }
3093 
gt_virt_redir_tval_read(CPUARMState * env,const ARMCPRegInfo * ri)3094 static uint64_t gt_virt_redir_tval_read(CPUARMState *env,
3095                                         const ARMCPRegInfo *ri)
3096 {
3097     int timeridx = gt_virt_redir_timeridx(env);
3098     return gt_tval_read(env, ri, timeridx);
3099 }
3100 
gt_virt_redir_tval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3101 static void gt_virt_redir_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3102                                      uint64_t value)
3103 {
3104     int timeridx = gt_virt_redir_timeridx(env);
3105     gt_tval_write(env, ri, timeridx, value);
3106 }
3107 
gt_virt_redir_ctl_read(CPUARMState * env,const ARMCPRegInfo * ri)3108 static uint64_t gt_virt_redir_ctl_read(CPUARMState *env,
3109                                        const ARMCPRegInfo *ri)
3110 {
3111     int timeridx = gt_virt_redir_timeridx(env);
3112     return env->cp15.c14_timer[timeridx].ctl;
3113 }
3114 
gt_virt_redir_ctl_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3115 static void gt_virt_redir_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
3116                                     uint64_t value)
3117 {
3118     int timeridx = gt_virt_redir_timeridx(env);
3119     gt_ctl_write(env, ri, timeridx, value);
3120 }
3121 
gt_hyp_timer_reset(CPUARMState * env,const ARMCPRegInfo * ri)3122 static void gt_hyp_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
3123 {
3124     gt_timer_reset(env, ri, GTIMER_HYP);
3125 }
3126 
gt_hyp_cval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3127 static void gt_hyp_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3128                               uint64_t value)
3129 {
3130     gt_cval_write(env, ri, GTIMER_HYP, value);
3131 }
3132 
gt_hyp_tval_read(CPUARMState * env,const ARMCPRegInfo * ri)3133 static uint64_t gt_hyp_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
3134 {
3135     return gt_tval_read(env, ri, GTIMER_HYP);
3136 }
3137 
gt_hyp_tval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3138 static void gt_hyp_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3139                               uint64_t value)
3140 {
3141     gt_tval_write(env, ri, GTIMER_HYP, value);
3142 }
3143 
gt_hyp_ctl_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3144 static void gt_hyp_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
3145                               uint64_t value)
3146 {
3147     gt_ctl_write(env, ri, GTIMER_HYP, value);
3148 }
3149 
gt_sec_timer_reset(CPUARMState * env,const ARMCPRegInfo * ri)3150 static void gt_sec_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
3151 {
3152     gt_timer_reset(env, ri, GTIMER_SEC);
3153 }
3154 
gt_sec_cval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3155 static void gt_sec_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3156                               uint64_t value)
3157 {
3158     gt_cval_write(env, ri, GTIMER_SEC, value);
3159 }
3160 
gt_sec_tval_read(CPUARMState * env,const ARMCPRegInfo * ri)3161 static uint64_t gt_sec_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
3162 {
3163     return gt_tval_read(env, ri, GTIMER_SEC);
3164 }
3165 
gt_sec_tval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3166 static void gt_sec_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3167                               uint64_t value)
3168 {
3169     gt_tval_write(env, ri, GTIMER_SEC, value);
3170 }
3171 
gt_sec_ctl_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3172 static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
3173                               uint64_t value)
3174 {
3175     gt_ctl_write(env, ri, GTIMER_SEC, value);
3176 }
3177 
gt_hv_timer_reset(CPUARMState * env,const ARMCPRegInfo * ri)3178 static void gt_hv_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)
3179 {
3180     gt_timer_reset(env, ri, GTIMER_HYPVIRT);
3181 }
3182 
gt_hv_cval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3183 static void gt_hv_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3184                              uint64_t value)
3185 {
3186     gt_cval_write(env, ri, GTIMER_HYPVIRT, value);
3187 }
3188 
gt_hv_tval_read(CPUARMState * env,const ARMCPRegInfo * ri)3189 static uint64_t gt_hv_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
3190 {
3191     return gt_tval_read(env, ri, GTIMER_HYPVIRT);
3192 }
3193 
gt_hv_tval_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3194 static void gt_hv_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
3195                              uint64_t value)
3196 {
3197     gt_tval_write(env, ri, GTIMER_HYPVIRT, value);
3198 }
3199 
gt_hv_ctl_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3200 static void gt_hv_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
3201                             uint64_t value)
3202 {
3203     gt_ctl_write(env, ri, GTIMER_HYPVIRT, value);
3204 }
3205 
arm_gt_ptimer_cb(void * opaque)3206 void arm_gt_ptimer_cb(void *opaque)
3207 {
3208     ARMCPU *cpu = opaque;
3209 
3210     gt_recalc_timer(cpu, GTIMER_PHYS);
3211 }
3212 
arm_gt_vtimer_cb(void * opaque)3213 void arm_gt_vtimer_cb(void *opaque)
3214 {
3215     ARMCPU *cpu = opaque;
3216 
3217     gt_recalc_timer(cpu, GTIMER_VIRT);
3218 }
3219 
arm_gt_htimer_cb(void * opaque)3220 void arm_gt_htimer_cb(void *opaque)
3221 {
3222     ARMCPU *cpu = opaque;
3223 
3224     gt_recalc_timer(cpu, GTIMER_HYP);
3225 }
3226 
arm_gt_stimer_cb(void * opaque)3227 void arm_gt_stimer_cb(void *opaque)
3228 {
3229     ARMCPU *cpu = opaque;
3230 
3231     gt_recalc_timer(cpu, GTIMER_SEC);
3232 }
3233 
arm_gt_hvtimer_cb(void * opaque)3234 void arm_gt_hvtimer_cb(void *opaque)
3235 {
3236     ARMCPU *cpu = opaque;
3237 
3238     gt_recalc_timer(cpu, GTIMER_HYPVIRT);
3239 }
3240 
3241 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
3242     /*
3243      * Note that CNTFRQ is purely reads-as-written for the benefit
3244      * of software; writing it doesn't actually change the timer frequency.
3245      * Our reset value matches the fixed frequency we implement the timer at.
3246      */
3247     { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
3248       .type = ARM_CP_ALIAS,
3249       .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
3250       .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
3251     },
3252     { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
3253       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
3254       .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
3255       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
3256       .resetfn = arm_gt_cntfrq_reset,
3257     },
3258     /* overall control: mostly access permissions */
3259     { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
3260       .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
3261       .access = PL1_RW,
3262       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
3263       .resetvalue = 0,
3264     },
3265     /* per-timer control */
3266     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
3267       .secure = ARM_CP_SECSTATE_NS,
3268       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
3269       .accessfn = gt_ptimer_access,
3270       .fieldoffset = offsetoflow32(CPUARMState,
3271                                    cp15.c14_timer[GTIMER_PHYS].ctl),
3272       .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read,
3273       .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write,
3274     },
3275     { .name = "CNTP_CTL_S",
3276       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
3277       .secure = ARM_CP_SECSTATE_S,
3278       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
3279       .accessfn = gt_ptimer_access,
3280       .fieldoffset = offsetoflow32(CPUARMState,
3281                                    cp15.c14_timer[GTIMER_SEC].ctl),
3282       .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
3283     },
3284     { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
3285       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
3286       .type = ARM_CP_IO, .access = PL0_RW,
3287       .accessfn = gt_ptimer_access,
3288       .nv2_redirect_offset = 0x180 | NV2_REDIR_NV1,
3289       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
3290       .resetvalue = 0,
3291       .readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read,
3292       .writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write,
3293     },
3294     { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
3295       .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
3296       .accessfn = gt_vtimer_access,
3297       .fieldoffset = offsetoflow32(CPUARMState,
3298                                    cp15.c14_timer[GTIMER_VIRT].ctl),
3299       .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read,
3300       .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write,
3301     },
3302     { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
3303       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
3304       .type = ARM_CP_IO, .access = PL0_RW,
3305       .accessfn = gt_vtimer_access,
3306       .nv2_redirect_offset = 0x170 | NV2_REDIR_NV1,
3307       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
3308       .resetvalue = 0,
3309       .readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read,
3310       .writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write,
3311     },
3312     /* TimerValue views: a 32 bit downcounting view of the underlying state */
3313     { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
3314       .secure = ARM_CP_SECSTATE_NS,
3315       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
3316       .accessfn = gt_ptimer_access,
3317       .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write,
3318     },
3319     { .name = "CNTP_TVAL_S",
3320       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
3321       .secure = ARM_CP_SECSTATE_S,
3322       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
3323       .accessfn = gt_ptimer_access,
3324       .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
3325     },
3326     { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
3327       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
3328       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
3329       .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
3330       .readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write,
3331     },
3332     { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
3333       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
3334       .accessfn = gt_vtimer_access,
3335       .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write,
3336     },
3337     { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
3338       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
3339       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
3340       .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
3341       .readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write,
3342     },
3343     /* The counter itself */
3344     { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
3345       .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
3346       .accessfn = gt_pct_access,
3347       .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
3348     },
3349     { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
3350       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
3351       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
3352       .accessfn = gt_pct_access, .readfn = gt_cnt_read,
3353     },
3354     { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
3355       .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
3356       .accessfn = gt_vct_access,
3357       .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
3358     },
3359     { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
3360       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
3361       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
3362       .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
3363     },
3364     /* Comparison value, indicating when the timer goes off */
3365     { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
3366       .secure = ARM_CP_SECSTATE_NS,
3367       .access = PL0_RW,
3368       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
3369       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
3370       .accessfn = gt_ptimer_access,
3371       .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read,
3372       .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write,
3373     },
3374     { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
3375       .secure = ARM_CP_SECSTATE_S,
3376       .access = PL0_RW,
3377       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
3378       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
3379       .accessfn = gt_ptimer_access,
3380       .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
3381     },
3382     { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
3383       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
3384       .access = PL0_RW,
3385       .type = ARM_CP_IO,
3386       .nv2_redirect_offset = 0x178 | NV2_REDIR_NV1,
3387       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
3388       .resetvalue = 0, .accessfn = gt_ptimer_access,
3389       .readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read,
3390       .writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write,
3391     },
3392     { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
3393       .access = PL0_RW,
3394       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
3395       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
3396       .accessfn = gt_vtimer_access,
3397       .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read,
3398       .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write,
3399     },
3400     { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
3401       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
3402       .access = PL0_RW,
3403       .type = ARM_CP_IO,
3404       .nv2_redirect_offset = 0x168 | NV2_REDIR_NV1,
3405       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
3406       .resetvalue = 0, .accessfn = gt_vtimer_access,
3407       .readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read,
3408       .writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write,
3409     },
3410     /*
3411      * Secure timer -- this is actually restricted to only EL3
3412      * and configurably Secure-EL1 via the accessfn.
3413      */
3414     { .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
3415       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
3416       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW,
3417       .accessfn = gt_stimer_access,
3418       .readfn = gt_sec_tval_read,
3419       .writefn = gt_sec_tval_write,
3420       .resetfn = gt_sec_timer_reset,
3421     },
3422     { .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
3423       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
3424       .type = ARM_CP_IO, .access = PL1_RW,
3425       .accessfn = gt_stimer_access,
3426       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
3427       .resetvalue = 0,
3428       .writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
3429     },
3430     { .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
3431       .opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
3432       .type = ARM_CP_IO, .access = PL1_RW,
3433       .accessfn = gt_stimer_access,
3434       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
3435       .writefn = gt_sec_cval_write, .raw_writefn = raw_write,
3436     },
3437 };
3438 
3439 /*
3440  * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
3441  * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
3442  * so our implementations here are identical to the normal registers.
3443  */
3444 static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
3445     { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
3446       .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
3447       .accessfn = gt_vct_access,
3448       .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
3449     },
3450     { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
3451       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
3452       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
3453       .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
3454     },
3455     { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
3456       .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
3457       .accessfn = gt_pct_access,
3458       .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
3459     },
3460     { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
3461       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
3462       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
3463       .accessfn = gt_pct_access, .readfn = gt_cnt_read,
3464     },
3465 };
3466 
gt_cntpoff_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)3467 static CPAccessResult gt_cntpoff_access(CPUARMState *env,
3468                                         const ARMCPRegInfo *ri,
3469                                         bool isread)
3470 {
3471     if (arm_current_el(env) == 2 && arm_feature(env, ARM_FEATURE_EL3) &&
3472         !(env->cp15.scr_el3 & SCR_ECVEN)) {
3473         return CP_ACCESS_TRAP_EL3;
3474     }
3475     return CP_ACCESS_OK;
3476 }
3477 
gt_cntpoff_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3478 static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
3479                               uint64_t value)
3480 {
3481     ARMCPU *cpu = env_archcpu(env);
3482 
3483     trace_arm_gt_cntpoff_write(value);
3484     raw_write(env, ri, value);
3485     gt_recalc_timer(cpu, GTIMER_PHYS);
3486 }
3487 
3488 static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
3489     .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
3490     .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
3491     .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
3492     .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
3493     .nv2_redirect_offset = 0x1a8,
3494     .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
3495 };
3496 #else
3497 
3498 /*
3499  * In user-mode most of the generic timer registers are inaccessible
3500  * however modern kernels (4.12+) allow access to cntvct_el0
3501  */
3502 
gt_virt_cnt_read(CPUARMState * env,const ARMCPRegInfo * ri)3503 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
3504 {
3505     ARMCPU *cpu = env_archcpu(env);
3506 
3507     /*
3508      * Currently we have no support for QEMUTimer in linux-user so we
3509      * can't call gt_get_countervalue(env), instead we directly
3510      * call the lower level functions.
3511      */
3512     return cpu_get_clock() / gt_cntfrq_period_ns(cpu);
3513 }
3514 
3515 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
3516     { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
3517       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
3518       .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */,
3519       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
3520       .resetfn = arm_gt_cntfrq_reset,
3521     },
3522     { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
3523       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
3524       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
3525       .readfn = gt_virt_cnt_read,
3526     },
3527 };
3528 
3529 /*
3530  * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
3531  * is exposed to userspace by Linux.
3532  */
3533 static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
3534     { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
3535       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
3536       .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
3537       .readfn = gt_virt_cnt_read,
3538     },
3539 };
3540 
3541 #endif
3542 
par_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3543 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
3544 {
3545     if (arm_feature(env, ARM_FEATURE_LPAE)) {
3546         raw_write(env, ri, value);
3547     } else if (arm_feature(env, ARM_FEATURE_V7)) {
3548         raw_write(env, ri, value & 0xfffff6ff);
3549     } else {
3550         raw_write(env, ri, value & 0xfffff1ff);
3551     }
3552 }
3553 
3554 #ifndef CONFIG_USER_ONLY
3555 /* get_phys_addr() isn't present for user-mode-only targets */
3556 
ats_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)3557 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
3558                                  bool isread)
3559 {
3560     if (ri->opc2 & 4) {
3561         /*
3562          * The ATS12NSO* operations must trap to EL3 or EL2 if executed in
3563          * Secure EL1 (which can only happen if EL3 is AArch64).
3564          * They are simply UNDEF if executed from NS EL1.
3565          * They function normally from EL2 or EL3.
3566          */
3567         if (arm_current_el(env) == 1) {
3568             if (arm_is_secure_below_el3(env)) {
3569                 if (env->cp15.scr_el3 & SCR_EEL2) {
3570                     return CP_ACCESS_TRAP_EL2;
3571                 }
3572                 return CP_ACCESS_TRAP_EL3;
3573             }
3574             return CP_ACCESS_TRAP_UNCATEGORIZED;
3575         }
3576     }
3577     return CP_ACCESS_OK;
3578 }
3579 
3580 #ifdef CONFIG_TCG
par_el1_shareability(GetPhysAddrResult * res)3581 static int par_el1_shareability(GetPhysAddrResult *res)
3582 {
3583     /*
3584      * The PAR_EL1.SH field must be 0b10 for Device or Normal-NC
3585      * memory -- see pseudocode PAREncodeShareability().
3586      */
3587     if (((res->cacheattrs.attrs & 0xf0) == 0) ||
3588         res->cacheattrs.attrs == 0x44 || res->cacheattrs.attrs == 0x40) {
3589         return 2;
3590     }
3591     return res->cacheattrs.shareability;
3592 }
3593 
do_ats_write(CPUARMState * env,uint64_t value,MMUAccessType access_type,ARMMMUIdx mmu_idx,ARMSecuritySpace ss)3594 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
3595                              MMUAccessType access_type, ARMMMUIdx mmu_idx,
3596                              ARMSecuritySpace ss)
3597 {
3598     bool ret;
3599     uint64_t par64;
3600     bool format64 = false;
3601     ARMMMUFaultInfo fi = {};
3602     GetPhysAddrResult res = {};
3603 
3604     /*
3605      * I_MXTJT: Granule protection checks are not performed on the final
3606      * address of a successful translation.  This is a translation not a
3607      * memory reference, so "memop = none = 0".
3608      */
3609     ret = get_phys_addr_with_space_nogpc(env, value, access_type, 0,
3610                                          mmu_idx, ss, &res, &fi);
3611 
3612     /*
3613      * ATS operations only do S1 or S1+S2 translations, so we never
3614      * have to deal with the ARMCacheAttrs format for S2 only.
3615      */
3616     assert(!res.cacheattrs.is_s2_format);
3617 
3618     if (ret) {
3619         /*
3620          * Some kinds of translation fault must cause exceptions rather
3621          * than being reported in the PAR.
3622          */
3623         int current_el = arm_current_el(env);
3624         int target_el;
3625         uint32_t syn, fsr, fsc;
3626         bool take_exc = false;
3627 
3628         if (fi.s1ptw && current_el == 1
3629             && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
3630             /*
3631              * Synchronous stage 2 fault on an access made as part of the
3632              * translation table walk for AT S1E0* or AT S1E1* insn
3633              * executed from NS EL1. If this is a synchronous external abort
3634              * and SCR_EL3.EA == 1, then we take a synchronous external abort
3635              * to EL3. Otherwise the fault is taken as an exception to EL2,
3636              * and HPFAR_EL2 holds the faulting IPA.
3637              */
3638             if (fi.type == ARMFault_SyncExternalOnWalk &&
3639                 (env->cp15.scr_el3 & SCR_EA)) {
3640                 target_el = 3;
3641             } else {
3642                 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
3643                 if (arm_is_secure_below_el3(env) && fi.s1ns) {
3644                     env->cp15.hpfar_el2 |= HPFAR_NS;
3645                 }
3646                 target_el = 2;
3647             }
3648             take_exc = true;
3649         } else if (fi.type == ARMFault_SyncExternalOnWalk) {
3650             /*
3651              * Synchronous external aborts during a translation table walk
3652              * are taken as Data Abort exceptions.
3653              */
3654             if (fi.stage2) {
3655                 if (current_el == 3) {
3656                     target_el = 3;
3657                 } else {
3658                     target_el = 2;
3659                 }
3660             } else {
3661                 target_el = exception_target_el(env);
3662             }
3663             take_exc = true;
3664         }
3665 
3666         if (take_exc) {
3667             /* Construct FSR and FSC using same logic as arm_deliver_fault() */
3668             if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
3669                 arm_s1_regime_using_lpae_format(env, mmu_idx)) {
3670                 fsr = arm_fi_to_lfsc(&fi);
3671                 fsc = extract32(fsr, 0, 6);
3672             } else {
3673                 fsr = arm_fi_to_sfsc(&fi);
3674                 fsc = 0x3f;
3675             }
3676             /*
3677              * Report exception with ESR indicating a fault due to a
3678              * translation table walk for a cache maintenance instruction.
3679              */
3680             syn = syn_data_abort_no_iss(current_el == target_el, 0,
3681                                         fi.ea, 1, fi.s1ptw, 1, fsc);
3682             env->exception.vaddress = value;
3683             env->exception.fsr = fsr;
3684             raise_exception(env, EXCP_DATA_ABORT, syn, target_el);
3685         }
3686     }
3687 
3688     if (is_a64(env)) {
3689         format64 = true;
3690     } else if (arm_feature(env, ARM_FEATURE_LPAE)) {
3691         /*
3692          * ATS1Cxx:
3693          * * TTBCR.EAE determines whether the result is returned using the
3694          *   32-bit or the 64-bit PAR format
3695          * * Instructions executed in Hyp mode always use the 64bit format
3696          *
3697          * ATS1S2NSOxx uses the 64bit format if any of the following is true:
3698          * * The Non-secure TTBCR.EAE bit is set to 1
3699          * * The implementation includes EL2, and the value of HCR.VM is 1
3700          *
3701          * (Note that HCR.DC makes HCR.VM behave as if it is 1.)
3702          *
3703          * ATS1Hx always uses the 64bit format.
3704          */
3705         format64 = arm_s1_regime_using_lpae_format(env, mmu_idx);
3706 
3707         if (arm_feature(env, ARM_FEATURE_EL2)) {
3708             if (mmu_idx == ARMMMUIdx_E10_0 ||
3709                 mmu_idx == ARMMMUIdx_E10_1 ||
3710                 mmu_idx == ARMMMUIdx_E10_1_PAN) {
3711                 format64 |= env->cp15.hcr_el2 & (HCR_VM | HCR_DC);
3712             } else {
3713                 format64 |= arm_current_el(env) == 2;
3714             }
3715         }
3716     }
3717 
3718     if (format64) {
3719         /* Create a 64-bit PAR */
3720         par64 = (1 << 11); /* LPAE bit always set */
3721         if (!ret) {
3722             par64 |= res.f.phys_addr & ~0xfffULL;
3723             if (!res.f.attrs.secure) {
3724                 par64 |= (1 << 9); /* NS */
3725             }
3726             par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */
3727             par64 |= par_el1_shareability(&res) << 7; /* SH */
3728         } else {
3729             uint32_t fsr = arm_fi_to_lfsc(&fi);
3730 
3731             par64 |= 1; /* F */
3732             par64 |= (fsr & 0x3f) << 1; /* FS */
3733             if (fi.stage2) {
3734                 par64 |= (1 << 9); /* S */
3735             }
3736             if (fi.s1ptw) {
3737                 par64 |= (1 << 8); /* PTW */
3738             }
3739         }
3740     } else {
3741         /*
3742          * fsr is a DFSR/IFSR value for the short descriptor
3743          * translation table format (with WnR always clear).
3744          * Convert it to a 32-bit PAR.
3745          */
3746         if (!ret) {
3747             /* We do not set any attribute bits in the PAR */
3748             if (res.f.lg_page_size == 24
3749                 && arm_feature(env, ARM_FEATURE_V7)) {
3750                 par64 = (res.f.phys_addr & 0xff000000) | (1 << 1);
3751             } else {
3752                 par64 = res.f.phys_addr & 0xfffff000;
3753             }
3754             if (!res.f.attrs.secure) {
3755                 par64 |= (1 << 9); /* NS */
3756             }
3757         } else {
3758             uint32_t fsr = arm_fi_to_sfsc(&fi);
3759 
3760             par64 = ((fsr & (1 << 10)) >> 5) | ((fsr & (1 << 12)) >> 6) |
3761                     ((fsr & 0xf) << 1) | 1;
3762         }
3763     }
3764     return par64;
3765 }
3766 #endif /* CONFIG_TCG */
3767 
ats_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3768 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
3769 {
3770 #ifdef CONFIG_TCG
3771     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3772     uint64_t par64;
3773     ARMMMUIdx mmu_idx;
3774     int el = arm_current_el(env);
3775     ARMSecuritySpace ss = arm_security_space(env);
3776 
3777     switch (ri->opc2 & 6) {
3778     case 0:
3779         /* stage 1 current state PL1: ATS1CPR, ATS1CPW, ATS1CPRP, ATS1CPWP */
3780         switch (el) {
3781         case 3:
3782             if (ri->crm == 9 && arm_pan_enabled(env)) {
3783                 mmu_idx = ARMMMUIdx_E30_3_PAN;
3784             } else {
3785                 mmu_idx = ARMMMUIdx_E3;
3786             }
3787             break;
3788         case 2:
3789             g_assert(ss != ARMSS_Secure);  /* ARMv8.4-SecEL2 is 64-bit only */
3790             /* fall through */
3791         case 1:
3792             if (ri->crm == 9 && arm_pan_enabled(env)) {
3793                 mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
3794             } else {
3795                 mmu_idx = ARMMMUIdx_Stage1_E1;
3796             }
3797             break;
3798         default:
3799             g_assert_not_reached();
3800         }
3801         break;
3802     case 2:
3803         /* stage 1 current state PL0: ATS1CUR, ATS1CUW */
3804         switch (el) {
3805         case 3:
3806             mmu_idx = ARMMMUIdx_E30_0;
3807             break;
3808         case 2:
3809             g_assert(ss != ARMSS_Secure);  /* ARMv8.4-SecEL2 is 64-bit only */
3810             mmu_idx = ARMMMUIdx_Stage1_E0;
3811             break;
3812         case 1:
3813             mmu_idx = ARMMMUIdx_Stage1_E0;
3814             break;
3815         default:
3816             g_assert_not_reached();
3817         }
3818         break;
3819     case 4:
3820         /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
3821         mmu_idx = ARMMMUIdx_E10_1;
3822         ss = ARMSS_NonSecure;
3823         break;
3824     case 6:
3825         /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
3826         mmu_idx = ARMMMUIdx_E10_0;
3827         ss = ARMSS_NonSecure;
3828         break;
3829     default:
3830         g_assert_not_reached();
3831     }
3832 
3833     par64 = do_ats_write(env, value, access_type, mmu_idx, ss);
3834 
3835     A32_BANKED_CURRENT_REG_SET(env, par, par64);
3836 #else
3837     /* Handled by hardware accelerator. */
3838     g_assert_not_reached();
3839 #endif /* CONFIG_TCG */
3840 }
3841 
ats1h_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3842 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
3843                         uint64_t value)
3844 {
3845 #ifdef CONFIG_TCG
3846     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3847     uint64_t par64;
3848 
3849     /* There is no SecureEL2 for AArch32. */
3850     par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2,
3851                          ARMSS_NonSecure);
3852 
3853     A32_BANKED_CURRENT_REG_SET(env, par, par64);
3854 #else
3855     /* Handled by hardware accelerator. */
3856     g_assert_not_reached();
3857 #endif /* CONFIG_TCG */
3858 }
3859 
at_e012_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)3860 static CPAccessResult at_e012_access(CPUARMState *env, const ARMCPRegInfo *ri,
3861                                      bool isread)
3862 {
3863     /*
3864      * R_NYXTL: instruction is UNDEFINED if it applies to an Exception level
3865      * lower than EL3 and the combination SCR_EL3.{NSE,NS} is reserved. This can
3866      * only happen when executing at EL3 because that combination also causes an
3867      * illegal exception return. We don't need to check FEAT_RME either, because
3868      * scr_write() ensures that the NSE bit is not set otherwise.
3869      */
3870     if ((env->cp15.scr_el3 & (SCR_NSE | SCR_NS)) == SCR_NSE) {
3871         return CP_ACCESS_TRAP;
3872     }
3873     return CP_ACCESS_OK;
3874 }
3875 
at_s1e2_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)3876 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
3877                                      bool isread)
3878 {
3879     if (arm_current_el(env) == 3 &&
3880         !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) {
3881         return CP_ACCESS_TRAP;
3882     }
3883     return at_e012_access(env, ri, isread);
3884 }
3885 
at_s1e01_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)3886 static CPAccessResult at_s1e01_access(CPUARMState *env, const ARMCPRegInfo *ri,
3887                                       bool isread)
3888 {
3889     if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_AT)) {
3890         return CP_ACCESS_TRAP_EL2;
3891     }
3892     return at_e012_access(env, ri, isread);
3893 }
3894 
ats_write64(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3895 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
3896                         uint64_t value)
3897 {
3898 #ifdef CONFIG_TCG
3899     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
3900     ARMMMUIdx mmu_idx;
3901     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
3902     bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
3903     bool for_el3 = false;
3904     ARMSecuritySpace ss;
3905 
3906     switch (ri->opc2 & 6) {
3907     case 0:
3908         switch (ri->opc1) {
3909         case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
3910             if (ri->crm == 9 && arm_pan_enabled(env)) {
3911                 mmu_idx = regime_e20 ?
3912                           ARMMMUIdx_E20_2_PAN : ARMMMUIdx_Stage1_E1_PAN;
3913             } else {
3914                 mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1;
3915             }
3916             break;
3917         case 4: /* AT S1E2R, AT S1E2W */
3918             mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2;
3919             break;
3920         case 6: /* AT S1E3R, AT S1E3W */
3921             mmu_idx = ARMMMUIdx_E3;
3922             for_el3 = true;
3923             break;
3924         default:
3925             g_assert_not_reached();
3926         }
3927         break;
3928     case 2: /* AT S1E0R, AT S1E0W */
3929         mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_Stage1_E0;
3930         break;
3931     case 4: /* AT S12E1R, AT S12E1W */
3932         mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_E10_1;
3933         break;
3934     case 6: /* AT S12E0R, AT S12E0W */
3935         mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_E10_0;
3936         break;
3937     default:
3938         g_assert_not_reached();
3939     }
3940 
3941     ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env);
3942     env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss);
3943 #else
3944     /* Handled by hardware accelerator. */
3945     g_assert_not_reached();
3946 #endif /* CONFIG_TCG */
3947 }
3948 #endif
3949 
3950 /* Return basic MPU access permission bits.  */
simple_mpu_ap_bits(uint32_t val)3951 static uint32_t simple_mpu_ap_bits(uint32_t val)
3952 {
3953     uint32_t ret;
3954     uint32_t mask;
3955     int i;
3956     ret = 0;
3957     mask = 3;
3958     for (i = 0; i < 16; i += 2) {
3959         ret |= (val >> i) & mask;
3960         mask <<= 2;
3961     }
3962     return ret;
3963 }
3964 
3965 /* Pad basic MPU access permission bits to extended format.  */
extended_mpu_ap_bits(uint32_t val)3966 static uint32_t extended_mpu_ap_bits(uint32_t val)
3967 {
3968     uint32_t ret;
3969     uint32_t mask;
3970     int i;
3971     ret = 0;
3972     mask = 3;
3973     for (i = 0; i < 16; i += 2) {
3974         ret |= (val & mask) << i;
3975         mask <<= 2;
3976     }
3977     return ret;
3978 }
3979 
pmsav5_data_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3980 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
3981                                  uint64_t value)
3982 {
3983     env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
3984 }
3985 
pmsav5_data_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)3986 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
3987 {
3988     return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
3989 }
3990 
pmsav5_insn_ap_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)3991 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
3992                                  uint64_t value)
3993 {
3994     env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
3995 }
3996 
pmsav5_insn_ap_read(CPUARMState * env,const ARMCPRegInfo * ri)3997 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
3998 {
3999     return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
4000 }
4001 
pmsav7_read(CPUARMState * env,const ARMCPRegInfo * ri)4002 static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
4003 {
4004     uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
4005 
4006     if (!u32p) {
4007         return 0;
4008     }
4009 
4010     u32p += env->pmsav7.rnr[M_REG_NS];
4011     return *u32p;
4012 }
4013 
pmsav7_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4014 static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
4015                          uint64_t value)
4016 {
4017     ARMCPU *cpu = env_archcpu(env);
4018     uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
4019 
4020     if (!u32p) {
4021         return;
4022     }
4023 
4024     u32p += env->pmsav7.rnr[M_REG_NS];
4025     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
4026     *u32p = value;
4027 }
4028 
pmsav7_rgnr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4029 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4030                               uint64_t value)
4031 {
4032     ARMCPU *cpu = env_archcpu(env);
4033     uint32_t nrgs = cpu->pmsav7_dregion;
4034 
4035     if (value >= nrgs) {
4036         qemu_log_mask(LOG_GUEST_ERROR,
4037                       "PMSAv7 RGNR write >= # supported regions, %" PRIu32
4038                       " > %" PRIu32 "\n", (uint32_t)value, nrgs);
4039         return;
4040     }
4041 
4042     raw_write(env, ri, value);
4043 }
4044 
prbar_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4045 static void prbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
4046                           uint64_t value)
4047 {
4048     ARMCPU *cpu = env_archcpu(env);
4049 
4050     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
4051     env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value;
4052 }
4053 
prbar_read(CPUARMState * env,const ARMCPRegInfo * ri)4054 static uint64_t prbar_read(CPUARMState *env, const ARMCPRegInfo *ri)
4055 {
4056     return env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]];
4057 }
4058 
prlar_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4059 static void prlar_write(CPUARMState *env, const ARMCPRegInfo *ri,
4060                           uint64_t value)
4061 {
4062     ARMCPU *cpu = env_archcpu(env);
4063 
4064     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
4065     env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value;
4066 }
4067 
prlar_read(CPUARMState * env,const ARMCPRegInfo * ri)4068 static uint64_t prlar_read(CPUARMState *env, const ARMCPRegInfo *ri)
4069 {
4070     return env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]];
4071 }
4072 
prselr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4073 static void prselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4074                            uint64_t value)
4075 {
4076     ARMCPU *cpu = env_archcpu(env);
4077 
4078     /*
4079      * Ignore writes that would select not implemented region.
4080      * This is architecturally UNPREDICTABLE.
4081      */
4082     if (value >= cpu->pmsav7_dregion) {
4083         return;
4084     }
4085 
4086     env->pmsav7.rnr[M_REG_NS] = value;
4087 }
4088 
hprbar_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4089 static void hprbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
4090                           uint64_t value)
4091 {
4092     ARMCPU *cpu = env_archcpu(env);
4093 
4094     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
4095     env->pmsav8.hprbar[env->pmsav8.hprselr] = value;
4096 }
4097 
hprbar_read(CPUARMState * env,const ARMCPRegInfo * ri)4098 static uint64_t hprbar_read(CPUARMState *env, const ARMCPRegInfo *ri)
4099 {
4100     return env->pmsav8.hprbar[env->pmsav8.hprselr];
4101 }
4102 
hprlar_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4103 static void hprlar_write(CPUARMState *env, const ARMCPRegInfo *ri,
4104                           uint64_t value)
4105 {
4106     ARMCPU *cpu = env_archcpu(env);
4107 
4108     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
4109     env->pmsav8.hprlar[env->pmsav8.hprselr] = value;
4110 }
4111 
hprlar_read(CPUARMState * env,const ARMCPRegInfo * ri)4112 static uint64_t hprlar_read(CPUARMState *env, const ARMCPRegInfo *ri)
4113 {
4114     return env->pmsav8.hprlar[env->pmsav8.hprselr];
4115 }
4116 
hprenr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4117 static void hprenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4118                           uint64_t value)
4119 {
4120     uint32_t n;
4121     uint32_t bit;
4122     ARMCPU *cpu = env_archcpu(env);
4123 
4124     /* Ignore writes to unimplemented regions */
4125     int rmax = MIN(cpu->pmsav8r_hdregion, 32);
4126     value &= MAKE_64BIT_MASK(0, rmax);
4127 
4128     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
4129 
4130     /* Register alias is only valid for first 32 indexes */
4131     for (n = 0; n < rmax; ++n) {
4132         bit = extract32(value, n, 1);
4133         env->pmsav8.hprlar[n] = deposit32(
4134                     env->pmsav8.hprlar[n], 0, 1, bit);
4135     }
4136 }
4137 
hprenr_read(CPUARMState * env,const ARMCPRegInfo * ri)4138 static uint64_t hprenr_read(CPUARMState *env, const ARMCPRegInfo *ri)
4139 {
4140     uint32_t n;
4141     uint32_t result = 0x0;
4142     ARMCPU *cpu = env_archcpu(env);
4143 
4144     /* Register alias is only valid for first 32 indexes */
4145     for (n = 0; n < MIN(cpu->pmsav8r_hdregion, 32); ++n) {
4146         if (env->pmsav8.hprlar[n] & 0x1) {
4147             result |= (0x1 << n);
4148         }
4149     }
4150     return result;
4151 }
4152 
hprselr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4153 static void hprselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4154                            uint64_t value)
4155 {
4156     ARMCPU *cpu = env_archcpu(env);
4157 
4158     /*
4159      * Ignore writes that would select not implemented region.
4160      * This is architecturally UNPREDICTABLE.
4161      */
4162     if (value >= cpu->pmsav8r_hdregion) {
4163         return;
4164     }
4165 
4166     env->pmsav8.hprselr = value;
4167 }
4168 
pmsav8r_regn_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4169 static void pmsav8r_regn_write(CPUARMState *env, const ARMCPRegInfo *ri,
4170                           uint64_t value)
4171 {
4172     ARMCPU *cpu = env_archcpu(env);
4173     uint8_t index = (extract32(ri->opc0, 0, 1) << 4) |
4174                     (extract32(ri->crm, 0, 3) << 1) | extract32(ri->opc2, 2, 1);
4175 
4176     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
4177 
4178     if (ri->opc1 & 4) {
4179         if (index >= cpu->pmsav8r_hdregion) {
4180             return;
4181         }
4182         if (ri->opc2 & 0x1) {
4183             env->pmsav8.hprlar[index] = value;
4184         } else {
4185             env->pmsav8.hprbar[index] = value;
4186         }
4187     } else {
4188         if (index >= cpu->pmsav7_dregion) {
4189             return;
4190         }
4191         if (ri->opc2 & 0x1) {
4192             env->pmsav8.rlar[M_REG_NS][index] = value;
4193         } else {
4194             env->pmsav8.rbar[M_REG_NS][index] = value;
4195         }
4196     }
4197 }
4198 
pmsav8r_regn_read(CPUARMState * env,const ARMCPRegInfo * ri)4199 static uint64_t pmsav8r_regn_read(CPUARMState *env, const ARMCPRegInfo *ri)
4200 {
4201     ARMCPU *cpu = env_archcpu(env);
4202     uint8_t index = (extract32(ri->opc0, 0, 1) << 4) |
4203                     (extract32(ri->crm, 0, 3) << 1) | extract32(ri->opc2, 2, 1);
4204 
4205     if (ri->opc1 & 4) {
4206         if (index >= cpu->pmsav8r_hdregion) {
4207             return 0x0;
4208         }
4209         if (ri->opc2 & 0x1) {
4210             return env->pmsav8.hprlar[index];
4211         } else {
4212             return env->pmsav8.hprbar[index];
4213         }
4214     } else {
4215         if (index >= cpu->pmsav7_dregion) {
4216             return 0x0;
4217         }
4218         if (ri->opc2 & 0x1) {
4219             return env->pmsav8.rlar[M_REG_NS][index];
4220         } else {
4221             return env->pmsav8.rbar[M_REG_NS][index];
4222         }
4223     }
4224 }
4225 
4226 static const ARMCPRegInfo pmsav8r_cp_reginfo[] = {
4227     { .name = "PRBAR",
4228       .cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 0,
4229       .access = PL1_RW, .type = ARM_CP_NO_RAW,
4230       .accessfn = access_tvm_trvm,
4231       .readfn = prbar_read, .writefn = prbar_write },
4232     { .name = "PRLAR",
4233       .cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 1,
4234       .access = PL1_RW, .type = ARM_CP_NO_RAW,
4235       .accessfn = access_tvm_trvm,
4236       .readfn = prlar_read, .writefn = prlar_write },
4237     { .name = "PRSELR", .resetvalue = 0,
4238       .cp = 15, .opc1 = 0, .crn = 6, .crm = 2, .opc2 = 1,
4239       .access = PL1_RW, .accessfn = access_tvm_trvm,
4240       .writefn = prselr_write,
4241       .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]) },
4242     { .name = "HPRBAR", .resetvalue = 0,
4243       .cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 0,
4244       .access = PL2_RW, .type = ARM_CP_NO_RAW,
4245       .readfn = hprbar_read, .writefn = hprbar_write },
4246     { .name = "HPRLAR",
4247       .cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 1,
4248       .access = PL2_RW, .type = ARM_CP_NO_RAW,
4249       .readfn = hprlar_read, .writefn = hprlar_write },
4250     { .name = "HPRSELR", .resetvalue = 0,
4251       .cp = 15, .opc1 = 4, .crn = 6, .crm = 2, .opc2 = 1,
4252       .access = PL2_RW,
4253       .writefn = hprselr_write,
4254       .fieldoffset = offsetof(CPUARMState, pmsav8.hprselr) },
4255     { .name = "HPRENR",
4256       .cp = 15, .opc1 = 4, .crn = 6, .crm = 1, .opc2 = 1,
4257       .access = PL2_RW, .type = ARM_CP_NO_RAW,
4258       .readfn = hprenr_read, .writefn = hprenr_write },
4259 };
4260 
4261 static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
4262     /*
4263      * Reset for all these registers is handled in arm_cpu_reset(),
4264      * because the PMSAv7 is also used by M-profile CPUs, which do
4265      * not register cpregs but still need the state to be reset.
4266      */
4267     { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
4268       .access = PL1_RW, .type = ARM_CP_NO_RAW,
4269       .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
4270       .readfn = pmsav7_read, .writefn = pmsav7_write,
4271       .resetfn = arm_cp_reset_ignore },
4272     { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
4273       .access = PL1_RW, .type = ARM_CP_NO_RAW,
4274       .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
4275       .readfn = pmsav7_read, .writefn = pmsav7_write,
4276       .resetfn = arm_cp_reset_ignore },
4277     { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
4278       .access = PL1_RW, .type = ARM_CP_NO_RAW,
4279       .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
4280       .readfn = pmsav7_read, .writefn = pmsav7_write,
4281       .resetfn = arm_cp_reset_ignore },
4282     { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
4283       .access = PL1_RW,
4284       .fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]),
4285       .writefn = pmsav7_rgnr_write,
4286       .resetfn = arm_cp_reset_ignore },
4287 };
4288 
4289 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
4290     { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
4291       .access = PL1_RW, .type = ARM_CP_ALIAS,
4292       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
4293       .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
4294     { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
4295       .access = PL1_RW, .type = ARM_CP_ALIAS,
4296       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
4297       .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
4298     { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
4299       .access = PL1_RW,
4300       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
4301       .resetvalue = 0, },
4302     { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
4303       .access = PL1_RW,
4304       .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
4305       .resetvalue = 0, },
4306     { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
4307       .access = PL1_RW,
4308       .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
4309     { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
4310       .access = PL1_RW,
4311       .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
4312     /* Protection region base and size registers */
4313     { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
4314       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
4315       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
4316     { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
4317       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
4318       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
4319     { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
4320       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
4321       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
4322     { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
4323       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
4324       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
4325     { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
4326       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
4327       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
4328     { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
4329       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
4330       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
4331     { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
4332       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
4333       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
4334     { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
4335       .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
4336       .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
4337 };
4338 
vmsa_ttbcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4339 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4340                              uint64_t value)
4341 {
4342     ARMCPU *cpu = env_archcpu(env);
4343 
4344     if (!arm_feature(env, ARM_FEATURE_V8)) {
4345         if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
4346             /*
4347              * Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
4348              * using Long-descriptor translation table format
4349              */
4350             value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
4351         } else if (arm_feature(env, ARM_FEATURE_EL3)) {
4352             /*
4353              * In an implementation that includes the Security Extensions
4354              * TTBCR has additional fields PD0 [4] and PD1 [5] for
4355              * Short-descriptor translation table format.
4356              */
4357             value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
4358         } else {
4359             value &= TTBCR_N;
4360         }
4361     }
4362 
4363     if (arm_feature(env, ARM_FEATURE_LPAE)) {
4364         /*
4365          * With LPAE the TTBCR could result in a change of ASID
4366          * via the TTBCR.A1 bit, so do a TLB flush.
4367          */
4368         tlb_flush(CPU(cpu));
4369     }
4370     raw_write(env, ri, value);
4371 }
4372 
vmsa_tcr_el12_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4373 static void vmsa_tcr_el12_write(CPUARMState *env, const ARMCPRegInfo *ri,
4374                                uint64_t value)
4375 {
4376     ARMCPU *cpu = env_archcpu(env);
4377 
4378     /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
4379     tlb_flush(CPU(cpu));
4380     raw_write(env, ri, value);
4381 }
4382 
vmsa_ttbr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4383 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4384                             uint64_t value)
4385 {
4386     /* If the ASID changes (with a 64-bit write), we must flush the TLB.  */
4387     if (cpreg_field_is_64bit(ri) &&
4388         extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
4389         ARMCPU *cpu = env_archcpu(env);
4390         tlb_flush(CPU(cpu));
4391     }
4392     raw_write(env, ri, value);
4393 }
4394 
vmsa_tcr_ttbr_el2_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4395 static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
4396                                     uint64_t value)
4397 {
4398     /*
4399      * If we are running with E2&0 regime, then an ASID is active.
4400      * Flush if that might be changing.  Note we're not checking
4401      * TCR_EL2.A1 to know if this is really the TTBRx_EL2 that
4402      * holds the active ASID, only checking the field that might.
4403      */
4404     if (extract64(raw_read(env, ri) ^ value, 48, 16) &&
4405         (arm_hcr_el2_eff(env) & HCR_E2H)) {
4406         uint16_t mask = ARMMMUIdxBit_E20_2 |
4407                         ARMMMUIdxBit_E20_2_PAN |
4408                         ARMMMUIdxBit_E20_0;
4409         tlb_flush_by_mmuidx(env_cpu(env), mask);
4410     }
4411     raw_write(env, ri, value);
4412 }
4413 
vttbr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4414 static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4415                         uint64_t value)
4416 {
4417     ARMCPU *cpu = env_archcpu(env);
4418     CPUState *cs = CPU(cpu);
4419 
4420     /*
4421      * A change in VMID to the stage2 page table (Stage2) invalidates
4422      * the stage2 and combined stage 1&2 tlbs (EL10_1 and EL10_0).
4423      */
4424     if (extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
4425         tlb_flush_by_mmuidx(cs, alle1_tlbmask(env));
4426     }
4427     raw_write(env, ri, value);
4428 }
4429 
4430 static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
4431     { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
4432       .access = PL1_RW, .accessfn = access_tvm_trvm, .type = ARM_CP_ALIAS,
4433       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
4434                              offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
4435     { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
4436       .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0,
4437       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
4438                              offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
4439     { .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
4440       .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0,
4441       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
4442                              offsetof(CPUARMState, cp15.dfar_ns) } },
4443     { .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
4444       .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
4445       .access = PL1_RW, .accessfn = access_tvm_trvm,
4446       .fgt = FGT_FAR_EL1,
4447       .nv2_redirect_offset = 0x220 | NV2_REDIR_NV1,
4448       .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
4449       .resetvalue = 0, },
4450 };
4451 
4452 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
4453     { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
4454       .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
4455       .access = PL1_RW, .accessfn = access_tvm_trvm,
4456       .fgt = FGT_ESR_EL1,
4457       .nv2_redirect_offset = 0x138 | NV2_REDIR_NV1,
4458       .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
4459     { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
4460       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
4461       .access = PL1_RW, .accessfn = access_tvm_trvm,
4462       .fgt = FGT_TTBR0_EL1,
4463       .nv2_redirect_offset = 0x200 | NV2_REDIR_NV1,
4464       .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
4465       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
4466                              offsetof(CPUARMState, cp15.ttbr0_ns) } },
4467     { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
4468       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
4469       .access = PL1_RW, .accessfn = access_tvm_trvm,
4470       .fgt = FGT_TTBR1_EL1,
4471       .nv2_redirect_offset = 0x210 | NV2_REDIR_NV1,
4472       .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
4473       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
4474                              offsetof(CPUARMState, cp15.ttbr1_ns) } },
4475     { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
4476       .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
4477       .access = PL1_RW, .accessfn = access_tvm_trvm,
4478       .fgt = FGT_TCR_EL1,
4479       .nv2_redirect_offset = 0x120 | NV2_REDIR_NV1,
4480       .writefn = vmsa_tcr_el12_write,
4481       .raw_writefn = raw_write,
4482       .resetvalue = 0,
4483       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
4484     { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
4485       .access = PL1_RW, .accessfn = access_tvm_trvm,
4486       .type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
4487       .raw_writefn = raw_write,
4488       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
4489                              offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
4490 };
4491 
4492 /*
4493  * Note that unlike TTBCR, writing to TTBCR2 does not require flushing
4494  * qemu tlbs nor adjusting cached masks.
4495  */
4496 static const ARMCPRegInfo ttbcr2_reginfo = {
4497     .name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3,
4498     .access = PL1_RW, .accessfn = access_tvm_trvm,
4499     .type = ARM_CP_ALIAS,
4500     .bank_fieldoffsets = {
4501         offsetofhigh32(CPUARMState, cp15.tcr_el[3]),
4502         offsetofhigh32(CPUARMState, cp15.tcr_el[1]),
4503     },
4504 };
4505 
omap_ticonfig_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4506 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
4507                                 uint64_t value)
4508 {
4509     env->cp15.c15_ticonfig = value & 0xe7;
4510     /* The OS_TYPE bit in this register changes the reported CPUID! */
4511     env->cp15.c0_cpuid = (value & (1 << 5)) ?
4512         ARM_CPUID_TI915T : ARM_CPUID_TI925T;
4513 }
4514 
omap_threadid_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4515 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
4516                                 uint64_t value)
4517 {
4518     env->cp15.c15_threadid = value & 0xffff;
4519 }
4520 
omap_wfi_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4521 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
4522                            uint64_t value)
4523 {
4524     /* Wait-for-interrupt (deprecated) */
4525     cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT);
4526 }
4527 
omap_cachemaint_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4528 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
4529                                   uint64_t value)
4530 {
4531     /*
4532      * On OMAP there are registers indicating the max/min index of dcache lines
4533      * containing a dirty line; cache flush operations have to reset these.
4534      */
4535     env->cp15.c15_i_max = 0x000;
4536     env->cp15.c15_i_min = 0xff0;
4537 }
4538 
4539 static const ARMCPRegInfo omap_cp_reginfo[] = {
4540     { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
4541       .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
4542       .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
4543       .resetvalue = 0, },
4544     { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
4545       .access = PL1_RW, .type = ARM_CP_NOP },
4546     { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
4547       .access = PL1_RW,
4548       .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
4549       .writefn = omap_ticonfig_write },
4550     { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
4551       .access = PL1_RW,
4552       .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
4553     { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
4554       .access = PL1_RW, .resetvalue = 0xff0,
4555       .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
4556     { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
4557       .access = PL1_RW,
4558       .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
4559       .writefn = omap_threadid_write },
4560     { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
4561       .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
4562       .type = ARM_CP_NO_RAW,
4563       .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
4564     /*
4565      * TODO: Peripheral port remap register:
4566      * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
4567      * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
4568      * when MMU is off.
4569      */
4570     { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
4571       .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
4572       .type = ARM_CP_OVERRIDE | ARM_CP_NO_RAW,
4573       .writefn = omap_cachemaint_write },
4574     { .name = "C9", .cp = 15, .crn = 9,
4575       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
4576       .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
4577 };
4578 
xscale_cpar_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4579 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
4580                               uint64_t value)
4581 {
4582     env->cp15.c15_cpar = value & 0x3fff;
4583 }
4584 
4585 static const ARMCPRegInfo xscale_cp_reginfo[] = {
4586     { .name = "XSCALE_CPAR",
4587       .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
4588       .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
4589       .writefn = xscale_cpar_write, },
4590     { .name = "XSCALE_AUXCR",
4591       .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
4592       .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
4593       .resetvalue = 0, },
4594     /*
4595      * XScale specific cache-lockdown: since we have no cache we NOP these
4596      * and hope the guest does not really rely on cache behaviour.
4597      */
4598     { .name = "XSCALE_LOCK_ICACHE_LINE",
4599       .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
4600       .access = PL1_W, .type = ARM_CP_NOP },
4601     { .name = "XSCALE_UNLOCK_ICACHE",
4602       .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
4603       .access = PL1_W, .type = ARM_CP_NOP },
4604     { .name = "XSCALE_DCACHE_LOCK",
4605       .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
4606       .access = PL1_RW, .type = ARM_CP_NOP },
4607     { .name = "XSCALE_UNLOCK_DCACHE",
4608       .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
4609       .access = PL1_W, .type = ARM_CP_NOP },
4610 };
4611 
4612 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
4613     /*
4614      * RAZ/WI the whole crn=15 space, when we don't have a more specific
4615      * implementation of this implementation-defined space.
4616      * Ideally this should eventually disappear in favour of actually
4617      * implementing the correct behaviour for all cores.
4618      */
4619     { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
4620       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
4621       .access = PL1_RW,
4622       .type = ARM_CP_CONST | ARM_CP_NO_RAW | ARM_CP_OVERRIDE,
4623       .resetvalue = 0 },
4624 };
4625 
4626 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
4627     /* Cache status: RAZ because we have no cache so it's always clean */
4628     { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
4629       .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
4630       .resetvalue = 0 },
4631 };
4632 
4633 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
4634     /* We never have a block transfer operation in progress */
4635     { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
4636       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
4637       .resetvalue = 0 },
4638     /* The cache ops themselves: these all NOP for QEMU */
4639     { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
4640       .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
4641     { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
4642       .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
4643     { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
4644       .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
4645     { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
4646       .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
4647     { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
4648       .access = PL0_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
4649     { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
4650       .access = PL1_W, .type = ARM_CP_NOP | ARM_CP_64BIT },
4651 };
4652 
4653 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
4654     /*
4655      * The cache test-and-clean instructions always return (1 << 30)
4656      * to indicate that there are no dirty cache lines.
4657      */
4658     { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
4659       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
4660       .resetvalue = (1 << 30) },
4661     { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
4662       .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_RAW,
4663       .resetvalue = (1 << 30) },
4664 };
4665 
4666 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
4667     /* Ignore ReadBuffer accesses */
4668     { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
4669       .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
4670       .access = PL1_RW, .resetvalue = 0,
4671       .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_RAW },
4672 };
4673 
midr_read(CPUARMState * env,const ARMCPRegInfo * ri)4674 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
4675 {
4676     unsigned int cur_el = arm_current_el(env);
4677 
4678     if (arm_is_el2_enabled(env) && cur_el == 1) {
4679         return env->cp15.vpidr_el2;
4680     }
4681     return raw_read(env, ri);
4682 }
4683 
mpidr_read_val(CPUARMState * env)4684 static uint64_t mpidr_read_val(CPUARMState *env)
4685 {
4686     ARMCPU *cpu = env_archcpu(env);
4687     uint64_t mpidr = cpu->mp_affinity;
4688 
4689     if (arm_feature(env, ARM_FEATURE_V7MP)) {
4690         mpidr |= (1U << 31);
4691         /*
4692          * Cores which are uniprocessor (non-coherent)
4693          * but still implement the MP extensions set
4694          * bit 30. (For instance, Cortex-R5).
4695          */
4696         if (cpu->mp_is_up) {
4697             mpidr |= (1u << 30);
4698         }
4699     }
4700     return mpidr;
4701 }
4702 
mpidr_read(CPUARMState * env,const ARMCPRegInfo * ri)4703 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
4704 {
4705     unsigned int cur_el = arm_current_el(env);
4706 
4707     if (arm_is_el2_enabled(env) && cur_el == 1) {
4708         return env->cp15.vmpidr_el2;
4709     }
4710     return mpidr_read_val(env);
4711 }
4712 
4713 static const ARMCPRegInfo lpae_cp_reginfo[] = {
4714     /* NOP AMAIR0/1 */
4715     { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
4716       .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
4717       .access = PL1_RW, .accessfn = access_tvm_trvm,
4718       .fgt = FGT_AMAIR_EL1,
4719       .nv2_redirect_offset = 0x148 | NV2_REDIR_NV1,
4720       .type = ARM_CP_CONST, .resetvalue = 0 },
4721     /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
4722     { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
4723       .access = PL1_RW, .accessfn = access_tvm_trvm,
4724       .type = ARM_CP_CONST, .resetvalue = 0 },
4725     { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
4726       .access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
4727       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
4728                              offsetof(CPUARMState, cp15.par_ns)} },
4729     { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
4730       .access = PL1_RW, .accessfn = access_tvm_trvm,
4731       .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4732       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
4733                              offsetof(CPUARMState, cp15.ttbr0_ns) },
4734       .writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
4735     { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
4736       .access = PL1_RW, .accessfn = access_tvm_trvm,
4737       .type = ARM_CP_64BIT | ARM_CP_ALIAS,
4738       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
4739                              offsetof(CPUARMState, cp15.ttbr1_ns) },
4740       .writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
4741 };
4742 
aa64_fpcr_read(CPUARMState * env,const ARMCPRegInfo * ri)4743 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
4744 {
4745     return vfp_get_fpcr(env);
4746 }
4747 
aa64_fpcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4748 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4749                             uint64_t value)
4750 {
4751     vfp_set_fpcr(env, value);
4752 }
4753 
aa64_fpsr_read(CPUARMState * env,const ARMCPRegInfo * ri)4754 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
4755 {
4756     return vfp_get_fpsr(env);
4757 }
4758 
aa64_fpsr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4759 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
4760                             uint64_t value)
4761 {
4762     vfp_set_fpsr(env, value);
4763 }
4764 
aa64_daif_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)4765 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri,
4766                                        bool isread)
4767 {
4768     if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UMA)) {
4769         return CP_ACCESS_TRAP;
4770     }
4771     return CP_ACCESS_OK;
4772 }
4773 
aa64_daif_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4774 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
4775                             uint64_t value)
4776 {
4777     env->daif = value & PSTATE_DAIF;
4778 }
4779 
aa64_pan_read(CPUARMState * env,const ARMCPRegInfo * ri)4780 static uint64_t aa64_pan_read(CPUARMState *env, const ARMCPRegInfo *ri)
4781 {
4782     return env->pstate & PSTATE_PAN;
4783 }
4784 
aa64_pan_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4785 static void aa64_pan_write(CPUARMState *env, const ARMCPRegInfo *ri,
4786                            uint64_t value)
4787 {
4788     env->pstate = (env->pstate & ~PSTATE_PAN) | (value & PSTATE_PAN);
4789 }
4790 
4791 static const ARMCPRegInfo pan_reginfo = {
4792     .name = "PAN", .state = ARM_CP_STATE_AA64,
4793     .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 3,
4794     .type = ARM_CP_NO_RAW, .access = PL1_RW,
4795     .readfn = aa64_pan_read, .writefn = aa64_pan_write
4796 };
4797 
aa64_uao_read(CPUARMState * env,const ARMCPRegInfo * ri)4798 static uint64_t aa64_uao_read(CPUARMState *env, const ARMCPRegInfo *ri)
4799 {
4800     return env->pstate & PSTATE_UAO;
4801 }
4802 
aa64_uao_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4803 static void aa64_uao_write(CPUARMState *env, const ARMCPRegInfo *ri,
4804                            uint64_t value)
4805 {
4806     env->pstate = (env->pstate & ~PSTATE_UAO) | (value & PSTATE_UAO);
4807 }
4808 
4809 static const ARMCPRegInfo uao_reginfo = {
4810     .name = "UAO", .state = ARM_CP_STATE_AA64,
4811     .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 4,
4812     .type = ARM_CP_NO_RAW, .access = PL1_RW,
4813     .readfn = aa64_uao_read, .writefn = aa64_uao_write
4814 };
4815 
aa64_dit_read(CPUARMState * env,const ARMCPRegInfo * ri)4816 static uint64_t aa64_dit_read(CPUARMState *env, const ARMCPRegInfo *ri)
4817 {
4818     return env->pstate & PSTATE_DIT;
4819 }
4820 
aa64_dit_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4821 static void aa64_dit_write(CPUARMState *env, const ARMCPRegInfo *ri,
4822                            uint64_t value)
4823 {
4824     env->pstate = (env->pstate & ~PSTATE_DIT) | (value & PSTATE_DIT);
4825 }
4826 
4827 static const ARMCPRegInfo dit_reginfo = {
4828     .name = "DIT", .state = ARM_CP_STATE_AA64,
4829     .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 5,
4830     .type = ARM_CP_NO_RAW, .access = PL0_RW,
4831     .readfn = aa64_dit_read, .writefn = aa64_dit_write
4832 };
4833 
aa64_ssbs_read(CPUARMState * env,const ARMCPRegInfo * ri)4834 static uint64_t aa64_ssbs_read(CPUARMState *env, const ARMCPRegInfo *ri)
4835 {
4836     return env->pstate & PSTATE_SSBS;
4837 }
4838 
aa64_ssbs_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4839 static void aa64_ssbs_write(CPUARMState *env, const ARMCPRegInfo *ri,
4840                            uint64_t value)
4841 {
4842     env->pstate = (env->pstate & ~PSTATE_SSBS) | (value & PSTATE_SSBS);
4843 }
4844 
4845 static const ARMCPRegInfo ssbs_reginfo = {
4846     .name = "SSBS", .state = ARM_CP_STATE_AA64,
4847     .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 6,
4848     .type = ARM_CP_NO_RAW, .access = PL0_RW,
4849     .readfn = aa64_ssbs_read, .writefn = aa64_ssbs_write
4850 };
4851 
aa64_cacheop_poc_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)4852 static CPAccessResult aa64_cacheop_poc_access(CPUARMState *env,
4853                                               const ARMCPRegInfo *ri,
4854                                               bool isread)
4855 {
4856     /* Cache invalidate/clean to Point of Coherency or Persistence...  */
4857     switch (arm_current_el(env)) {
4858     case 0:
4859         /* ... EL0 must UNDEF unless SCTLR_EL1.UCI is set.  */
4860         if (!(arm_sctlr(env, 0) & SCTLR_UCI)) {
4861             return CP_ACCESS_TRAP;
4862         }
4863         /* fall through */
4864     case 1:
4865         /* ... EL1 must trap to EL2 if HCR_EL2.TPCP is set.  */
4866         if (arm_hcr_el2_eff(env) & HCR_TPCP) {
4867             return CP_ACCESS_TRAP_EL2;
4868         }
4869         break;
4870     }
4871     return CP_ACCESS_OK;
4872 }
4873 
do_cacheop_pou_access(CPUARMState * env,uint64_t hcrflags)4874 static CPAccessResult do_cacheop_pou_access(CPUARMState *env, uint64_t hcrflags)
4875 {
4876     /* Cache invalidate/clean to Point of Unification... */
4877     switch (arm_current_el(env)) {
4878     case 0:
4879         /* ... EL0 must UNDEF unless SCTLR_EL1.UCI is set.  */
4880         if (!(arm_sctlr(env, 0) & SCTLR_UCI)) {
4881             return CP_ACCESS_TRAP;
4882         }
4883         /* fall through */
4884     case 1:
4885         /* ... EL1 must trap to EL2 if relevant HCR_EL2 flags are set.  */
4886         if (arm_hcr_el2_eff(env) & hcrflags) {
4887             return CP_ACCESS_TRAP_EL2;
4888         }
4889         break;
4890     }
4891     return CP_ACCESS_OK;
4892 }
4893 
access_ticab(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)4894 static CPAccessResult access_ticab(CPUARMState *env, const ARMCPRegInfo *ri,
4895                                    bool isread)
4896 {
4897     return do_cacheop_pou_access(env, HCR_TICAB | HCR_TPU);
4898 }
4899 
access_tocu(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)4900 static CPAccessResult access_tocu(CPUARMState *env, const ARMCPRegInfo *ri,
4901                                   bool isread)
4902 {
4903     return do_cacheop_pou_access(env, HCR_TOCU | HCR_TPU);
4904 }
4905 
4906 /*
4907  * See: D4.7.2 TLB maintenance requirements and the TLB maintenance instructions
4908  * Page D4-1736 (DDI0487A.b)
4909  */
4910 
vae1_tlbmask(CPUARMState * env)4911 static int vae1_tlbmask(CPUARMState *env)
4912 {
4913     uint64_t hcr = arm_hcr_el2_eff(env);
4914     uint16_t mask;
4915 
4916     assert(arm_feature(env, ARM_FEATURE_AARCH64));
4917 
4918     if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
4919         mask = ARMMMUIdxBit_E20_2 |
4920                ARMMMUIdxBit_E20_2_PAN |
4921                ARMMMUIdxBit_E20_0;
4922     } else {
4923         /* This is AArch64 only, so we don't need to touch the EL30_x TLBs */
4924         mask = ARMMMUIdxBit_E10_1 |
4925                ARMMMUIdxBit_E10_1_PAN |
4926                ARMMMUIdxBit_E10_0;
4927     }
4928     return mask;
4929 }
4930 
vae2_tlbmask(CPUARMState * env)4931 static int vae2_tlbmask(CPUARMState *env)
4932 {
4933     uint64_t hcr = arm_hcr_el2_eff(env);
4934     uint16_t mask;
4935 
4936     if (hcr & HCR_E2H) {
4937         mask = ARMMMUIdxBit_E20_2 |
4938                ARMMMUIdxBit_E20_2_PAN |
4939                ARMMMUIdxBit_E20_0;
4940     } else {
4941         mask = ARMMMUIdxBit_E2;
4942     }
4943     return mask;
4944 }
4945 
4946 /* Return 56 if TBI is enabled, 64 otherwise. */
tlbbits_for_regime(CPUARMState * env,ARMMMUIdx mmu_idx,uint64_t addr)4947 static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
4948                               uint64_t addr)
4949 {
4950     uint64_t tcr = regime_tcr(env, mmu_idx);
4951     int tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
4952     int select = extract64(addr, 55, 1);
4953 
4954     return (tbi >> select) & 1 ? 56 : 64;
4955 }
4956 
vae1_tlbbits(CPUARMState * env,uint64_t addr)4957 static int vae1_tlbbits(CPUARMState *env, uint64_t addr)
4958 {
4959     uint64_t hcr = arm_hcr_el2_eff(env);
4960     ARMMMUIdx mmu_idx;
4961 
4962     assert(arm_feature(env, ARM_FEATURE_AARCH64));
4963 
4964     /* Only the regime of the mmu_idx below is significant. */
4965     if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
4966         mmu_idx = ARMMMUIdx_E20_0;
4967     } else {
4968         mmu_idx = ARMMMUIdx_E10_0;
4969     }
4970 
4971     return tlbbits_for_regime(env, mmu_idx, addr);
4972 }
4973 
vae2_tlbbits(CPUARMState * env,uint64_t addr)4974 static int vae2_tlbbits(CPUARMState *env, uint64_t addr)
4975 {
4976     uint64_t hcr = arm_hcr_el2_eff(env);
4977     ARMMMUIdx mmu_idx;
4978 
4979     /*
4980      * Only the regime of the mmu_idx below is significant.
4981      * Regime EL2&0 has two ranges with separate TBI configuration, while EL2
4982      * only has one.
4983      */
4984     if (hcr & HCR_E2H) {
4985         mmu_idx = ARMMMUIdx_E20_2;
4986     } else {
4987         mmu_idx = ARMMMUIdx_E2;
4988     }
4989 
4990     return tlbbits_for_regime(env, mmu_idx, addr);
4991 }
4992 
tlbi_aa64_vmalle1is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)4993 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
4994                                       uint64_t value)
4995 {
4996     CPUState *cs = env_cpu(env);
4997     int mask = vae1_tlbmask(env);
4998 
4999     tlb_flush_by_mmuidx_all_cpus_synced(cs, mask);
5000 }
5001 
tlbi_aa64_vmalle1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5002 static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
5003                                     uint64_t value)
5004 {
5005     CPUState *cs = env_cpu(env);
5006     int mask = vae1_tlbmask(env);
5007 
5008     if (tlb_force_broadcast(env)) {
5009         tlb_flush_by_mmuidx_all_cpus_synced(cs, mask);
5010     } else {
5011         tlb_flush_by_mmuidx(cs, mask);
5012     }
5013 }
5014 
e2_tlbmask(CPUARMState * env)5015 static int e2_tlbmask(CPUARMState *env)
5016 {
5017     return (ARMMMUIdxBit_E20_0 |
5018             ARMMMUIdxBit_E20_2 |
5019             ARMMMUIdxBit_E20_2_PAN |
5020             ARMMMUIdxBit_E2);
5021 }
5022 
tlbi_aa64_alle1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5023 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
5024                                   uint64_t value)
5025 {
5026     CPUState *cs = env_cpu(env);
5027     int mask = alle1_tlbmask(env);
5028 
5029     tlb_flush_by_mmuidx(cs, mask);
5030 }
5031 
tlbi_aa64_alle2_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5032 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
5033                                   uint64_t value)
5034 {
5035     CPUState *cs = env_cpu(env);
5036     int mask = e2_tlbmask(env);
5037 
5038     tlb_flush_by_mmuidx(cs, mask);
5039 }
5040 
tlbi_aa64_alle3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5041 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
5042                                   uint64_t value)
5043 {
5044     ARMCPU *cpu = env_archcpu(env);
5045     CPUState *cs = CPU(cpu);
5046 
5047     tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E3);
5048 }
5049 
tlbi_aa64_alle1is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5050 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
5051                                     uint64_t value)
5052 {
5053     CPUState *cs = env_cpu(env);
5054     int mask = alle1_tlbmask(env);
5055 
5056     tlb_flush_by_mmuidx_all_cpus_synced(cs, mask);
5057 }
5058 
tlbi_aa64_alle2is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5059 static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
5060                                     uint64_t value)
5061 {
5062     CPUState *cs = env_cpu(env);
5063     int mask = e2_tlbmask(env);
5064 
5065     tlb_flush_by_mmuidx_all_cpus_synced(cs, mask);
5066 }
5067 
tlbi_aa64_alle3is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5068 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
5069                                     uint64_t value)
5070 {
5071     CPUState *cs = env_cpu(env);
5072 
5073     tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E3);
5074 }
5075 
tlbi_aa64_vae2_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5076 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
5077                                  uint64_t value)
5078 {
5079     /*
5080      * Invalidate by VA, EL2
5081      * Currently handles both VAE2 and VALE2, since we don't support
5082      * flush-last-level-only.
5083      */
5084     CPUState *cs = env_cpu(env);
5085     int mask = vae2_tlbmask(env);
5086     uint64_t pageaddr = sextract64(value << 12, 0, 56);
5087     int bits = vae2_tlbbits(env, pageaddr);
5088 
5089     tlb_flush_page_bits_by_mmuidx(cs, pageaddr, mask, bits);
5090 }
5091 
tlbi_aa64_vae3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5092 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
5093                                  uint64_t value)
5094 {
5095     /*
5096      * Invalidate by VA, EL3
5097      * Currently handles both VAE3 and VALE3, since we don't support
5098      * flush-last-level-only.
5099      */
5100     ARMCPU *cpu = env_archcpu(env);
5101     CPUState *cs = CPU(cpu);
5102     uint64_t pageaddr = sextract64(value << 12, 0, 56);
5103 
5104     tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E3);
5105 }
5106 
tlbi_aa64_vae1is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5107 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
5108                                    uint64_t value)
5109 {
5110     CPUState *cs = env_cpu(env);
5111     int mask = vae1_tlbmask(env);
5112     uint64_t pageaddr = sextract64(value << 12, 0, 56);
5113     int bits = vae1_tlbbits(env, pageaddr);
5114 
5115     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
5116 }
5117 
tlbi_aa64_vae1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5118 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
5119                                  uint64_t value)
5120 {
5121     /*
5122      * Invalidate by VA, EL1&0 (AArch64 version).
5123      * Currently handles all of VAE1, VAAE1, VAALE1 and VALE1,
5124      * since we don't support flush-for-specific-ASID-only or
5125      * flush-last-level-only.
5126      */
5127     CPUState *cs = env_cpu(env);
5128     int mask = vae1_tlbmask(env);
5129     uint64_t pageaddr = sextract64(value << 12, 0, 56);
5130     int bits = vae1_tlbbits(env, pageaddr);
5131 
5132     if (tlb_force_broadcast(env)) {
5133         tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
5134     } else {
5135         tlb_flush_page_bits_by_mmuidx(cs, pageaddr, mask, bits);
5136     }
5137 }
5138 
tlbi_aa64_vae2is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5139 static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
5140                                    uint64_t value)
5141 {
5142     CPUState *cs = env_cpu(env);
5143     int mask = vae2_tlbmask(env);
5144     uint64_t pageaddr = sextract64(value << 12, 0, 56);
5145     int bits = vae2_tlbbits(env, pageaddr);
5146 
5147     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
5148 }
5149 
tlbi_aa64_vae3is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5150 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
5151                                    uint64_t value)
5152 {
5153     CPUState *cs = env_cpu(env);
5154     uint64_t pageaddr = sextract64(value << 12, 0, 56);
5155     int bits = tlbbits_for_regime(env, ARMMMUIdx_E3, pageaddr);
5156 
5157     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
5158                                                   ARMMMUIdxBit_E3, bits);
5159 }
5160 
ipas2e1_tlbmask(CPUARMState * env,int64_t value)5161 static int ipas2e1_tlbmask(CPUARMState *env, int64_t value)
5162 {
5163     /*
5164      * The MSB of value is the NS field, which only applies if SEL2
5165      * is implemented and SCR_EL3.NS is not set (i.e. in secure mode).
5166      */
5167     return (value >= 0
5168             && cpu_isar_feature(aa64_sel2, env_archcpu(env))
5169             && arm_is_secure_below_el3(env)
5170             ? ARMMMUIdxBit_Stage2_S
5171             : ARMMMUIdxBit_Stage2);
5172 }
5173 
tlbi_aa64_ipas2e1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5174 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
5175                                     uint64_t value)
5176 {
5177     CPUState *cs = env_cpu(env);
5178     int mask = ipas2e1_tlbmask(env, value);
5179     uint64_t pageaddr = sextract64(value << 12, 0, 56);
5180 
5181     if (tlb_force_broadcast(env)) {
5182         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask);
5183     } else {
5184         tlb_flush_page_by_mmuidx(cs, pageaddr, mask);
5185     }
5186 }
5187 
tlbi_aa64_ipas2e1is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5188 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
5189                                       uint64_t value)
5190 {
5191     CPUState *cs = env_cpu(env);
5192     int mask = ipas2e1_tlbmask(env, value);
5193     uint64_t pageaddr = sextract64(value << 12, 0, 56);
5194 
5195     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr, mask);
5196 }
5197 
5198 #ifdef TARGET_AARCH64
5199 typedef struct {
5200     uint64_t base;
5201     uint64_t length;
5202 } TLBIRange;
5203 
tlbi_range_tg_to_gran_size(int tg)5204 static ARMGranuleSize tlbi_range_tg_to_gran_size(int tg)
5205 {
5206     /*
5207      * Note that the TLBI range TG field encoding differs from both
5208      * TG0 and TG1 encodings.
5209      */
5210     switch (tg) {
5211     case 1:
5212         return Gran4K;
5213     case 2:
5214         return Gran16K;
5215     case 3:
5216         return Gran64K;
5217     default:
5218         return GranInvalid;
5219     }
5220 }
5221 
tlbi_aa64_get_range(CPUARMState * env,ARMMMUIdx mmuidx,uint64_t value)5222 static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
5223                                      uint64_t value)
5224 {
5225     unsigned int page_size_granule, page_shift, num, scale, exponent;
5226     /* Extract one bit to represent the va selector in use. */
5227     uint64_t select = sextract64(value, 36, 1);
5228     ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true, false);
5229     TLBIRange ret = { };
5230     ARMGranuleSize gran;
5231 
5232     page_size_granule = extract64(value, 46, 2);
5233     gran = tlbi_range_tg_to_gran_size(page_size_granule);
5234 
5235     /* The granule encoded in value must match the granule in use. */
5236     if (gran != param.gran) {
5237         qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
5238                       page_size_granule);
5239         return ret;
5240     }
5241 
5242     page_shift = arm_granule_bits(gran);
5243     num = extract64(value, 39, 5);
5244     scale = extract64(value, 44, 2);
5245     exponent = (5 * scale) + 1;
5246 
5247     ret.length = (num + 1) << (exponent + page_shift);
5248 
5249     if (param.select) {
5250         ret.base = sextract64(value, 0, 37);
5251     } else {
5252         ret.base = extract64(value, 0, 37);
5253     }
5254     if (param.ds) {
5255         /*
5256          * With DS=1, BaseADDR is always shifted 16 so that it is able
5257          * to address all 52 va bits.  The input address is perforce
5258          * aligned on a 64k boundary regardless of translation granule.
5259          */
5260         page_shift = 16;
5261     }
5262     ret.base <<= page_shift;
5263 
5264     return ret;
5265 }
5266 
do_rvae_write(CPUARMState * env,uint64_t value,int idxmap,bool synced)5267 static void do_rvae_write(CPUARMState *env, uint64_t value,
5268                           int idxmap, bool synced)
5269 {
5270     ARMMMUIdx one_idx = ARM_MMU_IDX_A | ctz32(idxmap);
5271     TLBIRange range;
5272     int bits;
5273 
5274     range = tlbi_aa64_get_range(env, one_idx, value);
5275     bits = tlbbits_for_regime(env, one_idx, range.base);
5276 
5277     if (synced) {
5278         tlb_flush_range_by_mmuidx_all_cpus_synced(env_cpu(env),
5279                                                   range.base,
5280                                                   range.length,
5281                                                   idxmap,
5282                                                   bits);
5283     } else {
5284         tlb_flush_range_by_mmuidx(env_cpu(env), range.base,
5285                                   range.length, idxmap, bits);
5286     }
5287 }
5288 
tlbi_aa64_rvae1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5289 static void tlbi_aa64_rvae1_write(CPUARMState *env,
5290                                   const ARMCPRegInfo *ri,
5291                                   uint64_t value)
5292 {
5293     /*
5294      * Invalidate by VA range, EL1&0.
5295      * Currently handles all of RVAE1, RVAAE1, RVAALE1 and RVALE1,
5296      * since we don't support flush-for-specific-ASID-only or
5297      * flush-last-level-only.
5298      */
5299 
5300     do_rvae_write(env, value, vae1_tlbmask(env),
5301                   tlb_force_broadcast(env));
5302 }
5303 
tlbi_aa64_rvae1is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5304 static void tlbi_aa64_rvae1is_write(CPUARMState *env,
5305                                     const ARMCPRegInfo *ri,
5306                                     uint64_t value)
5307 {
5308     /*
5309      * Invalidate by VA range, Inner/Outer Shareable EL1&0.
5310      * Currently handles all of RVAE1IS, RVAE1OS, RVAAE1IS, RVAAE1OS,
5311      * RVAALE1IS, RVAALE1OS, RVALE1IS and RVALE1OS, since we don't support
5312      * flush-for-specific-ASID-only, flush-last-level-only or inner/outer
5313      * shareable specific flushes.
5314      */
5315 
5316     do_rvae_write(env, value, vae1_tlbmask(env), true);
5317 }
5318 
tlbi_aa64_rvae2_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5319 static void tlbi_aa64_rvae2_write(CPUARMState *env,
5320                                   const ARMCPRegInfo *ri,
5321                                   uint64_t value)
5322 {
5323     /*
5324      * Invalidate by VA range, EL2.
5325      * Currently handles all of RVAE2 and RVALE2,
5326      * since we don't support flush-for-specific-ASID-only or
5327      * flush-last-level-only.
5328      */
5329 
5330     do_rvae_write(env, value, vae2_tlbmask(env),
5331                   tlb_force_broadcast(env));
5332 
5333 
5334 }
5335 
tlbi_aa64_rvae2is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5336 static void tlbi_aa64_rvae2is_write(CPUARMState *env,
5337                                     const ARMCPRegInfo *ri,
5338                                     uint64_t value)
5339 {
5340     /*
5341      * Invalidate by VA range, Inner/Outer Shareable, EL2.
5342      * Currently handles all of RVAE2IS, RVAE2OS, RVALE2IS and RVALE2OS,
5343      * since we don't support flush-for-specific-ASID-only,
5344      * flush-last-level-only or inner/outer shareable specific flushes.
5345      */
5346 
5347     do_rvae_write(env, value, vae2_tlbmask(env), true);
5348 
5349 }
5350 
tlbi_aa64_rvae3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5351 static void tlbi_aa64_rvae3_write(CPUARMState *env,
5352                                   const ARMCPRegInfo *ri,
5353                                   uint64_t value)
5354 {
5355     /*
5356      * Invalidate by VA range, EL3.
5357      * Currently handles all of RVAE3 and RVALE3,
5358      * since we don't support flush-for-specific-ASID-only or
5359      * flush-last-level-only.
5360      */
5361 
5362     do_rvae_write(env, value, ARMMMUIdxBit_E3, tlb_force_broadcast(env));
5363 }
5364 
tlbi_aa64_rvae3is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5365 static void tlbi_aa64_rvae3is_write(CPUARMState *env,
5366                                     const ARMCPRegInfo *ri,
5367                                     uint64_t value)
5368 {
5369     /*
5370      * Invalidate by VA range, EL3, Inner/Outer Shareable.
5371      * Currently handles all of RVAE3IS, RVAE3OS, RVALE3IS and RVALE3OS,
5372      * since we don't support flush-for-specific-ASID-only,
5373      * flush-last-level-only or inner/outer specific flushes.
5374      */
5375 
5376     do_rvae_write(env, value, ARMMMUIdxBit_E3, true);
5377 }
5378 
tlbi_aa64_ripas2e1_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5379 static void tlbi_aa64_ripas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
5380                                      uint64_t value)
5381 {
5382     do_rvae_write(env, value, ipas2e1_tlbmask(env, value),
5383                   tlb_force_broadcast(env));
5384 }
5385 
tlbi_aa64_ripas2e1is_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5386 static void tlbi_aa64_ripas2e1is_write(CPUARMState *env,
5387                                        const ARMCPRegInfo *ri,
5388                                        uint64_t value)
5389 {
5390     do_rvae_write(env, value, ipas2e1_tlbmask(env, value), true);
5391 }
5392 #endif
5393 
aa64_zva_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)5394 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
5395                                       bool isread)
5396 {
5397     int cur_el = arm_current_el(env);
5398 
5399     if (cur_el < 2) {
5400         uint64_t hcr = arm_hcr_el2_eff(env);
5401 
5402         if (cur_el == 0) {
5403             if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
5404                 if (!(env->cp15.sctlr_el[2] & SCTLR_DZE)) {
5405                     return CP_ACCESS_TRAP_EL2;
5406                 }
5407             } else {
5408                 if (!(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
5409                     return CP_ACCESS_TRAP;
5410                 }
5411                 if (hcr & HCR_TDZ) {
5412                     return CP_ACCESS_TRAP_EL2;
5413                 }
5414             }
5415         } else if (hcr & HCR_TDZ) {
5416             return CP_ACCESS_TRAP_EL2;
5417         }
5418     }
5419     return CP_ACCESS_OK;
5420 }
5421 
aa64_dczid_read(CPUARMState * env,const ARMCPRegInfo * ri)5422 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
5423 {
5424     ARMCPU *cpu = env_archcpu(env);
5425     int dzp_bit = 1 << 4;
5426 
5427     /* DZP indicates whether DC ZVA access is allowed */
5428     if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) {
5429         dzp_bit = 0;
5430     }
5431     return cpu->dcz_blocksize | dzp_bit;
5432 }
5433 
sp_el0_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)5434 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
5435                                     bool isread)
5436 {
5437     if (!(env->pstate & PSTATE_SP)) {
5438         /*
5439          * Access to SP_EL0 is undefined if it's being used as
5440          * the stack pointer.
5441          */
5442         return CP_ACCESS_TRAP_UNCATEGORIZED;
5443     }
5444     return CP_ACCESS_OK;
5445 }
5446 
spsel_read(CPUARMState * env,const ARMCPRegInfo * ri)5447 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
5448 {
5449     return env->pstate & PSTATE_SP;
5450 }
5451 
spsel_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t val)5452 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
5453 {
5454     update_spsel(env, val);
5455 }
5456 
sctlr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5457 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5458                         uint64_t value)
5459 {
5460     ARMCPU *cpu = env_archcpu(env);
5461 
5462     if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
5463         /* M bit is RAZ/WI for PMSA with no MPU implemented */
5464         value &= ~SCTLR_M;
5465     }
5466 
5467     /* ??? Lots of these bits are not implemented.  */
5468 
5469     if (ri->state == ARM_CP_STATE_AA64 && !cpu_isar_feature(aa64_mte, cpu)) {
5470         if (ri->opc1 == 6) { /* SCTLR_EL3 */
5471             value &= ~(SCTLR_ITFSB | SCTLR_TCF | SCTLR_ATA);
5472         } else {
5473             value &= ~(SCTLR_ITFSB | SCTLR_TCF0 | SCTLR_TCF |
5474                        SCTLR_ATA0 | SCTLR_ATA);
5475         }
5476     }
5477 
5478     if (raw_read(env, ri) == value) {
5479         /*
5480          * Skip the TLB flush if nothing actually changed; Linux likes
5481          * to do a lot of pointless SCTLR writes.
5482          */
5483         return;
5484     }
5485 
5486     raw_write(env, ri, value);
5487 
5488     /* This may enable/disable the MMU, so do a TLB flush.  */
5489     tlb_flush(CPU(cpu));
5490 
5491     if (tcg_enabled() && ri->type & ARM_CP_SUPPRESS_TB_END) {
5492         /*
5493          * Normally we would always end the TB on an SCTLR write; see the
5494          * comment in ARMCPRegInfo sctlr initialization below for why Xscale
5495          * is special.  Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild
5496          * of hflags from the translator, so do it here.
5497          */
5498         arm_rebuild_hflags(env);
5499     }
5500 }
5501 
mdcr_el3_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5502 static void mdcr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
5503                            uint64_t value)
5504 {
5505     /*
5506      * Some MDCR_EL3 bits affect whether PMU counters are running:
5507      * if we are trying to change any of those then we must
5508      * bracket this update with PMU start/finish calls.
5509      */
5510     bool pmu_op = (env->cp15.mdcr_el3 ^ value) & MDCR_EL3_PMU_ENABLE_BITS;
5511 
5512     if (pmu_op) {
5513         pmu_op_start(env);
5514     }
5515     env->cp15.mdcr_el3 = value;
5516     if (pmu_op) {
5517         pmu_op_finish(env);
5518     }
5519 }
5520 
sdcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5521 static void sdcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
5522                        uint64_t value)
5523 {
5524     /* Not all bits defined for MDCR_EL3 exist in the AArch32 SDCR */
5525     mdcr_el3_write(env, ri, value & SDCR_VALID_MASK);
5526 }
5527 
mdcr_el2_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5528 static void mdcr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
5529                            uint64_t value)
5530 {
5531     /*
5532      * Some MDCR_EL2 bits affect whether PMU counters are running:
5533      * if we are trying to change any of those then we must
5534      * bracket this update with PMU start/finish calls.
5535      */
5536     bool pmu_op = (env->cp15.mdcr_el2 ^ value) & MDCR_EL2_PMU_ENABLE_BITS;
5537 
5538     if (pmu_op) {
5539         pmu_op_start(env);
5540     }
5541     env->cp15.mdcr_el2 = value;
5542     if (pmu_op) {
5543         pmu_op_finish(env);
5544     }
5545 }
5546 
access_nv1(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)5547 static CPAccessResult access_nv1(CPUARMState *env, const ARMCPRegInfo *ri,
5548                                  bool isread)
5549 {
5550     if (arm_current_el(env) == 1) {
5551         uint64_t hcr_nv = arm_hcr_el2_eff(env) & (HCR_NV | HCR_NV1 | HCR_NV2);
5552 
5553         if (hcr_nv == (HCR_NV | HCR_NV1)) {
5554             return CP_ACCESS_TRAP_EL2;
5555         }
5556     }
5557     return CP_ACCESS_OK;
5558 }
5559 
5560 #ifdef CONFIG_USER_ONLY
5561 /*
5562  * `IC IVAU` is handled to improve compatibility with JITs that dual-map their
5563  * code to get around W^X restrictions, where one region is writable and the
5564  * other is executable.
5565  *
5566  * Since the executable region is never written to we cannot detect code
5567  * changes when running in user mode, and rely on the emulated JIT telling us
5568  * that the code has changed by executing this instruction.
5569  */
ic_ivau_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)5570 static void ic_ivau_write(CPUARMState *env, const ARMCPRegInfo *ri,
5571                           uint64_t value)
5572 {
5573     uint64_t icache_line_mask, start_address, end_address;
5574     const ARMCPU *cpu;
5575 
5576     cpu = env_archcpu(env);
5577 
5578     icache_line_mask = (4 << extract32(cpu->ctr, 0, 4)) - 1;
5579     start_address = value & ~icache_line_mask;
5580     end_address = value | icache_line_mask;
5581 
5582     mmap_lock();
5583 
5584     tb_invalidate_phys_range(start_address, end_address);
5585 
5586     mmap_unlock();
5587 }
5588 #endif
5589 
5590 static const ARMCPRegInfo v8_cp_reginfo[] = {
5591     /*
5592      * Minimal set of EL0-visible registers. This will need to be expanded
5593      * significantly for system emulation of AArch64 CPUs.
5594      */
5595     { .name = "NZCV", .state = ARM_CP_STATE_AA64,
5596       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
5597       .access = PL0_RW, .type = ARM_CP_NZCV },
5598     { .name = "DAIF", .state = ARM_CP_STATE_AA64,
5599       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
5600       .type = ARM_CP_NO_RAW,
5601       .access = PL0_RW, .accessfn = aa64_daif_access,
5602       .fieldoffset = offsetof(CPUARMState, daif),
5603       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
5604     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
5605       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
5606       .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
5607       .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
5608     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
5609       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
5610       .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
5611       .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
5612     { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
5613       .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
5614       .access = PL0_R, .type = ARM_CP_NO_RAW,
5615       .fgt = FGT_DCZID_EL0,
5616       .readfn = aa64_dczid_read },
5617     { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
5618       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
5619       .access = PL0_W, .type = ARM_CP_DC_ZVA,
5620 #ifndef CONFIG_USER_ONLY
5621       /* Avoid overhead of an access check that always passes in user-mode */
5622       .accessfn = aa64_zva_access,
5623       .fgt = FGT_DCZVA,
5624 #endif
5625     },
5626     { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
5627       .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
5628       .access = PL1_R, .type = ARM_CP_CURRENTEL },
5629     /*
5630      * Instruction cache ops. All of these except `IC IVAU` NOP because we
5631      * don't emulate caches.
5632      */
5633     { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
5634       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
5635       .access = PL1_W, .type = ARM_CP_NOP,
5636       .fgt = FGT_ICIALLUIS,
5637       .accessfn = access_ticab },
5638     { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
5639       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
5640       .access = PL1_W, .type = ARM_CP_NOP,
5641       .fgt = FGT_ICIALLU,
5642       .accessfn = access_tocu },
5643     { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
5644       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
5645       .access = PL0_W,
5646       .fgt = FGT_ICIVAU,
5647       .accessfn = access_tocu,
5648 #ifdef CONFIG_USER_ONLY
5649       .type = ARM_CP_NO_RAW,
5650       .writefn = ic_ivau_write
5651 #else
5652       .type = ARM_CP_NOP
5653 #endif
5654     },
5655     /* Cache ops: all NOPs since we don't emulate caches */
5656     { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
5657       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
5658       .access = PL1_W, .accessfn = aa64_cacheop_poc_access,
5659       .fgt = FGT_DCIVAC,
5660       .type = ARM_CP_NOP },
5661     { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
5662       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
5663       .fgt = FGT_DCISW,
5664       .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
5665     { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
5666       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
5667       .access = PL0_W, .type = ARM_CP_NOP,
5668       .fgt = FGT_DCCVAC,
5669       .accessfn = aa64_cacheop_poc_access },
5670     { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
5671       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
5672       .fgt = FGT_DCCSW,
5673       .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
5674     { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
5675       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
5676       .access = PL0_W, .type = ARM_CP_NOP,
5677       .fgt = FGT_DCCVAU,
5678       .accessfn = access_tocu },
5679     { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
5680       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
5681       .access = PL0_W, .type = ARM_CP_NOP,
5682       .fgt = FGT_DCCIVAC,
5683       .accessfn = aa64_cacheop_poc_access },
5684     { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
5685       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
5686       .fgt = FGT_DCCISW,
5687       .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
5688     /* TLBI operations */
5689     { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
5690       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
5691       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
5692       .fgt = FGT_TLBIVMALLE1IS,
5693       .writefn = tlbi_aa64_vmalle1is_write },
5694     { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
5695       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
5696       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
5697       .fgt = FGT_TLBIVAE1IS,
5698       .writefn = tlbi_aa64_vae1is_write },
5699     { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
5700       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
5701       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
5702       .fgt = FGT_TLBIASIDE1IS,
5703       .writefn = tlbi_aa64_vmalle1is_write },
5704     { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
5705       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
5706       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
5707       .fgt = FGT_TLBIVAAE1IS,
5708       .writefn = tlbi_aa64_vae1is_write },
5709     { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
5710       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
5711       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
5712       .fgt = FGT_TLBIVALE1IS,
5713       .writefn = tlbi_aa64_vae1is_write },
5714     { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
5715       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
5716       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
5717       .fgt = FGT_TLBIVAALE1IS,
5718       .writefn = tlbi_aa64_vae1is_write },
5719     { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
5720       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
5721       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
5722       .fgt = FGT_TLBIVMALLE1,
5723       .writefn = tlbi_aa64_vmalle1_write },
5724     { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
5725       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
5726       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
5727       .fgt = FGT_TLBIVAE1,
5728       .writefn = tlbi_aa64_vae1_write },
5729     { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
5730       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
5731       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
5732       .fgt = FGT_TLBIASIDE1,
5733       .writefn = tlbi_aa64_vmalle1_write },
5734     { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
5735       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
5736       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
5737       .fgt = FGT_TLBIVAAE1,
5738       .writefn = tlbi_aa64_vae1_write },
5739     { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
5740       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
5741       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
5742       .fgt = FGT_TLBIVALE1,
5743       .writefn = tlbi_aa64_vae1_write },
5744     { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
5745       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
5746       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
5747       .fgt = FGT_TLBIVAALE1,
5748       .writefn = tlbi_aa64_vae1_write },
5749     { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
5750       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
5751       .access = PL2_W, .type = ARM_CP_NO_RAW,
5752       .writefn = tlbi_aa64_ipas2e1is_write },
5753     { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
5754       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
5755       .access = PL2_W, .type = ARM_CP_NO_RAW,
5756       .writefn = tlbi_aa64_ipas2e1is_write },
5757     { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
5758       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
5759       .access = PL2_W, .type = ARM_CP_NO_RAW,
5760       .writefn = tlbi_aa64_alle1is_write },
5761     { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64,
5762       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6,
5763       .access = PL2_W, .type = ARM_CP_NO_RAW,
5764       .writefn = tlbi_aa64_alle1is_write },
5765     { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
5766       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
5767       .access = PL2_W, .type = ARM_CP_NO_RAW,
5768       .writefn = tlbi_aa64_ipas2e1_write },
5769     { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
5770       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
5771       .access = PL2_W, .type = ARM_CP_NO_RAW,
5772       .writefn = tlbi_aa64_ipas2e1_write },
5773     { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
5774       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
5775       .access = PL2_W, .type = ARM_CP_NO_RAW,
5776       .writefn = tlbi_aa64_alle1_write },
5777     { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64,
5778       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6,
5779       .access = PL2_W, .type = ARM_CP_NO_RAW,
5780       .writefn = tlbi_aa64_alle1is_write },
5781 #ifndef CONFIG_USER_ONLY
5782     /* 64 bit address translation operations */
5783     { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
5784       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
5785       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5786       .fgt = FGT_ATS1E1R,
5787       .accessfn = at_s1e01_access, .writefn = ats_write64 },
5788     { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
5789       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
5790       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5791       .fgt = FGT_ATS1E1W,
5792       .accessfn = at_s1e01_access, .writefn = ats_write64 },
5793     { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
5794       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
5795       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5796       .fgt = FGT_ATS1E0R,
5797       .accessfn = at_s1e01_access, .writefn = ats_write64 },
5798     { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
5799       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
5800       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5801       .fgt = FGT_ATS1E0W,
5802       .accessfn = at_s1e01_access, .writefn = ats_write64 },
5803     { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
5804       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
5805       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5806       .accessfn = at_e012_access, .writefn = ats_write64 },
5807     { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
5808       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
5809       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5810       .accessfn = at_e012_access, .writefn = ats_write64 },
5811     { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
5812       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
5813       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5814       .accessfn = at_e012_access, .writefn = ats_write64 },
5815     { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
5816       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
5817       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5818       .accessfn = at_e012_access, .writefn = ats_write64 },
5819     /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
5820     { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
5821       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
5822       .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5823       .writefn = ats_write64 },
5824     { .name = "AT_S1E3W", .state = ARM_CP_STATE_AA64,
5825       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 1,
5826       .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
5827       .writefn = ats_write64 },
5828     { .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
5829       .type = ARM_CP_ALIAS,
5830       .opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
5831       .access = PL1_RW, .resetvalue = 0,
5832       .fgt = FGT_PAR_EL1,
5833       .fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
5834       .writefn = par_write },
5835 #endif
5836     /* TLB invalidate last level of translation table walk */
5837     { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
5838       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis,
5839       .writefn = tlbimva_is_write },
5840     { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
5841       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis,
5842       .writefn = tlbimvaa_is_write },
5843     { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
5844       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
5845       .writefn = tlbimva_write },
5846     { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
5847       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
5848       .writefn = tlbimvaa_write },
5849     { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
5850       .type = ARM_CP_NO_RAW, .access = PL2_W,
5851       .writefn = tlbimva_hyp_write },
5852     { .name = "TLBIMVALHIS",
5853       .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
5854       .type = ARM_CP_NO_RAW, .access = PL2_W,
5855       .writefn = tlbimva_hyp_is_write },
5856     { .name = "TLBIIPAS2",
5857       .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
5858       .type = ARM_CP_NO_RAW, .access = PL2_W,
5859       .writefn = tlbiipas2_hyp_write },
5860     { .name = "TLBIIPAS2IS",
5861       .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
5862       .type = ARM_CP_NO_RAW, .access = PL2_W,
5863       .writefn = tlbiipas2is_hyp_write },
5864     { .name = "TLBIIPAS2L",
5865       .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
5866       .type = ARM_CP_NO_RAW, .access = PL2_W,
5867       .writefn = tlbiipas2_hyp_write },
5868     { .name = "TLBIIPAS2LIS",
5869       .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
5870       .type = ARM_CP_NO_RAW, .access = PL2_W,
5871       .writefn = tlbiipas2is_hyp_write },
5872     /* 32 bit cache operations */
5873     { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
5874       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_ticab },
5875     { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
5876       .type = ARM_CP_NOP, .access = PL1_W },
5877     { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
5878       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu },
5879     { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
5880       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu },
5881     { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
5882       .type = ARM_CP_NOP, .access = PL1_W },
5883     { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
5884       .type = ARM_CP_NOP, .access = PL1_W },
5885     { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
5886       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access },
5887     { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
5888       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
5889     { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
5890       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access },
5891     { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
5892       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
5893     { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
5894       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu },
5895     { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
5896       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access },
5897     { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
5898       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
5899     /* MMU Domain access control / MPU write buffer control */
5900     { .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
5901       .access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0,
5902       .writefn = dacr_write, .raw_writefn = raw_write,
5903       .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
5904                              offsetoflow32(CPUARMState, cp15.dacr_ns) } },
5905     { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
5906       .type = ARM_CP_ALIAS,
5907       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
5908       .access = PL1_RW, .accessfn = access_nv1,
5909       .nv2_redirect_offset = 0x230 | NV2_REDIR_NV1,
5910       .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
5911     { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
5912       .type = ARM_CP_ALIAS,
5913       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
5914       .access = PL1_RW, .accessfn = access_nv1,
5915       .nv2_redirect_offset = 0x160 | NV2_REDIR_NV1,
5916       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) },
5917     /*
5918      * We rely on the access checks not allowing the guest to write to the
5919      * state field when SPSel indicates that it's being used as the stack
5920      * pointer.
5921      */
5922     { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
5923       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
5924       .access = PL1_RW, .accessfn = sp_el0_access,
5925       .type = ARM_CP_ALIAS,
5926       .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
5927     { .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
5928       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
5929       .nv2_redirect_offset = 0x240,
5930       .access = PL2_RW, .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_KEEP,
5931       .fieldoffset = offsetof(CPUARMState, sp_el[1]) },
5932     { .name = "SPSel", .state = ARM_CP_STATE_AA64,
5933       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
5934       .type = ARM_CP_NO_RAW,
5935       .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
5936     { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64,
5937       .type = ARM_CP_ALIAS,
5938       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0,
5939       .access = PL2_RW,
5940       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) },
5941     { .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64,
5942       .type = ARM_CP_ALIAS,
5943       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1,
5944       .access = PL2_RW,
5945       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) },
5946     { .name = "SPSR_UND", .state = ARM_CP_STATE_AA64,
5947       .type = ARM_CP_ALIAS,
5948       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2,
5949       .access = PL2_RW,
5950       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) },
5951     { .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64,
5952       .type = ARM_CP_ALIAS,
5953       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3,
5954       .access = PL2_RW,
5955       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) },
5956     { .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64,
5957       .type = ARM_CP_IO,
5958       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1,
5959       .resetvalue = 0,
5960       .access = PL3_RW,
5961       .writefn = mdcr_el3_write,
5962       .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) },
5963     { .name = "SDCR", .type = ARM_CP_ALIAS | ARM_CP_IO,
5964       .cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1,
5965       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
5966       .writefn = sdcr_write,
5967       .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
5968 };
5969 
5970 /* These are present only when EL1 supports AArch32 */
5971 static const ARMCPRegInfo v8_aa32_el1_reginfo[] = {
5972     { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64,
5973       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0,
5974       .access = PL2_RW,
5975       .type = ARM_CP_ALIAS | ARM_CP_FPU | ARM_CP_EL3_NO_EL2_KEEP,
5976       .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]) },
5977     { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
5978       .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
5979       .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP,
5980       .writefn = dacr_write, .raw_writefn = raw_write,
5981       .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
5982     { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
5983       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
5984       .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP,
5985       .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
5986 };
5987 
do_hcr_write(CPUARMState * env,uint64_t value,uint64_t valid_mask)5988 static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
5989 {
5990     ARMCPU *cpu = env_archcpu(env);
5991 
5992     if (arm_feature(env, ARM_FEATURE_V8)) {
5993         valid_mask |= MAKE_64BIT_MASK(0, 34);  /* ARMv8.0 */
5994     } else {
5995         valid_mask |= MAKE_64BIT_MASK(0, 28);  /* ARMv7VE */
5996     }
5997 
5998     if (arm_feature(env, ARM_FEATURE_EL3)) {
5999         valid_mask &= ~HCR_HCD;
6000     } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
6001         /*
6002          * Architecturally HCR.TSC is RES0 if EL3 is not implemented.
6003          * However, if we're using the SMC PSCI conduit then QEMU is
6004          * effectively acting like EL3 firmware and so the guest at
6005          * EL2 should retain the ability to prevent EL1 from being
6006          * able to make SMC calls into the ersatz firmware, so in
6007          * that case HCR.TSC should be read/write.
6008          */
6009         valid_mask &= ~HCR_TSC;
6010     }
6011 
6012     if (arm_feature(env, ARM_FEATURE_AARCH64)) {
6013         if (cpu_isar_feature(aa64_vh, cpu)) {
6014             valid_mask |= HCR_E2H;
6015         }
6016         if (cpu_isar_feature(aa64_ras, cpu)) {
6017             valid_mask |= HCR_TERR | HCR_TEA;
6018         }
6019         if (cpu_isar_feature(aa64_lor, cpu)) {
6020             valid_mask |= HCR_TLOR;
6021         }
6022         if (cpu_isar_feature(aa64_pauth, cpu)) {
6023             valid_mask |= HCR_API | HCR_APK;
6024         }
6025         if (cpu_isar_feature(aa64_mte, cpu)) {
6026             valid_mask |= HCR_ATA | HCR_DCT | HCR_TID5;
6027         }
6028         if (cpu_isar_feature(aa64_scxtnum, cpu)) {
6029             valid_mask |= HCR_ENSCXT;
6030         }
6031         if (cpu_isar_feature(aa64_fwb, cpu)) {
6032             valid_mask |= HCR_FWB;
6033         }
6034         if (cpu_isar_feature(aa64_rme, cpu)) {
6035             valid_mask |= HCR_GPF;
6036         }
6037         if (cpu_isar_feature(aa64_nv, cpu)) {
6038             valid_mask |= HCR_NV | HCR_NV1 | HCR_AT;
6039         }
6040         if (cpu_isar_feature(aa64_nv2, cpu)) {
6041             valid_mask |= HCR_NV2;
6042         }
6043     }
6044 
6045     if (cpu_isar_feature(any_evt, cpu)) {
6046         valid_mask |= HCR_TTLBIS | HCR_TTLBOS | HCR_TICAB | HCR_TOCU | HCR_TID4;
6047     } else if (cpu_isar_feature(any_half_evt, cpu)) {
6048         valid_mask |= HCR_TICAB | HCR_TOCU | HCR_TID4;
6049     }
6050 
6051     /* Clear RES0 bits.  */
6052     value &= valid_mask;
6053 
6054     /*
6055      * These bits change the MMU setup:
6056      * HCR_VM enables stage 2 translation
6057      * HCR_PTW forbids certain page-table setups
6058      * HCR_DC disables stage1 and enables stage2 translation
6059      * HCR_DCT enables tagging on (disabled) stage1 translation
6060      * HCR_FWB changes the interpretation of stage2 descriptor bits
6061      * HCR_NV and HCR_NV1 affect interpretation of descriptor bits
6062      */
6063     if ((env->cp15.hcr_el2 ^ value) &
6064         (HCR_VM | HCR_PTW | HCR_DC | HCR_DCT | HCR_FWB | HCR_NV | HCR_NV1)) {
6065         tlb_flush(CPU(cpu));
6066     }
6067     env->cp15.hcr_el2 = value;
6068 
6069     /*
6070      * Updates to VI and VF require us to update the status of
6071      * virtual interrupts, which are the logical OR of these bits
6072      * and the state of the input lines from the GIC. (This requires
6073      * that we have the BQL, which is done by marking the
6074      * reginfo structs as ARM_CP_IO.)
6075      * Note that if a write to HCR pends a VIRQ or VFIQ or VINMI or
6076      * VFNMI, it is never possible for it to be taken immediately
6077      * because VIRQ, VFIQ, VINMI and VFNMI are masked unless running
6078      * at EL0 or EL1, and HCR can only be written at EL2.
6079      */
6080     g_assert(bql_locked());
6081     arm_cpu_update_virq(cpu);
6082     arm_cpu_update_vfiq(cpu);
6083     arm_cpu_update_vserr(cpu);
6084     if (cpu_isar_feature(aa64_nmi, cpu)) {
6085         arm_cpu_update_vinmi(cpu);
6086         arm_cpu_update_vfnmi(cpu);
6087     }
6088 }
6089 
hcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)6090 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
6091 {
6092     do_hcr_write(env, value, 0);
6093 }
6094 
hcr_writehigh(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)6095 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri,
6096                           uint64_t value)
6097 {
6098     /* Handle HCR2 write, i.e. write to high half of HCR_EL2 */
6099     value = deposit64(env->cp15.hcr_el2, 32, 32, value);
6100     do_hcr_write(env, value, MAKE_64BIT_MASK(0, 32));
6101 }
6102 
hcr_writelow(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)6103 static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
6104                          uint64_t value)
6105 {
6106     /* Handle HCR write, i.e. write to low half of HCR_EL2 */
6107     value = deposit64(env->cp15.hcr_el2, 0, 32, value);
6108     do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32));
6109 }
6110 
6111 /*
6112  * Return the effective value of HCR_EL2, at the given security state.
6113  * Bits that are not included here:
6114  * RW       (read from SCR_EL3.RW as needed)
6115  */
arm_hcr_el2_eff_secstate(CPUARMState * env,ARMSecuritySpace space)6116 uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space)
6117 {
6118     uint64_t ret = env->cp15.hcr_el2;
6119 
6120     assert(space != ARMSS_Root);
6121 
6122     if (!arm_is_el2_enabled_secstate(env, space)) {
6123         /*
6124          * "This register has no effect if EL2 is not enabled in the
6125          * current Security state".  This is ARMv8.4-SecEL2 speak for
6126          * !(SCR_EL3.NS==1 || SCR_EL3.EEL2==1).
6127          *
6128          * Prior to that, the language was "In an implementation that
6129          * includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves
6130          * as if this field is 0 for all purposes other than a direct
6131          * read or write access of HCR_EL2".  With lots of enumeration
6132          * on a per-field basis.  In current QEMU, this is condition
6133          * is arm_is_secure_below_el3.
6134          *
6135          * Since the v8.4 language applies to the entire register, and
6136          * appears to be backward compatible, use that.
6137          */
6138         return 0;
6139     }
6140 
6141     /*
6142      * For a cpu that supports both aarch64 and aarch32, we can set bits
6143      * in HCR_EL2 (e.g. via EL3) that are RES0 when we enter EL2 as aa32.
6144      * Ignore all of the bits in HCR+HCR2 that are not valid for aarch32.
6145      */
6146     if (!arm_el_is_aa64(env, 2)) {
6147         uint64_t aa32_valid;
6148 
6149         /*
6150          * These bits are up-to-date as of ARMv8.6.
6151          * For HCR, it's easiest to list just the 2 bits that are invalid.
6152          * For HCR2, list those that are valid.
6153          */
6154         aa32_valid = MAKE_64BIT_MASK(0, 32) & ~(HCR_RW | HCR_TDZ);
6155         aa32_valid |= (HCR_CD | HCR_ID | HCR_TERR | HCR_TEA | HCR_MIOCNCE |
6156                        HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_TTLBIS);
6157         ret &= aa32_valid;
6158     }
6159 
6160     if (ret & HCR_TGE) {
6161         /* These bits are up-to-date as of ARMv8.6.  */
6162         if (ret & HCR_E2H) {
6163             ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO |
6164                      HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE |
6165                      HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU |
6166                      HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE |
6167                      HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_ENSCXT |
6168                      HCR_TTLBIS | HCR_TTLBOS | HCR_TID5);
6169         } else {
6170             ret |= HCR_FMO | HCR_IMO | HCR_AMO;
6171         }
6172         ret &= ~(HCR_SWIO | HCR_PTW | HCR_VF | HCR_VI | HCR_VSE |
6173                  HCR_FB | HCR_TID1 | HCR_TID3 | HCR_TSC | HCR_TACR |
6174                  HCR_TSW | HCR_TTLB | HCR_TVM | HCR_HCD | HCR_TRVM |
6175                  HCR_TLOR);
6176     }
6177 
6178     return ret;
6179 }
6180 
arm_hcr_el2_eff(CPUARMState * env)6181 uint64_t arm_hcr_el2_eff(CPUARMState *env)
6182 {
6183     if (arm_feature(env, ARM_FEATURE_M)) {
6184         return 0;
6185     }
6186     return arm_hcr_el2_eff_secstate(env, arm_security_space_below_el3(env));
6187 }
6188 
6189 /*
6190  * Corresponds to ARM pseudocode function ELIsInHost().
6191  */
el_is_in_host(CPUARMState * env,int el)6192 bool el_is_in_host(CPUARMState *env, int el)
6193 {
6194     uint64_t mask;
6195 
6196     /*
6197      * Since we only care about E2H and TGE, we can skip arm_hcr_el2_eff().
6198      * Perform the simplest bit tests first, and validate EL2 afterward.
6199      */
6200     if (el & 1) {
6201         return false; /* EL1 or EL3 */
6202     }
6203 
6204     /*
6205      * Note that hcr_write() checks isar_feature_aa64_vh(),
6206      * aka HaveVirtHostExt(), in allowing HCR_E2H to be set.
6207      */
6208     mask = el ? HCR_E2H : HCR_E2H | HCR_TGE;
6209     if ((env->cp15.hcr_el2 & mask) != mask) {
6210         return false;
6211     }
6212 
6213     /* TGE and/or E2H set: double check those bits are currently legal. */
6214     return arm_is_el2_enabled(env) && arm_el_is_aa64(env, 2);
6215 }
6216 
hcrx_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)6217 static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri,
6218                        uint64_t value)
6219 {
6220     ARMCPU *cpu = env_archcpu(env);
6221     uint64_t valid_mask = 0;
6222 
6223     /* FEAT_MOPS adds MSCEn and MCE2 */
6224     if (cpu_isar_feature(aa64_mops, cpu)) {
6225         valid_mask |= HCRX_MSCEN | HCRX_MCE2;
6226     }
6227 
6228     /* FEAT_NMI adds TALLINT, VINMI and VFNMI */
6229     if (cpu_isar_feature(aa64_nmi, cpu)) {
6230         valid_mask |= HCRX_TALLINT | HCRX_VINMI | HCRX_VFNMI;
6231     }
6232     /* FEAT_CMOW adds CMOW */
6233 
6234     if (cpu_isar_feature(aa64_cmow, cpu)) {
6235         valid_mask |= HCRX_CMOW;
6236     }
6237 
6238     /* Clear RES0 bits.  */
6239     env->cp15.hcrx_el2 = value & valid_mask;
6240 
6241     /*
6242      * Updates to VINMI and VFNMI require us to update the status of
6243      * virtual NMI, which are the logical OR of these bits
6244      * and the state of the input lines from the GIC. (This requires
6245      * that we have the BQL, which is done by marking the
6246      * reginfo structs as ARM_CP_IO.)
6247      * Note that if a write to HCRX pends a VINMI or VFNMI it is never
6248      * possible for it to be taken immediately, because VINMI and
6249      * VFNMI are masked unless running at EL0 or EL1, and HCRX
6250      * can only be written at EL2.
6251      */
6252     if (cpu_isar_feature(aa64_nmi, cpu)) {
6253         g_assert(bql_locked());
6254         arm_cpu_update_vinmi(cpu);
6255         arm_cpu_update_vfnmi(cpu);
6256     }
6257 }
6258 
access_hxen(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)6259 static CPAccessResult access_hxen(CPUARMState *env, const ARMCPRegInfo *ri,
6260                                   bool isread)
6261 {
6262     if (arm_current_el(env) == 2
6263         && arm_feature(env, ARM_FEATURE_EL3)
6264         && !(env->cp15.scr_el3 & SCR_HXEN)) {
6265         return CP_ACCESS_TRAP_EL3;
6266     }
6267     return CP_ACCESS_OK;
6268 }
6269 
6270 static const ARMCPRegInfo hcrx_el2_reginfo = {
6271     .name = "HCRX_EL2", .state = ARM_CP_STATE_AA64,
6272     .type = ARM_CP_IO,
6273     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 2,
6274     .access = PL2_RW, .writefn = hcrx_write, .accessfn = access_hxen,
6275     .nv2_redirect_offset = 0xa0,
6276     .fieldoffset = offsetof(CPUARMState, cp15.hcrx_el2),
6277 };
6278 
6279 /* Return the effective value of HCRX_EL2.  */
arm_hcrx_el2_eff(CPUARMState * env)6280 uint64_t arm_hcrx_el2_eff(CPUARMState *env)
6281 {
6282     /*
6283      * The bits in this register behave as 0 for all purposes other than
6284      * direct reads of the register if SCR_EL3.HXEn is 0.
6285      * If EL2 is not enabled in the current security state, then the
6286      * bit may behave as if 0, or as if 1, depending on the bit.
6287      * For the moment, we treat the EL2-disabled case as taking
6288      * priority over the HXEn-disabled case. This is true for the only
6289      * bit for a feature which we implement where the answer is different
6290      * for the two cases (MSCEn for FEAT_MOPS).
6291      * This may need to be revisited for future bits.
6292      */
6293     if (!arm_is_el2_enabled(env)) {
6294         uint64_t hcrx = 0;
6295         if (cpu_isar_feature(aa64_mops, env_archcpu(env))) {
6296             /* MSCEn behaves as 1 if EL2 is not enabled */
6297             hcrx |= HCRX_MSCEN;
6298         }
6299         return hcrx;
6300     }
6301     if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_HXEN)) {
6302         return 0;
6303     }
6304     return env->cp15.hcrx_el2;
6305 }
6306 
cptr_el2_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)6307 static void cptr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
6308                            uint64_t value)
6309 {
6310     /*
6311      * For A-profile AArch32 EL3, if NSACR.CP10
6312      * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
6313      */
6314     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
6315         !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
6316         uint64_t mask = R_HCPTR_TCP11_MASK | R_HCPTR_TCP10_MASK;
6317         value = (value & ~mask) | (env->cp15.cptr_el[2] & mask);
6318     }
6319     env->cp15.cptr_el[2] = value;
6320 }
6321 
cptr_el2_read(CPUARMState * env,const ARMCPRegInfo * ri)6322 static uint64_t cptr_el2_read(CPUARMState *env, const ARMCPRegInfo *ri)
6323 {
6324     /*
6325      * For A-profile AArch32 EL3, if NSACR.CP10
6326      * is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
6327      */
6328     uint64_t value = env->cp15.cptr_el[2];
6329 
6330     if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
6331         !arm_is_secure(env) && !extract32(env->cp15.nsacr, 10, 1)) {
6332         value |= R_HCPTR_TCP11_MASK | R_HCPTR_TCP10_MASK;
6333     }
6334     return value;
6335 }
6336 
6337 static const ARMCPRegInfo el2_cp_reginfo[] = {
6338     { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
6339       .type = ARM_CP_IO,
6340       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
6341       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
6342       .nv2_redirect_offset = 0x78,
6343       .writefn = hcr_write, .raw_writefn = raw_write },
6344     { .name = "HCR", .state = ARM_CP_STATE_AA32,
6345       .type = ARM_CP_ALIAS | ARM_CP_IO,
6346       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
6347       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
6348       .writefn = hcr_writelow },
6349     { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
6350       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
6351       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
6352     { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
6353       .type = ARM_CP_ALIAS | ARM_CP_NV2_REDIRECT,
6354       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
6355       .access = PL2_RW,
6356       .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
6357     { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
6358       .type = ARM_CP_NV2_REDIRECT,
6359       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
6360       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
6361     { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
6362       .type = ARM_CP_NV2_REDIRECT,
6363       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
6364       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
6365     { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
6366       .type = ARM_CP_ALIAS,
6367       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
6368       .access = PL2_RW,
6369       .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) },
6370     { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
6371       .type = ARM_CP_ALIAS | ARM_CP_NV2_REDIRECT,
6372       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
6373       .access = PL2_RW,
6374       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
6375     { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
6376       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
6377       .access = PL2_RW, .writefn = vbar_write,
6378       .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
6379       .resetvalue = 0 },
6380     { .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
6381       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
6382       .access = PL3_RW, .type = ARM_CP_ALIAS,
6383       .fieldoffset = offsetof(CPUARMState, sp_el[2]) },
6384     { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
6385       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
6386       .access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
6387       .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]),
6388       .readfn = cptr_el2_read, .writefn = cptr_el2_write },
6389     { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
6390       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
6391       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
6392       .resetvalue = 0 },
6393     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
6394       .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
6395       .access = PL2_RW, .type = ARM_CP_ALIAS,
6396       .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
6397     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
6398       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
6399       .access = PL2_RW, .type = ARM_CP_CONST,
6400       .resetvalue = 0 },
6401     /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
6402     { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
6403       .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
6404       .access = PL2_RW, .type = ARM_CP_CONST,
6405       .resetvalue = 0 },
6406     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
6407       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
6408       .access = PL2_RW, .type = ARM_CP_CONST,
6409       .resetvalue = 0 },
6410     { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
6411       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
6412       .access = PL2_RW, .type = ARM_CP_CONST,
6413       .resetvalue = 0 },
6414     { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
6415       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
6416       .access = PL2_RW, .writefn = vmsa_tcr_el12_write,
6417       .raw_writefn = raw_write,
6418       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
6419     { .name = "VTCR", .state = ARM_CP_STATE_AA32,
6420       .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
6421       .type = ARM_CP_ALIAS,
6422       .access = PL2_RW, .accessfn = access_el3_aa32ns,
6423       .fieldoffset = offsetoflow32(CPUARMState, cp15.vtcr_el2) },
6424     { .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
6425       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
6426       .access = PL2_RW,
6427       .nv2_redirect_offset = 0x40,
6428       /* no .writefn needed as this can't cause an ASID change */
6429       .fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
6430     { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
6431       .cp = 15, .opc1 = 6, .crm = 2,
6432       .type = ARM_CP_64BIT | ARM_CP_ALIAS,
6433       .access = PL2_RW, .accessfn = access_el3_aa32ns,
6434       .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
6435       .writefn = vttbr_write, .raw_writefn = raw_write },
6436     { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
6437       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
6438       .access = PL2_RW, .writefn = vttbr_write, .raw_writefn = raw_write,
6439       .nv2_redirect_offset = 0x20,
6440       .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
6441     { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
6442       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
6443       .access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
6444       .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
6445     { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
6446       .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
6447       .access = PL2_RW, .resetvalue = 0,
6448       .nv2_redirect_offset = 0x90,
6449       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
6450     { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
6451       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
6452       .access = PL2_RW, .resetvalue = 0,
6453       .writefn = vmsa_tcr_ttbr_el2_write, .raw_writefn = raw_write,
6454       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
6455     { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
6456       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
6457       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
6458     { .name = "TLBIALLNSNH",
6459       .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
6460       .type = ARM_CP_NO_RAW, .access = PL2_W,
6461       .writefn = tlbiall_nsnh_write },
6462     { .name = "TLBIALLNSNHIS",
6463       .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
6464       .type = ARM_CP_NO_RAW, .access = PL2_W,
6465       .writefn = tlbiall_nsnh_is_write },
6466     { .name = "TLBIALLH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
6467       .type = ARM_CP_NO_RAW, .access = PL2_W,
6468       .writefn = tlbiall_hyp_write },
6469     { .name = "TLBIALLHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
6470       .type = ARM_CP_NO_RAW, .access = PL2_W,
6471       .writefn = tlbiall_hyp_is_write },
6472     { .name = "TLBIMVAH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
6473       .type = ARM_CP_NO_RAW, .access = PL2_W,
6474       .writefn = tlbimva_hyp_write },
6475     { .name = "TLBIMVAHIS", .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
6476       .type = ARM_CP_NO_RAW, .access = PL2_W,
6477       .writefn = tlbimva_hyp_is_write },
6478     { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
6479       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
6480       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
6481       .writefn = tlbi_aa64_alle2_write },
6482     { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
6483       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
6484       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
6485       .writefn = tlbi_aa64_vae2_write },
6486     { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
6487       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
6488       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
6489       .writefn = tlbi_aa64_vae2_write },
6490     { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
6491       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
6492       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
6493       .writefn = tlbi_aa64_alle2is_write },
6494     { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
6495       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
6496       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
6497       .writefn = tlbi_aa64_vae2is_write },
6498     { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
6499       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
6500       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
6501       .writefn = tlbi_aa64_vae2is_write },
6502 #ifndef CONFIG_USER_ONLY
6503     /*
6504      * Unlike the other EL2-related AT operations, these must
6505      * UNDEF from EL3 if EL2 is not implemented, which is why we
6506      * define them here rather than with the rest of the AT ops.
6507      */
6508     { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
6509       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
6510       .access = PL2_W, .accessfn = at_s1e2_access,
6511       .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
6512       .writefn = ats_write64 },
6513     { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
6514       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
6515       .access = PL2_W, .accessfn = at_s1e2_access,
6516       .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
6517       .writefn = ats_write64 },
6518     /*
6519      * The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
6520      * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
6521      * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
6522      * to behave as if SCR.NS was 1.
6523      */
6524     { .name = "ATS1HR", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
6525       .access = PL2_W,
6526       .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
6527     { .name = "ATS1HW", .cp = 15, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
6528       .access = PL2_W,
6529       .writefn = ats1h_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
6530     { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
6531       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
6532       /*
6533        * ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
6534        * reset values as IMPDEF. We choose to reset to 3 to comply with
6535        * both ARMv7 and ARMv8.
6536        */
6537       .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 3,
6538       .writefn = gt_cnthctl_write, .raw_writefn = raw_write,
6539       .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
6540     { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
6541       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
6542       .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
6543       .writefn = gt_cntvoff_write,
6544       .nv2_redirect_offset = 0x60,
6545       .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
6546     { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
6547       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS | ARM_CP_IO,
6548       .writefn = gt_cntvoff_write,
6549       .fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
6550     { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
6551       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
6552       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
6553       .type = ARM_CP_IO, .access = PL2_RW,
6554       .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
6555     { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
6556       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
6557       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_IO,
6558       .writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
6559     { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
6560       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
6561       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW,
6562       .resetfn = gt_hyp_timer_reset,
6563       .readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
6564     { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
6565       .type = ARM_CP_IO,
6566       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
6567       .access = PL2_RW,
6568       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
6569       .resetvalue = 0,
6570       .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
6571 #endif
6572     { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
6573       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
6574       .access = PL2_RW, .accessfn = access_el3_aa32ns,
6575       .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
6576     { .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64,
6577       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
6578       .access = PL2_RW,
6579       .fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
6580     { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
6581       .cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
6582       .access = PL2_RW,
6583       .nv2_redirect_offset = 0x80,
6584       .fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) },
6585 };
6586 
6587 static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
6588     { .name = "HCR2", .state = ARM_CP_STATE_AA32,
6589       .type = ARM_CP_ALIAS | ARM_CP_IO,
6590       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
6591       .access = PL2_RW,
6592       .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
6593       .writefn = hcr_writehigh },
6594 };
6595 
sel2_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)6596 static CPAccessResult sel2_access(CPUARMState *env, const ARMCPRegInfo *ri,
6597                                   bool isread)
6598 {
6599     if (arm_current_el(env) == 3 || arm_is_secure_below_el3(env)) {
6600         return CP_ACCESS_OK;
6601     }
6602     return CP_ACCESS_TRAP_UNCATEGORIZED;
6603 }
6604 
6605 static const ARMCPRegInfo el2_sec_cp_reginfo[] = {
6606     { .name = "VSTTBR_EL2", .state = ARM_CP_STATE_AA64,
6607       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 0,
6608       .access = PL2_RW, .accessfn = sel2_access,
6609       .nv2_redirect_offset = 0x30,
6610       .fieldoffset = offsetof(CPUARMState, cp15.vsttbr_el2) },
6611     { .name = "VSTCR_EL2", .state = ARM_CP_STATE_AA64,
6612       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2,
6613       .access = PL2_RW, .accessfn = sel2_access,
6614       .nv2_redirect_offset = 0x48,
6615       .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) },
6616 };
6617 
nsacr_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)6618 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
6619                                    bool isread)
6620 {
6621     /*
6622      * The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
6623      * At Secure EL1 it traps to EL3 or EL2.
6624      */
6625     if (arm_current_el(env) == 3) {
6626         return CP_ACCESS_OK;
6627     }
6628     if (arm_is_secure_below_el3(env)) {
6629         if (env->cp15.scr_el3 & SCR_EEL2) {
6630             return CP_ACCESS_TRAP_EL2;
6631         }
6632         return CP_ACCESS_TRAP_EL3;
6633     }
6634     /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
6635     if (isread) {
6636         return CP_ACCESS_OK;
6637     }
6638     return CP_ACCESS_TRAP_UNCATEGORIZED;
6639 }
6640 
6641 static const ARMCPRegInfo el3_cp_reginfo[] = {
6642     { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
6643       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
6644       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
6645       .resetfn = scr_reset, .writefn = scr_write, .raw_writefn = raw_write },
6646     { .name = "SCR",  .type = ARM_CP_ALIAS | ARM_CP_NEWEL,
6647       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
6648       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
6649       .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
6650       .writefn = scr_write, .raw_writefn = raw_write },
6651     { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
6652       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
6653       .access = PL3_RW, .resetvalue = 0,
6654       .fieldoffset = offsetof(CPUARMState, cp15.sder) },
6655     { .name = "SDER",
6656       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
6657       .access = PL3_RW, .resetvalue = 0,
6658       .fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
6659     { .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
6660       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
6661       .writefn = vbar_write, .resetvalue = 0,
6662       .fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
6663     { .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
6664       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
6665       .access = PL3_RW, .resetvalue = 0,
6666       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
6667     { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
6668       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
6669       .access = PL3_RW,
6670       /* no .writefn needed as this can't cause an ASID change */
6671       .resetvalue = 0,
6672       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
6673     { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
6674       .type = ARM_CP_ALIAS,
6675       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
6676       .access = PL3_RW,
6677       .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
6678     { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
6679       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
6680       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
6681     { .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
6682       .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
6683       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
6684     { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
6685       .type = ARM_CP_ALIAS,
6686       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
6687       .access = PL3_RW,
6688       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) },
6689     { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
6690       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
6691       .access = PL3_RW, .writefn = vbar_write,
6692       .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
6693       .resetvalue = 0 },
6694     { .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
6695       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
6696       .access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
6697       .fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
6698     { .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
6699       .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
6700       .access = PL3_RW, .resetvalue = 0,
6701       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
6702     { .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
6703       .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
6704       .access = PL3_RW, .type = ARM_CP_CONST,
6705       .resetvalue = 0 },
6706     { .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH,
6707       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0,
6708       .access = PL3_RW, .type = ARM_CP_CONST,
6709       .resetvalue = 0 },
6710     { .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH,
6711       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1,
6712       .access = PL3_RW, .type = ARM_CP_CONST,
6713       .resetvalue = 0 },
6714     { .name = "TLBI_ALLE3IS", .state = ARM_CP_STATE_AA64,
6715       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 0,
6716       .access = PL3_W, .type = ARM_CP_NO_RAW,
6717       .writefn = tlbi_aa64_alle3is_write },
6718     { .name = "TLBI_VAE3IS", .state = ARM_CP_STATE_AA64,
6719       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 1,
6720       .access = PL3_W, .type = ARM_CP_NO_RAW,
6721       .writefn = tlbi_aa64_vae3is_write },
6722     { .name = "TLBI_VALE3IS", .state = ARM_CP_STATE_AA64,
6723       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 3, .opc2 = 5,
6724       .access = PL3_W, .type = ARM_CP_NO_RAW,
6725       .writefn = tlbi_aa64_vae3is_write },
6726     { .name = "TLBI_ALLE3", .state = ARM_CP_STATE_AA64,
6727       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 0,
6728       .access = PL3_W, .type = ARM_CP_NO_RAW,
6729       .writefn = tlbi_aa64_alle3_write },
6730     { .name = "TLBI_VAE3", .state = ARM_CP_STATE_AA64,
6731       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 1,
6732       .access = PL3_W, .type = ARM_CP_NO_RAW,
6733       .writefn = tlbi_aa64_vae3_write },
6734     { .name = "TLBI_VALE3", .state = ARM_CP_STATE_AA64,
6735       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 5,
6736       .access = PL3_W, .type = ARM_CP_NO_RAW,
6737       .writefn = tlbi_aa64_vae3_write },
6738 };
6739 
6740 #ifndef CONFIG_USER_ONLY
6741 
e2h_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)6742 static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
6743                                  bool isread)
6744 {
6745     if (arm_current_el(env) == 1) {
6746         /* This must be a FEAT_NV access */
6747         return CP_ACCESS_OK;
6748     }
6749     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
6750         return CP_ACCESS_TRAP_UNCATEGORIZED;
6751     }
6752     return CP_ACCESS_OK;
6753 }
6754 
access_el1nvpct(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)6755 static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
6756                                       bool isread)
6757 {
6758     if (arm_current_el(env) == 1) {
6759         /* This must be a FEAT_NV access with NVx == 101 */
6760         if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
6761             return CP_ACCESS_TRAP_EL2;
6762         }
6763     }
6764     return e2h_access(env, ri, isread);
6765 }
6766 
access_el1nvvct(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)6767 static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
6768                                       bool isread)
6769 {
6770     if (arm_current_el(env) == 1) {
6771         /* This must be a FEAT_NV access with NVx == 101 */
6772         if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
6773             return CP_ACCESS_TRAP_EL2;
6774         }
6775     }
6776     return e2h_access(env, ri, isread);
6777 }
6778 
6779 /* Test if system register redirection is to occur in the current state.  */
redirect_for_e2h(CPUARMState * env)6780 static bool redirect_for_e2h(CPUARMState *env)
6781 {
6782     return arm_current_el(env) == 2 && (arm_hcr_el2_eff(env) & HCR_E2H);
6783 }
6784 
el2_e2h_read(CPUARMState * env,const ARMCPRegInfo * ri)6785 static uint64_t el2_e2h_read(CPUARMState *env, const ARMCPRegInfo *ri)
6786 {
6787     CPReadFn *readfn;
6788 
6789     if (redirect_for_e2h(env)) {
6790         /* Switch to the saved EL2 version of the register.  */
6791         ri = ri->opaque;
6792         readfn = ri->readfn;
6793     } else {
6794         readfn = ri->orig_readfn;
6795     }
6796     if (readfn == NULL) {
6797         readfn = raw_read;
6798     }
6799     return readfn(env, ri);
6800 }
6801 
el2_e2h_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)6802 static void el2_e2h_write(CPUARMState *env, const ARMCPRegInfo *ri,
6803                           uint64_t value)
6804 {
6805     CPWriteFn *writefn;
6806 
6807     if (redirect_for_e2h(env)) {
6808         /* Switch to the saved EL2 version of the register.  */
6809         ri = ri->opaque;
6810         writefn = ri->writefn;
6811     } else {
6812         writefn = ri->orig_writefn;
6813     }
6814     if (writefn == NULL) {
6815         writefn = raw_write;
6816     }
6817     writefn(env, ri, value);
6818 }
6819 
el2_e2h_e12_read(CPUARMState * env,const ARMCPRegInfo * ri)6820 static uint64_t el2_e2h_e12_read(CPUARMState *env, const ARMCPRegInfo *ri)
6821 {
6822     /* Pass the EL1 register accessor its ri, not the EL12 alias ri */
6823     return ri->orig_readfn(env, ri->opaque);
6824 }
6825 
el2_e2h_e12_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)6826 static void el2_e2h_e12_write(CPUARMState *env, const ARMCPRegInfo *ri,
6827                               uint64_t value)
6828 {
6829     /* Pass the EL1 register accessor its ri, not the EL12 alias ri */
6830     return ri->orig_writefn(env, ri->opaque, value);
6831 }
6832 
el2_e2h_e12_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)6833 static CPAccessResult el2_e2h_e12_access(CPUARMState *env,
6834                                          const ARMCPRegInfo *ri,
6835                                          bool isread)
6836 {
6837     if (arm_current_el(env) == 1) {
6838         /*
6839          * This must be a FEAT_NV access (will either trap or redirect
6840          * to memory). None of the registers with _EL12 aliases want to
6841          * apply their trap controls for this kind of access, so don't
6842          * call the orig_accessfn or do the "UNDEF when E2H is 0" check.
6843          */
6844         return CP_ACCESS_OK;
6845     }
6846     /* FOO_EL12 aliases only exist when E2H is 1; otherwise they UNDEF */
6847     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
6848         return CP_ACCESS_TRAP_UNCATEGORIZED;
6849     }
6850     if (ri->orig_accessfn) {
6851         return ri->orig_accessfn(env, ri->opaque, isread);
6852     }
6853     return CP_ACCESS_OK;
6854 }
6855 
define_arm_vh_e2h_redirects_aliases(ARMCPU * cpu)6856 static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
6857 {
6858     struct E2HAlias {
6859         uint32_t src_key, dst_key, new_key;
6860         const char *src_name, *dst_name, *new_name;
6861         bool (*feature)(const ARMISARegisters *id);
6862     };
6863 
6864 #define K(op0, op1, crn, crm, op2) \
6865     ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2)
6866 
6867     static const struct E2HAlias aliases[] = {
6868         { K(3, 0,  1, 0, 0), K(3, 4,  1, 0, 0), K(3, 5, 1, 0, 0),
6869           "SCTLR", "SCTLR_EL2", "SCTLR_EL12" },
6870         { K(3, 0,  1, 0, 2), K(3, 4,  1, 1, 2), K(3, 5, 1, 0, 2),
6871           "CPACR", "CPTR_EL2", "CPACR_EL12" },
6872         { K(3, 0,  2, 0, 0), K(3, 4,  2, 0, 0), K(3, 5, 2, 0, 0),
6873           "TTBR0_EL1", "TTBR0_EL2", "TTBR0_EL12" },
6874         { K(3, 0,  2, 0, 1), K(3, 4,  2, 0, 1), K(3, 5, 2, 0, 1),
6875           "TTBR1_EL1", "TTBR1_EL2", "TTBR1_EL12" },
6876         { K(3, 0,  2, 0, 2), K(3, 4,  2, 0, 2), K(3, 5, 2, 0, 2),
6877           "TCR_EL1", "TCR_EL2", "TCR_EL12" },
6878         { K(3, 0,  4, 0, 0), K(3, 4,  4, 0, 0), K(3, 5, 4, 0, 0),
6879           "SPSR_EL1", "SPSR_EL2", "SPSR_EL12" },
6880         { K(3, 0,  4, 0, 1), K(3, 4,  4, 0, 1), K(3, 5, 4, 0, 1),
6881           "ELR_EL1", "ELR_EL2", "ELR_EL12" },
6882         { K(3, 0,  5, 1, 0), K(3, 4,  5, 1, 0), K(3, 5, 5, 1, 0),
6883           "AFSR0_EL1", "AFSR0_EL2", "AFSR0_EL12" },
6884         { K(3, 0,  5, 1, 1), K(3, 4,  5, 1, 1), K(3, 5, 5, 1, 1),
6885           "AFSR1_EL1", "AFSR1_EL2", "AFSR1_EL12" },
6886         { K(3, 0,  5, 2, 0), K(3, 4,  5, 2, 0), K(3, 5, 5, 2, 0),
6887           "ESR_EL1", "ESR_EL2", "ESR_EL12" },
6888         { K(3, 0,  6, 0, 0), K(3, 4,  6, 0, 0), K(3, 5, 6, 0, 0),
6889           "FAR_EL1", "FAR_EL2", "FAR_EL12" },
6890         { K(3, 0, 10, 2, 0), K(3, 4, 10, 2, 0), K(3, 5, 10, 2, 0),
6891           "MAIR_EL1", "MAIR_EL2", "MAIR_EL12" },
6892         { K(3, 0, 10, 3, 0), K(3, 4, 10, 3, 0), K(3, 5, 10, 3, 0),
6893           "AMAIR0", "AMAIR_EL2", "AMAIR_EL12" },
6894         { K(3, 0, 12, 0, 0), K(3, 4, 12, 0, 0), K(3, 5, 12, 0, 0),
6895           "VBAR", "VBAR_EL2", "VBAR_EL12" },
6896         { K(3, 0, 13, 0, 1), K(3, 4, 13, 0, 1), K(3, 5, 13, 0, 1),
6897           "CONTEXTIDR_EL1", "CONTEXTIDR_EL2", "CONTEXTIDR_EL12" },
6898         { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0),
6899           "CNTKCTL", "CNTHCTL_EL2", "CNTKCTL_EL12" },
6900 
6901         /*
6902          * Note that redirection of ZCR is mentioned in the description
6903          * of ZCR_EL2, and aliasing in the description of ZCR_EL1, but
6904          * not in the summary table.
6905          */
6906         { K(3, 0,  1, 2, 0), K(3, 4,  1, 2, 0), K(3, 5, 1, 2, 0),
6907           "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve },
6908         { K(3, 0,  1, 2, 6), K(3, 4,  1, 2, 6), K(3, 5, 1, 2, 6),
6909           "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme },
6910 
6911         { K(3, 0,  5, 6, 0), K(3, 4,  5, 6, 0), K(3, 5, 5, 6, 0),
6912           "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte },
6913 
6914         { K(3, 0, 13, 0, 7), K(3, 4, 13, 0, 7), K(3, 5, 13, 0, 7),
6915           "SCXTNUM_EL1", "SCXTNUM_EL2", "SCXTNUM_EL12",
6916           isar_feature_aa64_scxtnum },
6917 
6918         /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */
6919         /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */
6920     };
6921 #undef K
6922 
6923     size_t i;
6924 
6925     for (i = 0; i < ARRAY_SIZE(aliases); i++) {
6926         const struct E2HAlias *a = &aliases[i];
6927         ARMCPRegInfo *src_reg, *dst_reg, *new_reg;
6928         bool ok;
6929 
6930         if (a->feature && !a->feature(&cpu->isar)) {
6931             continue;
6932         }
6933 
6934         src_reg = g_hash_table_lookup(cpu->cp_regs,
6935                                       (gpointer)(uintptr_t)a->src_key);
6936         dst_reg = g_hash_table_lookup(cpu->cp_regs,
6937                                       (gpointer)(uintptr_t)a->dst_key);
6938         g_assert(src_reg != NULL);
6939         g_assert(dst_reg != NULL);
6940 
6941         /* Cross-compare names to detect typos in the keys.  */
6942         g_assert(strcmp(src_reg->name, a->src_name) == 0);
6943         g_assert(strcmp(dst_reg->name, a->dst_name) == 0);
6944 
6945         /* None of the core system registers use opaque; we will.  */
6946         g_assert(src_reg->opaque == NULL);
6947 
6948         /* Create alias before redirection so we dup the right data. */
6949         new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
6950 
6951         new_reg->name = a->new_name;
6952         new_reg->type |= ARM_CP_ALIAS;
6953         /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
6954         new_reg->access &= PL2_RW | PL3_RW;
6955         /* The new_reg op fields are as per new_key, not the target reg */
6956         new_reg->crn = (a->new_key & CP_REG_ARM64_SYSREG_CRN_MASK)
6957             >> CP_REG_ARM64_SYSREG_CRN_SHIFT;
6958         new_reg->crm = (a->new_key & CP_REG_ARM64_SYSREG_CRM_MASK)
6959             >> CP_REG_ARM64_SYSREG_CRM_SHIFT;
6960         new_reg->opc0 = (a->new_key & CP_REG_ARM64_SYSREG_OP0_MASK)
6961             >> CP_REG_ARM64_SYSREG_OP0_SHIFT;
6962         new_reg->opc1 = (a->new_key & CP_REG_ARM64_SYSREG_OP1_MASK)
6963             >> CP_REG_ARM64_SYSREG_OP1_SHIFT;
6964         new_reg->opc2 = (a->new_key & CP_REG_ARM64_SYSREG_OP2_MASK)
6965             >> CP_REG_ARM64_SYSREG_OP2_SHIFT;
6966         new_reg->opaque = src_reg;
6967         new_reg->orig_readfn = src_reg->readfn ?: raw_read;
6968         new_reg->orig_writefn = src_reg->writefn ?: raw_write;
6969         new_reg->orig_accessfn = src_reg->accessfn;
6970         if (!new_reg->raw_readfn) {
6971             new_reg->raw_readfn = raw_read;
6972         }
6973         if (!new_reg->raw_writefn) {
6974             new_reg->raw_writefn = raw_write;
6975         }
6976         new_reg->readfn = el2_e2h_e12_read;
6977         new_reg->writefn = el2_e2h_e12_write;
6978         new_reg->accessfn = el2_e2h_e12_access;
6979 
6980         /*
6981          * If the _EL1 register is redirected to memory by FEAT_NV2,
6982          * then it shares the offset with the _EL12 register,
6983          * and which one is redirected depends on HCR_EL2.NV1.
6984          */
6985         if (new_reg->nv2_redirect_offset) {
6986             assert(new_reg->nv2_redirect_offset & NV2_REDIR_NV1);
6987             new_reg->nv2_redirect_offset &= ~NV2_REDIR_NV1;
6988             new_reg->nv2_redirect_offset |= NV2_REDIR_NO_NV1;
6989         }
6990 
6991         ok = g_hash_table_insert(cpu->cp_regs,
6992                                  (gpointer)(uintptr_t)a->new_key, new_reg);
6993         g_assert(ok);
6994 
6995         src_reg->opaque = dst_reg;
6996         src_reg->orig_readfn = src_reg->readfn ?: raw_read;
6997         src_reg->orig_writefn = src_reg->writefn ?: raw_write;
6998         if (!src_reg->raw_readfn) {
6999             src_reg->raw_readfn = raw_read;
7000         }
7001         if (!src_reg->raw_writefn) {
7002             src_reg->raw_writefn = raw_write;
7003         }
7004         src_reg->readfn = el2_e2h_read;
7005         src_reg->writefn = el2_e2h_write;
7006     }
7007 }
7008 #endif
7009 
ctr_el0_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7010 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
7011                                      bool isread)
7012 {
7013     int cur_el = arm_current_el(env);
7014 
7015     if (cur_el < 2) {
7016         uint64_t hcr = arm_hcr_el2_eff(env);
7017 
7018         if (cur_el == 0) {
7019             if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
7020                 if (!(env->cp15.sctlr_el[2] & SCTLR_UCT)) {
7021                     return CP_ACCESS_TRAP_EL2;
7022                 }
7023             } else {
7024                 if (!(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
7025                     return CP_ACCESS_TRAP;
7026                 }
7027                 if (hcr & HCR_TID2) {
7028                     return CP_ACCESS_TRAP_EL2;
7029                 }
7030             }
7031         } else if (hcr & HCR_TID2) {
7032             return CP_ACCESS_TRAP_EL2;
7033         }
7034     }
7035 
7036     if (arm_current_el(env) < 2 && arm_hcr_el2_eff(env) & HCR_TID2) {
7037         return CP_ACCESS_TRAP_EL2;
7038     }
7039 
7040     return CP_ACCESS_OK;
7041 }
7042 
7043 /*
7044  * Check for traps to RAS registers, which are controlled
7045  * by HCR_EL2.TERR and SCR_EL3.TERR.
7046  */
access_terr(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7047 static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri,
7048                                   bool isread)
7049 {
7050     int el = arm_current_el(env);
7051 
7052     if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) {
7053         return CP_ACCESS_TRAP_EL2;
7054     }
7055     if (el < 3 && (env->cp15.scr_el3 & SCR_TERR)) {
7056         return CP_ACCESS_TRAP_EL3;
7057     }
7058     return CP_ACCESS_OK;
7059 }
7060 
disr_read(CPUARMState * env,const ARMCPRegInfo * ri)7061 static uint64_t disr_read(CPUARMState *env, const ARMCPRegInfo *ri)
7062 {
7063     int el = arm_current_el(env);
7064 
7065     if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) {
7066         return env->cp15.vdisr_el2;
7067     }
7068     if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) {
7069         return 0; /* RAZ/WI */
7070     }
7071     return env->cp15.disr_el1;
7072 }
7073 
disr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t val)7074 static void disr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
7075 {
7076     int el = arm_current_el(env);
7077 
7078     if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) {
7079         env->cp15.vdisr_el2 = val;
7080         return;
7081     }
7082     if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) {
7083         return; /* RAZ/WI */
7084     }
7085     env->cp15.disr_el1 = val;
7086 }
7087 
7088 /*
7089  * Minimal RAS implementation with no Error Records.
7090  * Which means that all of the Error Record registers:
7091  *   ERXADDR_EL1
7092  *   ERXCTLR_EL1
7093  *   ERXFR_EL1
7094  *   ERXMISC0_EL1
7095  *   ERXMISC1_EL1
7096  *   ERXMISC2_EL1
7097  *   ERXMISC3_EL1
7098  *   ERXPFGCDN_EL1  (RASv1p1)
7099  *   ERXPFGCTL_EL1  (RASv1p1)
7100  *   ERXPFGF_EL1    (RASv1p1)
7101  *   ERXSTATUS_EL1
7102  * and
7103  *   ERRSELR_EL1
7104  * may generate UNDEFINED, which is the effect we get by not
7105  * listing them at all.
7106  *
7107  * These registers have fine-grained trap bits, but UNDEF-to-EL1
7108  * is higher priority than FGT-to-EL2 so we do not need to list them
7109  * in order to check for an FGT.
7110  */
7111 static const ARMCPRegInfo minimal_ras_reginfo[] = {
7112     { .name = "DISR_EL1", .state = ARM_CP_STATE_BOTH,
7113       .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 1,
7114       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.disr_el1),
7115       .readfn = disr_read, .writefn = disr_write, .raw_writefn = raw_write },
7116     { .name = "ERRIDR_EL1", .state = ARM_CP_STATE_BOTH,
7117       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 3, .opc2 = 0,
7118       .access = PL1_R, .accessfn = access_terr,
7119       .fgt = FGT_ERRIDR_EL1,
7120       .type = ARM_CP_CONST, .resetvalue = 0 },
7121     { .name = "VDISR_EL2", .state = ARM_CP_STATE_BOTH,
7122       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 1, .opc2 = 1,
7123       .nv2_redirect_offset = 0x500,
7124       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vdisr_el2) },
7125     { .name = "VSESR_EL2", .state = ARM_CP_STATE_BOTH,
7126       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 3,
7127       .nv2_redirect_offset = 0x508,
7128       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vsesr_el2) },
7129 };
7130 
7131 /*
7132  * Return the exception level to which exceptions should be taken
7133  * via SVEAccessTrap.  This excludes the check for whether the exception
7134  * should be routed through AArch64.AdvSIMDFPAccessTrap.  That can easily
7135  * be found by testing 0 < fp_exception_el < sve_exception_el.
7136  *
7137  * C.f. the ARM pseudocode function CheckSVEEnabled.  Note that the
7138  * pseudocode does *not* separate out the FP trap checks, but has them
7139  * all in one function.
7140  */
sve_exception_el(CPUARMState * env,int el)7141 int sve_exception_el(CPUARMState *env, int el)
7142 {
7143 #ifndef CONFIG_USER_ONLY
7144     if (el <= 1 && !el_is_in_host(env, el)) {
7145         switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, ZEN)) {
7146         case 1:
7147             if (el != 0) {
7148                 break;
7149             }
7150             /* fall through */
7151         case 0:
7152         case 2:
7153             return 1;
7154         }
7155     }
7156 
7157     if (el <= 2 && arm_is_el2_enabled(env)) {
7158         /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */
7159         if (env->cp15.hcr_el2 & HCR_E2H) {
7160             switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, ZEN)) {
7161             case 1:
7162                 if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) {
7163                     break;
7164                 }
7165                 /* fall through */
7166             case 0:
7167             case 2:
7168                 return 2;
7169             }
7170         } else {
7171             if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TZ)) {
7172                 return 2;
7173             }
7174         }
7175     }
7176 
7177     /* CPTR_EL3.  Since EZ is negative we must check for EL3.  */
7178     if (arm_feature(env, ARM_FEATURE_EL3)
7179         && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, EZ)) {
7180         return 3;
7181     }
7182 #endif
7183     return 0;
7184 }
7185 
7186 /*
7187  * Return the exception level to which exceptions should be taken for SME.
7188  * C.f. the ARM pseudocode function CheckSMEAccess.
7189  */
sme_exception_el(CPUARMState * env,int el)7190 int sme_exception_el(CPUARMState *env, int el)
7191 {
7192 #ifndef CONFIG_USER_ONLY
7193     if (el <= 1 && !el_is_in_host(env, el)) {
7194         switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) {
7195         case 1:
7196             if (el != 0) {
7197                 break;
7198             }
7199             /* fall through */
7200         case 0:
7201         case 2:
7202             return 1;
7203         }
7204     }
7205 
7206     if (el <= 2 && arm_is_el2_enabled(env)) {
7207         /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */
7208         if (env->cp15.hcr_el2 & HCR_E2H) {
7209             switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) {
7210             case 1:
7211                 if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) {
7212                     break;
7213                 }
7214                 /* fall through */
7215             case 0:
7216             case 2:
7217                 return 2;
7218             }
7219         } else {
7220             if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) {
7221                 return 2;
7222             }
7223         }
7224     }
7225 
7226     /* CPTR_EL3.  Since ESM is negative we must check for EL3.  */
7227     if (arm_feature(env, ARM_FEATURE_EL3)
7228         && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
7229         return 3;
7230     }
7231 #endif
7232     return 0;
7233 }
7234 
7235 /*
7236  * Given that SVE is enabled, return the vector length for EL.
7237  */
sve_vqm1_for_el_sm(CPUARMState * env,int el,bool sm)7238 uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm)
7239 {
7240     ARMCPU *cpu = env_archcpu(env);
7241     uint64_t *cr = env->vfp.zcr_el;
7242     uint32_t map = cpu->sve_vq.map;
7243     uint32_t len = ARM_MAX_VQ - 1;
7244 
7245     if (sm) {
7246         cr = env->vfp.smcr_el;
7247         map = cpu->sme_vq.map;
7248     }
7249 
7250     if (el <= 1 && !el_is_in_host(env, el)) {
7251         len = MIN(len, 0xf & (uint32_t)cr[1]);
7252     }
7253     if (el <= 2 && arm_is_el2_enabled(env)) {
7254         len = MIN(len, 0xf & (uint32_t)cr[2]);
7255     }
7256     if (arm_feature(env, ARM_FEATURE_EL3)) {
7257         len = MIN(len, 0xf & (uint32_t)cr[3]);
7258     }
7259 
7260     map &= MAKE_64BIT_MASK(0, len + 1);
7261     if (map != 0) {
7262         return 31 - clz32(map);
7263     }
7264 
7265     /* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */
7266     assert(sm);
7267     return ctz32(cpu->sme_vq.map);
7268 }
7269 
sve_vqm1_for_el(CPUARMState * env,int el)7270 uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
7271 {
7272     return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM));
7273 }
7274 
zcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)7275 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
7276                       uint64_t value)
7277 {
7278     int cur_el = arm_current_el(env);
7279     int old_len = sve_vqm1_for_el(env, cur_el);
7280     int new_len;
7281 
7282     /* Bits other than [3:0] are RAZ/WI.  */
7283     QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
7284     raw_write(env, ri, value & 0xf);
7285 
7286     /*
7287      * Because we arrived here, we know both FP and SVE are enabled;
7288      * otherwise we would have trapped access to the ZCR_ELn register.
7289      */
7290     new_len = sve_vqm1_for_el(env, cur_el);
7291     if (new_len < old_len) {
7292         aarch64_sve_narrow_vq(env, new_len + 1);
7293     }
7294 }
7295 
7296 static const ARMCPRegInfo zcr_reginfo[] = {
7297     { .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
7298       .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
7299       .nv2_redirect_offset = 0x1e0 | NV2_REDIR_NV1,
7300       .access = PL1_RW, .type = ARM_CP_SVE,
7301       .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
7302       .writefn = zcr_write, .raw_writefn = raw_write },
7303     { .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
7304       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
7305       .access = PL2_RW, .type = ARM_CP_SVE,
7306       .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
7307       .writefn = zcr_write, .raw_writefn = raw_write },
7308     { .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
7309       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
7310       .access = PL3_RW, .type = ARM_CP_SVE,
7311       .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
7312       .writefn = zcr_write, .raw_writefn = raw_write },
7313 };
7314 
7315 #ifdef TARGET_AARCH64
access_tpidr2(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7316 static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
7317                                     bool isread)
7318 {
7319     int el = arm_current_el(env);
7320 
7321     if (el == 0) {
7322         uint64_t sctlr = arm_sctlr(env, el);
7323         if (!(sctlr & SCTLR_EnTP2)) {
7324             return CP_ACCESS_TRAP;
7325         }
7326     }
7327     /* TODO: FEAT_FGT */
7328     if (el < 3
7329         && arm_feature(env, ARM_FEATURE_EL3)
7330         && !(env->cp15.scr_el3 & SCR_ENTP2)) {
7331         return CP_ACCESS_TRAP_EL3;
7332     }
7333     return CP_ACCESS_OK;
7334 }
7335 
access_smprimap(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7336 static CPAccessResult access_smprimap(CPUARMState *env, const ARMCPRegInfo *ri,
7337                                       bool isread)
7338 {
7339     /* If EL1 this is a FEAT_NV access and CPTR_EL3.ESM doesn't apply */
7340     if (arm_current_el(env) == 2
7341         && arm_feature(env, ARM_FEATURE_EL3)
7342         && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
7343         return CP_ACCESS_TRAP_EL3;
7344     }
7345     return CP_ACCESS_OK;
7346 }
7347 
access_smpri(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7348 static CPAccessResult access_smpri(CPUARMState *env, const ARMCPRegInfo *ri,
7349                                    bool isread)
7350 {
7351     if (arm_current_el(env) < 3
7352         && arm_feature(env, ARM_FEATURE_EL3)
7353         && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
7354         return CP_ACCESS_TRAP_EL3;
7355     }
7356     return CP_ACCESS_OK;
7357 }
7358 
7359 /* ResetSVEState */
arm_reset_sve_state(CPUARMState * env)7360 static void arm_reset_sve_state(CPUARMState *env)
7361 {
7362     memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
7363     /* Recall that FFR is stored as pregs[16]. */
7364     memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
7365     vfp_set_fpcr(env, 0x0800009f);
7366 }
7367 
aarch64_set_svcr(CPUARMState * env,uint64_t new,uint64_t mask)7368 void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
7369 {
7370     uint64_t change = (env->svcr ^ new) & mask;
7371 
7372     if (change == 0) {
7373         return;
7374     }
7375     env->svcr ^= change;
7376 
7377     if (change & R_SVCR_SM_MASK) {
7378         arm_reset_sve_state(env);
7379     }
7380 
7381     /*
7382      * ResetSMEState.
7383      *
7384      * SetPSTATE_ZA zeros on enable and disable.  We can zero this only
7385      * on enable: while disabled, the storage is inaccessible and the
7386      * value does not matter.  We're not saving the storage in vmstate
7387      * when disabled either.
7388      */
7389     if (change & new & R_SVCR_ZA_MASK) {
7390         memset(env->zarray, 0, sizeof(env->zarray));
7391     }
7392 
7393     if (tcg_enabled()) {
7394         arm_rebuild_hflags(env);
7395     }
7396 }
7397 
svcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)7398 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
7399                        uint64_t value)
7400 {
7401     aarch64_set_svcr(env, value, -1);
7402 }
7403 
smcr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)7404 static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
7405                        uint64_t value)
7406 {
7407     int cur_el = arm_current_el(env);
7408     int old_len = sve_vqm1_for_el(env, cur_el);
7409     int new_len;
7410 
7411     QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1);
7412     value &= R_SMCR_LEN_MASK | R_SMCR_FA64_MASK;
7413     raw_write(env, ri, value);
7414 
7415     /*
7416      * Note that it is CONSTRAINED UNPREDICTABLE what happens to ZA storage
7417      * when SVL is widened (old values kept, or zeros).  Choose to keep the
7418      * current values for simplicity.  But for QEMU internals, we must still
7419      * apply the narrower SVL to the Zregs and Pregs -- see the comment
7420      * above aarch64_sve_narrow_vq.
7421      */
7422     new_len = sve_vqm1_for_el(env, cur_el);
7423     if (new_len < old_len) {
7424         aarch64_sve_narrow_vq(env, new_len + 1);
7425     }
7426 }
7427 
7428 static const ARMCPRegInfo sme_reginfo[] = {
7429     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
7430       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
7431       .access = PL0_RW, .accessfn = access_tpidr2,
7432       .fgt = FGT_NTPIDR2_EL0,
7433       .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
7434     { .name = "SVCR", .state = ARM_CP_STATE_AA64,
7435       .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 2,
7436       .access = PL0_RW, .type = ARM_CP_SME,
7437       .fieldoffset = offsetof(CPUARMState, svcr),
7438       .writefn = svcr_write, .raw_writefn = raw_write },
7439     { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64,
7440       .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6,
7441       .nv2_redirect_offset = 0x1f0 | NV2_REDIR_NV1,
7442       .access = PL1_RW, .type = ARM_CP_SME,
7443       .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]),
7444       .writefn = smcr_write, .raw_writefn = raw_write },
7445     { .name = "SMCR_EL2", .state = ARM_CP_STATE_AA64,
7446       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 6,
7447       .access = PL2_RW, .type = ARM_CP_SME,
7448       .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[2]),
7449       .writefn = smcr_write, .raw_writefn = raw_write },
7450     { .name = "SMCR_EL3", .state = ARM_CP_STATE_AA64,
7451       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 6,
7452       .access = PL3_RW, .type = ARM_CP_SME,
7453       .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
7454       .writefn = smcr_write, .raw_writefn = raw_write },
7455     { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64,
7456       .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6,
7457       .access = PL1_R, .accessfn = access_aa64_tid1,
7458       /*
7459        * IMPLEMENTOR = 0 (software)
7460        * REVISION    = 0 (implementation defined)
7461        * SMPS        = 0 (no streaming execution priority in QEMU)
7462        * AFFINITY    = 0 (streaming sve mode not shared with other PEs)
7463        */
7464       .type = ARM_CP_CONST, .resetvalue = 0, },
7465     /*
7466      * Because SMIDR_EL1.SMPS is 0, SMPRI_EL1 and SMPRIMAP_EL2 are RES 0.
7467      */
7468     { .name = "SMPRI_EL1", .state = ARM_CP_STATE_AA64,
7469       .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 4,
7470       .access = PL1_RW, .accessfn = access_smpri,
7471       .fgt = FGT_NSMPRI_EL1,
7472       .type = ARM_CP_CONST, .resetvalue = 0 },
7473     { .name = "SMPRIMAP_EL2", .state = ARM_CP_STATE_AA64,
7474       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 5,
7475       .nv2_redirect_offset = 0x1f8,
7476       .access = PL2_RW, .accessfn = access_smprimap,
7477       .type = ARM_CP_CONST, .resetvalue = 0 },
7478 };
7479 
tlbi_aa64_paall_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)7480 static void tlbi_aa64_paall_write(CPUARMState *env, const ARMCPRegInfo *ri,
7481                                   uint64_t value)
7482 {
7483     CPUState *cs = env_cpu(env);
7484 
7485     tlb_flush(cs);
7486 }
7487 
gpccr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)7488 static void gpccr_write(CPUARMState *env, const ARMCPRegInfo *ri,
7489                         uint64_t value)
7490 {
7491     /* L0GPTSZ is RO; other bits not mentioned are RES0. */
7492     uint64_t rw_mask = R_GPCCR_PPS_MASK | R_GPCCR_IRGN_MASK |
7493         R_GPCCR_ORGN_MASK | R_GPCCR_SH_MASK | R_GPCCR_PGS_MASK |
7494         R_GPCCR_GPC_MASK | R_GPCCR_GPCP_MASK;
7495 
7496     env->cp15.gpccr_el3 = (value & rw_mask) | (env->cp15.gpccr_el3 & ~rw_mask);
7497 }
7498 
gpccr_reset(CPUARMState * env,const ARMCPRegInfo * ri)7499 static void gpccr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
7500 {
7501     env->cp15.gpccr_el3 = FIELD_DP64(0, GPCCR, L0GPTSZ,
7502                                      env_archcpu(env)->reset_l0gptsz);
7503 }
7504 
tlbi_aa64_paallos_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)7505 static void tlbi_aa64_paallos_write(CPUARMState *env, const ARMCPRegInfo *ri,
7506                                     uint64_t value)
7507 {
7508     CPUState *cs = env_cpu(env);
7509 
7510     tlb_flush_all_cpus_synced(cs);
7511 }
7512 
7513 static const ARMCPRegInfo rme_reginfo[] = {
7514     { .name = "GPCCR_EL3", .state = ARM_CP_STATE_AA64,
7515       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 6,
7516       .access = PL3_RW, .writefn = gpccr_write, .resetfn = gpccr_reset,
7517       .fieldoffset = offsetof(CPUARMState, cp15.gpccr_el3) },
7518     { .name = "GPTBR_EL3", .state = ARM_CP_STATE_AA64,
7519       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 4,
7520       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.gptbr_el3) },
7521     { .name = "MFAR_EL3", .state = ARM_CP_STATE_AA64,
7522       .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 5,
7523       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mfar_el3) },
7524     { .name = "TLBI_PAALL", .state = ARM_CP_STATE_AA64,
7525       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 4,
7526       .access = PL3_W, .type = ARM_CP_NO_RAW,
7527       .writefn = tlbi_aa64_paall_write },
7528     { .name = "TLBI_PAALLOS", .state = ARM_CP_STATE_AA64,
7529       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 4,
7530       .access = PL3_W, .type = ARM_CP_NO_RAW,
7531       .writefn = tlbi_aa64_paallos_write },
7532     /*
7533      * QEMU does not have a way to invalidate by physical address, thus
7534      * invalidating a range of physical addresses is accomplished by
7535      * flushing all tlb entries in the outer shareable domain,
7536      * just like PAALLOS.
7537      */
7538     { .name = "TLBI_RPALOS", .state = ARM_CP_STATE_AA64,
7539       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 7,
7540       .access = PL3_W, .type = ARM_CP_NO_RAW,
7541       .writefn = tlbi_aa64_paallos_write },
7542     { .name = "TLBI_RPAOS", .state = ARM_CP_STATE_AA64,
7543       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 3,
7544       .access = PL3_W, .type = ARM_CP_NO_RAW,
7545       .writefn = tlbi_aa64_paallos_write },
7546     { .name = "DC_CIPAPA", .state = ARM_CP_STATE_AA64,
7547       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 1,
7548       .access = PL3_W, .type = ARM_CP_NOP },
7549 };
7550 
7551 static const ARMCPRegInfo rme_mte_reginfo[] = {
7552     { .name = "DC_CIGDPAPA", .state = ARM_CP_STATE_AA64,
7553       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 5,
7554       .access = PL3_W, .type = ARM_CP_NOP },
7555 };
7556 
aa64_allint_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)7557 static void aa64_allint_write(CPUARMState *env, const ARMCPRegInfo *ri,
7558                               uint64_t value)
7559 {
7560     env->pstate = (env->pstate & ~PSTATE_ALLINT) | (value & PSTATE_ALLINT);
7561 }
7562 
aa64_allint_read(CPUARMState * env,const ARMCPRegInfo * ri)7563 static uint64_t aa64_allint_read(CPUARMState *env, const ARMCPRegInfo *ri)
7564 {
7565     return env->pstate & PSTATE_ALLINT;
7566 }
7567 
aa64_allint_access(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7568 static CPAccessResult aa64_allint_access(CPUARMState *env,
7569                                          const ARMCPRegInfo *ri, bool isread)
7570 {
7571     if (!isread && arm_current_el(env) == 1 &&
7572         (arm_hcrx_el2_eff(env) & HCRX_TALLINT)) {
7573         return CP_ACCESS_TRAP_EL2;
7574     }
7575     return CP_ACCESS_OK;
7576 }
7577 
7578 static const ARMCPRegInfo nmi_reginfo[] = {
7579     { .name = "ALLINT", .state = ARM_CP_STATE_AA64,
7580       .opc0 = 3, .opc1 = 0, .opc2 = 0, .crn = 4, .crm = 3,
7581       .type = ARM_CP_NO_RAW,
7582       .access = PL1_RW, .accessfn = aa64_allint_access,
7583       .fieldoffset = offsetof(CPUARMState, pstate),
7584       .writefn = aa64_allint_write, .readfn = aa64_allint_read,
7585       .resetfn = arm_cp_reset_ignore },
7586 };
7587 #endif /* TARGET_AARCH64 */
7588 
define_pmu_regs(ARMCPU * cpu)7589 static void define_pmu_regs(ARMCPU *cpu)
7590 {
7591     /*
7592      * v7 performance monitor control register: same implementor
7593      * field as main ID register, and we implement four counters in
7594      * addition to the cycle count register.
7595      */
7596     unsigned int i, pmcrn = pmu_num_counters(&cpu->env);
7597     ARMCPRegInfo pmcr = {
7598         .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
7599         .access = PL0_RW,
7600         .fgt = FGT_PMCR_EL0,
7601         .type = ARM_CP_IO | ARM_CP_ALIAS,
7602         .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
7603         .accessfn = pmreg_access,
7604         .readfn = pmcr_read, .raw_readfn = raw_read,
7605         .writefn = pmcr_write, .raw_writefn = raw_write,
7606     };
7607     ARMCPRegInfo pmcr64 = {
7608         .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
7609         .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
7610         .access = PL0_RW, .accessfn = pmreg_access,
7611         .fgt = FGT_PMCR_EL0,
7612         .type = ARM_CP_IO,
7613         .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
7614         .resetvalue = cpu->isar.reset_pmcr_el0,
7615         .readfn = pmcr_read, .raw_readfn = raw_read,
7616         .writefn = pmcr_write, .raw_writefn = raw_write,
7617     };
7618 
7619     define_one_arm_cp_reg(cpu, &pmcr);
7620     define_one_arm_cp_reg(cpu, &pmcr64);
7621     for (i = 0; i < pmcrn; i++) {
7622         char *pmevcntr_name = g_strdup_printf("PMEVCNTR%d", i);
7623         char *pmevcntr_el0_name = g_strdup_printf("PMEVCNTR%d_EL0", i);
7624         char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i);
7625         char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i);
7626         ARMCPRegInfo pmev_regs[] = {
7627             { .name = pmevcntr_name, .cp = 15, .crn = 14,
7628               .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
7629               .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
7630               .fgt = FGT_PMEVCNTRN_EL0,
7631               .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
7632               .accessfn = pmreg_access_xevcntr },
7633             { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
7634               .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
7635               .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access_xevcntr,
7636               .type = ARM_CP_IO,
7637               .fgt = FGT_PMEVCNTRN_EL0,
7638               .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
7639               .raw_readfn = pmevcntr_rawread,
7640               .raw_writefn = pmevcntr_rawwrite },
7641             { .name = pmevtyper_name, .cp = 15, .crn = 14,
7642               .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
7643               .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
7644               .fgt = FGT_PMEVTYPERN_EL0,
7645               .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
7646               .accessfn = pmreg_access },
7647             { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64,
7648               .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)),
7649               .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
7650               .fgt = FGT_PMEVTYPERN_EL0,
7651               .type = ARM_CP_IO,
7652               .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
7653               .raw_writefn = pmevtyper_rawwrite },
7654         };
7655         define_arm_cp_regs(cpu, pmev_regs);
7656         g_free(pmevcntr_name);
7657         g_free(pmevcntr_el0_name);
7658         g_free(pmevtyper_name);
7659         g_free(pmevtyper_el0_name);
7660     }
7661     if (cpu_isar_feature(aa32_pmuv3p1, cpu)) {
7662         ARMCPRegInfo v81_pmu_regs[] = {
7663             { .name = "PMCEID2", .state = ARM_CP_STATE_AA32,
7664               .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 4,
7665               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
7666               .fgt = FGT_PMCEIDN_EL0,
7667               .resetvalue = extract64(cpu->pmceid0, 32, 32) },
7668             { .name = "PMCEID3", .state = ARM_CP_STATE_AA32,
7669               .cp = 15, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 5,
7670               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
7671               .fgt = FGT_PMCEIDN_EL0,
7672               .resetvalue = extract64(cpu->pmceid1, 32, 32) },
7673         };
7674         define_arm_cp_regs(cpu, v81_pmu_regs);
7675     }
7676     if (cpu_isar_feature(any_pmuv3p4, cpu)) {
7677         static const ARMCPRegInfo v84_pmmir = {
7678             .name = "PMMIR_EL1", .state = ARM_CP_STATE_BOTH,
7679             .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 6,
7680             .access = PL1_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
7681             .fgt = FGT_PMMIR_EL1,
7682             .resetvalue = 0
7683         };
7684         define_one_arm_cp_reg(cpu, &v84_pmmir);
7685     }
7686 }
7687 
7688 #ifndef CONFIG_USER_ONLY
7689 /*
7690  * We don't know until after realize whether there's a GICv3
7691  * attached, and that is what registers the gicv3 sysregs.
7692  * So we have to fill in the GIC fields in ID_PFR/ID_PFR1_EL1/ID_AA64PFR0_EL1
7693  * at runtime.
7694  */
id_pfr1_read(CPUARMState * env,const ARMCPRegInfo * ri)7695 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
7696 {
7697     ARMCPU *cpu = env_archcpu(env);
7698     uint64_t pfr1 = cpu->isar.id_pfr1;
7699 
7700     if (env->gicv3state) {
7701         pfr1 |= 1 << 28;
7702     }
7703     return pfr1;
7704 }
7705 
id_aa64pfr0_read(CPUARMState * env,const ARMCPRegInfo * ri)7706 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
7707 {
7708     ARMCPU *cpu = env_archcpu(env);
7709     uint64_t pfr0 = cpu->isar.id_aa64pfr0;
7710 
7711     if (env->gicv3state) {
7712         pfr0 |= 1 << 24;
7713     }
7714     return pfr0;
7715 }
7716 #endif
7717 
7718 /*
7719  * Shared logic between LORID and the rest of the LOR* registers.
7720  * Secure state exclusion has already been dealt with.
7721  */
access_lor_ns(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7722 static CPAccessResult access_lor_ns(CPUARMState *env,
7723                                     const ARMCPRegInfo *ri, bool isread)
7724 {
7725     int el = arm_current_el(env);
7726 
7727     if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TLOR)) {
7728         return CP_ACCESS_TRAP_EL2;
7729     }
7730     if (el < 3 && (env->cp15.scr_el3 & SCR_TLOR)) {
7731         return CP_ACCESS_TRAP_EL3;
7732     }
7733     return CP_ACCESS_OK;
7734 }
7735 
access_lor_other(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7736 static CPAccessResult access_lor_other(CPUARMState *env,
7737                                        const ARMCPRegInfo *ri, bool isread)
7738 {
7739     if (arm_is_secure_below_el3(env)) {
7740         /* Access denied in secure mode.  */
7741         return CP_ACCESS_TRAP;
7742     }
7743     return access_lor_ns(env, ri, isread);
7744 }
7745 
7746 /*
7747  * A trivial implementation of ARMv8.1-LOR leaves all of these
7748  * registers fixed at 0, which indicates that there are zero
7749  * supported Limited Ordering regions.
7750  */
7751 static const ARMCPRegInfo lor_reginfo[] = {
7752     { .name = "LORSA_EL1", .state = ARM_CP_STATE_AA64,
7753       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 0,
7754       .access = PL1_RW, .accessfn = access_lor_other,
7755       .fgt = FGT_LORSA_EL1,
7756       .type = ARM_CP_CONST, .resetvalue = 0 },
7757     { .name = "LOREA_EL1", .state = ARM_CP_STATE_AA64,
7758       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 1,
7759       .access = PL1_RW, .accessfn = access_lor_other,
7760       .fgt = FGT_LOREA_EL1,
7761       .type = ARM_CP_CONST, .resetvalue = 0 },
7762     { .name = "LORN_EL1", .state = ARM_CP_STATE_AA64,
7763       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 2,
7764       .access = PL1_RW, .accessfn = access_lor_other,
7765       .fgt = FGT_LORN_EL1,
7766       .type = ARM_CP_CONST, .resetvalue = 0 },
7767     { .name = "LORC_EL1", .state = ARM_CP_STATE_AA64,
7768       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 3,
7769       .access = PL1_RW, .accessfn = access_lor_other,
7770       .fgt = FGT_LORC_EL1,
7771       .type = ARM_CP_CONST, .resetvalue = 0 },
7772     { .name = "LORID_EL1", .state = ARM_CP_STATE_AA64,
7773       .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 4, .opc2 = 7,
7774       .access = PL1_R, .accessfn = access_lor_ns,
7775       .fgt = FGT_LORID_EL1,
7776       .type = ARM_CP_CONST, .resetvalue = 0 },
7777 };
7778 
7779 #ifdef TARGET_AARCH64
access_pauth(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)7780 static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri,
7781                                    bool isread)
7782 {
7783     int el = arm_current_el(env);
7784 
7785     if (el < 2 &&
7786         arm_is_el2_enabled(env) &&
7787         !(arm_hcr_el2_eff(env) & HCR_APK)) {
7788         return CP_ACCESS_TRAP_EL2;
7789     }
7790     if (el < 3 &&
7791         arm_feature(env, ARM_FEATURE_EL3) &&
7792         !(env->cp15.scr_el3 & SCR_APK)) {
7793         return CP_ACCESS_TRAP_EL3;
7794     }
7795     return CP_ACCESS_OK;
7796 }
7797 
7798 static const ARMCPRegInfo pauth_reginfo[] = {
7799     { .name = "APDAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
7800       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0,
7801       .access = PL1_RW, .accessfn = access_pauth,
7802       .fgt = FGT_APDAKEY,
7803       .fieldoffset = offsetof(CPUARMState, keys.apda.lo) },
7804     { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
7805       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1,
7806       .access = PL1_RW, .accessfn = access_pauth,
7807       .fgt = FGT_APDAKEY,
7808       .fieldoffset = offsetof(CPUARMState, keys.apda.hi) },
7809     { .name = "APDBKEYLO_EL1", .state = ARM_CP_STATE_AA64,
7810       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2,
7811       .access = PL1_RW, .accessfn = access_pauth,
7812       .fgt = FGT_APDBKEY,
7813       .fieldoffset = offsetof(CPUARMState, keys.apdb.lo) },
7814     { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
7815       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3,
7816       .access = PL1_RW, .accessfn = access_pauth,
7817       .fgt = FGT_APDBKEY,
7818       .fieldoffset = offsetof(CPUARMState, keys.apdb.hi) },
7819     { .name = "APGAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
7820       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0,
7821       .access = PL1_RW, .accessfn = access_pauth,
7822       .fgt = FGT_APGAKEY,
7823       .fieldoffset = offsetof(CPUARMState, keys.apga.lo) },
7824     { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
7825       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1,
7826       .access = PL1_RW, .accessfn = access_pauth,
7827       .fgt = FGT_APGAKEY,
7828       .fieldoffset = offsetof(CPUARMState, keys.apga.hi) },
7829     { .name = "APIAKEYLO_EL1", .state = ARM_CP_STATE_AA64,
7830       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0,
7831       .access = PL1_RW, .accessfn = access_pauth,
7832       .fgt = FGT_APIAKEY,
7833       .fieldoffset = offsetof(CPUARMState, keys.apia.lo) },
7834     { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
7835       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1,
7836       .access = PL1_RW, .accessfn = access_pauth,
7837       .fgt = FGT_APIAKEY,
7838       .fieldoffset = offsetof(CPUARMState, keys.apia.hi) },
7839     { .name = "APIBKEYLO_EL1", .state = ARM_CP_STATE_AA64,
7840       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2,
7841       .access = PL1_RW, .accessfn = access_pauth,
7842       .fgt = FGT_APIBKEY,
7843       .fieldoffset = offsetof(CPUARMState, keys.apib.lo) },
7844     { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
7845       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3,
7846       .access = PL1_RW, .accessfn = access_pauth,
7847       .fgt = FGT_APIBKEY,
7848       .fieldoffset = offsetof(CPUARMState, keys.apib.hi) },
7849 };
7850 
7851 static const ARMCPRegInfo tlbirange_reginfo[] = {
7852     { .name = "TLBI_RVAE1IS", .state = ARM_CP_STATE_AA64,
7853       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 1,
7854       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
7855       .fgt = FGT_TLBIRVAE1IS,
7856       .writefn = tlbi_aa64_rvae1is_write },
7857     { .name = "TLBI_RVAAE1IS", .state = ARM_CP_STATE_AA64,
7858       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 3,
7859       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
7860       .fgt = FGT_TLBIRVAAE1IS,
7861       .writefn = tlbi_aa64_rvae1is_write },
7862    { .name = "TLBI_RVALE1IS", .state = ARM_CP_STATE_AA64,
7863       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 5,
7864       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
7865       .fgt = FGT_TLBIRVALE1IS,
7866       .writefn = tlbi_aa64_rvae1is_write },
7867     { .name = "TLBI_RVAALE1IS", .state = ARM_CP_STATE_AA64,
7868       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 7,
7869       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
7870       .fgt = FGT_TLBIRVAALE1IS,
7871       .writefn = tlbi_aa64_rvae1is_write },
7872     { .name = "TLBI_RVAE1OS", .state = ARM_CP_STATE_AA64,
7873       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
7874       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
7875       .fgt = FGT_TLBIRVAE1OS,
7876       .writefn = tlbi_aa64_rvae1is_write },
7877     { .name = "TLBI_RVAAE1OS", .state = ARM_CP_STATE_AA64,
7878       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 3,
7879       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
7880       .fgt = FGT_TLBIRVAAE1OS,
7881       .writefn = tlbi_aa64_rvae1is_write },
7882    { .name = "TLBI_RVALE1OS", .state = ARM_CP_STATE_AA64,
7883       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 5,
7884       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
7885       .fgt = FGT_TLBIRVALE1OS,
7886       .writefn = tlbi_aa64_rvae1is_write },
7887     { .name = "TLBI_RVAALE1OS", .state = ARM_CP_STATE_AA64,
7888       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 7,
7889       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
7890       .fgt = FGT_TLBIRVAALE1OS,
7891       .writefn = tlbi_aa64_rvae1is_write },
7892     { .name = "TLBI_RVAE1", .state = ARM_CP_STATE_AA64,
7893       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
7894       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
7895       .fgt = FGT_TLBIRVAE1,
7896       .writefn = tlbi_aa64_rvae1_write },
7897     { .name = "TLBI_RVAAE1", .state = ARM_CP_STATE_AA64,
7898       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 3,
7899       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
7900       .fgt = FGT_TLBIRVAAE1,
7901       .writefn = tlbi_aa64_rvae1_write },
7902    { .name = "TLBI_RVALE1", .state = ARM_CP_STATE_AA64,
7903       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 5,
7904       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
7905       .fgt = FGT_TLBIRVALE1,
7906       .writefn = tlbi_aa64_rvae1_write },
7907     { .name = "TLBI_RVAALE1", .state = ARM_CP_STATE_AA64,
7908       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 7,
7909       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
7910       .fgt = FGT_TLBIRVAALE1,
7911       .writefn = tlbi_aa64_rvae1_write },
7912     { .name = "TLBI_RIPAS2E1IS", .state = ARM_CP_STATE_AA64,
7913       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 2,
7914       .access = PL2_W, .type = ARM_CP_NO_RAW,
7915       .writefn = tlbi_aa64_ripas2e1is_write },
7916     { .name = "TLBI_RIPAS2LE1IS", .state = ARM_CP_STATE_AA64,
7917       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 6,
7918       .access = PL2_W, .type = ARM_CP_NO_RAW,
7919       .writefn = tlbi_aa64_ripas2e1is_write },
7920     { .name = "TLBI_RVAE2IS", .state = ARM_CP_STATE_AA64,
7921       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 1,
7922       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
7923       .writefn = tlbi_aa64_rvae2is_write },
7924    { .name = "TLBI_RVALE2IS", .state = ARM_CP_STATE_AA64,
7925       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 5,
7926       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
7927       .writefn = tlbi_aa64_rvae2is_write },
7928     { .name = "TLBI_RIPAS2E1", .state = ARM_CP_STATE_AA64,
7929       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 2,
7930       .access = PL2_W, .type = ARM_CP_NO_RAW,
7931       .writefn = tlbi_aa64_ripas2e1_write },
7932     { .name = "TLBI_RIPAS2LE1", .state = ARM_CP_STATE_AA64,
7933       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 6,
7934       .access = PL2_W, .type = ARM_CP_NO_RAW,
7935       .writefn = tlbi_aa64_ripas2e1_write },
7936    { .name = "TLBI_RVAE2OS", .state = ARM_CP_STATE_AA64,
7937       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 1,
7938       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
7939       .writefn = tlbi_aa64_rvae2is_write },
7940    { .name = "TLBI_RVALE2OS", .state = ARM_CP_STATE_AA64,
7941       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 5,
7942       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
7943       .writefn = tlbi_aa64_rvae2is_write },
7944     { .name = "TLBI_RVAE2", .state = ARM_CP_STATE_AA64,
7945       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 1,
7946       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
7947       .writefn = tlbi_aa64_rvae2_write },
7948    { .name = "TLBI_RVALE2", .state = ARM_CP_STATE_AA64,
7949       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 5,
7950       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
7951       .writefn = tlbi_aa64_rvae2_write },
7952    { .name = "TLBI_RVAE3IS", .state = ARM_CP_STATE_AA64,
7953       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 1,
7954       .access = PL3_W, .type = ARM_CP_NO_RAW,
7955       .writefn = tlbi_aa64_rvae3is_write },
7956    { .name = "TLBI_RVALE3IS", .state = ARM_CP_STATE_AA64,
7957       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 5,
7958       .access = PL3_W, .type = ARM_CP_NO_RAW,
7959       .writefn = tlbi_aa64_rvae3is_write },
7960    { .name = "TLBI_RVAE3OS", .state = ARM_CP_STATE_AA64,
7961       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 5, .opc2 = 1,
7962       .access = PL3_W, .type = ARM_CP_NO_RAW,
7963       .writefn = tlbi_aa64_rvae3is_write },
7964    { .name = "TLBI_RVALE3OS", .state = ARM_CP_STATE_AA64,
7965       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 5, .opc2 = 5,
7966       .access = PL3_W, .type = ARM_CP_NO_RAW,
7967       .writefn = tlbi_aa64_rvae3is_write },
7968    { .name = "TLBI_RVAE3", .state = ARM_CP_STATE_AA64,
7969       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 1,
7970       .access = PL3_W, .type = ARM_CP_NO_RAW,
7971       .writefn = tlbi_aa64_rvae3_write },
7972    { .name = "TLBI_RVALE3", .state = ARM_CP_STATE_AA64,
7973       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 5,
7974       .access = PL3_W, .type = ARM_CP_NO_RAW,
7975       .writefn = tlbi_aa64_rvae3_write },
7976 };
7977 
7978 static const ARMCPRegInfo tlbios_reginfo[] = {
7979     { .name = "TLBI_VMALLE1OS", .state = ARM_CP_STATE_AA64,
7980       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 0,
7981       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
7982       .fgt = FGT_TLBIVMALLE1OS,
7983       .writefn = tlbi_aa64_vmalle1is_write },
7984     { .name = "TLBI_VAE1OS", .state = ARM_CP_STATE_AA64,
7985       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 1,
7986       .fgt = FGT_TLBIVAE1OS,
7987       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
7988       .writefn = tlbi_aa64_vae1is_write },
7989     { .name = "TLBI_ASIDE1OS", .state = ARM_CP_STATE_AA64,
7990       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 2,
7991       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
7992       .fgt = FGT_TLBIASIDE1OS,
7993       .writefn = tlbi_aa64_vmalle1is_write },
7994     { .name = "TLBI_VAAE1OS", .state = ARM_CP_STATE_AA64,
7995       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 3,
7996       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
7997       .fgt = FGT_TLBIVAAE1OS,
7998       .writefn = tlbi_aa64_vae1is_write },
7999     { .name = "TLBI_VALE1OS", .state = ARM_CP_STATE_AA64,
8000       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 5,
8001       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
8002       .fgt = FGT_TLBIVALE1OS,
8003       .writefn = tlbi_aa64_vae1is_write },
8004     { .name = "TLBI_VAALE1OS", .state = ARM_CP_STATE_AA64,
8005       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 7,
8006       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
8007       .fgt = FGT_TLBIVAALE1OS,
8008       .writefn = tlbi_aa64_vae1is_write },
8009     { .name = "TLBI_ALLE2OS", .state = ARM_CP_STATE_AA64,
8010       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 0,
8011       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
8012       .writefn = tlbi_aa64_alle2is_write },
8013     { .name = "TLBI_VAE2OS", .state = ARM_CP_STATE_AA64,
8014       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 1,
8015       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
8016       .writefn = tlbi_aa64_vae2is_write },
8017    { .name = "TLBI_ALLE1OS", .state = ARM_CP_STATE_AA64,
8018       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 4,
8019       .access = PL2_W, .type = ARM_CP_NO_RAW,
8020       .writefn = tlbi_aa64_alle1is_write },
8021     { .name = "TLBI_VALE2OS", .state = ARM_CP_STATE_AA64,
8022       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 5,
8023       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
8024       .writefn = tlbi_aa64_vae2is_write },
8025     { .name = "TLBI_VMALLS12E1OS", .state = ARM_CP_STATE_AA64,
8026       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 6,
8027       .access = PL2_W, .type = ARM_CP_NO_RAW,
8028       .writefn = tlbi_aa64_alle1is_write },
8029     { .name = "TLBI_IPAS2E1OS", .state = ARM_CP_STATE_AA64,
8030       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 0,
8031       .access = PL2_W, .type = ARM_CP_NOP },
8032     { .name = "TLBI_RIPAS2E1OS", .state = ARM_CP_STATE_AA64,
8033       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 3,
8034       .access = PL2_W, .type = ARM_CP_NOP },
8035     { .name = "TLBI_IPAS2LE1OS", .state = ARM_CP_STATE_AA64,
8036       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 4,
8037       .access = PL2_W, .type = ARM_CP_NOP },
8038     { .name = "TLBI_RIPAS2LE1OS", .state = ARM_CP_STATE_AA64,
8039       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 7,
8040       .access = PL2_W, .type = ARM_CP_NOP },
8041     { .name = "TLBI_ALLE3OS", .state = ARM_CP_STATE_AA64,
8042       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 0,
8043       .access = PL3_W, .type = ARM_CP_NO_RAW,
8044       .writefn = tlbi_aa64_alle3is_write },
8045     { .name = "TLBI_VAE3OS", .state = ARM_CP_STATE_AA64,
8046       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 1,
8047       .access = PL3_W, .type = ARM_CP_NO_RAW,
8048       .writefn = tlbi_aa64_vae3is_write },
8049     { .name = "TLBI_VALE3OS", .state = ARM_CP_STATE_AA64,
8050       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 5,
8051       .access = PL3_W, .type = ARM_CP_NO_RAW,
8052       .writefn = tlbi_aa64_vae3is_write },
8053 };
8054 
rndr_readfn(CPUARMState * env,const ARMCPRegInfo * ri)8055 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
8056 {
8057     Error *err = NULL;
8058     uint64_t ret;
8059 
8060     /* Success sets NZCV = 0000.  */
8061     env->NF = env->CF = env->VF = 0, env->ZF = 1;
8062 
8063     if (qemu_guest_getrandom(&ret, sizeof(ret), &err) < 0) {
8064         /*
8065          * ??? Failed, for unknown reasons in the crypto subsystem.
8066          * The best we can do is log the reason and return the
8067          * timed-out indication to the guest.  There is no reason
8068          * we know to expect this failure to be transitory, so the
8069          * guest may well hang retrying the operation.
8070          */
8071         qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
8072                       ri->name, error_get_pretty(err));
8073         error_free(err);
8074 
8075         env->ZF = 0; /* NZCF = 0100 */
8076         return 0;
8077     }
8078     return ret;
8079 }
8080 
8081 /* We do not support re-seeding, so the two registers operate the same.  */
8082 static const ARMCPRegInfo rndr_reginfo[] = {
8083     { .name = "RNDR", .state = ARM_CP_STATE_AA64,
8084       .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
8085       .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 0,
8086       .access = PL0_R, .readfn = rndr_readfn },
8087     { .name = "RNDRRS", .state = ARM_CP_STATE_AA64,
8088       .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END | ARM_CP_IO,
8089       .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 4, .opc2 = 1,
8090       .access = PL0_R, .readfn = rndr_readfn },
8091 };
8092 
dccvap_writefn(CPUARMState * env,const ARMCPRegInfo * opaque,uint64_t value)8093 static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque,
8094                           uint64_t value)
8095 {
8096 #ifdef CONFIG_TCG
8097     ARMCPU *cpu = env_archcpu(env);
8098     /* CTR_EL0 System register -> DminLine, bits [19:16] */
8099     uint64_t dline_size = 4 << ((cpu->ctr >> 16) & 0xF);
8100     uint64_t vaddr_in = (uint64_t) value;
8101     uint64_t vaddr = vaddr_in & ~(dline_size - 1);
8102     void *haddr;
8103     int mem_idx = arm_env_mmu_index(env);
8104 
8105     /* This won't be crossing page boundaries */
8106     haddr = probe_read(env, vaddr, dline_size, mem_idx, GETPC());
8107     if (haddr) {
8108 #ifndef CONFIG_USER_ONLY
8109 
8110         ram_addr_t offset;
8111         MemoryRegion *mr;
8112 
8113         /* RCU lock is already being held */
8114         mr = memory_region_from_host(haddr, &offset);
8115 
8116         if (mr) {
8117             memory_region_writeback(mr, offset, dline_size);
8118         }
8119 #endif /*CONFIG_USER_ONLY*/
8120     }
8121 #else
8122     /* Handled by hardware accelerator. */
8123     g_assert_not_reached();
8124 #endif /* CONFIG_TCG */
8125 }
8126 
8127 static const ARMCPRegInfo dcpop_reg[] = {
8128     { .name = "DC_CVAP", .state = ARM_CP_STATE_AA64,
8129       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 1,
8130       .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END,
8131       .fgt = FGT_DCCVAP,
8132       .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn },
8133 };
8134 
8135 static const ARMCPRegInfo dcpodp_reg[] = {
8136     { .name = "DC_CVADP", .state = ARM_CP_STATE_AA64,
8137       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 1,
8138       .access = PL0_W, .type = ARM_CP_NO_RAW | ARM_CP_SUPPRESS_TB_END,
8139       .fgt = FGT_DCCVADP,
8140       .accessfn = aa64_cacheop_poc_access, .writefn = dccvap_writefn },
8141 };
8142 
access_aa64_tid5(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8143 static CPAccessResult access_aa64_tid5(CPUARMState *env, const ARMCPRegInfo *ri,
8144                                        bool isread)
8145 {
8146     if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID5)) {
8147         return CP_ACCESS_TRAP_EL2;
8148     }
8149 
8150     return CP_ACCESS_OK;
8151 }
8152 
access_mte(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8153 static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,
8154                                  bool isread)
8155 {
8156     int el = arm_current_el(env);
8157     if (el < 2 && arm_is_el2_enabled(env)) {
8158         uint64_t hcr = arm_hcr_el2_eff(env);
8159         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
8160             return CP_ACCESS_TRAP_EL2;
8161         }
8162     }
8163     if (el < 3 &&
8164         arm_feature(env, ARM_FEATURE_EL3) &&
8165         !(env->cp15.scr_el3 & SCR_ATA)) {
8166         return CP_ACCESS_TRAP_EL3;
8167     }
8168     return CP_ACCESS_OK;
8169 }
8170 
access_tfsr_el1(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8171 static CPAccessResult access_tfsr_el1(CPUARMState *env, const ARMCPRegInfo *ri,
8172                                       bool isread)
8173 {
8174     CPAccessResult nv1 = access_nv1(env, ri, isread);
8175 
8176     if (nv1 != CP_ACCESS_OK) {
8177         return nv1;
8178     }
8179     return access_mte(env, ri, isread);
8180 }
8181 
access_tfsr_el2(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8182 static CPAccessResult access_tfsr_el2(CPUARMState *env, const ARMCPRegInfo *ri,
8183                                       bool isread)
8184 {
8185     /*
8186      * TFSR_EL2: similar to generic access_mte(), but we need to
8187      * account for FEAT_NV. At EL1 this must be a FEAT_NV access;
8188      * if NV2 is enabled then we will redirect this to TFSR_EL1
8189      * after doing the HCR and SCR ATA traps; otherwise this will
8190      * be a trap to EL2 and the HCR/SCR traps do not apply.
8191      */
8192     int el = arm_current_el(env);
8193 
8194     if (el == 1 && (arm_hcr_el2_eff(env) & HCR_NV2)) {
8195         return CP_ACCESS_OK;
8196     }
8197     if (el < 2 && arm_is_el2_enabled(env)) {
8198         uint64_t hcr = arm_hcr_el2_eff(env);
8199         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
8200             return CP_ACCESS_TRAP_EL2;
8201         }
8202     }
8203     if (el < 3 &&
8204         arm_feature(env, ARM_FEATURE_EL3) &&
8205         !(env->cp15.scr_el3 & SCR_ATA)) {
8206         return CP_ACCESS_TRAP_EL3;
8207     }
8208     return CP_ACCESS_OK;
8209 }
8210 
tco_read(CPUARMState * env,const ARMCPRegInfo * ri)8211 static uint64_t tco_read(CPUARMState *env, const ARMCPRegInfo *ri)
8212 {
8213     return env->pstate & PSTATE_TCO;
8214 }
8215 
tco_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t val)8216 static void tco_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
8217 {
8218     env->pstate = (env->pstate & ~PSTATE_TCO) | (val & PSTATE_TCO);
8219 }
8220 
8221 static const ARMCPRegInfo mte_reginfo[] = {
8222     { .name = "TFSRE0_EL1", .state = ARM_CP_STATE_AA64,
8223       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 1,
8224       .access = PL1_RW, .accessfn = access_mte,
8225       .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[0]) },
8226     { .name = "TFSR_EL1", .state = ARM_CP_STATE_AA64,
8227       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 0,
8228       .access = PL1_RW, .accessfn = access_tfsr_el1,
8229       .nv2_redirect_offset = 0x190 | NV2_REDIR_NV1,
8230       .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[1]) },
8231     { .name = "TFSR_EL2", .state = ARM_CP_STATE_AA64,
8232       .type = ARM_CP_NV2_REDIRECT,
8233       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 6, .opc2 = 0,
8234       .access = PL2_RW, .accessfn = access_tfsr_el2,
8235       .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[2]) },
8236     { .name = "TFSR_EL3", .state = ARM_CP_STATE_AA64,
8237       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 6, .opc2 = 0,
8238       .access = PL3_RW,
8239       .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[3]) },
8240     { .name = "RGSR_EL1", .state = ARM_CP_STATE_AA64,
8241       .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 5,
8242       .access = PL1_RW, .accessfn = access_mte,
8243       .fieldoffset = offsetof(CPUARMState, cp15.rgsr_el1) },
8244     { .name = "GCR_EL1", .state = ARM_CP_STATE_AA64,
8245       .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 6,
8246       .access = PL1_RW, .accessfn = access_mte,
8247       .fieldoffset = offsetof(CPUARMState, cp15.gcr_el1) },
8248     { .name = "TCO", .state = ARM_CP_STATE_AA64,
8249       .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7,
8250       .type = ARM_CP_NO_RAW,
8251       .access = PL0_RW, .readfn = tco_read, .writefn = tco_write },
8252     { .name = "DC_IGVAC", .state = ARM_CP_STATE_AA64,
8253       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 3,
8254       .type = ARM_CP_NOP, .access = PL1_W,
8255       .fgt = FGT_DCIVAC,
8256       .accessfn = aa64_cacheop_poc_access },
8257     { .name = "DC_IGSW", .state = ARM_CP_STATE_AA64,
8258       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 4,
8259       .fgt = FGT_DCISW,
8260       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
8261     { .name = "DC_IGDVAC", .state = ARM_CP_STATE_AA64,
8262       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 5,
8263       .type = ARM_CP_NOP, .access = PL1_W,
8264       .fgt = FGT_DCIVAC,
8265       .accessfn = aa64_cacheop_poc_access },
8266     { .name = "DC_IGDSW", .state = ARM_CP_STATE_AA64,
8267       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 6,
8268       .fgt = FGT_DCISW,
8269       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
8270     { .name = "DC_CGSW", .state = ARM_CP_STATE_AA64,
8271       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 4,
8272       .fgt = FGT_DCCSW,
8273       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
8274     { .name = "DC_CGDSW", .state = ARM_CP_STATE_AA64,
8275       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 6,
8276       .fgt = FGT_DCCSW,
8277       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
8278     { .name = "DC_CIGSW", .state = ARM_CP_STATE_AA64,
8279       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 4,
8280       .fgt = FGT_DCCISW,
8281       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
8282     { .name = "DC_CIGDSW", .state = ARM_CP_STATE_AA64,
8283       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 6,
8284       .fgt = FGT_DCCISW,
8285       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
8286 };
8287 
8288 static const ARMCPRegInfo mte_tco_ro_reginfo[] = {
8289     { .name = "TCO", .state = ARM_CP_STATE_AA64,
8290       .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7,
8291       .type = ARM_CP_CONST, .access = PL0_RW, },
8292 };
8293 
8294 static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = {
8295     { .name = "DC_CGVAC", .state = ARM_CP_STATE_AA64,
8296       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 3,
8297       .type = ARM_CP_NOP, .access = PL0_W,
8298       .fgt = FGT_DCCVAC,
8299       .accessfn = aa64_cacheop_poc_access },
8300     { .name = "DC_CGDVAC", .state = ARM_CP_STATE_AA64,
8301       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 5,
8302       .type = ARM_CP_NOP, .access = PL0_W,
8303       .fgt = FGT_DCCVAC,
8304       .accessfn = aa64_cacheop_poc_access },
8305     { .name = "DC_CGVAP", .state = ARM_CP_STATE_AA64,
8306       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 3,
8307       .type = ARM_CP_NOP, .access = PL0_W,
8308       .fgt = FGT_DCCVAP,
8309       .accessfn = aa64_cacheop_poc_access },
8310     { .name = "DC_CGDVAP", .state = ARM_CP_STATE_AA64,
8311       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 12, .opc2 = 5,
8312       .type = ARM_CP_NOP, .access = PL0_W,
8313       .fgt = FGT_DCCVAP,
8314       .accessfn = aa64_cacheop_poc_access },
8315     { .name = "DC_CGVADP", .state = ARM_CP_STATE_AA64,
8316       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 3,
8317       .type = ARM_CP_NOP, .access = PL0_W,
8318       .fgt = FGT_DCCVADP,
8319       .accessfn = aa64_cacheop_poc_access },
8320     { .name = "DC_CGDVADP", .state = ARM_CP_STATE_AA64,
8321       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 13, .opc2 = 5,
8322       .type = ARM_CP_NOP, .access = PL0_W,
8323       .fgt = FGT_DCCVADP,
8324       .accessfn = aa64_cacheop_poc_access },
8325     { .name = "DC_CIGVAC", .state = ARM_CP_STATE_AA64,
8326       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 3,
8327       .type = ARM_CP_NOP, .access = PL0_W,
8328       .fgt = FGT_DCCIVAC,
8329       .accessfn = aa64_cacheop_poc_access },
8330     { .name = "DC_CIGDVAC", .state = ARM_CP_STATE_AA64,
8331       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 5,
8332       .type = ARM_CP_NOP, .access = PL0_W,
8333       .fgt = FGT_DCCIVAC,
8334       .accessfn = aa64_cacheop_poc_access },
8335     { .name = "DC_GVA", .state = ARM_CP_STATE_AA64,
8336       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 3,
8337       .access = PL0_W, .type = ARM_CP_DC_GVA,
8338 #ifndef CONFIG_USER_ONLY
8339       /* Avoid overhead of an access check that always passes in user-mode */
8340       .accessfn = aa64_zva_access,
8341       .fgt = FGT_DCZVA,
8342 #endif
8343     },
8344     { .name = "DC_GZVA", .state = ARM_CP_STATE_AA64,
8345       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 4,
8346       .access = PL0_W, .type = ARM_CP_DC_GZVA,
8347 #ifndef CONFIG_USER_ONLY
8348       /* Avoid overhead of an access check that always passes in user-mode */
8349       .accessfn = aa64_zva_access,
8350       .fgt = FGT_DCZVA,
8351 #endif
8352     },
8353 };
8354 
access_scxtnum(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8355 static CPAccessResult access_scxtnum(CPUARMState *env, const ARMCPRegInfo *ri,
8356                                      bool isread)
8357 {
8358     uint64_t hcr = arm_hcr_el2_eff(env);
8359     int el = arm_current_el(env);
8360 
8361     if (el == 0 && !((hcr & HCR_E2H) && (hcr & HCR_TGE))) {
8362         if (env->cp15.sctlr_el[1] & SCTLR_TSCXT) {
8363             if (hcr & HCR_TGE) {
8364                 return CP_ACCESS_TRAP_EL2;
8365             }
8366             return CP_ACCESS_TRAP;
8367         }
8368     } else if (el < 2 && (env->cp15.sctlr_el[2] & SCTLR_TSCXT)) {
8369         return CP_ACCESS_TRAP_EL2;
8370     }
8371     if (el < 2 && arm_is_el2_enabled(env) && !(hcr & HCR_ENSCXT)) {
8372         return CP_ACCESS_TRAP_EL2;
8373     }
8374     if (el < 3
8375         && arm_feature(env, ARM_FEATURE_EL3)
8376         && !(env->cp15.scr_el3 & SCR_ENSCXT)) {
8377         return CP_ACCESS_TRAP_EL3;
8378     }
8379     return CP_ACCESS_OK;
8380 }
8381 
access_scxtnum_el1(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8382 static CPAccessResult access_scxtnum_el1(CPUARMState *env,
8383                                          const ARMCPRegInfo *ri,
8384                                          bool isread)
8385 {
8386     CPAccessResult nv1 = access_nv1(env, ri, isread);
8387 
8388     if (nv1 != CP_ACCESS_OK) {
8389         return nv1;
8390     }
8391     return access_scxtnum(env, ri, isread);
8392 }
8393 
8394 static const ARMCPRegInfo scxtnum_reginfo[] = {
8395     { .name = "SCXTNUM_EL0", .state = ARM_CP_STATE_AA64,
8396       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 7,
8397       .access = PL0_RW, .accessfn = access_scxtnum,
8398       .fgt = FGT_SCXTNUM_EL0,
8399       .fieldoffset = offsetof(CPUARMState, scxtnum_el[0]) },
8400     { .name = "SCXTNUM_EL1", .state = ARM_CP_STATE_AA64,
8401       .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 7,
8402       .access = PL1_RW, .accessfn = access_scxtnum_el1,
8403       .fgt = FGT_SCXTNUM_EL1,
8404       .nv2_redirect_offset = 0x188 | NV2_REDIR_NV1,
8405       .fieldoffset = offsetof(CPUARMState, scxtnum_el[1]) },
8406     { .name = "SCXTNUM_EL2", .state = ARM_CP_STATE_AA64,
8407       .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 7,
8408       .access = PL2_RW, .accessfn = access_scxtnum,
8409       .fieldoffset = offsetof(CPUARMState, scxtnum_el[2]) },
8410     { .name = "SCXTNUM_EL3", .state = ARM_CP_STATE_AA64,
8411       .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 7,
8412       .access = PL3_RW,
8413       .fieldoffset = offsetof(CPUARMState, scxtnum_el[3]) },
8414 };
8415 
access_fgt(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8416 static CPAccessResult access_fgt(CPUARMState *env, const ARMCPRegInfo *ri,
8417                                  bool isread)
8418 {
8419     if (arm_current_el(env) == 2 &&
8420         arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_FGTEN)) {
8421         return CP_ACCESS_TRAP_EL3;
8422     }
8423     return CP_ACCESS_OK;
8424 }
8425 
8426 static const ARMCPRegInfo fgt_reginfo[] = {
8427     { .name = "HFGRTR_EL2", .state = ARM_CP_STATE_AA64,
8428       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
8429       .nv2_redirect_offset = 0x1b8,
8430       .access = PL2_RW, .accessfn = access_fgt,
8431       .fieldoffset = offsetof(CPUARMState, cp15.fgt_read[FGTREG_HFGRTR]) },
8432     { .name = "HFGWTR_EL2", .state = ARM_CP_STATE_AA64,
8433       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 5,
8434       .nv2_redirect_offset = 0x1c0,
8435       .access = PL2_RW, .accessfn = access_fgt,
8436       .fieldoffset = offsetof(CPUARMState, cp15.fgt_write[FGTREG_HFGWTR]) },
8437     { .name = "HDFGRTR_EL2", .state = ARM_CP_STATE_AA64,
8438       .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 1, .opc2 = 4,
8439       .nv2_redirect_offset = 0x1d0,
8440       .access = PL2_RW, .accessfn = access_fgt,
8441       .fieldoffset = offsetof(CPUARMState, cp15.fgt_read[FGTREG_HDFGRTR]) },
8442     { .name = "HDFGWTR_EL2", .state = ARM_CP_STATE_AA64,
8443       .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 1, .opc2 = 5,
8444       .nv2_redirect_offset = 0x1d8,
8445       .access = PL2_RW, .accessfn = access_fgt,
8446       .fieldoffset = offsetof(CPUARMState, cp15.fgt_write[FGTREG_HDFGWTR]) },
8447     { .name = "HFGITR_EL2", .state = ARM_CP_STATE_AA64,
8448       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 6,
8449       .nv2_redirect_offset = 0x1c8,
8450       .access = PL2_RW, .accessfn = access_fgt,
8451       .fieldoffset = offsetof(CPUARMState, cp15.fgt_exec[FGTREG_HFGITR]) },
8452 };
8453 
vncr_write(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)8454 static void vncr_write(CPUARMState *env, const ARMCPRegInfo *ri,
8455                        uint64_t value)
8456 {
8457     /*
8458      * Clear the RES0 bottom 12 bits; this means at runtime we can guarantee
8459      * that VNCR_EL2 + offset is 64-bit aligned. We don't need to do anything
8460      * about the RESS bits at the top -- we choose the "generate an EL2
8461      * translation abort on use" CONSTRAINED UNPREDICTABLE option (i.e. let
8462      * the ptw.c code detect the resulting invalid address).
8463      */
8464     env->cp15.vncr_el2 = value & ~0xfffULL;
8465 }
8466 
8467 static const ARMCPRegInfo nv2_reginfo[] = {
8468     { .name = "VNCR_EL2", .state = ARM_CP_STATE_AA64,
8469       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 2, .opc2 = 0,
8470       .access = PL2_RW,
8471       .writefn = vncr_write,
8472       .nv2_redirect_offset = 0xb0,
8473       .fieldoffset = offsetof(CPUARMState, cp15.vncr_el2) },
8474 };
8475 
8476 #endif /* TARGET_AARCH64 */
8477 
access_predinv(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8478 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri,
8479                                      bool isread)
8480 {
8481     int el = arm_current_el(env);
8482 
8483     if (el == 0) {
8484         uint64_t sctlr = arm_sctlr(env, el);
8485         if (!(sctlr & SCTLR_EnRCTX)) {
8486             return CP_ACCESS_TRAP;
8487         }
8488     } else if (el == 1) {
8489         uint64_t hcr = arm_hcr_el2_eff(env);
8490         if (hcr & HCR_NV) {
8491             return CP_ACCESS_TRAP_EL2;
8492         }
8493     }
8494     return CP_ACCESS_OK;
8495 }
8496 
8497 static const ARMCPRegInfo predinv_reginfo[] = {
8498     { .name = "CFP_RCTX", .state = ARM_CP_STATE_AA64,
8499       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 4,
8500       .fgt = FGT_CFPRCTX,
8501       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
8502     { .name = "DVP_RCTX", .state = ARM_CP_STATE_AA64,
8503       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 5,
8504       .fgt = FGT_DVPRCTX,
8505       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
8506     { .name = "CPP_RCTX", .state = ARM_CP_STATE_AA64,
8507       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 3, .opc2 = 7,
8508       .fgt = FGT_CPPRCTX,
8509       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
8510     /*
8511      * Note the AArch32 opcodes have a different OPC1.
8512      */
8513     { .name = "CFPRCTX", .state = ARM_CP_STATE_AA32,
8514       .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 4,
8515       .fgt = FGT_CFPRCTX,
8516       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
8517     { .name = "DVPRCTX", .state = ARM_CP_STATE_AA32,
8518       .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 5,
8519       .fgt = FGT_DVPRCTX,
8520       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
8521     { .name = "CPPRCTX", .state = ARM_CP_STATE_AA32,
8522       .cp = 15, .opc1 = 0, .crn = 7, .crm = 3, .opc2 = 7,
8523       .fgt = FGT_CPPRCTX,
8524       .type = ARM_CP_NOP, .access = PL0_W, .accessfn = access_predinv },
8525 };
8526 
ccsidr2_read(CPUARMState * env,const ARMCPRegInfo * ri)8527 static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri)
8528 {
8529     /* Read the high 32 bits of the current CCSIDR */
8530     return extract64(ccsidr_read(env, ri), 32, 32);
8531 }
8532 
8533 static const ARMCPRegInfo ccsidr2_reginfo[] = {
8534     { .name = "CCSIDR2", .state = ARM_CP_STATE_BOTH,
8535       .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 2,
8536       .access = PL1_R,
8537       .accessfn = access_tid4,
8538       .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW },
8539 };
8540 
access_aa64_tid3(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8541 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
8542                                        bool isread)
8543 {
8544     if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
8545         return CP_ACCESS_TRAP_EL2;
8546     }
8547 
8548     return CP_ACCESS_OK;
8549 }
8550 
access_aa32_tid3(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8551 static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
8552                                        bool isread)
8553 {
8554     if (arm_feature(env, ARM_FEATURE_V8)) {
8555         return access_aa64_tid3(env, ri, isread);
8556     }
8557 
8558     return CP_ACCESS_OK;
8559 }
8560 
access_jazelle(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8561 static CPAccessResult access_jazelle(CPUARMState *env, const ARMCPRegInfo *ri,
8562                                      bool isread)
8563 {
8564     if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID0)) {
8565         return CP_ACCESS_TRAP_EL2;
8566     }
8567 
8568     return CP_ACCESS_OK;
8569 }
8570 
access_joscr_jmcr(CPUARMState * env,const ARMCPRegInfo * ri,bool isread)8571 static CPAccessResult access_joscr_jmcr(CPUARMState *env,
8572                                         const ARMCPRegInfo *ri, bool isread)
8573 {
8574     /*
8575      * HSTR.TJDBX traps JOSCR and JMCR accesses, but it exists only
8576      * in v7A, not in v8A.
8577      */
8578     if (!arm_feature(env, ARM_FEATURE_V8) &&
8579         arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) &&
8580         (env->cp15.hstr_el2 & HSTR_TJDBX)) {
8581         return CP_ACCESS_TRAP_EL2;
8582     }
8583     return CP_ACCESS_OK;
8584 }
8585 
8586 static const ARMCPRegInfo jazelle_regs[] = {
8587     { .name = "JIDR",
8588       .cp = 14, .crn = 0, .crm = 0, .opc1 = 7, .opc2 = 0,
8589       .access = PL1_R, .accessfn = access_jazelle,
8590       .type = ARM_CP_CONST, .resetvalue = 0 },
8591     { .name = "JOSCR",
8592       .cp = 14, .crn = 1, .crm = 0, .opc1 = 7, .opc2 = 0,
8593       .accessfn = access_joscr_jmcr,
8594       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
8595     { .name = "JMCR",
8596       .cp = 14, .crn = 2, .crm = 0, .opc1 = 7, .opc2 = 0,
8597       .accessfn = access_joscr_jmcr,
8598       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
8599 };
8600 
8601 static const ARMCPRegInfo contextidr_el2 = {
8602     .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64,
8603     .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1,
8604     .access = PL2_RW,
8605     .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2])
8606 };
8607 
8608 static const ARMCPRegInfo vhe_reginfo[] = {
8609     { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64,
8610       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1,
8611       .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write,
8612       .raw_writefn = raw_write,
8613       .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) },
8614 #ifndef CONFIG_USER_ONLY
8615     { .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64,
8616       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 2,
8617       .fieldoffset =
8618         offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].cval),
8619       .type = ARM_CP_IO, .access = PL2_RW,
8620       .writefn = gt_hv_cval_write, .raw_writefn = raw_write },
8621     { .name = "CNTHV_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
8622       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 0,
8623       .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW,
8624       .resetfn = gt_hv_timer_reset,
8625       .readfn = gt_hv_tval_read, .writefn = gt_hv_tval_write },
8626     { .name = "CNTHV_CTL_EL2", .state = ARM_CP_STATE_BOTH,
8627       .type = ARM_CP_IO,
8628       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 3, .opc2 = 1,
8629       .access = PL2_RW,
8630       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYPVIRT].ctl),
8631       .writefn = gt_hv_ctl_write, .raw_writefn = raw_write },
8632     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
8633       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
8634       .type = ARM_CP_IO | ARM_CP_ALIAS,
8635       .access = PL2_RW, .accessfn = access_el1nvpct,
8636       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
8637       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
8638       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
8639     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
8640       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
8641       .type = ARM_CP_IO | ARM_CP_ALIAS,
8642       .access = PL2_RW, .accessfn = access_el1nvvct,
8643       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
8644       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
8645       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
8646     { .name = "CNTP_TVAL_EL02", .state = ARM_CP_STATE_AA64,
8647       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 0,
8648       .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS,
8649       .access = PL2_RW, .accessfn = e2h_access,
8650       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write },
8651     { .name = "CNTV_TVAL_EL02", .state = ARM_CP_STATE_AA64,
8652       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 0,
8653       .type = ARM_CP_NO_RAW | ARM_CP_IO | ARM_CP_ALIAS,
8654       .access = PL2_RW, .accessfn = e2h_access,
8655       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write },
8656     { .name = "CNTP_CVAL_EL02", .state = ARM_CP_STATE_AA64,
8657       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 2,
8658       .type = ARM_CP_IO | ARM_CP_ALIAS,
8659       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
8660       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
8661       .access = PL2_RW, .accessfn = access_el1nvpct,
8662       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
8663     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
8664       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
8665       .type = ARM_CP_IO | ARM_CP_ALIAS,
8666       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
8667       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
8668       .access = PL2_RW, .accessfn = access_el1nvvct,
8669       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
8670 #endif
8671 };
8672 
8673 #ifndef CONFIG_USER_ONLY
8674 static const ARMCPRegInfo ats1e1_reginfo[] = {
8675     { .name = "AT_S1E1RP", .state = ARM_CP_STATE_AA64,
8676       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0,
8677       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
8678       .fgt = FGT_ATS1E1RP,
8679       .accessfn = at_s1e01_access, .writefn = ats_write64 },
8680     { .name = "AT_S1E1WP", .state = ARM_CP_STATE_AA64,
8681       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
8682       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
8683       .fgt = FGT_ATS1E1WP,
8684       .accessfn = at_s1e01_access, .writefn = ats_write64 },
8685 };
8686 
8687 static const ARMCPRegInfo ats1cp_reginfo[] = {
8688     { .name = "ATS1CPRP",
8689       .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0,
8690       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
8691       .writefn = ats_write },
8692     { .name = "ATS1CPWP",
8693       .cp = 15, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
8694       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
8695       .writefn = ats_write },
8696 };
8697 #endif
8698 
8699 /*
8700  * ACTLR2 and HACTLR2 map to ACTLR_EL1[63:32] and
8701  * ACTLR_EL2[63:32]. They exist only if the ID_MMFR4.AC2 field
8702  * is non-zero, which is never for ARMv7, optionally in ARMv8
8703  * and mandatorily for ARMv8.2 and up.
8704  * ACTLR2 is banked for S and NS if EL3 is AArch32. Since QEMU's
8705  * implementation is RAZ/WI we can ignore this detail, as we
8706  * do for ACTLR.
8707  */
8708 static const ARMCPRegInfo actlr2_hactlr2_reginfo[] = {
8709     { .name = "ACTLR2", .state = ARM_CP_STATE_AA32,
8710       .cp = 15, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 3,
8711       .access = PL1_RW, .accessfn = access_tacr,
8712       .type = ARM_CP_CONST, .resetvalue = 0 },
8713     { .name = "HACTLR2", .state = ARM_CP_STATE_AA32,
8714       .cp = 15, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 3,
8715       .access = PL2_RW, .type = ARM_CP_CONST,
8716       .resetvalue = 0 },
8717 };
8718 
register_cp_regs_for_features(ARMCPU * cpu)8719 void register_cp_regs_for_features(ARMCPU *cpu)
8720 {
8721     /* Register all the coprocessor registers based on feature bits */
8722     CPUARMState *env = &cpu->env;
8723     if (arm_feature(env, ARM_FEATURE_M)) {
8724         /* M profile has no coprocessor registers */
8725         return;
8726     }
8727 
8728     define_arm_cp_regs(cpu, cp_reginfo);
8729     if (!arm_feature(env, ARM_FEATURE_V8)) {
8730         /*
8731          * Must go early as it is full of wildcards that may be
8732          * overridden by later definitions.
8733          */
8734         define_arm_cp_regs(cpu, not_v8_cp_reginfo);
8735     }
8736 
8737     if (arm_feature(env, ARM_FEATURE_V6)) {
8738         /* The ID registers all have impdef reset values */
8739         ARMCPRegInfo v6_idregs[] = {
8740             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
8741               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
8742               .access = PL1_R, .type = ARM_CP_CONST,
8743               .accessfn = access_aa32_tid3,
8744               .resetvalue = cpu->isar.id_pfr0 },
8745             /*
8746              * ID_PFR1 is not a plain ARM_CP_CONST because we don't know
8747              * the value of the GIC field until after we define these regs.
8748              */
8749             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
8750               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
8751               .access = PL1_R, .type = ARM_CP_NO_RAW,
8752               .accessfn = access_aa32_tid3,
8753 #ifdef CONFIG_USER_ONLY
8754               .type = ARM_CP_CONST,
8755               .resetvalue = cpu->isar.id_pfr1,
8756 #else
8757               .type = ARM_CP_NO_RAW,
8758               .accessfn = access_aa32_tid3,
8759               .readfn = id_pfr1_read,
8760               .writefn = arm_cp_write_ignore
8761 #endif
8762             },
8763             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
8764               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
8765               .access = PL1_R, .type = ARM_CP_CONST,
8766               .accessfn = access_aa32_tid3,
8767               .resetvalue = cpu->isar.id_dfr0 },
8768             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
8769               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
8770               .access = PL1_R, .type = ARM_CP_CONST,
8771               .accessfn = access_aa32_tid3,
8772               .resetvalue = cpu->id_afr0 },
8773             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
8774               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
8775               .access = PL1_R, .type = ARM_CP_CONST,
8776               .accessfn = access_aa32_tid3,
8777               .resetvalue = cpu->isar.id_mmfr0 },
8778             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
8779               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
8780               .access = PL1_R, .type = ARM_CP_CONST,
8781               .accessfn = access_aa32_tid3,
8782               .resetvalue = cpu->isar.id_mmfr1 },
8783             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
8784               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
8785               .access = PL1_R, .type = ARM_CP_CONST,
8786               .accessfn = access_aa32_tid3,
8787               .resetvalue = cpu->isar.id_mmfr2 },
8788             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
8789               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
8790               .access = PL1_R, .type = ARM_CP_CONST,
8791               .accessfn = access_aa32_tid3,
8792               .resetvalue = cpu->isar.id_mmfr3 },
8793             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
8794               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
8795               .access = PL1_R, .type = ARM_CP_CONST,
8796               .accessfn = access_aa32_tid3,
8797               .resetvalue = cpu->isar.id_isar0 },
8798             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
8799               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
8800               .access = PL1_R, .type = ARM_CP_CONST,
8801               .accessfn = access_aa32_tid3,
8802               .resetvalue = cpu->isar.id_isar1 },
8803             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
8804               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
8805               .access = PL1_R, .type = ARM_CP_CONST,
8806               .accessfn = access_aa32_tid3,
8807               .resetvalue = cpu->isar.id_isar2 },
8808             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
8809               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
8810               .access = PL1_R, .type = ARM_CP_CONST,
8811               .accessfn = access_aa32_tid3,
8812               .resetvalue = cpu->isar.id_isar3 },
8813             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
8814               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
8815               .access = PL1_R, .type = ARM_CP_CONST,
8816               .accessfn = access_aa32_tid3,
8817               .resetvalue = cpu->isar.id_isar4 },
8818             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
8819               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
8820               .access = PL1_R, .type = ARM_CP_CONST,
8821               .accessfn = access_aa32_tid3,
8822               .resetvalue = cpu->isar.id_isar5 },
8823             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
8824               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
8825               .access = PL1_R, .type = ARM_CP_CONST,
8826               .accessfn = access_aa32_tid3,
8827               .resetvalue = cpu->isar.id_mmfr4 },
8828             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
8829               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
8830               .access = PL1_R, .type = ARM_CP_CONST,
8831               .accessfn = access_aa32_tid3,
8832               .resetvalue = cpu->isar.id_isar6 },
8833         };
8834         define_arm_cp_regs(cpu, v6_idregs);
8835         define_arm_cp_regs(cpu, v6_cp_reginfo);
8836     } else {
8837         define_arm_cp_regs(cpu, not_v6_cp_reginfo);
8838     }
8839     if (arm_feature(env, ARM_FEATURE_V6K)) {
8840         define_arm_cp_regs(cpu, v6k_cp_reginfo);
8841     }
8842     if (arm_feature(env, ARM_FEATURE_V7MP) &&
8843         !arm_feature(env, ARM_FEATURE_PMSA)) {
8844         define_arm_cp_regs(cpu, v7mp_cp_reginfo);
8845     }
8846     if (arm_feature(env, ARM_FEATURE_V7VE)) {
8847         define_arm_cp_regs(cpu, pmovsset_cp_reginfo);
8848     }
8849     if (arm_feature(env, ARM_FEATURE_V7)) {
8850         ARMCPRegInfo clidr = {
8851             .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
8852             .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
8853             .access = PL1_R, .type = ARM_CP_CONST,
8854             .accessfn = access_tid4,
8855             .fgt = FGT_CLIDR_EL1,
8856             .resetvalue = cpu->clidr
8857         };
8858         define_one_arm_cp_reg(cpu, &clidr);
8859         define_arm_cp_regs(cpu, v7_cp_reginfo);
8860         define_debug_regs(cpu);
8861         define_pmu_regs(cpu);
8862     } else {
8863         define_arm_cp_regs(cpu, not_v7_cp_reginfo);
8864     }
8865     if (arm_feature(env, ARM_FEATURE_V8)) {
8866         /*
8867          * v8 ID registers, which all have impdef reset values.
8868          * Note that within the ID register ranges the unused slots
8869          * must all RAZ, not UNDEF; future architecture versions may
8870          * define new registers here.
8871          * ID registers which are AArch64 views of the AArch32 ID registers
8872          * which already existed in v6 and v7 are handled elsewhere,
8873          * in v6_idregs[].
8874          */
8875         int i;
8876         ARMCPRegInfo v8_idregs[] = {
8877             /*
8878              * ID_AA64PFR0_EL1 is not a plain ARM_CP_CONST in system
8879              * emulation because we don't know the right value for the
8880              * GIC field until after we define these regs.
8881              */
8882             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
8883               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
8884               .access = PL1_R,
8885 #ifdef CONFIG_USER_ONLY
8886               .type = ARM_CP_CONST,
8887               .resetvalue = cpu->isar.id_aa64pfr0
8888 #else
8889               .type = ARM_CP_NO_RAW,
8890               .accessfn = access_aa64_tid3,
8891               .readfn = id_aa64pfr0_read,
8892               .writefn = arm_cp_write_ignore
8893 #endif
8894             },
8895             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
8896               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
8897               .access = PL1_R, .type = ARM_CP_CONST,
8898               .accessfn = access_aa64_tid3,
8899               .resetvalue = cpu->isar.id_aa64pfr1},
8900             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8901               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
8902               .access = PL1_R, .type = ARM_CP_CONST,
8903               .accessfn = access_aa64_tid3,
8904               .resetvalue = 0 },
8905             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8906               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
8907               .access = PL1_R, .type = ARM_CP_CONST,
8908               .accessfn = access_aa64_tid3,
8909               .resetvalue = 0 },
8910             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
8911               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
8912               .access = PL1_R, .type = ARM_CP_CONST,
8913               .accessfn = access_aa64_tid3,
8914               .resetvalue = cpu->isar.id_aa64zfr0 },
8915             { .name = "ID_AA64SMFR0_EL1", .state = ARM_CP_STATE_AA64,
8916               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
8917               .access = PL1_R, .type = ARM_CP_CONST,
8918               .accessfn = access_aa64_tid3,
8919               .resetvalue = cpu->isar.id_aa64smfr0 },
8920             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8921               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
8922               .access = PL1_R, .type = ARM_CP_CONST,
8923               .accessfn = access_aa64_tid3,
8924               .resetvalue = 0 },
8925             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8926               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
8927               .access = PL1_R, .type = ARM_CP_CONST,
8928               .accessfn = access_aa64_tid3,
8929               .resetvalue = 0 },
8930             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
8931               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
8932               .access = PL1_R, .type = ARM_CP_CONST,
8933               .accessfn = access_aa64_tid3,
8934               .resetvalue = cpu->isar.id_aa64dfr0 },
8935             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
8936               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
8937               .access = PL1_R, .type = ARM_CP_CONST,
8938               .accessfn = access_aa64_tid3,
8939               .resetvalue = cpu->isar.id_aa64dfr1 },
8940             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8941               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
8942               .access = PL1_R, .type = ARM_CP_CONST,
8943               .accessfn = access_aa64_tid3,
8944               .resetvalue = 0 },
8945             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8946               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
8947               .access = PL1_R, .type = ARM_CP_CONST,
8948               .accessfn = access_aa64_tid3,
8949               .resetvalue = 0 },
8950             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
8951               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
8952               .access = PL1_R, .type = ARM_CP_CONST,
8953               .accessfn = access_aa64_tid3,
8954               .resetvalue = cpu->id_aa64afr0 },
8955             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
8956               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
8957               .access = PL1_R, .type = ARM_CP_CONST,
8958               .accessfn = access_aa64_tid3,
8959               .resetvalue = cpu->id_aa64afr1 },
8960             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8961               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
8962               .access = PL1_R, .type = ARM_CP_CONST,
8963               .accessfn = access_aa64_tid3,
8964               .resetvalue = 0 },
8965             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8966               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
8967               .access = PL1_R, .type = ARM_CP_CONST,
8968               .accessfn = access_aa64_tid3,
8969               .resetvalue = 0 },
8970             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
8971               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
8972               .access = PL1_R, .type = ARM_CP_CONST,
8973               .accessfn = access_aa64_tid3,
8974               .resetvalue = cpu->isar.id_aa64isar0 },
8975             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
8976               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
8977               .access = PL1_R, .type = ARM_CP_CONST,
8978               .accessfn = access_aa64_tid3,
8979               .resetvalue = cpu->isar.id_aa64isar1 },
8980             { .name = "ID_AA64ISAR2_EL1", .state = ARM_CP_STATE_AA64,
8981               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
8982               .access = PL1_R, .type = ARM_CP_CONST,
8983               .accessfn = access_aa64_tid3,
8984               .resetvalue = cpu->isar.id_aa64isar2 },
8985             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8986               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
8987               .access = PL1_R, .type = ARM_CP_CONST,
8988               .accessfn = access_aa64_tid3,
8989               .resetvalue = 0 },
8990             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8991               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
8992               .access = PL1_R, .type = ARM_CP_CONST,
8993               .accessfn = access_aa64_tid3,
8994               .resetvalue = 0 },
8995             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
8996               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
8997               .access = PL1_R, .type = ARM_CP_CONST,
8998               .accessfn = access_aa64_tid3,
8999               .resetvalue = 0 },
9000             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
9001               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
9002               .access = PL1_R, .type = ARM_CP_CONST,
9003               .accessfn = access_aa64_tid3,
9004               .resetvalue = 0 },
9005             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
9006               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
9007               .access = PL1_R, .type = ARM_CP_CONST,
9008               .accessfn = access_aa64_tid3,
9009               .resetvalue = 0 },
9010             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
9011               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
9012               .access = PL1_R, .type = ARM_CP_CONST,
9013               .accessfn = access_aa64_tid3,
9014               .resetvalue = cpu->isar.id_aa64mmfr0 },
9015             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
9016               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
9017               .access = PL1_R, .type = ARM_CP_CONST,
9018               .accessfn = access_aa64_tid3,
9019               .resetvalue = cpu->isar.id_aa64mmfr1 },
9020             { .name = "ID_AA64MMFR2_EL1", .state = ARM_CP_STATE_AA64,
9021               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
9022               .access = PL1_R, .type = ARM_CP_CONST,
9023               .accessfn = access_aa64_tid3,
9024               .resetvalue = cpu->isar.id_aa64mmfr2 },
9025             { .name = "ID_AA64MMFR3_EL1", .state = ARM_CP_STATE_AA64,
9026               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
9027               .access = PL1_R, .type = ARM_CP_CONST,
9028               .accessfn = access_aa64_tid3,
9029               .resetvalue = cpu->isar.id_aa64mmfr3 },
9030             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
9031               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
9032               .access = PL1_R, .type = ARM_CP_CONST,
9033               .accessfn = access_aa64_tid3,
9034               .resetvalue = 0 },
9035             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
9036               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
9037               .access = PL1_R, .type = ARM_CP_CONST,
9038               .accessfn = access_aa64_tid3,
9039               .resetvalue = 0 },
9040             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
9041               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
9042               .access = PL1_R, .type = ARM_CP_CONST,
9043               .accessfn = access_aa64_tid3,
9044               .resetvalue = 0 },
9045             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
9046               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
9047               .access = PL1_R, .type = ARM_CP_CONST,
9048               .accessfn = access_aa64_tid3,
9049               .resetvalue = 0 },
9050             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
9051               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
9052               .access = PL1_R, .type = ARM_CP_CONST,
9053               .accessfn = access_aa64_tid3,
9054               .resetvalue = cpu->isar.mvfr0 },
9055             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
9056               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
9057               .access = PL1_R, .type = ARM_CP_CONST,
9058               .accessfn = access_aa64_tid3,
9059               .resetvalue = cpu->isar.mvfr1 },
9060             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
9061               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
9062               .access = PL1_R, .type = ARM_CP_CONST,
9063               .accessfn = access_aa64_tid3,
9064               .resetvalue = cpu->isar.mvfr2 },
9065             /*
9066              * "0, c0, c3, {0,1,2}" are the encodings corresponding to
9067              * AArch64 MVFR[012]_EL1. Define the STATE_AA32 encoding
9068              * as RAZ, since it is in the "reserved for future ID
9069              * registers, RAZ" part of the AArch32 encoding space.
9070              */
9071             { .name = "RES_0_C0_C3_0", .state = ARM_CP_STATE_AA32,
9072               .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
9073               .access = PL1_R, .type = ARM_CP_CONST,
9074               .accessfn = access_aa64_tid3,
9075               .resetvalue = 0 },
9076             { .name = "RES_0_C0_C3_1", .state = ARM_CP_STATE_AA32,
9077               .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
9078               .access = PL1_R, .type = ARM_CP_CONST,
9079               .accessfn = access_aa64_tid3,
9080               .resetvalue = 0 },
9081             { .name = "RES_0_C0_C3_2", .state = ARM_CP_STATE_AA32,
9082               .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
9083               .access = PL1_R, .type = ARM_CP_CONST,
9084               .accessfn = access_aa64_tid3,
9085               .resetvalue = 0 },
9086             /*
9087              * Other encodings in "0, c0, c3, ..." are STATE_BOTH because
9088              * they're also RAZ for AArch64, and in v8 are gradually
9089              * being filled with AArch64-view-of-AArch32-ID-register
9090              * for new ID registers.
9091              */
9092             { .name = "RES_0_C0_C3_3", .state = ARM_CP_STATE_BOTH,
9093               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
9094               .access = PL1_R, .type = ARM_CP_CONST,
9095               .accessfn = access_aa64_tid3,
9096               .resetvalue = 0 },
9097             { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH,
9098               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
9099               .access = PL1_R, .type = ARM_CP_CONST,
9100               .accessfn = access_aa64_tid3,
9101               .resetvalue = cpu->isar.id_pfr2 },
9102             { .name = "ID_DFR1", .state = ARM_CP_STATE_BOTH,
9103               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
9104               .access = PL1_R, .type = ARM_CP_CONST,
9105               .accessfn = access_aa64_tid3,
9106               .resetvalue = cpu->isar.id_dfr1 },
9107             { .name = "ID_MMFR5", .state = ARM_CP_STATE_BOTH,
9108               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
9109               .access = PL1_R, .type = ARM_CP_CONST,
9110               .accessfn = access_aa64_tid3,
9111               .resetvalue = cpu->isar.id_mmfr5 },
9112             { .name = "RES_0_C0_C3_7", .state = ARM_CP_STATE_BOTH,
9113               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
9114               .access = PL1_R, .type = ARM_CP_CONST,
9115               .accessfn = access_aa64_tid3,
9116               .resetvalue = 0 },
9117             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
9118               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
9119               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
9120               .fgt = FGT_PMCEIDN_EL0,
9121               .resetvalue = extract64(cpu->pmceid0, 0, 32) },
9122             { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64,
9123               .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6,
9124               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
9125               .fgt = FGT_PMCEIDN_EL0,
9126               .resetvalue = cpu->pmceid0 },
9127             { .name = "PMCEID1", .state = ARM_CP_STATE_AA32,
9128               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7,
9129               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
9130               .fgt = FGT_PMCEIDN_EL0,
9131               .resetvalue = extract64(cpu->pmceid1, 0, 32) },
9132             { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64,
9133               .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7,
9134               .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST,
9135               .fgt = FGT_PMCEIDN_EL0,
9136               .resetvalue = cpu->pmceid1 },
9137         };
9138 #ifdef CONFIG_USER_ONLY
9139         static const ARMCPRegUserSpaceInfo v8_user_idregs[] = {
9140             { .name = "ID_AA64PFR0_EL1",
9141               .exported_bits = R_ID_AA64PFR0_FP_MASK |
9142                                R_ID_AA64PFR0_ADVSIMD_MASK |
9143                                R_ID_AA64PFR0_SVE_MASK |
9144                                R_ID_AA64PFR0_DIT_MASK,
9145               .fixed_bits = (0x1u << R_ID_AA64PFR0_EL0_SHIFT) |
9146                             (0x1u << R_ID_AA64PFR0_EL1_SHIFT) },
9147             { .name = "ID_AA64PFR1_EL1",
9148               .exported_bits = R_ID_AA64PFR1_BT_MASK |
9149                                R_ID_AA64PFR1_SSBS_MASK |
9150                                R_ID_AA64PFR1_MTE_MASK |
9151                                R_ID_AA64PFR1_SME_MASK },
9152             { .name = "ID_AA64PFR*_EL1_RESERVED",
9153               .is_glob = true },
9154             { .name = "ID_AA64ZFR0_EL1",
9155               .exported_bits = R_ID_AA64ZFR0_SVEVER_MASK |
9156                                R_ID_AA64ZFR0_AES_MASK |
9157                                R_ID_AA64ZFR0_BITPERM_MASK |
9158                                R_ID_AA64ZFR0_BFLOAT16_MASK |
9159                                R_ID_AA64ZFR0_B16B16_MASK |
9160                                R_ID_AA64ZFR0_SHA3_MASK |
9161                                R_ID_AA64ZFR0_SM4_MASK |
9162                                R_ID_AA64ZFR0_I8MM_MASK |
9163                                R_ID_AA64ZFR0_F32MM_MASK |
9164                                R_ID_AA64ZFR0_F64MM_MASK },
9165             { .name = "ID_AA64SMFR0_EL1",
9166               .exported_bits = R_ID_AA64SMFR0_F32F32_MASK |
9167                                R_ID_AA64SMFR0_BI32I32_MASK |
9168                                R_ID_AA64SMFR0_B16F32_MASK |
9169                                R_ID_AA64SMFR0_F16F32_MASK |
9170                                R_ID_AA64SMFR0_I8I32_MASK |
9171                                R_ID_AA64SMFR0_F16F16_MASK |
9172                                R_ID_AA64SMFR0_B16B16_MASK |
9173                                R_ID_AA64SMFR0_I16I32_MASK |
9174                                R_ID_AA64SMFR0_F64F64_MASK |
9175                                R_ID_AA64SMFR0_I16I64_MASK |
9176                                R_ID_AA64SMFR0_SMEVER_MASK |
9177                                R_ID_AA64SMFR0_FA64_MASK },
9178             { .name = "ID_AA64MMFR0_EL1",
9179               .exported_bits = R_ID_AA64MMFR0_ECV_MASK,
9180               .fixed_bits = (0xfu << R_ID_AA64MMFR0_TGRAN64_SHIFT) |
9181                             (0xfu << R_ID_AA64MMFR0_TGRAN4_SHIFT) },
9182             { .name = "ID_AA64MMFR1_EL1",
9183               .exported_bits = R_ID_AA64MMFR1_AFP_MASK },
9184             { .name = "ID_AA64MMFR2_EL1",
9185               .exported_bits = R_ID_AA64MMFR2_AT_MASK },
9186             { .name = "ID_AA64MMFR3_EL1",
9187               .exported_bits = 0 },
9188             { .name = "ID_AA64MMFR*_EL1_RESERVED",
9189               .is_glob = true },
9190             { .name = "ID_AA64DFR0_EL1",
9191               .fixed_bits = (0x6u << R_ID_AA64DFR0_DEBUGVER_SHIFT) },
9192             { .name = "ID_AA64DFR1_EL1" },
9193             { .name = "ID_AA64DFR*_EL1_RESERVED",
9194               .is_glob = true },
9195             { .name = "ID_AA64AFR*",
9196               .is_glob = true },
9197             { .name = "ID_AA64ISAR0_EL1",
9198               .exported_bits = R_ID_AA64ISAR0_AES_MASK |
9199                                R_ID_AA64ISAR0_SHA1_MASK |
9200                                R_ID_AA64ISAR0_SHA2_MASK |
9201                                R_ID_AA64ISAR0_CRC32_MASK |
9202                                R_ID_AA64ISAR0_ATOMIC_MASK |
9203                                R_ID_AA64ISAR0_RDM_MASK |
9204                                R_ID_AA64ISAR0_SHA3_MASK |
9205                                R_ID_AA64ISAR0_SM3_MASK |
9206                                R_ID_AA64ISAR0_SM4_MASK |
9207                                R_ID_AA64ISAR0_DP_MASK |
9208                                R_ID_AA64ISAR0_FHM_MASK |
9209                                R_ID_AA64ISAR0_TS_MASK |
9210                                R_ID_AA64ISAR0_RNDR_MASK },
9211             { .name = "ID_AA64ISAR1_EL1",
9212               .exported_bits = R_ID_AA64ISAR1_DPB_MASK |
9213                                R_ID_AA64ISAR1_APA_MASK |
9214                                R_ID_AA64ISAR1_API_MASK |
9215                                R_ID_AA64ISAR1_JSCVT_MASK |
9216                                R_ID_AA64ISAR1_FCMA_MASK |
9217                                R_ID_AA64ISAR1_LRCPC_MASK |
9218                                R_ID_AA64ISAR1_GPA_MASK |
9219                                R_ID_AA64ISAR1_GPI_MASK |
9220                                R_ID_AA64ISAR1_FRINTTS_MASK |
9221                                R_ID_AA64ISAR1_SB_MASK |
9222                                R_ID_AA64ISAR1_BF16_MASK |
9223                                R_ID_AA64ISAR1_DGH_MASK |
9224                                R_ID_AA64ISAR1_I8MM_MASK },
9225             { .name = "ID_AA64ISAR2_EL1",
9226               .exported_bits = R_ID_AA64ISAR2_WFXT_MASK |
9227                                R_ID_AA64ISAR2_RPRES_MASK |
9228                                R_ID_AA64ISAR2_GPA3_MASK |
9229                                R_ID_AA64ISAR2_APA3_MASK |
9230                                R_ID_AA64ISAR2_MOPS_MASK |
9231                                R_ID_AA64ISAR2_BC_MASK |
9232                                R_ID_AA64ISAR2_RPRFM_MASK |
9233                                R_ID_AA64ISAR2_CSSC_MASK },
9234             { .name = "ID_AA64ISAR*_EL1_RESERVED",
9235               .is_glob = true },
9236         };
9237         modify_arm_cp_regs(v8_idregs, v8_user_idregs);
9238 #endif
9239         /*
9240          * RVBAR_EL1 and RMR_EL1 only implemented if EL1 is the highest EL.
9241          * TODO: For RMR, a write with bit 1 set should do something with
9242          * cpu_reset(). In the meantime, "the bit is strictly a request",
9243          * so we are in spec just ignoring writes.
9244          */
9245         if (!arm_feature(env, ARM_FEATURE_EL3) &&
9246             !arm_feature(env, ARM_FEATURE_EL2)) {
9247             ARMCPRegInfo el1_reset_regs[] = {
9248                 { .name = "RVBAR_EL1", .state = ARM_CP_STATE_BOTH,
9249                   .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
9250                   .access = PL1_R,
9251                   .fieldoffset = offsetof(CPUARMState, cp15.rvbar) },
9252                 { .name = "RMR_EL1", .state = ARM_CP_STATE_BOTH,
9253                   .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2,
9254                   .access = PL1_RW, .type = ARM_CP_CONST,
9255                   .resetvalue = arm_feature(env, ARM_FEATURE_AARCH64) }
9256             };
9257             define_arm_cp_regs(cpu, el1_reset_regs);
9258         }
9259         define_arm_cp_regs(cpu, v8_idregs);
9260         define_arm_cp_regs(cpu, v8_cp_reginfo);
9261         if (cpu_isar_feature(aa64_aa32_el1, cpu)) {
9262             define_arm_cp_regs(cpu, v8_aa32_el1_reginfo);
9263         }
9264 
9265         for (i = 4; i < 16; i++) {
9266             /*
9267              * Encodings in "0, c0, {c4-c7}, {0-7}" are RAZ for AArch32.
9268              * For pre-v8 cores there are RAZ patterns for these in
9269              * id_pre_v8_midr_cp_reginfo[]; for v8 we do that here.
9270              * v8 extends the "must RAZ" part of the ID register space
9271              * to also cover c0, 0, c{8-15}, {0-7}.
9272              * These are STATE_AA32 because in the AArch64 sysreg space
9273              * c4-c7 is where the AArch64 ID registers live (and we've
9274              * already defined those in v8_idregs[]), and c8-c15 are not
9275              * "must RAZ" for AArch64.
9276              */
9277             g_autofree char *name = g_strdup_printf("RES_0_C0_C%d_X", i);
9278             ARMCPRegInfo v8_aa32_raz_idregs = {
9279                 .name = name,
9280                 .state = ARM_CP_STATE_AA32,
9281                 .cp = 15, .opc1 = 0, .crn = 0, .crm = i, .opc2 = CP_ANY,
9282                 .access = PL1_R, .type = ARM_CP_CONST,
9283                 .accessfn = access_aa64_tid3,
9284                 .resetvalue = 0 };
9285             define_one_arm_cp_reg(cpu, &v8_aa32_raz_idregs);
9286         }
9287     }
9288 
9289     /*
9290      * Register the base EL2 cpregs.
9291      * Pre v8, these registers are implemented only as part of the
9292      * Virtualization Extensions (EL2 present).  Beginning with v8,
9293      * if EL2 is missing but EL3 is enabled, mostly these become
9294      * RES0 from EL3, with some specific exceptions.
9295      */
9296     if (arm_feature(env, ARM_FEATURE_EL2)
9297         || (arm_feature(env, ARM_FEATURE_EL3)
9298             && arm_feature(env, ARM_FEATURE_V8))) {
9299         uint64_t vmpidr_def = mpidr_read_val(env);
9300         ARMCPRegInfo vpidr_regs[] = {
9301             { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
9302               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
9303               .access = PL2_RW, .accessfn = access_el3_aa32ns,
9304               .resetvalue = cpu->midr,
9305               .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ,
9306               .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
9307             { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
9308               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
9309               .access = PL2_RW, .resetvalue = cpu->midr,
9310               .type = ARM_CP_EL3_NO_EL2_C_NZ,
9311               .nv2_redirect_offset = 0x88,
9312               .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
9313             { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
9314               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
9315               .access = PL2_RW, .accessfn = access_el3_aa32ns,
9316               .resetvalue = vmpidr_def,
9317               .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ,
9318               .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
9319             { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
9320               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
9321               .access = PL2_RW, .resetvalue = vmpidr_def,
9322               .type = ARM_CP_EL3_NO_EL2_C_NZ,
9323               .nv2_redirect_offset = 0x50,
9324               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
9325         };
9326         /*
9327          * The only field of MDCR_EL2 that has a defined architectural reset
9328          * value is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
9329          */
9330         ARMCPRegInfo mdcr_el2 = {
9331             .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, .type = ARM_CP_IO,
9332             .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
9333             .writefn = mdcr_el2_write,
9334             .access = PL2_RW, .resetvalue = pmu_num_counters(env),
9335             .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2),
9336         };
9337         define_one_arm_cp_reg(cpu, &mdcr_el2);
9338         define_arm_cp_regs(cpu, vpidr_regs);
9339         define_arm_cp_regs(cpu, el2_cp_reginfo);
9340         if (arm_feature(env, ARM_FEATURE_V8)) {
9341             define_arm_cp_regs(cpu, el2_v8_cp_reginfo);
9342         }
9343         if (cpu_isar_feature(aa64_sel2, cpu)) {
9344             define_arm_cp_regs(cpu, el2_sec_cp_reginfo);
9345         }
9346         /*
9347          * RVBAR_EL2 and RMR_EL2 only implemented if EL2 is the highest EL.
9348          * See commentary near RMR_EL1.
9349          */
9350         if (!arm_feature(env, ARM_FEATURE_EL3)) {
9351             static const ARMCPRegInfo el2_reset_regs[] = {
9352                 { .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
9353                   .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
9354                   .access = PL2_R,
9355                   .fieldoffset = offsetof(CPUARMState, cp15.rvbar) },
9356                 { .name = "RVBAR", .type = ARM_CP_ALIAS,
9357                   .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
9358                   .access = PL2_R,
9359                   .fieldoffset = offsetof(CPUARMState, cp15.rvbar) },
9360                 { .name = "RMR_EL2", .state = ARM_CP_STATE_AA64,
9361                   .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 2,
9362                   .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 1 },
9363             };
9364             define_arm_cp_regs(cpu, el2_reset_regs);
9365         }
9366     }
9367 
9368     /* Register the base EL3 cpregs. */
9369     if (arm_feature(env, ARM_FEATURE_EL3)) {
9370         define_arm_cp_regs(cpu, el3_cp_reginfo);
9371         ARMCPRegInfo el3_regs[] = {
9372             { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
9373               .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
9374               .access = PL3_R,
9375               .fieldoffset = offsetof(CPUARMState, cp15.rvbar), },
9376             { .name = "RMR_EL3", .state = ARM_CP_STATE_AA64,
9377               .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 2,
9378               .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 1 },
9379             { .name = "RMR", .state = ARM_CP_STATE_AA32,
9380               .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2,
9381               .access = PL3_RW, .type = ARM_CP_CONST,
9382               .resetvalue = arm_feature(env, ARM_FEATURE_AARCH64) },
9383             { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
9384               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
9385               .access = PL3_RW,
9386               .raw_writefn = raw_write, .writefn = sctlr_write,
9387               .fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[3]),
9388               .resetvalue = cpu->reset_sctlr },
9389         };
9390 
9391         define_arm_cp_regs(cpu, el3_regs);
9392     }
9393     /*
9394      * The behaviour of NSACR is sufficiently various that we don't
9395      * try to describe it in a single reginfo:
9396      *  if EL3 is 64 bit, then trap to EL3 from S EL1,
9397      *     reads as constant 0xc00 from NS EL1 and NS EL2
9398      *  if EL3 is 32 bit, then RW at EL3, RO at NS EL1 and NS EL2
9399      *  if v7 without EL3, register doesn't exist
9400      *  if v8 without EL3, reads as constant 0xc00 from NS EL1 and NS EL2
9401      */
9402     if (arm_feature(env, ARM_FEATURE_EL3)) {
9403         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
9404             static const ARMCPRegInfo nsacr = {
9405                 .name = "NSACR", .type = ARM_CP_CONST,
9406                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
9407                 .access = PL1_RW, .accessfn = nsacr_access,
9408                 .resetvalue = 0xc00
9409             };
9410             define_one_arm_cp_reg(cpu, &nsacr);
9411         } else {
9412             static const ARMCPRegInfo nsacr = {
9413                 .name = "NSACR",
9414                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
9415                 .access = PL3_RW | PL1_R,
9416                 .resetvalue = 0,
9417                 .fieldoffset = offsetof(CPUARMState, cp15.nsacr)
9418             };
9419             define_one_arm_cp_reg(cpu, &nsacr);
9420         }
9421     } else {
9422         if (arm_feature(env, ARM_FEATURE_V8)) {
9423             static const ARMCPRegInfo nsacr = {
9424                 .name = "NSACR", .type = ARM_CP_CONST,
9425                 .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 2,
9426                 .access = PL1_R,
9427                 .resetvalue = 0xc00
9428             };
9429             define_one_arm_cp_reg(cpu, &nsacr);
9430         }
9431     }
9432 
9433     if (arm_feature(env, ARM_FEATURE_PMSA)) {
9434         if (arm_feature(env, ARM_FEATURE_V6)) {
9435             /* PMSAv6 not implemented */
9436             assert(arm_feature(env, ARM_FEATURE_V7));
9437             define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
9438             define_arm_cp_regs(cpu, pmsav7_cp_reginfo);
9439         } else {
9440             define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
9441         }
9442     } else {
9443         define_arm_cp_regs(cpu, vmsa_pmsa_cp_reginfo);
9444         define_arm_cp_regs(cpu, vmsa_cp_reginfo);
9445         /* TTCBR2 is introduced with ARMv8.2-AA32HPD.  */
9446         if (cpu_isar_feature(aa32_hpd, cpu)) {
9447             define_one_arm_cp_reg(cpu, &ttbcr2_reginfo);
9448         }
9449     }
9450     if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
9451         define_arm_cp_regs(cpu, t2ee_cp_reginfo);
9452     }
9453     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
9454         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
9455     }
9456     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
9457         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
9458     }
9459 #ifndef CONFIG_USER_ONLY
9460     if (cpu_isar_feature(aa64_ecv, cpu)) {
9461         define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
9462     }
9463 #endif
9464     if (arm_feature(env, ARM_FEATURE_VAPA)) {
9465         ARMCPRegInfo vapa_cp_reginfo[] = {
9466             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
9467               .access = PL1_RW, .resetvalue = 0,
9468               .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.par_s),
9469                                      offsetoflow32(CPUARMState, cp15.par_ns) },
9470               .writefn = par_write},
9471 #ifndef CONFIG_USER_ONLY
9472             /* This underdecoding is safe because the reginfo is NO_RAW. */
9473             { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
9474               .access = PL1_W, .accessfn = ats_access,
9475               .writefn = ats_write, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC },
9476 #endif
9477         };
9478 
9479         /*
9480          * When LPAE exists this 32-bit PAR register is an alias of the
9481          * 64-bit AArch32 PAR register defined in lpae_cp_reginfo[]
9482          */
9483         if (arm_feature(env, ARM_FEATURE_LPAE)) {
9484             vapa_cp_reginfo[0].type = ARM_CP_ALIAS | ARM_CP_NO_GDB;
9485         }
9486         define_arm_cp_regs(cpu, vapa_cp_reginfo);
9487     }
9488     if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
9489         define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
9490     }
9491     if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
9492         define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
9493     }
9494     if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
9495         define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
9496     }
9497     if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
9498         define_arm_cp_regs(cpu, omap_cp_reginfo);
9499     }
9500     if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
9501         define_arm_cp_regs(cpu, strongarm_cp_reginfo);
9502     }
9503     if (arm_feature(env, ARM_FEATURE_XSCALE)) {
9504         define_arm_cp_regs(cpu, xscale_cp_reginfo);
9505     }
9506     if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
9507         define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
9508     }
9509     if (arm_feature(env, ARM_FEATURE_LPAE)) {
9510         define_arm_cp_regs(cpu, lpae_cp_reginfo);
9511     }
9512     if (cpu_isar_feature(aa32_jazelle, cpu)) {
9513         define_arm_cp_regs(cpu, jazelle_regs);
9514     }
9515     /*
9516      * Slightly awkwardly, the OMAP and StrongARM cores need all of
9517      * cp15 crn=0 to be writes-ignored, whereas for other cores they should
9518      * be read-only (ie write causes UNDEF exception).
9519      */
9520     {
9521         ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
9522             /*
9523              * Pre-v8 MIDR space.
9524              * Note that the MIDR isn't a simple constant register because
9525              * of the TI925 behaviour where writes to another register can
9526              * cause the MIDR value to change.
9527              *
9528              * Unimplemented registers in the c15 0 0 0 space default to
9529              * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
9530              * and friends override accordingly.
9531              */
9532             { .name = "MIDR",
9533               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
9534               .access = PL1_R, .resetvalue = cpu->midr,
9535               .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
9536               .readfn = midr_read,
9537               .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
9538               .type = ARM_CP_OVERRIDE },
9539             /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
9540             { .name = "DUMMY",
9541               .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
9542               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
9543             { .name = "DUMMY",
9544               .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
9545               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
9546             { .name = "DUMMY",
9547               .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
9548               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
9549             { .name = "DUMMY",
9550               .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
9551               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
9552             { .name = "DUMMY",
9553               .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
9554               .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
9555         };
9556         ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
9557             { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
9558               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
9559               .access = PL1_R, .type = ARM_CP_NO_RAW, .resetvalue = cpu->midr,
9560               .fgt = FGT_MIDR_EL1,
9561               .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
9562               .readfn = midr_read },
9563             /* crn = 0 op1 = 0 crm = 0 op2 = 7 : AArch32 aliases of MIDR */
9564             { .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST,
9565               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 7,
9566               .access = PL1_R, .resetvalue = cpu->midr },
9567             { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
9568               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
9569               .access = PL1_R,
9570               .accessfn = access_aa64_tid1,
9571               .fgt = FGT_REVIDR_EL1,
9572               .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
9573         };
9574         ARMCPRegInfo id_v8_midr_alias_cp_reginfo = {
9575             .name = "MIDR", .type = ARM_CP_ALIAS | ARM_CP_CONST | ARM_CP_NO_GDB,
9576             .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
9577             .access = PL1_R, .resetvalue = cpu->midr
9578         };
9579         ARMCPRegInfo id_cp_reginfo[] = {
9580             /* These are common to v8 and pre-v8 */
9581             { .name = "CTR",
9582               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
9583               .access = PL1_R, .accessfn = ctr_el0_access,
9584               .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
9585             { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
9586               .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
9587               .access = PL0_R, .accessfn = ctr_el0_access,
9588               .fgt = FGT_CTR_EL0,
9589               .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
9590             /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
9591             { .name = "TCMTR",
9592               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
9593               .access = PL1_R,
9594               .accessfn = access_aa32_tid1,
9595               .type = ARM_CP_CONST, .resetvalue = 0 },
9596         };
9597         /* TLBTR is specific to VMSA */
9598         ARMCPRegInfo id_tlbtr_reginfo = {
9599               .name = "TLBTR",
9600               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
9601               .access = PL1_R,
9602               .accessfn = access_aa32_tid1,
9603               .type = ARM_CP_CONST, .resetvalue = 0,
9604         };
9605         /* MPUIR is specific to PMSA V6+ */
9606         ARMCPRegInfo id_mpuir_reginfo = {
9607               .name = "MPUIR",
9608               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 4,
9609               .access = PL1_R, .type = ARM_CP_CONST,
9610               .resetvalue = cpu->pmsav7_dregion << 8
9611         };
9612         /* HMPUIR is specific to PMSA V8 */
9613         ARMCPRegInfo id_hmpuir_reginfo = {
9614             .name = "HMPUIR",
9615             .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 4,
9616             .access = PL2_R, .type = ARM_CP_CONST,
9617             .resetvalue = cpu->pmsav8r_hdregion
9618         };
9619         static const ARMCPRegInfo crn0_wi_reginfo = {
9620             .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
9621             .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
9622             .type = ARM_CP_NOP | ARM_CP_OVERRIDE
9623         };
9624 #ifdef CONFIG_USER_ONLY
9625         static const ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
9626             { .name = "MIDR_EL1",
9627               .exported_bits = R_MIDR_EL1_REVISION_MASK |
9628                                R_MIDR_EL1_PARTNUM_MASK |
9629                                R_MIDR_EL1_ARCHITECTURE_MASK |
9630                                R_MIDR_EL1_VARIANT_MASK |
9631                                R_MIDR_EL1_IMPLEMENTER_MASK },
9632             { .name = "REVIDR_EL1" },
9633         };
9634         modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo);
9635 #endif
9636         if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
9637             arm_feature(env, ARM_FEATURE_STRONGARM)) {
9638             size_t i;
9639             /*
9640              * Register the blanket "writes ignored" value first to cover the
9641              * whole space. Then update the specific ID registers to allow write
9642              * access, so that they ignore writes rather than causing them to
9643              * UNDEF.
9644              */
9645             define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
9646             for (i = 0; i < ARRAY_SIZE(id_pre_v8_midr_cp_reginfo); ++i) {
9647                 id_pre_v8_midr_cp_reginfo[i].access = PL1_RW;
9648             }
9649             for (i = 0; i < ARRAY_SIZE(id_cp_reginfo); ++i) {
9650                 id_cp_reginfo[i].access = PL1_RW;
9651             }
9652             id_mpuir_reginfo.access = PL1_RW;
9653             id_tlbtr_reginfo.access = PL1_RW;
9654         }
9655         if (arm_feature(env, ARM_FEATURE_V8)) {
9656             define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
9657             if (!arm_feature(env, ARM_FEATURE_PMSA)) {
9658                 define_one_arm_cp_reg(cpu, &id_v8_midr_alias_cp_reginfo);
9659             }
9660         } else {
9661             define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
9662         }
9663         define_arm_cp_regs(cpu, id_cp_reginfo);
9664         if (!arm_feature(env, ARM_FEATURE_PMSA)) {
9665             define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
9666         } else if (arm_feature(env, ARM_FEATURE_PMSA) &&
9667                    arm_feature(env, ARM_FEATURE_V8)) {
9668             uint32_t i = 0;
9669             char *tmp_string;
9670 
9671             define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
9672             define_one_arm_cp_reg(cpu, &id_hmpuir_reginfo);
9673             define_arm_cp_regs(cpu, pmsav8r_cp_reginfo);
9674 
9675             /* Register alias is only valid for first 32 indexes */
9676             for (i = 0; i < MIN(cpu->pmsav7_dregion, 32); ++i) {
9677                 uint8_t crm = 0b1000 | extract32(i, 1, 3);
9678                 uint8_t opc1 = extract32(i, 4, 1);
9679                 uint8_t opc2 = extract32(i, 0, 1) << 2;
9680 
9681                 tmp_string = g_strdup_printf("PRBAR%u", i);
9682                 ARMCPRegInfo tmp_prbarn_reginfo = {
9683                     .name = tmp_string, .type = ARM_CP_ALIAS | ARM_CP_NO_RAW,
9684                     .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2,
9685                     .access = PL1_RW, .resetvalue = 0,
9686                     .accessfn = access_tvm_trvm,
9687                     .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read
9688                 };
9689                 define_one_arm_cp_reg(cpu, &tmp_prbarn_reginfo);
9690                 g_free(tmp_string);
9691 
9692                 opc2 = extract32(i, 0, 1) << 2 | 0x1;
9693                 tmp_string = g_strdup_printf("PRLAR%u", i);
9694                 ARMCPRegInfo tmp_prlarn_reginfo = {
9695                     .name = tmp_string, .type = ARM_CP_ALIAS | ARM_CP_NO_RAW,
9696                     .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2,
9697                     .access = PL1_RW, .resetvalue = 0,
9698                     .accessfn = access_tvm_trvm,
9699                     .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read
9700                 };
9701                 define_one_arm_cp_reg(cpu, &tmp_prlarn_reginfo);
9702                 g_free(tmp_string);
9703             }
9704 
9705             /* Register alias is only valid for first 32 indexes */
9706             for (i = 0; i < MIN(cpu->pmsav8r_hdregion, 32); ++i) {
9707                 uint8_t crm = 0b1000 | extract32(i, 1, 3);
9708                 uint8_t opc1 = 0b100 | extract32(i, 4, 1);
9709                 uint8_t opc2 = extract32(i, 0, 1) << 2;
9710 
9711                 tmp_string = g_strdup_printf("HPRBAR%u", i);
9712                 ARMCPRegInfo tmp_hprbarn_reginfo = {
9713                     .name = tmp_string,
9714                     .type = ARM_CP_NO_RAW,
9715                     .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2,
9716                     .access = PL2_RW, .resetvalue = 0,
9717                     .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read
9718                 };
9719                 define_one_arm_cp_reg(cpu, &tmp_hprbarn_reginfo);
9720                 g_free(tmp_string);
9721 
9722                 opc2 = extract32(i, 0, 1) << 2 | 0x1;
9723                 tmp_string = g_strdup_printf("HPRLAR%u", i);
9724                 ARMCPRegInfo tmp_hprlarn_reginfo = {
9725                     .name = tmp_string,
9726                     .type = ARM_CP_NO_RAW,
9727                     .cp = 15, .opc1 = opc1, .crn = 6, .crm = crm, .opc2 = opc2,
9728                     .access = PL2_RW, .resetvalue = 0,
9729                     .writefn = pmsav8r_regn_write, .readfn = pmsav8r_regn_read
9730                 };
9731                 define_one_arm_cp_reg(cpu, &tmp_hprlarn_reginfo);
9732                 g_free(tmp_string);
9733             }
9734         } else if (arm_feature(env, ARM_FEATURE_V7)) {
9735             define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
9736         }
9737     }
9738 
9739     if (arm_feature(env, ARM_FEATURE_MPIDR)) {
9740         ARMCPRegInfo mpidr_cp_reginfo[] = {
9741             { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH,
9742               .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
9743               .fgt = FGT_MPIDR_EL1,
9744               .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
9745         };
9746 #ifdef CONFIG_USER_ONLY
9747         static const ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
9748             { .name = "MPIDR_EL1",
9749               .fixed_bits = 0x0000000080000000 },
9750         };
9751         modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo);
9752 #endif
9753         define_arm_cp_regs(cpu, mpidr_cp_reginfo);
9754     }
9755 
9756     if (arm_feature(env, ARM_FEATURE_AUXCR)) {
9757         ARMCPRegInfo auxcr_reginfo[] = {
9758             { .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
9759               .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
9760               .access = PL1_RW, .accessfn = access_tacr,
9761               .nv2_redirect_offset = 0x118,
9762               .type = ARM_CP_CONST, .resetvalue = cpu->reset_auxcr },
9763             { .name = "ACTLR_EL2", .state = ARM_CP_STATE_BOTH,
9764               .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 1,
9765               .access = PL2_RW, .type = ARM_CP_CONST,
9766               .resetvalue = 0 },
9767             { .name = "ACTLR_EL3", .state = ARM_CP_STATE_AA64,
9768               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 1,
9769               .access = PL3_RW, .type = ARM_CP_CONST,
9770               .resetvalue = 0 },
9771         };
9772         define_arm_cp_regs(cpu, auxcr_reginfo);
9773         if (cpu_isar_feature(aa32_ac2, cpu)) {
9774             define_arm_cp_regs(cpu, actlr2_hactlr2_reginfo);
9775         }
9776     }
9777 
9778     if (arm_feature(env, ARM_FEATURE_CBAR)) {
9779         /*
9780          * CBAR is IMPDEF, but common on Arm Cortex-A implementations.
9781          * There are two flavours:
9782          *  (1) older 32-bit only cores have a simple 32-bit CBAR
9783          *  (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a
9784          *      32-bit register visible to AArch32 at a different encoding
9785          *      to the "flavour 1" register and with the bits rearranged to
9786          *      be able to squash a 64-bit address into the 32-bit view.
9787          * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but
9788          * in future if we support AArch32-only configs of some of the
9789          * AArch64 cores we might need to add a specific feature flag
9790          * to indicate cores with "flavour 2" CBAR.
9791          */
9792         if (arm_feature(env, ARM_FEATURE_V8)) {
9793             /* 32 bit view is [31:18] 0...0 [43:32]. */
9794             uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
9795                 | extract64(cpu->reset_cbar, 32, 12);
9796             ARMCPRegInfo cbar_reginfo[] = {
9797                 { .name = "CBAR",
9798                   .type = ARM_CP_CONST,
9799                   .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0,
9800                   .access = PL1_R, .resetvalue = cbar32 },
9801                 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
9802                   .type = ARM_CP_CONST,
9803                   .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
9804                   .access = PL1_R, .resetvalue = cpu->reset_cbar },
9805             };
9806             /* We don't implement a r/w 64 bit CBAR currently */
9807             assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
9808             define_arm_cp_regs(cpu, cbar_reginfo);
9809         } else {
9810             ARMCPRegInfo cbar = {
9811                 .name = "CBAR",
9812                 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
9813                 .access = PL1_R | PL3_W, .resetvalue = cpu->reset_cbar,
9814                 .fieldoffset = offsetof(CPUARMState,
9815                                         cp15.c15_config_base_address)
9816             };
9817             if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
9818                 cbar.access = PL1_R;
9819                 cbar.fieldoffset = 0;
9820                 cbar.type = ARM_CP_CONST;
9821             }
9822             define_one_arm_cp_reg(cpu, &cbar);
9823         }
9824     }
9825 
9826     if (arm_feature(env, ARM_FEATURE_VBAR)) {
9827         static const ARMCPRegInfo vbar_cp_reginfo[] = {
9828             { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
9829               .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
9830               .access = PL1_RW, .writefn = vbar_write,
9831               .accessfn = access_nv1,
9832               .fgt = FGT_VBAR_EL1,
9833               .nv2_redirect_offset = 0x250 | NV2_REDIR_NV1,
9834               .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
9835                                      offsetof(CPUARMState, cp15.vbar_ns) },
9836               .resetvalue = 0 },
9837         };
9838         define_arm_cp_regs(cpu, vbar_cp_reginfo);
9839     }
9840 
9841     /* Generic registers whose values depend on the implementation */
9842     {
9843         ARMCPRegInfo sctlr = {
9844             .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
9845             .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
9846             .access = PL1_RW, .accessfn = access_tvm_trvm,
9847             .fgt = FGT_SCTLR_EL1,
9848             .nv2_redirect_offset = 0x110 | NV2_REDIR_NV1,
9849             .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
9850                                    offsetof(CPUARMState, cp15.sctlr_ns) },
9851             .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
9852             .raw_writefn = raw_write,
9853         };
9854         if (arm_feature(env, ARM_FEATURE_XSCALE)) {
9855             /*
9856              * Normally we would always end the TB on an SCTLR write, but Linux
9857              * arch/arm/mach-pxa/sleep.S expects two instructions following
9858              * an MMU enable to execute from cache.  Imitate this behaviour.
9859              */
9860             sctlr.type |= ARM_CP_SUPPRESS_TB_END;
9861         }
9862         define_one_arm_cp_reg(cpu, &sctlr);
9863 
9864         if (arm_feature(env, ARM_FEATURE_PMSA) &&
9865             arm_feature(env, ARM_FEATURE_V8)) {
9866             ARMCPRegInfo vsctlr = {
9867                 .name = "VSCTLR", .state = ARM_CP_STATE_AA32,
9868                 .cp = 15, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
9869                 .access = PL2_RW, .resetvalue = 0x0,
9870                 .fieldoffset = offsetoflow32(CPUARMState, cp15.vsctlr),
9871             };
9872             define_one_arm_cp_reg(cpu, &vsctlr);
9873         }
9874     }
9875 
9876     if (cpu_isar_feature(aa64_lor, cpu)) {
9877         define_arm_cp_regs(cpu, lor_reginfo);
9878     }
9879     if (cpu_isar_feature(aa64_pan, cpu)) {
9880         define_one_arm_cp_reg(cpu, &pan_reginfo);
9881     }
9882 #ifndef CONFIG_USER_ONLY
9883     if (cpu_isar_feature(aa64_ats1e1, cpu)) {
9884         define_arm_cp_regs(cpu, ats1e1_reginfo);
9885     }
9886     if (cpu_isar_feature(aa32_ats1e1, cpu)) {
9887         define_arm_cp_regs(cpu, ats1cp_reginfo);
9888     }
9889 #endif
9890     if (cpu_isar_feature(aa64_uao, cpu)) {
9891         define_one_arm_cp_reg(cpu, &uao_reginfo);
9892     }
9893 
9894     if (cpu_isar_feature(aa64_dit, cpu)) {
9895         define_one_arm_cp_reg(cpu, &dit_reginfo);
9896     }
9897     if (cpu_isar_feature(aa64_ssbs, cpu)) {
9898         define_one_arm_cp_reg(cpu, &ssbs_reginfo);
9899     }
9900     if (cpu_isar_feature(any_ras, cpu)) {
9901         define_arm_cp_regs(cpu, minimal_ras_reginfo);
9902     }
9903 
9904     if (cpu_isar_feature(aa64_vh, cpu) ||
9905         cpu_isar_feature(aa64_debugv8p2, cpu)) {
9906         define_one_arm_cp_reg(cpu, &contextidr_el2);
9907     }
9908     if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) {
9909         define_arm_cp_regs(cpu, vhe_reginfo);
9910     }
9911 
9912     if (cpu_isar_feature(aa64_sve, cpu)) {
9913         define_arm_cp_regs(cpu, zcr_reginfo);
9914     }
9915 
9916     if (cpu_isar_feature(aa64_hcx, cpu)) {
9917         define_one_arm_cp_reg(cpu, &hcrx_el2_reginfo);
9918     }
9919 
9920 #ifdef TARGET_AARCH64
9921     if (cpu_isar_feature(aa64_sme, cpu)) {
9922         define_arm_cp_regs(cpu, sme_reginfo);
9923     }
9924     if (cpu_isar_feature(aa64_pauth, cpu)) {
9925         define_arm_cp_regs(cpu, pauth_reginfo);
9926     }
9927     if (cpu_isar_feature(aa64_rndr, cpu)) {
9928         define_arm_cp_regs(cpu, rndr_reginfo);
9929     }
9930     if (cpu_isar_feature(aa64_tlbirange, cpu)) {
9931         define_arm_cp_regs(cpu, tlbirange_reginfo);
9932     }
9933     if (cpu_isar_feature(aa64_tlbios, cpu)) {
9934         define_arm_cp_regs(cpu, tlbios_reginfo);
9935     }
9936     /* Data Cache clean instructions up to PoP */
9937     if (cpu_isar_feature(aa64_dcpop, cpu)) {
9938         define_one_arm_cp_reg(cpu, dcpop_reg);
9939 
9940         if (cpu_isar_feature(aa64_dcpodp, cpu)) {
9941             define_one_arm_cp_reg(cpu, dcpodp_reg);
9942         }
9943     }
9944 
9945     /*
9946      * If full MTE is enabled, add all of the system registers.
9947      * If only "instructions available at EL0" are enabled,
9948      * then define only a RAZ/WI version of PSTATE.TCO.
9949      */
9950     if (cpu_isar_feature(aa64_mte, cpu)) {
9951         ARMCPRegInfo gmid_reginfo = {
9952             .name = "GMID_EL1", .state = ARM_CP_STATE_AA64,
9953             .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 4,
9954             .access = PL1_R, .accessfn = access_aa64_tid5,
9955             .type = ARM_CP_CONST, .resetvalue = cpu->gm_blocksize,
9956         };
9957         define_one_arm_cp_reg(cpu, &gmid_reginfo);
9958         define_arm_cp_regs(cpu, mte_reginfo);
9959         define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo);
9960     } else if (cpu_isar_feature(aa64_mte_insn_reg, cpu)) {
9961         define_arm_cp_regs(cpu, mte_tco_ro_reginfo);
9962         define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo);
9963     }
9964 
9965     if (cpu_isar_feature(aa64_scxtnum, cpu)) {
9966         define_arm_cp_regs(cpu, scxtnum_reginfo);
9967     }
9968 
9969     if (cpu_isar_feature(aa64_fgt, cpu)) {
9970         define_arm_cp_regs(cpu, fgt_reginfo);
9971     }
9972 
9973     if (cpu_isar_feature(aa64_rme, cpu)) {
9974         define_arm_cp_regs(cpu, rme_reginfo);
9975         if (cpu_isar_feature(aa64_mte, cpu)) {
9976             define_arm_cp_regs(cpu, rme_mte_reginfo);
9977         }
9978     }
9979 
9980     if (cpu_isar_feature(aa64_nv2, cpu)) {
9981         define_arm_cp_regs(cpu, nv2_reginfo);
9982     }
9983 
9984     if (cpu_isar_feature(aa64_nmi, cpu)) {
9985         define_arm_cp_regs(cpu, nmi_reginfo);
9986     }
9987 #endif
9988 
9989     if (cpu_isar_feature(any_predinv, cpu)) {
9990         define_arm_cp_regs(cpu, predinv_reginfo);
9991     }
9992 
9993     if (cpu_isar_feature(any_ccidx, cpu)) {
9994         define_arm_cp_regs(cpu, ccsidr2_reginfo);
9995     }
9996 
9997 #ifndef CONFIG_USER_ONLY
9998     /*
9999      * Register redirections and aliases must be done last,
10000      * after the registers from the other extensions have been defined.
10001      */
10002     if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) {
10003         define_arm_vh_e2h_redirects_aliases(cpu);
10004     }
10005 #endif
10006 }
10007 
10008 /*
10009  * Private utility function for define_one_arm_cp_reg_with_opaque():
10010  * add a single reginfo struct to the hash table.
10011  */
add_cpreg_to_hashtable(ARMCPU * cpu,const ARMCPRegInfo * r,void * opaque,CPState state,CPSecureState secstate,int crm,int opc1,int opc2,const char * name)10012 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
10013                                    void *opaque, CPState state,
10014                                    CPSecureState secstate,
10015                                    int crm, int opc1, int opc2,
10016                                    const char *name)
10017 {
10018     CPUARMState *env = &cpu->env;
10019     uint32_t key;
10020     ARMCPRegInfo *r2;
10021     bool is64 = r->type & ARM_CP_64BIT;
10022     bool ns = secstate & ARM_CP_SECSTATE_NS;
10023     int cp = r->cp;
10024     size_t name_len;
10025     bool make_const;
10026 
10027     switch (state) {
10028     case ARM_CP_STATE_AA32:
10029         /* We assume it is a cp15 register if the .cp field is left unset. */
10030         if (cp == 0 && r->state == ARM_CP_STATE_BOTH) {
10031             cp = 15;
10032         }
10033         key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2);
10034         break;
10035     case ARM_CP_STATE_AA64:
10036         /*
10037          * To allow abbreviation of ARMCPRegInfo definitions, we treat
10038          * cp == 0 as equivalent to the value for "standard guest-visible
10039          * sysreg".  STATE_BOTH definitions are also always "standard sysreg"
10040          * in their AArch64 view (the .cp value may be non-zero for the
10041          * benefit of the AArch32 view).
10042          */
10043         if (cp == 0 || r->state == ARM_CP_STATE_BOTH) {
10044             cp = CP_REG_ARM64_SYSREG_CP;
10045         }
10046         key = ENCODE_AA64_CP_REG(cp, r->crn, crm, r->opc0, opc1, opc2);
10047         break;
10048     default:
10049         g_assert_not_reached();
10050     }
10051 
10052     /* Overriding of an existing definition must be explicitly requested. */
10053     if (!(r->type & ARM_CP_OVERRIDE)) {
10054         const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
10055         if (oldreg) {
10056             assert(oldreg->type & ARM_CP_OVERRIDE);
10057         }
10058     }
10059 
10060     /*
10061      * Eliminate registers that are not present because the EL is missing.
10062      * Doing this here makes it easier to put all registers for a given
10063      * feature into the same ARMCPRegInfo array and define them all at once.
10064      */
10065     make_const = false;
10066     if (arm_feature(env, ARM_FEATURE_EL3)) {
10067         /*
10068          * An EL2 register without EL2 but with EL3 is (usually) RES0.
10069          * See rule RJFFP in section D1.1.3 of DDI0487H.a.
10070          */
10071         int min_el = ctz32(r->access) / 2;
10072         if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) {
10073             if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) {
10074                 return;
10075             }
10076             make_const = !(r->type & ARM_CP_EL3_NO_EL2_KEEP);
10077         }
10078     } else {
10079         CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2)
10080                                  ? PL2_RW : PL1_RW);
10081         if ((r->access & max_el) == 0) {
10082             return;
10083         }
10084     }
10085 
10086     /* Combine cpreg and name into one allocation. */
10087     name_len = strlen(name) + 1;
10088     r2 = g_malloc(sizeof(*r2) + name_len);
10089     *r2 = *r;
10090     r2->name = memcpy(r2 + 1, name, name_len);
10091 
10092     /*
10093      * Update fields to match the instantiation, overwiting wildcards
10094      * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH.
10095      */
10096     r2->cp = cp;
10097     r2->crm = crm;
10098     r2->opc1 = opc1;
10099     r2->opc2 = opc2;
10100     r2->state = state;
10101     r2->secure = secstate;
10102     if (opaque) {
10103         r2->opaque = opaque;
10104     }
10105 
10106     if (make_const) {
10107         /* This should not have been a very special register to begin. */
10108         int old_special = r2->type & ARM_CP_SPECIAL_MASK;
10109         assert(old_special == 0 || old_special == ARM_CP_NOP);
10110         /*
10111          * Set the special function to CONST, retaining the other flags.
10112          * This is important for e.g. ARM_CP_SVE so that we still
10113          * take the SVE trap if CPTR_EL3.EZ == 0.
10114          */
10115         r2->type = (r2->type & ~ARM_CP_SPECIAL_MASK) | ARM_CP_CONST;
10116         /*
10117          * Usually, these registers become RES0, but there are a few
10118          * special cases like VPIDR_EL2 which have a constant non-zero
10119          * value with writes ignored.
10120          */
10121         if (!(r->type & ARM_CP_EL3_NO_EL2_C_NZ)) {
10122             r2->resetvalue = 0;
10123         }
10124         /*
10125          * ARM_CP_CONST has precedence, so removing the callbacks and
10126          * offsets are not strictly necessary, but it is potentially
10127          * less confusing to debug later.
10128          */
10129         r2->readfn = NULL;
10130         r2->writefn = NULL;
10131         r2->raw_readfn = NULL;
10132         r2->raw_writefn = NULL;
10133         r2->resetfn = NULL;
10134         r2->fieldoffset = 0;
10135         r2->bank_fieldoffsets[0] = 0;
10136         r2->bank_fieldoffsets[1] = 0;
10137     } else {
10138         bool isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
10139 
10140         if (isbanked) {
10141             /*
10142              * Register is banked (using both entries in array).
10143              * Overwriting fieldoffset as the array is only used to define
10144              * banked registers but later only fieldoffset is used.
10145              */
10146             r2->fieldoffset = r->bank_fieldoffsets[ns];
10147         }
10148         if (state == ARM_CP_STATE_AA32) {
10149             if (isbanked) {
10150                 /*
10151                  * If the register is banked then we don't need to migrate or
10152                  * reset the 32-bit instance in certain cases:
10153                  *
10154                  * 1) If the register has both 32-bit and 64-bit instances
10155                  *    then we can count on the 64-bit instance taking care
10156                  *    of the non-secure bank.
10157                  * 2) If ARMv8 is enabled then we can count on a 64-bit
10158                  *    version taking care of the secure bank.  This requires
10159                  *    that separate 32 and 64-bit definitions are provided.
10160                  */
10161                 if ((r->state == ARM_CP_STATE_BOTH && ns) ||
10162                     (arm_feature(env, ARM_FEATURE_V8) && !ns)) {
10163                     r2->type |= ARM_CP_ALIAS;
10164                 }
10165             } else if ((secstate != r->secure) && !ns) {
10166                 /*
10167                  * The register is not banked so we only want to allow
10168                  * migration of the non-secure instance.
10169                  */
10170                 r2->type |= ARM_CP_ALIAS;
10171             }
10172 
10173             if (HOST_BIG_ENDIAN &&
10174                 r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) {
10175                 r2->fieldoffset += sizeof(uint32_t);
10176             }
10177         }
10178     }
10179 
10180     /*
10181      * By convention, for wildcarded registers only the first
10182      * entry is used for migration; the others are marked as
10183      * ALIAS so we don't try to transfer the register
10184      * multiple times. Special registers (ie NOP/WFI) are
10185      * never migratable and not even raw-accessible.
10186      */
10187     if (r2->type & ARM_CP_SPECIAL_MASK) {
10188         r2->type |= ARM_CP_NO_RAW;
10189     }
10190     if (((r->crm == CP_ANY) && crm != 0) ||
10191         ((r->opc1 == CP_ANY) && opc1 != 0) ||
10192         ((r->opc2 == CP_ANY) && opc2 != 0)) {
10193         r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
10194     }
10195 
10196     /*
10197      * Check that raw accesses are either forbidden or handled. Note that
10198      * we can't assert this earlier because the setup of fieldoffset for
10199      * banked registers has to be done first.
10200      */
10201     if (!(r2->type & ARM_CP_NO_RAW)) {
10202         assert(!raw_accessors_invalid(r2));
10203     }
10204 
10205     g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2);
10206 }
10207 
10208 
define_one_arm_cp_reg_with_opaque(ARMCPU * cpu,const ARMCPRegInfo * r,void * opaque)10209 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
10210                                        const ARMCPRegInfo *r, void *opaque)
10211 {
10212     /*
10213      * Define implementations of coprocessor registers.
10214      * We store these in a hashtable because typically
10215      * there are less than 150 registers in a space which
10216      * is 16*16*16*8*8 = 262144 in size.
10217      * Wildcarding is supported for the crm, opc1 and opc2 fields.
10218      * If a register is defined twice then the second definition is
10219      * used, so this can be used to define some generic registers and
10220      * then override them with implementation specific variations.
10221      * At least one of the original and the second definition should
10222      * include ARM_CP_OVERRIDE in its type bits -- this is just a guard
10223      * against accidental use.
10224      *
10225      * The state field defines whether the register is to be
10226      * visible in the AArch32 or AArch64 execution state. If the
10227      * state is set to ARM_CP_STATE_BOTH then we synthesise a
10228      * reginfo structure for the AArch32 view, which sees the lower
10229      * 32 bits of the 64 bit register.
10230      *
10231      * Only registers visible in AArch64 may set r->opc0; opc0 cannot
10232      * be wildcarded. AArch64 registers are always considered to be 64
10233      * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
10234      * the register, if any.
10235      */
10236     int crm, opc1, opc2;
10237     int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
10238     int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
10239     int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
10240     int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
10241     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
10242     int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
10243     CPState state;
10244 
10245     /* 64 bit registers have only CRm and Opc1 fields */
10246     assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
10247     /* op0 only exists in the AArch64 encodings */
10248     assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
10249     /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
10250     assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
10251     /*
10252      * This API is only for Arm's system coprocessors (14 and 15) or
10253      * (M-profile or v7A-and-earlier only) for implementation defined
10254      * coprocessors in the range 0..7.  Our decode assumes this, since
10255      * 8..13 can be used for other insns including VFP and Neon. See
10256      * valid_cp() in translate.c.  Assert here that we haven't tried
10257      * to use an invalid coprocessor number.
10258      */
10259     switch (r->state) {
10260     case ARM_CP_STATE_BOTH:
10261         /* 0 has a special meaning, but otherwise the same rules as AA32. */
10262         if (r->cp == 0) {
10263             break;
10264         }
10265         /* fall through */
10266     case ARM_CP_STATE_AA32:
10267         if (arm_feature(&cpu->env, ARM_FEATURE_V8) &&
10268             !arm_feature(&cpu->env, ARM_FEATURE_M)) {
10269             assert(r->cp >= 14 && r->cp <= 15);
10270         } else {
10271             assert(r->cp < 8 || (r->cp >= 14 && r->cp <= 15));
10272         }
10273         break;
10274     case ARM_CP_STATE_AA64:
10275         assert(r->cp == 0 || r->cp == CP_REG_ARM64_SYSREG_CP);
10276         break;
10277     default:
10278         g_assert_not_reached();
10279     }
10280     /*
10281      * The AArch64 pseudocode CheckSystemAccess() specifies that op1
10282      * encodes a minimum access level for the register. We roll this
10283      * runtime check into our general permission check code, so check
10284      * here that the reginfo's specified permissions are strict enough
10285      * to encompass the generic architectural permission check.
10286      */
10287     if (r->state != ARM_CP_STATE_AA32) {
10288         CPAccessRights mask;
10289         switch (r->opc1) {
10290         case 0:
10291             /* min_EL EL1, but some accessible to EL0 via kernel ABI */
10292             mask = PL0U_R | PL1_RW;
10293             break;
10294         case 1: case 2:
10295             /* min_EL EL1 */
10296             mask = PL1_RW;
10297             break;
10298         case 3:
10299             /* min_EL EL0 */
10300             mask = PL0_RW;
10301             break;
10302         case 4:
10303         case 5:
10304             /* min_EL EL2 */
10305             mask = PL2_RW;
10306             break;
10307         case 6:
10308             /* min_EL EL3 */
10309             mask = PL3_RW;
10310             break;
10311         case 7:
10312             /* min_EL EL1, secure mode only (we don't check the latter) */
10313             mask = PL1_RW;
10314             break;
10315         default:
10316             /* broken reginfo with out-of-range opc1 */
10317             g_assert_not_reached();
10318         }
10319         /* assert our permissions are not too lax (stricter is fine) */
10320         assert((r->access & ~mask) == 0);
10321     }
10322 
10323     /*
10324      * Check that the register definition has enough info to handle
10325      * reads and writes if they are permitted.
10326      */
10327     if (!(r->type & (ARM_CP_SPECIAL_MASK | ARM_CP_CONST))) {
10328         if (r->access & PL3_R) {
10329             assert((r->fieldoffset ||
10330                    (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
10331                    r->readfn);
10332         }
10333         if (r->access & PL3_W) {
10334             assert((r->fieldoffset ||
10335                    (r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1])) ||
10336                    r->writefn);
10337         }
10338     }
10339 
10340     for (crm = crmmin; crm <= crmmax; crm++) {
10341         for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
10342             for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
10343                 for (state = ARM_CP_STATE_AA32;
10344                      state <= ARM_CP_STATE_AA64; state++) {
10345                     if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
10346                         continue;
10347                     }
10348                     if (state == ARM_CP_STATE_AA32) {
10349                         /*
10350                          * Under AArch32 CP registers can be common
10351                          * (same for secure and non-secure world) or banked.
10352                          */
10353                         char *name;
10354 
10355                         switch (r->secure) {
10356                         case ARM_CP_SECSTATE_S:
10357                         case ARM_CP_SECSTATE_NS:
10358                             add_cpreg_to_hashtable(cpu, r, opaque, state,
10359                                                    r->secure, crm, opc1, opc2,
10360                                                    r->name);
10361                             break;
10362                         case ARM_CP_SECSTATE_BOTH:
10363                             name = g_strdup_printf("%s_S", r->name);
10364                             add_cpreg_to_hashtable(cpu, r, opaque, state,
10365                                                    ARM_CP_SECSTATE_S,
10366                                                    crm, opc1, opc2, name);
10367                             g_free(name);
10368                             add_cpreg_to_hashtable(cpu, r, opaque, state,
10369                                                    ARM_CP_SECSTATE_NS,
10370                                                    crm, opc1, opc2, r->name);
10371                             break;
10372                         default:
10373                             g_assert_not_reached();
10374                         }
10375                     } else {
10376                         /*
10377                          * AArch64 registers get mapped to non-secure instance
10378                          * of AArch32
10379                          */
10380                         add_cpreg_to_hashtable(cpu, r, opaque, state,
10381                                                ARM_CP_SECSTATE_NS,
10382                                                crm, opc1, opc2, r->name);
10383                     }
10384                 }
10385             }
10386         }
10387     }
10388 }
10389 
10390 /* Define a whole list of registers */
define_arm_cp_regs_with_opaque_len(ARMCPU * cpu,const ARMCPRegInfo * regs,void * opaque,size_t len)10391 void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs,
10392                                         void *opaque, size_t len)
10393 {
10394     size_t i;
10395     for (i = 0; i < len; ++i) {
10396         define_one_arm_cp_reg_with_opaque(cpu, regs + i, opaque);
10397     }
10398 }
10399 
10400 /*
10401  * Modify ARMCPRegInfo for access from userspace.
10402  *
10403  * This is a data driven modification directed by
10404  * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as
10405  * user-space cannot alter any values and dynamic values pertaining to
10406  * execution state are hidden from user space view anyway.
10407  */
modify_arm_cp_regs_with_len(ARMCPRegInfo * regs,size_t regs_len,const ARMCPRegUserSpaceInfo * mods,size_t mods_len)10408 void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len,
10409                                  const ARMCPRegUserSpaceInfo *mods,
10410                                  size_t mods_len)
10411 {
10412     for (size_t mi = 0; mi < mods_len; ++mi) {
10413         const ARMCPRegUserSpaceInfo *m = mods + mi;
10414         GPatternSpec *pat = NULL;
10415 
10416         if (m->is_glob) {
10417             pat = g_pattern_spec_new(m->name);
10418         }
10419         for (size_t ri = 0; ri < regs_len; ++ri) {
10420             ARMCPRegInfo *r = regs + ri;
10421 
10422             if (pat && g_pattern_match_string(pat, r->name)) {
10423                 r->type = ARM_CP_CONST;
10424                 r->access = PL0U_R;
10425                 r->resetvalue = 0;
10426                 /* continue */
10427             } else if (strcmp(r->name, m->name) == 0) {
10428                 r->type = ARM_CP_CONST;
10429                 r->access = PL0U_R;
10430                 r->resetvalue &= m->exported_bits;
10431                 r->resetvalue |= m->fixed_bits;
10432                 break;
10433             }
10434         }
10435         if (pat) {
10436             g_pattern_spec_free(pat);
10437         }
10438     }
10439 }
10440 
get_arm_cp_reginfo(GHashTable * cpregs,uint32_t encoded_cp)10441 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
10442 {
10443     return g_hash_table_lookup(cpregs, (gpointer)(uintptr_t)encoded_cp);
10444 }
10445 
arm_cp_write_ignore(CPUARMState * env,const ARMCPRegInfo * ri,uint64_t value)10446 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
10447                          uint64_t value)
10448 {
10449     /* Helper coprocessor write function for write-ignore registers */
10450 }
10451 
arm_cp_read_zero(CPUARMState * env,const ARMCPRegInfo * ri)10452 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
10453 {
10454     /* Helper coprocessor write function for read-as-zero registers */
10455     return 0;
10456 }
10457 
arm_cp_reset_ignore(CPUARMState * env,const ARMCPRegInfo * opaque)10458 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
10459 {
10460     /* Helper coprocessor reset function for do-nothing-on-reset registers */
10461 }
10462 
bad_mode_switch(CPUARMState * env,int mode,CPSRWriteType write_type)10463 static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type)
10464 {
10465     /*
10466      * Return true if it is not valid for us to switch to
10467      * this CPU mode (ie all the UNPREDICTABLE cases in
10468      * the ARM ARM CPSRWriteByInstr pseudocode).
10469      */
10470 
10471     /* Changes to or from Hyp via MSR and CPS are illegal. */
10472     if (write_type == CPSRWriteByInstr &&
10473         ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP ||
10474          mode == ARM_CPU_MODE_HYP)) {
10475         return 1;
10476     }
10477 
10478     switch (mode) {
10479     case ARM_CPU_MODE_USR:
10480         return 0;
10481     case ARM_CPU_MODE_SYS:
10482     case ARM_CPU_MODE_SVC:
10483     case ARM_CPU_MODE_ABT:
10484     case ARM_CPU_MODE_UND:
10485     case ARM_CPU_MODE_IRQ:
10486     case ARM_CPU_MODE_FIQ:
10487         /*
10488          * Note that we don't implement the IMPDEF NSACR.RFR which in v7
10489          * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.)
10490          */
10491         /*
10492          * If HCR.TGE is set then changes from Monitor to NS PL1 via MSR
10493          * and CPS are treated as illegal mode changes.
10494          */
10495         if (write_type == CPSRWriteByInstr &&
10496             (env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON &&
10497             (arm_hcr_el2_eff(env) & HCR_TGE)) {
10498             return 1;
10499         }
10500         return 0;
10501     case ARM_CPU_MODE_HYP:
10502         return !arm_is_el2_enabled(env) || arm_current_el(env) < 2;
10503     case ARM_CPU_MODE_MON:
10504         return arm_current_el(env) < 3;
10505     default:
10506         return 1;
10507     }
10508 }
10509 
cpsr_read(CPUARMState * env)10510 uint32_t cpsr_read(CPUARMState *env)
10511 {
10512     int ZF;
10513     ZF = (env->ZF == 0);
10514     return env->uncached_cpsr | (env->NF & 0x80000000) | (ZF << 30) |
10515         (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
10516         | (env->thumb << 5) | ((env->condexec_bits & 3) << 25)
10517         | ((env->condexec_bits & 0xfc) << 8)
10518         | (env->GE << 16) | (env->daif & CPSR_AIF);
10519 }
10520 
cpsr_write(CPUARMState * env,uint32_t val,uint32_t mask,CPSRWriteType write_type)10521 void cpsr_write(CPUARMState *env, uint32_t val, uint32_t mask,
10522                 CPSRWriteType write_type)
10523 {
10524     uint32_t changed_daif;
10525     bool rebuild_hflags = (write_type != CPSRWriteRaw) &&
10526         (mask & (CPSR_M | CPSR_E | CPSR_IL));
10527 
10528     if (mask & CPSR_NZCV) {
10529         env->ZF = (~val) & CPSR_Z;
10530         env->NF = val;
10531         env->CF = (val >> 29) & 1;
10532         env->VF = (val << 3) & 0x80000000;
10533     }
10534     if (mask & CPSR_Q) {
10535         env->QF = ((val & CPSR_Q) != 0);
10536     }
10537     if (mask & CPSR_T) {
10538         env->thumb = ((val & CPSR_T) != 0);
10539     }
10540     if (mask & CPSR_IT_0_1) {
10541         env->condexec_bits &= ~3;
10542         env->condexec_bits |= (val >> 25) & 3;
10543     }
10544     if (mask & CPSR_IT_2_7) {
10545         env->condexec_bits &= 3;
10546         env->condexec_bits |= (val >> 8) & 0xfc;
10547     }
10548     if (mask & CPSR_GE) {
10549         env->GE = (val >> 16) & 0xf;
10550     }
10551 
10552     /*
10553      * In a V7 implementation that includes the security extensions but does
10554      * not include Virtualization Extensions the SCR.FW and SCR.AW bits control
10555      * whether non-secure software is allowed to change the CPSR_F and CPSR_A
10556      * bits respectively.
10557      *
10558      * In a V8 implementation, it is permitted for privileged software to
10559      * change the CPSR A/F bits regardless of the SCR.AW/FW bits.
10560      */
10561     if (write_type != CPSRWriteRaw && !arm_feature(env, ARM_FEATURE_V8) &&
10562         arm_feature(env, ARM_FEATURE_EL3) &&
10563         !arm_feature(env, ARM_FEATURE_EL2) &&
10564         !arm_is_secure(env)) {
10565 
10566         changed_daif = (env->daif ^ val) & mask;
10567 
10568         if (changed_daif & CPSR_A) {
10569             /*
10570              * Check to see if we are allowed to change the masking of async
10571              * abort exceptions from a non-secure state.
10572              */
10573             if (!(env->cp15.scr_el3 & SCR_AW)) {
10574                 qemu_log_mask(LOG_GUEST_ERROR,
10575                               "Ignoring attempt to switch CPSR_A flag from "
10576                               "non-secure world with SCR.AW bit clear\n");
10577                 mask &= ~CPSR_A;
10578             }
10579         }
10580 
10581         if (changed_daif & CPSR_F) {
10582             /*
10583              * Check to see if we are allowed to change the masking of FIQ
10584              * exceptions from a non-secure state.
10585              */
10586             if (!(env->cp15.scr_el3 & SCR_FW)) {
10587                 qemu_log_mask(LOG_GUEST_ERROR,
10588                               "Ignoring attempt to switch CPSR_F flag from "
10589                               "non-secure world with SCR.FW bit clear\n");
10590                 mask &= ~CPSR_F;
10591             }
10592 
10593             /*
10594              * Check whether non-maskable FIQ (NMFI) support is enabled.
10595              * If this bit is set software is not allowed to mask
10596              * FIQs, but is allowed to set CPSR_F to 0.
10597              */
10598             if ((A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_NMFI) &&
10599                 (val & CPSR_F)) {
10600                 qemu_log_mask(LOG_GUEST_ERROR,
10601                               "Ignoring attempt to enable CPSR_F flag "
10602                               "(non-maskable FIQ [NMFI] support enabled)\n");
10603                 mask &= ~CPSR_F;
10604             }
10605         }
10606     }
10607 
10608     env->daif &= ~(CPSR_AIF & mask);
10609     env->daif |= val & CPSR_AIF & mask;
10610 
10611     if (write_type != CPSRWriteRaw &&
10612         ((env->uncached_cpsr ^ val) & mask & CPSR_M)) {
10613         if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR) {
10614             /*
10615              * Note that we can only get here in USR mode if this is a
10616              * gdb stub write; for this case we follow the architectural
10617              * behaviour for guest writes in USR mode of ignoring an attempt
10618              * to switch mode. (Those are caught by translate.c for writes
10619              * triggered by guest instructions.)
10620              */
10621             mask &= ~CPSR_M;
10622         } else if (bad_mode_switch(env, val & CPSR_M, write_type)) {
10623             /*
10624              * Attempt to switch to an invalid mode: this is UNPREDICTABLE in
10625              * v7, and has defined behaviour in v8:
10626              *  + leave CPSR.M untouched
10627              *  + allow changes to the other CPSR fields
10628              *  + set PSTATE.IL
10629              * For user changes via the GDB stub, we don't set PSTATE.IL,
10630              * as this would be unnecessarily harsh for a user error.
10631              */
10632             mask &= ~CPSR_M;
10633             if (write_type != CPSRWriteByGDBStub &&
10634                 arm_feature(env, ARM_FEATURE_V8)) {
10635                 mask |= CPSR_IL;
10636                 val |= CPSR_IL;
10637             }
10638             qemu_log_mask(LOG_GUEST_ERROR,
10639                           "Illegal AArch32 mode switch attempt from %s to %s\n",
10640                           aarch32_mode_name(env->uncached_cpsr),
10641                           aarch32_mode_name(val));
10642         } else {
10643             qemu_log_mask(CPU_LOG_INT, "%s %s to %s PC 0x%" PRIx32 "\n",
10644                           write_type == CPSRWriteExceptionReturn ?
10645                           "Exception return from AArch32" :
10646                           "AArch32 mode switch from",
10647                           aarch32_mode_name(env->uncached_cpsr),
10648                           aarch32_mode_name(val), env->regs[15]);
10649             switch_mode(env, val & CPSR_M);
10650         }
10651     }
10652     mask &= ~CACHED_CPSR_BITS;
10653     env->uncached_cpsr = (env->uncached_cpsr & ~mask) | (val & mask);
10654     if (tcg_enabled() && rebuild_hflags) {
10655         arm_rebuild_hflags(env);
10656     }
10657 }
10658 
10659 #ifdef CONFIG_USER_ONLY
10660 
switch_mode(CPUARMState * env,int mode)10661 static void switch_mode(CPUARMState *env, int mode)
10662 {
10663     ARMCPU *cpu = env_archcpu(env);
10664 
10665     if (mode != ARM_CPU_MODE_USR) {
10666         cpu_abort(CPU(cpu), "Tried to switch out of user mode\n");
10667     }
10668 }
10669 
arm_phys_excp_target_el(CPUState * cs,uint32_t excp_idx,uint32_t cur_el,bool secure)10670 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
10671                                  uint32_t cur_el, bool secure)
10672 {
10673     return 1;
10674 }
10675 
aarch64_sync_64_to_32(CPUARMState * env)10676 void aarch64_sync_64_to_32(CPUARMState *env)
10677 {
10678     g_assert_not_reached();
10679 }
10680 
10681 #else
10682 
switch_mode(CPUARMState * env,int mode)10683 static void switch_mode(CPUARMState *env, int mode)
10684 {
10685     int old_mode;
10686     int i;
10687 
10688     old_mode = env->uncached_cpsr & CPSR_M;
10689     if (mode == old_mode) {
10690         return;
10691     }
10692 
10693     if (old_mode == ARM_CPU_MODE_FIQ) {
10694         memcpy(env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
10695         memcpy(env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
10696     } else if (mode == ARM_CPU_MODE_FIQ) {
10697         memcpy(env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
10698         memcpy(env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
10699     }
10700 
10701     i = bank_number(old_mode);
10702     env->banked_r13[i] = env->regs[13];
10703     env->banked_spsr[i] = env->spsr;
10704 
10705     i = bank_number(mode);
10706     env->regs[13] = env->banked_r13[i];
10707     env->spsr = env->banked_spsr[i];
10708 
10709     env->banked_r14[r14_bank_number(old_mode)] = env->regs[14];
10710     env->regs[14] = env->banked_r14[r14_bank_number(mode)];
10711 }
10712 
10713 /*
10714  * Physical Interrupt Target EL Lookup Table
10715  *
10716  * [ From ARM ARM section G1.13.4 (Table G1-15) ]
10717  *
10718  * The below multi-dimensional table is used for looking up the target
10719  * exception level given numerous condition criteria.  Specifically, the
10720  * target EL is based on SCR and HCR routing controls as well as the
10721  * currently executing EL and secure state.
10722  *
10723  *    Dimensions:
10724  *    target_el_table[2][2][2][2][2][4]
10725  *                    |  |  |  |  |  +--- Current EL
10726  *                    |  |  |  |  +------ Non-secure(0)/Secure(1)
10727  *                    |  |  |  +--------- HCR mask override
10728  *                    |  |  +------------ SCR exec state control
10729  *                    |  +--------------- SCR mask override
10730  *                    +------------------ 32-bit(0)/64-bit(1) EL3
10731  *
10732  *    The table values are as such:
10733  *    0-3 = EL0-EL3
10734  *     -1 = Cannot occur
10735  *
10736  * The ARM ARM target EL table includes entries indicating that an "exception
10737  * is not taken".  The two cases where this is applicable are:
10738  *    1) An exception is taken from EL3 but the SCR does not have the exception
10739  *    routed to EL3.
10740  *    2) An exception is taken from EL2 but the HCR does not have the exception
10741  *    routed to EL2.
10742  * In these two cases, the below table contain a target of EL1.  This value is
10743  * returned as it is expected that the consumer of the table data will check
10744  * for "target EL >= current EL" to ensure the exception is not taken.
10745  *
10746  *            SCR     HCR
10747  *         64  EA     AMO                 From
10748  *        BIT IRQ     IMO      Non-secure         Secure
10749  *        EL3 FIQ  RW FMO   EL0 EL1 EL2 EL3   EL0 EL1 EL2 EL3
10750  */
10751 static const int8_t target_el_table[2][2][2][2][2][4] = {
10752     {{{{/* 0   0   0   0 */{ 1,  1,  2, -1 },{ 3, -1, -1,  3 },},
10753        {/* 0   0   0   1 */{ 2,  2,  2, -1 },{ 3, -1, -1,  3 },},},
10754       {{/* 0   0   1   0 */{ 1,  1,  2, -1 },{ 3, -1, -1,  3 },},
10755        {/* 0   0   1   1 */{ 2,  2,  2, -1 },{ 3, -1, -1,  3 },},},},
10756      {{{/* 0   1   0   0 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},
10757        {/* 0   1   0   1 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},},
10758       {{/* 0   1   1   0 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},
10759        {/* 0   1   1   1 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},},},},
10760     {{{{/* 1   0   0   0 */{ 1,  1,  2, -1 },{ 1,  1, -1,  1 },},
10761        {/* 1   0   0   1 */{ 2,  2,  2, -1 },{ 2,  2, -1,  1 },},},
10762       {{/* 1   0   1   0 */{ 1,  1,  1, -1 },{ 1,  1,  1,  1 },},
10763        {/* 1   0   1   1 */{ 2,  2,  2, -1 },{ 2,  2,  2,  1 },},},},
10764      {{{/* 1   1   0   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
10765        {/* 1   1   0   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},
10766       {{/* 1   1   1   0 */{ 3,  3,  3, -1 },{ 3,  3,  3,  3 },},
10767        {/* 1   1   1   1 */{ 3,  3,  3, -1 },{ 3,  3,  3,  3 },},},},},
10768 };
10769 
10770 /*
10771  * Determine the target EL for physical exceptions
10772  */
arm_phys_excp_target_el(CPUState * cs,uint32_t excp_idx,uint32_t cur_el,bool secure)10773 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
10774                                  uint32_t cur_el, bool secure)
10775 {
10776     CPUARMState *env = cpu_env(cs);
10777     bool rw;
10778     bool scr;
10779     bool hcr;
10780     int target_el;
10781     /* Is the highest EL AArch64? */
10782     bool is64 = arm_feature(env, ARM_FEATURE_AARCH64);
10783     uint64_t hcr_el2;
10784 
10785     if (arm_feature(env, ARM_FEATURE_EL3)) {
10786         rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
10787     } else {
10788         /*
10789          * Either EL2 is the highest EL (and so the EL2 register width
10790          * is given by is64); or there is no EL2 or EL3, in which case
10791          * the value of 'rw' does not affect the table lookup anyway.
10792          */
10793         rw = is64;
10794     }
10795 
10796     hcr_el2 = arm_hcr_el2_eff(env);
10797     switch (excp_idx) {
10798     case EXCP_IRQ:
10799     case EXCP_NMI:
10800         scr = ((env->cp15.scr_el3 & SCR_IRQ) == SCR_IRQ);
10801         hcr = hcr_el2 & HCR_IMO;
10802         break;
10803     case EXCP_FIQ:
10804         scr = ((env->cp15.scr_el3 & SCR_FIQ) == SCR_FIQ);
10805         hcr = hcr_el2 & HCR_FMO;
10806         break;
10807     default:
10808         scr = ((env->cp15.scr_el3 & SCR_EA) == SCR_EA);
10809         hcr = hcr_el2 & HCR_AMO;
10810         break;
10811     };
10812 
10813     /*
10814      * For these purposes, TGE and AMO/IMO/FMO both force the
10815      * interrupt to EL2.  Fold TGE into the bit extracted above.
10816      */
10817     hcr |= (hcr_el2 & HCR_TGE) != 0;
10818 
10819     /* Perform a table-lookup for the target EL given the current state */
10820     target_el = target_el_table[is64][scr][rw][hcr][secure][cur_el];
10821 
10822     assert(target_el > 0);
10823 
10824     return target_el;
10825 }
10826 
arm_log_exception(CPUState * cs)10827 void arm_log_exception(CPUState *cs)
10828 {
10829     int idx = cs->exception_index;
10830 
10831     if (qemu_loglevel_mask(CPU_LOG_INT)) {
10832         const char *exc = NULL;
10833         static const char * const excnames[] = {
10834             [EXCP_UDEF] = "Undefined Instruction",
10835             [EXCP_SWI] = "SVC",
10836             [EXCP_PREFETCH_ABORT] = "Prefetch Abort",
10837             [EXCP_DATA_ABORT] = "Data Abort",
10838             [EXCP_IRQ] = "IRQ",
10839             [EXCP_FIQ] = "FIQ",
10840             [EXCP_BKPT] = "Breakpoint",
10841             [EXCP_EXCEPTION_EXIT] = "QEMU v7M exception exit",
10842             [EXCP_KERNEL_TRAP] = "QEMU intercept of kernel commpage",
10843             [EXCP_HVC] = "Hypervisor Call",
10844             [EXCP_HYP_TRAP] = "Hypervisor Trap",
10845             [EXCP_SMC] = "Secure Monitor Call",
10846             [EXCP_VIRQ] = "Virtual IRQ",
10847             [EXCP_VFIQ] = "Virtual FIQ",
10848             [EXCP_SEMIHOST] = "Semihosting call",
10849             [EXCP_NOCP] = "v7M NOCP UsageFault",
10850             [EXCP_INVSTATE] = "v7M INVSTATE UsageFault",
10851             [EXCP_STKOF] = "v8M STKOF UsageFault",
10852             [EXCP_LAZYFP] = "v7M exception during lazy FP stacking",
10853             [EXCP_LSERR] = "v8M LSERR UsageFault",
10854             [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
10855             [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault",
10856             [EXCP_VSERR] = "Virtual SERR",
10857             [EXCP_GPC] = "Granule Protection Check",
10858             [EXCP_NMI] = "NMI",
10859             [EXCP_VINMI] = "Virtual IRQ NMI",
10860             [EXCP_VFNMI] = "Virtual FIQ NMI",
10861         };
10862 
10863         if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
10864             exc = excnames[idx];
10865         }
10866         if (!exc) {
10867             exc = "unknown";
10868         }
10869         qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s] on CPU %d\n",
10870                       idx, exc, cs->cpu_index);
10871     }
10872 }
10873 
10874 /*
10875  * Function used to synchronize QEMU's AArch64 register set with AArch32
10876  * register set.  This is necessary when switching between AArch32 and AArch64
10877  * execution state.
10878  */
aarch64_sync_32_to_64(CPUARMState * env)10879 void aarch64_sync_32_to_64(CPUARMState *env)
10880 {
10881     int i;
10882     uint32_t mode = env->uncached_cpsr & CPSR_M;
10883 
10884     /* We can blanket copy R[0:7] to X[0:7] */
10885     for (i = 0; i < 8; i++) {
10886         env->xregs[i] = env->regs[i];
10887     }
10888 
10889     /*
10890      * Unless we are in FIQ mode, x8-x12 come from the user registers r8-r12.
10891      * Otherwise, they come from the banked user regs.
10892      */
10893     if (mode == ARM_CPU_MODE_FIQ) {
10894         for (i = 8; i < 13; i++) {
10895             env->xregs[i] = env->usr_regs[i - 8];
10896         }
10897     } else {
10898         for (i = 8; i < 13; i++) {
10899             env->xregs[i] = env->regs[i];
10900         }
10901     }
10902 
10903     /*
10904      * Registers x13-x23 are the various mode SP and FP registers. Registers
10905      * r13 and r14 are only copied if we are in that mode, otherwise we copy
10906      * from the mode banked register.
10907      */
10908     if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
10909         env->xregs[13] = env->regs[13];
10910         env->xregs[14] = env->regs[14];
10911     } else {
10912         env->xregs[13] = env->banked_r13[bank_number(ARM_CPU_MODE_USR)];
10913         /* HYP is an exception in that it is copied from r14 */
10914         if (mode == ARM_CPU_MODE_HYP) {
10915             env->xregs[14] = env->regs[14];
10916         } else {
10917             env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)];
10918         }
10919     }
10920 
10921     if (mode == ARM_CPU_MODE_HYP) {
10922         env->xregs[15] = env->regs[13];
10923     } else {
10924         env->xregs[15] = env->banked_r13[bank_number(ARM_CPU_MODE_HYP)];
10925     }
10926 
10927     if (mode == ARM_CPU_MODE_IRQ) {
10928         env->xregs[16] = env->regs[14];
10929         env->xregs[17] = env->regs[13];
10930     } else {
10931         env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)];
10932         env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
10933     }
10934 
10935     if (mode == ARM_CPU_MODE_SVC) {
10936         env->xregs[18] = env->regs[14];
10937         env->xregs[19] = env->regs[13];
10938     } else {
10939         env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)];
10940         env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
10941     }
10942 
10943     if (mode == ARM_CPU_MODE_ABT) {
10944         env->xregs[20] = env->regs[14];
10945         env->xregs[21] = env->regs[13];
10946     } else {
10947         env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)];
10948         env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
10949     }
10950 
10951     if (mode == ARM_CPU_MODE_UND) {
10952         env->xregs[22] = env->regs[14];
10953         env->xregs[23] = env->regs[13];
10954     } else {
10955         env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)];
10956         env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
10957     }
10958 
10959     /*
10960      * Registers x24-x30 are mapped to r8-r14 in FIQ mode.  If we are in FIQ
10961      * mode, then we can copy from r8-r14.  Otherwise, we copy from the
10962      * FIQ bank for r8-r14.
10963      */
10964     if (mode == ARM_CPU_MODE_FIQ) {
10965         for (i = 24; i < 31; i++) {
10966             env->xregs[i] = env->regs[i - 16];   /* X[24:30] <- R[8:14] */
10967         }
10968     } else {
10969         for (i = 24; i < 29; i++) {
10970             env->xregs[i] = env->fiq_regs[i - 24];
10971         }
10972         env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
10973         env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)];
10974     }
10975 
10976     env->pc = env->regs[15];
10977 }
10978 
10979 /*
10980  * Function used to synchronize QEMU's AArch32 register set with AArch64
10981  * register set.  This is necessary when switching between AArch32 and AArch64
10982  * execution state.
10983  */
aarch64_sync_64_to_32(CPUARMState * env)10984 void aarch64_sync_64_to_32(CPUARMState *env)
10985 {
10986     int i;
10987     uint32_t mode = env->uncached_cpsr & CPSR_M;
10988 
10989     /* We can blanket copy X[0:7] to R[0:7] */
10990     for (i = 0; i < 8; i++) {
10991         env->regs[i] = env->xregs[i];
10992     }
10993 
10994     /*
10995      * Unless we are in FIQ mode, r8-r12 come from the user registers x8-x12.
10996      * Otherwise, we copy x8-x12 into the banked user regs.
10997      */
10998     if (mode == ARM_CPU_MODE_FIQ) {
10999         for (i = 8; i < 13; i++) {
11000             env->usr_regs[i - 8] = env->xregs[i];
11001         }
11002     } else {
11003         for (i = 8; i < 13; i++) {
11004             env->regs[i] = env->xregs[i];
11005         }
11006     }
11007 
11008     /*
11009      * Registers r13 & r14 depend on the current mode.
11010      * If we are in a given mode, we copy the corresponding x registers to r13
11011      * and r14.  Otherwise, we copy the x register to the banked r13 and r14
11012      * for the mode.
11013      */
11014     if (mode == ARM_CPU_MODE_USR || mode == ARM_CPU_MODE_SYS) {
11015         env->regs[13] = env->xregs[13];
11016         env->regs[14] = env->xregs[14];
11017     } else {
11018         env->banked_r13[bank_number(ARM_CPU_MODE_USR)] = env->xregs[13];
11019 
11020         /*
11021          * HYP is an exception in that it does not have its own banked r14 but
11022          * shares the USR r14
11023          */
11024         if (mode == ARM_CPU_MODE_HYP) {
11025             env->regs[14] = env->xregs[14];
11026         } else {
11027             env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
11028         }
11029     }
11030 
11031     if (mode == ARM_CPU_MODE_HYP) {
11032         env->regs[13] = env->xregs[15];
11033     } else {
11034         env->banked_r13[bank_number(ARM_CPU_MODE_HYP)] = env->xregs[15];
11035     }
11036 
11037     if (mode == ARM_CPU_MODE_IRQ) {
11038         env->regs[14] = env->xregs[16];
11039         env->regs[13] = env->xregs[17];
11040     } else {
11041         env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
11042         env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
11043     }
11044 
11045     if (mode == ARM_CPU_MODE_SVC) {
11046         env->regs[14] = env->xregs[18];
11047         env->regs[13] = env->xregs[19];
11048     } else {
11049         env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
11050         env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
11051     }
11052 
11053     if (mode == ARM_CPU_MODE_ABT) {
11054         env->regs[14] = env->xregs[20];
11055         env->regs[13] = env->xregs[21];
11056     } else {
11057         env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
11058         env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
11059     }
11060 
11061     if (mode == ARM_CPU_MODE_UND) {
11062         env->regs[14] = env->xregs[22];
11063         env->regs[13] = env->xregs[23];
11064     } else {
11065         env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
11066         env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
11067     }
11068 
11069     /*
11070      * Registers x24-x30 are mapped to r8-r14 in FIQ mode.  If we are in FIQ
11071      * mode, then we can copy to r8-r14.  Otherwise, we copy to the
11072      * FIQ bank for r8-r14.
11073      */
11074     if (mode == ARM_CPU_MODE_FIQ) {
11075         for (i = 24; i < 31; i++) {
11076             env->regs[i - 16] = env->xregs[i];   /* X[24:30] -> R[8:14] */
11077         }
11078     } else {
11079         for (i = 24; i < 29; i++) {
11080             env->fiq_regs[i - 24] = env->xregs[i];
11081         }
11082         env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
11083         env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
11084     }
11085 
11086     env->regs[15] = env->pc;
11087 }
11088 
take_aarch32_exception(CPUARMState * env,int new_mode,uint32_t mask,uint32_t offset,uint32_t newpc)11089 static void take_aarch32_exception(CPUARMState *env, int new_mode,
11090                                    uint32_t mask, uint32_t offset,
11091                                    uint32_t newpc)
11092 {
11093     int new_el;
11094 
11095     /* Change the CPU state so as to actually take the exception. */
11096     switch_mode(env, new_mode);
11097 
11098     /*
11099      * For exceptions taken to AArch32 we must clear the SS bit in both
11100      * PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.
11101      */
11102     env->pstate &= ~PSTATE_SS;
11103     env->spsr = cpsr_read(env);
11104     /* Clear IT bits.  */
11105     env->condexec_bits = 0;
11106     /* Switch to the new mode, and to the correct instruction set.  */
11107     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
11108 
11109     /* This must be after mode switching. */
11110     new_el = arm_current_el(env);
11111 
11112     /* Set new mode endianness */
11113     env->uncached_cpsr &= ~CPSR_E;
11114     if (env->cp15.sctlr_el[new_el] & SCTLR_EE) {
11115         env->uncached_cpsr |= CPSR_E;
11116     }
11117     /* J and IL must always be cleared for exception entry */
11118     env->uncached_cpsr &= ~(CPSR_IL | CPSR_J);
11119     env->daif |= mask;
11120 
11121     if (cpu_isar_feature(aa32_ssbs, env_archcpu(env))) {
11122         if (env->cp15.sctlr_el[new_el] & SCTLR_DSSBS_32) {
11123             env->uncached_cpsr |= CPSR_SSBS;
11124         } else {
11125             env->uncached_cpsr &= ~CPSR_SSBS;
11126         }
11127     }
11128 
11129     if (new_mode == ARM_CPU_MODE_HYP) {
11130         env->thumb = (env->cp15.sctlr_el[2] & SCTLR_TE) != 0;
11131         env->elr_el[2] = env->regs[15];
11132     } else {
11133         /* CPSR.PAN is normally preserved preserved unless...  */
11134         if (cpu_isar_feature(aa32_pan, env_archcpu(env))) {
11135             switch (new_el) {
11136             case 3:
11137                 if (!arm_is_secure_below_el3(env)) {
11138                     /* ... the target is EL3, from non-secure state.  */
11139                     env->uncached_cpsr &= ~CPSR_PAN;
11140                     break;
11141                 }
11142                 /* ... the target is EL3, from secure state ... */
11143                 /* fall through */
11144             case 1:
11145                 /* ... the target is EL1 and SCTLR.SPAN is 0.  */
11146                 if (!(env->cp15.sctlr_el[new_el] & SCTLR_SPAN)) {
11147                     env->uncached_cpsr |= CPSR_PAN;
11148                 }
11149                 break;
11150             }
11151         }
11152         /*
11153          * this is a lie, as there was no c1_sys on V4T/V5, but who cares
11154          * and we should just guard the thumb mode on V4
11155          */
11156         if (arm_feature(env, ARM_FEATURE_V4T)) {
11157             env->thumb =
11158                 (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_TE) != 0;
11159         }
11160         env->regs[14] = env->regs[15] + offset;
11161     }
11162     env->regs[15] = newpc;
11163 
11164     if (tcg_enabled()) {
11165         arm_rebuild_hflags(env);
11166     }
11167 }
11168 
arm_cpu_do_interrupt_aarch32_hyp(CPUState * cs)11169 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
11170 {
11171     /*
11172      * Handle exception entry to Hyp mode; this is sufficiently
11173      * different to entry to other AArch32 modes that we handle it
11174      * separately here.
11175      *
11176      * The vector table entry used is always the 0x14 Hyp mode entry point,
11177      * unless this is an UNDEF/SVC/HVC/abort taken from Hyp to Hyp.
11178      * The offset applied to the preferred return address is always zero
11179      * (see DDI0487C.a section G1.12.3).
11180      * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values.
11181      */
11182     uint32_t addr, mask;
11183     ARMCPU *cpu = ARM_CPU(cs);
11184     CPUARMState *env = &cpu->env;
11185 
11186     switch (cs->exception_index) {
11187     case EXCP_UDEF:
11188         addr = 0x04;
11189         break;
11190     case EXCP_SWI:
11191         addr = 0x08;
11192         break;
11193     case EXCP_BKPT:
11194         /* Fall through to prefetch abort.  */
11195     case EXCP_PREFETCH_ABORT:
11196         env->cp15.ifar_s = env->exception.vaddress;
11197         qemu_log_mask(CPU_LOG_INT, "...with HIFAR 0x%x\n",
11198                       (uint32_t)env->exception.vaddress);
11199         addr = 0x0c;
11200         break;
11201     case EXCP_DATA_ABORT:
11202         env->cp15.dfar_s = env->exception.vaddress;
11203         qemu_log_mask(CPU_LOG_INT, "...with HDFAR 0x%x\n",
11204                       (uint32_t)env->exception.vaddress);
11205         addr = 0x10;
11206         break;
11207     case EXCP_IRQ:
11208         addr = 0x18;
11209         break;
11210     case EXCP_FIQ:
11211         addr = 0x1c;
11212         break;
11213     case EXCP_HVC:
11214         addr = 0x08;
11215         break;
11216     case EXCP_HYP_TRAP:
11217         addr = 0x14;
11218         break;
11219     default:
11220         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
11221     }
11222 
11223     if (cs->exception_index != EXCP_IRQ && cs->exception_index != EXCP_FIQ) {
11224         if (!arm_feature(env, ARM_FEATURE_V8)) {
11225             /*
11226              * QEMU syndrome values are v8-style. v7 has the IL bit
11227              * UNK/SBZP for "field not valid" cases, where v8 uses RES1.
11228              * If this is a v7 CPU, squash the IL bit in those cases.
11229              */
11230             if (cs->exception_index == EXCP_PREFETCH_ABORT ||
11231                 (cs->exception_index == EXCP_DATA_ABORT &&
11232                  !(env->exception.syndrome & ARM_EL_ISV)) ||
11233                 syn_get_ec(env->exception.syndrome) == EC_UNCATEGORIZED) {
11234                 env->exception.syndrome &= ~ARM_EL_IL;
11235             }
11236         }
11237         env->cp15.esr_el[2] = env->exception.syndrome;
11238     }
11239 
11240     if (arm_current_el(env) != 2 && addr < 0x14) {
11241         addr = 0x14;
11242     }
11243 
11244     mask = 0;
11245     if (!(env->cp15.scr_el3 & SCR_EA)) {
11246         mask |= CPSR_A;
11247     }
11248     if (!(env->cp15.scr_el3 & SCR_IRQ)) {
11249         mask |= CPSR_I;
11250     }
11251     if (!(env->cp15.scr_el3 & SCR_FIQ)) {
11252         mask |= CPSR_F;
11253     }
11254 
11255     addr += env->cp15.hvbar;
11256 
11257     take_aarch32_exception(env, ARM_CPU_MODE_HYP, mask, 0, addr);
11258 }
11259 
arm_cpu_do_interrupt_aarch32(CPUState * cs)11260 static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
11261 {
11262     ARMCPU *cpu = ARM_CPU(cs);
11263     CPUARMState *env = &cpu->env;
11264     uint32_t addr;
11265     uint32_t mask;
11266     int new_mode;
11267     uint32_t offset;
11268     uint32_t moe;
11269 
11270     /* If this is a debug exception we must update the DBGDSCR.MOE bits */
11271     switch (syn_get_ec(env->exception.syndrome)) {
11272     case EC_BREAKPOINT:
11273     case EC_BREAKPOINT_SAME_EL:
11274         moe = 1;
11275         break;
11276     case EC_WATCHPOINT:
11277     case EC_WATCHPOINT_SAME_EL:
11278         moe = 10;
11279         break;
11280     case EC_AA32_BKPT:
11281         moe = 3;
11282         break;
11283     case EC_VECTORCATCH:
11284         moe = 5;
11285         break;
11286     default:
11287         moe = 0;
11288         break;
11289     }
11290 
11291     if (moe) {
11292         env->cp15.mdscr_el1 = deposit64(env->cp15.mdscr_el1, 2, 4, moe);
11293     }
11294 
11295     if (env->exception.target_el == 2) {
11296         /* Debug exceptions are reported differently on AArch32 */
11297         switch (syn_get_ec(env->exception.syndrome)) {
11298         case EC_BREAKPOINT:
11299         case EC_BREAKPOINT_SAME_EL:
11300         case EC_AA32_BKPT:
11301         case EC_VECTORCATCH:
11302             env->exception.syndrome = syn_insn_abort(arm_current_el(env) == 2,
11303                                                      0, 0, 0x22);
11304             break;
11305         case EC_WATCHPOINT:
11306             env->exception.syndrome = syn_set_ec(env->exception.syndrome,
11307                                                  EC_DATAABORT);
11308             break;
11309         case EC_WATCHPOINT_SAME_EL:
11310             env->exception.syndrome = syn_set_ec(env->exception.syndrome,
11311                                                  EC_DATAABORT_SAME_EL);
11312             break;
11313         }
11314         arm_cpu_do_interrupt_aarch32_hyp(cs);
11315         return;
11316     }
11317 
11318     switch (cs->exception_index) {
11319     case EXCP_UDEF:
11320         new_mode = ARM_CPU_MODE_UND;
11321         addr = 0x04;
11322         mask = CPSR_I;
11323         if (env->thumb) {
11324             offset = 2;
11325         } else {
11326             offset = 4;
11327         }
11328         break;
11329     case EXCP_SWI:
11330         new_mode = ARM_CPU_MODE_SVC;
11331         addr = 0x08;
11332         mask = CPSR_I;
11333         /* The PC already points to the next instruction.  */
11334         offset = 0;
11335         break;
11336     case EXCP_BKPT:
11337         /* Fall through to prefetch abort.  */
11338     case EXCP_PREFETCH_ABORT:
11339         A32_BANKED_CURRENT_REG_SET(env, ifsr, env->exception.fsr);
11340         A32_BANKED_CURRENT_REG_SET(env, ifar, env->exception.vaddress);
11341         qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x IFAR 0x%x\n",
11342                       env->exception.fsr, (uint32_t)env->exception.vaddress);
11343         new_mode = ARM_CPU_MODE_ABT;
11344         addr = 0x0c;
11345         mask = CPSR_A | CPSR_I;
11346         offset = 4;
11347         break;
11348     case EXCP_DATA_ABORT:
11349         A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
11350         A32_BANKED_CURRENT_REG_SET(env, dfar, env->exception.vaddress);
11351         qemu_log_mask(CPU_LOG_INT, "...with DFSR 0x%x DFAR 0x%x\n",
11352                       env->exception.fsr,
11353                       (uint32_t)env->exception.vaddress);
11354         new_mode = ARM_CPU_MODE_ABT;
11355         addr = 0x10;
11356         mask = CPSR_A | CPSR_I;
11357         offset = 8;
11358         break;
11359     case EXCP_IRQ:
11360         new_mode = ARM_CPU_MODE_IRQ;
11361         addr = 0x18;
11362         /* Disable IRQ and imprecise data aborts.  */
11363         mask = CPSR_A | CPSR_I;
11364         offset = 4;
11365         if (env->cp15.scr_el3 & SCR_IRQ) {
11366             /* IRQ routed to monitor mode */
11367             new_mode = ARM_CPU_MODE_MON;
11368             mask |= CPSR_F;
11369         }
11370         break;
11371     case EXCP_FIQ:
11372         new_mode = ARM_CPU_MODE_FIQ;
11373         addr = 0x1c;
11374         /* Disable FIQ, IRQ and imprecise data aborts.  */
11375         mask = CPSR_A | CPSR_I | CPSR_F;
11376         if (env->cp15.scr_el3 & SCR_FIQ) {
11377             /* FIQ routed to monitor mode */
11378             new_mode = ARM_CPU_MODE_MON;
11379         }
11380         offset = 4;
11381         break;
11382     case EXCP_VIRQ:
11383         new_mode = ARM_CPU_MODE_IRQ;
11384         addr = 0x18;
11385         /* Disable IRQ and imprecise data aborts.  */
11386         mask = CPSR_A | CPSR_I;
11387         offset = 4;
11388         break;
11389     case EXCP_VFIQ:
11390         new_mode = ARM_CPU_MODE_FIQ;
11391         addr = 0x1c;
11392         /* Disable FIQ, IRQ and imprecise data aborts.  */
11393         mask = CPSR_A | CPSR_I | CPSR_F;
11394         offset = 4;
11395         break;
11396     case EXCP_VSERR:
11397         {
11398             /*
11399              * Note that this is reported as a data abort, but the DFAR
11400              * has an UNKNOWN value.  Construct the SError syndrome from
11401              * AET and ExT fields.
11402              */
11403             ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal, };
11404 
11405             if (extended_addresses_enabled(env)) {
11406                 env->exception.fsr = arm_fi_to_lfsc(&fi);
11407             } else {
11408                 env->exception.fsr = arm_fi_to_sfsc(&fi);
11409             }
11410             env->exception.fsr |= env->cp15.vsesr_el2 & 0xd000;
11411             A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
11412             qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x\n",
11413                           env->exception.fsr);
11414 
11415             new_mode = ARM_CPU_MODE_ABT;
11416             addr = 0x10;
11417             mask = CPSR_A | CPSR_I;
11418             offset = 8;
11419         }
11420         break;
11421     case EXCP_SMC:
11422         new_mode = ARM_CPU_MODE_MON;
11423         addr = 0x08;
11424         mask = CPSR_A | CPSR_I | CPSR_F;
11425         offset = 0;
11426         break;
11427     default:
11428         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
11429         return; /* Never happens.  Keep compiler happy.  */
11430     }
11431 
11432     if (new_mode == ARM_CPU_MODE_MON) {
11433         addr += env->cp15.mvbar;
11434     } else if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
11435         /* High vectors. When enabled, base address cannot be remapped. */
11436         addr += 0xffff0000;
11437     } else {
11438         /*
11439          * ARM v7 architectures provide a vector base address register to remap
11440          * the interrupt vector table.
11441          * This register is only followed in non-monitor mode, and is banked.
11442          * Note: only bits 31:5 are valid.
11443          */
11444         addr += A32_BANKED_CURRENT_REG_GET(env, vbar);
11445     }
11446 
11447     if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
11448         env->cp15.scr_el3 &= ~SCR_NS;
11449     }
11450 
11451     take_aarch32_exception(env, new_mode, mask, offset, addr);
11452 }
11453 
aarch64_regnum(CPUARMState * env,int aarch32_reg)11454 static int aarch64_regnum(CPUARMState *env, int aarch32_reg)
11455 {
11456     /*
11457      * Return the register number of the AArch64 view of the AArch32
11458      * register @aarch32_reg. The CPUARMState CPSR is assumed to still
11459      * be that of the AArch32 mode the exception came from.
11460      */
11461     int mode = env->uncached_cpsr & CPSR_M;
11462 
11463     switch (aarch32_reg) {
11464     case 0 ... 7:
11465         return aarch32_reg;
11466     case 8 ... 12:
11467         return mode == ARM_CPU_MODE_FIQ ? aarch32_reg + 16 : aarch32_reg;
11468     case 13:
11469         switch (mode) {
11470         case ARM_CPU_MODE_USR:
11471         case ARM_CPU_MODE_SYS:
11472             return 13;
11473         case ARM_CPU_MODE_HYP:
11474             return 15;
11475         case ARM_CPU_MODE_IRQ:
11476             return 17;
11477         case ARM_CPU_MODE_SVC:
11478             return 19;
11479         case ARM_CPU_MODE_ABT:
11480             return 21;
11481         case ARM_CPU_MODE_UND:
11482             return 23;
11483         case ARM_CPU_MODE_FIQ:
11484             return 29;
11485         default:
11486             g_assert_not_reached();
11487         }
11488     case 14:
11489         switch (mode) {
11490         case ARM_CPU_MODE_USR:
11491         case ARM_CPU_MODE_SYS:
11492         case ARM_CPU_MODE_HYP:
11493             return 14;
11494         case ARM_CPU_MODE_IRQ:
11495             return 16;
11496         case ARM_CPU_MODE_SVC:
11497             return 18;
11498         case ARM_CPU_MODE_ABT:
11499             return 20;
11500         case ARM_CPU_MODE_UND:
11501             return 22;
11502         case ARM_CPU_MODE_FIQ:
11503             return 30;
11504         default:
11505             g_assert_not_reached();
11506         }
11507     case 15:
11508         return 31;
11509     default:
11510         g_assert_not_reached();
11511     }
11512 }
11513 
cpsr_read_for_spsr_elx(CPUARMState * env)11514 static uint32_t cpsr_read_for_spsr_elx(CPUARMState *env)
11515 {
11516     uint32_t ret = cpsr_read(env);
11517 
11518     /* Move DIT to the correct location for SPSR_ELx */
11519     if (ret & CPSR_DIT) {
11520         ret &= ~CPSR_DIT;
11521         ret |= PSTATE_DIT;
11522     }
11523     /* Merge PSTATE.SS into SPSR_ELx */
11524     ret |= env->pstate & PSTATE_SS;
11525 
11526     return ret;
11527 }
11528 
syndrome_is_sync_extabt(uint32_t syndrome)11529 static bool syndrome_is_sync_extabt(uint32_t syndrome)
11530 {
11531     /* Return true if this syndrome value is a synchronous external abort */
11532     switch (syn_get_ec(syndrome)) {
11533     case EC_INSNABORT:
11534     case EC_INSNABORT_SAME_EL:
11535     case EC_DATAABORT:
11536     case EC_DATAABORT_SAME_EL:
11537         /* Look at fault status code for all the synchronous ext abort cases */
11538         switch (syndrome & 0x3f) {
11539         case 0x10:
11540         case 0x13:
11541         case 0x14:
11542         case 0x15:
11543         case 0x16:
11544         case 0x17:
11545             return true;
11546         default:
11547             return false;
11548         }
11549     default:
11550         return false;
11551     }
11552 }
11553 
11554 /* Handle exception entry to a target EL which is using AArch64 */
arm_cpu_do_interrupt_aarch64(CPUState * cs)11555 static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
11556 {
11557     ARMCPU *cpu = ARM_CPU(cs);
11558     CPUARMState *env = &cpu->env;
11559     unsigned int new_el = env->exception.target_el;
11560     target_ulong addr = env->cp15.vbar_el[new_el];
11561     unsigned int new_mode = aarch64_pstate_mode(new_el, true);
11562     unsigned int old_mode;
11563     unsigned int cur_el = arm_current_el(env);
11564     int rt;
11565 
11566     if (tcg_enabled()) {
11567         /*
11568          * Note that new_el can never be 0.  If cur_el is 0, then
11569          * el0_a64 is is_a64(), else el0_a64 is ignored.
11570          */
11571         aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
11572     }
11573 
11574     if (cur_el < new_el) {
11575         /*
11576          * Entry vector offset depends on whether the implemented EL
11577          * immediately lower than the target level is using AArch32 or AArch64
11578          */
11579         bool is_aa64;
11580         uint64_t hcr;
11581 
11582         switch (new_el) {
11583         case 3:
11584             is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
11585             break;
11586         case 2:
11587             hcr = arm_hcr_el2_eff(env);
11588             if ((hcr & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
11589                 is_aa64 = (hcr & HCR_RW) != 0;
11590                 break;
11591             }
11592             /* fall through */
11593         case 1:
11594             is_aa64 = is_a64(env);
11595             break;
11596         default:
11597             g_assert_not_reached();
11598         }
11599 
11600         if (is_aa64) {
11601             addr += 0x400;
11602         } else {
11603             addr += 0x600;
11604         }
11605     } else if (pstate_read(env) & PSTATE_SP) {
11606         addr += 0x200;
11607     }
11608 
11609     switch (cs->exception_index) {
11610     case EXCP_GPC:
11611         qemu_log_mask(CPU_LOG_INT, "...with MFAR 0x%" PRIx64 "\n",
11612                       env->cp15.mfar_el3);
11613         /* fall through */
11614     case EXCP_PREFETCH_ABORT:
11615     case EXCP_DATA_ABORT:
11616         /*
11617          * FEAT_DoubleFault allows synchronous external aborts taken to EL3
11618          * to be taken to the SError vector entrypoint.
11619          */
11620         if (new_el == 3 && (env->cp15.scr_el3 & SCR_EASE) &&
11621             syndrome_is_sync_extabt(env->exception.syndrome)) {
11622             addr += 0x180;
11623         }
11624         env->cp15.far_el[new_el] = env->exception.vaddress;
11625         qemu_log_mask(CPU_LOG_INT, "...with FAR 0x%" PRIx64 "\n",
11626                       env->cp15.far_el[new_el]);
11627         /* fall through */
11628     case EXCP_BKPT:
11629     case EXCP_UDEF:
11630     case EXCP_SWI:
11631     case EXCP_HVC:
11632     case EXCP_HYP_TRAP:
11633     case EXCP_SMC:
11634         switch (syn_get_ec(env->exception.syndrome)) {
11635         case EC_ADVSIMDFPACCESSTRAP:
11636             /*
11637              * QEMU internal FP/SIMD syndromes from AArch32 include the
11638              * TA and coproc fields which are only exposed if the exception
11639              * is taken to AArch32 Hyp mode. Mask them out to get a valid
11640              * AArch64 format syndrome.
11641              */
11642             env->exception.syndrome &= ~MAKE_64BIT_MASK(0, 20);
11643             break;
11644         case EC_CP14RTTRAP:
11645         case EC_CP15RTTRAP:
11646         case EC_CP14DTTRAP:
11647             /*
11648              * For a trap on AArch32 MRC/MCR/LDC/STC the Rt field is currently
11649              * the raw register field from the insn; when taking this to
11650              * AArch64 we must convert it to the AArch64 view of the register
11651              * number. Notice that we read a 4-bit AArch32 register number and
11652              * write back a 5-bit AArch64 one.
11653              */
11654             rt = extract32(env->exception.syndrome, 5, 4);
11655             rt = aarch64_regnum(env, rt);
11656             env->exception.syndrome = deposit32(env->exception.syndrome,
11657                                                 5, 5, rt);
11658             break;
11659         case EC_CP15RRTTRAP:
11660         case EC_CP14RRTTRAP:
11661             /* Similarly for MRRC/MCRR traps for Rt and Rt2 fields */
11662             rt = extract32(env->exception.syndrome, 5, 4);
11663             rt = aarch64_regnum(env, rt);
11664             env->exception.syndrome = deposit32(env->exception.syndrome,
11665                                                 5, 5, rt);
11666             rt = extract32(env->exception.syndrome, 10, 4);
11667             rt = aarch64_regnum(env, rt);
11668             env->exception.syndrome = deposit32(env->exception.syndrome,
11669                                                 10, 5, rt);
11670             break;
11671         }
11672         env->cp15.esr_el[new_el] = env->exception.syndrome;
11673         break;
11674     case EXCP_IRQ:
11675     case EXCP_VIRQ:
11676     case EXCP_NMI:
11677     case EXCP_VINMI:
11678         addr += 0x80;
11679         break;
11680     case EXCP_FIQ:
11681     case EXCP_VFIQ:
11682     case EXCP_VFNMI:
11683         addr += 0x100;
11684         break;
11685     case EXCP_VSERR:
11686         addr += 0x180;
11687         /* Construct the SError syndrome from IDS and ISS fields. */
11688         env->exception.syndrome = syn_serror(env->cp15.vsesr_el2 & 0x1ffffff);
11689         env->cp15.esr_el[new_el] = env->exception.syndrome;
11690         break;
11691     default:
11692         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
11693     }
11694 
11695     if (is_a64(env)) {
11696         old_mode = pstate_read(env);
11697         aarch64_save_sp(env, arm_current_el(env));
11698         env->elr_el[new_el] = env->pc;
11699 
11700         if (cur_el == 1 && new_el == 1) {
11701             uint64_t hcr = arm_hcr_el2_eff(env);
11702             if ((hcr & (HCR_NV | HCR_NV1 | HCR_NV2)) == HCR_NV ||
11703                 (hcr & (HCR_NV | HCR_NV2)) == (HCR_NV | HCR_NV2)) {
11704                 /*
11705                  * FEAT_NV, FEAT_NV2 may need to report EL2 in the SPSR
11706                  * by setting M[3:2] to 0b10.
11707                  * If NV2 is disabled, change SPSR when NV,NV1 == 1,0 (I_ZJRNN)
11708                  * If NV2 is enabled, change SPSR when NV is 1 (I_DBTLM)
11709                  */
11710                 old_mode = deposit32(old_mode, 2, 2, 2);
11711             }
11712         }
11713     } else {
11714         old_mode = cpsr_read_for_spsr_elx(env);
11715         env->elr_el[new_el] = env->regs[15];
11716 
11717         aarch64_sync_32_to_64(env);
11718 
11719         env->condexec_bits = 0;
11720     }
11721     env->banked_spsr[aarch64_banked_spsr_index(new_el)] = old_mode;
11722 
11723     qemu_log_mask(CPU_LOG_INT, "...with SPSR 0x%x\n", old_mode);
11724     qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n",
11725                   env->elr_el[new_el]);
11726 
11727     if (cpu_isar_feature(aa64_pan, cpu)) {
11728         /* The value of PSTATE.PAN is normally preserved, except when ... */
11729         new_mode |= old_mode & PSTATE_PAN;
11730         switch (new_el) {
11731         case 2:
11732             /* ... the target is EL2 with HCR_EL2.{E2H,TGE} == '11' ...  */
11733             if ((arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE))
11734                 != (HCR_E2H | HCR_TGE)) {
11735                 break;
11736             }
11737             /* fall through */
11738         case 1:
11739             /* ... the target is EL1 ... */
11740             /* ... and SCTLR_ELx.SPAN == 0, then set to 1.  */
11741             if ((env->cp15.sctlr_el[new_el] & SCTLR_SPAN) == 0) {
11742                 new_mode |= PSTATE_PAN;
11743             }
11744             break;
11745         }
11746     }
11747     if (cpu_isar_feature(aa64_mte, cpu)) {
11748         new_mode |= PSTATE_TCO;
11749     }
11750 
11751     if (cpu_isar_feature(aa64_ssbs, cpu)) {
11752         if (env->cp15.sctlr_el[new_el] & SCTLR_DSSBS_64) {
11753             new_mode |= PSTATE_SSBS;
11754         } else {
11755             new_mode &= ~PSTATE_SSBS;
11756         }
11757     }
11758 
11759     if (cpu_isar_feature(aa64_nmi, cpu)) {
11760         if (!(env->cp15.sctlr_el[new_el] & SCTLR_SPINTMASK)) {
11761             new_mode |= PSTATE_ALLINT;
11762         } else {
11763             new_mode &= ~PSTATE_ALLINT;
11764         }
11765     }
11766 
11767     pstate_write(env, PSTATE_DAIF | new_mode);
11768     env->aarch64 = true;
11769     aarch64_restore_sp(env, new_el);
11770 
11771     if (tcg_enabled()) {
11772         helper_rebuild_hflags_a64(env, new_el);
11773     }
11774 
11775     env->pc = addr;
11776 
11777     qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n",
11778                   new_el, env->pc, pstate_read(env));
11779 }
11780 
11781 /*
11782  * Do semihosting call and set the appropriate return value. All the
11783  * permission and validity checks have been done at translate time.
11784  *
11785  * We only see semihosting exceptions in TCG only as they are not
11786  * trapped to the hypervisor in KVM.
11787  */
11788 #ifdef CONFIG_TCG
tcg_handle_semihosting(CPUState * cs)11789 static void tcg_handle_semihosting(CPUState *cs)
11790 {
11791     ARMCPU *cpu = ARM_CPU(cs);
11792     CPUARMState *env = &cpu->env;
11793 
11794     if (is_a64(env)) {
11795         qemu_log_mask(CPU_LOG_INT,
11796                       "...handling as semihosting call 0x%" PRIx64 "\n",
11797                       env->xregs[0]);
11798         do_common_semihosting(cs);
11799         env->pc += 4;
11800     } else {
11801         qemu_log_mask(CPU_LOG_INT,
11802                       "...handling as semihosting call 0x%x\n",
11803                       env->regs[0]);
11804         do_common_semihosting(cs);
11805         env->regs[15] += env->thumb ? 2 : 4;
11806     }
11807 }
11808 #endif
11809 
11810 /*
11811  * Handle a CPU exception for A and R profile CPUs.
11812  * Do any appropriate logging, handle PSCI calls, and then hand off
11813  * to the AArch64-entry or AArch32-entry function depending on the
11814  * target exception level's register width.
11815  *
11816  * Note: this is used for both TCG (as the do_interrupt tcg op),
11817  *       and KVM to re-inject guest debug exceptions, and to
11818  *       inject a Synchronous-External-Abort.
11819  */
arm_cpu_do_interrupt(CPUState * cs)11820 void arm_cpu_do_interrupt(CPUState *cs)
11821 {
11822     ARMCPU *cpu = ARM_CPU(cs);
11823     CPUARMState *env = &cpu->env;
11824     unsigned int new_el = env->exception.target_el;
11825 
11826     assert(!arm_feature(env, ARM_FEATURE_M));
11827 
11828     arm_log_exception(cs);
11829     qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env),
11830                   new_el);
11831     if (qemu_loglevel_mask(CPU_LOG_INT)
11832         && !excp_is_internal(cs->exception_index)) {
11833         qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n",
11834                       syn_get_ec(env->exception.syndrome),
11835                       env->exception.syndrome);
11836     }
11837 
11838     if (tcg_enabled() && arm_is_psci_call(cpu, cs->exception_index)) {
11839         arm_handle_psci_call(cpu);
11840         qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
11841         return;
11842     }
11843 
11844     /*
11845      * Semihosting semantics depend on the register width of the code
11846      * that caused the exception, not the target exception level, so
11847      * must be handled here.
11848      */
11849 #ifdef CONFIG_TCG
11850     if (cs->exception_index == EXCP_SEMIHOST) {
11851         tcg_handle_semihosting(cs);
11852         return;
11853     }
11854 #endif
11855 
11856     /*
11857      * Hooks may change global state so BQL should be held, also the
11858      * BQL needs to be held for any modification of
11859      * cs->interrupt_request.
11860      */
11861     g_assert(bql_locked());
11862 
11863     arm_call_pre_el_change_hook(cpu);
11864 
11865     assert(!excp_is_internal(cs->exception_index));
11866     if (arm_el_is_aa64(env, new_el)) {
11867         arm_cpu_do_interrupt_aarch64(cs);
11868     } else {
11869         arm_cpu_do_interrupt_aarch32(cs);
11870     }
11871 
11872     arm_call_el_change_hook(cpu);
11873 
11874     if (!kvm_enabled()) {
11875         cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
11876     }
11877 }
11878 #endif /* !CONFIG_USER_ONLY */
11879 
arm_sctlr(CPUARMState * env,int el)11880 uint64_t arm_sctlr(CPUARMState *env, int el)
11881 {
11882     /* Only EL0 needs to be adjusted for EL1&0 or EL2&0 or EL3&0 */
11883     if (el == 0) {
11884         ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0);
11885         switch (mmu_idx) {
11886         case ARMMMUIdx_E20_0:
11887             el = 2;
11888             break;
11889         case ARMMMUIdx_E30_0:
11890             el = 3;
11891             break;
11892         default:
11893             el = 1;
11894             break;
11895         }
11896     }
11897     return env->cp15.sctlr_el[el];
11898 }
11899 
aa64_va_parameter_tbi(uint64_t tcr,ARMMMUIdx mmu_idx)11900 int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
11901 {
11902     if (regime_has_2_ranges(mmu_idx)) {
11903         return extract64(tcr, 37, 2);
11904     } else if (regime_is_stage2(mmu_idx)) {
11905         return 0; /* VTCR_EL2 */
11906     } else {
11907         /* Replicate the single TBI bit so we always have 2 bits.  */
11908         return extract32(tcr, 20, 1) * 3;
11909     }
11910 }
11911 
aa64_va_parameter_tbid(uint64_t tcr,ARMMMUIdx mmu_idx)11912 int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
11913 {
11914     if (regime_has_2_ranges(mmu_idx)) {
11915         return extract64(tcr, 51, 2);
11916     } else if (regime_is_stage2(mmu_idx)) {
11917         return 0; /* VTCR_EL2 */
11918     } else {
11919         /* Replicate the single TBID bit so we always have 2 bits.  */
11920         return extract32(tcr, 29, 1) * 3;
11921     }
11922 }
11923 
aa64_va_parameter_tcma(uint64_t tcr,ARMMMUIdx mmu_idx)11924 int aa64_va_parameter_tcma(uint64_t tcr, ARMMMUIdx mmu_idx)
11925 {
11926     if (regime_has_2_ranges(mmu_idx)) {
11927         return extract64(tcr, 57, 2);
11928     } else {
11929         /* Replicate the single TCMA bit so we always have 2 bits.  */
11930         return extract32(tcr, 30, 1) * 3;
11931     }
11932 }
11933 
tg0_to_gran_size(int tg)11934 static ARMGranuleSize tg0_to_gran_size(int tg)
11935 {
11936     switch (tg) {
11937     case 0:
11938         return Gran4K;
11939     case 1:
11940         return Gran64K;
11941     case 2:
11942         return Gran16K;
11943     default:
11944         return GranInvalid;
11945     }
11946 }
11947 
tg1_to_gran_size(int tg)11948 static ARMGranuleSize tg1_to_gran_size(int tg)
11949 {
11950     switch (tg) {
11951     case 1:
11952         return Gran16K;
11953     case 2:
11954         return Gran4K;
11955     case 3:
11956         return Gran64K;
11957     default:
11958         return GranInvalid;
11959     }
11960 }
11961 
have4k(ARMCPU * cpu,bool stage2)11962 static inline bool have4k(ARMCPU *cpu, bool stage2)
11963 {
11964     return stage2 ? cpu_isar_feature(aa64_tgran4_2, cpu)
11965         : cpu_isar_feature(aa64_tgran4, cpu);
11966 }
11967 
have16k(ARMCPU * cpu,bool stage2)11968 static inline bool have16k(ARMCPU *cpu, bool stage2)
11969 {
11970     return stage2 ? cpu_isar_feature(aa64_tgran16_2, cpu)
11971         : cpu_isar_feature(aa64_tgran16, cpu);
11972 }
11973 
have64k(ARMCPU * cpu,bool stage2)11974 static inline bool have64k(ARMCPU *cpu, bool stage2)
11975 {
11976     return stage2 ? cpu_isar_feature(aa64_tgran64_2, cpu)
11977         : cpu_isar_feature(aa64_tgran64, cpu);
11978 }
11979 
sanitize_gran_size(ARMCPU * cpu,ARMGranuleSize gran,bool stage2)11980 static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran,
11981                                          bool stage2)
11982 {
11983     switch (gran) {
11984     case Gran4K:
11985         if (have4k(cpu, stage2)) {
11986             return gran;
11987         }
11988         break;
11989     case Gran16K:
11990         if (have16k(cpu, stage2)) {
11991             return gran;
11992         }
11993         break;
11994     case Gran64K:
11995         if (have64k(cpu, stage2)) {
11996             return gran;
11997         }
11998         break;
11999     case GranInvalid:
12000         break;
12001     }
12002     /*
12003      * If the guest selects a granule size that isn't implemented,
12004      * the architecture requires that we behave as if it selected one
12005      * that is (with an IMPDEF choice of which one to pick). We choose
12006      * to implement the smallest supported granule size.
12007      */
12008     if (have4k(cpu, stage2)) {
12009         return Gran4K;
12010     }
12011     if (have16k(cpu, stage2)) {
12012         return Gran16K;
12013     }
12014     assert(have64k(cpu, stage2));
12015     return Gran64K;
12016 }
12017 
aa64_va_parameters(CPUARMState * env,uint64_t va,ARMMMUIdx mmu_idx,bool data,bool el1_is_aa32)12018 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
12019                                    ARMMMUIdx mmu_idx, bool data,
12020                                    bool el1_is_aa32)
12021 {
12022     uint64_t tcr = regime_tcr(env, mmu_idx);
12023     bool epd, hpd, tsz_oob, ds, ha, hd;
12024     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
12025     ARMGranuleSize gran;
12026     ARMCPU *cpu = env_archcpu(env);
12027     bool stage2 = regime_is_stage2(mmu_idx);
12028 
12029     if (!regime_has_2_ranges(mmu_idx)) {
12030         select = 0;
12031         tsz = extract32(tcr, 0, 6);
12032         gran = tg0_to_gran_size(extract32(tcr, 14, 2));
12033         if (stage2) {
12034             /* VTCR_EL2 */
12035             hpd = false;
12036         } else {
12037             hpd = extract32(tcr, 24, 1);
12038         }
12039         epd = false;
12040         sh = extract32(tcr, 12, 2);
12041         ps = extract32(tcr, 16, 3);
12042         ha = extract32(tcr, 21, 1) && cpu_isar_feature(aa64_hafs, cpu);
12043         hd = extract32(tcr, 22, 1) && cpu_isar_feature(aa64_hdbs, cpu);
12044         ds = extract64(tcr, 32, 1);
12045     } else {
12046         bool e0pd;
12047 
12048         /*
12049          * Bit 55 is always between the two regions, and is canonical for
12050          * determining if address tagging is enabled.
12051          */
12052         select = extract64(va, 55, 1);
12053         if (!select) {
12054             tsz = extract32(tcr, 0, 6);
12055             gran = tg0_to_gran_size(extract32(tcr, 14, 2));
12056             epd = extract32(tcr, 7, 1);
12057             sh = extract32(tcr, 12, 2);
12058             hpd = extract64(tcr, 41, 1);
12059             e0pd = extract64(tcr, 55, 1);
12060         } else {
12061             tsz = extract32(tcr, 16, 6);
12062             gran = tg1_to_gran_size(extract32(tcr, 30, 2));
12063             epd = extract32(tcr, 23, 1);
12064             sh = extract32(tcr, 28, 2);
12065             hpd = extract64(tcr, 42, 1);
12066             e0pd = extract64(tcr, 56, 1);
12067         }
12068         ps = extract64(tcr, 32, 3);
12069         ha = extract64(tcr, 39, 1) && cpu_isar_feature(aa64_hafs, cpu);
12070         hd = extract64(tcr, 40, 1) && cpu_isar_feature(aa64_hdbs, cpu);
12071         ds = extract64(tcr, 59, 1);
12072 
12073         if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) &&
12074             regime_is_user(env, mmu_idx)) {
12075             epd = true;
12076         }
12077     }
12078 
12079     gran = sanitize_gran_size(cpu, gran, stage2);
12080 
12081     if (cpu_isar_feature(aa64_st, cpu)) {
12082         max_tsz = 48 - (gran == Gran64K);
12083     } else {
12084         max_tsz = 39;
12085     }
12086 
12087     /*
12088      * DS is RES0 unless FEAT_LPA2 is supported for the given page size;
12089      * adjust the effective value of DS, as documented.
12090      */
12091     min_tsz = 16;
12092     if (gran == Gran64K) {
12093         if (cpu_isar_feature(aa64_lva, cpu)) {
12094             min_tsz = 12;
12095         }
12096         ds = false;
12097     } else if (ds) {
12098         if (regime_is_stage2(mmu_idx)) {
12099             if (gran == Gran16K) {
12100                 ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
12101             } else {
12102                 ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
12103             }
12104         } else {
12105             if (gran == Gran16K) {
12106                 ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
12107             } else {
12108                 ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
12109             }
12110         }
12111         if (ds) {
12112             min_tsz = 12;
12113         }
12114     }
12115 
12116     if (stage2 && el1_is_aa32) {
12117         /*
12118          * For AArch32 EL1 the min txsz (and thus max IPA size) requirements
12119          * are loosened: a configured IPA of 40 bits is permitted even if
12120          * the implemented PA is less than that (and so a 40 bit IPA would
12121          * fault for an AArch64 EL1). See R_DTLMN.
12122          */
12123         min_tsz = MIN(min_tsz, 24);
12124     }
12125 
12126     if (tsz > max_tsz) {
12127         tsz = max_tsz;
12128         tsz_oob = true;
12129     } else if (tsz < min_tsz) {
12130         tsz = min_tsz;
12131         tsz_oob = true;
12132     } else {
12133         tsz_oob = false;
12134     }
12135 
12136     /* Present TBI as a composite with TBID.  */
12137     tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
12138     if (!data) {
12139         tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
12140     }
12141     tbi = (tbi >> select) & 1;
12142 
12143     return (ARMVAParameters) {
12144         .tsz = tsz,
12145         .ps = ps,
12146         .sh = sh,
12147         .select = select,
12148         .tbi = tbi,
12149         .epd = epd,
12150         .hpd = hpd,
12151         .tsz_oob = tsz_oob,
12152         .ds = ds,
12153         .ha = ha,
12154         .hd = ha && hd,
12155         .gran = gran,
12156     };
12157 }
12158 
12159 /*
12160  * Note that signed overflow is undefined in C.  The following routines are
12161  * careful to use unsigned types where modulo arithmetic is required.
12162  * Failure to do so _will_ break on newer gcc.
12163  */
12164 
12165 /* Signed saturating arithmetic.  */
12166 
12167 /* Perform 16-bit signed saturating addition.  */
add16_sat(uint16_t a,uint16_t b)12168 static inline uint16_t add16_sat(uint16_t a, uint16_t b)
12169 {
12170     uint16_t res;
12171 
12172     res = a + b;
12173     if (((res ^ a) & 0x8000) && !((a ^ b) & 0x8000)) {
12174         if (a & 0x8000) {
12175             res = 0x8000;
12176         } else {
12177             res = 0x7fff;
12178         }
12179     }
12180     return res;
12181 }
12182 
12183 /* Perform 8-bit signed saturating addition.  */
add8_sat(uint8_t a,uint8_t b)12184 static inline uint8_t add8_sat(uint8_t a, uint8_t b)
12185 {
12186     uint8_t res;
12187 
12188     res = a + b;
12189     if (((res ^ a) & 0x80) && !((a ^ b) & 0x80)) {
12190         if (a & 0x80) {
12191             res = 0x80;
12192         } else {
12193             res = 0x7f;
12194         }
12195     }
12196     return res;
12197 }
12198 
12199 /* Perform 16-bit signed saturating subtraction.  */
sub16_sat(uint16_t a,uint16_t b)12200 static inline uint16_t sub16_sat(uint16_t a, uint16_t b)
12201 {
12202     uint16_t res;
12203 
12204     res = a - b;
12205     if (((res ^ a) & 0x8000) && ((a ^ b) & 0x8000)) {
12206         if (a & 0x8000) {
12207             res = 0x8000;
12208         } else {
12209             res = 0x7fff;
12210         }
12211     }
12212     return res;
12213 }
12214 
12215 /* Perform 8-bit signed saturating subtraction.  */
sub8_sat(uint8_t a,uint8_t b)12216 static inline uint8_t sub8_sat(uint8_t a, uint8_t b)
12217 {
12218     uint8_t res;
12219 
12220     res = a - b;
12221     if (((res ^ a) & 0x80) && ((a ^ b) & 0x80)) {
12222         if (a & 0x80) {
12223             res = 0x80;
12224         } else {
12225             res = 0x7f;
12226         }
12227     }
12228     return res;
12229 }
12230 
12231 #define ADD16(a, b, n) RESULT(add16_sat(a, b), n, 16);
12232 #define SUB16(a, b, n) RESULT(sub16_sat(a, b), n, 16);
12233 #define ADD8(a, b, n)  RESULT(add8_sat(a, b), n, 8);
12234 #define SUB8(a, b, n)  RESULT(sub8_sat(a, b), n, 8);
12235 #define PFX q
12236 
12237 #include "op_addsub.h"
12238 
12239 /* Unsigned saturating arithmetic.  */
add16_usat(uint16_t a,uint16_t b)12240 static inline uint16_t add16_usat(uint16_t a, uint16_t b)
12241 {
12242     uint16_t res;
12243     res = a + b;
12244     if (res < a) {
12245         res = 0xffff;
12246     }
12247     return res;
12248 }
12249 
sub16_usat(uint16_t a,uint16_t b)12250 static inline uint16_t sub16_usat(uint16_t a, uint16_t b)
12251 {
12252     if (a > b) {
12253         return a - b;
12254     } else {
12255         return 0;
12256     }
12257 }
12258 
add8_usat(uint8_t a,uint8_t b)12259 static inline uint8_t add8_usat(uint8_t a, uint8_t b)
12260 {
12261     uint8_t res;
12262     res = a + b;
12263     if (res < a) {
12264         res = 0xff;
12265     }
12266     return res;
12267 }
12268 
sub8_usat(uint8_t a,uint8_t b)12269 static inline uint8_t sub8_usat(uint8_t a, uint8_t b)
12270 {
12271     if (a > b) {
12272         return a - b;
12273     } else {
12274         return 0;
12275     }
12276 }
12277 
12278 #define ADD16(a, b, n) RESULT(add16_usat(a, b), n, 16);
12279 #define SUB16(a, b, n) RESULT(sub16_usat(a, b), n, 16);
12280 #define ADD8(a, b, n)  RESULT(add8_usat(a, b), n, 8);
12281 #define SUB8(a, b, n)  RESULT(sub8_usat(a, b), n, 8);
12282 #define PFX uq
12283 
12284 #include "op_addsub.h"
12285 
12286 /* Signed modulo arithmetic.  */
12287 #define SARITH16(a, b, n, op) do { \
12288     int32_t sum; \
12289     sum = (int32_t)(int16_t)(a) op (int32_t)(int16_t)(b); \
12290     RESULT(sum, n, 16); \
12291     if (sum >= 0) \
12292         ge |= 3 << (n * 2); \
12293     } while (0)
12294 
12295 #define SARITH8(a, b, n, op) do { \
12296     int32_t sum; \
12297     sum = (int32_t)(int8_t)(a) op (int32_t)(int8_t)(b); \
12298     RESULT(sum, n, 8); \
12299     if (sum >= 0) \
12300         ge |= 1 << n; \
12301     } while (0)
12302 
12303 
12304 #define ADD16(a, b, n) SARITH16(a, b, n, +)
12305 #define SUB16(a, b, n) SARITH16(a, b, n, -)
12306 #define ADD8(a, b, n)  SARITH8(a, b, n, +)
12307 #define SUB8(a, b, n)  SARITH8(a, b, n, -)
12308 #define PFX s
12309 #define ARITH_GE
12310 
12311 #include "op_addsub.h"
12312 
12313 /* Unsigned modulo arithmetic.  */
12314 #define ADD16(a, b, n) do { \
12315     uint32_t sum; \
12316     sum = (uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b); \
12317     RESULT(sum, n, 16); \
12318     if ((sum >> 16) == 1) \
12319         ge |= 3 << (n * 2); \
12320     } while (0)
12321 
12322 #define ADD8(a, b, n) do { \
12323     uint32_t sum; \
12324     sum = (uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b); \
12325     RESULT(sum, n, 8); \
12326     if ((sum >> 8) == 1) \
12327         ge |= 1 << n; \
12328     } while (0)
12329 
12330 #define SUB16(a, b, n) do { \
12331     uint32_t sum; \
12332     sum = (uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b); \
12333     RESULT(sum, n, 16); \
12334     if ((sum >> 16) == 0) \
12335         ge |= 3 << (n * 2); \
12336     } while (0)
12337 
12338 #define SUB8(a, b, n) do { \
12339     uint32_t sum; \
12340     sum = (uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b); \
12341     RESULT(sum, n, 8); \
12342     if ((sum >> 8) == 0) \
12343         ge |= 1 << n; \
12344     } while (0)
12345 
12346 #define PFX u
12347 #define ARITH_GE
12348 
12349 #include "op_addsub.h"
12350 
12351 /* Halved signed arithmetic.  */
12352 #define ADD16(a, b, n) \
12353   RESULT(((int32_t)(int16_t)(a) + (int32_t)(int16_t)(b)) >> 1, n, 16)
12354 #define SUB16(a, b, n) \
12355   RESULT(((int32_t)(int16_t)(a) - (int32_t)(int16_t)(b)) >> 1, n, 16)
12356 #define ADD8(a, b, n) \
12357   RESULT(((int32_t)(int8_t)(a) + (int32_t)(int8_t)(b)) >> 1, n, 8)
12358 #define SUB8(a, b, n) \
12359   RESULT(((int32_t)(int8_t)(a) - (int32_t)(int8_t)(b)) >> 1, n, 8)
12360 #define PFX sh
12361 
12362 #include "op_addsub.h"
12363 
12364 /* Halved unsigned arithmetic.  */
12365 #define ADD16(a, b, n) \
12366   RESULT(((uint32_t)(uint16_t)(a) + (uint32_t)(uint16_t)(b)) >> 1, n, 16)
12367 #define SUB16(a, b, n) \
12368   RESULT(((uint32_t)(uint16_t)(a) - (uint32_t)(uint16_t)(b)) >> 1, n, 16)
12369 #define ADD8(a, b, n) \
12370   RESULT(((uint32_t)(uint8_t)(a) + (uint32_t)(uint8_t)(b)) >> 1, n, 8)
12371 #define SUB8(a, b, n) \
12372   RESULT(((uint32_t)(uint8_t)(a) - (uint32_t)(uint8_t)(b)) >> 1, n, 8)
12373 #define PFX uh
12374 
12375 #include "op_addsub.h"
12376 
do_usad(uint8_t a,uint8_t b)12377 static inline uint8_t do_usad(uint8_t a, uint8_t b)
12378 {
12379     if (a > b) {
12380         return a - b;
12381     } else {
12382         return b - a;
12383     }
12384 }
12385 
12386 /* Unsigned sum of absolute byte differences.  */
HELPER(usad8)12387 uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
12388 {
12389     uint32_t sum;
12390     sum = do_usad(a, b);
12391     sum += do_usad(a >> 8, b >> 8);
12392     sum += do_usad(a >> 16, b >> 16);
12393     sum += do_usad(a >> 24, b >> 24);
12394     return sum;
12395 }
12396 
12397 /* For ARMv6 SEL instruction.  */
HELPER(sel_flags)12398 uint32_t HELPER(sel_flags)(uint32_t flags, uint32_t a, uint32_t b)
12399 {
12400     uint32_t mask;
12401 
12402     mask = 0;
12403     if (flags & 1) {
12404         mask |= 0xff;
12405     }
12406     if (flags & 2) {
12407         mask |= 0xff00;
12408     }
12409     if (flags & 4) {
12410         mask |= 0xff0000;
12411     }
12412     if (flags & 8) {
12413         mask |= 0xff000000;
12414     }
12415     return (a & mask) | (b & ~mask);
12416 }
12417 
12418 /*
12419  * CRC helpers.
12420  * The upper bytes of val (above the number specified by 'bytes') must have
12421  * been zeroed out by the caller.
12422  */
HELPER(crc32)12423 uint32_t HELPER(crc32)(uint32_t acc, uint32_t val, uint32_t bytes)
12424 {
12425     uint8_t buf[4];
12426 
12427     stl_le_p(buf, val);
12428 
12429     /* zlib crc32 converts the accumulator and output to one's complement.  */
12430     return crc32(acc ^ 0xffffffff, buf, bytes) ^ 0xffffffff;
12431 }
12432 
HELPER(crc32c)12433 uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
12434 {
12435     uint8_t buf[4];
12436 
12437     stl_le_p(buf, val);
12438 
12439     /* Linux crc32c converts the output to one's complement.  */
12440     return crc32c(acc, buf, bytes) ^ 0xffffffff;
12441 }
12442 
12443 /*
12444  * Return the exception level to which FP-disabled exceptions should
12445  * be taken, or 0 if FP is enabled.
12446  */
fp_exception_el(CPUARMState * env,int cur_el)12447 int fp_exception_el(CPUARMState *env, int cur_el)
12448 {
12449 #ifndef CONFIG_USER_ONLY
12450     uint64_t hcr_el2;
12451 
12452     /*
12453      * CPACR and the CPTR registers don't exist before v6, so FP is
12454      * always accessible
12455      */
12456     if (!arm_feature(env, ARM_FEATURE_V6)) {
12457         return 0;
12458     }
12459 
12460     if (arm_feature(env, ARM_FEATURE_M)) {
12461         /* CPACR can cause a NOCP UsageFault taken to current security state */
12462         if (!v7m_cpacr_pass(env, env->v7m.secure, cur_el != 0)) {
12463             return 1;
12464         }
12465 
12466         if (arm_feature(env, ARM_FEATURE_M_SECURITY) && !env->v7m.secure) {
12467             if (!extract32(env->v7m.nsacr, 10, 1)) {
12468                 /* FP insns cause a NOCP UsageFault taken to Secure */
12469                 return 3;
12470             }
12471         }
12472 
12473         return 0;
12474     }
12475 
12476     hcr_el2 = arm_hcr_el2_eff(env);
12477 
12478     /*
12479      * The CPACR controls traps to EL1, or PL1 if we're 32 bit:
12480      * 0, 2 : trap EL0 and EL1/PL1 accesses
12481      * 1    : trap only EL0 accesses
12482      * 3    : trap no accesses
12483      * This register is ignored if E2H+TGE are both set.
12484      */
12485     if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
12486         int fpen = FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, FPEN);
12487 
12488         switch (fpen) {
12489         case 1:
12490             if (cur_el != 0) {
12491                 break;
12492             }
12493             /* fall through */
12494         case 0:
12495         case 2:
12496             /* Trap from Secure PL0 or PL1 to Secure PL1. */
12497             if (!arm_el_is_aa64(env, 3)
12498                 && (cur_el == 3 || arm_is_secure_below_el3(env))) {
12499                 return 3;
12500             }
12501             if (cur_el <= 1) {
12502                 return 1;
12503             }
12504             break;
12505         }
12506     }
12507 
12508     /*
12509      * The NSACR allows A-profile AArch32 EL3 and M-profile secure mode
12510      * to control non-secure access to the FPU. It doesn't have any
12511      * effect if EL3 is AArch64 or if EL3 doesn't exist at all.
12512      */
12513     if ((arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
12514          cur_el <= 2 && !arm_is_secure_below_el3(env))) {
12515         if (!extract32(env->cp15.nsacr, 10, 1)) {
12516             /* FP insns act as UNDEF */
12517             return cur_el == 2 ? 2 : 1;
12518         }
12519     }
12520 
12521     /*
12522      * CPTR_EL2 is present in v7VE or v8, and changes format
12523      * with HCR_EL2.E2H (regardless of TGE).
12524      */
12525     if (cur_el <= 2) {
12526         if (hcr_el2 & HCR_E2H) {
12527             switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, FPEN)) {
12528             case 1:
12529                 if (cur_el != 0 || !(hcr_el2 & HCR_TGE)) {
12530                     break;
12531                 }
12532                 /* fall through */
12533             case 0:
12534             case 2:
12535                 return 2;
12536             }
12537         } else if (arm_is_el2_enabled(env)) {
12538             if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TFP)) {
12539                 return 2;
12540             }
12541         }
12542     }
12543 
12544     /* CPTR_EL3 : present in v8 */
12545     if (FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TFP)) {
12546         /* Trap all FP ops to EL3 */
12547         return 3;
12548     }
12549 #endif
12550     return 0;
12551 }
12552 
12553 /* Return the exception level we're running at if this is our mmu_idx */
arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)12554 int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
12555 {
12556     if (mmu_idx & ARM_MMU_IDX_M) {
12557         return mmu_idx & ARM_MMU_IDX_M_PRIV;
12558     }
12559 
12560     switch (mmu_idx) {
12561     case ARMMMUIdx_E10_0:
12562     case ARMMMUIdx_E20_0:
12563     case ARMMMUIdx_E30_0:
12564         return 0;
12565     case ARMMMUIdx_E10_1:
12566     case ARMMMUIdx_E10_1_PAN:
12567         return 1;
12568     case ARMMMUIdx_E2:
12569     case ARMMMUIdx_E20_2:
12570     case ARMMMUIdx_E20_2_PAN:
12571         return 2;
12572     case ARMMMUIdx_E3:
12573     case ARMMMUIdx_E30_3_PAN:
12574         return 3;
12575     default:
12576         g_assert_not_reached();
12577     }
12578 }
12579 
12580 #ifndef CONFIG_TCG
arm_v7m_mmu_idx_for_secstate(CPUARMState * env,bool secstate)12581 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
12582 {
12583     g_assert_not_reached();
12584 }
12585 #endif
12586 
arm_mmu_idx_el(CPUARMState * env,int el)12587 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
12588 {
12589     ARMMMUIdx idx;
12590     uint64_t hcr;
12591 
12592     if (arm_feature(env, ARM_FEATURE_M)) {
12593         return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
12594     }
12595 
12596     /* See ARM pseudo-function ELIsInHost.  */
12597     switch (el) {
12598     case 0:
12599         hcr = arm_hcr_el2_eff(env);
12600         if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
12601             idx = ARMMMUIdx_E20_0;
12602         } else if (arm_is_secure_below_el3(env) &&
12603                    !arm_el_is_aa64(env, 3)) {
12604             idx = ARMMMUIdx_E30_0;
12605         } else {
12606             idx = ARMMMUIdx_E10_0;
12607         }
12608         break;
12609     case 1:
12610         if (arm_pan_enabled(env)) {
12611             idx = ARMMMUIdx_E10_1_PAN;
12612         } else {
12613             idx = ARMMMUIdx_E10_1;
12614         }
12615         break;
12616     case 2:
12617         /* Note that TGE does not apply at EL2.  */
12618         if (arm_hcr_el2_eff(env) & HCR_E2H) {
12619             if (arm_pan_enabled(env)) {
12620                 idx = ARMMMUIdx_E20_2_PAN;
12621             } else {
12622                 idx = ARMMMUIdx_E20_2;
12623             }
12624         } else {
12625             idx = ARMMMUIdx_E2;
12626         }
12627         break;
12628     case 3:
12629         if (!arm_el_is_aa64(env, 3) && arm_pan_enabled(env)) {
12630             return ARMMMUIdx_E30_3_PAN;
12631         }
12632         return ARMMMUIdx_E3;
12633     default:
12634         g_assert_not_reached();
12635     }
12636 
12637     return idx;
12638 }
12639 
arm_mmu_idx(CPUARMState * env)12640 ARMMMUIdx arm_mmu_idx(CPUARMState *env)
12641 {
12642     return arm_mmu_idx_el(env, arm_current_el(env));
12643 }
12644 
mve_no_pred(CPUARMState * env)12645 static bool mve_no_pred(CPUARMState *env)
12646 {
12647     /*
12648      * Return true if there is definitely no predication of MVE
12649      * instructions by VPR or LTPSIZE. (Returning false even if there
12650      * isn't any predication is OK; generated code will just be
12651      * a little worse.)
12652      * If the CPU does not implement MVE then this TB flag is always 0.
12653      *
12654      * NOTE: if you change this logic, the "recalculate s->mve_no_pred"
12655      * logic in gen_update_fp_context() needs to be updated to match.
12656      *
12657      * We do not include the effect of the ECI bits here -- they are
12658      * tracked in other TB flags. This simplifies the logic for
12659      * "when did we emit code that changes the MVE_NO_PRED TB flag
12660      * and thus need to end the TB?".
12661      */
12662     if (cpu_isar_feature(aa32_mve, env_archcpu(env))) {
12663         return false;
12664     }
12665     if (env->v7m.vpr) {
12666         return false;
12667     }
12668     if (env->v7m.ltpsize < 4) {
12669         return false;
12670     }
12671     return true;
12672 }
12673 
cpu_get_tb_cpu_state(CPUARMState * env,vaddr * pc,uint64_t * cs_base,uint32_t * pflags)12674 void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
12675                           uint64_t *cs_base, uint32_t *pflags)
12676 {
12677     CPUARMTBFlags flags;
12678 
12679     assert_hflags_rebuild_correctly(env);
12680     flags = env->hflags;
12681 
12682     if (EX_TBFLAG_ANY(flags, AARCH64_STATE)) {
12683         *pc = env->pc;
12684         if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {
12685             DP_TBFLAG_A64(flags, BTYPE, env->btype);
12686         }
12687     } else {
12688         *pc = env->regs[15];
12689 
12690         if (arm_feature(env, ARM_FEATURE_M)) {
12691             if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
12692                 FIELD_EX32(env->v7m.fpccr[M_REG_S], V7M_FPCCR, S)
12693                 != env->v7m.secure) {
12694                 DP_TBFLAG_M32(flags, FPCCR_S_WRONG, 1);
12695             }
12696 
12697             if ((env->v7m.fpccr[env->v7m.secure] & R_V7M_FPCCR_ASPEN_MASK) &&
12698                 (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK) ||
12699                  (env->v7m.secure &&
12700                   !(env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK)))) {
12701                 /*
12702                  * ASPEN is set, but FPCA/SFPA indicate that there is no
12703                  * active FP context; we must create a new FP context before
12704                  * executing any FP insn.
12705                  */
12706                 DP_TBFLAG_M32(flags, NEW_FP_CTXT_NEEDED, 1);
12707             }
12708 
12709             bool is_secure = env->v7m.fpccr[M_REG_S] & R_V7M_FPCCR_S_MASK;
12710             if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
12711                 DP_TBFLAG_M32(flags, LSPACT, 1);
12712             }
12713 
12714             if (mve_no_pred(env)) {
12715                 DP_TBFLAG_M32(flags, MVE_NO_PRED, 1);
12716             }
12717         } else {
12718             /*
12719              * Note that XSCALE_CPAR shares bits with VECSTRIDE.
12720              * Note that VECLEN+VECSTRIDE are RES0 for M-profile.
12721              */
12722             if (arm_feature(env, ARM_FEATURE_XSCALE)) {
12723                 DP_TBFLAG_A32(flags, XSCALE_CPAR, env->cp15.c15_cpar);
12724             } else {
12725                 DP_TBFLAG_A32(flags, VECLEN, env->vfp.vec_len);
12726                 DP_TBFLAG_A32(flags, VECSTRIDE, env->vfp.vec_stride);
12727             }
12728             if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) {
12729                 DP_TBFLAG_A32(flags, VFPEN, 1);
12730             }
12731         }
12732 
12733         DP_TBFLAG_AM32(flags, THUMB, env->thumb);
12734         DP_TBFLAG_AM32(flags, CONDEXEC, env->condexec_bits);
12735     }
12736 
12737     /*
12738      * The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
12739      * states defined in the ARM ARM for software singlestep:
12740      *  SS_ACTIVE   PSTATE.SS   State
12741      *     0            x       Inactive (the TB flag for SS is always 0)
12742      *     1            0       Active-pending
12743      *     1            1       Active-not-pending
12744      * SS_ACTIVE is set in hflags; PSTATE__SS is computed every TB.
12745      */
12746     if (EX_TBFLAG_ANY(flags, SS_ACTIVE) && (env->pstate & PSTATE_SS)) {
12747         DP_TBFLAG_ANY(flags, PSTATE__SS, 1);
12748     }
12749 
12750     *pflags = flags.flags;
12751     *cs_base = flags.flags2;
12752 }
12753 
12754 #ifdef TARGET_AARCH64
12755 /*
12756  * The manual says that when SVE is enabled and VQ is widened the
12757  * implementation is allowed to zero the previously inaccessible
12758  * portion of the registers.  The corollary to that is that when
12759  * SVE is enabled and VQ is narrowed we are also allowed to zero
12760  * the now inaccessible portion of the registers.
12761  *
12762  * The intent of this is that no predicate bit beyond VQ is ever set.
12763  * Which means that some operations on predicate registers themselves
12764  * may operate on full uint64_t or even unrolled across the maximum
12765  * uint64_t[4].  Performing 4 bits of host arithmetic unconditionally
12766  * may well be cheaper than conditionals to restrict the operation
12767  * to the relevant portion of a uint16_t[16].
12768  */
aarch64_sve_narrow_vq(CPUARMState * env,unsigned vq)12769 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
12770 {
12771     int i, j;
12772     uint64_t pmask;
12773 
12774     assert(vq >= 1 && vq <= ARM_MAX_VQ);
12775     assert(vq <= env_archcpu(env)->sve_max_vq);
12776 
12777     /* Zap the high bits of the zregs.  */
12778     for (i = 0; i < 32; i++) {
12779         memset(&env->vfp.zregs[i].d[2 * vq], 0, 16 * (ARM_MAX_VQ - vq));
12780     }
12781 
12782     /* Zap the high bits of the pregs and ffr.  */
12783     pmask = 0;
12784     if (vq & 3) {
12785         pmask = ~(-1ULL << (16 * (vq & 3)));
12786     }
12787     for (j = vq / 4; j < ARM_MAX_VQ / 4; j++) {
12788         for (i = 0; i < 17; ++i) {
12789             env->vfp.pregs[i].p[j] &= pmask;
12790         }
12791         pmask = 0;
12792     }
12793 }
12794 
sve_vqm1_for_el_sm_ena(CPUARMState * env,int el,bool sm)12795 static uint32_t sve_vqm1_for_el_sm_ena(CPUARMState *env, int el, bool sm)
12796 {
12797     int exc_el;
12798 
12799     if (sm) {
12800         exc_el = sme_exception_el(env, el);
12801     } else {
12802         exc_el = sve_exception_el(env, el);
12803     }
12804     if (exc_el) {
12805         return 0; /* disabled */
12806     }
12807     return sve_vqm1_for_el_sm(env, el, sm);
12808 }
12809 
12810 /*
12811  * Notice a change in SVE vector size when changing EL.
12812  */
aarch64_sve_change_el(CPUARMState * env,int old_el,int new_el,bool el0_a64)12813 void aarch64_sve_change_el(CPUARMState *env, int old_el,
12814                            int new_el, bool el0_a64)
12815 {
12816     ARMCPU *cpu = env_archcpu(env);
12817     int old_len, new_len;
12818     bool old_a64, new_a64, sm;
12819 
12820     /* Nothing to do if no SVE.  */
12821     if (!cpu_isar_feature(aa64_sve, cpu)) {
12822         return;
12823     }
12824 
12825     /* Nothing to do if FP is disabled in either EL.  */
12826     if (fp_exception_el(env, old_el) || fp_exception_el(env, new_el)) {
12827         return;
12828     }
12829 
12830     old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64;
12831     new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64;
12832 
12833     /*
12834      * Both AArch64.TakeException and AArch64.ExceptionReturn
12835      * invoke ResetSVEState when taking an exception from, or
12836      * returning to, AArch32 state when PSTATE.SM is enabled.
12837      */
12838     sm = FIELD_EX64(env->svcr, SVCR, SM);
12839     if (old_a64 != new_a64 && sm) {
12840         arm_reset_sve_state(env);
12841         return;
12842     }
12843 
12844     /*
12845      * DDI0584A.d sec 3.2: "If SVE instructions are disabled or trapped
12846      * at ELx, or not available because the EL is in AArch32 state, then
12847      * for all purposes other than a direct read, the ZCR_ELx.LEN field
12848      * has an effective value of 0".
12849      *
12850      * Consider EL2 (aa64, vq=4) -> EL0 (aa32) -> EL1 (aa64, vq=0).
12851      * If we ignore aa32 state, we would fail to see the vq4->vq0 transition
12852      * from EL2->EL1.  Thus we go ahead and narrow when entering aa32 so that
12853      * we already have the correct register contents when encountering the
12854      * vq0->vq0 transition between EL0->EL1.
12855      */
12856     old_len = new_len = 0;
12857     if (old_a64) {
12858         old_len = sve_vqm1_for_el_sm_ena(env, old_el, sm);
12859     }
12860     if (new_a64) {
12861         new_len = sve_vqm1_for_el_sm_ena(env, new_el, sm);
12862     }
12863 
12864     /* When changing vector length, clear inaccessible state.  */
12865     if (new_len < old_len) {
12866         aarch64_sve_narrow_vq(env, new_len + 1);
12867     }
12868 }
12869 #endif
12870 
12871 #ifndef CONFIG_USER_ONLY
arm_security_space(CPUARMState * env)12872 ARMSecuritySpace arm_security_space(CPUARMState *env)
12873 {
12874     if (arm_feature(env, ARM_FEATURE_M)) {
12875         return arm_secure_to_space(env->v7m.secure);
12876     }
12877 
12878     /*
12879      * If EL3 is not supported then the secure state is implementation
12880      * defined, in which case QEMU defaults to non-secure.
12881      */
12882     if (!arm_feature(env, ARM_FEATURE_EL3)) {
12883         return ARMSS_NonSecure;
12884     }
12885 
12886     /* Check for AArch64 EL3 or AArch32 Mon. */
12887     if (is_a64(env)) {
12888         if (extract32(env->pstate, 2, 2) == 3) {
12889             if (cpu_isar_feature(aa64_rme, env_archcpu(env))) {
12890                 return ARMSS_Root;
12891             } else {
12892                 return ARMSS_Secure;
12893             }
12894         }
12895     } else {
12896         if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
12897             return ARMSS_Secure;
12898         }
12899     }
12900 
12901     return arm_security_space_below_el3(env);
12902 }
12903 
arm_security_space_below_el3(CPUARMState * env)12904 ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env)
12905 {
12906     assert(!arm_feature(env, ARM_FEATURE_M));
12907 
12908     /*
12909      * If EL3 is not supported then the secure state is implementation
12910      * defined, in which case QEMU defaults to non-secure.
12911      */
12912     if (!arm_feature(env, ARM_FEATURE_EL3)) {
12913         return ARMSS_NonSecure;
12914     }
12915 
12916     /*
12917      * Note NSE cannot be set without RME, and NSE & !NS is Reserved.
12918      * Ignoring NSE when !NS retains consistency without having to
12919      * modify other predicates.
12920      */
12921     if (!(env->cp15.scr_el3 & SCR_NS)) {
12922         return ARMSS_Secure;
12923     } else if (env->cp15.scr_el3 & SCR_NSE) {
12924         return ARMSS_Realm;
12925     } else {
12926         return ARMSS_NonSecure;
12927     }
12928 }
12929 #endif /* !CONFIG_USER_ONLY */
12930