Fix new typos (found by codespell)
[qemu.git] / target-arm / helper.c
1 #include "cpu.h"
2 #include "internals.h"
3 #include "exec/gdbstub.h"
4 #include "exec/helper-proto.h"
5 #include "qemu/host-utils.h"
6 #include "sysemu/arch_init.h"
7 #include "sysemu/sysemu.h"
8 #include "qemu/bitops.h"
9 #include "qemu/crc32c.h"
10 #include "exec/cpu_ldst.h"
11 #include "arm_ldst.h"
12 #include <zlib.h> /* For crc32 */
13
14 #ifndef CONFIG_USER_ONLY
15 static inline int get_phys_addr(CPUARMState *env, target_ulong address,
16 int access_type, int is_user,
17 hwaddr *phys_ptr, int *prot,
18 target_ulong *page_size);
19
20 /* Definitions for the PMCCNTR and PMCR registers */
21 #define PMCRD 0x8
22 #define PMCRC 0x4
23 #define PMCRE 0x1
24 #endif
25
26 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
27 {
28 int nregs;
29
30 /* VFP data registers are always little-endian. */
31 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
32 if (reg < nregs) {
33 stfq_le_p(buf, env->vfp.regs[reg]);
34 return 8;
35 }
36 if (arm_feature(env, ARM_FEATURE_NEON)) {
37 /* Aliases for Q regs. */
38 nregs += 16;
39 if (reg < nregs) {
40 stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
41 stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
42 return 16;
43 }
44 }
45 switch (reg - nregs) {
46 case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
47 case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
48 case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
49 }
50 return 0;
51 }
52
53 static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
54 {
55 int nregs;
56
57 nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
58 if (reg < nregs) {
59 env->vfp.regs[reg] = ldfq_le_p(buf);
60 return 8;
61 }
62 if (arm_feature(env, ARM_FEATURE_NEON)) {
63 nregs += 16;
64 if (reg < nregs) {
65 env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
66 env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
67 return 16;
68 }
69 }
70 switch (reg - nregs) {
71 case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
72 case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
73 case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
74 }
75 return 0;
76 }
77
78 static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
79 {
80 switch (reg) {
81 case 0 ... 31:
82 /* 128 bit FP register */
83 stfq_le_p(buf, env->vfp.regs[reg * 2]);
84 stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
85 return 16;
86 case 32:
87 /* FPSR */
88 stl_p(buf, vfp_get_fpsr(env));
89 return 4;
90 case 33:
91 /* FPCR */
92 stl_p(buf, vfp_get_fpcr(env));
93 return 4;
94 default:
95 return 0;
96 }
97 }
98
99 static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
100 {
101 switch (reg) {
102 case 0 ... 31:
103 /* 128 bit FP register */
104 env->vfp.regs[reg * 2] = ldfq_le_p(buf);
105 env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
106 return 16;
107 case 32:
108 /* FPSR */
109 vfp_set_fpsr(env, ldl_p(buf));
110 return 4;
111 case 33:
112 /* FPCR */
113 vfp_set_fpcr(env, ldl_p(buf));
114 return 4;
115 default:
116 return 0;
117 }
118 }
119
120 static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
121 {
122 if (cpreg_field_is_64bit(ri)) {
123 return CPREG_FIELD64(env, ri);
124 } else {
125 return CPREG_FIELD32(env, ri);
126 }
127 }
128
129 static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
130 uint64_t value)
131 {
132 if (cpreg_field_is_64bit(ri)) {
133 CPREG_FIELD64(env, ri) = value;
134 } else {
135 CPREG_FIELD32(env, ri) = value;
136 }
137 }
138
139 static uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)
140 {
141 /* Raw read of a coprocessor register (as needed for migration, etc). */
142 if (ri->type & ARM_CP_CONST) {
143 return ri->resetvalue;
144 } else if (ri->raw_readfn) {
145 return ri->raw_readfn(env, ri);
146 } else if (ri->readfn) {
147 return ri->readfn(env, ri);
148 } else {
149 return raw_read(env, ri);
150 }
151 }
152
153 static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,
154 uint64_t v)
155 {
156 /* Raw write of a coprocessor register (as needed for migration, etc).
157 * Note that constant registers are treated as write-ignored; the
158 * caller should check for success by whether a readback gives the
159 * value written.
160 */
161 if (ri->type & ARM_CP_CONST) {
162 return;
163 } else if (ri->raw_writefn) {
164 ri->raw_writefn(env, ri, v);
165 } else if (ri->writefn) {
166 ri->writefn(env, ri, v);
167 } else {
168 raw_write(env, ri, v);
169 }
170 }
171
172 bool write_cpustate_to_list(ARMCPU *cpu)
173 {
174 /* Write the coprocessor state from cpu->env to the (index,value) list. */
175 int i;
176 bool ok = true;
177
178 for (i = 0; i < cpu->cpreg_array_len; i++) {
179 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
180 const ARMCPRegInfo *ri;
181
182 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
183 if (!ri) {
184 ok = false;
185 continue;
186 }
187 if (ri->type & ARM_CP_NO_MIGRATE) {
188 continue;
189 }
190 cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
191 }
192 return ok;
193 }
194
195 bool write_list_to_cpustate(ARMCPU *cpu)
196 {
197 int i;
198 bool ok = true;
199
200 for (i = 0; i < cpu->cpreg_array_len; i++) {
201 uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
202 uint64_t v = cpu->cpreg_values[i];
203 const ARMCPRegInfo *ri;
204
205 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
206 if (!ri) {
207 ok = false;
208 continue;
209 }
210 if (ri->type & ARM_CP_NO_MIGRATE) {
211 continue;
212 }
213 /* Write value and confirm it reads back as written
214 * (to catch read-only registers and partially read-only
215 * registers where the incoming migration value doesn't match)
216 */
217 write_raw_cp_reg(&cpu->env, ri, v);
218 if (read_raw_cp_reg(&cpu->env, ri) != v) {
219 ok = false;
220 }
221 }
222 return ok;
223 }
224
225 static void add_cpreg_to_list(gpointer key, gpointer opaque)
226 {
227 ARMCPU *cpu = opaque;
228 uint64_t regidx;
229 const ARMCPRegInfo *ri;
230
231 regidx = *(uint32_t *)key;
232 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
233
234 if (!(ri->type & ARM_CP_NO_MIGRATE)) {
235 cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
236 /* The value array need not be initialized at this point */
237 cpu->cpreg_array_len++;
238 }
239 }
240
241 static void count_cpreg(gpointer key, gpointer opaque)
242 {
243 ARMCPU *cpu = opaque;
244 uint64_t regidx;
245 const ARMCPRegInfo *ri;
246
247 regidx = *(uint32_t *)key;
248 ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
249
250 if (!(ri->type & ARM_CP_NO_MIGRATE)) {
251 cpu->cpreg_array_len++;
252 }
253 }
254
255 static gint cpreg_key_compare(gconstpointer a, gconstpointer b)
256 {
257 uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);
258 uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);
259
260 if (aidx > bidx) {
261 return 1;
262 }
263 if (aidx < bidx) {
264 return -1;
265 }
266 return 0;
267 }
268
269 static void cpreg_make_keylist(gpointer key, gpointer value, gpointer udata)
270 {
271 GList **plist = udata;
272
273 *plist = g_list_prepend(*plist, key);
274 }
275
276 void init_cpreg_list(ARMCPU *cpu)
277 {
278 /* Initialise the cpreg_tuples[] array based on the cp_regs hash.
279 * Note that we require cpreg_tuples[] to be sorted by key ID.
280 */
281 GList *keys = NULL;
282 int arraylen;
283
284 g_hash_table_foreach(cpu->cp_regs, cpreg_make_keylist, &keys);
285
286 keys = g_list_sort(keys, cpreg_key_compare);
287
288 cpu->cpreg_array_len = 0;
289
290 g_list_foreach(keys, count_cpreg, cpu);
291
292 arraylen = cpu->cpreg_array_len;
293 cpu->cpreg_indexes = g_new(uint64_t, arraylen);
294 cpu->cpreg_values = g_new(uint64_t, arraylen);
295 cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
296 cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
297 cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
298 cpu->cpreg_array_len = 0;
299
300 g_list_foreach(keys, add_cpreg_to_list, cpu);
301
302 assert(cpu->cpreg_array_len == arraylen);
303
304 g_list_free(keys);
305 }
306
307 /* Return true if extended addresses are enabled.
308 * This is always the case if our translation regime is 64 bit,
309 * but depends on TTBCR.EAE for 32 bit.
310 */
311 static inline bool extended_addresses_enabled(CPUARMState *env)
312 {
313 return arm_el_is_aa64(env, 1)
314 || ((arm_feature(env, ARM_FEATURE_LPAE)
315 && (env->cp15.c2_control & TTBCR_EAE)));
316 }
317
318 static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
319 {
320 ARMCPU *cpu = arm_env_get_cpu(env);
321
322 raw_write(env, ri, value);
323 tlb_flush(CPU(cpu), 1); /* Flush TLB as domain not tracked in TLB */
324 }
325
326 static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
327 {
328 ARMCPU *cpu = arm_env_get_cpu(env);
329
330 if (raw_read(env, ri) != value) {
331 /* Unlike real hardware the qemu TLB uses virtual addresses,
332 * not modified virtual addresses, so this causes a TLB flush.
333 */
334 tlb_flush(CPU(cpu), 1);
335 raw_write(env, ri, value);
336 }
337 }
338
339 static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
340 uint64_t value)
341 {
342 ARMCPU *cpu = arm_env_get_cpu(env);
343
344 if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
345 && !extended_addresses_enabled(env)) {
346 /* For VMSA (when not using the LPAE long descriptor page table
347 * format) this register includes the ASID, so do a TLB flush.
348 * For PMSA it is purely a process ID and no action is needed.
349 */
350 tlb_flush(CPU(cpu), 1);
351 }
352 raw_write(env, ri, value);
353 }
354
355 static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,
356 uint64_t value)
357 {
358 /* Invalidate all (TLBIALL) */
359 ARMCPU *cpu = arm_env_get_cpu(env);
360
361 tlb_flush(CPU(cpu), 1);
362 }
363
364 static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,
365 uint64_t value)
366 {
367 /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */
368 ARMCPU *cpu = arm_env_get_cpu(env);
369
370 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
371 }
372
373 static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,
374 uint64_t value)
375 {
376 /* Invalidate by ASID (TLBIASID) */
377 ARMCPU *cpu = arm_env_get_cpu(env);
378
379 tlb_flush(CPU(cpu), value == 0);
380 }
381
382 static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
383 uint64_t value)
384 {
385 /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */
386 ARMCPU *cpu = arm_env_get_cpu(env);
387
388 tlb_flush_page(CPU(cpu), value & TARGET_PAGE_MASK);
389 }
390
391 static const ARMCPRegInfo cp_reginfo[] = {
392 /* DBGDIDR: just RAZ. In particular this means the "debug architecture
393 * version" bits will read as a reserved value, which should cause
394 * Linux to not try to use the debug hardware.
395 */
396 { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
397 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
398 { .name = "FCSEIDR", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 0,
399 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c13_fcse),
400 .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
401 { .name = "CONTEXTIDR", .state = ARM_CP_STATE_BOTH,
402 .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
403 .access = PL1_RW,
404 .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el1),
405 .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
406 REGINFO_SENTINEL
407 };
408
409 static const ARMCPRegInfo not_v8_cp_reginfo[] = {
410 /* NB: Some of these registers exist in v8 but with more precise
411 * definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
412 */
413 /* MMU Domain access control / MPU write buffer control */
414 { .name = "DACR", .cp = 15,
415 .crn = 3, .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
416 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c3),
417 .resetvalue = 0, .writefn = dacr_write, .raw_writefn = raw_write, },
418 /* ??? This covers not just the impdef TLB lockdown registers but also
419 * some v7VMSA registers relating to TEX remap, so it is overly broad.
420 */
421 { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = CP_ANY,
422 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
423 /* MMU TLB control. Note that the wildcarding means we cover not just
424 * the unified TLB ops but also the dside/iside/inner-shareable variants.
425 */
426 { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,
427 .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,
428 .type = ARM_CP_NO_MIGRATE },
429 { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,
430 .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,
431 .type = ARM_CP_NO_MIGRATE },
432 { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,
433 .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,
434 .type = ARM_CP_NO_MIGRATE },
435 { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,
436 .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,
437 .type = ARM_CP_NO_MIGRATE },
438 /* Cache maintenance ops; some of this space may be overridden later. */
439 { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
440 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
441 .type = ARM_CP_NOP | ARM_CP_OVERRIDE },
442 REGINFO_SENTINEL
443 };
444
445 static const ARMCPRegInfo not_v6_cp_reginfo[] = {
446 /* Not all pre-v6 cores implemented this WFI, so this is slightly
447 * over-broad.
448 */
449 { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
450 .access = PL1_W, .type = ARM_CP_WFI },
451 REGINFO_SENTINEL
452 };
453
454 static const ARMCPRegInfo not_v7_cp_reginfo[] = {
455 /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
456 * is UNPREDICTABLE; we choose to NOP as most implementations do).
457 */
458 { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
459 .access = PL1_W, .type = ARM_CP_WFI },
460 /* L1 cache lockdown. Not architectural in v6 and earlier but in practice
461 * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
462 * OMAPCP will override this space.
463 */
464 { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
465 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
466 .resetvalue = 0 },
467 { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
468 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
469 .resetvalue = 0 },
470 /* v6 doesn't have the cache ID registers but Linux reads them anyway */
471 { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
472 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
473 .resetvalue = 0 },
474 REGINFO_SENTINEL
475 };
476
477 static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
478 uint64_t value)
479 {
480 uint32_t mask = 0;
481
482 /* In ARMv8 most bits of CPACR_EL1 are RES0. */
483 if (!arm_feature(env, ARM_FEATURE_V8)) {
484 /* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
485 * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
486 * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
487 */
488 if (arm_feature(env, ARM_FEATURE_VFP)) {
489 /* VFP coprocessor: cp10 & cp11 [23:20] */
490 mask |= (1 << 31) | (1 << 30) | (0xf << 20);
491
492 if (!arm_feature(env, ARM_FEATURE_NEON)) {
493 /* ASEDIS [31] bit is RAO/WI */
494 value |= (1 << 31);
495 }
496
497 /* VFPv3 and upwards with NEON implement 32 double precision
498 * registers (D0-D31).
499 */
500 if (!arm_feature(env, ARM_FEATURE_NEON) ||
501 !arm_feature(env, ARM_FEATURE_VFP3)) {
502 /* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
503 value |= (1 << 30);
504 }
505 }
506 value &= mask;
507 }
508 env->cp15.c1_coproc = value;
509 }
510
511 static const ARMCPRegInfo v6_cp_reginfo[] = {
512 /* prefetch by MVA in v6, NOP in v7 */
513 { .name = "MVA_prefetch",
514 .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
515 .access = PL1_W, .type = ARM_CP_NOP },
516 { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
517 .access = PL0_W, .type = ARM_CP_NOP },
518 { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
519 .access = PL0_W, .type = ARM_CP_NOP },
520 { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
521 .access = PL0_W, .type = ARM_CP_NOP },
522 { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
523 .access = PL1_RW,
524 .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el1),
525 .resetvalue = 0, },
526 /* Watchpoint Fault Address Register : should actually only be present
527 * for 1136, 1176, 11MPCore.
528 */
529 { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
530 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
531 { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
532 .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2,
533 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_coproc),
534 .resetvalue = 0, .writefn = cpacr_write },
535 REGINFO_SENTINEL
536 };
537
538 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri)
539 {
540 /* Performance monitor registers user accessibility is controlled
541 * by PMUSERENR.
542 */
543 if (arm_current_pl(env) == 0 && !env->cp15.c9_pmuserenr) {
544 return CP_ACCESS_TRAP;
545 }
546 return CP_ACCESS_OK;
547 }
548
549 #ifndef CONFIG_USER_ONLY
550 static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
551 uint64_t value)
552 {
553 /* Don't computer the number of ticks in user mode */
554 uint32_t temp_ticks;
555
556 temp_ticks = qemu_clock_get_us(QEMU_CLOCK_VIRTUAL) *
557 get_ticks_per_sec() / 1000000;
558
559 if (env->cp15.c9_pmcr & PMCRE) {
560 /* If the counter is enabled */
561 if (env->cp15.c9_pmcr & PMCRD) {
562 /* Increment once every 64 processor clock cycles */
563 env->cp15.c15_ccnt = (temp_ticks/64) - env->cp15.c15_ccnt;
564 } else {
565 env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
566 }
567 }
568
569 if (value & PMCRC) {
570 /* The counter has been reset */
571 env->cp15.c15_ccnt = 0;
572 }
573
574 /* only the DP, X, D and E bits are writable */
575 env->cp15.c9_pmcr &= ~0x39;
576 env->cp15.c9_pmcr |= (value & 0x39);
577
578 if (env->cp15.c9_pmcr & PMCRE) {
579 if (env->cp15.c9_pmcr & PMCRD) {
580 /* Increment once every 64 processor clock cycles */
581 temp_ticks /= 64;
582 }
583 env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
584 }
585 }
586
587 static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
588 {
589 uint32_t total_ticks;
590
591 if (!(env->cp15.c9_pmcr & PMCRE)) {
592 /* Counter is disabled, do not change value */
593 return env->cp15.c15_ccnt;
594 }
595
596 total_ticks = qemu_clock_get_us(QEMU_CLOCK_VIRTUAL) *
597 get_ticks_per_sec() / 1000000;
598
599 if (env->cp15.c9_pmcr & PMCRD) {
600 /* Increment once every 64 processor clock cycles */
601 total_ticks /= 64;
602 }
603 return total_ticks - env->cp15.c15_ccnt;
604 }
605
606 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
607 uint64_t value)
608 {
609 uint32_t total_ticks;
610
611 if (!(env->cp15.c9_pmcr & PMCRE)) {
612 /* Counter is disabled, set the absolute value */
613 env->cp15.c15_ccnt = value;
614 return;
615 }
616
617 total_ticks = qemu_clock_get_us(QEMU_CLOCK_VIRTUAL) *
618 get_ticks_per_sec() / 1000000;
619
620 if (env->cp15.c9_pmcr & PMCRD) {
621 /* Increment once every 64 processor clock cycles */
622 total_ticks /= 64;
623 }
624 env->cp15.c15_ccnt = total_ticks - value;
625 }
626 #endif
627
628 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
629 uint64_t value)
630 {
631 value &= (1 << 31);
632 env->cp15.c9_pmcnten |= value;
633 }
634
635 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
636 uint64_t value)
637 {
638 value &= (1 << 31);
639 env->cp15.c9_pmcnten &= ~value;
640 }
641
642 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
643 uint64_t value)
644 {
645 env->cp15.c9_pmovsr &= ~value;
646 }
647
648 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
649 uint64_t value)
650 {
651 env->cp15.c9_pmxevtyper = value & 0xff;
652 }
653
654 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
655 uint64_t value)
656 {
657 env->cp15.c9_pmuserenr = value & 1;
658 }
659
660 static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
661 uint64_t value)
662 {
663 /* We have no event counters so only the C bit can be changed */
664 value &= (1 << 31);
665 env->cp15.c9_pminten |= value;
666 }
667
668 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
669 uint64_t value)
670 {
671 value &= (1 << 31);
672 env->cp15.c9_pminten &= ~value;
673 }
674
675 static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
676 uint64_t value)
677 {
678 /* Note that even though the AArch64 view of this register has bits
679 * [10:0] all RES0 we can only mask the bottom 5, to comply with the
680 * architectural requirements for bits which are RES0 only in some
681 * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
682 * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
683 */
684 raw_write(env, ri, value & ~0x1FULL);
685 }
686
687 static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
688 {
689 ARMCPU *cpu = arm_env_get_cpu(env);
690 return cpu->ccsidr[env->cp15.c0_cssel];
691 }
692
693 static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
694 uint64_t value)
695 {
696 raw_write(env, ri, value & 0xf);
697 }
698
699 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
700 {
701 CPUState *cs = ENV_GET_CPU(env);
702 uint64_t ret = 0;
703
704 if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
705 ret |= CPSR_I;
706 }
707 if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
708 ret |= CPSR_F;
709 }
710 /* External aborts are not possible in QEMU so A bit is always clear */
711 return ret;
712 }
713
714 static const ARMCPRegInfo v7_cp_reginfo[] = {
715 /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
716 * debug components
717 */
718 { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
719 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
720 { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
721 .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
722 /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
723 { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
724 .access = PL1_W, .type = ARM_CP_NOP },
725 /* Performance monitors are implementation defined in v7,
726 * but with an ARM recommended set of registers, which we
727 * follow (although we don't actually implement any counters)
728 *
729 * Performance registers fall into three categories:
730 * (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)
731 * (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)
732 * (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)
733 * For the cases controlled by PMUSERENR we must set .access to PL0_RW
734 * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.
735 */
736 { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,
737 .access = PL0_RW, .resetvalue = 0,
738 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
739 .writefn = pmcntenset_write,
740 .accessfn = pmreg_access,
741 .raw_writefn = raw_write },
742 { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,
743 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
744 .accessfn = pmreg_access,
745 .writefn = pmcntenclr_write,
746 .type = ARM_CP_NO_MIGRATE },
747 { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
748 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
749 .accessfn = pmreg_access,
750 .writefn = pmovsr_write,
751 .raw_writefn = raw_write },
752 /* Unimplemented so WI. */
753 { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
754 .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
755 /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
756 * We choose to RAZ/WI.
757 */
758 { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
759 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
760 .accessfn = pmreg_access },
761 #ifndef CONFIG_USER_ONLY
762 { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
763 .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
764 .readfn = pmccntr_read, .writefn = pmccntr_write,
765 .accessfn = pmreg_access },
766 #endif
767 { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
768 .access = PL0_RW,
769 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
770 .accessfn = pmreg_access, .writefn = pmxevtyper_write,
771 .raw_writefn = raw_write },
772 /* Unimplemented, RAZ/WI. */
773 { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
774 .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
775 .accessfn = pmreg_access },
776 { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
777 .access = PL0_R | PL1_RW,
778 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
779 .resetvalue = 0,
780 .writefn = pmuserenr_write, .raw_writefn = raw_write },
781 { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
782 .access = PL1_RW,
783 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
784 .resetvalue = 0,
785 .writefn = pmintenset_write, .raw_writefn = raw_write },
786 { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
787 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
788 .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
789 .resetvalue = 0, .writefn = pmintenclr_write, },
790 { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
791 .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
792 .access = PL1_RW, .writefn = vbar_write,
793 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[1]),
794 .resetvalue = 0 },
795 { .name = "SCR", .cp = 15, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,
796 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_scr),
797 .resetvalue = 0, },
798 { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
799 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
800 .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_MIGRATE },
801 { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
802 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
803 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c0_cssel),
804 .writefn = csselr_write, .resetvalue = 0 },
805 /* Auxiliary ID register: this actually has an IMPDEF value but for now
806 * just RAZ for all cores:
807 */
808 { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
809 .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
810 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
811 /* Auxiliary fault status registers: these also are IMPDEF, and we
812 * choose to RAZ/WI for all cores.
813 */
814 { .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
815 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
816 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
817 { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
818 .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
819 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
820 /* MAIR can just read-as-written because we don't implement caches
821 * and so don't need to care about memory attributes.
822 */
823 { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
824 .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
825 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el1),
826 .resetvalue = 0 },
827 /* For non-long-descriptor page tables these are PRRR and NMRR;
828 * regardless they still act as reads-as-written for QEMU.
829 * The override is necessary because of the overly-broad TLB_LOCKDOWN
830 * definition.
831 */
832 { .name = "MAIR0", .state = ARM_CP_STATE_AA32, .type = ARM_CP_OVERRIDE,
833 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,
834 .fieldoffset = offsetoflow32(CPUARMState, cp15.mair_el1),
835 .resetfn = arm_cp_reset_ignore },
836 { .name = "MAIR1", .state = ARM_CP_STATE_AA32, .type = ARM_CP_OVERRIDE,
837 .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,
838 .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el1),
839 .resetfn = arm_cp_reset_ignore },
840 { .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
841 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
842 .type = ARM_CP_NO_MIGRATE, .access = PL1_R, .readfn = isr_read },
843 REGINFO_SENTINEL
844 };
845
846 static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,
847 uint64_t value)
848 {
849 value &= 1;
850 env->teecr = value;
851 }
852
853 static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri)
854 {
855 if (arm_current_pl(env) == 0 && (env->teecr & 1)) {
856 return CP_ACCESS_TRAP;
857 }
858 return CP_ACCESS_OK;
859 }
860
861 static const ARMCPRegInfo t2ee_cp_reginfo[] = {
862 { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
863 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
864 .resetvalue = 0,
865 .writefn = teecr_write },
866 { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
867 .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
868 .accessfn = teehbr_access, .resetvalue = 0 },
869 REGINFO_SENTINEL
870 };
871
872 static const ARMCPRegInfo v6k_cp_reginfo[] = {
873 { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
874 .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
875 .access = PL0_RW,
876 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el0), .resetvalue = 0 },
877 { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
878 .access = PL0_RW,
879 .fieldoffset = offsetoflow32(CPUARMState, cp15.tpidr_el0),
880 .resetfn = arm_cp_reset_ignore },
881 { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
882 .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
883 .access = PL0_R|PL1_W,
884 .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el0), .resetvalue = 0 },
885 { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
886 .access = PL0_R|PL1_W,
887 .fieldoffset = offsetoflow32(CPUARMState, cp15.tpidrro_el0),
888 .resetfn = arm_cp_reset_ignore },
889 { .name = "TPIDR_EL1", .state = ARM_CP_STATE_BOTH,
890 .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
891 .access = PL1_RW,
892 .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el1), .resetvalue = 0 },
893 REGINFO_SENTINEL
894 };
895
896 #ifndef CONFIG_USER_ONLY
897
898 static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri)
899 {
900 /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */
901 if (arm_current_pl(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) {
902 return CP_ACCESS_TRAP;
903 }
904 return CP_ACCESS_OK;
905 }
906
907 static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx)
908 {
909 /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */
910 if (arm_current_pl(env) == 0 &&
911 !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
912 return CP_ACCESS_TRAP;
913 }
914 return CP_ACCESS_OK;
915 }
916
917 static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx)
918 {
919 /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if
920 * EL0[PV]TEN is zero.
921 */
922 if (arm_current_pl(env) == 0 &&
923 !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
924 return CP_ACCESS_TRAP;
925 }
926 return CP_ACCESS_OK;
927 }
928
929 static CPAccessResult gt_pct_access(CPUARMState *env,
930 const ARMCPRegInfo *ri)
931 {
932 return gt_counter_access(env, GTIMER_PHYS);
933 }
934
935 static CPAccessResult gt_vct_access(CPUARMState *env,
936 const ARMCPRegInfo *ri)
937 {
938 return gt_counter_access(env, GTIMER_VIRT);
939 }
940
941 static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
942 {
943 return gt_timer_access(env, GTIMER_PHYS);
944 }
945
946 static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri)
947 {
948 return gt_timer_access(env, GTIMER_VIRT);
949 }
950
951 static uint64_t gt_get_countervalue(CPUARMState *env)
952 {
953 return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
954 }
955
956 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
957 {
958 ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
959
960 if (gt->ctl & 1) {
961 /* Timer enabled: calculate and set current ISTATUS, irq, and
962 * reset timer to when ISTATUS next has to change
963 */
964 uint64_t count = gt_get_countervalue(&cpu->env);
965 /* Note that this must be unsigned 64 bit arithmetic: */
966 int istatus = count >= gt->cval;
967 uint64_t nexttick;
968
969 gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
970 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
971 (istatus && !(gt->ctl & 2)));
972 if (istatus) {
973 /* Next transition is when count rolls back over to zero */
974 nexttick = UINT64_MAX;
975 } else {
976 /* Next transition is when we hit cval */
977 nexttick = gt->cval;
978 }
979 /* Note that the desired next expiry time might be beyond the
980 * signed-64-bit range of a QEMUTimer -- in this case we just
981 * set the timer for as far in the future as possible. When the
982 * timer expires we will reset the timer for any remaining period.
983 */
984 if (nexttick > INT64_MAX / GTIMER_SCALE) {
985 nexttick = INT64_MAX / GTIMER_SCALE;
986 }
987 timer_mod(cpu->gt_timer[timeridx], nexttick);
988 } else {
989 /* Timer disabled: ISTATUS and timer output always clear */
990 gt->ctl &= ~4;
991 qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
992 timer_del(cpu->gt_timer[timeridx]);
993 }
994 }
995
996 static void gt_cnt_reset(CPUARMState *env, const ARMCPRegInfo *ri)
997 {
998 ARMCPU *cpu = arm_env_get_cpu(env);
999 int timeridx = ri->opc1 & 1;
1000
1001 timer_del(cpu->gt_timer[timeridx]);
1002 }
1003
1004 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
1005 {
1006 return gt_get_countervalue(env);
1007 }
1008
1009 static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1010 uint64_t value)
1011 {
1012 int timeridx = ri->opc1 & 1;
1013
1014 env->cp15.c14_timer[timeridx].cval = value;
1015 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1016 }
1017
1018 static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)
1019 {
1020 int timeridx = ri->crm & 1;
1021
1022 return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
1023 gt_get_countervalue(env));
1024 }
1025
1026 static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
1027 uint64_t value)
1028 {
1029 int timeridx = ri->crm & 1;
1030
1031 env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) +
1032 + sextract64(value, 0, 32);
1033 gt_recalc_timer(arm_env_get_cpu(env), timeridx);
1034 }
1035
1036 static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
1037 uint64_t value)
1038 {
1039 ARMCPU *cpu = arm_env_get_cpu(env);
1040 int timeridx = ri->crm & 1;
1041 uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
1042
1043 env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
1044 if ((oldval ^ value) & 1) {
1045 /* Enable toggled */
1046 gt_recalc_timer(cpu, timeridx);
1047 } else if ((oldval ^ value) & 2) {
1048 /* IMASK toggled: don't need to recalculate,
1049 * just set the interrupt line based on ISTATUS
1050 */
1051 qemu_set_irq(cpu->gt_timer_outputs[timeridx],
1052 (oldval & 4) && !(value & 2));
1053 }
1054 }
1055
1056 void arm_gt_ptimer_cb(void *opaque)
1057 {
1058 ARMCPU *cpu = opaque;
1059
1060 gt_recalc_timer(cpu, GTIMER_PHYS);
1061 }
1062
1063 void arm_gt_vtimer_cb(void *opaque)
1064 {
1065 ARMCPU *cpu = opaque;
1066
1067 gt_recalc_timer(cpu, GTIMER_VIRT);
1068 }
1069
1070 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1071 /* Note that CNTFRQ is purely reads-as-written for the benefit
1072 * of software; writing it doesn't actually change the timer frequency.
1073 * Our reset value matches the fixed frequency we implement the timer at.
1074 */
1075 { .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
1076 .type = ARM_CP_NO_MIGRATE,
1077 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1078 .fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
1079 .resetfn = arm_cp_reset_ignore,
1080 },
1081 { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
1082 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
1083 .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
1084 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
1085 .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
1086 },
1087 /* overall control: mostly access permissions */
1088 { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
1089 .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
1090 .access = PL1_RW,
1091 .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
1092 .resetvalue = 0,
1093 },
1094 /* per-timer control */
1095 { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
1096 .type = ARM_CP_IO | ARM_CP_NO_MIGRATE, .access = PL1_RW | PL0_R,
1097 .accessfn = gt_ptimer_access,
1098 .fieldoffset = offsetoflow32(CPUARMState,
1099 cp15.c14_timer[GTIMER_PHYS].ctl),
1100 .resetfn = arm_cp_reset_ignore,
1101 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1102 },
1103 { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
1104 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
1105 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1106 .accessfn = gt_ptimer_access,
1107 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
1108 .resetvalue = 0,
1109 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1110 },
1111 { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
1112 .type = ARM_CP_IO | ARM_CP_NO_MIGRATE, .access = PL1_RW | PL0_R,
1113 .accessfn = gt_vtimer_access,
1114 .fieldoffset = offsetoflow32(CPUARMState,
1115 cp15.c14_timer[GTIMER_VIRT].ctl),
1116 .resetfn = arm_cp_reset_ignore,
1117 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1118 },
1119 { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
1120 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
1121 .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
1122 .accessfn = gt_vtimer_access,
1123 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
1124 .resetvalue = 0,
1125 .writefn = gt_ctl_write, .raw_writefn = raw_write,
1126 },
1127 /* TimerValue views: a 32 bit downcounting view of the underlying state */
1128 { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
1129 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1130 .accessfn = gt_ptimer_access,
1131 .readfn = gt_tval_read, .writefn = gt_tval_write,
1132 },
1133 { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1134 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
1135 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1136 .readfn = gt_tval_read, .writefn = gt_tval_write,
1137 },
1138 { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
1139 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1140 .accessfn = gt_vtimer_access,
1141 .readfn = gt_tval_read, .writefn = gt_tval_write,
1142 },
1143 { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
1144 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
1145 .type = ARM_CP_NO_MIGRATE | ARM_CP_IO, .access = PL1_RW | PL0_R,
1146 .readfn = gt_tval_read, .writefn = gt_tval_write,
1147 },
1148 /* The counter itself */
1149 { .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
1150 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE | ARM_CP_IO,
1151 .accessfn = gt_pct_access,
1152 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1153 },
1154 { .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
1155 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
1156 .access = PL0_R, .type = ARM_CP_NO_MIGRATE | ARM_CP_IO,
1157 .accessfn = gt_pct_access,
1158 .readfn = gt_cnt_read, .resetfn = gt_cnt_reset,
1159 },
1160 { .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
1161 .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE | ARM_CP_IO,
1162 .accessfn = gt_vct_access,
1163 .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
1164 },
1165 { .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
1166 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
1167 .access = PL0_R, .type = ARM_CP_NO_MIGRATE | ARM_CP_IO,
1168 .accessfn = gt_vct_access,
1169 .readfn = gt_cnt_read, .resetfn = gt_cnt_reset,
1170 },
1171 /* Comparison value, indicating when the timer goes off */
1172 { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
1173 .access = PL1_RW | PL0_R,
1174 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_MIGRATE,
1175 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1176 .accessfn = gt_ptimer_access, .resetfn = arm_cp_reset_ignore,
1177 .writefn = gt_cval_write, .raw_writefn = raw_write,
1178 },
1179 { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1180 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
1181 .access = PL1_RW | PL0_R,
1182 .type = ARM_CP_IO,
1183 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
1184 .resetvalue = 0, .accessfn = gt_vtimer_access,
1185 .writefn = gt_cval_write, .raw_writefn = raw_write,
1186 },
1187 { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
1188 .access = PL1_RW | PL0_R,
1189 .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_NO_MIGRATE,
1190 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1191 .accessfn = gt_vtimer_access, .resetfn = arm_cp_reset_ignore,
1192 .writefn = gt_cval_write, .raw_writefn = raw_write,
1193 },
1194 { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
1195 .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
1196 .access = PL1_RW | PL0_R,
1197 .type = ARM_CP_IO,
1198 .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
1199 .resetvalue = 0, .accessfn = gt_vtimer_access,
1200 .writefn = gt_cval_write, .raw_writefn = raw_write,
1201 },
1202 REGINFO_SENTINEL
1203 };
1204
1205 #else
1206 /* In user-mode none of the generic timer registers are accessible,
1207 * and their implementation depends on QEMU_CLOCK_VIRTUAL and qdev gpio outputs,
1208 * so instead just don't register any of them.
1209 */
1210 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
1211 REGINFO_SENTINEL
1212 };
1213
1214 #endif
1215
1216 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1217 {
1218 if (arm_feature(env, ARM_FEATURE_LPAE)) {
1219 raw_write(env, ri, value);
1220 } else if (arm_feature(env, ARM_FEATURE_V7)) {
1221 raw_write(env, ri, value & 0xfffff6ff);
1222 } else {
1223 raw_write(env, ri, value & 0xfffff1ff);
1224 }
1225 }
1226
1227 #ifndef CONFIG_USER_ONLY
1228 /* get_phys_addr() isn't present for user-mode-only targets */
1229
1230 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri)
1231 {
1232 if (ri->opc2 & 4) {
1233 /* Other states are only available with TrustZone; in
1234 * a non-TZ implementation these registers don't exist
1235 * at all, which is an Uncategorized trap. This underdecoding
1236 * is safe because the reginfo is NO_MIGRATE.
1237 */
1238 return CP_ACCESS_TRAP_UNCATEGORIZED;
1239 }
1240 return CP_ACCESS_OK;
1241 }
1242
1243 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
1244 {
1245 hwaddr phys_addr;
1246 target_ulong page_size;
1247 int prot;
1248 int ret, is_user = ri->opc2 & 2;
1249 int access_type = ri->opc2 & 1;
1250
1251 ret = get_phys_addr(env, value, access_type, is_user,
1252 &phys_addr, &prot, &page_size);
1253 if (extended_addresses_enabled(env)) {
1254 /* ret is a DFSR/IFSR value for the long descriptor
1255 * translation table format, but with WnR always clear.
1256 * Convert it to a 64-bit PAR.
1257 */
1258 uint64_t par64 = (1 << 11); /* LPAE bit always set */
1259 if (ret == 0) {
1260 par64 |= phys_addr & ~0xfffULL;
1261 /* We don't set the ATTR or SH fields in the PAR. */
1262 } else {
1263 par64 |= 1; /* F */
1264 par64 |= (ret & 0x3f) << 1; /* FS */
1265 /* Note that S2WLK and FSTAGE are always zero, because we don't
1266 * implement virtualization and therefore there can't be a stage 2
1267 * fault.
1268 */
1269 }
1270 env->cp15.par_el1 = par64;
1271 } else {
1272 /* ret is a DFSR/IFSR value for the short descriptor
1273 * translation table format (with WnR always clear).
1274 * Convert it to a 32-bit PAR.
1275 */
1276 if (ret == 0) {
1277 /* We do not set any attribute bits in the PAR */
1278 if (page_size == (1 << 24)
1279 && arm_feature(env, ARM_FEATURE_V7)) {
1280 env->cp15.par_el1 = (phys_addr & 0xff000000) | 1 << 1;
1281 } else {
1282 env->cp15.par_el1 = phys_addr & 0xfffff000;
1283 }
1284 } else {
1285 env->cp15.par_el1 = ((ret & (1 << 10)) >> 5) |
1286 ((ret & (1 << 12)) >> 6) |
1287 ((ret & 0xf) << 1) | 1;
1288 }
1289 }
1290 }
1291 #endif
1292
1293 static const ARMCPRegInfo vapa_cp_reginfo[] = {
1294 { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
1295 .access = PL1_RW, .resetvalue = 0,
1296 .fieldoffset = offsetoflow32(CPUARMState, cp15.par_el1),
1297 .writefn = par_write },
1298 #ifndef CONFIG_USER_ONLY
1299 { .name = "ATS", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = CP_ANY,
1300 .access = PL1_W, .accessfn = ats_access,
1301 .writefn = ats_write, .type = ARM_CP_NO_MIGRATE },
1302 #endif
1303 REGINFO_SENTINEL
1304 };
1305
1306 /* Return basic MPU access permission bits. */
1307 static uint32_t simple_mpu_ap_bits(uint32_t val)
1308 {
1309 uint32_t ret;
1310 uint32_t mask;
1311 int i;
1312 ret = 0;
1313 mask = 3;
1314 for (i = 0; i < 16; i += 2) {
1315 ret |= (val >> i) & mask;
1316 mask <<= 2;
1317 }
1318 return ret;
1319 }
1320
1321 /* Pad basic MPU access permission bits to extended format. */
1322 static uint32_t extended_mpu_ap_bits(uint32_t val)
1323 {
1324 uint32_t ret;
1325 uint32_t mask;
1326 int i;
1327 ret = 0;
1328 mask = 3;
1329 for (i = 0; i < 16; i += 2) {
1330 ret |= (val & mask) << i;
1331 mask <<= 2;
1332 }
1333 return ret;
1334 }
1335
1336 static void pmsav5_data_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1337 uint64_t value)
1338 {
1339 env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
1340 }
1341
1342 static uint64_t pmsav5_data_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1343 {
1344 return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
1345 }
1346
1347 static void pmsav5_insn_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
1348 uint64_t value)
1349 {
1350 env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
1351 }
1352
1353 static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
1354 {
1355 return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
1356 }
1357
1358 static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
1359 { .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
1360 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1361 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
1362 .resetvalue = 0,
1363 .readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
1364 { .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
1365 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1366 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
1367 .resetvalue = 0,
1368 .readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
1369 { .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
1370 .access = PL1_RW,
1371 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
1372 .resetvalue = 0, },
1373 { .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
1374 .access = PL1_RW,
1375 .fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
1376 .resetvalue = 0, },
1377 { .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
1378 .access = PL1_RW,
1379 .fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
1380 { .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
1381 .access = PL1_RW,
1382 .fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
1383 /* Protection region base and size registers */
1384 { .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
1385 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1386 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
1387 { .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
1388 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1389 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
1390 { .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
1391 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1392 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
1393 { .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
1394 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1395 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
1396 { .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
1397 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1398 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
1399 { .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
1400 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1401 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
1402 { .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
1403 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1404 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
1405 { .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
1406 .opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
1407 .fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
1408 REGINFO_SENTINEL
1409 };
1410
1411 static void vmsa_ttbcr_raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
1412 uint64_t value)
1413 {
1414 int maskshift = extract32(value, 0, 3);
1415
1416 if (!arm_feature(env, ARM_FEATURE_V8)) {
1417 if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
1418 /* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
1419 * using Long-desciptor translation table format */
1420 value &= ~((7 << 19) | (3 << 14) | (0xf << 3));
1421 } else if (arm_feature(env, ARM_FEATURE_EL3)) {
1422 /* In an implementation that includes the Security Extensions
1423 * TTBCR has additional fields PD0 [4] and PD1 [5] for
1424 * Short-descriptor translation table format.
1425 */
1426 value &= TTBCR_PD1 | TTBCR_PD0 | TTBCR_N;
1427 } else {
1428 value &= TTBCR_N;
1429 }
1430 }
1431
1432 /* Note that we always calculate c2_mask and c2_base_mask, but
1433 * they are only used for short-descriptor tables (ie if EAE is 0);
1434 * for long-descriptor tables the TTBCR fields are used differently
1435 * and the c2_mask and c2_base_mask values are meaningless.
1436 */
1437 raw_write(env, ri, value);
1438 env->cp15.c2_mask = ~(((uint32_t)0xffffffffu) >> maskshift);
1439 env->cp15.c2_base_mask = ~((uint32_t)0x3fffu >> maskshift);
1440 }
1441
1442 static void vmsa_ttbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1443 uint64_t value)
1444 {
1445 ARMCPU *cpu = arm_env_get_cpu(env);
1446
1447 if (arm_feature(env, ARM_FEATURE_LPAE)) {
1448 /* With LPAE the TTBCR could result in a change of ASID
1449 * via the TTBCR.A1 bit, so do a TLB flush.
1450 */
1451 tlb_flush(CPU(cpu), 1);
1452 }
1453 vmsa_ttbcr_raw_write(env, ri, value);
1454 }
1455
1456 static void vmsa_ttbcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
1457 {
1458 env->cp15.c2_base_mask = 0xffffc000u;
1459 raw_write(env, ri, 0);
1460 env->cp15.c2_mask = 0;
1461 }
1462
1463 static void vmsa_tcr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
1464 uint64_t value)
1465 {
1466 ARMCPU *cpu = arm_env_get_cpu(env);
1467
1468 /* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
1469 tlb_flush(CPU(cpu), 1);
1470 raw_write(env, ri, value);
1471 }
1472
1473 static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1474 uint64_t value)
1475 {
1476 /* 64 bit accesses to the TTBRs can change the ASID and so we
1477 * must flush the TLB.
1478 */
1479 if (cpreg_field_is_64bit(ri)) {
1480 ARMCPU *cpu = arm_env_get_cpu(env);
1481
1482 tlb_flush(CPU(cpu), 1);
1483 }
1484 raw_write(env, ri, value);
1485 }
1486
1487 static const ARMCPRegInfo vmsa_cp_reginfo[] = {
1488 { .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
1489 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,
1490 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
1491 .resetfn = arm_cp_reset_ignore, },
1492 { .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
1493 .access = PL1_RW,
1494 .fieldoffset = offsetof(CPUARMState, cp15.ifsr_el2), .resetvalue = 0, },
1495 { .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
1496 .opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
1497 .access = PL1_RW,
1498 .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
1499 { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
1500 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
1501 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el1),
1502 .writefn = vmsa_ttbr_write, .resetvalue = 0 },
1503 { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
1504 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
1505 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el1),
1506 .writefn = vmsa_ttbr_write, .resetvalue = 0 },
1507 { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
1508 .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
1509 .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
1510 .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
1511 .fieldoffset = offsetof(CPUARMState, cp15.c2_control) },
1512 { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
1513 .access = PL1_RW, .type = ARM_CP_NO_MIGRATE, .writefn = vmsa_ttbcr_write,
1514 .resetfn = arm_cp_reset_ignore, .raw_writefn = vmsa_ttbcr_raw_write,
1515 .fieldoffset = offsetoflow32(CPUARMState, cp15.c2_control) },
1516 /* 64-bit FAR; this entry also gives us the AArch32 DFAR */
1517 { .name = "FAR_EL1", .state = ARM_CP_STATE_BOTH,
1518 .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
1519 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el1),
1520 .resetvalue = 0, },
1521 REGINFO_SENTINEL
1522 };
1523
1524 static void omap_ticonfig_write(CPUARMState *env, const ARMCPRegInfo *ri,
1525 uint64_t value)
1526 {
1527 env->cp15.c15_ticonfig = value & 0xe7;
1528 /* The OS_TYPE bit in this register changes the reported CPUID! */
1529 env->cp15.c0_cpuid = (value & (1 << 5)) ?
1530 ARM_CPUID_TI915T : ARM_CPUID_TI925T;
1531 }
1532
1533 static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
1534 uint64_t value)
1535 {
1536 env->cp15.c15_threadid = value & 0xffff;
1537 }
1538
1539 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
1540 uint64_t value)
1541 {
1542 /* Wait-for-interrupt (deprecated) */
1543 cpu_interrupt(CPU(arm_env_get_cpu(env)), CPU_INTERRUPT_HALT);
1544 }
1545
1546 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
1547 uint64_t value)
1548 {
1549 /* On OMAP there are registers indicating the max/min index of dcache lines
1550 * containing a dirty line; cache flush operations have to reset these.
1551 */
1552 env->cp15.c15_i_max = 0x000;
1553 env->cp15.c15_i_min = 0xff0;
1554 }
1555
1556 static const ARMCPRegInfo omap_cp_reginfo[] = {
1557 { .name = "DFSR", .cp = 15, .crn = 5, .crm = CP_ANY,
1558 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_OVERRIDE,
1559 .fieldoffset = offsetoflow32(CPUARMState, cp15.esr_el[1]),
1560 .resetvalue = 0, },
1561 { .name = "", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,
1562 .access = PL1_RW, .type = ARM_CP_NOP },
1563 { .name = "TICONFIG", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0,
1564 .access = PL1_RW,
1565 .fieldoffset = offsetof(CPUARMState, cp15.c15_ticonfig), .resetvalue = 0,
1566 .writefn = omap_ticonfig_write },
1567 { .name = "IMAX", .cp = 15, .crn = 15, .crm = 2, .opc1 = 0, .opc2 = 0,
1568 .access = PL1_RW,
1569 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_max), .resetvalue = 0, },
1570 { .name = "IMIN", .cp = 15, .crn = 15, .crm = 3, .opc1 = 0, .opc2 = 0,
1571 .access = PL1_RW, .resetvalue = 0xff0,
1572 .fieldoffset = offsetof(CPUARMState, cp15.c15_i_min) },
1573 { .name = "THREADID", .cp = 15, .crn = 15, .crm = 4, .opc1 = 0, .opc2 = 0,
1574 .access = PL1_RW,
1575 .fieldoffset = offsetof(CPUARMState, cp15.c15_threadid), .resetvalue = 0,
1576 .writefn = omap_threadid_write },
1577 { .name = "TI925T_STATUS", .cp = 15, .crn = 15,
1578 .crm = 8, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
1579 .type = ARM_CP_NO_MIGRATE,
1580 .readfn = arm_cp_read_zero, .writefn = omap_wfi_write, },
1581 /* TODO: Peripheral port remap register:
1582 * On OMAP2 mcr p15, 0, rn, c15, c2, 4 sets up the interrupt controller
1583 * base address at $rn & ~0xfff and map size of 0x200 << ($rn & 0xfff),
1584 * when MMU is off.
1585 */
1586 { .name = "OMAP_CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
1587 .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
1588 .type = ARM_CP_OVERRIDE | ARM_CP_NO_MIGRATE,
1589 .writefn = omap_cachemaint_write },
1590 { .name = "C9", .cp = 15, .crn = 9,
1591 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW,
1592 .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
1593 REGINFO_SENTINEL
1594 };
1595
1596 static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
1597 uint64_t value)
1598 {
1599 value &= 0x3fff;
1600 if (env->cp15.c15_cpar != value) {
1601 /* Changes cp0 to cp13 behavior, so needs a TB flush. */
1602 tb_flush(env);
1603 env->cp15.c15_cpar = value;
1604 }
1605 }
1606
1607 static const ARMCPRegInfo xscale_cp_reginfo[] = {
1608 { .name = "XSCALE_CPAR",
1609 .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
1610 .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
1611 .writefn = xscale_cpar_write, },
1612 { .name = "XSCALE_AUXCR",
1613 .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
1614 .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
1615 .resetvalue = 0, },
1616 /* XScale specific cache-lockdown: since we have no cache we NOP these
1617 * and hope the guest does not really rely on cache behaviour.
1618 */
1619 { .name = "XSCALE_LOCK_ICACHE_LINE",
1620 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
1621 .access = PL1_W, .type = ARM_CP_NOP },
1622 { .name = "XSCALE_UNLOCK_ICACHE",
1623 .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
1624 .access = PL1_W, .type = ARM_CP_NOP },
1625 { .name = "XSCALE_DCACHE_LOCK",
1626 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
1627 .access = PL1_RW, .type = ARM_CP_NOP },
1628 { .name = "XSCALE_UNLOCK_DCACHE",
1629 .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
1630 .access = PL1_W, .type = ARM_CP_NOP },
1631 REGINFO_SENTINEL
1632 };
1633
1634 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
1635 /* RAZ/WI the whole crn=15 space, when we don't have a more specific
1636 * implementation of this implementation-defined space.
1637 * Ideally this should eventually disappear in favour of actually
1638 * implementing the correct behaviour for all cores.
1639 */
1640 { .name = "C15_IMPDEF", .cp = 15, .crn = 15,
1641 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
1642 .access = PL1_RW,
1643 .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE | ARM_CP_OVERRIDE,
1644 .resetvalue = 0 },
1645 REGINFO_SENTINEL
1646 };
1647
1648 static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
1649 /* Cache status: RAZ because we have no cache so it's always clean */
1650 { .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
1651 .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1652 .resetvalue = 0 },
1653 REGINFO_SENTINEL
1654 };
1655
1656 static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
1657 /* We never have a a block transfer operation in progress */
1658 { .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
1659 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1660 .resetvalue = 0 },
1661 /* The cache ops themselves: these all NOP for QEMU */
1662 { .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
1663 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1664 { .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
1665 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1666 { .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
1667 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1668 { .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
1669 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1670 { .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
1671 .access = PL0_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1672 { .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
1673 .access = PL1_W, .type = ARM_CP_NOP|ARM_CP_64BIT },
1674 REGINFO_SENTINEL
1675 };
1676
1677 static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
1678 /* The cache test-and-clean instructions always return (1 << 30)
1679 * to indicate that there are no dirty cache lines.
1680 */
1681 { .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
1682 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1683 .resetvalue = (1 << 30) },
1684 { .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
1685 .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,
1686 .resetvalue = (1 << 30) },
1687 REGINFO_SENTINEL
1688 };
1689
1690 static const ARMCPRegInfo strongarm_cp_reginfo[] = {
1691 /* Ignore ReadBuffer accesses */
1692 { .name = "C9_READBUFFER", .cp = 15, .crn = 9,
1693 .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
1694 .access = PL1_RW, .resetvalue = 0,
1695 .type = ARM_CP_CONST | ARM_CP_OVERRIDE | ARM_CP_NO_MIGRATE },
1696 REGINFO_SENTINEL
1697 };
1698
1699 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1700 {
1701 CPUState *cs = CPU(arm_env_get_cpu(env));
1702 uint32_t mpidr = cs->cpu_index;
1703 /* We don't support setting cluster ID ([8..11]) (known as Aff1
1704 * in later ARM ARM versions), or any of the higher affinity level fields,
1705 * so these bits always RAZ.
1706 */
1707 if (arm_feature(env, ARM_FEATURE_V7MP)) {
1708 mpidr |= (1U << 31);
1709 /* Cores which are uniprocessor (non-coherent)
1710 * but still implement the MP extensions set
1711 * bit 30. (For instance, A9UP.) However we do
1712 * not currently model any of those cores.
1713 */
1714 }
1715 return mpidr;
1716 }
1717
1718 static const ARMCPRegInfo mpidr_cp_reginfo[] = {
1719 { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
1720 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
1721 .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_MIGRATE },
1722 REGINFO_SENTINEL
1723 };
1724
1725 static const ARMCPRegInfo lpae_cp_reginfo[] = {
1726 /* NOP AMAIR0/1: the override is because these clash with the rather
1727 * broadly specified TLB_LOCKDOWN entry in the generic cp_reginfo.
1728 */
1729 { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
1730 .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
1731 .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_OVERRIDE,
1732 .resetvalue = 0 },
1733 /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
1734 { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
1735 .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_OVERRIDE,
1736 .resetvalue = 0 },
1737 /* 64 bit access versions of the (dummy) debug registers */
1738 { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
1739 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
1740 { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
1741 .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
1742 { .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
1743 .access = PL1_RW, .type = ARM_CP_64BIT,
1744 .fieldoffset = offsetof(CPUARMState, cp15.par_el1), .resetvalue = 0 },
1745 { .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
1746 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE,
1747 .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el1),
1748 .writefn = vmsa_ttbr_write, .resetfn = arm_cp_reset_ignore },
1749 { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
1750 .access = PL1_RW, .type = ARM_CP_64BIT | ARM_CP_NO_MIGRATE,
1751 .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el1),
1752 .writefn = vmsa_ttbr_write, .resetfn = arm_cp_reset_ignore },
1753 REGINFO_SENTINEL
1754 };
1755
1756 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1757 {
1758 return vfp_get_fpcr(env);
1759 }
1760
1761 static void aa64_fpcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1762 uint64_t value)
1763 {
1764 vfp_set_fpcr(env, value);
1765 }
1766
1767 static uint64_t aa64_fpsr_read(CPUARMState *env, const ARMCPRegInfo *ri)
1768 {
1769 return vfp_get_fpsr(env);
1770 }
1771
1772 static void aa64_fpsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
1773 uint64_t value)
1774 {
1775 vfp_set_fpsr(env, value);
1776 }
1777
1778 static CPAccessResult aa64_daif_access(CPUARMState *env, const ARMCPRegInfo *ri)
1779 {
1780 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UMA)) {
1781 return CP_ACCESS_TRAP;
1782 }
1783 return CP_ACCESS_OK;
1784 }
1785
1786 static void aa64_daif_write(CPUARMState *env, const ARMCPRegInfo *ri,
1787 uint64_t value)
1788 {
1789 env->daif = value & PSTATE_DAIF;
1790 }
1791
1792 static CPAccessResult aa64_cacheop_access(CPUARMState *env,
1793 const ARMCPRegInfo *ri)
1794 {
1795 /* Cache invalidate/clean: NOP, but EL0 must UNDEF unless
1796 * SCTLR_EL1.UCI is set.
1797 */
1798 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UCI)) {
1799 return CP_ACCESS_TRAP;
1800 }
1801 return CP_ACCESS_OK;
1802 }
1803
1804 static void tlbi_aa64_va_write(CPUARMState *env, const ARMCPRegInfo *ri,
1805 uint64_t value)
1806 {
1807 /* Invalidate by VA (AArch64 version) */
1808 ARMCPU *cpu = arm_env_get_cpu(env);
1809 uint64_t pageaddr = value << 12;
1810 tlb_flush_page(CPU(cpu), pageaddr);
1811 }
1812
1813 static void tlbi_aa64_vaa_write(CPUARMState *env, const ARMCPRegInfo *ri,
1814 uint64_t value)
1815 {
1816 /* Invalidate by VA, all ASIDs (AArch64 version) */
1817 ARMCPU *cpu = arm_env_get_cpu(env);
1818 uint64_t pageaddr = value << 12;
1819 tlb_flush_page(CPU(cpu), pageaddr);
1820 }
1821
1822 static void tlbi_aa64_asid_write(CPUARMState *env, const ARMCPRegInfo *ri,
1823 uint64_t value)
1824 {
1825 /* Invalidate by ASID (AArch64 version) */
1826 ARMCPU *cpu = arm_env_get_cpu(env);
1827 int asid = extract64(value, 48, 16);
1828 tlb_flush(CPU(cpu), asid == 0);
1829 }
1830
1831 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri)
1832 {
1833 /* We don't implement EL2, so the only control on DC ZVA is the
1834 * bit in the SCTLR which can prohibit access for EL0.
1835 */
1836 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_DZE)) {
1837 return CP_ACCESS_TRAP;
1838 }
1839 return CP_ACCESS_OK;
1840 }
1841
1842 static uint64_t aa64_dczid_read(CPUARMState *env, const ARMCPRegInfo *ri)
1843 {
1844 ARMCPU *cpu = arm_env_get_cpu(env);
1845 int dzp_bit = 1 << 4;
1846
1847 /* DZP indicates whether DC ZVA access is allowed */
1848 if (aa64_zva_access(env, NULL) != CP_ACCESS_OK) {
1849 dzp_bit = 0;
1850 }
1851 return cpu->dcz_blocksize | dzp_bit;
1852 }
1853
1854 static CPAccessResult sp_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
1855 {
1856 if (!env->pstate & PSTATE_SP) {
1857 /* Access to SP_EL0 is undefined if it's being used as
1858 * the stack pointer.
1859 */
1860 return CP_ACCESS_TRAP_UNCATEGORIZED;
1861 }
1862 return CP_ACCESS_OK;
1863 }
1864
1865 static uint64_t spsel_read(CPUARMState *env, const ARMCPRegInfo *ri)
1866 {
1867 return env->pstate & PSTATE_SP;
1868 }
1869
1870 static void spsel_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
1871 {
1872 update_spsel(env, val);
1873 }
1874
1875 static const ARMCPRegInfo v8_cp_reginfo[] = {
1876 /* Minimal set of EL0-visible registers. This will need to be expanded
1877 * significantly for system emulation of AArch64 CPUs.
1878 */
1879 { .name = "NZCV", .state = ARM_CP_STATE_AA64,
1880 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
1881 .access = PL0_RW, .type = ARM_CP_NZCV },
1882 { .name = "DAIF", .state = ARM_CP_STATE_AA64,
1883 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
1884 .type = ARM_CP_NO_MIGRATE,
1885 .access = PL0_RW, .accessfn = aa64_daif_access,
1886 .fieldoffset = offsetof(CPUARMState, daif),
1887 .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
1888 { .name = "FPCR", .state = ARM_CP_STATE_AA64,
1889 .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
1890 .access = PL0_RW, .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
1891 { .name = "FPSR", .state = ARM_CP_STATE_AA64,
1892 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
1893 .access = PL0_RW, .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
1894 { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
1895 .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
1896 .access = PL0_R, .type = ARM_CP_NO_MIGRATE,
1897 .readfn = aa64_dczid_read },
1898 { .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
1899 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
1900 .access = PL0_W, .type = ARM_CP_DC_ZVA,
1901 #ifndef CONFIG_USER_ONLY
1902 /* Avoid overhead of an access check that always passes in user-mode */
1903 .accessfn = aa64_zva_access,
1904 #endif
1905 },
1906 { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
1907 .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
1908 .access = PL1_R, .type = ARM_CP_CURRENTEL },
1909 /* Cache ops: all NOPs since we don't emulate caches */
1910 { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
1911 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
1912 .access = PL1_W, .type = ARM_CP_NOP },
1913 { .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
1914 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
1915 .access = PL1_W, .type = ARM_CP_NOP },
1916 { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
1917 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
1918 .access = PL0_W, .type = ARM_CP_NOP,
1919 .accessfn = aa64_cacheop_access },
1920 { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
1921 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
1922 .access = PL1_W, .type = ARM_CP_NOP },
1923 { .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
1924 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
1925 .access = PL1_W, .type = ARM_CP_NOP },
1926 { .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
1927 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
1928 .access = PL0_W, .type = ARM_CP_NOP,
1929 .accessfn = aa64_cacheop_access },
1930 { .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
1931 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
1932 .access = PL1_W, .type = ARM_CP_NOP },
1933 { .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
1934 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
1935 .access = PL0_W, .type = ARM_CP_NOP,
1936 .accessfn = aa64_cacheop_access },
1937 { .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
1938 .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
1939 .access = PL0_W, .type = ARM_CP_NOP,
1940 .accessfn = aa64_cacheop_access },
1941 { .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
1942 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
1943 .access = PL1_W, .type = ARM_CP_NOP },
1944 /* TLBI operations */
1945 { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
1946 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
1947 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1948 .writefn = tlbiall_write },
1949 { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
1950 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
1951 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1952 .writefn = tlbi_aa64_va_write },
1953 { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
1954 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
1955 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1956 .writefn = tlbi_aa64_asid_write },
1957 { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
1958 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
1959 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1960 .writefn = tlbi_aa64_vaa_write },
1961 { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
1962 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
1963 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1964 .writefn = tlbi_aa64_va_write },
1965 { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
1966 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
1967 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1968 .writefn = tlbi_aa64_vaa_write },
1969 { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
1970 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
1971 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1972 .writefn = tlbiall_write },
1973 { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
1974 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
1975 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1976 .writefn = tlbi_aa64_va_write },
1977 { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
1978 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
1979 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1980 .writefn = tlbi_aa64_asid_write },
1981 { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
1982 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
1983 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1984 .writefn = tlbi_aa64_vaa_write },
1985 { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
1986 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
1987 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1988 .writefn = tlbi_aa64_va_write },
1989 { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
1990 .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
1991 .access = PL1_W, .type = ARM_CP_NO_MIGRATE,
1992 .writefn = tlbi_aa64_vaa_write },
1993 #ifndef CONFIG_USER_ONLY
1994 /* 64 bit address translation operations */
1995 { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
1996 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
1997 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
1998 { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
1999 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
2000 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2001 { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
2002 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
2003 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2004 { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
2005 .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
2006 .access = PL1_W, .type = ARM_CP_NO_MIGRATE, .writefn = ats_write },
2007 #endif
2008 /* 32 bit TLB invalidates, Inner Shareable */
2009 { .name = "TLBIALLIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
2010 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
2011 { .name = "TLBIMVAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
2012 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
2013 { .name = "TLBIASIDIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
2014 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
2015 { .name = "TLBIMVAAIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
2016 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimvaa_write },
2017 { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
2018 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
2019 { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
2020 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimvaa_write },
2021 /* 32 bit ITLB invalidates */
2022 { .name = "ITLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 0,
2023 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
2024 { .name = "ITLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
2025 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
2026 { .name = "ITLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 2,
2027 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
2028 /* 32 bit DTLB invalidates */
2029 { .name = "DTLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 0,
2030 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
2031 { .name = "DTLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
2032 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
2033 { .name = "DTLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 2,
2034 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
2035 /* 32 bit TLB invalidates */
2036 { .name = "TLBIALL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
2037 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiall_write },
2038 { .name = "TLBIMVA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
2039 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
2040 { .name = "TLBIASID", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
2041 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbiasid_write },
2042 { .name = "TLBIMVAA", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
2043 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimvaa_write },
2044 { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
2045 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimva_write },
2046 { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
2047 .type = ARM_CP_NO_MIGRATE, .access = PL1_W, .writefn = tlbimvaa_write },
2048 /* 32 bit cache operations */
2049 { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
2050 .type = ARM_CP_NOP, .access = PL1_W },
2051 { .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
2052 .type = ARM_CP_NOP, .access = PL1_W },
2053 { .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
2054 .type = ARM_CP_NOP, .access = PL1_W },
2055 { .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
2056 .type = ARM_CP_NOP, .access = PL1_W },
2057 { .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
2058 .type = ARM_CP_NOP, .access = PL1_W },
2059 { .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
2060 .type = ARM_CP_NOP, .access = PL1_W },
2061 { .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
2062 .type = ARM_CP_NOP, .access = PL1_W },
2063 { .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
2064 .type = ARM_CP_NOP, .access = PL1_W },
2065 { .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
2066 .type = ARM_CP_NOP, .access = PL1_W },
2067 { .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
2068 .type = ARM_CP_NOP, .access = PL1_W },
2069 { .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
2070 .type = ARM_CP_NOP, .access = PL1_W },
2071 { .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
2072 .type = ARM_CP_NOP, .access = PL1_W },
2073 { .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
2074 .type = ARM_CP_NOP, .access = PL1_W },
2075 /* MMU Domain access control / MPU write buffer control */
2076 { .name = "DACR", .cp = 15,
2077 .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
2078 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c3),
2079 .resetvalue = 0, .writefn = dacr_write, .raw_writefn = raw_write, },
2080 /* Dummy implementation of monitor debug system control register:
2081 * we don't support debug.
2082 */
2083 { .name = "MDSCR_EL1", .state = ARM_CP_STATE_AA64,
2084 .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
2085 .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
2086 /* We define a dummy WI OSLAR_EL1, because Linux writes to it. */
2087 { .name = "OSLAR_EL1", .state = ARM_CP_STATE_AA64,
2088 .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
2089 .access = PL1_W, .type = ARM_CP_NOP },
2090 { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
2091 .type = ARM_CP_NO_MIGRATE,
2092 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
2093 .access = PL1_RW,
2094 .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
2095 { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
2096 .type = ARM_CP_NO_MIGRATE,
2097 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
2098 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[0]) },
2099 /* We rely on the access checks not allowing the guest to write to the
2100 * state field when SPSel indicates that it's being used as the stack
2101 * pointer.
2102 */
2103 { .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
2104 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
2105 .access = PL1_RW, .accessfn = sp_el0_access,
2106 .type = ARM_CP_NO_MIGRATE,
2107 .fieldoffset = offsetof(CPUARMState, sp_el[0]) },
2108 { .name = "SPSel", .state = ARM_CP_STATE_AA64,
2109 .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
2110 .type = ARM_CP_NO_MIGRATE,
2111 .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
2112 REGINFO_SENTINEL
2113 };
2114
2115 /* Used to describe the behaviour of EL2 regs when EL2 does not exist. */
2116 static const ARMCPRegInfo v8_el3_no_el2_cp_reginfo[] = {
2117 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
2118 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
2119 .access = PL2_RW,
2120 .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
2121 REGINFO_SENTINEL
2122 };
2123
2124 static const ARMCPRegInfo v8_el2_cp_reginfo[] = {
2125 { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
2126 .type = ARM_CP_NO_MIGRATE,
2127 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
2128 .access = PL2_RW,
2129 .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
2130 { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
2131 .type = ARM_CP_NO_MIGRATE,
2132 .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
2133 .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[6]) },
2134 { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
2135 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
2136 .access = PL2_RW, .writefn = vbar_write,
2137 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
2138 .resetvalue = 0 },
2139 REGINFO_SENTINEL
2140 };
2141
2142 static const ARMCPRegInfo v8_el3_cp_reginfo[] = {
2143 { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
2144 .type = ARM_CP_NO_MIGRATE,
2145 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
2146 .access = PL3_RW,
2147 .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
2148 { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
2149 .type = ARM_CP_NO_MIGRATE,
2150 .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
2151 .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, banked_spsr[7]) },
2152 { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
2153 .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
2154 .access = PL3_RW, .writefn = vbar_write,
2155 .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
2156 .resetvalue = 0 },
2157 REGINFO_SENTINEL
2158 };
2159
2160 static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
2161 uint64_t value)
2162 {
2163 ARMCPU *cpu = arm_env_get_cpu(env);
2164
2165 if (raw_read(env, ri) == value) {
2166 /* Skip the TLB flush if nothing actually changed; Linux likes
2167 * to do a lot of pointless SCTLR writes.
2168 */
2169 return;
2170 }
2171
2172 raw_write(env, ri, value);
2173 /* ??? Lots of these bits are not implemented. */
2174 /* This may enable/disable the MMU, so do a TLB flush. */
2175 tlb_flush(CPU(cpu), 1);
2176 }
2177
2178 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri)
2179 {
2180 /* Only accessible in EL0 if SCTLR.UCT is set (and only in AArch64,
2181 * but the AArch32 CTR has its own reginfo struct)
2182 */
2183 if (arm_current_pl(env) == 0 && !(env->cp15.c1_sys & SCTLR_UCT)) {
2184 return CP_ACCESS_TRAP;
2185 }
2186 return CP_ACCESS_OK;
2187 }
2188
2189 static void define_aarch64_debug_regs(ARMCPU *cpu)
2190 {
2191 /* Define breakpoint and watchpoint registers. These do nothing
2192 * but read as written, for now.
2193 */
2194 int i;
2195
2196 for (i = 0; i < 16; i++) {
2197 ARMCPRegInfo dbgregs[] = {
2198 { .name = "DBGBVR", .state = ARM_CP_STATE_AA64,
2199 .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
2200 .access = PL1_RW,
2201 .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]) },
2202 { .name = "DBGBCR", .state = ARM_CP_STATE_AA64,
2203 .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
2204 .access = PL1_RW,
2205 .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]) },
2206 { .name = "DBGWVR", .state = ARM_CP_STATE_AA64,
2207 .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
2208 .access = PL1_RW,
2209 .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]) },
2210 { .name = "DBGWCR", .state = ARM_CP_STATE_AA64,
2211 .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
2212 .access = PL1_RW,
2213 .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]) },
2214 REGINFO_SENTINEL
2215 };
2216 define_arm_cp_regs(cpu, dbgregs);
2217 }
2218 }
2219
2220 void register_cp_regs_for_features(ARMCPU *cpu)
2221 {
2222 /* Register all the coprocessor registers based on feature bits */
2223 CPUARMState *env = &cpu->env;
2224 if (arm_feature(env, ARM_FEATURE_M)) {
2225 /* M profile has no coprocessor registers */
2226 return;
2227 }
2228
2229 define_arm_cp_regs(cpu, cp_reginfo);
2230 if (!arm_feature(env, ARM_FEATURE_V8)) {
2231 /* Must go early as it is full of wildcards that may be
2232 * overridden by later definitions.
2233 */
2234 define_arm_cp_regs(cpu, not_v8_cp_reginfo);
2235 }
2236
2237 if (arm_feature(env, ARM_FEATURE_V6)) {
2238 /* The ID registers all have impdef reset values */
2239 ARMCPRegInfo v6_idregs[] = {
2240 { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
2241 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
2242 .access = PL1_R, .type = ARM_CP_CONST,
2243 .resetvalue = cpu->id_pfr0 },
2244 { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
2245 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
2246 .access = PL1_R, .type = ARM_CP_CONST,
2247 .resetvalue = cpu->id_pfr1 },
2248 { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
2249 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
2250 .access = PL1_R, .type = ARM_CP_CONST,
2251 .resetvalue = cpu->id_dfr0 },
2252 { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
2253 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
2254 .access = PL1_R, .type = ARM_CP_CONST,
2255 .resetvalue = cpu->id_afr0 },
2256 { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
2257 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
2258 .access = PL1_R, .type = ARM_CP_CONST,
2259 .resetvalue = cpu->id_mmfr0 },
2260 { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
2261 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
2262 .access = PL1_R, .type = ARM_CP_CONST,
2263 .resetvalue = cpu->id_mmfr1 },
2264 { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
2265 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
2266 .access = PL1_R, .type = ARM_CP_CONST,
2267 .resetvalue = cpu->id_mmfr2 },
2268 { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
2269 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
2270 .access = PL1_R, .type = ARM_CP_CONST,
2271 .resetvalue = cpu->id_mmfr3 },
2272 { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
2273 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
2274 .access = PL1_R, .type = ARM_CP_CONST,
2275 .resetvalue = cpu->id_isar0 },
2276 { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
2277 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
2278 .access = PL1_R, .type = ARM_CP_CONST,
2279 .resetvalue = cpu->id_isar1 },
2280 { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
2281 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
2282 .access = PL1_R, .type = ARM_CP_CONST,
2283 .resetvalue = cpu->id_isar2 },
2284 { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
2285 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
2286 .access = PL1_R, .type = ARM_CP_CONST,
2287 .resetvalue = cpu->id_isar3 },
2288 { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
2289 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
2290 .access = PL1_R, .type = ARM_CP_CONST,
2291 .resetvalue = cpu->id_isar4 },
2292 { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
2293 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
2294 .access = PL1_R, .type = ARM_CP_CONST,
2295 .resetvalue = cpu->id_isar5 },
2296 /* 6..7 are as yet unallocated and must RAZ */
2297 { .name = "ID_ISAR6", .cp = 15, .crn = 0, .crm = 2,
2298 .opc1 = 0, .opc2 = 6, .access = PL1_R, .type = ARM_CP_CONST,
2299 .resetvalue = 0 },
2300 { .name = "ID_ISAR7", .cp = 15, .crn = 0, .crm = 2,
2301 .opc1 = 0, .opc2 = 7, .access = PL1_R, .type = ARM_CP_CONST,
2302 .resetvalue = 0 },
2303 REGINFO_SENTINEL
2304 };
2305 define_arm_cp_regs(cpu, v6_idregs);
2306 define_arm_cp_regs(cpu, v6_cp_reginfo);
2307 } else {
2308 define_arm_cp_regs(cpu, not_v6_cp_reginfo);
2309 }
2310 if (arm_feature(env, ARM_FEATURE_V6K)) {
2311 define_arm_cp_regs(cpu, v6k_cp_reginfo);
2312 }
2313 if (arm_feature(env, ARM_FEATURE_V7)) {
2314 /* v7 performance monitor control register: same implementor
2315 * field as main ID register, and we implement only the cycle
2316 * count register.
2317 */
2318 #ifndef CONFIG_USER_ONLY
2319 ARMCPRegInfo pmcr = {
2320 .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
2321 .access = PL0_RW, .resetvalue = cpu->midr & 0xff000000,
2322 .type = ARM_CP_IO,
2323 .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
2324 .accessfn = pmreg_access, .writefn = pmcr_write,
2325 .raw_writefn = raw_write,
2326 };
2327 define_one_arm_cp_reg(cpu, &pmcr);
2328 #endif
2329 ARMCPRegInfo clidr = {
2330 .name = "CLIDR", .state = ARM_CP_STATE_BOTH,
2331 .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 1,
2332 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->clidr
2333 };
2334 define_one_arm_cp_reg(cpu, &clidr);
2335 define_arm_cp_regs(cpu, v7_cp_reginfo);
2336 } else {
2337 define_arm_cp_regs(cpu, not_v7_cp_reginfo);
2338 }
2339 if (arm_feature(env, ARM_FEATURE_V8)) {
2340 /* AArch64 ID registers, which all have impdef reset values */
2341 ARMCPRegInfo v8_idregs[] = {
2342 { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
2343 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
2344 .access = PL1_R, .type = ARM_CP_CONST,
2345 .resetvalue = cpu->id_aa64pfr0 },
2346 { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
2347 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
2348 .access = PL1_R, .type = ARM_CP_CONST,
2349 .resetvalue = cpu->id_aa64pfr1},
2350 { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
2351 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
2352 .access = PL1_R, .type = ARM_CP_CONST,
2353 /* We mask out the PMUVer field, because we don't currently
2354 * implement the PMU. Not advertising it prevents the guest
2355 * from trying to use it and getting UNDEFs on registers we
2356 * don't implement.
2357 */
2358 .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
2359 { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
2360 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
2361 .access = PL1_R, .type = ARM_CP_CONST,
2362 .resetvalue = cpu->id_aa64dfr1 },
2363 { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
2364 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
2365 .access = PL1_R, .type = ARM_CP_CONST,
2366 .resetvalue = cpu->id_aa64afr0 },
2367 { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
2368 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
2369 .access = PL1_R, .type = ARM_CP_CONST,
2370 .resetvalue = cpu->id_aa64afr1 },
2371 { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
2372 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
2373 .access = PL1_R, .type = ARM_CP_CONST,
2374 .resetvalue = cpu->id_aa64isar0 },
2375 { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
2376 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
2377 .access = PL1_R, .type = ARM_CP_CONST,
2378 .resetvalue = cpu->id_aa64isar1 },
2379 { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
2380 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
2381 .access = PL1_R, .type = ARM_CP_CONST,
2382 .resetvalue = cpu->id_aa64mmfr0 },
2383 { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
2384 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
2385 .access = PL1_R, .type = ARM_CP_CONST,
2386 .resetvalue = cpu->id_aa64mmfr1 },
2387 { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
2388 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
2389 .access = PL1_R, .type = ARM_CP_CONST,
2390 .resetvalue = cpu->mvfr0 },
2391 { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
2392 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
2393 .access = PL1_R, .type = ARM_CP_CONST,
2394 .resetvalue = cpu->mvfr1 },
2395 { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
2396 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
2397 .access = PL1_R, .type = ARM_CP_CONST,
2398 .resetvalue = cpu->mvfr2 },
2399 REGINFO_SENTINEL
2400 };
2401 ARMCPRegInfo rvbar = {
2402 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
2403 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 2,
2404 .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
2405 };
2406 define_one_arm_cp_reg(cpu, &rvbar);
2407 define_arm_cp_regs(cpu, v8_idregs);
2408 define_arm_cp_regs(cpu, v8_cp_reginfo);
2409 define_aarch64_debug_regs(cpu);
2410 }
2411 if (arm_feature(env, ARM_FEATURE_EL2)) {
2412 define_arm_cp_regs(cpu, v8_el2_cp_reginfo);
2413 } else {
2414 /* If EL2 is missing but higher ELs are enabled, we need to
2415 * register the no_el2 reginfos.
2416 */
2417 if (arm_feature(env, ARM_FEATURE_EL3)) {
2418 define_arm_cp_regs(cpu, v8_el3_no_el2_cp_reginfo);
2419 }
2420 }
2421 if (arm_feature(env, ARM_FEATURE_EL3)) {
2422 define_arm_cp_regs(cpu, v8_el3_cp_reginfo);
2423 }
2424 if (arm_feature(env, ARM_FEATURE_MPU)) {
2425 /* These are the MPU registers prior to PMSAv6. Any new
2426 * PMSA core later than the ARM946 will require that we
2427 * implement the PMSAv6 or PMSAv7 registers, which are
2428 * completely different.
2429 */
2430 assert(!arm_feature(env, ARM_FEATURE_V6));
2431 define_arm_cp_regs(cpu, pmsav5_cp_reginfo);
2432 } else {
2433 define_arm_cp_regs(cpu, vmsa_cp_reginfo);
2434 }
2435 if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
2436 define_arm_cp_regs(cpu, t2ee_cp_reginfo);
2437 }
2438 if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
2439 define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
2440 }
2441 if (arm_feature(env, ARM_FEATURE_VAPA)) {
2442 define_arm_cp_regs(cpu, vapa_cp_reginfo);
2443 }
2444 if (arm_feature(env, ARM_FEATURE_CACHE_TEST_CLEAN)) {
2445 define_arm_cp_regs(cpu, cache_test_clean_cp_reginfo);
2446 }
2447 if (arm_feature(env, ARM_FEATURE_CACHE_DIRTY_REG)) {
2448 define_arm_cp_regs(cpu, cache_dirty_status_cp_reginfo);
2449 }
2450 if (arm_feature(env, ARM_FEATURE_CACHE_BLOCK_OPS)) {
2451 define_arm_cp_regs(cpu, cache_block_ops_cp_reginfo);
2452 }
2453 if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
2454 define_arm_cp_regs(cpu, omap_cp_reginfo);
2455 }
2456 if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
2457 define_arm_cp_regs(cpu, strongarm_cp_reginfo);
2458 }
2459 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
2460 define_arm_cp_regs(cpu, xscale_cp_reginfo);
2461 }
2462 if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
2463 define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
2464 }
2465 if (arm_feature(env, ARM_FEATURE_LPAE)) {
2466 define_arm_cp_regs(cpu, lpae_cp_reginfo);
2467 }
2468 /* Slightly awkwardly, the OMAP and StrongARM cores need all of
2469 * cp15 crn=0 to be writes-ignored, whereas for other cores they should
2470 * be read-only (ie write causes UNDEF exception).
2471 */
2472 {
2473 ARMCPRegInfo id_pre_v8_midr_cp_reginfo[] = {
2474 /* Pre-v8 MIDR space.
2475 * Note that the MIDR isn't a simple constant register because
2476 * of the TI925 behaviour where writes to another register can
2477 * cause the MIDR value to change.
2478 *
2479 * Unimplemented registers in the c15 0 0 0 space default to
2480 * MIDR. Define MIDR first as this entire space, then CTR, TCMTR
2481 * and friends override accordingly.
2482 */
2483 { .name = "MIDR",
2484 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = CP_ANY,
2485 .access = PL1_R, .resetvalue = cpu->midr,
2486 .writefn = arm_cp_write_ignore, .raw_writefn = raw_write,
2487 .fieldoffset = offsetof(CPUARMState, cp15.c0_cpuid),
2488 .type = ARM_CP_OVERRIDE },
2489 /* crn = 0 op1 = 0 crm = 3..7 : currently unassigned; we RAZ. */
2490 { .name = "DUMMY",
2491 .cp = 15, .crn = 0, .crm = 3, .opc1 = 0, .opc2 = CP_ANY,
2492 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2493 { .name = "DUMMY",
2494 .cp = 15, .crn = 0, .crm = 4, .opc1 = 0, .opc2 = CP_ANY,
2495 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2496 { .name = "DUMMY",
2497 .cp = 15, .crn = 0, .crm = 5, .opc1 = 0, .opc2 = CP_ANY,
2498 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2499 { .name = "DUMMY",
2500 .cp = 15, .crn = 0, .crm = 6, .opc1 = 0, .opc2 = CP_ANY,
2501 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2502 { .name = "DUMMY",
2503 .cp = 15, .crn = 0, .crm = 7, .opc1 = 0, .opc2 = CP_ANY,
2504 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2505 REGINFO_SENTINEL
2506 };
2507 ARMCPRegInfo id_v8_midr_cp_reginfo[] = {
2508 /* v8 MIDR -- the wildcard isn't necessary, and nor is the
2509 * variable-MIDR TI925 behaviour. Instead we have a single
2510 * (strictly speaking IMPDEF) alias of the MIDR, REVIDR.
2511 */
2512 { .name = "MIDR_EL1", .state = ARM_CP_STATE_BOTH,
2513 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 0,
2514 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->midr },
2515 { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
2516 .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
2517 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->midr },
2518 REGINFO_SENTINEL
2519 };
2520 ARMCPRegInfo id_cp_reginfo[] = {
2521 /* These are common to v8 and pre-v8 */
2522 { .name = "CTR",
2523 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 1,
2524 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
2525 { .name = "CTR_EL0", .state = ARM_CP_STATE_AA64,
2526 .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 0, .crm = 0,
2527 .access = PL0_R, .accessfn = ctr_el0_access,
2528 .type = ARM_CP_CONST, .resetvalue = cpu->ctr },
2529 /* TCMTR and TLBTR exist in v8 but have no 64-bit versions */
2530 { .name = "TCMTR",
2531 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
2532 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2533 { .name = "TLBTR",
2534 .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
2535 .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },
2536 REGINFO_SENTINEL
2537 };
2538 ARMCPRegInfo crn0_wi_reginfo = {
2539 .name = "CRN0_WI", .cp = 15, .crn = 0, .crm = CP_ANY,
2540 .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
2541 .type = ARM_CP_NOP | ARM_CP_OVERRIDE
2542 };
2543 if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
2544 arm_feature(env, ARM_FEATURE_STRONGARM)) {
2545 ARMCPRegInfo *r;
2546 /* Register the blanket "writes ignored" value first to cover the
2547 * whole space. Then update the specific ID registers to allow write
2548 * access, so that they ignore writes rather than causing them to
2549 * UNDEF.
2550 */
2551 define_one_arm_cp_reg(cpu, &crn0_wi_reginfo);
2552 for (r = id_pre_v8_midr_cp_reginfo;
2553 r->type != ARM_CP_SENTINEL; r++) {
2554 r->access = PL1_RW;
2555 }
2556 for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
2557 r->access = PL1_RW;
2558 }
2559 }
2560 if (arm_feature(env, ARM_FEATURE_V8)) {
2561 define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
2562 } else {
2563 define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
2564 }
2565 define_arm_cp_regs(cpu, id_cp_reginfo);
2566 }
2567
2568 if (arm_feature(env, ARM_FEATURE_MPIDR)) {
2569 define_arm_cp_regs(cpu, mpidr_cp_reginfo);
2570 }
2571
2572 if (arm_feature(env, ARM_FEATURE_AUXCR)) {
2573 ARMCPRegInfo auxcr = {
2574 .name = "ACTLR_EL1", .state = ARM_CP_STATE_BOTH,
2575 .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 1,
2576 .access = PL1_RW, .type = ARM_CP_CONST,
2577 .resetvalue = cpu->reset_auxcr
2578 };
2579 define_one_arm_cp_reg(cpu, &auxcr);
2580 }
2581
2582 if (arm_feature(env, ARM_FEATURE_CBAR)) {
2583 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
2584 /* 32 bit view is [31:18] 0...0 [43:32]. */
2585 uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
2586 | extract64(cpu->reset_cbar, 32, 12);
2587 ARMCPRegInfo cbar_reginfo[] = {
2588 { .name = "CBAR",
2589 .type = ARM_CP_CONST,
2590 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
2591 .access = PL1_R, .resetvalue = cpu->reset_cbar },
2592 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
2593 .type = ARM_CP_CONST,
2594 .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
2595 .access = PL1_R, .resetvalue = cbar32 },
2596 REGINFO_SENTINEL
2597 };
2598 /* We don't implement a r/w 64 bit CBAR currently */
2599 assert(arm_feature(env, ARM_FEATURE_CBAR_RO));
2600 define_arm_cp_regs(cpu, cbar_reginfo);
2601 } else {
2602 ARMCPRegInfo cbar = {
2603 .name = "CBAR",
2604 .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
2605 .access = PL1_R|PL3_W, .resetvalue = cpu->reset_cbar,
2606 .fieldoffset = offsetof(CPUARMState,
2607 cp15.c15_config_base_address)
2608 };
2609 if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
2610 cbar.access = PL1_R;
2611 cbar.fieldoffset = 0;
2612 cbar.type = ARM_CP_CONST;
2613 }
2614 define_one_arm_cp_reg(cpu, &cbar);
2615 }
2616 }
2617
2618 /* Generic registers whose values depend on the implementation */
2619 {
2620 ARMCPRegInfo sctlr = {
2621 .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
2622 .opc0 = 3, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
2623 .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_sys),
2624 .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
2625 .raw_writefn = raw_write,
2626 };
2627 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
2628 /* Normally we would always end the TB on an SCTLR write, but Linux
2629 * arch/arm/mach-pxa/sleep.S expects two instructions following
2630 * an MMU enable to execute from cache. Imitate this behaviour.
2631 */
2632 sctlr.type |= ARM_CP_SUPPRESS_TB_END;
2633 }
2634 define_one_arm_cp_reg(cpu, &sctlr);
2635 }
2636 }
2637
2638 ARMCPU *cpu_arm_init(const char *cpu_model)
2639 {
2640 return ARM_CPU(cpu_generic_init(TYPE_ARM_CPU, cpu_model));
2641 }
2642
2643 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
2644 {
2645 CPUState *cs = CPU(cpu);
2646 CPUARMState *env = &cpu->env;
2647
2648 if (arm_feature(env, ARM_FEATURE_AARCH64)) {
2649 gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
2650 aarch64_fpu_gdb_set_reg,
2651 34, "aarch64-fpu.xml", 0);
2652 } else if (arm_feature(env, ARM_FEATURE_NEON)) {
2653 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
2654 51, "arm-neon.xml", 0);
2655 } else if (arm_feature(env, ARM_FEATURE_VFP3)) {
2656 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
2657 35, "arm-vfp3.xml", 0);
2658 } else if (arm_feature(env, ARM_FEATURE_VFP)) {
2659 gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
2660 19, "arm-vfp.xml", 0);
2661 }
2662 }
2663
2664 /* Sort alphabetically by type name, except for "any". */
2665 static gint arm_cpu_list_compare(gconstpointer a, gconstpointer b)
2666 {
2667 ObjectClass *class_a = (ObjectClass *)a;
2668 ObjectClass *class_b = (ObjectClass *)b;
2669 const char *name_a, *name_b;
2670
2671 name_a = object_class_get_name(class_a);
2672 name_b = object_class_get_name(class_b);
2673 if (strcmp(name_a, "any-" TYPE_ARM_CPU) == 0) {
2674 return 1;
2675 } else if (strcmp(name_b, "any-" TYPE_ARM_CPU) == 0) {
2676 return -1;
2677 } else {
2678 return strcmp(name_a, name_b);
2679 }
2680 }
2681
2682 static void arm_cpu_list_entry(gpointer data, gpointer user_data)
2683 {
2684 ObjectClass *oc = data;
2685 CPUListState *s = user_data;
2686 const char *typename;
2687 char *name;
2688
2689 typename = object_class_get_name(oc);
2690 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_ARM_CPU));
2691 (*s->cpu_fprintf)(s->file, " %s\n",
2692 name);
2693 g_free(name);
2694 }
2695
2696 void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf)
2697 {
2698 CPUListState s = {
2699 .file = f,
2700 .cpu_fprintf = cpu_fprintf,
2701 };
2702 GSList *list;
2703
2704 list = object_class_get_list(TYPE_ARM_CPU, false);
2705 list = g_slist_sort(list, arm_cpu_list_compare);
2706 (*cpu_fprintf)(f, "Available CPUs:\n");
2707 g_slist_foreach(list, arm_cpu_list_entry, &s);
2708 g_slist_free(list);
2709 #ifdef CONFIG_KVM
2710 /* The 'host' CPU type is dynamically registered only if KVM is
2711 * enabled, so we have to special-case it here:
2712 */
2713 (*cpu_fprintf)(f, " host (only available in KVM mode)\n");
2714 #endif
2715 }
2716
2717 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
2718 {
2719 ObjectClass *oc = data;
2720 CpuDefinitionInfoList **cpu_list = user_data;
2721 CpuDefinitionInfoList *entry;
2722 CpuDefinitionInfo *info;
2723 const char *typename;
2724
2725 typename = object_class_get_name(oc);
2726 info = g_malloc0(sizeof(*info));
2727 info->name = g_strndup(typename,
2728 strlen(typename) - strlen("-" TYPE_ARM_CPU));
2729
2730 entry = g_malloc0(sizeof(*entry));
2731 entry->value = info;
2732 entry->next = *cpu_list;
2733 *cpu_list = entry;
2734 }
2735
2736 CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp)
2737 {
2738 CpuDefinitionInfoList *cpu_list = NULL;
2739 GSList *list;
2740
2741 list = object_class_get_list(TYPE_ARM_CPU, false);
2742 g_slist_foreach(list, arm_cpu_add_definition, &cpu_list);
2743 g_slist_free(list);
2744
2745 return cpu_list;
2746 }
2747
2748 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
2749 void *opaque, int state,
2750 int crm, int opc1, int opc2)
2751 {
2752 /* Private utility function for define_one_arm_cp_reg_with_opaque():
2753 * add a single reginfo struct to the hash table.
2754 */
2755 uint32_t *key = g_new(uint32_t, 1);
2756 ARMCPRegInfo *r2 = g_memdup(r, sizeof(ARMCPRegInfo));
2757 int is64 = (r->type & ARM_CP_64BIT) ? 1 : 0;
2758 if (r->state == ARM_CP_STATE_BOTH && state == ARM_CP_STATE_AA32) {
2759 /* The AArch32 view of a shared register sees the lower 32 bits
2760 * of a 64 bit backing field. It is not migratable as the AArch64
2761 * view handles that. AArch64 also handles reset.
2762 * We assume it is a cp15 register.
2763 */
2764 r2->cp = 15;
2765 r2->type |= ARM_CP_NO_MIGRATE;
2766 r2->resetfn = arm_cp_reset_ignore;
2767 #ifdef HOST_WORDS_BIGENDIAN
2768 if (r2->fieldoffset) {
2769 r2->fieldoffset += sizeof(uint32_t);
2770 }
2771 #endif
2772 }
2773 if (state == ARM_CP_STATE_AA64) {
2774 /* To allow abbreviation of ARMCPRegInfo
2775 * definitions, we treat cp == 0 as equivalent to
2776 * the value for "standard guest-visible sysreg".
2777 */
2778 if (r->cp == 0) {
2779 r2->cp = CP_REG_ARM64_SYSREG_CP;
2780 }
2781 *key = ENCODE_AA64_CP_REG(r2->cp, r2->crn, crm,
2782 r2->opc0, opc1, opc2);
2783 } else {
2784 *key = ENCODE_CP_REG(r2->cp, is64, r2->crn, crm, opc1, opc2);
2785 }
2786 if (opaque) {
2787 r2->opaque = opaque;
2788 }