helper.c · samitouri/QOSamiQemu · siGit Code & Deploy

Code Commits Issues Pulls Sessions CI/CD

master

c 10,442 lines 373 KB

Raw

1	/*
2	* ARM generic helpers.
3	*
4	* This code is licensed under the GNU GPL v2 or later.
5	*
6	* SPDX-License-Identifier: GPL-2.0-or-later
7	*/
8
9	#include "qemu/osdep.h"
10	#include "qemu/log.h"
11	#include "trace.h"
12	#include "cpu.h"
13	#include "internals.h"
14	#include "cpu-features.h"
15	#include "exec/page-protection.h"
16	#include "exec/mmap-lock.h"
17	#include "qemu/main-loop.h"
18	#include "qemu/timer.h"
19	#include "qemu/bitops.h"
20	#include "qemu/qemu-print.h"
21	#include "exec/cputlb.h"
22	#include "exec/translation-block.h"
23	#include "hw/core/irq.h"
24	#include "system/cpu-timers.h"
25	#include "exec/icount.h"
26	#include "system/kvm.h"
27	#include "system/tcg.h"
28	#include "qapi/error.h"
29	#include "qemu/guest-random.h"
30	#ifdef CONFIG_TCG
31	#include "accel/tcg/probe.h"
32	#include "accel/tcg/getpc.h"
33	#include "semihosting/common-semi.h"
34	#endif
35	#include "cpregs.h"
36	#include "target/arm/gtimer.h"
37	#include "qemu/plugin.h"
38
39	static void switch_mode(CPUARMState *env, int mode);
40	#ifndef CONFIG_USER_ONLY
41	static void gt_recalc_timer(ARMCPU *cpu, int timeridx);
42	#endif
43
44	int compare_u64(const void a, const void b)
45	{
46	if ((uint64_t )a > (uint64_t )b) {
47	return 1;
48	}
49	if ((uint64_t )a < (uint64_t )b) {
50	return -1;
51	}
52	return 0;
53	}
54
55	/*
56	* Macros which are lvalues for the field in CPUARMState for the
57	* ARMCPRegInfo *ri.
58	*/
59	#define CPREG_FIELD32(env, ri) \
60	((uint32_t )((char *)(env) + (ri)->fieldoffset))
61	#define CPREG_FIELD64(env, ri) \
62	((uint64_t )((char *)(env) + (ri)->fieldoffset))
63
64	uint64_t raw_read(CPUARMState env, const ARMCPRegInfo ri)
65	{
66	assert(ri->fieldoffset);
67	switch (cpreg_field_type(ri)) {
68	case MO_64:
69	return CPREG_FIELD64(env, ri);
70	case MO_32:
71	return CPREG_FIELD32(env, ri);
72	default:
73	g_assert_not_reached();
74	}
75	}
76
77	void raw_write(CPUARMState env, const ARMCPRegInfo ri, uint64_t value)
78	{
79	assert(ri->fieldoffset);
80	switch (cpreg_field_type(ri)) {
81	case MO_64:
82	CPREG_FIELD64(env, ri) = value;
83	break;
84	case MO_32:
85	CPREG_FIELD32(env, ri) = value;
86	break;
87	default:
88	g_assert_not_reached();
89	}
90	}
91
92	#undef CPREG_FIELD32
93	#undef CPREG_FIELD64
94
95	static void raw_ptr(CPUARMState env, const ARMCPRegInfo *ri)
96	{
97	return (char *)env + ri->fieldoffset;
98	}
99
100	uint64_t read_raw_cp_reg(CPUARMState env, const ARMCPRegInfo ri)
101	{
102	/* Raw read of a coprocessor register (as needed for migration, etc). */
103	if (ri->type & ARM_CP_CONST) {
104	return ri->resetvalue;
105	} else if (ri->raw_readfn) {
106	return ri->raw_readfn(env, ri);
107	} else if (ri->readfn) {
108	return ri->readfn(env, ri);
109	} else {
110	return raw_read(env, ri);
111	}
112	}
113
114	static void write_raw_cp_reg(CPUARMState env, const ARMCPRegInfo ri,
115	uint64_t v)
116	{
117	/*
118	* Raw write of a coprocessor register (as needed for migration, etc).
119	* Note that constant registers are treated as write-ignored; the
120	* caller should check for success by whether a readback gives the
121	* value written.
122	*/
123	if (ri->type & ARM_CP_CONST) {
124	return;
125	} else if (ri->raw_writefn) {
126	ri->raw_writefn(env, ri, v);
127	} else if (ri->writefn) {
128	ri->writefn(env, ri, v);
129	} else {
130	raw_write(env, ri, v);
131	}
132	}
133
134	static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
135	{
136	/*
137	* Return true if the regdef would cause an assertion if you called
138	* read_raw_cp_reg() or write_raw_cp_reg() on it (ie if it is a
139	* program bug for it not to have the NO_RAW flag).
140	* NB that returning false here doesn't necessarily mean that calling
141	* read/write_raw_cp_reg() is safe, because we can't distinguish "has
142	* read/write access functions which are safe for raw use" from "has
143	* read/write access functions which have side effects but has forgotten
144	* to provide raw access functions".
145	* The tests here line up with the conditions in read/write_raw_cp_reg()
146	* and assertions in raw_read()/raw_write().
147	*/
148	if ((ri->type & ARM_CP_CONST) \|\|
149	ri->fieldoffset \|\|
150	((ri->raw_writefn \|\| ri->writefn) && (ri->raw_readfn \|\| ri->readfn))) {
151	return false;
152	}
153	return true;
154	}
155
156	bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
157	{
158	/* Write the coprocessor state from cpu->env to the (index,value) list. */
159	int i;
160	bool ok = true;
161
162	for (i = 0; i < cpu->cpreg_array_len; i++) {
163	uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
164	const ARMCPRegInfo *ri;
165	uint64_t newval;
166
167	ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
168	if (!ri) {
169	ok = false;
170	continue;
171	}
172	if (ri->type & ARM_CP_NO_RAW) {
173	continue;
174	}
175
176	newval = read_raw_cp_reg(&cpu->env, ri);
177	if (kvm_sync) {
178	/*
179	* Only sync if the previous list->cpustate sync succeeded.
180	* Rather than tracking the success/failure state for every
181	* item in the list, we just recheck "does the raw write we must
182	* have made in write_list_to_cpustate() read back OK" here.
183	*/
184	uint64_t oldval = cpu->cpreg_values[i];
185
186	if (oldval == newval) {
187	continue;
188	}
189
190	write_raw_cp_reg(&cpu->env, ri, oldval);
191	if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
192	continue;
193	}
194
195	write_raw_cp_reg(&cpu->env, ri, newval);
196	}
197	cpu->cpreg_values[i] = newval;
198	}
199	return ok;
200	}
201
202	bool write_list_to_cpustate(ARMCPU *cpu)
203	{
204	int i;
205	bool ok = true;
206
207	for (i = 0; i < cpu->cpreg_array_len; i++) {
208	uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
209	uint64_t v = cpu->cpreg_values[i];
210	const ARMCPRegInfo *ri;
211
212	ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
213	if (!ri) {
214	ok = false;
215	continue;
216	}
217	if (ri->type & ARM_CP_NO_RAW) {
218	continue;
219	}
220	/*
221	* Write value and confirm it reads back as written
222	* (to catch read-only registers and partially read-only
223	* registers where the incoming migration value doesn't match)
224	*/
225	write_raw_cp_reg(&cpu->env, ri, v);
226	if (read_raw_cp_reg(&cpu->env, ri) != v) {
227	ok = false;
228	}
229	}
230	return ok;
231	}
232
233	static void add_cpreg_to_list(gpointer key, gpointer value, gpointer opaque)
234	{
235	ARMCPU *cpu = opaque;
236	uint32_t regidx = (uintptr_t)key;
237	const ARMCPRegInfo *ri = value;
238
239	if (!(ri->type & (ARM_CP_NO_RAW \| ARM_CP_ALIAS))) {
240	cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
241	/* The value array need not be initialized at this point */
242	cpu->cpreg_array_len++;
243	}
244	}
245
246	static void count_cpreg(gpointer key, gpointer value, gpointer opaque)
247	{
248	ARMCPU *cpu = opaque;
249	const ARMCPRegInfo *ri = value;
250
251	if (!(ri->type & (ARM_CP_NO_RAW \| ARM_CP_ALIAS))) {
252	cpu->cpreg_array_len++;
253	}
254	}
255
256	void arm_init_cpreg_list(ARMCPU *cpu)
257	{
258	/*
259	* Initialise the cpreg_tuples[] array based on the cp_regs hash.
260	* Note that we require cpreg_tuples[] to be sorted by key ID.
261	*/
262	int arraylen;
263
264	cpu->cpreg_array_len = 0;
265	g_hash_table_foreach(cpu->cp_regs, count_cpreg, cpu);
266
267	arraylen = cpu->cpreg_array_len;
268	if (arraylen) {
269	cpu->cpreg_indexes = g_new(uint64_t, arraylen);
270	cpu->cpreg_values = g_new(uint64_t, arraylen);
271	} else {
272	cpu->cpreg_indexes = NULL;
273	cpu->cpreg_values = NULL;
274	}
275	cpu->cpreg_array_len = 0;
276
277	g_hash_table_foreach(cpu->cp_regs, add_cpreg_to_list, cpu);
278
279	assert(cpu->cpreg_array_len == arraylen);
280
281	if (arraylen) {
282	qsort(cpu->cpreg_indexes, arraylen, sizeof(uint64_t), compare_u64);
283	}
284	}
285
286	bool arm_pan_enabled(CPUARMState *env)
287	{
288	if (is_a64(env)) {
289	if ((arm_hcr_el2_eff(env) & (HCR_NV \| HCR_NV1)) == (HCR_NV \| HCR_NV1)) {
290	return false;
291	}
292	return env->pstate & PSTATE_PAN;
293	} else {
294	return env->uncached_cpsr & CPSR_PAN;
295	}
296	}
297
298	/*
299	* Some registers are not accessible from AArch32 EL3 if SCR.NS == 0.
300	*/
301	static CPAccessResult access_el3_aa32ns(CPUARMState *env,
302	const ARMCPRegInfo *ri,
303	bool isread)
304	{
305	if (!is_a64(env) && arm_current_el(env) == 3 &&
306	arm_is_secure_below_el3(env)) {
307	return CP_ACCESS_UNDEFINED;
308	}
309	return CP_ACCESS_OK;
310	}
311
312	/*
313	* Some secure-only AArch32 registers trap to EL3 if used from
314	* Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).
315	* Note that an access from Secure EL1 can only happen if EL3 is AArch64.
316	* We assume that the .access field is set to PL1_RW.
317	*/
318	static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
319	const ARMCPRegInfo *ri,
320	bool isread)
321	{
322	if (arm_current_el(env) == 3) {
323	return CP_ACCESS_OK;
324	}
325	if (arm_is_secure_below_el3(env)) {
326	if (env->cp15.scr_el3 & SCR_EEL2) {
327	return CP_ACCESS_TRAP_EL2;
328	}
329	return CP_ACCESS_TRAP_EL3;
330	}
331	/* This will be EL1 NS and EL2 NS, which just UNDEF */
332	return CP_ACCESS_UNDEFINED;
333	}
334
335	/* Check for traps from EL1 due to HCR_EL2.TVM and HCR_EL2.TRVM. */
336	CPAccessResult access_tvm_trvm(CPUARMState env, const ARMCPRegInfo ri,
337	bool isread)
338	{
339	if (arm_current_el(env) == 1) {
340	uint64_t trap = isread ? HCR_TRVM : HCR_TVM;
341	if (arm_hcr_el2_eff(env) & trap) {
342	return CP_ACCESS_TRAP_EL2;
343	}
344	}
345	return CP_ACCESS_OK;
346	}
347
348	/* Check for traps from EL1 due to HCR_EL2.TSW. */
349	static CPAccessResult access_tsw(CPUARMState env, const ARMCPRegInfo ri,
350	bool isread)
351	{
352	if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TSW)) {
353	return CP_ACCESS_TRAP_EL2;
354	}
355	return CP_ACCESS_OK;
356	}
357
358	/* Check for traps from EL1 due to HCR_EL2.TACR. */
359	static CPAccessResult access_tacr(CPUARMState env, const ARMCPRegInfo ri,
360	bool isread)
361	{
362	if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TACR)) {
363	return CP_ACCESS_TRAP_EL2;
364	}
365	return CP_ACCESS_OK;
366	}
367
368	static void dacr_write(CPUARMState env, const ARMCPRegInfo ri, uint64_t value)
369	{
370	ARMCPU *cpu = env_archcpu(env);
371
372	raw_write(env, ri, value);
373	tlb_flush(CPU(cpu)); /* Flush TLB as domain not tracked in TLB */
374	}
375
376	static void fcse_write(CPUARMState env, const ARMCPRegInfo ri, uint64_t value)
377	{
378	ARMCPU *cpu = env_archcpu(env);
379
380	if (raw_read(env, ri) != value) {
381	/*
382	* Unlike real hardware the qemu TLB uses virtual addresses,
383	* not modified virtual addresses, so this causes a TLB flush.
384	*/
385	tlb_flush(CPU(cpu));
386	raw_write(env, ri, value);
387	}
388	}
389
390	static void contextidr_write(CPUARMState env, const ARMCPRegInfo ri,
391	uint64_t value)
392	{
393	ARMCPU *cpu = env_archcpu(env);
394
395	if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
396	&& !extended_addresses_enabled(env)) {
397	/*
398	* For VMSA (when not using the LPAE long descriptor page table
399	* format) this register includes the ASID, so do a TLB flush.
400	* For PMSA it is purely a process ID and no action is needed.
401	*/
402	tlb_flush(CPU(cpu));
403	}
404	raw_write(env, ri, value);
405	}
406
407	int alle1_tlbmask(CPUARMState *env)
408	{
409	/*
410	* Note that the 'ALL' scope must invalidate both stage 1 and
411	* stage 2 translations, whereas most other scopes only invalidate
412	* stage 1 translations.
413	*
414	* For AArch32 this is only used for TLBIALLNSNH and VTTBR
415	* writes, so only needs to apply to NS PL1&0, not S PL1&0.
416	*/
417	return (ARMMMUIdxBit_E10_1 \|
418	ARMMMUIdxBit_E10_1_PAN \|
419	ARMMMUIdxBit_E10_1_GCS \|
420	ARMMMUIdxBit_E10_0 \|
421	ARMMMUIdxBit_E10_0_GCS \|
422	ARMMMUIdxBit_Stage2 \|
423	ARMMMUIdxBit_Stage2_S);
424	}
425
426	int alle2_tlbmask(void)
427	{
428	return (ARMMMUIdxBit_E20_2 \|
429	ARMMMUIdxBit_E20_2_PAN \|
430	ARMMMUIdxBit_E20_2_GCS \|
431	ARMMMUIdxBit_E20_0 \|
432	ARMMMUIdxBit_E20_0_GCS);
433	}
434
435	static const ARMCPRegInfo cp_reginfo[] = {
436	/*
437	* Define the secure and non-secure FCSE identifier CP registers
438	* separately because there is no secure bank in V8 (no _EL3). This allows
439	* the secure register to be properly reset and migrated. There is also no
440	* v8 EL1 version of the register so the non-secure instance stands alone.
441	*/
442	{ .name = "FCSEIDR",
443	.cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
444	.access = PL1_RW, .secure = ARM_CP_SECSTATE_NS,
445	.fieldoffset = offsetof(CPUARMState, cp15.fcseidr_ns),
446	.resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
447	{ .name = "FCSEIDR_S",
448	.cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 0,
449	.access = PL1_RW, .secure = ARM_CP_SECSTATE_S,
450	.fieldoffset = offsetof(CPUARMState, cp15.fcseidr_s),
451	.resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },
452	/*
453	* Define the secure and non-secure context identifier CP registers
454	* separately because there is no secure bank in V8 (no _EL3). This allows
455	* the secure register to be properly reset and migrated. In the
456	* non-secure case, the 32-bit register will have reset and migration
457	* disabled during registration as it is handled by the 64-bit instance.
458	*/
459	{ .name = "CONTEXTIDR_EL1", .state = ARM_CP_STATE_BOTH,
460	.opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
461	.access = PL1_RW, .accessfn = access_tvm_trvm,
462	.fgt = FGT_CONTEXTIDR_EL1,
463	.nv2_redirect_offset = 0x108 \| NV2_REDIR_NV1,
464	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 13, 0, 1),
465	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 13, 0, 1),
466	.secure = ARM_CP_SECSTATE_NS,
467	.fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
468	.resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
469	{ .name = "CONTEXTIDR_S", .state = ARM_CP_STATE_AA32,
470	.cp = 15, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 1,
471	.access = PL1_RW, .accessfn = access_tvm_trvm,
472	.secure = ARM_CP_SECSTATE_S,
473	.fieldoffset = offsetof(CPUARMState, cp15.contextidr_s),
474	.resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
475	};
476
477	static const ARMCPRegInfo not_v8_cp_reginfo[] = {
478	/*
479	* NB: Some of these registers exist in v8 but with more precise
480	* definitions that don't use CP_ANY wildcards (mostly in v8_cp_reginfo[]).
481	*/
482	/* MMU Domain access control / MPU write buffer control */
483	{ .name = "DACR",
484	.cp = 15, .opc1 = CP_ANY, .crn = 3, .crm = CP_ANY, .opc2 = CP_ANY,
485	.access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0,
486	.writefn = dacr_write, .raw_writefn = raw_write,
487	.bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
488	offsetoflow32(CPUARMState, cp15.dacr_ns) } },
489	/*
490	* ARMv7 allocates a range of implementation defined TLB LOCKDOWN regs.
491	* For v6 and v5, these mappings are overly broad.
492	*/
493	{ .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 0,
494	.opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
495	{ .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 1,
496	.opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
497	{ .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 4,
498	.opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
499	{ .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = 8,
500	.opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },
501	/* Cache maintenance ops; some of this space may be overridden later. */
502	{ .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,
503	.opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,
504	.type = ARM_CP_NOP \| ARM_CP_OVERRIDE },
505	};
506
507	static const ARMCPRegInfo not_v6_cp_reginfo[] = {
508	/*
509	* Not all pre-v6 cores implemented this WFI, so this is slightly
510	* over-broad.
511	*/
512	{ .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,
513	.access = PL1_W, .type = ARM_CP_WFI },
514	};
515
516	static const ARMCPRegInfo not_v7_cp_reginfo[] = {
517	/*
518	* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which
519	* is UNPREDICTABLE; we choose to NOP as most implementations do).
520	*/
521	{ .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
522	.access = PL1_W, .type = ARM_CP_WFI },
523	/*
524	* L1 cache lockdown. Not architectural in v6 and earlier but in practice
525	* implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and
526	* OMAPCP will override this space.
527	*/
528	{ .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,
529	.access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),
530	.resetvalue = 0 },
531	{ .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,
532	.access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),
533	.resetvalue = 0 },
534	/* v6 doesn't have the cache ID registers but Linux reads them anyway */
535	{ .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,
536	.access = PL1_R, .type = ARM_CP_CONST \| ARM_CP_NO_RAW,
537	.resetvalue = 0 },
538	/*
539	* We don't implement pre-v7 debug but most CPUs had at least a DBGDIDR;
540	* implementing it as RAZ means the "debug architecture version" bits
541	* will read as a reserved value, which should cause Linux to not try
542	* to use the debug hardware.
543	*/
544	{ .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
545	.access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },
546	{ .name = "PRRR", .cp = 15, .crn = 10, .crm = 2,
547	.opc1 = 0, .opc2 = 0, .access = PL1_RW, .type = ARM_CP_NOP },
548	{ .name = "NMRR", .cp = 15, .crn = 10, .crm = 2,
549	.opc1 = 0, .opc2 = 1, .access = PL1_RW, .type = ARM_CP_NOP },
550	};
551
552	static void cpacr_write(CPUARMState env, const ARMCPRegInfo ri,
553	uint64_t value)
554	{
555	uint32_t mask = 0;
556
557	/*
558	* The AArch64 view of CPACR_EL1 has a different layout to the old
559	* AArch32 one. We also need to permit the old AArch32 bits to be
560	* read and written so that an AArch64 EL2 hypervisor can set up
561	* the register for an AArch32 EL1 guest. So we choose not to
562	* enforce any RAZ/WI or RAO/WI bits for v8 based on feature
563	* presence/absence.
564	*
565	* For v7 the situation is a bit simpler and there we do choose to
566	* enforce RAZ/WI and RAO/WI.
567	*/
568	if (!arm_feature(env, ARM_FEATURE_V8)) {
569	/*
570	* ARMv7 defines bits for unimplemented coprocessors as RAZ/WI.
571	* ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
572	* TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
573	*/
574	if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
575	/* VFP coprocessor: cp10 & cp11 [23:20] */
576	mask \|= R_CPACR_CP11_MASK \|
577	R_CPACR_CP10_MASK;
578
579	if (!arm_feature(env, ARM_FEATURE_NEON)) {
580	/* ASEDIS [31] bit is RAO/WI */
581	value \|= R_CPACR_ASEDIS_MASK;
582	mask \|= R_CPACR_ASEDIS_MASK;
583	} else if (arm_feature(env, ARM_FEATURE_NEON_TRAPS)) {
584	/*
585	* bit is present unless CPU doesn't implement ASEDIS
586	* (in which case it is RAZ/WI; this is the Cortex-A8)
587	*/
588	mask \|= R_CPACR_ASEDIS_MASK;
589	}
590
591	/*
592	* VFPv3 and upwards with NEON implement 32 double precision
593	* registers (D0-D31).
594	*/
595	if (!cpu_isar_feature(aa32_simd_r32, env_archcpu(env))) {
596	/* D32DIS [30] is RAO/WI if D16-31 are not implemented. */
597	value \|= R_CPACR_D32DIS_MASK;
598	mask \|= R_CPACR_D32DIS_MASK;
599	} else if (arm_feature(env, ARM_FEATURE_D32DIS)) {
600	/*
601	* Bit is present unless CPU doesn't implement D32DIS,
602	* in which case it is RAZ/WI.
603	*/
604	mask \|= R_CPACR_D32DIS_MASK;
605	}
606	}
607	value &= mask;
608	}
609
610	/*
611	* For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
612	* is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
613	* Similarly, if NSACR.NSASEDIS is 1 then CPACR.ASEDIS ignores writes
614	* and reads as 1, and NSACR.NSD32DIS makes CPACR.D32DIS behave as RAO/WI.
615	*/
616	if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
617	!arm_is_secure(env)) {
618	if (!FIELD_EX32(env->cp15.nsacr, NSACR, CP10)) {
619	mask = R_CPACR_CP11_MASK \| R_CPACR_CP10_MASK;
620	value = (value & ~mask) \| (env->cp15.cpacr_el1 & mask);
621	}
622	if (FIELD_EX32(env->cp15.nsacr, NSACR, NSASEDIS)) {
623	mask = R_CPACR_ASEDIS_MASK;
624	value = (value & ~mask) \| (env->cp15.cpacr_el1 & mask);
625	}
626	if (FIELD_EX32(env->cp15.nsacr, NSACR, NSD32DIS)) {
627	mask = R_CPACR_D32DIS_MASK;
628	value = (value & ~mask) \| (env->cp15.cpacr_el1 & mask);
629	}
630	}
631
632	env->cp15.cpacr_el1 = value;
633	}
634
635	static uint64_t cpacr_read(CPUARMState env, const ARMCPRegInfo ri)
636	{
637	/*
638	* For A-profile AArch32 EL3 (but not M-profile secure mode), if NSACR.CP10
639	* is 0 then CPACR.{CP11,CP10} ignore writes and read as 0b00.
640	* Similarly NSACR.NSASEDIS makes CPACR.ASEDIS read as 1.
641	*/
642	uint64_t value = env->cp15.cpacr_el1;
643
644	if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
645	!arm_is_secure(env)) {
646	if (!FIELD_EX32(env->cp15.nsacr, NSACR, CP10)) {
647	value = ~(R_CPACR_CP11_MASK \| R_CPACR_CP10_MASK);
648	}
649	if (FIELD_EX32(env->cp15.nsacr, NSACR, NSASEDIS)) {
650	value \|= R_CPACR_ASEDIS_MASK;
651	}
652	if (FIELD_EX32(env->cp15.nsacr, NSACR, NSD32DIS)) {
653	value \|= R_CPACR_D32DIS_MASK;
654	}
655	}
656	return value;
657	}
658
659
660	static void cpacr_reset(CPUARMState env, const ARMCPRegInfo ri)
661	{
662	/*
663	* Call cpacr_write() so that we reset with the correct RAO bits set
664	* for our CPU features.
665	*/
666	cpacr_write(env, ri, 0);
667	}
668
669	static CPAccessResult cpacr_access(CPUARMState env, const ARMCPRegInfo ri,
670	bool isread)
671	{
672	if (arm_feature(env, ARM_FEATURE_V8)) {
673	/* Check if CPACR accesses are to be trapped to EL2 */
674	if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) &&
675	FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TCPAC)) {
676	return CP_ACCESS_TRAP_EL2;
677	/* Check if CPACR accesses are to be trapped to EL3 */
678	} else if (arm_current_el(env) < 3 &&
679	FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) {
680	return CP_ACCESS_TRAP_EL3;
681	}
682	}
683
684	return CP_ACCESS_OK;
685	}
686
687	static CPAccessResult cptr_access(CPUARMState env, const ARMCPRegInfo ri,
688	bool isread)
689	{
690	/* Check if CPTR accesses are set to trap to EL3 */
691	if (arm_current_el(env) == 2 &&
692	FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, TCPAC)) {
693	return CP_ACCESS_TRAP_EL3;
694	}
695
696	return CP_ACCESS_OK;
697	}
698
699	static const ARMCPRegInfo v6_cp_reginfo[] = {
700	/* prefetch by MVA in v6, NOP in v7 */
701	{ .name = "MVA_prefetch",
702	.cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,
703	.access = PL1_W, .type = ARM_CP_NOP },
704	/*
705	* We need to break the TB after ISB to execute self-modifying code
706	* correctly and also to take any pending interrupts immediately.
707	* So use arm_cp_write_ignore() function instead of ARM_CP_NOP flag.
708	*/
709	{ .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,
710	.access = PL0_W, .type = ARM_CP_NO_RAW, .writefn = arm_cp_write_ignore },
711	{ .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,
712	.access = PL0_W, .type = ARM_CP_NOP },
713	{ .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,
714	.access = PL0_W, .type = ARM_CP_NOP },
715	{ .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,
716	.access = PL1_RW, .accessfn = access_tvm_trvm,
717	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ifar_s),
718	offsetof(CPUARMState, cp15.ifar_ns) },
719	.resetvalue = 0, },
720	/*
721	* Watchpoint Fault Address Register : should actually only be present
722	* for 1136, 1176, 11MPCore.
723	*/
724	{ .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
725	.access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
726	{ .name = "CPACR_EL1", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
727	.crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
728	.fgt = FGT_CPACR_EL1,
729	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 1, 1, 2),
730	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 1, 0, 2),
731	.nv2_redirect_offset = 0x100 \| NV2_REDIR_NV1,
732	.access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
733	.resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
734	};
735
736	/*
737	* Bits in MDCR_EL2 and MDCR_EL3 which pmu_counter_enabled() looks at.
738	* We use these to decide whether we need to wrap a write to MDCR_EL2
739	* or MDCR_EL3 in pmu_op_start()/pmu_op_finish() calls.
740	*/
741	#define MDCR_EL2_PMU_ENABLE_BITS \
742	(MDCR_HPME \| MDCR_HPMD \| MDCR_HPMN \| MDCR_HCCD \| MDCR_HLP)
743	#define MDCR_EL3_PMU_ENABLE_BITS (MDCR_SPME \| MDCR_SCCD)
744
745	static void vbar_write(CPUARMState env, const ARMCPRegInfo ri,
746	uint64_t value)
747	{
748	/*
749	* Note that even though the AArch64 view of this register has bits
750	* [10:0] all RES0 we can only mask the bottom 5, to comply with the
751	* architectural requirements for bits which are RES0 only in some
752	* contexts. (ARMv8 would permit us to do no masking at all, but ARMv7
753	* requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)
754	*/
755	raw_write(env, ri, value & ~0x1FULL);
756	}
757
758	static void scr_write(CPUARMState env, const ARMCPRegInfo ri, uint64_t value)
759	{
760	/* Begin with base v8.0 state. */
761	uint64_t valid_mask = 0x3fff;
762	ARMCPU *cpu = env_archcpu(env);
763	uint64_t changed;
764
765	/*
766	* Because SCR_EL3 is the "real" cpreg and SCR is the alias, reset always
767	* passes the reginfo for SCR_EL3, which has type ARM_CP_STATE_AA64.
768	* Instead, choose the format based on the mode of EL3.
769	*/
770	if (arm_el_is_aa64(env, 3)) {
771	value \|= SCR_FW \| SCR_AW; /* RES1 */
772	valid_mask &= ~SCR_NET; /* RES0 */
773
774	if (!cpu_isar_feature(aa64_aa32_el1, cpu) &&
775	!cpu_isar_feature(aa64_aa32_el2, cpu)) {
776	value \|= SCR_RW; /* RAO/WI */
777	}
778	if (cpu_isar_feature(aa64_ras, cpu)) {
779	valid_mask \|= SCR_TERR;
780	}
781	if (cpu_isar_feature(aa64_lor, cpu)) {
782	valid_mask \|= SCR_TLOR;
783	}
784	if (cpu_isar_feature(aa64_pauth, cpu)) {
785	valid_mask \|= SCR_API \| SCR_APK;
786	}
787	if (cpu_isar_feature(aa64_sel2, cpu)) {
788	valid_mask \|= SCR_EEL2;
789	} else if (cpu_isar_feature(aa64_rme, cpu)) {
790	/* With RME and without SEL2, NS is RES1 (R_GSWWH, I_DJJQJ). */
791	value \|= SCR_NS;
792	}
793	if (cpu_isar_feature(aa64_mte, cpu)) {
794	valid_mask \|= SCR_ATA;
795	}
796	if (cpu_isar_feature(aa64_scxtnum, cpu)) {
797	valid_mask \|= SCR_ENSCXT;
798	}
799	if (cpu_isar_feature(aa64_doublefault, cpu)) {
800	valid_mask \|= SCR_EASE \| SCR_NMEA;
801	}
802	if (cpu_isar_feature(aa64_sme, cpu)) {
803	valid_mask \|= SCR_ENTP2;
804	}
805	if (cpu_isar_feature(aa64_hcx, cpu)) {
806	valid_mask \|= SCR_HXEN;
807	}
808	if (cpu_isar_feature(aa64_fgt, cpu)) {
809	valid_mask \|= SCR_FGTEN;
810	}
811	if (cpu_isar_feature(aa64_rme, cpu)) {
812	valid_mask \|= SCR_NSE \| SCR_GPF;
813	}
814	if (cpu_isar_feature(aa64_ecv, cpu)) {
815	valid_mask \|= SCR_ECVEN;
816	}
817	if (cpu_isar_feature(aa64_gcs, cpu)) {
818	valid_mask \|= SCR_GCSEN;
819	}
820	if (cpu_isar_feature(aa64_tcr2, cpu)) {
821	valid_mask \|= SCR_TCR2EN;
822	}
823	if (cpu_isar_feature(aa64_sctlr2, cpu)) {
824	valid_mask \|= SCR_SCTLR2EN;
825	}
826	if (cpu_isar_feature(aa64_s1pie, cpu) \|\|
827	cpu_isar_feature(aa64_s2pie, cpu)) {
828	valid_mask \|= SCR_PIEN;
829	}
830	if (cpu_isar_feature(aa64_aie, cpu)) {
831	valid_mask \|= SCR_AIEN;
832	}
833	if (cpu_isar_feature(aa64_mec, cpu)) {
834	valid_mask \|= SCR_MECEN;
835	}
836	if (cpu_isar_feature(aa64_fpmr, cpu)) {
837	valid_mask \|= SCR_ENFPM;
838	}
839	if (cpu_isar_feature(aa64_rng_trap, cpu)) {
840	valid_mask \|= SCR_TRNDR;
841	}
842	} else {
843	valid_mask &= ~(SCR_RW \| SCR_ST);
844	if (cpu_isar_feature(aa32_ras, cpu)) {
845	valid_mask \|= SCR_TERR;
846	}
847	}
848
849	if (!arm_feature(env, ARM_FEATURE_EL2)) {
850	valid_mask &= ~SCR_HCE;
851
852	/*
853	* On ARMv7, SMD (or SCD as it is called in v7) is only
854	* supported if EL2 exists. The bit is UNK/SBZP when
855	* EL2 is unavailable. In QEMU ARMv7, we force it to always zero
856	* when EL2 is unavailable.
857	* On ARMv8, this bit is always available.
858	*/
859	if (arm_feature(env, ARM_FEATURE_V7) &&
860	!arm_feature(env, ARM_FEATURE_V8)) {
861	valid_mask &= ~SCR_SMD;
862	}
863	}
864
865	/* Clear all-context RES0 bits. */
866	value &= valid_mask;
867	changed = env->cp15.scr_el3 ^ value;
868	env->cp15.scr_el3 = value;
869
870	#ifndef CONFIG_USER_ONLY
871	if (changed & SCR_ECVEN) {
872	gt_recalc_timer(cpu, GTIMER_PHYS);
873	}
874	#endif
875
876	/*
877	* If SCR_EL3.{NS,NSE} changes, i.e. change of security state,
878	* we must invalidate all TLBs below EL3.
879	*/
880	if (changed & (SCR_NS \| SCR_NSE)) {
881	tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 \|
882	ARMMMUIdxBit_E10_0_GCS \|
883	ARMMMUIdxBit_E20_0 \|
884	ARMMMUIdxBit_E20_0_GCS \|
885	ARMMMUIdxBit_E10_1 \|
886	ARMMMUIdxBit_E10_1_PAN \|
887	ARMMMUIdxBit_E10_1_GCS \|
888	ARMMMUIdxBit_E20_2 \|
889	ARMMMUIdxBit_E20_2_PAN \|
890	ARMMMUIdxBit_E20_2_GCS \|
891	ARMMMUIdxBit_E2 \|
892	ARMMMUIdxBit_E2_GCS));
893	}
894	}
895
896	static void scr_reset(CPUARMState env, const ARMCPRegInfo ri)
897	{
898	/*
899	* scr_write will set the RES1 bits on an AArch64-only CPU.
900	* The reset value will be 0x30 on an AArch64-only CPU and 0 otherwise.
901	*/
902	scr_write(env, ri, 0);
903	}
904
905	static CPAccessResult access_tid4(CPUARMState *env,
906	const ARMCPRegInfo *ri,
907	bool isread)
908	{
909	if (arm_current_el(env) == 1 &&
910	(arm_hcr_el2_eff(env) & (HCR_TID2 \| HCR_TID4))) {
911	return CP_ACCESS_TRAP_EL2;
912	}
913
914	return CP_ACCESS_OK;
915	}
916
917	static uint64_t ccsidr_read(CPUARMState env, const ARMCPRegInfo ri)
918	{
919	ARMCPU *cpu = env_archcpu(env);
920
921	/*
922	* Acquire the CSSELR index from the bank corresponding to the CCSIDR
923	* bank
924	*/
925	uint32_t index = A32_BANKED_REG_GET(env, csselr,
926	ri->secure & ARM_CP_SECSTATE_S);
927
928	return cpu->ccsidr[index];
929	}
930
931	static void csselr_write(CPUARMState env, const ARMCPRegInfo ri,
932	uint64_t value)
933	{
934	raw_write(env, ri, value & 0xf);
935	}
936
937	static uint64_t isr_read(CPUARMState env, const ARMCPRegInfo ri)
938	{
939	CPUState *cs = env_cpu(env);
940	bool el1 = arm_current_el(env) == 1;
941	uint64_t hcr_el2 = el1 ? arm_hcr_el2_eff(env) : 0;
942	uint64_t ret = 0;
943
944	if (hcr_el2 & HCR_IMO) {
945	if (cpu_test_interrupt(cs, CPU_INTERRUPT_VIRQ)) {
946	ret \|= CPSR_I;
947	}
948	if (cpu_test_interrupt(cs, CPU_INTERRUPT_VINMI)) {
949	ret \|= ISR_IS;
950	ret \|= CPSR_I;
951	}
952	} else {
953	if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD)) {
954	ret \|= CPSR_I;
955	}
956
957	if (cpu_test_interrupt(cs, CPU_INTERRUPT_NMI)) {
958	ret \|= ISR_IS;
959	ret \|= CPSR_I;
960	}
961	}
962
963	if (hcr_el2 & HCR_FMO) {
964	if (cpu_test_interrupt(cs, CPU_INTERRUPT_VFIQ)) {
965	ret \|= CPSR_F;
966	}
967	if (cpu_test_interrupt(cs, CPU_INTERRUPT_VFNMI)) {
968	ret \|= ISR_FS;
969	ret \|= CPSR_F;
970	}
971	} else {
972	if (cpu_test_interrupt(cs, CPU_INTERRUPT_FIQ)) {
973	ret \|= CPSR_F;
974	}
975	}
976
977	if (hcr_el2 & HCR_AMO) {
978	if (cpu_test_interrupt(cs, CPU_INTERRUPT_VSERR)) {
979	ret \|= CPSR_A;
980	}
981	}
982
983	return ret;
984	}
985
986	static CPAccessResult access_tid1(CPUARMState env, const ARMCPRegInfo ri,
987	bool isread)
988	{
989	if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) {
990	return CP_ACCESS_TRAP_EL2;
991	}
992
993	return CP_ACCESS_OK;
994	}
995
996	static const ARMCPRegInfo v7_cp_reginfo[] = {
997	/* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
998	{ .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
999	.access = PL1_W, .type = ARM_CP_NOP },
1000	{ .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
1001	.opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,
1002	.access = PL1_R,
1003	.accessfn = access_tid4,
1004	.fgt = FGT_CCSIDR_EL1,
1005	.readfn = ccsidr_read, .type = ARM_CP_NO_RAW },
1006	{ .name = "CSSELR", .state = ARM_CP_STATE_BOTH,
1007	.opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,
1008	.access = PL1_RW,
1009	.accessfn = access_tid4,
1010	.fgt = FGT_CSSELR_EL1,
1011	.writefn = csselr_write, .resetvalue = 0,
1012	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.csselr_s),
1013	offsetof(CPUARMState, cp15.csselr_ns) } },
1014	/*
1015	* Auxiliary ID register: this actually has an IMPDEF value but for now
1016	* just RAZ for all cores:
1017	*/
1018	{ .name = "AIDR", .state = ARM_CP_STATE_BOTH,
1019	.opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
1020	.access = PL1_R, .type = ARM_CP_CONST,
1021	.accessfn = access_tid1,
1022	.fgt = FGT_AIDR_EL1,
1023	.resetvalue = 0 },
1024	/*
1025	* Auxiliary fault status registers: these also are IMPDEF, and we
1026	* choose to RAZ/WI for all cores.
1027	*/
1028	{ .name = "AFSR0_EL1", .state = ARM_CP_STATE_BOTH,
1029	.opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 0,
1030	.access = PL1_RW, .accessfn = access_tvm_trvm,
1031	.fgt = FGT_AFSR0_EL1,
1032	.nv2_redirect_offset = 0x128 \| NV2_REDIR_NV1,
1033	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 5, 1, 0),
1034	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 5, 1, 0),
1035	.type = ARM_CP_CONST, .resetvalue = 0 },
1036	{ .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
1037	.opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
1038	.access = PL1_RW, .accessfn = access_tvm_trvm,
1039	.fgt = FGT_AFSR1_EL1,
1040	.nv2_redirect_offset = 0x130 \| NV2_REDIR_NV1,
1041	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 5, 1, 1),
1042	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 5, 1, 1),
1043	.type = ARM_CP_CONST, .resetvalue = 0 },
1044	/*
1045	* MAIR can just read-as-written because we don't implement caches
1046	* and so don't need to care about memory attributes.
1047	*/
1048	{ .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,
1049	.opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
1050	.access = PL1_RW, .accessfn = access_tvm_trvm,
1051	.fgt = FGT_MAIR_EL1,
1052	.nv2_redirect_offset = 0x140 \| NV2_REDIR_NV1,
1053	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 2, 0),
1054	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 2, 0),
1055	.fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
1056	.resetvalue = 0 },
1057	{ .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
1058	.opc0 = 3, .opc1 = 6, .crn = 10, .crm = 2, .opc2 = 0,
1059	.access = PL3_RW, .fgt = FGT_MAIR_EL3,
1060	.fieldoffset = offsetof(CPUARMState, cp15.mair_el[3]),
1061	.resetvalue = 0 },
1062	/*
1063	* For non-long-descriptor page tables these are PRRR and NMRR;
1064	* regardless they still act as reads-as-written for QEMU.
1065	*/
1066	/*
1067	* MAIR0/1 are defined separately from their 64-bit counterpart which
1068	* allows them to assign the correct fieldoffset based on the endianness
1069	* handled in the field definitions.
1070	*/
1071	{ .name = "MAIR0", .state = ARM_CP_STATE_AA32,
1072	.cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,
1073	.access = PL1_RW, .accessfn = access_tvm_trvm,
1074	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair0_s),
1075	offsetof(CPUARMState, cp15.mair0_ns) },
1076	.resetfn = arm_cp_reset_ignore },
1077	{ .name = "MAIR1", .state = ARM_CP_STATE_AA32,
1078	.cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1,
1079	.access = PL1_RW, .accessfn = access_tvm_trvm,
1080	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.mair1_s),
1081	offsetof(CPUARMState, cp15.mair1_ns) },
1082	.resetfn = arm_cp_reset_ignore },
1083	{ .name = "ISR_EL1", .state = ARM_CP_STATE_BOTH,
1084	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 0,
1085	.fgt = FGT_ISR_EL1,
1086	.type = ARM_CP_NO_RAW, .access = PL1_R, .readfn = isr_read },
1087	};
1088
1089	static void teecr_write(CPUARMState env, const ARMCPRegInfo ri,
1090	uint64_t value)
1091	{
1092	value &= 1;
1093	env->teecr = value;
1094	}
1095
1096	static CPAccessResult teecr_access(CPUARMState env, const ARMCPRegInfo ri,
1097	bool isread)
1098	{
1099	/*
1100	* HSTR.TTEE only exists in v7A, not v8A, but v8A doesn't have T2EE
1101	* at all, so we don't need to check whether we're v8A.
1102	*/
1103	if (arm_current_el(env) < 2 && !arm_is_secure_below_el3(env) &&
1104	(env->cp15.hstr_el2 & HSTR_TTEE)) {
1105	return CP_ACCESS_TRAP_EL2;
1106	}
1107	return CP_ACCESS_OK;
1108	}
1109
1110	static CPAccessResult teehbr_access(CPUARMState env, const ARMCPRegInfo ri,
1111	bool isread)
1112	{
1113	if (arm_current_el(env) == 0 && (env->teecr & 1)) {
1114	return CP_ACCESS_TRAP_EL1;
1115	}
1116	return teecr_access(env, ri, isread);
1117	}
1118
1119	static const ARMCPRegInfo t2ee_cp_reginfo[] = {
1120	{ .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,
1121	.access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),
1122	.resetvalue = 0,
1123	.writefn = teecr_write, .accessfn = teecr_access },
1124	{ .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,
1125	.access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),
1126	.accessfn = teehbr_access, .resetvalue = 0 },
1127	};
1128
1129	static const ARMCPRegInfo v6k_cp_reginfo[] = {
1130	{ .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,
1131	.opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,
1132	.access = PL0_RW,
1133	.fgt = FGT_TPIDR_EL0,
1134	.fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[0]), .resetvalue = 0 },
1135	{ .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,
1136	.access = PL0_RW,
1137	.fgt = FGT_TPIDR_EL0,
1138	.bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrurw_s),
1139	offsetoflow32(CPUARMState, cp15.tpidrurw_ns) },
1140	.resetfn = arm_cp_reset_ignore },
1141	{ .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,
1142	.opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,
1143	.access = PL0_R \| PL1_W,
1144	.fgt = FGT_TPIDRRO_EL0,
1145	.fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el[0]),
1146	.resetvalue = 0},
1147	{ .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,
1148	.access = PL0_R \| PL1_W,
1149	.fgt = FGT_TPIDRRO_EL0,
1150	.bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidruro_s),
1151	offsetoflow32(CPUARMState, cp15.tpidruro_ns) },
1152	.resetfn = arm_cp_reset_ignore },
1153	{ .name = "TPIDR_EL1", .state = ARM_CP_STATE_AA64,
1154	.opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,
1155	.access = PL1_RW,
1156	.fgt = FGT_TPIDR_EL1,
1157	.fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[1]), .resetvalue = 0 },
1158	{ .name = "TPIDRPRW", .opc1 = 0, .cp = 15, .crn = 13, .crm = 0, .opc2 = 4,
1159	.access = PL1_RW,
1160	.bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tpidrprw_s),
1161	offsetoflow32(CPUARMState, cp15.tpidrprw_ns) },
1162	.resetvalue = 0 },
1163	};
1164
1165	static void arm_gt_cntfrq_reset(CPUARMState env, const ARMCPRegInfo ri)
1166	{
1167	ARMCPU *cpu = env_archcpu(env);
1168
1169	cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;
1170	}
1171
1172	#ifndef CONFIG_USER_ONLY
1173
1174	static CPAccessResult gt_cntfrq_access(CPUARMState env, const ARMCPRegInfo ri,
1175	bool isread)
1176	{
1177	/*
1178	* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero.
1179	* Writable only at the highest implemented exception level.
1180	*/
1181	int el = arm_current_el(env);
1182	uint64_t hcr;
1183	uint32_t cntkctl;
1184
1185	switch (el) {
1186	case 0:
1187	hcr = arm_hcr_el2_eff(env);
1188	if ((hcr & (HCR_E2H \| HCR_TGE)) == (HCR_E2H \| HCR_TGE)) {
1189	cntkctl = env->cp15.cnthctl_el2;
1190	} else {
1191	cntkctl = env->cp15.c14_cntkctl;
1192	}
1193	if (!extract32(cntkctl, 0, 2)) {
1194	return CP_ACCESS_TRAP_EL1;
1195	}
1196	break;
1197	case 1:
1198	if (!isread && ri->state == ARM_CP_STATE_AA32 &&
1199	arm_is_secure_below_el3(env)) {
1200	/* Accesses from 32-bit Secure EL1 UNDEF (not trap to EL3!) */
1201	return CP_ACCESS_UNDEFINED;
1202	}
1203	break;
1204	case 2:
1205	case 3:
1206	break;
1207	}
1208
1209	if (!isread && el < arm_highest_el(env)) {
1210	return CP_ACCESS_UNDEFINED;
1211	}
1212
1213	return CP_ACCESS_OK;
1214	}
1215
1216	static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
1217	bool isread)
1218	{
1219	unsigned int cur_el = arm_current_el(env);
1220	bool has_el2 = arm_is_el2_enabled(env);
1221	uint64_t hcr = arm_hcr_el2_eff(env);
1222
1223	switch (cur_el) {
1224	case 0:
1225	/* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]CTEN. */
1226	if ((hcr & (HCR_E2H \| HCR_TGE)) == (HCR_E2H \| HCR_TGE)) {
1227	return (extract32(env->cp15.cnthctl_el2, timeridx, 1)
1228	? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2);
1229	}
1230
1231	/* CNT[PV]CT: not visible from PL0 if EL0[PV]CTEN is zero */
1232	if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
1233	return CP_ACCESS_TRAP_EL1;
1234	}
1235	/* fall through */
1236	case 1:
1237	/* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */
1238	if (has_el2 && timeridx == GTIMER_PHYS &&
1239	(hcr & HCR_E2H
1240	? !extract32(env->cp15.cnthctl_el2, 10, 1)
1241	: !extract32(env->cp15.cnthctl_el2, 0, 1))) {
1242	return CP_ACCESS_TRAP_EL2;
1243	}
1244	if (has_el2 && timeridx == GTIMER_VIRT) {
1245	if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
1246	return CP_ACCESS_TRAP_EL2;
1247	}
1248	}
1249	break;
1250	}
1251	return CP_ACCESS_OK;
1252	}
1253
1254	static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
1255	bool isread)
1256	{
1257	unsigned int cur_el = arm_current_el(env);
1258	bool has_el2 = arm_is_el2_enabled(env);
1259	uint64_t hcr = arm_hcr_el2_eff(env);
1260
1261	switch (cur_el) {
1262	case 0:
1263	if ((hcr & (HCR_E2H \| HCR_TGE)) == (HCR_E2H \| HCR_TGE)) {
1264	/* If HCR_EL2.<E2H,TGE> == '11': check CNTHCTL_EL2.EL0[PV]TEN. */
1265	return (extract32(env->cp15.cnthctl_el2, 9 - timeridx, 1)
1266	? CP_ACCESS_OK : CP_ACCESS_TRAP_EL2);
1267	}
1268
1269	/*
1270	* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from
1271	* EL0 if EL0[PV]TEN is zero.
1272	*/
1273	if (!extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {
1274	return CP_ACCESS_TRAP_EL1;
1275	}
1276	/* fall through */
1277
1278	case 1:
1279	if (has_el2 && timeridx == GTIMER_PHYS) {
1280	if (hcr & HCR_E2H) {
1281	/* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */
1282	if (!extract32(env->cp15.cnthctl_el2, 11, 1)) {
1283	return CP_ACCESS_TRAP_EL2;
1284	}
1285	} else {
1286	/* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */
1287	if (!extract32(env->cp15.cnthctl_el2, 1, 1)) {
1288	return CP_ACCESS_TRAP_EL2;
1289	}
1290	}
1291	}
1292	if (has_el2 && timeridx == GTIMER_VIRT) {
1293	if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
1294	return CP_ACCESS_TRAP_EL2;
1295	}
1296	}
1297	break;
1298	}
1299	return CP_ACCESS_OK;
1300	}
1301
1302	static CPAccessResult gt_pct_access(CPUARMState *env,
1303	const ARMCPRegInfo *ri,
1304	bool isread)
1305	{
1306	return gt_counter_access(env, GTIMER_PHYS, isread);
1307	}
1308
1309	static CPAccessResult gt_vct_access(CPUARMState *env,
1310	const ARMCPRegInfo *ri,
1311	bool isread)
1312	{
1313	return gt_counter_access(env, GTIMER_VIRT, isread);
1314	}
1315
1316	static CPAccessResult gt_ptimer_access(CPUARMState env, const ARMCPRegInfo ri,
1317	bool isread)
1318	{
1319	return gt_timer_access(env, GTIMER_PHYS, isread);
1320	}
1321
1322	static CPAccessResult gt_vtimer_access(CPUARMState env, const ARMCPRegInfo ri,
1323	bool isread)
1324	{
1325	return gt_timer_access(env, GTIMER_VIRT, isread);
1326	}
1327
1328	static CPAccessResult gt_stimer_access(CPUARMState *env,
1329	const ARMCPRegInfo *ri,
1330	bool isread)
1331	{
1332	/*
1333	* The AArch64 register view of the secure physical timer is
1334	* always accessible from EL3, and configurably accessible from
1335	* Secure EL1.
1336	*/
1337	switch (arm_current_el(env)) {
1338	case 1:
1339	if (!arm_is_secure(env)) {
1340	return CP_ACCESS_UNDEFINED;
1341	}
1342	if (arm_is_el2_enabled(env)) {
1343	return CP_ACCESS_UNDEFINED;
1344	}
1345	if (!(env->cp15.scr_el3 & SCR_ST)) {
1346	return CP_ACCESS_TRAP_EL3;
1347	}
1348	return CP_ACCESS_OK;
1349	case 0:
1350	case 2:
1351	return CP_ACCESS_UNDEFINED;
1352	case 3:
1353	return CP_ACCESS_OK;
1354	default:
1355	g_assert_not_reached();
1356	}
1357	}
1358
1359	static CPAccessResult gt_sel2timer_access(CPUARMState *env,
1360	const ARMCPRegInfo *ri,
1361	bool isread)
1362	{
1363	/*
1364	* The AArch64 register view of the secure EL2 timers are mostly
1365	* accessible from EL3 and EL2 although can also be trapped to EL2
1366	* from EL1 depending on nested virt config.
1367	*/
1368	switch (arm_current_el(env)) {
1369	case 0: /* UNDEFINED */
1370	return CP_ACCESS_UNDEFINED;
1371	case 1:
1372	if (!arm_is_secure(env)) {
1373	/* UNDEFINED */
1374	return CP_ACCESS_UNDEFINED;
1375	} else if (arm_hcr_el2_eff(env) & HCR_NV) {
1376	/* Aarch64.SystemAccessTrap(EL2, 0x18) */
1377	return CP_ACCESS_TRAP_EL2;
1378	}
1379	/* UNDEFINED */
1380	return CP_ACCESS_UNDEFINED;
1381	case 2:
1382	if (!arm_is_secure(env)) {
1383	/* UNDEFINED */
1384	return CP_ACCESS_UNDEFINED;
1385	}
1386	return CP_ACCESS_OK;
1387	case 3:
1388	if (env->cp15.scr_el3 & SCR_EEL2) {
1389	return CP_ACCESS_OK;
1390	} else {
1391	return CP_ACCESS_UNDEFINED;
1392	}
1393	default:
1394	g_assert_not_reached();
1395	}
1396	}
1397
1398	uint64_t gt_get_countervalue(CPUARMState *env)
1399	{
1400	ARMCPU *cpu = env_archcpu(env);
1401
1402	return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu);
1403	}
1404
1405	static void gt_update_gicv5_ppi(CPUARMState *env, int timeridx, bool level)
1406	{
1407	static int timeridx_to_ppi[] = {
1408	[GTIMER_PHYS] = GICV5_PPI_CNTP,
1409	[GTIMER_VIRT] = GICV5_PPI_CNTV,
1410	[GTIMER_HYP] = GICV5_PPI_CNTHP,
1411	[GTIMER_SEC] = GICV5_PPI_CNTPS,
1412	[GTIMER_HYPVIRT] = GICV5_PPI_CNTHV,
1413	[GTIMER_S_EL2_PHYS] = GICV5_PPI_CNTHPS,
1414	[GTIMER_S_EL2_VIRT] = GICV5_PPI_CNTHVS,
1415	};
1416
1417	gicv5_update_ppi_state(env, timeridx_to_ppi[timeridx], level);
1418	}
1419
1420	static void gt_update_irq(ARMCPU *cpu, int timeridx)
1421	{
1422	CPUARMState *env = &cpu->env;
1423	uint64_t cnthctl = env->cp15.cnthctl_el2;
1424	ARMSecuritySpace ss = arm_security_space(env);
1425	/* ISTATUS && !IMASK */
1426	int irqstate = (env->cp15.c14_timer[timeridx].ctl & 6) == 4;
1427
1428	/*
1429	* If bit CNTHCTL_EL2.CNT[VP]MASK is set, it overrides IMASK.
1430	* It is RES0 in Secure and NonSecure state.
1431	*/
1432	if ((ss == ARMSS_Root \|\| ss == ARMSS_Realm) &&
1433	((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) \|\|
1434	(timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
1435	irqstate = 0;
1436	}
1437
1438	/*
1439	* We update both the GICv5 PPI and the external-GIC irq line
1440	* (whichever of the two mechanisms is unused will do nothing)
1441	*/
1442	gt_update_gicv5_ppi(env, timeridx, irqstate);
1443	qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
1444	trace_arm_gt_update_irq(timeridx, irqstate);
1445	}
1446
1447	void gt_rme_post_el_change(ARMCPU cpu, void ignored)
1448	{
1449	/*
1450	* Changing security state between Root and Secure/NonSecure, which may
1451	* happen when switching EL, can change the effective value of CNTHCTL_EL2
1452	* mask bits. Update the IRQ state accordingly.
1453	*/
1454	gt_update_irq(cpu, GTIMER_VIRT);
1455	gt_update_irq(cpu, GTIMER_PHYS);
1456	}
1457
1458	static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
1459	{
1460	if ((!arm_feature(env, ARM_FEATURE_EL3) \|\| (env->cp15.scr_el3 & SCR_ECVEN))
1461	&& FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV)
1462	&& arm_is_el2_enabled(env)
1463	&& (arm_hcr_el2_eff(env) & (HCR_E2H \| HCR_TGE)) != (HCR_E2H \| HCR_TGE)) {
1464	return env->cp15.cntpoff_el2;
1465	}
1466	return 0;
1467	}
1468
1469	static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx)
1470	{
1471	/*
1472	* Return the timer offset to use for indirect accesses to the timer.
1473	* This is the Offset value as defined in D12.2.4.1 "Operation of the
1474	* CompareValue views of the timers".
1475	*
1476	* The condition here is not always the same as the condition for
1477	* whether to apply an offset register when doing a direct read of
1478	* the counter sysreg; those conditions are described in the
1479	* access pseudocode for each counter register.
1480	*/
1481	switch (timeridx) {
1482	case GTIMER_PHYS:
1483	return gt_phys_raw_cnt_offset(env);
1484	case GTIMER_VIRT:
1485	return env->cp15.cntvoff_el2;
1486	case GTIMER_HYP:
1487	case GTIMER_SEC:
1488	case GTIMER_HYPVIRT:
1489	case GTIMER_S_EL2_PHYS:
1490	case GTIMER_S_EL2_VIRT:
1491	return 0;
1492	default:
1493	g_assert_not_reached();
1494	}
1495	}
1496
1497	uint64_t gt_direct_access_timer_offset(CPUARMState *env, int timeridx)
1498	{
1499	/*
1500	* Return the timer offset to use for direct accesses to the
1501	* counter registers CNTPCT and CNTVCT, and for direct accesses
1502	* to the CNT*_TVAL registers.
1503	*
1504	* This isn't exactly the same as the indirect-access offset,
1505	* because here we also care about what EL the register access
1506	* is being made from.
1507	*
1508	* This corresponds to the access pseudocode for the registers.
1509	*/
1510	uint64_t hcr;
1511
1512	switch (timeridx) {
1513	case GTIMER_PHYS:
1514	if (arm_current_el(env) >= 2) {
1515	return 0;
1516	}
1517	return gt_phys_raw_cnt_offset(env);
1518	case GTIMER_VIRT:
1519	switch (arm_current_el(env)) {
1520	case 2:
1521	hcr = arm_hcr_el2_eff(env);
1522	if (hcr & HCR_E2H) {
1523	return 0;
1524	}
1525	break;
1526	case 0:
1527	hcr = arm_hcr_el2_eff(env);
1528	if ((hcr & (HCR_E2H \| HCR_TGE)) == (HCR_E2H \| HCR_TGE)) {
1529	return 0;
1530	}
1531	break;
1532	}
1533	return env->cp15.cntvoff_el2;
1534	case GTIMER_HYP:
1535	case GTIMER_SEC:
1536	case GTIMER_HYPVIRT:
1537	case GTIMER_S_EL2_PHYS:
1538	case GTIMER_S_EL2_VIRT:
1539	return 0;
1540	default:
1541	g_assert_not_reached();
1542	}
1543	}
1544
1545	static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
1546	{
1547	ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
1548
1549	if (gt->ctl & 1) {
1550	/*
1551	* Timer enabled: calculate and set current ISTATUS, irq, and
1552	* reset timer to when ISTATUS next has to change
1553	*/
1554	uint64_t offset = gt_indirect_access_timer_offset(&cpu->env, timeridx);
1555	uint64_t count = gt_get_countervalue(&cpu->env);
1556	/* Note that this must be unsigned 64 bit arithmetic: */
1557	int istatus = count - offset >= gt->cval;
1558	uint64_t nexttick;
1559
1560	gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
1561
1562	if (istatus) {
1563	/*
1564	* Next transition is when (count - offset) rolls back over to 0.
1565	* If offset > count then this is when count == offset;
1566	* if offset <= count then this is when count == offset + 2^64
1567	* For the latter case we set nexttick to an "as far in future
1568	* as possible" value and let the code below handle it.
1569	*/
1570	if (offset > count) {
1571	nexttick = offset;
1572	} else {
1573	nexttick = UINT64_MAX;
1574	}
1575	} else {
1576	/*
1577	* Next transition is when (count - offset) == cval, i.e.
1578	* when count == (cval + offset).
1579	* If that would overflow, then again we set up the next interrupt
1580	* for "as far in the future as possible" for the code below.
1581	*/
1582	if (uadd64_overflow(gt->cval, offset, &nexttick)) {
1583	nexttick = UINT64_MAX;
1584	}
1585	}
1586	/*
1587	* Note that the desired next expiry time might be beyond the
1588	* signed-64-bit range of a QEMUTimer -- in this case we just
1589	* set the timer for as far in the future as possible. When the
1590	* timer expires we will reset the timer for any remaining period.
1591	*/
1592	if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {
1593	timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
1594	} else {
1595	timer_mod(cpu->gt_timer[timeridx], nexttick);
1596	}
1597	trace_arm_gt_recalc(timeridx, nexttick);
1598	} else {
1599	/* Timer disabled: ISTATUS and timer output always clear */
1600	gt->ctl &= ~4;
1601	timer_del(cpu->gt_timer[timeridx]);
1602	trace_arm_gt_recalc_disabled(timeridx);
1603	}
1604	gt_update_irq(cpu, timeridx);
1605	}
1606
1607	static void gt_timer_reset(CPUARMState env, const ARMCPRegInfo ri,
1608	int timeridx)
1609	{
1610	ARMCPU *cpu = env_archcpu(env);
1611
1612	timer_del(cpu->gt_timer[timeridx]);
1613	}
1614
1615	static uint64_t gt_cnt_read(CPUARMState env, const ARMCPRegInfo ri)
1616	{
1617	uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_PHYS);
1618	return gt_get_countervalue(env) - offset;
1619	}
1620
1621	static uint64_t gt_virt_cnt_read(CPUARMState env, const ARMCPRegInfo ri)
1622	{
1623	uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_VIRT);
1624	return gt_get_countervalue(env) - offset;
1625	}
1626
1627	static void gt_cval_write(CPUARMState env, const ARMCPRegInfo ri,
1628	int timeridx,
1629	uint64_t value)
1630	{
1631	trace_arm_gt_cval_write(timeridx, value);
1632	env->cp15.c14_timer[timeridx].cval = value;
1633	gt_recalc_timer(env_archcpu(env), timeridx);
1634	}
1635
1636	static uint64_t do_tval_read(CPUARMState *env, int timeridx, uint64_t offset)
1637	{
1638	return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
1639	(gt_get_countervalue(env) - offset));
1640	}
1641
1642	static uint64_t gt_tval_read(CPUARMState env, const ARMCPRegInfo ri,
1643	int timeridx)
1644	{
1645	uint64_t offset = gt_direct_access_timer_offset(env, timeridx);
1646
1647	return do_tval_read(env, timeridx, offset);
1648	}
1649
1650	static void do_tval_write(CPUARMState *env, int timeridx, uint64_t value,
1651	uint64_t offset)
1652	{
1653	trace_arm_gt_tval_write(timeridx, value);
1654	env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +
1655	sextract64(value, 0, 32);
1656	gt_recalc_timer(env_archcpu(env), timeridx);
1657	}
1658
1659	static void gt_tval_write(CPUARMState env, const ARMCPRegInfo ri,
1660	int timeridx,
1661	uint64_t value)
1662	{
1663	uint64_t offset = gt_direct_access_timer_offset(env, timeridx);
1664
1665	do_tval_write(env, timeridx, value, offset);
1666	}
1667
1668	static void gt_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
1669	int timeridx,
1670	uint64_t value)
1671	{
1672	ARMCPU *cpu = env_archcpu(env);
1673	uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;
1674
1675	trace_arm_gt_ctl_write(timeridx, value);
1676	env->cp15.c14_timer[timeridx].ctl = deposit64(oldval, 0, 2, value);
1677	if ((oldval ^ value) & 1) {
1678	/* Enable toggled */
1679	gt_recalc_timer(cpu, timeridx);
1680	} else if ((oldval ^ value) & 2) {
1681	/*
1682	* IMASK toggled: don't need to recalculate,
1683	* just set the interrupt line based on ISTATUS
1684	*/
1685	trace_arm_gt_imask_toggle(timeridx);
1686	gt_update_irq(cpu, timeridx);
1687	}
1688	}
1689
1690	static void gt_phys_timer_reset(CPUARMState env, const ARMCPRegInfo ri)
1691	{
1692	gt_timer_reset(env, ri, GTIMER_PHYS);
1693	}
1694
1695	static void gt_phys_cval_write(CPUARMState env, const ARMCPRegInfo ri,
1696	uint64_t value)
1697	{
1698	gt_cval_write(env, ri, GTIMER_PHYS, value);
1699	}
1700
1701	static uint64_t gt_phys_tval_read(CPUARMState env, const ARMCPRegInfo ri)
1702	{
1703	return gt_tval_read(env, ri, GTIMER_PHYS);
1704	}
1705
1706	static void gt_phys_tval_write(CPUARMState env, const ARMCPRegInfo ri,
1707	uint64_t value)
1708	{
1709	gt_tval_write(env, ri, GTIMER_PHYS, value);
1710	}
1711
1712	static void gt_phys_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
1713	uint64_t value)
1714	{
1715	gt_ctl_write(env, ri, GTIMER_PHYS, value);
1716	}
1717
1718	static int gt_phys_redir_timeridx(CPUARMState *env)
1719	{
1720	switch (arm_mmu_idx(env)) {
1721	case ARMMMUIdx_E20_0:
1722	case ARMMMUIdx_E20_2:
1723	case ARMMMUIdx_E20_2_PAN:
1724	return GTIMER_HYP;
1725	default:
1726	return GTIMER_PHYS;
1727	}
1728	}
1729
1730	static int gt_virt_redir_timeridx(CPUARMState *env)
1731	{
1732	switch (arm_mmu_idx(env)) {
1733	case ARMMMUIdx_E20_0:
1734	case ARMMMUIdx_E20_2:
1735	case ARMMMUIdx_E20_2_PAN:
1736	return GTIMER_HYPVIRT;
1737	default:
1738	return GTIMER_VIRT;
1739	}
1740	}
1741
1742	static uint64_t gt_phys_redir_cval_read(CPUARMState *env,
1743	const ARMCPRegInfo *ri)
1744	{
1745	int timeridx = gt_phys_redir_timeridx(env);
1746	return env->cp15.c14_timer[timeridx].cval;
1747	}
1748
1749	static void gt_phys_redir_cval_write(CPUARMState env, const ARMCPRegInfo ri,
1750	uint64_t value)
1751	{
1752	int timeridx = gt_phys_redir_timeridx(env);
1753	gt_cval_write(env, ri, timeridx, value);
1754	}
1755
1756	static uint64_t gt_phys_redir_tval_read(CPUARMState *env,
1757	const ARMCPRegInfo *ri)
1758	{
1759	int timeridx = gt_phys_redir_timeridx(env);
1760	return gt_tval_read(env, ri, timeridx);
1761	}
1762
1763	static void gt_phys_redir_tval_write(CPUARMState env, const ARMCPRegInfo ri,
1764	uint64_t value)
1765	{
1766	int timeridx = gt_phys_redir_timeridx(env);
1767	gt_tval_write(env, ri, timeridx, value);
1768	}
1769
1770	static uint64_t gt_phys_redir_ctl_read(CPUARMState *env,
1771	const ARMCPRegInfo *ri)
1772	{
1773	int timeridx = gt_phys_redir_timeridx(env);
1774	return env->cp15.c14_timer[timeridx].ctl;
1775	}
1776
1777	static void gt_phys_redir_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
1778	uint64_t value)
1779	{
1780	int timeridx = gt_phys_redir_timeridx(env);
1781	gt_ctl_write(env, ri, timeridx, value);
1782	}
1783
1784	static void gt_virt_timer_reset(CPUARMState env, const ARMCPRegInfo ri)
1785	{
1786	gt_timer_reset(env, ri, GTIMER_VIRT);
1787	}
1788
1789	static void gt_virt_cval_write(CPUARMState env, const ARMCPRegInfo ri,
1790	uint64_t value)
1791	{
1792	gt_cval_write(env, ri, GTIMER_VIRT, value);
1793	}
1794
1795	static uint64_t gt_virt_tval_read(CPUARMState env, const ARMCPRegInfo ri)
1796	{
1797	/*
1798	* This is CNTV_TVAL_EL02; unlike the underlying CNTV_TVAL_EL0
1799	* we always apply CNTVOFF_EL2. Special case that here rather
1800	* than going into the generic gt_tval_read() and then having
1801	* to re-detect that it's this register.
1802	* Note that the accessfn/perms mean we know we're at EL2 or EL3 here.
1803	*/
1804	return do_tval_read(env, GTIMER_VIRT, env->cp15.cntvoff_el2);
1805	}
1806
1807	static void gt_virt_tval_write(CPUARMState env, const ARMCPRegInfo ri,
1808	uint64_t value)
1809	{
1810	/* Similarly for writes to CNTV_TVAL_EL02 */
1811	do_tval_write(env, GTIMER_VIRT, value, env->cp15.cntvoff_el2);
1812	}
1813
1814	static void gt_virt_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
1815	uint64_t value)
1816	{
1817	gt_ctl_write(env, ri, GTIMER_VIRT, value);
1818	}
1819
1820	static void gt_cnthctl_write(CPUARMState env, const ARMCPRegInfo ri,
1821	uint64_t value)
1822	{
1823	ARMCPU *cpu = env_archcpu(env);
1824	uint32_t oldval = env->cp15.cnthctl_el2;
1825	uint32_t valid_mask =
1826	R_CNTHCTL_EL0PCTEN_E2H1_MASK \|
1827	R_CNTHCTL_EL0VCTEN_E2H1_MASK \|
1828	R_CNTxCTL_EVNTEN_MASK \|
1829	R_CNTxCTL_EVNTDIR_MASK \|
1830	R_CNTxCTL_EVNTI_MASK \|
1831	R_CNTHCTL_EL0VTEN_MASK \|
1832	R_CNTHCTL_EL0PTEN_MASK \|
1833	R_CNTHCTL_EL1PCTEN_E2H1_MASK \|
1834	R_CNTHCTL_EL1PTEN_MASK;
1835
1836	if (cpu_isar_feature(aa64_rme, cpu)) {
1837	valid_mask \|= R_CNTHCTL_CNTVMASK_MASK \| R_CNTHCTL_CNTPMASK_MASK;
1838	}
1839	if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
1840	valid_mask \|=
1841	R_CNTHCTL_EL1TVT_MASK \|
1842	R_CNTHCTL_EL1TVCT_MASK \|
1843	R_CNTHCTL_EL1NVPCT_MASK \|
1844	R_CNTHCTL_EL1NVVCT_MASK \|
1845	R_CNTxCTL_EVNTIS_MASK;
1846	}
1847	if (cpu_isar_feature(aa64_ecv, cpu)) {
1848	valid_mask \|= R_CNTHCTL_ECV_MASK;
1849	}
1850
1851	/* Clear RES0 bits */
1852	value &= valid_mask;
1853
1854	raw_write(env, ri, value);
1855
1856	if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
1857	gt_update_irq(cpu, GTIMER_VIRT);
1858	}
1859	if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
1860	gt_update_irq(cpu, GTIMER_PHYS);
1861	}
1862	if ((oldval ^ value) & R_CNTHCTL_ECV_MASK) {
1863	gt_recalc_timer(cpu, GTIMER_PHYS);
1864	}
1865	}
1866
1867	static void gt_cntvoff_write(CPUARMState env, const ARMCPRegInfo ri,
1868	uint64_t value)
1869	{
1870	ARMCPU *cpu = env_archcpu(env);
1871
1872	trace_arm_gt_cntvoff_write(value);
1873	raw_write(env, ri, value);
1874	gt_recalc_timer(cpu, GTIMER_VIRT);
1875	}
1876
1877	static uint64_t gt_virt_redir_cval_read(CPUARMState *env,
1878	const ARMCPRegInfo *ri)
1879	{
1880	int timeridx = gt_virt_redir_timeridx(env);
1881	return env->cp15.c14_timer[timeridx].cval;
1882	}
1883
1884	static void gt_virt_redir_cval_write(CPUARMState env, const ARMCPRegInfo ri,
1885	uint64_t value)
1886	{
1887	int timeridx = gt_virt_redir_timeridx(env);
1888	gt_cval_write(env, ri, timeridx, value);
1889	}
1890
1891	static uint64_t gt_virt_redir_tval_read(CPUARMState *env,
1892	const ARMCPRegInfo *ri)
1893	{
1894	int timeridx = gt_virt_redir_timeridx(env);
1895	return gt_tval_read(env, ri, timeridx);
1896	}
1897
1898	static void gt_virt_redir_tval_write(CPUARMState env, const ARMCPRegInfo ri,
1899	uint64_t value)
1900	{
1901	int timeridx = gt_virt_redir_timeridx(env);
1902	gt_tval_write(env, ri, timeridx, value);
1903	}
1904
1905	static uint64_t gt_virt_redir_ctl_read(CPUARMState *env,
1906	const ARMCPRegInfo *ri)
1907	{
1908	int timeridx = gt_virt_redir_timeridx(env);
1909	return env->cp15.c14_timer[timeridx].ctl;
1910	}
1911
1912	static void gt_virt_redir_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
1913	uint64_t value)
1914	{
1915	int timeridx = gt_virt_redir_timeridx(env);
1916	gt_ctl_write(env, ri, timeridx, value);
1917	}
1918
1919	static void gt_hyp_timer_reset(CPUARMState env, const ARMCPRegInfo ri)
1920	{
1921	gt_timer_reset(env, ri, GTIMER_HYP);
1922	}
1923
1924	static void gt_hyp_cval_write(CPUARMState env, const ARMCPRegInfo ri,
1925	uint64_t value)
1926	{
1927	gt_cval_write(env, ri, GTIMER_HYP, value);
1928	}
1929
1930	static uint64_t gt_hyp_tval_read(CPUARMState env, const ARMCPRegInfo ri)
1931	{
1932	return gt_tval_read(env, ri, GTIMER_HYP);
1933	}
1934
1935	static void gt_hyp_tval_write(CPUARMState env, const ARMCPRegInfo ri,
1936	uint64_t value)
1937	{
1938	gt_tval_write(env, ri, GTIMER_HYP, value);
1939	}
1940
1941	static void gt_hyp_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
1942	uint64_t value)
1943	{
1944	gt_ctl_write(env, ri, GTIMER_HYP, value);
1945	}
1946
1947	static void gt_sec_timer_reset(CPUARMState env, const ARMCPRegInfo ri)
1948	{
1949	gt_timer_reset(env, ri, GTIMER_SEC);
1950	}
1951
1952	static void gt_sec_cval_write(CPUARMState env, const ARMCPRegInfo ri,
1953	uint64_t value)
1954	{
1955	gt_cval_write(env, ri, GTIMER_SEC, value);
1956	}
1957
1958	static uint64_t gt_sec_tval_read(CPUARMState env, const ARMCPRegInfo ri)
1959	{
1960	return gt_tval_read(env, ri, GTIMER_SEC);
1961	}
1962
1963	static void gt_sec_tval_write(CPUARMState env, const ARMCPRegInfo ri,
1964	uint64_t value)
1965	{
1966	gt_tval_write(env, ri, GTIMER_SEC, value);
1967	}
1968
1969	static void gt_sec_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
1970	uint64_t value)
1971	{
1972	gt_ctl_write(env, ri, GTIMER_SEC, value);
1973	}
1974
1975	static void gt_sec_pel2_timer_reset(CPUARMState env, const ARMCPRegInfo ri)
1976	{
1977	gt_timer_reset(env, ri, GTIMER_S_EL2_PHYS);
1978	}
1979
1980	static void gt_sec_pel2_cval_write(CPUARMState env, const ARMCPRegInfo ri,
1981	uint64_t value)
1982	{
1983	gt_cval_write(env, ri, GTIMER_S_EL2_PHYS, value);
1984	}
1985
1986	static uint64_t gt_sec_pel2_tval_read(CPUARMState env, const ARMCPRegInfo ri)
1987	{
1988	return gt_tval_read(env, ri, GTIMER_S_EL2_PHYS);
1989	}
1990
1991	static void gt_sec_pel2_tval_write(CPUARMState env, const ARMCPRegInfo ri,
1992	uint64_t value)
1993	{
1994	gt_tval_write(env, ri, GTIMER_S_EL2_PHYS, value);
1995	}
1996
1997	static void gt_sec_pel2_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
1998	uint64_t value)
1999	{
2000	gt_ctl_write(env, ri, GTIMER_S_EL2_PHYS, value);
2001	}
2002
2003	static void gt_sec_vel2_timer_reset(CPUARMState env, const ARMCPRegInfo ri)
2004	{
2005	gt_timer_reset(env, ri, GTIMER_S_EL2_VIRT);
2006	}
2007
2008	static void gt_sec_vel2_cval_write(CPUARMState env, const ARMCPRegInfo ri,
2009	uint64_t value)
2010	{
2011	gt_cval_write(env, ri, GTIMER_S_EL2_VIRT, value);
2012	}
2013
2014	static uint64_t gt_sec_vel2_tval_read(CPUARMState env, const ARMCPRegInfo ri)
2015	{
2016	return gt_tval_read(env, ri, GTIMER_S_EL2_VIRT);
2017	}
2018
2019	static void gt_sec_vel2_tval_write(CPUARMState env, const ARMCPRegInfo ri,
2020	uint64_t value)
2021	{
2022	gt_tval_write(env, ri, GTIMER_S_EL2_VIRT, value);
2023	}
2024
2025	static void gt_sec_vel2_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
2026	uint64_t value)
2027	{
2028	gt_ctl_write(env, ri, GTIMER_S_EL2_VIRT, value);
2029	}
2030
2031	static void gt_hv_timer_reset(CPUARMState env, const ARMCPRegInfo ri)
2032	{
2033	gt_timer_reset(env, ri, GTIMER_HYPVIRT);
2034	}
2035
2036	static void gt_hv_cval_write(CPUARMState env, const ARMCPRegInfo ri,
2037	uint64_t value)
2038	{
2039	gt_cval_write(env, ri, GTIMER_HYPVIRT, value);
2040	}
2041
2042	static uint64_t gt_hv_tval_read(CPUARMState env, const ARMCPRegInfo ri)
2043	{
2044	return gt_tval_read(env, ri, GTIMER_HYPVIRT);
2045	}
2046
2047	static void gt_hv_tval_write(CPUARMState env, const ARMCPRegInfo ri,
2048	uint64_t value)
2049	{
2050	gt_tval_write(env, ri, GTIMER_HYPVIRT, value);
2051	}
2052
2053	static void gt_hv_ctl_write(CPUARMState env, const ARMCPRegInfo ri,
2054	uint64_t value)
2055	{
2056	gt_ctl_write(env, ri, GTIMER_HYPVIRT, value);
2057	}
2058
2059	void arm_gt_ptimer_cb(void *opaque)
2060	{
2061	ARMCPU *cpu = opaque;
2062
2063	gt_recalc_timer(cpu, GTIMER_PHYS);
2064	}
2065
2066	void arm_gt_vtimer_cb(void *opaque)
2067	{
2068	ARMCPU *cpu = opaque;
2069
2070	gt_recalc_timer(cpu, GTIMER_VIRT);
2071	}
2072
2073	void arm_gt_htimer_cb(void *opaque)
2074	{
2075	ARMCPU *cpu = opaque;
2076
2077	gt_recalc_timer(cpu, GTIMER_HYP);
2078	}
2079
2080	void arm_gt_stimer_cb(void *opaque)
2081	{
2082	ARMCPU *cpu = opaque;
2083
2084	gt_recalc_timer(cpu, GTIMER_SEC);
2085	}
2086
2087	void arm_gt_sel2timer_cb(void *opaque)
2088	{
2089	ARMCPU *cpu = opaque;
2090
2091	gt_recalc_timer(cpu, GTIMER_S_EL2_PHYS);
2092	}
2093
2094	void arm_gt_sel2vtimer_cb(void *opaque)
2095	{
2096	ARMCPU *cpu = opaque;
2097
2098	gt_recalc_timer(cpu, GTIMER_S_EL2_VIRT);
2099	}
2100
2101	void arm_gt_hvtimer_cb(void *opaque)
2102	{
2103	ARMCPU *cpu = opaque;
2104
2105	gt_recalc_timer(cpu, GTIMER_HYPVIRT);
2106	}
2107
2108	static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2109	/*
2110	* Note that CNTFRQ is purely reads-as-written for the benefit
2111	* of software; writing it doesn't actually change the timer frequency.
2112	* Our reset value matches the fixed frequency we implement the timer at.
2113	*/
2114	{ .name = "CNTFRQ", .cp = 15, .crn = 14, .crm = 0, .opc1 = 0, .opc2 = 0,
2115	.type = ARM_CP_ALIAS,
2116	.access = PL1_RW \| PL0_R, .accessfn = gt_cntfrq_access,
2117	.fieldoffset = offsetoflow32(CPUARMState, cp15.c14_cntfrq),
2118	},
2119	{ .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2120	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2121	.access = PL1_RW \| PL0_R, .accessfn = gt_cntfrq_access,
2122	.fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2123	.resetfn = arm_gt_cntfrq_reset,
2124	},
2125	/* overall control: mostly access permissions */
2126	{ .name = "CNTKCTL_EL1", .state = ARM_CP_STATE_BOTH,
2127	.opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
2128	.access = PL1_RW,
2129	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 14, 1, 0),
2130	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 14, 1, 0),
2131	.fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
2132	.resetvalue = 0,
2133	},
2134	/* per-timer control */
2135	{ .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2136	.secure = ARM_CP_SECSTATE_NS,
2137	.type = ARM_CP_IO \| ARM_CP_ALIAS, .access = PL0_RW,
2138	.accessfn = gt_ptimer_access,
2139	.fieldoffset = offsetoflow32(CPUARMState,
2140	cp15.c14_timer[GTIMER_PHYS].ctl),
2141	.readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read,
2142	.writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write,
2143	},
2144	{ .name = "CNTP_CTL_S",
2145	.cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
2146	.secure = ARM_CP_SECSTATE_S,
2147	.type = ARM_CP_IO \| ARM_CP_ALIAS, .access = PL0_RW,
2148	.accessfn = gt_ptimer_access,
2149	.fieldoffset = offsetoflow32(CPUARMState,
2150	cp15.c14_timer[GTIMER_SEC].ctl),
2151	.writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2152	},
2153	{ .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
2154	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
2155	.type = ARM_CP_IO, .access = PL0_RW,
2156	.accessfn = gt_ptimer_access,
2157	.nv2_redirect_offset = 0x180 \| NV2_REDIR_NV1,
2158	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
2159	.resetvalue = 0,
2160	.readfn = gt_phys_redir_ctl_read, .raw_readfn = raw_read,
2161	.writefn = gt_phys_redir_ctl_write, .raw_writefn = raw_write,
2162	},
2163	{ .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
2164	.type = ARM_CP_IO \| ARM_CP_ALIAS, .access = PL0_RW,
2165	.accessfn = gt_vtimer_access,
2166	.fieldoffset = offsetoflow32(CPUARMState,
2167	cp15.c14_timer[GTIMER_VIRT].ctl),
2168	.readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read,
2169	.writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write,
2170	},
2171	{ .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
2172	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
2173	.type = ARM_CP_IO, .access = PL0_RW,
2174	.accessfn = gt_vtimer_access,
2175	.nv2_redirect_offset = 0x170 \| NV2_REDIR_NV1,
2176	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
2177	.resetvalue = 0,
2178	.readfn = gt_virt_redir_ctl_read, .raw_readfn = raw_read,
2179	.writefn = gt_virt_redir_ctl_write, .raw_writefn = raw_write,
2180	},
2181	/* TimerValue views: a 32 bit downcounting view of the underlying state */
2182	{ .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2183	.secure = ARM_CP_SECSTATE_NS,
2184	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL0_RW,
2185	.accessfn = gt_ptimer_access,
2186	.readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write,
2187	},
2188	{ .name = "CNTP_TVAL_S",
2189	.cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
2190	.secure = ARM_CP_SECSTATE_S,
2191	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL0_RW,
2192	.accessfn = gt_ptimer_access,
2193	.readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
2194	},
2195	{ .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2196	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
2197	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL0_RW,
2198	.accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
2199	.readfn = gt_phys_redir_tval_read, .writefn = gt_phys_redir_tval_write,
2200	},
2201	{ .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
2202	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL0_RW,
2203	.accessfn = gt_vtimer_access,
2204	.readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write,
2205	},
2206	{ .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
2207	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
2208	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL0_RW,
2209	.accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
2210	.readfn = gt_virt_redir_tval_read, .writefn = gt_virt_redir_tval_write,
2211	},
2212	/* The counter itself */
2213	{ .name = "CNTPCT", .cp = 15, .crm = 14, .opc1 = 0,
2214	.access = PL0_R, .type = ARM_CP_64BIT \| ARM_CP_NO_RAW \| ARM_CP_IO,
2215	.accessfn = gt_pct_access,
2216	.readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
2217	},
2218	{ .name = "CNTPCT_EL0", .state = ARM_CP_STATE_AA64,
2219	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 1,
2220	.access = PL0_R, .type = ARM_CP_NO_RAW \| ARM_CP_IO,
2221	.accessfn = gt_pct_access, .readfn = gt_cnt_read,
2222	},
2223	{ .name = "CNTVCT", .cp = 15, .crm = 14, .opc1 = 1,
2224	.access = PL0_R, .type = ARM_CP_64BIT \| ARM_CP_NO_RAW \| ARM_CP_IO,
2225	.accessfn = gt_vct_access,
2226	.readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
2227	},
2228	{ .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2229	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2230	.access = PL0_R, .type = ARM_CP_NO_RAW \| ARM_CP_IO,
2231	.accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
2232	},
2233	/* Comparison value, indicating when the timer goes off */
2234	{ .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
2235	.secure = ARM_CP_SECSTATE_NS,
2236	.access = PL0_RW,
2237	.type = ARM_CP_64BIT \| ARM_CP_IO \| ARM_CP_ALIAS,
2238	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2239	.accessfn = gt_ptimer_access,
2240	.readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read,
2241	.writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write,
2242	},
2243	{ .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
2244	.secure = ARM_CP_SECSTATE_S,
2245	.access = PL0_RW,
2246	.type = ARM_CP_64BIT \| ARM_CP_IO \| ARM_CP_ALIAS,
2247	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2248	.accessfn = gt_ptimer_access,
2249	.writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2250	},
2251	{ .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2252	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
2253	.access = PL0_RW,
2254	.type = ARM_CP_IO,
2255	.nv2_redirect_offset = 0x178 \| NV2_REDIR_NV1,
2256	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
2257	.resetvalue = 0, .accessfn = gt_ptimer_access,
2258	.readfn = gt_phys_redir_cval_read, .raw_readfn = raw_read,
2259	.writefn = gt_phys_redir_cval_write, .raw_writefn = raw_write,
2260	},
2261	{ .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
2262	.access = PL0_RW,
2263	.type = ARM_CP_64BIT \| ARM_CP_IO \| ARM_CP_ALIAS,
2264	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2265	.accessfn = gt_vtimer_access,
2266	.readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read,
2267	.writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write,
2268	},
2269	{ .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
2270	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
2271	.access = PL0_RW,
2272	.type = ARM_CP_IO,
2273	.nv2_redirect_offset = 0x168 \| NV2_REDIR_NV1,
2274	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
2275	.resetvalue = 0, .accessfn = gt_vtimer_access,
2276	.readfn = gt_virt_redir_cval_read, .raw_readfn = raw_read,
2277	.writefn = gt_virt_redir_cval_write, .raw_writefn = raw_write,
2278	},
2279	/*
2280	* Secure timer -- this is actually restricted to only EL3
2281	* and configurably Secure-EL1 via the accessfn.
2282	*/
2283	{ .name = "CNTPS_TVAL_EL1", .state = ARM_CP_STATE_AA64,
2284	.opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 0,
2285	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL1_RW,
2286	.accessfn = gt_stimer_access,
2287	.readfn = gt_sec_tval_read,
2288	.writefn = gt_sec_tval_write,
2289	.resetfn = gt_sec_timer_reset,
2290	},
2291	{ .name = "CNTPS_CTL_EL1", .state = ARM_CP_STATE_AA64,
2292	.opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 1,
2293	.type = ARM_CP_IO, .access = PL1_RW,
2294	.accessfn = gt_stimer_access,
2295	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].ctl),
2296	.resetvalue = 0,
2297	.writefn = gt_sec_ctl_write, .raw_writefn = raw_write,
2298	},
2299	{ .name = "CNTPS_CVAL_EL1", .state = ARM_CP_STATE_AA64,
2300	.opc0 = 3, .opc1 = 7, .crn = 14, .crm = 2, .opc2 = 2,
2301	.type = ARM_CP_IO, .access = PL1_RW,
2302	.accessfn = gt_stimer_access,
2303	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
2304	.writefn = gt_sec_cval_write, .raw_writefn = raw_write,
2305	},
2306	};
2307
2308	/*
2309	* FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
2310	* are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
2311	* so our implementations here are identical to the normal registers.
2312	*/
2313	static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
2314	{ .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
2315	.access = PL0_R, .type = ARM_CP_64BIT \| ARM_CP_NO_RAW \| ARM_CP_IO,
2316	.accessfn = gt_vct_access,
2317	.readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
2318	},
2319	{ .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
2320	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
2321	.access = PL0_R, .type = ARM_CP_NO_RAW \| ARM_CP_IO,
2322	.accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
2323	},
2324	{ .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
2325	.access = PL0_R, .type = ARM_CP_64BIT \| ARM_CP_NO_RAW \| ARM_CP_IO,
2326	.accessfn = gt_pct_access,
2327	.readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
2328	},
2329	{ .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
2330	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
2331	.access = PL0_R, .type = ARM_CP_NO_RAW \| ARM_CP_IO,
2332	.accessfn = gt_pct_access, .readfn = gt_cnt_read,
2333	},
2334	};
2335
2336	static CPAccessResult gt_cntpoff_access(CPUARMState *env,
2337	const ARMCPRegInfo *ri,
2338	bool isread)
2339	{
2340	if (arm_current_el(env) == 2 && arm_feature(env, ARM_FEATURE_EL3) &&
2341	!(env->cp15.scr_el3 & SCR_ECVEN)) {
2342	return CP_ACCESS_TRAP_EL3;
2343	}
2344	return CP_ACCESS_OK;
2345	}
2346
2347	static void gt_cntpoff_write(CPUARMState env, const ARMCPRegInfo ri,
2348	uint64_t value)
2349	{
2350	ARMCPU *cpu = env_archcpu(env);
2351
2352	trace_arm_gt_cntpoff_write(value);
2353	raw_write(env, ri, value);
2354	gt_recalc_timer(cpu, GTIMER_PHYS);
2355	}
2356
2357	static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
2358	.name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
2359	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
2360	.access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
2361	.accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
2362	.nv2_redirect_offset = 0x1a8,
2363	.fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
2364	};
2365	#else
2366
2367	/*
2368	* In user-mode most of the generic timer registers are inaccessible
2369	* however modern kernels (4.12+) allow access to cntvct_el0
2370	*/
2371
2372	static uint64_t gt_virt_cnt_read(CPUARMState env, const ARMCPRegInfo ri)
2373	{
2374	ARMCPU *cpu = env_archcpu(env);
2375
2376	/*
2377	* Currently we have no support for QEMUTimer in linux-user so we
2378	* can't call gt_get_countervalue(env), instead we directly
2379	* call the lower level functions.
2380	*/
2381	return cpu_get_clock() / gt_cntfrq_period_ns(cpu);
2382	}
2383
2384	static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
2385	{ .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
2386	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
2387	.access = PL0_R /* no PL1_RW in linux-user */,
2388	.fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
2389	.resetfn = arm_gt_cntfrq_reset,
2390	},
2391	{ .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,
2392	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,
2393	.access = PL0_R, .type = ARM_CP_NO_RAW \| ARM_CP_IO,
2394	.readfn = gt_virt_cnt_read,
2395	},
2396	};
2397
2398	/*
2399	* CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
2400	* is exposed to userspace by Linux.
2401	*/
2402	static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
2403	{ .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
2404	.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
2405	.access = PL0_R, .type = ARM_CP_NO_RAW \| ARM_CP_IO,
2406	.readfn = gt_virt_cnt_read,
2407	},
2408	};
2409
2410	#endif
2411
2412	static void par_write(CPUARMState env, const ARMCPRegInfo ri, uint64_t value)
2413	{
2414	if (arm_feature(env, ARM_FEATURE_LPAE)) {
2415	raw_write(env, ri, value);
2416	} else if (arm_feature(env, ARM_FEATURE_V7)) {
2417	raw_write(env, ri, value & 0xfffff6ff);
2418	} else {
2419	raw_write(env, ri, value & 0xfffff1ff);
2420	}
2421	}
2422
2423	/* Return basic MPU access permission bits. */
2424	static uint32_t simple_mpu_ap_bits(uint32_t val)
2425	{
2426	uint32_t ret;
2427	uint32_t mask;
2428	int i;
2429	ret = 0;
2430	mask = 3;
2431	for (i = 0; i < 16; i += 2) {
2432	ret \|= (val >> i) & mask;
2433	mask <<= 2;
2434	}
2435	return ret;
2436	}
2437
2438	/* Pad basic MPU access permission bits to extended format. */
2439	static uint32_t extended_mpu_ap_bits(uint32_t val)
2440	{
2441	uint32_t ret;
2442	uint32_t mask;
2443	int i;
2444	ret = 0;
2445	mask = 3;
2446	for (i = 0; i < 16; i += 2) {
2447	ret \|= (val & mask) << i;
2448	mask <<= 2;
2449	}
2450	return ret;
2451	}
2452
2453	static void pmsav5_data_ap_write(CPUARMState env, const ARMCPRegInfo ri,
2454	uint64_t value)
2455	{
2456	env->cp15.pmsav5_data_ap = extended_mpu_ap_bits(value);
2457	}
2458
2459	static uint64_t pmsav5_data_ap_read(CPUARMState env, const ARMCPRegInfo ri)
2460	{
2461	return simple_mpu_ap_bits(env->cp15.pmsav5_data_ap);
2462	}
2463
2464	static void pmsav5_insn_ap_write(CPUARMState env, const ARMCPRegInfo ri,
2465	uint64_t value)
2466	{
2467	env->cp15.pmsav5_insn_ap = extended_mpu_ap_bits(value);
2468	}
2469
2470	static uint64_t pmsav5_insn_ap_read(CPUARMState env, const ARMCPRegInfo ri)
2471	{
2472	return simple_mpu_ap_bits(env->cp15.pmsav5_insn_ap);
2473	}
2474
2475	static uint64_t pmsav7_read(CPUARMState env, const ARMCPRegInfo ri)
2476	{
2477	uint32_t u32p = (uint32_t **)raw_ptr(env, ri);
2478
2479	if (!u32p) {
2480	return 0;
2481	}
2482
2483	u32p += env->pmsav7.rnr[M_REG_NS];
2484	return *u32p;
2485	}
2486
2487	static void pmsav7_write(CPUARMState env, const ARMCPRegInfo ri,
2488	uint64_t value)
2489	{
2490	ARMCPU *cpu = env_archcpu(env);
2491	uint32_t u32p = (uint32_t **)raw_ptr(env, ri);
2492
2493	if (!u32p) {
2494	return;
2495	}
2496
2497	u32p += env->pmsav7.rnr[M_REG_NS];
2498	tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
2499	*u32p = value;
2500	}
2501
2502	static void pmsav7_rgnr_write(CPUARMState env, const ARMCPRegInfo ri,
2503	uint64_t value)
2504	{
2505	ARMCPU *cpu = env_archcpu(env);
2506	uint32_t nrgs = cpu->pmsav7_dregion;
2507
2508	if (value >= nrgs) {
2509	qemu_log_mask(LOG_GUEST_ERROR,
2510	"PMSAv7 RGNR write >= # supported regions, %" PRIu32
2511	" > %" PRIu32 "\n", (uint32_t)value, nrgs);
2512	return;
2513	}
2514
2515	raw_write(env, ri, value);
2516	}
2517
2518	static void prbar_write(CPUARMState env, const ARMCPRegInfo ri,
2519	uint64_t value)
2520	{
2521	ARMCPU *cpu = env_archcpu(env);
2522
2523	tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
2524	env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value;
2525	}
2526
2527	static uint64_t prbar_read(CPUARMState env, const ARMCPRegInfo ri)
2528	{
2529	return env->pmsav8.rbar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]];
2530	}
2531
2532	static void prlar_write(CPUARMState env, const ARMCPRegInfo ri,
2533	uint64_t value)
2534	{
2535	ARMCPU *cpu = env_archcpu(env);
2536
2537	tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
2538	env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]] = value;
2539	}
2540
2541	static uint64_t prlar_read(CPUARMState env, const ARMCPRegInfo ri)
2542	{
2543	return env->pmsav8.rlar[M_REG_NS][env->pmsav7.rnr[M_REG_NS]];
2544	}
2545
2546	static void prselr_write(CPUARMState env, const ARMCPRegInfo ri,
2547	uint64_t value)
2548	{
2549	ARMCPU *cpu = env_archcpu(env);
2550
2551	/*
2552	* Ignore writes that would select not implemented region.
2553	* This is architecturally UNPREDICTABLE.
2554	*/
2555	if (value >= cpu->pmsav7_dregion) {
2556	return;
2557	}
2558
2559	env->pmsav7.rnr[M_REG_NS] = value;
2560	}
2561
2562	static void hprbar_write(CPUARMState env, const ARMCPRegInfo ri,
2563	uint64_t value)
2564	{
2565	ARMCPU *cpu = env_archcpu(env);
2566
2567	tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
2568	env->pmsav8.hprbar[env->pmsav8.hprselr] = value;
2569	}
2570
2571	static uint64_t hprbar_read(CPUARMState env, const ARMCPRegInfo ri)
2572	{
2573	return env->pmsav8.hprbar[env->pmsav8.hprselr];
2574	}
2575
2576	static void hprlar_write(CPUARMState env, const ARMCPRegInfo ri,
2577	uint64_t value)
2578	{
2579	ARMCPU *cpu = env_archcpu(env);
2580
2581	tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
2582	env->pmsav8.hprlar[env->pmsav8.hprselr] = value;
2583	}
2584
2585	static uint64_t hprlar_read(CPUARMState env, const ARMCPRegInfo ri)
2586	{
2587	return env->pmsav8.hprlar[env->pmsav8.hprselr];
2588	}
2589
2590	static void hprenr_write(CPUARMState env, const ARMCPRegInfo ri,
2591	uint64_t value)
2592	{
2593	uint32_t n;
2594	uint32_t bit;
2595	ARMCPU *cpu = env_archcpu(env);
2596
2597	/* Ignore writes to unimplemented regions */
2598	int rmax = MIN(cpu->pmsav8r_hdregion, 32);
2599	value &= MAKE_64BIT_MASK(0, rmax);
2600
2601	tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
2602
2603	/* Register alias is only valid for first 32 indexes */
2604	for (n = 0; n < rmax; ++n) {
2605	bit = extract32(value, n, 1);
2606	env->pmsav8.hprlar[n] = deposit32(
2607	env->pmsav8.hprlar[n], 0, 1, bit);
2608	}
2609	}
2610
2611	static uint64_t hprenr_read(CPUARMState env, const ARMCPRegInfo ri)
2612	{
2613	uint32_t n;
2614	uint32_t result = 0x0;
2615	ARMCPU *cpu = env_archcpu(env);
2616
2617	/* Register alias is only valid for first 32 indexes */
2618	for (n = 0; n < MIN(cpu->pmsav8r_hdregion, 32); ++n) {
2619	if (env->pmsav8.hprlar[n] & 0x1) {
2620	result \|= (0x1 << n);
2621	}
2622	}
2623	return result;
2624	}
2625
2626	static void hprselr_write(CPUARMState env, const ARMCPRegInfo ri,
2627	uint64_t value)
2628	{
2629	ARMCPU *cpu = env_archcpu(env);
2630
2631	/*
2632	* Ignore writes that would select not implemented region.
2633	* This is architecturally UNPREDICTABLE.
2634	*/
2635	if (value >= cpu->pmsav8r_hdregion) {
2636	return;
2637	}
2638
2639	env->pmsav8.hprselr = value;
2640	}
2641
2642	static void pmsav8r_regn_write(CPUARMState env, const ARMCPRegInfo ri,
2643	uint64_t value)
2644	{
2645	ARMCPU *cpu = env_archcpu(env);
2646	uint8_t index = (extract32(ri->opc0, 0, 1) << 4) \|
2647	(extract32(ri->crm, 0, 3) << 1) \| extract32(ri->opc2, 2, 1);
2648
2649	tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
2650
2651	if (ri->opc1 & 4) {
2652	if (index >= cpu->pmsav8r_hdregion) {
2653	return;
2654	}
2655	if (ri->opc2 & 0x1) {
2656	env->pmsav8.hprlar[index] = value;
2657	} else {
2658	env->pmsav8.hprbar[index] = value;
2659	}
2660	} else {
2661	if (index >= cpu->pmsav7_dregion) {
2662	return;
2663	}
2664	if (ri->opc2 & 0x1) {
2665	env->pmsav8.rlar[M_REG_NS][index] = value;
2666	} else {
2667	env->pmsav8.rbar[M_REG_NS][index] = value;
2668	}
2669	}
2670	}
2671
2672	static uint64_t pmsav8r_regn_read(CPUARMState env, const ARMCPRegInfo ri)
2673	{
2674	ARMCPU *cpu = env_archcpu(env);
2675	uint8_t index = (extract32(ri->opc0, 0, 1) << 4) \|
2676	(extract32(ri->crm, 0, 3) << 1) \| extract32(ri->opc2, 2, 1);
2677
2678	if (ri->opc1 & 4) {
2679	if (index >= cpu->pmsav8r_hdregion) {
2680	return 0x0;
2681	}
2682	if (ri->opc2 & 0x1) {
2683	return env->pmsav8.hprlar[index];
2684	} else {
2685	return env->pmsav8.hprbar[index];
2686	}
2687	} else {
2688	if (index >= cpu->pmsav7_dregion) {
2689	return 0x0;
2690	}
2691	if (ri->opc2 & 0x1) {
2692	return env->pmsav8.rlar[M_REG_NS][index];
2693	} else {
2694	return env->pmsav8.rbar[M_REG_NS][index];
2695	}
2696	}
2697	}
2698
2699	static const ARMCPRegInfo pmsav8r_cp_reginfo[] = {
2700	{ .name = "PRBAR",
2701	.cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 0,
2702	.access = PL1_RW, .type = ARM_CP_NO_RAW,
2703	.accessfn = access_tvm_trvm,
2704	.readfn = prbar_read, .writefn = prbar_write },
2705	{ .name = "PRLAR",
2706	.cp = 15, .opc1 = 0, .crn = 6, .crm = 3, .opc2 = 1,
2707	.access = PL1_RW, .type = ARM_CP_NO_RAW,
2708	.accessfn = access_tvm_trvm,
2709	.readfn = prlar_read, .writefn = prlar_write },
2710	{ .name = "PRSELR", .resetvalue = 0,
2711	.cp = 15, .opc1 = 0, .crn = 6, .crm = 2, .opc2 = 1,
2712	.access = PL1_RW, .accessfn = access_tvm_trvm,
2713	.writefn = prselr_write,
2714	.fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]) },
2715	{ .name = "HPRBAR", .resetvalue = 0,
2716	.cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 0,
2717	.access = PL2_RW, .type = ARM_CP_NO_RAW,
2718	.readfn = hprbar_read, .writefn = hprbar_write },
2719	{ .name = "HPRLAR",
2720	.cp = 15, .opc1 = 4, .crn = 6, .crm = 3, .opc2 = 1,
2721	.access = PL2_RW, .type = ARM_CP_NO_RAW,
2722	.readfn = hprlar_read, .writefn = hprlar_write },
2723	{ .name = "HPRSELR", .resetvalue = 0,
2724	.cp = 15, .opc1 = 4, .crn = 6, .crm = 2, .opc2 = 1,
2725	.access = PL2_RW,
2726	.writefn = hprselr_write,
2727	.fieldoffset = offsetof(CPUARMState, pmsav8.hprselr) },
2728	{ .name = "HPRENR",
2729	.cp = 15, .opc1 = 4, .crn = 6, .crm = 1, .opc2 = 1,
2730	.access = PL2_RW, .type = ARM_CP_NO_RAW,
2731	.readfn = hprenr_read, .writefn = hprenr_write },
2732	};
2733
2734	static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
2735	/*
2736	* Reset for all these registers is handled in arm_cpu_reset(),
2737	* because the PMSAv7 is also used by M-profile CPUs, which do
2738	* not register cpregs but still need the state to be reset.
2739	*/
2740	{ .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
2741	.access = PL1_RW, .type = ARM_CP_NO_RAW,
2742	.fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
2743	.readfn = pmsav7_read, .writefn = pmsav7_write,
2744	.resetfn = arm_cp_reset_ignore },
2745	{ .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
2746	.access = PL1_RW, .type = ARM_CP_NO_RAW,
2747	.fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
2748	.readfn = pmsav7_read, .writefn = pmsav7_write,
2749	.resetfn = arm_cp_reset_ignore },
2750	{ .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
2751	.access = PL1_RW, .type = ARM_CP_NO_RAW,
2752	.fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
2753	.readfn = pmsav7_read, .writefn = pmsav7_write,
2754	.resetfn = arm_cp_reset_ignore },
2755	{ .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
2756	.access = PL1_RW,
2757	.fieldoffset = offsetof(CPUARMState, pmsav7.rnr[M_REG_NS]),
2758	.writefn = pmsav7_rgnr_write,
2759	.resetfn = arm_cp_reset_ignore },
2760	};
2761
2762	static const ARMCPRegInfo pmsav5_cp_reginfo[] = {
2763	{ .name = "DATA_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2764	.access = PL1_RW, .type = ARM_CP_ALIAS,
2765	.fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2766	.readfn = pmsav5_data_ap_read, .writefn = pmsav5_data_ap_write, },
2767	{ .name = "INSN_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2768	.access = PL1_RW, .type = ARM_CP_ALIAS,
2769	.fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2770	.readfn = pmsav5_insn_ap_read, .writefn = pmsav5_insn_ap_write, },
2771	{ .name = "DATA_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 2,
2772	.access = PL1_RW,
2773	.fieldoffset = offsetof(CPUARMState, cp15.pmsav5_data_ap),
2774	.resetvalue = 0, },
2775	{ .name = "INSN_EXT_AP", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 3,
2776	.access = PL1_RW,
2777	.fieldoffset = offsetof(CPUARMState, cp15.pmsav5_insn_ap),
2778	.resetvalue = 0, },
2779	{ .name = "DCACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
2780	.access = PL1_RW,
2781	.fieldoffset = offsetof(CPUARMState, cp15.c2_data), .resetvalue = 0, },
2782	{ .name = "ICACHE_CFG", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 1,
2783	.access = PL1_RW,
2784	.fieldoffset = offsetof(CPUARMState, cp15.c2_insn), .resetvalue = 0, },
2785	/* Protection region base and size registers */
2786	{ .name = "946_PRBS0", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0,
2787	.opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2788	.fieldoffset = offsetof(CPUARMState, cp15.c6_region[0]) },
2789	{ .name = "946_PRBS1", .cp = 15, .crn = 6, .crm = 1, .opc1 = 0,
2790	.opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2791	.fieldoffset = offsetof(CPUARMState, cp15.c6_region[1]) },
2792	{ .name = "946_PRBS2", .cp = 15, .crn = 6, .crm = 2, .opc1 = 0,
2793	.opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2794	.fieldoffset = offsetof(CPUARMState, cp15.c6_region[2]) },
2795	{ .name = "946_PRBS3", .cp = 15, .crn = 6, .crm = 3, .opc1 = 0,
2796	.opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2797	.fieldoffset = offsetof(CPUARMState, cp15.c6_region[3]) },
2798	{ .name = "946_PRBS4", .cp = 15, .crn = 6, .crm = 4, .opc1 = 0,
2799	.opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2800	.fieldoffset = offsetof(CPUARMState, cp15.c6_region[4]) },
2801	{ .name = "946_PRBS5", .cp = 15, .crn = 6, .crm = 5, .opc1 = 0,
2802	.opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2803	.fieldoffset = offsetof(CPUARMState, cp15.c6_region[5]) },
2804	{ .name = "946_PRBS6", .cp = 15, .crn = 6, .crm = 6, .opc1 = 0,
2805	.opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2806	.fieldoffset = offsetof(CPUARMState, cp15.c6_region[6]) },
2807	{ .name = "946_PRBS7", .cp = 15, .crn = 6, .crm = 7, .opc1 = 0,
2808	.opc2 = CP_ANY, .access = PL1_RW, .resetvalue = 0,
2809	.fieldoffset = offsetof(CPUARMState, cp15.c6_region[7]) },
2810	};
2811
2812	static void vmsa_ttbcr_write(CPUARMState env, const ARMCPRegInfo ri,
2813	uint64_t value)
2814	{
2815	ARMCPU *cpu = env_archcpu(env);
2816
2817	if (!arm_feature(env, ARM_FEATURE_V8)) {
2818	if (arm_feature(env, ARM_FEATURE_LPAE) && (value & TTBCR_EAE)) {
2819	/*
2820	* Pre ARMv8 bits [21:19], [15:14] and [6:3] are UNK/SBZP when
2821	* using Long-descriptor translation table format
2822	*/
2823	value &= ~((7 << 19) \| (3 << 14) \| (0xf << 3));
2824	} else if (arm_feature(env, ARM_FEATURE_EL3)) {
2825	/*
2826	* In an implementation that includes the Security Extensions
2827	* TTBCR has additional fields PD0 [4] and PD1 [5] for
2828	* Short-descriptor translation table format.
2829	*/
2830	value &= TTBCR_PD1 \| TTBCR_PD0 \| TTBCR_N;
2831	} else {
2832	value &= TTBCR_N;
2833	}
2834	}
2835
2836	if (arm_feature(env, ARM_FEATURE_LPAE)) {
2837	/*
2838	* With LPAE the TTBCR could result in a change of ASID
2839	* via the TTBCR.A1 bit, so do a TLB flush.
2840	*/
2841	tlb_flush(CPU(cpu));
2842	}
2843	raw_write(env, ri, value);
2844	}
2845
2846	static void vmsa_tcr_el12_write(CPUARMState env, const ARMCPRegInfo ri,
2847	uint64_t value)
2848	{
2849	ARMCPU *cpu = env_archcpu(env);
2850
2851	/* For AArch64 the A1 bit could result in a change of ASID, so TLB flush. */
2852	tlb_flush(CPU(cpu));
2853	raw_write(env, ri, value);
2854	}
2855
2856	static void vmsa_ttbr_write(CPUARMState env, const ARMCPRegInfo ri,
2857	uint64_t value)
2858	{
2859	/* If the ASID changes (with a 64-bit write), we must flush the TLB. */
2860	if (cpreg_field_type(ri) == MO_64 &&
2861	extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
2862	ARMCPU *cpu = env_archcpu(env);
2863	tlb_flush(CPU(cpu));
2864	}
2865	raw_write(env, ri, value);
2866	}
2867
2868	static void vmsa_tcr_ttbr_el2_write(CPUARMState env, const ARMCPRegInfo ri,
2869	uint64_t value)
2870	{
2871	/*
2872	* If we are running with E2&0 regime, then an ASID is active.
2873	* Flush if that might be changing. Note we're not checking
2874	* TCR_EL2.A1 to know if this is really the TTBRx_EL2 that
2875	* holds the active ASID, only checking the field that might.
2876	*/
2877	if (extract64(raw_read(env, ri) ^ value, 48, 16) &&
2878	(arm_hcr_el2_eff(env) & HCR_E2H)) {
2879	tlb_flush_by_mmuidx(env_cpu(env), alle2_tlbmask());
2880	}
2881	raw_write(env, ri, value);
2882	}
2883
2884	static void vttbr_write(CPUARMState env, const ARMCPRegInfo ri,
2885	uint64_t value)
2886	{
2887	ARMCPU *cpu = env_archcpu(env);
2888	CPUState *cs = CPU(cpu);
2889
2890	/*
2891	* A change in VMID to the stage2 page table (Stage2) invalidates
2892	* the stage2 and combined stage 1&2 tlbs (EL10_1 and EL10_0).
2893	*/
2894	if (extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
2895	tlb_flush_by_mmuidx(cs, alle1_tlbmask(env));
2896	}
2897	raw_write(env, ri, value);
2898	}
2899
2900	static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
2901	{ .name = "DFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 0,
2902	.access = PL1_RW, .accessfn = access_tvm_trvm, .type = ARM_CP_ALIAS,
2903	.bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dfsr_s),
2904	offsetoflow32(CPUARMState, cp15.dfsr_ns) }, },
2905	{ .name = "IFSR", .cp = 15, .crn = 5, .crm = 0, .opc1 = 0, .opc2 = 1,
2906	.access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0,
2907	.bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ifsr_s),
2908	offsetoflow32(CPUARMState, cp15.ifsr_ns) } },
2909	{ .name = "DFAR", .cp = 15, .opc1 = 0, .crn = 6, .crm = 0, .opc2 = 0,
2910	.access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0,
2911	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.dfar_s),
2912	offsetof(CPUARMState, cp15.dfar_ns) } },
2913	{ .name = "FAR_EL1", .state = ARM_CP_STATE_AA64,
2914	.opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
2915	.access = PL1_RW, .accessfn = access_tvm_trvm,
2916	.fgt = FGT_FAR_EL1,
2917	.nv2_redirect_offset = 0x220 \| NV2_REDIR_NV1,
2918	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 6, 0, 0),
2919	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 6, 0, 0),
2920	.fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
2921	.resetvalue = 0, },
2922	};
2923
2924	static const ARMCPRegInfo vmsa_cp_reginfo[] = {
2925	{ .name = "ESR_EL1", .state = ARM_CP_STATE_AA64,
2926	.opc0 = 3, .crn = 5, .crm = 2, .opc1 = 0, .opc2 = 0,
2927	.access = PL1_RW, .accessfn = access_tvm_trvm,
2928	.fgt = FGT_ESR_EL1,
2929	.nv2_redirect_offset = 0x138 \| NV2_REDIR_NV1,
2930	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 5, 2, 0),
2931	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 5, 2, 0),
2932	.fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
2933	{ .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
2934	.opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
2935	.access = PL1_RW, .accessfn = access_tvm_trvm,
2936	.fgt = FGT_TTBR0_EL1,
2937	.nv2_redirect_offset = 0x200 \| NV2_REDIR_NV1,
2938	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 0, 0),
2939	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 0, 0),
2940	.writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
2941	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
2942	offsetof(CPUARMState, cp15.ttbr0_ns) } },
2943	{ .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
2944	.opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
2945	.access = PL1_RW, .accessfn = access_tvm_trvm,
2946	.fgt = FGT_TTBR1_EL1,
2947	.nv2_redirect_offset = 0x210 \| NV2_REDIR_NV1,
2948	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 0, 1),
2949	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 0, 1),
2950	.writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
2951	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
2952	offsetof(CPUARMState, cp15.ttbr1_ns) } },
2953	{ .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
2954	.opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2955	.access = PL1_RW, .accessfn = access_tvm_trvm,
2956	.fgt = FGT_TCR_EL1,
2957	.nv2_redirect_offset = 0x120 \| NV2_REDIR_NV1,
2958	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 0, 2),
2959	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 0, 2),
2960	.writefn = vmsa_tcr_el12_write,
2961	.raw_writefn = raw_write,
2962	.resetvalue = 0,
2963	.fieldoffset = offsetof(CPUARMState, cp15.tcr_el[1]) },
2964	{ .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
2965	.access = PL1_RW, .accessfn = access_tvm_trvm,
2966	.type = ARM_CP_ALIAS, .writefn = vmsa_ttbcr_write,
2967	.raw_writefn = raw_write,
2968	.bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.tcr_el[3]),
2969	offsetoflow32(CPUARMState, cp15.tcr_el[1])} },
2970	};
2971
2972	/*
2973	* Note that unlike TTBCR, writing to TTBCR2 does not require flushing
2974	* qemu tlbs nor adjusting cached masks.
2975	*/
2976	static const ARMCPRegInfo ttbcr2_reginfo = {
2977	.name = "TTBCR2", .cp = 15, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 3,
2978	.access = PL1_RW, .accessfn = access_tvm_trvm,
2979	.type = ARM_CP_ALIAS,
2980	.bank_fieldoffsets = {
2981	offsetofhigh32(CPUARMState, cp15.tcr_el[3]),
2982	offsetofhigh32(CPUARMState, cp15.tcr_el[1]),
2983	},
2984	};
2985
2986	static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
2987	/*
2988	* RAZ/WI the whole crn=15 space, when we don't have a more specific
2989	* implementation of this implementation-defined space.
2990	* Ideally this should eventually disappear in favour of actually
2991	* implementing the correct behaviour for all cores.
2992	*/
2993	{ .name = "C15_IMPDEF", .cp = 15, .crn = 15,
2994	.crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
2995	.access = PL1_RW,
2996	.type = ARM_CP_CONST \| ARM_CP_NO_RAW \| ARM_CP_OVERRIDE,
2997	.resetvalue = 0 },
2998	};
2999
3000	static const ARMCPRegInfo cache_dirty_status_cp_reginfo[] = {
3001	/* Cache status: RAZ because we have no cache so it's always clean */
3002	{ .name = "CDSR", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 6,
3003	.access = PL1_R, .type = ARM_CP_CONST \| ARM_CP_NO_RAW,
3004	.resetvalue = 0 },
3005	};
3006
3007	static const ARMCPRegInfo cache_block_ops_cp_reginfo[] = {
3008	/* We never have a block transfer operation in progress */
3009	{ .name = "BXSR", .cp = 15, .crn = 7, .crm = 12, .opc1 = 0, .opc2 = 4,
3010	.access = PL0_R, .type = ARM_CP_CONST \| ARM_CP_NO_RAW,
3011	.resetvalue = 0 },
3012	/* The cache ops themselves: these all NOP for QEMU */
3013	{ .name = "IICR", .cp = 15, .crm = 5, .opc1 = 0,
3014	.access = PL1_W, .type = ARM_CP_NOP \| ARM_CP_64BIT },
3015	{ .name = "IDCR", .cp = 15, .crm = 6, .opc1 = 0,
3016	.access = PL1_W, .type = ARM_CP_NOP \| ARM_CP_64BIT },
3017	{ .name = "CDCR", .cp = 15, .crm = 12, .opc1 = 0,
3018	.access = PL0_W, .type = ARM_CP_NOP \| ARM_CP_64BIT },
3019	{ .name = "PIR", .cp = 15, .crm = 12, .opc1 = 1,
3020	.access = PL0_W, .type = ARM_CP_NOP \| ARM_CP_64BIT },
3021	{ .name = "PDR", .cp = 15, .crm = 12, .opc1 = 2,
3022	.access = PL0_W, .type = ARM_CP_NOP \| ARM_CP_64BIT },
3023	{ .name = "CIDCR", .cp = 15, .crm = 14, .opc1 = 0,
3024	.access = PL1_W, .type = ARM_CP_NOP \| ARM_CP_64BIT },
3025	};
3026
3027	static const ARMCPRegInfo cache_test_clean_cp_reginfo[] = {
3028	/*
3029	* The cache test-and-clean instructions always return (1 << 30)
3030	* to indicate that there are no dirty cache lines.
3031	*/
3032	{ .name = "TC_DCACHE", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 3,
3033	.access = PL0_R, .type = ARM_CP_CONST \| ARM_CP_NO_RAW,
3034	.resetvalue = (1 << 30) },
3035	{ .name = "TCI_DCACHE", .cp = 15, .crn = 7, .crm = 14, .opc1 = 0, .opc2 = 3,
3036	.access = PL0_R, .type = ARM_CP_CONST \| ARM_CP_NO_RAW,
3037	.resetvalue = (1 << 30) },
3038	};
3039
3040	static const ARMCPRegInfo strongarm_cp_reginfo[] = {
3041	/* Ignore ReadBuffer accesses */
3042	{ .name = "C9_READBUFFER", .cp = 15, .crn = 9,
3043	.crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,
3044	.access = PL1_RW, .resetvalue = 0,
3045	.type = ARM_CP_CONST \| ARM_CP_OVERRIDE \| ARM_CP_NO_RAW },
3046	};
3047
3048	static uint64_t midr_read(CPUARMState env, const ARMCPRegInfo ri)
3049	{
3050	unsigned int cur_el = arm_current_el(env);
3051
3052	if (arm_is_el2_enabled(env) && cur_el == 1) {
3053	return env->cp15.vpidr_el2;
3054	}
3055	return raw_read(env, ri);
3056	}
3057
3058	static uint64_t mpidr_read_val(CPUARMState *env)
3059	{
3060	ARMCPU *cpu = env_archcpu(env);
3061	uint64_t mpidr = cpu->mp_affinity;
3062
3063	if (arm_feature(env, ARM_FEATURE_V7MP)) {
3064	mpidr \|= (1U << 31);
3065	/*
3066	* Cores which are uniprocessor (non-coherent)
3067	* but still implement the MP extensions set
3068	* bit 30. (For instance, Cortex-R5).
3069	*/
3070	if (cpu->mp_is_up) {
3071	mpidr \|= (1u << 30);
3072	}
3073	}
3074	return mpidr;
3075	}
3076
3077	static uint64_t mpidr_read(CPUARMState env, const ARMCPRegInfo ri)
3078	{
3079	unsigned int cur_el = arm_current_el(env);
3080
3081	if (arm_is_el2_enabled(env) && cur_el == 1) {
3082	return env->cp15.vmpidr_el2;
3083	}
3084	return mpidr_read_val(env);
3085	}
3086
3087	static const ARMCPRegInfo lpae_cp_reginfo[] = {
3088	/* AMAIR0 is mapped to AMAIR_EL1[31:0] */
3089	{ .name = "AMAIR_EL1", .state = ARM_CP_STATE_BOTH,
3090	.opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
3091	.access = PL1_RW, .accessfn = access_tvm_trvm,
3092	.fgt = FGT_AMAIR_EL1,
3093	.nv2_redirect_offset = 0x148 \| NV2_REDIR_NV1,
3094	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 3, 0),
3095	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 3, 0),
3096	.type = ARM_CP_CONST, .resetvalue = 0 },
3097	/* AMAIR1 is mapped to AMAIR_EL1[63:32] */
3098	{ .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
3099	.access = PL1_RW, .accessfn = access_tvm_trvm,
3100	.type = ARM_CP_CONST, .resetvalue = 0 },
3101	{ .name = "PAR", .cp = 15, .crm = 7, .opc1 = 0,
3102	.access = PL1_RW, .type = ARM_CP_64BIT, .resetvalue = 0,
3103	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.par_s),
3104	offsetof(CPUARMState, cp15.par_ns)} },
3105	{ .name = "TTBR0", .cp = 15, .crm = 2, .opc1 = 0,
3106	.access = PL1_RW, .accessfn = access_tvm_trvm,
3107	.type = ARM_CP_64BIT \| ARM_CP_ALIAS,
3108	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
3109	offsetof(CPUARMState, cp15.ttbr0_ns) },
3110	.writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
3111	{ .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
3112	.access = PL1_RW, .accessfn = access_tvm_trvm,
3113	.type = ARM_CP_64BIT \| ARM_CP_ALIAS,
3114	.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
3115	offsetof(CPUARMState, cp15.ttbr1_ns) },
3116	.writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
3117	};
3118
3119	static uint64_t aa64_fpcr_read(CPUARMState env, const ARMCPRegInfo ri)
3120	{
3121	return vfp_get_fpcr(env);
3122	}
3123
3124	static void aa64_fpcr_write(CPUARMState env, const ARMCPRegInfo ri,
3125	uint64_t value)
3126	{
3127	vfp_set_fpcr(env, value);
3128	}
3129
3130	static uint64_t aa64_fpsr_read(CPUARMState env, const ARMCPRegInfo ri)
3131	{
3132	return vfp_get_fpsr(env);
3133	}
3134
3135	static void aa64_fpsr_write(CPUARMState env, const ARMCPRegInfo ri,
3136	uint64_t value)
3137	{
3138	vfp_set_fpsr(env, value);
3139	}
3140
3141	static CPAccessResult aa64_daif_access(CPUARMState env, const ARMCPRegInfo ri,
3142	bool isread)
3143	{
3144	if (arm_current_el(env) == 0 && !(arm_sctlr(env, 0) & SCTLR_UMA)) {
3145	return CP_ACCESS_TRAP_EL1;
3146	}
3147	return CP_ACCESS_OK;
3148	}
3149
3150	static void aa64_daif_write(CPUARMState env, const ARMCPRegInfo ri,
3151	uint64_t value)
3152	{
3153	env->daif = value & PSTATE_DAIF;
3154	}
3155
3156	static uint64_t aa64_pan_read(CPUARMState env, const ARMCPRegInfo ri)
3157	{
3158	return env->pstate & PSTATE_PAN;
3159	}
3160
3161	static void aa64_pan_write(CPUARMState env, const ARMCPRegInfo ri,
3162	uint64_t value)
3163	{
3164	env->pstate = (env->pstate & ~PSTATE_PAN) \| (value & PSTATE_PAN);
3165	}
3166
3167	static const ARMCPRegInfo pan_reginfo = {
3168	.name = "PAN", .state = ARM_CP_STATE_AA64,
3169	.opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 3,
3170	.type = ARM_CP_NO_RAW, .access = PL1_RW,
3171	.readfn = aa64_pan_read, .writefn = aa64_pan_write
3172	};
3173
3174	static uint64_t aa64_uao_read(CPUARMState env, const ARMCPRegInfo ri)
3175	{
3176	return env->pstate & PSTATE_UAO;
3177	}
3178
3179	static void aa64_uao_write(CPUARMState env, const ARMCPRegInfo ri,
3180	uint64_t value)
3181	{
3182	env->pstate = (env->pstate & ~PSTATE_UAO) \| (value & PSTATE_UAO);
3183	}
3184
3185	static const ARMCPRegInfo uao_reginfo = {
3186	.name = "UAO", .state = ARM_CP_STATE_AA64,
3187	.opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 4,
3188	.type = ARM_CP_NO_RAW, .access = PL1_RW,
3189	.readfn = aa64_uao_read, .writefn = aa64_uao_write
3190	};
3191
3192	static uint64_t aa64_dit_read(CPUARMState env, const ARMCPRegInfo ri)
3193	{
3194	return env->pstate & PSTATE_DIT;
3195	}
3196
3197	static void aa64_dit_write(CPUARMState env, const ARMCPRegInfo ri,
3198	uint64_t value)
3199	{
3200	env->pstate = (env->pstate & ~PSTATE_DIT) \| (value & PSTATE_DIT);
3201	}
3202
3203	static const ARMCPRegInfo dit_reginfo = {
3204	.name = "DIT", .state = ARM_CP_STATE_AA64,
3205	.opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 5,
3206	.type = ARM_CP_NO_RAW, .access = PL0_RW,
3207	.readfn = aa64_dit_read, .writefn = aa64_dit_write
3208	};
3209
3210	static uint64_t aa64_ssbs_read(CPUARMState env, const ARMCPRegInfo ri)
3211	{
3212	return env->pstate & PSTATE_SSBS;
3213	}
3214
3215	static void aa64_ssbs_write(CPUARMState env, const ARMCPRegInfo ri,
3216	uint64_t value)
3217	{
3218	env->pstate = (env->pstate & ~PSTATE_SSBS) \| (value & PSTATE_SSBS);
3219	}
3220
3221	static const ARMCPRegInfo ssbs_reginfo = {
3222	.name = "SSBS", .state = ARM_CP_STATE_AA64,
3223	.opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 6,
3224	.type = ARM_CP_NO_RAW, .access = PL0_RW,
3225	.readfn = aa64_ssbs_read, .writefn = aa64_ssbs_write
3226	};
3227
3228	static CPAccessResult aa64_cacheop_poc_access(CPUARMState *env,
3229	const ARMCPRegInfo *ri,
3230	bool isread)
3231	{
3232	/* Cache invalidate/clean to Point of Coherency or Persistence... */
3233	switch (arm_current_el(env)) {
3234	case 0:
3235	/* ... EL0 must trap to EL1 unless SCTLR_EL1.UCI is set. */
3236	if (!(arm_sctlr(env, 0) & SCTLR_UCI)) {
3237	return CP_ACCESS_TRAP_EL1;
3238	}
3239	/* fall through */
3240	case 1:
3241	/* ... EL1 must trap to EL2 if HCR_EL2.TPCP is set. */
3242	if (arm_hcr_el2_eff(env) & HCR_TPCP) {
3243	return CP_ACCESS_TRAP_EL2;
3244	}
3245	break;
3246	}
3247	return CP_ACCESS_OK;
3248	}
3249
3250	static CPAccessResult do_cacheop_pou_access(CPUARMState *env, uint64_t hcrflags)
3251	{
3252	/* Cache invalidate/clean to Point of Unification... */
3253	switch (arm_current_el(env)) {
3254	case 0:
3255	/* ... EL0 must trap to EL1 unless SCTLR_EL1.UCI is set. */
3256	if (!(arm_sctlr(env, 0) & SCTLR_UCI)) {
3257	return CP_ACCESS_TRAP_EL1;
3258	}
3259	/* fall through */
3260	case 1:
3261	/* ... EL1 must trap to EL2 if relevant HCR_EL2 flags are set. */
3262	if (arm_hcr_el2_eff(env) & hcrflags) {
3263	return CP_ACCESS_TRAP_EL2;
3264	}
3265	break;
3266	}
3267	return CP_ACCESS_OK;
3268	}
3269
3270	static CPAccessResult access_ticab(CPUARMState env, const ARMCPRegInfo ri,
3271	bool isread)
3272	{
3273	return do_cacheop_pou_access(env, HCR_TICAB \| HCR_TPU);
3274	}
3275
3276	static CPAccessResult access_tocu(CPUARMState env, const ARMCPRegInfo ri,
3277	bool isread)
3278	{
3279	return do_cacheop_pou_access(env, HCR_TOCU \| HCR_TPU);
3280	}
3281
3282	static CPAccessResult aa64_zva_access(CPUARMState env, const ARMCPRegInfo ri,
3283	bool isread)
3284	{
3285	int cur_el = arm_current_el(env);
3286
3287	if (cur_el < 2) {
3288	uint64_t hcr = arm_hcr_el2_eff(env);
3289
3290	if (cur_el == 0) {
3291	if ((hcr & (HCR_E2H \| HCR_TGE)) == (HCR_E2H \| HCR_TGE)) {
3292	if (!(env->cp15.sctlr_el[2] & SCTLR_DZE)) {
3293	return CP_ACCESS_TRAP_EL2;
3294	}
3295	} else {
3296	if (!(env->cp15.sctlr_el[1] & SCTLR_DZE)) {
3297	return CP_ACCESS_TRAP_EL1;
3298	}
3299	if (hcr & HCR_TDZ) {
3300	return CP_ACCESS_TRAP_EL2;
3301	}
3302	}
3303	} else if (hcr & HCR_TDZ) {
3304	return CP_ACCESS_TRAP_EL2;
3305	}
3306	}
3307	return CP_ACCESS_OK;
3308	}
3309
3310	static uint64_t aa64_dczid_read(CPUARMState env, const ARMCPRegInfo ri)
3311	{
3312	ARMCPU *cpu = env_archcpu(env);
3313	int dzp_bit = 1 << 4;
3314
3315	assert(!kvm_enabled());
3316
3317	/* DZP indicates whether DC ZVA access is allowed */
3318	if (aa64_zva_access(env, NULL, false) == CP_ACCESS_OK) {
3319	dzp_bit = 0;
3320	}
3321
3322	return cpu->isar.idregs[DCZID_EL0_IDX] \| dzp_bit;
3323	}
3324
3325	static CPAccessResult sp_el0_access(CPUARMState env, const ARMCPRegInfo ri,
3326	bool isread)
3327	{
3328	if (!(env->pstate & PSTATE_SP)) {
3329	/*
3330	* Access to SP_EL0 is undefined if it's being used as
3331	* the stack pointer.
3332	*/
3333	return CP_ACCESS_UNDEFINED;
3334	}
3335	return CP_ACCESS_OK;
3336	}
3337
3338	static uint64_t spsel_read(CPUARMState env, const ARMCPRegInfo ri)
3339	{
3340	return env->pstate & PSTATE_SP;
3341	}
3342
3343	static void spsel_write(CPUARMState env, const ARMCPRegInfo ri, uint64_t val)
3344	{
3345	update_spsel(env, val);
3346	}
3347
3348	static void sctlr_write(CPUARMState env, const ARMCPRegInfo ri,
3349	uint64_t value)
3350	{
3351	ARMCPU *cpu = env_archcpu(env);
3352
3353	if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
3354	/* M bit is RAZ/WI for PMSA with no MPU implemented */
3355	value &= ~SCTLR_M;
3356	}
3357
3358	/* ??? Lots of these bits are not implemented. */
3359
3360	if (ri->state == ARM_CP_STATE_AA64) {
3361	if (!cpu_isar_feature(aa64_mte, cpu)) {
3362	if (ri->opc1 == 6) { /* SCTLR_EL3 */
3363	value &= ~(SCTLR_ITFSB \| SCTLR_TCF \| SCTLR_ATA \| SCTLR_TCSO);
3364	} else {
3365	value &= ~(SCTLR_ITFSB \| SCTLR_TCF0 \| SCTLR_TCF \|
3366	SCTLR_ATA0 \| SCTLR_ATA \| SCTLR_TCSO \| SCTLR_TCSO0);
3367	}
3368	} else if (!cpu_isar_feature(aa64_mte_store_only, cpu)) { /* not mte4 */
3369	if (ri->opc1 == 6) { /* SCTLR_EL3 */
3370	value &= ~SCTLR_TCSO;
3371	} else {
3372	value &= ~(SCTLR_TCSO \| SCTLR_TCSO0);
3373	}
3374	}
3375	}
3376
3377	if (raw_read(env, ri) == value) {
3378	/*
3379	* Skip the TLB flush if nothing actually changed; Linux likes
3380	* to do a lot of pointless SCTLR writes.
3381	*/
3382	return;
3383	}
3384
3385	raw_write(env, ri, value);
3386
3387	/* This may enable/disable the MMU, so do a TLB flush. */
3388	tlb_flush(CPU(cpu));
3389	}
3390
3391	static void mdcr_el3_write(CPUARMState env, const ARMCPRegInfo ri,
3392	uint64_t value)
3393	{
3394	/*
3395	* Some MDCR_EL3 bits affect whether PMU counters are running:
3396	* if we are trying to change any of those then we must
3397	* bracket this update with PMU start/finish calls.
3398	*/
3399	bool pmu_op = (env->cp15.mdcr_el3 ^ value) & MDCR_EL3_PMU_ENABLE_BITS;
3400
3401	if (pmu_op) {
3402	pmu_op_start(env);
3403	}
3404	env->cp15.mdcr_el3 = value;
3405	if (pmu_op) {
3406	pmu_op_finish(env);
3407	}
3408	}
3409
3410	static void sdcr_write(CPUARMState env, const ARMCPRegInfo ri,
3411	uint64_t value)
3412	{
3413	/* Not all bits defined for MDCR_EL3 exist in the AArch32 SDCR */
3414	mdcr_el3_write(env, ri, value & SDCR_VALID_MASK);
3415	}
3416
3417	static void mdcr_el2_write(CPUARMState env, const ARMCPRegInfo ri,
3418	uint64_t value)
3419	{
3420	/*
3421	* Some MDCR_EL2 bits affect whether PMU counters are running:
3422	* if we are trying to change any of those then we must
3423	* bracket this update with PMU start/finish calls.
3424	*/
3425	bool pmu_op = (env->cp15.mdcr_el2 ^ value) & MDCR_EL2_PMU_ENABLE_BITS;
3426
3427	if (pmu_op) {
3428	pmu_op_start(env);
3429	}
3430	env->cp15.mdcr_el2 = value;
3431	if (pmu_op) {
3432	pmu_op_finish(env);
3433	}
3434	}
3435
3436	static CPAccessResult access_nv1_with_nvx(uint64_t hcr_nv)
3437	{
3438	return hcr_nv == (HCR_NV \| HCR_NV1) ? CP_ACCESS_TRAP_EL2 : CP_ACCESS_OK;
3439	}
3440
3441	static CPAccessResult access_nv1(CPUARMState env, const ARMCPRegInfo ri,
3442	bool isread)
3443	{
3444	if (arm_current_el(env) == 1) {
3445	return access_nv1_with_nvx(arm_hcr_el2_nvx_eff(env));
3446	}
3447	return CP_ACCESS_OK;
3448	}
3449
3450	static CPAccessResult access_nv1_or_exlock_el1(CPUARMState *env,
3451	const ARMCPRegInfo *ri,
3452	bool isread)
3453	{
3454	if (arm_current_el(env) == 1) {
3455	uint64_t nvx = arm_hcr_el2_nvx_eff(env);
3456
3457	if (!isread &&
3458	(env->pstate & PSTATE_EXLOCK) &&
3459	(env->cp15.gcscr_el[1] & GCSCR_EXLOCKEN) &&
3460	!(nvx & HCR_NV1)) {
3461	return CP_ACCESS_EXLOCK;
3462	}
3463	return access_nv1_with_nvx(nvx);
3464	}
3465
3466	/*
3467	* At EL2, since VHE redirection is done at translation time,
3468	* el_is_in_host is always false here, so EXLOCK does not apply.
3469	*/
3470	return CP_ACCESS_OK;
3471	}
3472
3473	static CPAccessResult access_exlock_el2(CPUARMState *env,
3474	const ARMCPRegInfo *ri, bool isread)
3475	{
3476	int el = arm_current_el(env);
3477
3478	if (el == 3) {
3479	return CP_ACCESS_OK;
3480	}
3481
3482	/*
3483	* Access to the EL2 register from EL1 means NV is set, and
3484	* EXLOCK has priority over an NV1 trap to EL2.
3485	*/
3486	if (!isread &&
3487	(env->pstate & PSTATE_EXLOCK) &&
3488	(env->cp15.gcscr_el[el] & GCSCR_EXLOCKEN)) {
3489	return CP_ACCESS_EXLOCK;
3490	}
3491	return CP_ACCESS_OK;
3492	}
3493
3494	static CPAccessResult access_exlock_el3(CPUARMState *env,
3495	const ARMCPRegInfo *ri, bool isread)
3496	{
3497	if (!isread &&
3498	(env->pstate & PSTATE_EXLOCK) &&
3499	(env->cp15.gcscr_el[3] & GCSCR_EXLOCKEN)) {
3500	return CP_ACCESS_EXLOCK;
3501	}
3502	return CP_ACCESS_OK;
3503	}
3504
3505	#ifdef CONFIG_USER_ONLY
3506	/*
3507	* `IC IVAU` is handled to improve compatibility with JITs that dual-map their
3508	* code to get around W^X restrictions, where one region is writable and the
3509	* other is executable.
3510	*
3511	* Since the executable region is never written to we cannot detect code
3512	* changes when running in user mode, and rely on the emulated JIT telling us
3513	* that the code has changed by executing this instruction.
3514	*/
3515	static void ic_ivau_write(CPUARMState env, const ARMCPRegInfo ri,
3516	uint64_t value)
3517	{
3518	uint64_t icache_line_mask, start_address, end_address;
3519	const ARMCPU *cpu;
3520
3521	cpu = env_archcpu(env);
3522
3523	icache_line_mask = (4 << extract32(cpu->ctr, 0, 4)) - 1;
3524	start_address = value & ~icache_line_mask;
3525	end_address = value \| icache_line_mask;
3526
3527	mmap_lock();
3528
3529	tb_invalidate_phys_range(env_cpu(env), start_address, end_address);
3530
3531	mmap_unlock();
3532	}
3533	#endif
3534
3535	static const ARMCPRegInfo v8_cp_reginfo[] = {
3536	/*
3537	* Minimal set of EL0-visible registers. This will need to be expanded
3538	* significantly for system emulation of AArch64 CPUs.
3539	*/
3540	{ .name = "NZCV", .state = ARM_CP_STATE_AA64,
3541	.opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 2,
3542	.access = PL0_RW, .type = ARM_CP_NZCV },
3543	{ .name = "DAIF", .state = ARM_CP_STATE_AA64,
3544	.opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 2,
3545	.type = ARM_CP_NO_RAW,
3546	.access = PL0_RW, .accessfn = aa64_daif_access,
3547	.fieldoffset = offsetof(CPUARMState, daif),
3548	.writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
3549	{ .name = "FPCR", .state = ARM_CP_STATE_AA64,
3550	.opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
3551	.access = PL0_RW, .type = ARM_CP_FPU,
3552	.readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
3553	{ .name = "FPSR", .state = ARM_CP_STATE_AA64,
3554	.opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
3555	.access = PL0_RW, .type = ARM_CP_FPU \| ARM_CP_SUPPRESS_TB_END,
3556	.readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
3557	{ .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
3558	.opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
3559	.access = PL0_R, .type = ARM_CP_NO_RAW,
3560	.fgt = FGT_DCZID_EL0,
3561	.readfn = aa64_dczid_read },
3562	{ .name = "DC_ZVA", .state = ARM_CP_STATE_AA64,
3563	.opc0 = 1, .opc1 = 3, .crn = 7, .crm = 4, .opc2 = 1,
3564	.access = PL0_W, .type = ARM_CP_DC_ZVA,
3565	#ifndef CONFIG_USER_ONLY
3566	/* Avoid overhead of an access check that always passes in user-mode */
3567	.accessfn = aa64_zva_access,
3568	.fgt = FGT_DCZVA,
3569	#endif
3570	},
3571	{ .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
3572	.opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
3573	.access = PL1_R, .type = ARM_CP_CURRENTEL },
3574	/*
3575	* Instruction cache ops. All of these except `IC IVAU` NOP because we
3576	* don't emulate caches.
3577	*/
3578	{ .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
3579	.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
3580	.access = PL1_W, .type = ARM_CP_NOP,
3581	.fgt = FGT_ICIALLUIS,
3582	.accessfn = access_ticab },
3583	{ .name = "IC_IALLU", .state = ARM_CP_STATE_AA64,
3584	.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
3585	.access = PL1_W, .type = ARM_CP_NOP,
3586	.fgt = FGT_ICIALLU,
3587	.accessfn = access_tocu },
3588	{ .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
3589	.opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
3590	.access = PL0_W,
3591	.fgt = FGT_ICIVAU,
3592	.accessfn = access_tocu,
3593	#ifdef CONFIG_USER_ONLY
3594	.type = ARM_CP_NO_RAW,
3595	.writefn = ic_ivau_write
3596	#else
3597	.type = ARM_CP_NOP
3598	#endif
3599	},
3600	/* Cache ops: all NOPs since we don't emulate caches */
3601	{ .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
3602	.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
3603	.access = PL1_W, .accessfn = aa64_cacheop_poc_access,
3604	.fgt = FGT_DCIVAC,
3605	.type = ARM_CP_NOP },
3606	{ .name = "DC_ISW", .state = ARM_CP_STATE_AA64,
3607	.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
3608	.fgt = FGT_DCISW,
3609	.access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
3610	{ .name = "DC_CVAC", .state = ARM_CP_STATE_AA64,
3611	.opc0 = 1, .opc1 = 3, .crn = 7, .crm = 10, .opc2 = 1,
3612	.access = PL0_W, .type = ARM_CP_NOP,
3613	.fgt = FGT_DCCVAC,
3614	.accessfn = aa64_cacheop_poc_access },
3615	{ .name = "DC_CSW", .state = ARM_CP_STATE_AA64,
3616	.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
3617	.fgt = FGT_DCCSW,
3618	.access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
3619	{ .name = "DC_CVAU", .state = ARM_CP_STATE_AA64,
3620	.opc0 = 1, .opc1 = 3, .crn = 7, .crm = 11, .opc2 = 1,
3621	.access = PL0_W, .type = ARM_CP_NOP,
3622	.fgt = FGT_DCCVAU,
3623	.accessfn = access_tocu },
3624	{ .name = "DC_CIVAC", .state = ARM_CP_STATE_AA64,
3625	.opc0 = 1, .opc1 = 3, .crn = 7, .crm = 14, .opc2 = 1,
3626	.access = PL0_W, .type = ARM_CP_NOP,
3627	.fgt = FGT_DCCIVAC,
3628	.accessfn = aa64_cacheop_poc_access },
3629	{ .name = "DC_CISW", .state = ARM_CP_STATE_AA64,
3630	.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
3631	.fgt = FGT_DCCISW,
3632	.access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
3633	{ .name = "PAR_EL1", .state = ARM_CP_STATE_AA64,
3634	.type = ARM_CP_ALIAS,
3635	.opc0 = 3, .opc1 = 0, .crn = 7, .crm = 4, .opc2 = 0,
3636	.access = PL1_RW, .resetvalue = 0,
3637	.fgt = FGT_PAR_EL1,
3638	.fieldoffset = offsetof(CPUARMState, cp15.par_el[1]),
3639	.writefn = par_write },
3640	/* 32 bit cache operations */
3641	{ .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
3642	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_ticab },
3643	{ .name = "BPIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 6,
3644	.type = ARM_CP_NOP, .access = PL1_W },
3645	{ .name = "ICIALLU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 0,
3646	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu },
3647	{ .name = "ICIMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 1,
3648	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu },
3649	{ .name = "BPIALL", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 6,
3650	.type = ARM_CP_NOP, .access = PL1_W },
3651	{ .name = "BPIMVA", .cp = 15, .opc1 = 0, .crn = 7, .crm = 5, .opc2 = 7,
3652	.type = ARM_CP_NOP, .access = PL1_W },
3653	{ .name = "DCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
3654	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access },
3655	{ .name = "DCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 2,
3656	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
3657	{ .name = "DCCMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 1,
3658	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access },
3659	{ .name = "DCCSW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 10, .opc2 = 2,
3660	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
3661	{ .name = "DCCMVAU", .cp = 15, .opc1 = 0, .crn = 7, .crm = 11, .opc2 = 1,
3662	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tocu },
3663	{ .name = "DCCIMVAC", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 1,
3664	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_poc_access },
3665	{ .name = "DCCISW", .cp = 15, .opc1 = 0, .crn = 7, .crm = 14, .opc2 = 2,
3666	.type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_tsw },
3667	/* MMU Domain access control / MPU write buffer control */
3668	{ .name = "DACR", .cp = 15, .opc1 = 0, .crn = 3, .crm = 0, .opc2 = 0,
3669	.access = PL1_RW, .accessfn = access_tvm_trvm, .resetvalue = 0,
3670	.writefn = dacr_write, .raw_writefn = raw_write,
3671	.bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.dacr_s),
3672	offsetoflow32(CPUARMState, cp15.dacr_ns) } },
3673	{ .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
3674	.type = ARM_CP_ALIAS,
3675	.opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
3676	.access = PL1_RW, .accessfn = access_nv1_or_exlock_el1,
3677	.nv2_redirect_offset = 0x230 \| NV2_REDIR_NV1,
3678	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 4, 0, 1),
3679	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 4, 0, 1),
3680	.fieldoffset = offsetof(CPUARMState, elr_el[1]) },
3681	{ .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
3682	.type = ARM_CP_ALIAS,
3683	.opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
3684	.access = PL1_RW, .accessfn = access_nv1_or_exlock_el1,
3685	.nv2_redirect_offset = 0x160 \| NV2_REDIR_NV1,
3686	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 4, 0, 0),
3687	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 4, 0, 0),
3688	.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) },
3689	/*
3690	* We rely on the access checks not allowing the guest to write to the
3691	* state field when SPSel indicates that it's being used as the stack
3692	* pointer.
3693	*/
3694	{ .name = "SP_EL0", .state = ARM_CP_STATE_AA64,
3695	.opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 0,
3696	.access = PL1_RW, .accessfn = sp_el0_access,
3697	.type = ARM_CP_ALIAS,
3698	.fieldoffset = offsetof(CPUARMState, sp_el[0]) },
3699	{ .name = "SP_EL1", .state = ARM_CP_STATE_AA64,
3700	.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 0,
3701	.nv2_redirect_offset = 0x240,
3702	.access = PL2_RW, .type = ARM_CP_ALIAS \| ARM_CP_EL3_NO_EL2_KEEP,
3703	.fieldoffset = offsetof(CPUARMState, sp_el[1]) },
3704	{ .name = "SPSel", .state = ARM_CP_STATE_AA64,
3705	.opc0 = 3, .opc1 = 0, .crn = 4, .crm = 2, .opc2 = 0,
3706	.type = ARM_CP_NO_RAW,
3707	.access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
3708	{ .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64,
3709	.type = ARM_CP_ALIAS,
3710	.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 0,
3711	.access = PL2_RW,
3712	.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_IRQ]) },
3713	{ .name = "SPSR_ABT", .state = ARM_CP_STATE_AA64,
3714	.type = ARM_CP_ALIAS,
3715	.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 1,
3716	.access = PL2_RW,
3717	.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_ABT]) },
3718	{ .name = "SPSR_UND", .state = ARM_CP_STATE_AA64,
3719	.type = ARM_CP_ALIAS,
3720	.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 2,
3721	.access = PL2_RW,
3722	.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_UND]) },
3723	{ .name = "SPSR_FIQ", .state = ARM_CP_STATE_AA64,
3724	.type = ARM_CP_ALIAS,
3725	.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 3, .opc2 = 3,
3726	.access = PL2_RW,
3727	.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_FIQ]) },
3728	{ .name = "MDCR_EL3", .state = ARM_CP_STATE_AA64,
3729	.type = ARM_CP_IO,
3730	.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 3, .opc2 = 1,
3731	.resetvalue = 0,
3732	.access = PL3_RW, .fgt = FGT_MDCR_EL3,
3733	.writefn = mdcr_el3_write,
3734	.fieldoffset = offsetof(CPUARMState, cp15.mdcr_el3) },
3735	{ .name = "SDCR", .type = ARM_CP_ALIAS \| ARM_CP_IO,
3736	.cp = 15, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 1,
3737	.access = PL1_RW, .accessfn = access_trap_aa32s_el1,
3738	.writefn = sdcr_write,
3739	.fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
3740	};
3741
3742	/* These are present only when EL1 supports AArch32 */
3743	static const ARMCPRegInfo v8_aa32_el1_reginfo[] = {
3744	{ .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64,
3745	.opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0,
3746	.access = PL2_RW,
3747	.type = ARM_CP_ALIAS \| ARM_CP_FPU \| ARM_CP_EL3_NO_EL2_KEEP,
3748	.fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]) },
3749	{ .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
3750	.opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
3751	.access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP,
3752	.writefn = dacr_write, .raw_writefn = raw_write,
3753	.fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
3754	{ .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
3755	.opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
3756	.access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP,
3757	.fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
3758	};
3759
3760	static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
3761	{
3762	ARMCPU *cpu = env_archcpu(env);
3763	bool hcr_change_timer;
3764
3765	if (arm_feature(env, ARM_FEATURE_V8)) {
3766	valid_mask \|= MAKE_64BIT_MASK(0, 34); /* ARMv8.0 */
3767	} else {
3768	valid_mask \|= MAKE_64BIT_MASK(0, 28); /* ARMv7VE */
3769	}
3770
3771	if (arm_feature(env, ARM_FEATURE_EL3)) {
3772	valid_mask &= ~HCR_HCD;
3773	} else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
3774	/*
3775	* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
3776	* However, if we're using the SMC PSCI conduit then QEMU is
3777	* effectively acting like EL3 firmware and so the guest at
3778	* EL2 should retain the ability to prevent EL1 from being
3779	* able to make SMC calls into the ersatz firmware, so in
3780	* that case HCR.TSC should be read/write.
3781	*/
3782	valid_mask &= ~HCR_TSC;
3783	}
3784
3785	if (arm_feature(env, ARM_FEATURE_AARCH64)) {
3786	if (cpu_isar_feature(aa64_vh, cpu) &&
3787	cpu_isar_feature(aa64_e2h0, cpu)) {
3788	valid_mask \|= HCR_E2H;
3789	}
3790	if (cpu_isar_feature(aa64_ras, cpu)) {
3791	valid_mask \|= HCR_TERR \| HCR_TEA;
3792	}
3793	if (cpu_isar_feature(aa64_lor, cpu)) {
3794	valid_mask \|= HCR_TLOR;
3795	}
3796	if (cpu_isar_feature(aa64_pauth, cpu)) {
3797	valid_mask \|= HCR_API \| HCR_APK;
3798	}
3799	if (cpu_isar_feature(aa64_mte, cpu)) {
3800	valid_mask \|= HCR_ATA \| HCR_DCT \| HCR_TID5;
3801	}
3802	if (cpu_isar_feature(aa64_scxtnum, cpu)) {
3803	valid_mask \|= HCR_ENSCXT;
3804	}
3805	if (cpu_isar_feature(aa64_fwb, cpu)) {
3806	valid_mask \|= HCR_FWB;
3807	}
3808	if (cpu_isar_feature(aa64_rme, cpu)) {
3809	valid_mask \|= HCR_GPF;
3810	}
3811	if (cpu_isar_feature(aa64_nv, cpu)) {
3812	valid_mask \|= HCR_NV \| HCR_AT;
3813	if (!cpu_isar_feature(aa64_nv1_res0, cpu)) {
3814	valid_mask \|= HCR_NV1;
3815	}
3816	}
3817	if (cpu_isar_feature(aa64_nv2, cpu)) {
3818	valid_mask \|= HCR_NV2;
3819	}
3820	}
3821
3822	if (cpu_isar_feature(any_evt, cpu)) {
3823	valid_mask \|= HCR_TTLBIS \| HCR_TTLBOS \| HCR_TICAB \| HCR_TOCU \| HCR_TID4;
3824	} else if (cpu_isar_feature(any_half_evt, cpu)) {
3825	valid_mask \|= HCR_TICAB \| HCR_TOCU \| HCR_TID4;
3826	}
3827
3828	/* Clear RES0 bits. */
3829	value &= valid_mask;
3830
3831	if (arm_feature(env, ARM_FEATURE_AARCH64)) {
3832	/* RW is RAO/WI if EL1 is AArch64 only */
3833	if (!cpu_isar_feature(aa64_aa32_el1, cpu)) {
3834	value \|= HCR_RW;
3835	}
3836	/* Strictly E2H is RES1 unless FEAT_E2H0 relaxes the requirement */
3837	if (!cpu_isar_feature(aa64_e2h0, cpu)) {
3838	value \|= HCR_E2H;
3839	}
3840	}
3841
3842	/*
3843	* These bits change the MMU setup:
3844	* HCR_VM enables stage 2 translation
3845	* HCR_PTW forbids certain page-table setups
3846	* HCR_DC disables stage1 and enables stage2 translation
3847	* HCR_DCT enables tagging on (disabled) stage1 translation
3848	* HCR_FWB changes the interpretation of stage2 descriptor bits
3849	* HCR_NV and HCR_NV1 affect interpretation of descriptor bits
3850	*/
3851	if ((env->cp15.hcr_el2 ^ value) &
3852	(HCR_VM \| HCR_PTW \| HCR_DC \| HCR_DCT \| HCR_FWB \| HCR_NV \| HCR_NV1)) {
3853	tlb_flush(CPU(cpu));
3854	}
3855	hcr_change_timer = (env->cp15.hcr_el2 ^ value) &
3856	(HCR_E2H \| HCR_TGE);
3857
3858	/* update */
3859	env->cp15.hcr_el2 = value;
3860
3861	/*
3862	* Updates to VI and VF require us to update the status of
3863	* virtual interrupts, which are the logical OR of these bits
3864	* and the state of the input lines from the GIC. (This requires
3865	* that we have the BQL, which is done by marking the
3866	* reginfo structs as ARM_CP_IO.)
3867	* Note that if a write to HCR pends a VIRQ or VFIQ or VINMI or
3868	* VFNMI, it is never possible for it to be taken immediately
3869	* because VIRQ, VFIQ, VINMI and VFNMI are masked unless running
3870	* at EL0 or EL1, and HCR can only be written at EL2.
3871	*/
3872	g_assert(bql_locked());
3873	arm_cpu_update_virq(cpu);
3874	arm_cpu_update_vfiq(cpu);
3875	arm_cpu_update_vserr(cpu);
3876	if (cpu_isar_feature(aa64_nmi, cpu)) {
3877	arm_cpu_update_vinmi(cpu);
3878	arm_cpu_update_vfnmi(cpu);
3879	}
3880	if (hcr_change_timer) {
3881	#ifndef CONFIG_USER_ONLY
3882	gt_recalc_timer(cpu, GTIMER_PHYS);
3883	#endif
3884	}
3885	}
3886
3887	static void hcr_write(CPUARMState env, const ARMCPRegInfo ri, uint64_t value)
3888	{
3889	do_hcr_write(env, value, 0);
3890	}
3891
3892	static void hcr_writehigh(CPUARMState env, const ARMCPRegInfo ri,
3893	uint64_t value)
3894	{
3895	/* Handle HCR2 write, i.e. write to high half of HCR_EL2 */
3896	value = deposit64(env->cp15.hcr_el2, 32, 32, value);
3897	do_hcr_write(env, value, MAKE_64BIT_MASK(0, 32));
3898	}
3899
3900	static void hcr_writelow(CPUARMState env, const ARMCPRegInfo ri,
3901	uint64_t value)
3902	{
3903	/* Handle HCR write, i.e. write to low half of HCR_EL2 */
3904	value = deposit64(env->cp15.hcr_el2, 0, 32, value);
3905	do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32));
3906	}
3907
3908	static void hcr_reset(CPUARMState env, const ARMCPRegInfo ri)
3909	{
3910	/* hcr_write will set the RES1 bits on an AArch64-only CPU */
3911	hcr_write(env, ri, 0);
3912	}
3913
3914	/*
3915	* Return the effective value of HCR_EL2, at the given security state.
3916	* Bits that are not included here:
3917	* RW (read from SCR_EL3.RW as needed)
3918	*/
3919	uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space)
3920	{
3921	uint64_t ret = env->cp15.hcr_el2;
3922
3923	assert(space != ARMSS_Root);
3924
3925	if (!arm_is_el2_enabled_secstate(env, space)) {
3926	/*
3927	* "This register has no effect if EL2 is not enabled in the
3928	* current Security state". This is ARMv8.4-SecEL2 speak for
3929	* !(SCR_EL3.NS==1 \|\| SCR_EL3.EEL2==1).
3930	*
3931	* Prior to that, the language was "In an implementation that
3932	* includes EL3, when the value of SCR_EL3.NS is 0 the PE behaves
3933	* as if this field is 0 for all purposes other than a direct
3934	* read or write access of HCR_EL2". With lots of enumeration
3935	* on a per-field basis. In current QEMU, this is condition
3936	* is arm_is_secure_below_el3.
3937	*
3938	* Since the v8.4 language applies to the entire register, and
3939	* appears to be backward compatible, use that.
3940	*/
3941	return 0;
3942	}
3943
3944	/*
3945	* For a cpu that supports both aarch64 and aarch32, we can set bits
3946	* in HCR_EL2 (e.g. via EL3) that are RES0 when we enter EL2 as aa32.
3947	* Ignore all of the bits in HCR+HCR2 that are not valid for aarch32.
3948	*/
3949	if (!arm_el_is_aa64(env, 2)) {
3950	uint64_t aa32_valid;
3951
3952	/*
3953	* These bits are up-to-date as of ARMv8.6.
3954	* For HCR, it's easiest to list just the 2 bits that are invalid.
3955	* For HCR2, list those that are valid.
3956	*/
3957	aa32_valid = MAKE_64BIT_MASK(0, 32) & ~(HCR_RW \| HCR_TDZ);
3958	aa32_valid \|= (HCR_CD \| HCR_ID \| HCR_TERR \| HCR_TEA \| HCR_MIOCNCE \|
3959	HCR_TID4 \| HCR_TICAB \| HCR_TOCU \| HCR_TTLBIS);
3960	ret &= aa32_valid;
3961	}
3962
3963	if (ret & HCR_TGE) {
3964	/* These bits are up-to-date as of ARMv8.6. */
3965	if (ret & HCR_E2H) {
3966	ret &= ~(HCR_VM \| HCR_FMO \| HCR_IMO \| HCR_AMO \|
3967	HCR_BSU_MASK \| HCR_DC \| HCR_TWI \| HCR_TWE \|
3968	HCR_TID0 \| HCR_TID2 \| HCR_TPCP \| HCR_TPU \|
3969	HCR_TDZ \| HCR_CD \| HCR_ID \| HCR_MIOCNCE \|
3970	HCR_TID4 \| HCR_TICAB \| HCR_TOCU \| HCR_ENSCXT \|
3971	HCR_TTLBIS \| HCR_TTLBOS \| HCR_TID5);
3972	} else {
3973	ret \|= HCR_FMO \| HCR_IMO \| HCR_AMO;
3974	}
3975	ret &= ~(HCR_SWIO \| HCR_PTW \| HCR_VF \| HCR_VI \| HCR_VSE \|
3976	HCR_FB \| HCR_TID1 \| HCR_TID3 \| HCR_TSC \| HCR_TACR \|
3977	HCR_TSW \| HCR_TTLB \| HCR_TVM \| HCR_HCD \| HCR_TRVM \|
3978	HCR_TLOR);
3979	}
3980
3981	return ret;
3982	}
3983
3984	uint64_t arm_hcr_el2_eff(CPUARMState *env)
3985	{
3986	if (arm_feature(env, ARM_FEATURE_M)) {
3987	return 0;
3988	}
3989	return arm_hcr_el2_eff_secstate(env, arm_security_space_below_el3(env));
3990	}
3991
3992	uint64_t arm_hcr_el2_nvx_eff(CPUARMState *env)
3993	{
3994	uint64_t hcr = arm_hcr_el2_eff(env);
3995
3996	if (!(hcr & HCR_NV)) {
3997	return 0; /* CONSTRAINED UNPREDICTABLE wrt NV1 */
3998	}
3999	return hcr & (HCR_NV2 \| HCR_NV1 \| HCR_NV);
4000	}
4001
4002	/*
4003	* Corresponds to ARM pseudocode function ELIsInHost().
4004	*/
4005	bool el_is_in_host(CPUARMState *env, int el)
4006	{
4007	uint64_t mask;
4008
4009	/*
4010	* Since we only care about E2H and TGE, we can skip arm_hcr_el2_eff().
4011	* Perform the simplest bit tests first, and validate EL2 afterward.
4012	*/
4013	if (el & 1) {
4014	return false; /* EL1 or EL3 */
4015	}
4016
4017	/*
4018	* Note that hcr_write() checks isar_feature_aa64_vh(),
4019	* aka HaveVirtHostExt(), in allowing HCR_E2H to be set.
4020	*/
4021	mask = el ? HCR_E2H : HCR_E2H \| HCR_TGE;
4022	if ((env->cp15.hcr_el2 & mask) != mask) {
4023	return false;
4024	}
4025
4026	/* TGE and/or E2H set: double check those bits are currently legal. */
4027	return arm_is_el2_enabled(env) && arm_el_is_aa64(env, 2);
4028	}
4029
4030	static void hcrx_write(CPUARMState env, const ARMCPRegInfo ri,
4031	uint64_t value)
4032	{
4033	ARMCPU *cpu = env_archcpu(env);
4034	uint64_t valid_mask = 0;
4035
4036	if (cpu_isar_feature(aa64_mops, cpu)) {
4037	valid_mask \|= HCRX_MSCEN \| HCRX_MCE2;
4038	}
4039	if (cpu_isar_feature(aa64_nmi, cpu)) {
4040	valid_mask \|= HCRX_TALLINT \| HCRX_VINMI \| HCRX_VFNMI;
4041	}
4042	if (cpu_isar_feature(aa64_cmow, cpu)) {
4043	valid_mask \|= HCRX_CMOW;
4044	}
4045	if (cpu_isar_feature(aa64_xs, cpu)) {
4046	valid_mask \|= HCRX_FGTNXS \| HCRX_FNXS;
4047	}
4048	if (cpu_isar_feature(aa64_tcr2, cpu)) {
4049	valid_mask \|= HCRX_TCR2EN;
4050	}
4051	if (cpu_isar_feature(aa64_sctlr2, cpu)) {
4052	valid_mask \|= HCRX_SCTLR2EN;
4053	}
4054	if (cpu_isar_feature(aa64_gcs, cpu)) {
4055	valid_mask \|= HCRX_GCSEN;
4056	}
4057	if (cpu_isar_feature(aa64_fpmr, cpu)) {
4058	valid_mask \|= HCRX_ENFPM;
4059	}
4060
4061	/* Clear RES0 bits. */
4062	env->cp15.hcrx_el2 = value & valid_mask;
4063
4064	/*
4065	* Updates to VINMI and VFNMI require us to update the status of
4066	* virtual NMI, which are the logical OR of these bits
4067	* and the state of the input lines from the GIC. (This requires
4068	* that we have the BQL, which is done by marking the
4069	* reginfo structs as ARM_CP_IO.)
4070	* Note that if a write to HCRX pends a VINMI or VFNMI it is never
4071	* possible for it to be taken immediately, because VINMI and
4072	* VFNMI are masked unless running at EL0 or EL1, and HCRX
4073	* can only be written at EL2.
4074	*/
4075	if (cpu_isar_feature(aa64_nmi, cpu)) {
4076	g_assert(bql_locked());
4077	arm_cpu_update_vinmi(cpu);
4078	arm_cpu_update_vfnmi(cpu);
4079	}
4080	}
4081
4082	static CPAccessResult access_hxen(CPUARMState env, const ARMCPRegInfo ri,
4083	bool isread)
4084	{
4085	if (arm_current_el(env) == 2
4086	&& arm_feature(env, ARM_FEATURE_EL3)
4087	&& !(env->cp15.scr_el3 & SCR_HXEN)) {
4088	return CP_ACCESS_TRAP_EL3;
4089	}
4090	return CP_ACCESS_OK;
4091	}
4092
4093	static const ARMCPRegInfo hcrx_el2_reginfo = {
4094	.name = "HCRX_EL2", .state = ARM_CP_STATE_AA64,
4095	.type = ARM_CP_IO,
4096	.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 2,
4097	.access = PL2_RW, .writefn = hcrx_write, .accessfn = access_hxen,
4098	.nv2_redirect_offset = 0xa0,
4099	.fieldoffset = offsetof(CPUARMState, cp15.hcrx_el2),
4100	};
4101
4102	/* Return the effective value of HCRX_EL2. */
4103	uint64_t arm_hcrx_el2_eff(CPUARMState *env)
4104	{
4105	/*
4106	* The bits in this register behave as 0 for all purposes other than
4107	* direct reads of the register if SCR_EL3.HXEn is 0.
4108	* If EL2 is not enabled in the current security state, then the
4109	* bit may behave as if 0, or as if 1, depending on the bit.
4110	* For the moment, we treat the EL2-disabled case as taking
4111	* priority over the HXEn-disabled case. This is true for the only
4112	* bit for a feature which we implement where the answer is different
4113	* for the two cases (MSCEn for FEAT_MOPS).
4114	* This may need to be revisited for future bits.
4115	*/
4116	if (!arm_is_el2_enabled(env)) {
4117	ARMCPU *cpu = env_archcpu(env);
4118	uint64_t hcrx = 0;
4119
4120	/* Bits which whose effective value is 1 if el2 not enabled. */
4121	if (cpu_isar_feature(aa64_mops, cpu)) {
4122	hcrx \|= HCRX_MSCEN;
4123	}
4124	if (cpu_isar_feature(aa64_tcr2, cpu)) {
4125	hcrx \|= HCRX_TCR2EN;
4126	}
4127	if (cpu_isar_feature(aa64_sctlr2, cpu)) {
4128	hcrx \|= HCRX_SCTLR2EN;
4129	}
4130	if (cpu_isar_feature(aa64_gcs, cpu)) {
4131	hcrx \|= HCRX_GCSEN;
4132	}
4133	if (cpu_isar_feature(aa64_fpmr, cpu)) {
4134	hcrx \|= HCRX_ENFPM;
4135	}
4136	return hcrx;
4137	}
4138	if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_HXEN)) {
4139	return 0;
4140	}
4141	return env->cp15.hcrx_el2;
4142	}
4143
4144	static void cptr_el2_write(CPUARMState env, const ARMCPRegInfo ri,
4145	uint64_t value)
4146	{
4147	if (!arm_feature(env, ARM_FEATURE_NEON_TRAPS)) {
4148	/*
4149	* If CPU doesn't implement HCPTR.TASE it's RAZ/WI. Note that
4150	* NSACR.NSASEDIS being 1 overrides this.
4151	*/
4152	value &= ~R_HCPTR_TASE_MASK;
4153	}
4154	/*
4155	* For A-profile AArch32 EL3, if NSACR.CP10
4156	* is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
4157	* Similarly, if NSACR.NSASEDIS is 1 then HCPTR.TASE behaves as RAO/WI.
4158	*/
4159	if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
4160	!arm_is_secure(env)) {
4161	if (!FIELD_EX32(env->cp15.nsacr, NSACR, CP10)) {
4162	uint64_t mask = R_HCPTR_TCP11_MASK \| R_HCPTR_TCP10_MASK;
4163	value = (value & ~mask) \| (env->cp15.cptr_el[2] & mask);
4164	}
4165	if (FIELD_EX32(env->cp15.nsacr, NSACR, NSASEDIS)) {
4166	uint64_t mask = R_HCPTR_TASE_MASK;
4167	value = (value & ~mask) \| (env->cp15.cptr_el[2] & mask);
4168	}
4169	}
4170	env->cp15.cptr_el[2] = value;
4171	}
4172
4173	static uint64_t cptr_el2_read(CPUARMState env, const ARMCPRegInfo ri)
4174	{
4175	/*
4176	* For A-profile AArch32 EL3, if NSACR.CP10
4177	* is 0 then HCPTR.{TCP11,TCP10} ignore writes and read as 1.
4178	* Similarly, if NSACR.NSASEDIS is 1 then HCPTR.TASE behaves as RAO/WI.
4179	*/
4180	uint64_t value = env->cp15.cptr_el[2];
4181
4182	if (arm_feature(env, ARM_FEATURE_EL3) && !arm_el_is_aa64(env, 3) &&
4183	!arm_is_secure(env)) {
4184	if (!FIELD_EX32(env->cp15.nsacr, NSACR, CP10)) {
4185	value \|= R_HCPTR_TCP11_MASK \| R_HCPTR_TCP10_MASK;
4186	}
4187	if (!FIELD_EX32(env->cp15.nsacr, NSACR, NSASEDIS)) {
4188	value \|= R_HCPTR_TASE_MASK;
4189	}
4190	}
4191	return value;
4192	}
4193
4194	static const ARMCPRegInfo el2_cp_reginfo[] = {
4195	{ .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
4196	.type = ARM_CP_IO,
4197	.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4198	.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4199	.nv2_redirect_offset = 0x78,
4200	.resetfn = hcr_reset,
4201	.writefn = hcr_write, .raw_writefn = raw_write },
4202	{ .name = "HCR", .state = ARM_CP_STATE_AA32,
4203	.type = ARM_CP_ALIAS \| ARM_CP_IO,
4204	.cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
4205	.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
4206	.writefn = hcr_writelow },
4207	{ .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
4208	.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
4209	.access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
4210	{ .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
4211	.type = ARM_CP_ALIAS \| ARM_CP_NV2_REDIRECT,
4212	.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
4213	.access = PL2_RW, .accessfn = access_exlock_el2,
4214	.fieldoffset = offsetof(CPUARMState, elr_el[2]) },
4215	{ .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
4216	.type = ARM_CP_NV2_REDIRECT,
4217	.opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
4218	.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
4219	{ .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
4220	.type = ARM_CP_NV2_REDIRECT,
4221	.opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
4222	.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
4223	{ .name = "HIFAR", .state = ARM_CP_STATE_AA32,
4224	.type = ARM_CP_ALIAS,
4225	.cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
4226	.access = PL2_RW,
4227	.fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) },
4228	{ .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
4229	.type = ARM_CP_ALIAS \| ARM_CP_NV2_REDIRECT,
4230	.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
4231	.access = PL2_RW, .accessfn = access_exlock_el2,
4232	.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
4233	{ .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
4234	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
4235	.access = PL2_RW, .writefn = vbar_write,
4236	.fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
4237	.resetvalue = 0 },
4238	{ .name = "SP_EL2", .state = ARM_CP_STATE_AA64,
4239	.opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 0,
4240	.access = PL3_RW, .type = ARM_CP_ALIAS,
4241	.fieldoffset = offsetof(CPUARMState, sp_el[2]) },
4242	{ .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
4243	.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
4244	.access = PL2_RW, .accessfn = cptr_access, .resetvalue = 0,
4245	.fieldoffset = offsetof(CPUARMState, cp15.cptr_el[2]),
4246	.readfn = cptr_el2_read, .writefn = cptr_el2_write },
4247	{ .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
4248	.opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
4249	.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
4250	.resetvalue = 0 },
4251	{ .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
4252	.cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
4253	.access = PL2_RW, .type = ARM_CP_ALIAS,
4254	.fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
4255	{ .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
4256	.opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
4257	.access = PL2_RW, .type = ARM_CP_CONST,
4258	.resetvalue = 0 },
4259	/* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
4260	{ .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
4261	.cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
4262	.access = PL2_RW, .type = ARM_CP_CONST,
4263	.resetvalue = 0 },
4264	{ .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
4265	.opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
4266	.access = PL2_RW, .type = ARM_CP_CONST,
4267	.resetvalue = 0 },
4268	{ .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
4269	.opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
4270	.access = PL2_RW, .type = ARM_CP_CONST,
4271	.resetvalue = 0 },
4272	{ .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
4273	.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
4274	.access = PL2_RW, .writefn = vmsa_tcr_el12_write,
4275	.raw_writefn = raw_write,
4276	.fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
4277	{ .name = "VTCR", .state = ARM_CP_STATE_AA32,
4278	.cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4279	.type = ARM_CP_ALIAS,
4280	.access = PL2_RW, .accessfn = access_el3_aa32ns,
4281	.fieldoffset = offsetoflow32(CPUARMState, cp15.vtcr_el2) },
4282	{ .name = "VTCR_EL2", .state = ARM_CP_STATE_AA64,
4283	.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
4284	.access = PL2_RW,
4285	.nv2_redirect_offset = 0x40,
4286	/* no .writefn needed as this can't cause an ASID change */
4287	.fieldoffset = offsetof(CPUARMState, cp15.vtcr_el2) },
4288	{ .name = "VTTBR", .state = ARM_CP_STATE_AA32,
4289	.cp = 15, .opc1 = 6, .crm = 2,
4290	.type = ARM_CP_64BIT \| ARM_CP_ALIAS,
4291	.access = PL2_RW, .accessfn = access_el3_aa32ns,
4292	.fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
4293	.writefn = vttbr_write, .raw_writefn = raw_write },
4294	{ .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
4295	.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
4296	.access = PL2_RW, .writefn = vttbr_write, .raw_writefn = raw_write,
4297	.nv2_redirect_offset = 0x20,
4298	.fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
4299	{ .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
4300	.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
4301	.access = PL2_RW, .raw_writefn = raw_write, .writefn = sctlr_write,
4302	.fieldoffset = offsetof(CPUARMState, cp15.sctlr_el[2]) },
4303	{ .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
4304	.opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
4305	.access = PL2_RW, .resetvalue = 0,
4306	.nv2_redirect_offset = 0x90,
4307	.fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
4308	{ .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
4309	.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
4310	.access = PL2_RW, .resetvalue = 0,
4311	.writefn = vmsa_tcr_ttbr_el2_write, .raw_writefn = raw_write,
4312	.fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4313	{ .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
4314	.access = PL2_RW, .type = ARM_CP_64BIT \| ARM_CP_ALIAS,
4315	.fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
4316	#ifndef CONFIG_USER_ONLY
4317	{ .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
4318	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
4319	/*
4320	* ARMv7 requires bit 0 and 1 to reset to 1. ARMv8 defines the
4321	* reset values as IMPDEF. We choose to reset to 3 to comply with
4322	* both ARMv7 and ARMv8.
4323	*/
4324	.access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 3,
4325	.writefn = gt_cnthctl_write, .raw_writefn = raw_write,
4326	.fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
4327	{ .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
4328	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
4329	.access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
4330	.writefn = gt_cntvoff_write,
4331	.nv2_redirect_offset = 0x60,
4332	.fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
4333	{ .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
4334	.access = PL2_RW, .type = ARM_CP_64BIT \| ARM_CP_ALIAS \| ARM_CP_IO,
4335	.writefn = gt_cntvoff_write,
4336	.fieldoffset = offsetof(CPUARMState, cp15.cntvoff_el2) },
4337	{ .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
4338	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
4339	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
4340	.type = ARM_CP_IO, .access = PL2_RW,
4341	.writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
4342	{ .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
4343	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].cval),
4344	.access = PL2_RW, .type = ARM_CP_64BIT \| ARM_CP_IO,
4345	.writefn = gt_hyp_cval_write, .raw_writefn = raw_write },
4346	{ .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
4347	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
4348	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL2_RW,
4349	.resetfn = gt_hyp_timer_reset,
4350	.readfn = gt_hyp_tval_read, .writefn = gt_hyp_tval_write },
4351	{ .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
4352	.type = ARM_CP_IO,
4353	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
4354	.access = PL2_RW,
4355	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_HYP].ctl),
4356	.resetvalue = 0,
4357	.writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
4358	#endif
4359	{ .name = "HPFAR", .state = ARM_CP_STATE_AA32,
4360	.cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4361	.access = PL2_RW, .accessfn = access_el3_aa32ns,
4362	.fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
4363	{ .name = "HPFAR_EL2", .state = ARM_CP_STATE_AA64,
4364	.opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
4365	.access = PL2_RW,
4366	.fieldoffset = offsetof(CPUARMState, cp15.hpfar_el2) },
4367	{ .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
4368	.cp = 15, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
4369	.access = PL2_RW,
4370	.nv2_redirect_offset = 0x80,
4371	.fieldoffset = offsetof(CPUARMState, cp15.hstr_el2) },
4372	};
4373
4374	static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
4375	{ .name = "HCR2", .state = ARM_CP_STATE_AA32,
4376	.type = ARM_CP_ALIAS \| ARM_CP_IO,
4377	.cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
4378	.access = PL2_RW,
4379	.fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
4380	.writefn = hcr_writehigh },
4381	};
4382
4383	static CPAccessResult sel2_access(CPUARMState env, const ARMCPRegInfo ri,
4384	bool isread)
4385	{
4386	if (arm_current_el(env) == 3 \|\| arm_is_secure_below_el3(env)) {
4387	return CP_ACCESS_OK;
4388	}
4389	return CP_ACCESS_UNDEFINED;
4390	}
4391
4392	static const ARMCPRegInfo el2_sec_cp_reginfo[] = {
4393	{ .name = "VSTTBR_EL2", .state = ARM_CP_STATE_AA64,
4394	.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 0,
4395	.access = PL2_RW, .accessfn = sel2_access,
4396	.nv2_redirect_offset = 0x30,
4397	.fieldoffset = offsetof(CPUARMState, cp15.vsttbr_el2) },
4398	{ .name = "VSTCR_EL2", .state = ARM_CP_STATE_AA64,
4399	.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2,
4400	.access = PL2_RW, .accessfn = sel2_access,
4401	.nv2_redirect_offset = 0x48,
4402	.fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) },
4403	#ifndef CONFIG_USER_ONLY
4404	/* Secure EL2 Physical Timer */
4405	{ .name = "CNTHPS_TVAL_EL2", .state = ARM_CP_STATE_AA64,
4406	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 0,
4407	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL2_RW,
4408	.accessfn = gt_sel2timer_access,
4409	.readfn = gt_sec_pel2_tval_read,
4410	.writefn = gt_sec_pel2_tval_write,
4411	.resetfn = gt_sec_pel2_timer_reset,
4412	},
4413	{ .name = "CNTHPS_CTL_EL2", .state = ARM_CP_STATE_AA64,
4414	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 1,
4415	.type = ARM_CP_IO, .access = PL2_RW,
4416	.accessfn = gt_sel2timer_access,
4417	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_PHYS].ctl),
4418	.resetvalue = 0,
4419	.writefn = gt_sec_pel2_ctl_write, .raw_writefn = raw_write,
4420	},
4421	{ .name = "CNTHPS_CVAL_EL2", .state = ARM_CP_STATE_AA64,
4422	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 2,
4423	.type = ARM_CP_IO, .access = PL2_RW,
4424	.accessfn = gt_sel2timer_access,
4425	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_PHYS].cval),
4426	.writefn = gt_sec_pel2_cval_write, .raw_writefn = raw_write,
4427	},
4428	/* Secure EL2 Virtual Timer */
4429	{ .name = "CNTHVS_TVAL_EL2", .state = ARM_CP_STATE_AA64,
4430	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 0,
4431	.type = ARM_CP_NO_RAW \| ARM_CP_IO, .access = PL2_RW,
4432	.accessfn = gt_sel2timer_access,
4433	.readfn = gt_sec_vel2_tval_read,
4434	.writefn = gt_sec_vel2_tval_write,
4435	.resetfn = gt_sec_vel2_timer_reset,
4436	},
4437	{ .name = "CNTHVS_CTL_EL2", .state = ARM_CP_STATE_AA64,
4438	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 1,
4439	.type = ARM_CP_IO, .access = PL2_RW,
4440	.accessfn = gt_sel2timer_access,
4441	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_VIRT].ctl),
4442	.resetvalue = 0,
4443	.writefn = gt_sec_vel2_ctl_write, .raw_writefn = raw_write,
4444	},
4445	{ .name = "CNTHVS_CVAL_EL2", .state = ARM_CP_STATE_AA64,
4446	.opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 2,
4447	.type = ARM_CP_IO, .access = PL2_RW,
4448	.accessfn = gt_sel2timer_access,
4449	.fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_VIRT].cval),
4450	.writefn = gt_sec_vel2_cval_write, .raw_writefn = raw_write,
4451	},
4452	#endif
4453	};
4454
4455	static CPAccessResult nsacr_access(CPUARMState env, const ARMCPRegInfo ri,
4456	bool isread)
4457	{
4458	/*
4459	* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
4460	* At Secure EL1 it traps to EL3 or EL2.
4461	*/
4462	if (arm_current_el(env) == 3) {
4463	return CP_ACCESS_OK;
4464	}
4465	if (arm_is_secure_below_el3(env)) {
4466	if (env->cp15.scr_el3 & SCR_EEL2) {
4467	return CP_ACCESS_TRAP_EL2;
4468	}
4469	return CP_ACCESS_TRAP_EL3;
4470	}
4471	/* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
4472	if (isread) {
4473	return CP_ACCESS_OK;
4474	}
4475	return CP_ACCESS_UNDEFINED;
4476	}
4477
4478	static const ARMCPRegInfo el3_cp_reginfo[] = {
4479	{ .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
4480	.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
4481	.access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
4482	.resetfn = scr_reset, .writefn = scr_write, .raw_writefn = raw_write },
4483	{ .name = "SCR", .type = ARM_CP_ALIAS \| ARM_CP_NEWEL,
4484	.cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
4485	.access = PL1_RW, .accessfn = access_trap_aa32s_el1,
4486	.fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
4487	.writefn = scr_write, .raw_writefn = raw_write },
4488	{ .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
4489	.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
4490	.access = PL3_RW, .resetvalue = 0,
4491	.fieldoffset = offsetof(CPUARMState, cp15.sder) },
4492	{ .name = "SDER",
4493	.cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 1,
4494	.access = PL3_RW, .resetvalue = 0,
4495	.fieldoffset = offsetoflow32(CPUARMState, cp15.sder) },
4496	{ .name = "MVBAR", .cp = 15, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
4497	.access = PL1_RW, .accessfn = access_trap_aa32s_el1,
4498	.writefn = vbar_write, .resetvalue = 0,
4499	.fieldoffset = offsetof(CPUARMState, cp15.mvbar) },
4500	{ .name = "TTBR0_EL3", .state = ARM_CP_STATE_AA64,
4501	.opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 0,
4502	.access = PL3_RW, .fgt = FGT_TTBR0_EL3,
4503	.fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[3]) },
4504	{ .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
4505	.opc0 = 3, .opc1 = 6, .crn = 2, .crm = 0, .opc2 = 2,
4506	.access = PL3_RW, .fgt = FGT_TCR_EL3,
4507	/* no .writefn needed as this can't cause an ASID change */
4508	.resetvalue = 0,
4509	.fieldoffset = offsetof(CPUARMState, cp15.tcr_el[3]) },
4510	{ .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
4511	.type = ARM_CP_ALIAS,
4512	.opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
4513	.access = PL3_RW, .accessfn = access_exlock_el3,
4514	.fieldoffset = offsetof(CPUARMState, elr_el[3]) },
4515	{ .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
4516	.opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
4517	.access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[3]) },
4518	{ .name = "FAR_EL3", .state = ARM_CP_STATE_AA64,
4519	.opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 0,
4520	.access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[3]) },
4521	{ .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
4522	.type = ARM_CP_ALIAS,
4523	.opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
4524	.access = PL3_RW, .accessfn = access_exlock_el3,
4525	.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) },
4526	{ .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
4527	.opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
4528	.access = PL3_RW, .fgt = FGT_VBAR_EL3, .writefn = vbar_write,
4529	.fieldoffset = offsetof(CPUARMState, cp15.vbar_el[3]),
4530	.resetvalue = 0 },
4531	{ .name = "CPTR_EL3", .state = ARM_CP_STATE_AA64,
4532	.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 2,
4533	.access = PL3_RW, .accessfn = cptr_access, .resetvalue = 0,
4534	.fieldoffset = offsetof(CPUARMState, cp15.cptr_el[3]) },
4535	{ .name = "TPIDR_EL3", .state = ARM_CP_STATE_AA64,
4536	.opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 2,
4537	.access = PL3_RW, .fgt = FGT_TPIDR_EL3,
4538	.fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[3]) },
4539	{ .name = "AMAIR_EL3", .state = ARM_CP_STATE_AA64,
4540	.opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 0,
4541	.access = PL3_RW, .fgt = FGT_AMAIR_EL3,
4542	.type = ARM_CP_CONST, .resetvalue = 0 },
4543	{ .name = "AFSR0_EL3", .state = ARM_CP_STATE_BOTH,
4544	.opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 0,
4545	.access = PL3_RW, .fgt = FGT_AFSR0_EL3,
4546	.type = ARM_CP_CONST, .resetvalue = 0 },
4547	{ .name = "AFSR1_EL3", .state = ARM_CP_STATE_BOTH,
4548	.opc0 = 3, .opc1 = 6, .crn = 5, .crm = 1, .opc2 = 1,
4549	.access = PL3_RW, .fgt = FGT_AFSR1_EL3,
4550	.type = ARM_CP_CONST, .resetvalue = 0 },
4551	};
4552
4553	#ifndef CONFIG_USER_ONLY
4554
4555	static CPAccessResult e2h_access(CPUARMState env, const ARMCPRegInfo ri,
4556	bool isread)
4557	{
4558	if (arm_current_el(env) == 1) {
4559	/* This must be a FEAT_NV access */
4560	return CP_ACCESS_OK;
4561	}
4562	if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
4563	return CP_ACCESS_UNDEFINED;
4564	}
4565	return CP_ACCESS_OK;
4566	}
4567
4568	static CPAccessResult access_el1nvpct(CPUARMState env, const ARMCPRegInfo ri,
4569	bool isread)
4570	{
4571	if (arm_current_el(env) == 1) {
4572	/* This must be a FEAT_NV access with NVx == 101 */
4573	if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
4574	return CP_ACCESS_TRAP_EL2;
4575	}
4576	}
4577	return e2h_access(env, ri, isread);
4578	}
4579
4580	static CPAccessResult access_el1nvvct(CPUARMState env, const ARMCPRegInfo ri,
4581	bool isread)
4582	{
4583	if (arm_current_el(env) == 1) {
4584	/* This must be a FEAT_NV access with NVx == 101 */
4585	if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
4586	return CP_ACCESS_TRAP_EL2;
4587	}
4588	}
4589	return e2h_access(env, ri, isread);
4590	}
4591
4592	#endif
4593
4594	static CPAccessResult ctr_el0_access(CPUARMState env, const ARMCPRegInfo ri,
4595	bool isread)
4596	{
4597	int cur_el = arm_current_el(env);
4598
4599	if (cur_el < 2) {
4600	uint64_t hcr = arm_hcr_el2_eff(env);
4601
4602	if (cur_el == 0) {
4603	if ((hcr & (HCR_E2H \| HCR_TGE)) == (HCR_E2H \| HCR_TGE)) {
4604	if (!(env->cp15.sctlr_el[2] & SCTLR_UCT)) {
4605	return CP_ACCESS_TRAP_EL2;
4606	}
4607	} else {
4608	if (!(env->cp15.sctlr_el[1] & SCTLR_UCT)) {
4609	return CP_ACCESS_TRAP_EL1;
4610	}
4611	if (hcr & HCR_TID2) {
4612	return CP_ACCESS_TRAP_EL2;
4613	}
4614	}
4615	} else if (hcr & HCR_TID2) {
4616	return CP_ACCESS_TRAP_EL2;
4617	}
4618	}
4619
4620	if (arm_current_el(env) < 2 && arm_hcr_el2_eff(env) & HCR_TID2) {
4621	return CP_ACCESS_TRAP_EL2;
4622	}
4623
4624	return CP_ACCESS_OK;
4625	}
4626
4627	/*
4628	* Check for traps to RAS registers, which are controlled
4629	* by HCR_EL2.TERR and SCR_EL3.TERR.
4630	*/
4631	static CPAccessResult access_terr(CPUARMState env, const ARMCPRegInfo ri,
4632	bool isread)
4633	{
4634	int el = arm_current_el(env);
4635
4636	if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) {
4637	return CP_ACCESS_TRAP_EL2;
4638	}
4639	if (!arm_is_el3_or_mon(env) && (env->cp15.scr_el3 & SCR_TERR)) {
4640	return CP_ACCESS_TRAP_EL3;
4641	}
4642	return CP_ACCESS_OK;
4643	}
4644
4645	static uint64_t disr_read(CPUARMState env, const ARMCPRegInfo ri)
4646	{
4647	int el = arm_current_el(env);
4648
4649	if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) {
4650	return env->cp15.vdisr_el2;
4651	}
4652	if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) {
4653	return 0; /* RAZ/WI */
4654	}
4655	return env->cp15.disr_el1;
4656	}
4657
4658	static void disr_write(CPUARMState env, const ARMCPRegInfo ri, uint64_t val)
4659	{
4660	int el = arm_current_el(env);
4661
4662	if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) {
4663	env->cp15.vdisr_el2 = val;
4664	return;
4665	}
4666	if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) {
4667	return; /* RAZ/WI */
4668	}
4669	env->cp15.disr_el1 = val;
4670	}
4671
4672	/*
4673	* Minimal RAS implementation with no Error Records.
4674	* Which means that all of the Error Record registers:
4675	* ERXADDR_EL1
4676	* ERXCTLR_EL1
4677	* ERXFR_EL1
4678	* ERXMISC0_EL1
4679	* ERXMISC1_EL1
4680	* ERXMISC2_EL1
4681	* ERXMISC3_EL1
4682	* ERXPFGCDN_EL1 (RASv1p1)
4683	* ERXPFGCTL_EL1 (RASv1p1)
4684	* ERXPFGF_EL1 (RASv1p1)
4685	* ERXSTATUS_EL1
4686	* and
4687	* ERRSELR_EL1
4688	* may generate UNDEFINED, which is the effect we get by not
4689	* listing them at all.
4690	*
4691	* These registers have fine-grained trap bits, but UNDEF-to-EL1
4692	* is higher priority than FGT-to-EL2 so we do not need to list them
4693	* in order to check for an FGT.
4694	*/
4695	static const ARMCPRegInfo minimal_ras_reginfo[] = {
4696	{ .name = "DISR_EL1", .state = ARM_CP_STATE_BOTH,
4697	.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 1,
4698	.access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.disr_el1),
4699	.readfn = disr_read, .writefn = disr_write, .raw_writefn = raw_write },
4700	{ .name = "ERRIDR_EL1", .state = ARM_CP_STATE_BOTH,
4701	.opc0 = 3, .opc1 = 0, .crn = 5, .crm = 3, .opc2 = 0,
4702	.access = PL1_R, .accessfn = access_terr,
4703	.fgt = FGT_ERRIDR_EL1,
4704	.type = ARM_CP_CONST, .resetvalue = 0 },
4705	{ .name = "VDISR_EL2", .state = ARM_CP_STATE_BOTH,
4706	.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 1, .opc2 = 1,
4707	.nv2_redirect_offset = 0x500,
4708	.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vdisr_el2) },
4709	{ .name = "VSESR_EL2", .state = ARM_CP_STATE_BOTH,
4710	.opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 3,
4711	.nv2_redirect_offset = 0x508,
4712	.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vsesr_el2) },
4713	};
4714
4715	/*
4716	* Return the exception level to which exceptions should be taken
4717	* via SVEAccessTrap. This excludes the check for whether the exception
4718	* should be routed through AArch64.AdvSIMDFPAccessTrap. That can easily
4719	* be found by testing 0 < fp_exception_el < sve_exception_el.
4720	*
4721	* C.f. the ARM pseudocode function CheckSVEEnabled. Note that the
4722	* pseudocode does not separate out the FP trap checks, but has them
4723	* all in one function.
4724	*/
4725	int sve_exception_el(CPUARMState *env, int el)
4726	{
4727	#ifndef CONFIG_USER_ONLY
4728	if (el <= 1 && !el_is_in_host(env, el)) {
4729	switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, ZEN)) {
4730	case 1:
4731	if (el != 0) {
4732	break;
4733	}
4734	/* fall through */
4735	case 0:
4736	case 2:
4737	return 1;
4738	}
4739	}
4740
4741	if (el <= 2 && arm_is_el2_enabled(env)) {
4742	/* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */
4743	if (env->cp15.hcr_el2 & HCR_E2H) {
4744	switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, ZEN)) {
4745	case 1:
4746	if (el != 0 \|\| !(env->cp15.hcr_el2 & HCR_TGE)) {
4747	break;
4748	}
4749	/* fall through */
4750	case 0:
4751	case 2:
4752	return 2;
4753	}
4754	} else {
4755	if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TZ)) {
4756	return 2;
4757	}
4758	}
4759	}
4760
4761	/* CPTR_EL3. Since EZ is negative we must check for EL3. */
4762	if (arm_feature(env, ARM_FEATURE_EL3)
4763	&& !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, EZ)) {
4764	return 3;
4765	}
4766	#endif
4767	return 0;
4768	}
4769
4770	/*
4771	* Return the exception level to which exceptions should be taken for SME.
4772	* C.f. the ARM pseudocode function CheckSMEAccess.
4773	*/
4774	int sme_exception_el(CPUARMState *env, int el)
4775	{
4776	#ifndef CONFIG_USER_ONLY
4777	if (el <= 1 && !el_is_in_host(env, el)) {
4778	switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) {
4779	case 1:
4780	if (el != 0) {
4781	break;
4782	}
4783	/* fall through */
4784	case 0:
4785	case 2:
4786	return 1;
4787	}
4788	}
4789
4790	if (el <= 2 && arm_is_el2_enabled(env)) {
4791	/* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */
4792	if (env->cp15.hcr_el2 & HCR_E2H) {
4793	switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) {
4794	case 1:
4795	if (el != 0 \|\| !(env->cp15.hcr_el2 & HCR_TGE)) {
4796	break;
4797	}
4798	/* fall through */
4799	case 0:
4800	case 2:
4801	return 2;
4802	}
4803	} else {
4804	if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) {
4805	return 2;
4806	}
4807	}
4808	}
4809
4810	/* CPTR_EL3. Since ESM is negative we must check for EL3. */
4811	if (arm_feature(env, ARM_FEATURE_EL3)
4812	&& !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
4813	return 3;
4814	}
4815	#endif
4816	return 0;
4817	}
4818
4819	/*
4820	* Given that SVE or SME is enabled, return the vector length for EL.
4821	*/
4822	uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm)
4823	{
4824	ARMCPU *cpu = env_archcpu(env);
4825	uint64_t *cr = env->vfp.zcr_el;
4826	uint32_t map = cpu->sve_vq.map;
4827	uint32_t len = ARM_MAX_VQ - 1;
4828
4829	if (sm) {
4830	cr = env->vfp.smcr_el;
4831	map = cpu->sme_vq.map;
4832	} else if (map == 0) {
4833	/*
4834	* SME-only CPU not in streaming mode: effective VL
4835	* is 128 bits, per R_KXKNK.
4836	*/
4837	return 0;
4838	}
4839
4840	if (el <= 1 && !el_is_in_host(env, el)) {
4841	len = MIN(len, 0xf & (uint32_t)cr[1]);
4842	}
4843	if (el <= 2 && arm_is_el2_enabled(env)) {
4844	len = MIN(len, 0xf & (uint32_t)cr[2]);
4845	}
4846	if (arm_feature(env, ARM_FEATURE_EL3)) {
4847	len = MIN(len, 0xf & (uint32_t)cr[3]);
4848	}
4849
4850	map &= MAKE_64BIT_MASK(0, len + 1);
4851	if (map != 0) {
4852	return 31 - clz32(map);
4853	}
4854
4855	/* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */
4856	assert(sm);
4857	return ctz32(cpu->sme_vq.map);
4858	}
4859
4860	uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
4861	{
4862	return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM));
4863	}
4864
4865	static void zcr_write(CPUARMState env, const ARMCPRegInfo ri,
4866	uint64_t value)
4867	{
4868	int cur_el = arm_current_el(env);
4869	int old_len = sve_vqm1_for_el(env, cur_el);
4870	int new_len;
4871
4872	/* Bits other than [3:0] are RAZ/WI. */
4873	QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
4874	raw_write(env, ri, value & 0xf);
4875
4876	/*
4877	* Because we arrived here, we know both FP and SVE are enabled;
4878	* otherwise we would have trapped access to the ZCR_ELn register.
4879	*/
4880	new_len = sve_vqm1_for_el(env, cur_el);
4881	if (new_len < old_len) {
4882	aarch64_sve_narrow_vq(env, new_len + 1);
4883	}
4884	}
4885
4886	static const ARMCPRegInfo zcr_reginfo[] = {
4887	{ .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
4888	.opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
4889	.nv2_redirect_offset = 0x1e0 \| NV2_REDIR_NV1,
4890	.vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 1, 2, 0),
4891	.vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 1, 2, 0),
4892	.access = PL1_RW, .type = ARM_CP_SVE,
4893	.fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
4894	.writefn = zcr_write, .raw_writefn = raw_write },
4895	{ .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
4896	.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
4897	.access = PL2_RW, .type = ARM_CP_SVE,
4898	.fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
4899	.writefn = zcr_write, .raw_writefn = raw_write },
4900	{ .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
4901	.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
4902	.access = PL3_RW, .type = ARM_CP_SVE,
4903	.fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
4904	.writefn = zcr_write, .raw_writefn = raw_write },
4905	};
4906
4907	static CPAccessResult access_tpidr2(CPUARMState env, const ARMCPRegInfo ri,
4908	bool isread)
4909	{
4910	int el = arm_current_el(env);
4911
4912	if (el == 0) {
4913	uint64_t sctlr = arm_sctlr(env, el);
4914	if (!(sctlr & SCTLR_EnTP2)) {
4915	return CP_ACCESS_TRAP_EL1;
4916	}
4917	}
4918	/* TODO: FEAT_FGT */
4919	if (el < 3
4920	&& arm_feature(env, ARM_FEATURE_EL3)
4921	&& !(env->cp15.scr_el3 & SCR_ENTP2)) {
4922	return CP_ACCESS_TRAP_EL3;
4923	}
4924	return CP_ACCESS_OK;
4925	}
4926
4927	static CPAccessResult access_smprimap(CPUARMState env, const ARMCPRegInfo ri,
4928	bool isread)
4929	{
4930	/* If EL1 this is a FEAT_NV access and CPTR_EL3.ESM doesn't apply */
4931	if (arm_current_el(env) == 2
4932	&& arm_feature(env, ARM_FEATURE_EL3)
4933	&& !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
4934	return CP_ACCESS_TRAP_EL3;
4935	}
4936	return CP_ACCESS_OK;
4937	}
4938
4939	static CPAccessResult access_smpri(CPUARMState env, const ARMCPRegInfo ri,
4940	bool isread)
4941	{
4942	if (arm_current_el(env) < 3
4943	&& arm_feature(env, ARM_FEATURE_EL3)
4944	&& !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
4945	return CP_ACCESS_TRAP_EL3;
4946	}
4947	return CP_ACCESS_OK;
4948	}
4949
4950	/* ResetSVEState */
4951	static void arm_reset_sve_state(CPUARMState *env)
4952	{
4953	memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
4954	/* Recall that FFR is stored as pregs[16]. */
4955	memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
4956	vfp_set_fpsr(env, 0x0800009f);
4957	env->vfp.fpmr = 0;
4958	}
4959
4960	void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
4961	{
4962	uint64_t change = (env->svcr ^ new) & mask;
4963
4964	if (change == 0) {
4965	return;
4966	}
4967	env->svcr ^= change;
4968
4969	if (change & R_SVCR_SM_MASK) {
4970	arm_reset_sve_state(env);
4971	}
4972
4973	/*
4974	* ResetSMEState.
4975	*
4976	* SetPSTATE_ZA zeros on enable and disable. We can zero this only
4977	* on enable: while disabled, the storage is inaccessible and the
4978	* value does not matter. We're not saving the storage in vmstate
4979	* when disabled either.
4980	*/
4981	if (change & new & R_SVCR_ZA_MASK) {
4982	memset(&env->za_state, 0, sizeof(env->za_state));
4983	}
4984
4985	if (tcg_enabled()) {
4986	arm_rebuild_hflags(env);
4987	}
4988	}
4989
4990	static void svcr_write(CPUARMState env, const ARMCPRegInfo ri,
4991	uint64_t value)
4992	{
4993	aarch64_set_svcr(env, value, -1);
4994	}
4995
4996	static void smcr_write(CPUARMState env, const ARMCPRegInfo ri,
4997	uint64_t value)
4998	{
4999	int cur_el = arm_current_el(env);
5000	int old_len = sve_vqm1_for_el(env, cur_el);

Showing first 5,000 of 10,442 lines. View raw