/
cpu.h
4161 lines (3705 loc) · 135 KB
/
cpu.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* ARM virtual CPU header
*
* Copyright (c) 2003 Fabrice Bellard
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
*/
#ifndef ARM_CPU_H
#define ARM_CPU_H
#include "kvm-consts.h"
#include "qemu/cpu-float.h"
#include "hw/registerfields.h"
#include "cpu-qom.h"
#include "exec/cpu-defs.h"
#include "qapi/qapi-types-common.h"
/* ARM processors have a weak memory model */
#define TCG_GUEST_DEFAULT_MO (0)
#ifdef TARGET_AARCH64
#define KVM_HAVE_MCE_INJECTION 1
#endif
#define EXCP_UDEF 1 /* undefined instruction */
#define EXCP_SWI 2 /* software interrupt */
#define EXCP_PREFETCH_ABORT 3
#define EXCP_DATA_ABORT 4
#define EXCP_IRQ 5
#define EXCP_FIQ 6
#define EXCP_BKPT 7
#define EXCP_EXCEPTION_EXIT 8 /* Return from v7M exception. */
#define EXCP_KERNEL_TRAP 9 /* Jumped to kernel code page. */
#define EXCP_HVC 11 /* HyperVisor Call */
#define EXCP_HYP_TRAP 12
#define EXCP_SMC 13 /* Secure Monitor Call */
#define EXCP_VIRQ 14
#define EXCP_VFIQ 15
#define EXCP_SEMIHOST 16 /* semihosting call */
#define EXCP_NOCP 17 /* v7M NOCP UsageFault */
#define EXCP_INVSTATE 18 /* v7M INVSTATE UsageFault */
#define EXCP_STKOF 19 /* v8M STKOF UsageFault */
#define EXCP_LAZYFP 20 /* v7M fault during lazy FP stacking */
#define EXCP_LSERR 21 /* v8M LSERR SecureFault */
#define EXCP_UNALIGNED 22 /* v7M UNALIGNED UsageFault */
#define EXCP_DIVBYZERO 23 /* v7M DIVBYZERO UsageFault */
#define EXCP_VSERR 24
/* NB: add new EXCP_ defines to the array in arm_log_exception() too */
#define ARMV7M_EXCP_RESET 1
#define ARMV7M_EXCP_NMI 2
#define ARMV7M_EXCP_HARD 3
#define ARMV7M_EXCP_MEM 4
#define ARMV7M_EXCP_BUS 5
#define ARMV7M_EXCP_USAGE 6
#define ARMV7M_EXCP_SECURE 7
#define ARMV7M_EXCP_SVC 11
#define ARMV7M_EXCP_DEBUG 12
#define ARMV7M_EXCP_PENDSV 14
#define ARMV7M_EXCP_SYSTICK 15
/* For M profile, some registers are banked secure vs non-secure;
* these are represented as a 2-element array where the first element
* is the non-secure copy and the second is the secure copy.
* When the CPU does not have implement the security extension then
* only the first element is used.
* This means that the copy for the current security state can be
* accessed via env->registerfield[env->v7m.secure] (whether the security
* extension is implemented or not).
*/
enum {
M_REG_NS = 0,
M_REG_S = 1,
M_REG_NUM_BANKS = 2,
};
/* ARM-specific interrupt pending bits. */
#define CPU_INTERRUPT_FIQ CPU_INTERRUPT_TGT_EXT_1
#define CPU_INTERRUPT_VIRQ CPU_INTERRUPT_TGT_EXT_2
#define CPU_INTERRUPT_VFIQ CPU_INTERRUPT_TGT_EXT_3
#define CPU_INTERRUPT_VSERR CPU_INTERRUPT_TGT_INT_0
/* The usual mapping for an AArch64 system register to its AArch32
* counterpart is for the 32 bit world to have access to the lower
* half only (with writes leaving the upper half untouched). It's
* therefore useful to be able to pass TCG the offset of the least
* significant half of a uint64_t struct member.
*/
#if HOST_BIG_ENDIAN
#define offsetoflow32(S, M) (offsetof(S, M) + sizeof(uint32_t))
#define offsetofhigh32(S, M) offsetof(S, M)
#else
#define offsetoflow32(S, M) offsetof(S, M)
#define offsetofhigh32(S, M) (offsetof(S, M) + sizeof(uint32_t))
#endif
/* Meanings of the ARMCPU object's four inbound GPIO lines */
#define ARM_CPU_IRQ 0
#define ARM_CPU_FIQ 1
#define ARM_CPU_VIRQ 2
#define ARM_CPU_VFIQ 3
/* ARM-specific extra insn start words:
* 1: Conditional execution bits
* 2: Partial exception syndrome for data aborts
*/
#define TARGET_INSN_START_EXTRA_WORDS 2
/* The 2nd extra word holding syndrome info for data aborts does not use
* the upper 6 bits nor the lower 14 bits. We mask and shift it down to
* help the sleb128 encoder do a better job.
* When restoring the CPU state, we shift it back up.
*/
#define ARM_INSN_START_WORD2_MASK ((1 << 26) - 1)
#define ARM_INSN_START_WORD2_SHIFT 14
/* We currently assume float and double are IEEE single and double
precision respectively.
Doing runtime conversions is tricky because VFP registers may contain
integer values (eg. as the result of a FTOSI instruction).
s<2n> maps to the least significant half of d<n>
s<2n+1> maps to the most significant half of d<n>
*/
/**
* DynamicGDBXMLInfo:
* @desc: Contains the XML descriptions.
* @num: Number of the registers in this XML seen by GDB.
* @data: A union with data specific to the set of registers
* @cpregs_keys: Array that contains the corresponding Key of
* a given cpreg with the same order of the cpreg
* in the XML description.
*/
typedef struct DynamicGDBXMLInfo {
char *desc;
int num;
union {
struct {
uint32_t *keys;
} cpregs;
} data;
} DynamicGDBXMLInfo;
/* CPU state for each instance of a generic timer (in cp15 c14) */
typedef struct ARMGenericTimer {
uint64_t cval; /* Timer CompareValue register */
uint64_t ctl; /* Timer Control register */
} ARMGenericTimer;
#define GTIMER_PHYS 0
#define GTIMER_VIRT 1
#define GTIMER_HYP 2
#define GTIMER_SEC 3
#define GTIMER_HYPVIRT 4
#define NUM_GTIMERS 5
typedef struct {
uint64_t raw_tcr;
uint32_t mask;
uint32_t base_mask;
} TCR;
#define VTCR_NSW (1u << 29)
#define VTCR_NSA (1u << 30)
#define VSTCR_SW VTCR_NSW
#define VSTCR_SA VTCR_NSA
/* Define a maximum sized vector register.
* For 32-bit, this is a 128-bit NEON/AdvSIMD register.
* For 64-bit, this is a 2048-bit SVE register.
*
* Note that the mapping between S, D, and Q views of the register bank
* differs between AArch64 and AArch32.
* In AArch32:
* Qn = regs[n].d[1]:regs[n].d[0]
* Dn = regs[n / 2].d[n & 1]
* Sn = regs[n / 4].d[n % 4 / 2],
* bits 31..0 for even n, and bits 63..32 for odd n
* (and regs[16] to regs[31] are inaccessible)
* In AArch64:
* Zn = regs[n].d[*]
* Qn = regs[n].d[1]:regs[n].d[0]
* Dn = regs[n].d[0]
* Sn = regs[n].d[0] bits 31..0
* Hn = regs[n].d[0] bits 15..0
*
* This corresponds to the architecturally defined mapping between
* the two execution states, and means we do not need to explicitly
* map these registers when changing states.
*
* Align the data for use with TCG host vector operations.
*/
#ifdef TARGET_AARCH64
# define ARM_MAX_VQ 16
void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
#else
# define ARM_MAX_VQ 1
static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
static inline void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) { }
static inline void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp) { }
#endif
typedef struct ARMVectorReg {
uint64_t d[2 * ARM_MAX_VQ] QEMU_ALIGNED(16);
} ARMVectorReg;
#ifdef TARGET_AARCH64
/* In AArch32 mode, predicate registers do not exist at all. */
typedef struct ARMPredicateReg {
uint64_t p[DIV_ROUND_UP(2 * ARM_MAX_VQ, 8)] QEMU_ALIGNED(16);
} ARMPredicateReg;
/* In AArch32 mode, PAC keys do not exist at all. */
typedef struct ARMPACKey {
uint64_t lo, hi;
} ARMPACKey;
#endif
/* See the commentary above the TBFLAG field definitions. */
typedef struct CPUARMTBFlags {
uint32_t flags;
target_ulong flags2;
} CPUARMTBFlags;
typedef struct CPUArchState {
/* Regs for current mode. */
uint32_t regs[16];
/* 32/64 switch only happens when taking and returning from
* exceptions so the overlap semantics are taken care of then
* instead of having a complicated union.
*/
/* Regs for A64 mode. */
uint64_t xregs[32];
uint64_t pc;
/* PSTATE isn't an architectural register for ARMv8. However, it is
* convenient for us to assemble the underlying state into a 32 bit format
* identical to the architectural format used for the SPSR. (This is also
* what the Linux kernel's 'pstate' field in signal handlers and KVM's
* 'pstate' register are.) Of the PSTATE bits:
* NZCV are kept in the split out env->CF/VF/NF/ZF, (which have the same
* semantics as for AArch32, as described in the comments on each field)
* nRW (also known as M[4]) is kept, inverted, in env->aarch64
* DAIF (exception masks) are kept in env->daif
* BTYPE is kept in env->btype
* all other bits are stored in their correct places in env->pstate
*/
uint32_t pstate;
bool aarch64; /* True if CPU is in aarch64 state; inverse of PSTATE.nRW */
bool thumb; /* True if CPU is in thumb mode; cpsr[5] */
/* Cached TBFLAGS state. See below for which bits are included. */
CPUARMTBFlags hflags;
/* Frequently accessed CPSR bits are stored separately for efficiency.
This contains all the other bits. Use cpsr_{read,write} to access
the whole CPSR. */
uint32_t uncached_cpsr;
uint32_t spsr;
/* Banked registers. */
uint64_t banked_spsr[8];
uint32_t banked_r13[8];
uint32_t banked_r14[8];
/* These hold r8-r12. */
uint32_t usr_regs[5];
uint32_t fiq_regs[5];
/* cpsr flag cache for faster execution */
uint32_t CF; /* 0 or 1 */
uint32_t VF; /* V is the bit 31. All other bits are undefined */
uint32_t NF; /* N is bit 31. All other bits are undefined. */
uint32_t ZF; /* Z set if zero. */
uint32_t QF; /* 0 or 1 */
uint32_t GE; /* cpsr[19:16] */
uint32_t condexec_bits; /* IT bits. cpsr[15:10,26:25]. */
uint32_t btype; /* BTI branch type. spsr[11:10]. */
uint64_t daif; /* exception masks, in the bits they are in PSTATE */
uint64_t elr_el[4]; /* AArch64 exception link regs */
uint64_t sp_el[4]; /* AArch64 banked stack pointers */
/* System control coprocessor (cp15) */
struct {
uint32_t c0_cpuid;
union { /* Cache size selection */
struct {
uint64_t _unused_csselr0;
uint64_t csselr_ns;
uint64_t _unused_csselr1;
uint64_t csselr_s;
};
uint64_t csselr_el[4];
};
union { /* System control register. */
struct {
uint64_t _unused_sctlr;
uint64_t sctlr_ns;
uint64_t hsctlr;
uint64_t sctlr_s;
};
uint64_t sctlr_el[4];
};
uint64_t cpacr_el1; /* Architectural feature access control register */
uint64_t cptr_el[4]; /* ARMv8 feature trap registers */
uint32_t c1_xscaleauxcr; /* XScale auxiliary control register. */
uint64_t sder; /* Secure debug enable register. */
uint32_t nsacr; /* Non-secure access control register. */
union { /* MMU translation table base 0. */
struct {
uint64_t _unused_ttbr0_0;
uint64_t ttbr0_ns;
uint64_t _unused_ttbr0_1;
uint64_t ttbr0_s;
};
uint64_t ttbr0_el[4];
};
union { /* MMU translation table base 1. */
struct {
uint64_t _unused_ttbr1_0;
uint64_t ttbr1_ns;
uint64_t _unused_ttbr1_1;
uint64_t ttbr1_s;
};
uint64_t ttbr1_el[4];
};
uint64_t vttbr_el2; /* Virtualization Translation Table Base. */
uint64_t vsttbr_el2; /* Secure Virtualization Translation Table. */
/* MMU translation table base control. */
TCR tcr_el[4];
TCR vtcr_el2; /* Virtualization Translation Control. */
TCR vstcr_el2; /* Secure Virtualization Translation Control. */
uint32_t c2_data; /* MPU data cacheable bits. */
uint32_t c2_insn; /* MPU instruction cacheable bits. */
union { /* MMU domain access control register
* MPU write buffer control.
*/
struct {
uint64_t dacr_ns;
uint64_t dacr_s;
};
struct {
uint64_t dacr32_el2;
};
};
uint32_t pmsav5_data_ap; /* PMSAv5 MPU data access permissions */
uint32_t pmsav5_insn_ap; /* PMSAv5 MPU insn access permissions */
uint64_t hcr_el2; /* Hypervisor configuration register */
uint64_t scr_el3; /* Secure configuration register. */
union { /* Fault status registers. */
struct {
uint64_t ifsr_ns;
uint64_t ifsr_s;
};
struct {
uint64_t ifsr32_el2;
};
};
union {
struct {
uint64_t _unused_dfsr;
uint64_t dfsr_ns;
uint64_t hsr;
uint64_t dfsr_s;
};
uint64_t esr_el[4];
};
uint32_t c6_region[8]; /* MPU base/size registers. */
union { /* Fault address registers. */
struct {
uint64_t _unused_far0;
#if HOST_BIG_ENDIAN
uint32_t ifar_ns;
uint32_t dfar_ns;
uint32_t ifar_s;
uint32_t dfar_s;
#else
uint32_t dfar_ns;
uint32_t ifar_ns;
uint32_t dfar_s;
uint32_t ifar_s;
#endif
uint64_t _unused_far3;
};
uint64_t far_el[4];
};
uint64_t hpfar_el2;
uint64_t hstr_el2;
union { /* Translation result. */
struct {
uint64_t _unused_par_0;
uint64_t par_ns;
uint64_t _unused_par_1;
uint64_t par_s;
};
uint64_t par_el[4];
};
uint32_t c9_insn; /* Cache lockdown registers. */
uint32_t c9_data;
uint64_t c9_pmcr; /* performance monitor control register */
uint64_t c9_pmcnten; /* perf monitor counter enables */
uint64_t c9_pmovsr; /* perf monitor overflow status */
uint64_t c9_pmuserenr; /* perf monitor user enable */
uint64_t c9_pmselr; /* perf monitor counter selection register */
uint64_t c9_pminten; /* perf monitor interrupt enables */
union { /* Memory attribute redirection */
struct {
#if HOST_BIG_ENDIAN
uint64_t _unused_mair_0;
uint32_t mair1_ns;
uint32_t mair0_ns;
uint64_t _unused_mair_1;
uint32_t mair1_s;
uint32_t mair0_s;
#else
uint64_t _unused_mair_0;
uint32_t mair0_ns;
uint32_t mair1_ns;
uint64_t _unused_mair_1;
uint32_t mair0_s;
uint32_t mair1_s;
#endif
};
uint64_t mair_el[4];
};
union { /* vector base address register */
struct {
uint64_t _unused_vbar;
uint64_t vbar_ns;
uint64_t hvbar;
uint64_t vbar_s;
};
uint64_t vbar_el[4];
};
uint32_t mvbar; /* (monitor) vector base address register */
uint64_t rvbar; /* rvbar sampled from rvbar property at reset */
struct { /* FCSE PID. */
uint32_t fcseidr_ns;
uint32_t fcseidr_s;
};
union { /* Context ID. */
struct {
uint64_t _unused_contextidr_0;
uint64_t contextidr_ns;
uint64_t _unused_contextidr_1;
uint64_t contextidr_s;
};
uint64_t contextidr_el[4];
};
union { /* User RW Thread register. */
struct {
uint64_t tpidrurw_ns;
uint64_t tpidrprw_ns;
uint64_t htpidr;
uint64_t _tpidr_el3;
};
uint64_t tpidr_el[4];
};
/* The secure banks of these registers don't map anywhere */
uint64_t tpidrurw_s;
uint64_t tpidrprw_s;
uint64_t tpidruro_s;
union { /* User RO Thread register. */
uint64_t tpidruro_ns;
uint64_t tpidrro_el[1];
};
uint64_t c14_cntfrq; /* Counter Frequency register */
uint64_t c14_cntkctl; /* Timer Control register */
uint32_t cnthctl_el2; /* Counter/Timer Hyp Control register */
uint64_t cntvoff_el2; /* Counter Virtual Offset register */
ARMGenericTimer c14_timer[NUM_GTIMERS];
uint32_t c15_cpar; /* XScale Coprocessor Access Register */
uint32_t c15_ticonfig; /* TI925T configuration byte. */
uint32_t c15_i_max; /* Maximum D-cache dirty line index. */
uint32_t c15_i_min; /* Minimum D-cache dirty line index. */
uint32_t c15_threadid; /* TI debugger thread-ID. */
uint32_t c15_config_base_address; /* SCU base address. */
uint32_t c15_diagnostic; /* diagnostic register */
uint32_t c15_power_diagnostic;
uint32_t c15_power_control; /* power control */
uint64_t dbgbvr[16]; /* breakpoint value registers */
uint64_t dbgbcr[16]; /* breakpoint control registers */
uint64_t dbgwvr[16]; /* watchpoint value registers */
uint64_t dbgwcr[16]; /* watchpoint control registers */
uint64_t mdscr_el1;
uint64_t oslsr_el1; /* OS Lock Status */
uint64_t mdcr_el2;
uint64_t mdcr_el3;
/* Stores the architectural value of the counter *the last time it was
* updated* by pmccntr_op_start. Accesses should always be surrounded
* by pmccntr_op_start/pmccntr_op_finish to guarantee the latest
* architecturally-correct value is being read/set.
*/
uint64_t c15_ccnt;
/* Stores the delta between the architectural value and the underlying
* cycle count during normal operation. It is used to update c15_ccnt
* to be the correct architectural value before accesses. During
* accesses, c15_ccnt_delta contains the underlying count being used
* for the access, after which it reverts to the delta value in
* pmccntr_op_finish.
*/
uint64_t c15_ccnt_delta;
uint64_t c14_pmevcntr[31];
uint64_t c14_pmevcntr_delta[31];
uint64_t c14_pmevtyper[31];
uint64_t pmccfiltr_el0; /* Performance Monitor Filter Register */
uint64_t vpidr_el2; /* Virtualization Processor ID Register */
uint64_t vmpidr_el2; /* Virtualization Multiprocessor ID Register */
uint64_t tfsr_el[4]; /* tfsre0_el1 is index 0. */
uint64_t gcr_el1;
uint64_t rgsr_el1;
/* Minimal RAS registers */
uint64_t disr_el1;
uint64_t vdisr_el2;
uint64_t vsesr_el2;
} cp15;
struct {
/* M profile has up to 4 stack pointers:
* a Main Stack Pointer and a Process Stack Pointer for each
* of the Secure and Non-Secure states. (If the CPU doesn't support
* the security extension then it has only two SPs.)
* In QEMU we always store the currently active SP in regs[13],
* and the non-active SP for the current security state in
* v7m.other_sp. The stack pointers for the inactive security state
* are stored in other_ss_msp and other_ss_psp.
* switch_v7m_security_state() is responsible for rearranging them
* when we change security state.
*/
uint32_t other_sp;
uint32_t other_ss_msp;
uint32_t other_ss_psp;
uint32_t vecbase[M_REG_NUM_BANKS];
uint32_t basepri[M_REG_NUM_BANKS];
uint32_t control[M_REG_NUM_BANKS];
uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
uint32_t hfsr; /* HardFault Status */
uint32_t dfsr; /* Debug Fault Status Register */
uint32_t sfsr; /* Secure Fault Status Register */
uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
uint32_t bfar; /* BusFault Address */
uint32_t sfar; /* Secure Fault Address Register */
unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
int exception;
uint32_t primask[M_REG_NUM_BANKS];
uint32_t faultmask[M_REG_NUM_BANKS];
uint32_t aircr; /* only holds r/w state if security extn implemented */
uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
uint32_t csselr[M_REG_NUM_BANKS];
uint32_t scr[M_REG_NUM_BANKS];
uint32_t msplim[M_REG_NUM_BANKS];
uint32_t psplim[M_REG_NUM_BANKS];
uint32_t fpcar[M_REG_NUM_BANKS];
uint32_t fpccr[M_REG_NUM_BANKS];
uint32_t fpdscr[M_REG_NUM_BANKS];
uint32_t cpacr[M_REG_NUM_BANKS];
uint32_t nsacr;
uint32_t ltpsize;
uint32_t vpr;
} v7m;
/* Information associated with an exception about to be taken:
* code which raises an exception must set cs->exception_index and
* the relevant parts of this structure; the cpu_do_interrupt function
* will then set the guest-visible registers as part of the exception
* entry process.
*/
struct {
uint32_t syndrome; /* AArch64 format syndrome register */
uint32_t fsr; /* AArch32 format fault status register info */
uint64_t vaddress; /* virtual addr associated with exception, if any */
uint32_t target_el; /* EL the exception should be targeted for */
/* If we implement EL2 we will also need to store information
* about the intermediate physical address for stage 2 faults.
*/
} exception;
/* Information associated with an SError */
struct {
uint8_t pending;
uint8_t has_esr;
uint64_t esr;
} serror;
uint8_t ext_dabt_raised; /* Tracking/verifying injection of ext DABT */
/* State of our input IRQ/FIQ/VIRQ/VFIQ lines */
uint32_t irq_line_state;
/* Thumb-2 EE state. */
uint32_t teecr;
uint32_t teehbr;
/* VFP coprocessor state. */
struct {
ARMVectorReg zregs[32];
#ifdef TARGET_AARCH64
/* Store FFR as pregs[16] to make it easier to treat as any other. */
#define FFR_PRED_NUM 16
ARMPredicateReg pregs[17];
/* Scratch space for aa64 sve predicate temporary. */
ARMPredicateReg preg_tmp;
#endif
/* We store these fpcsr fields separately for convenience. */
uint32_t qc[4] QEMU_ALIGNED(16);
int vec_len;
int vec_stride;
uint32_t xregs[16];
/* Scratch space for aa32 neon expansion. */
uint32_t scratch[8];
/* There are a number of distinct float control structures:
*
* fp_status: is the "normal" fp status.
* fp_status_fp16: used for half-precision calculations
* standard_fp_status : the ARM "Standard FPSCR Value"
* standard_fp_status_fp16 : used for half-precision
* calculations with the ARM "Standard FPSCR Value"
*
* Half-precision operations are governed by a separate
* flush-to-zero control bit in FPSCR:FZ16. We pass a separate
* status structure to control this.
*
* The "Standard FPSCR", ie default-NaN, flush-to-zero,
* round-to-nearest and is used by any operations (generally
* Neon) which the architecture defines as controlled by the
* standard FPSCR value rather than the FPSCR.
*
* The "standard FPSCR but for fp16 ops" is needed because
* the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
* using a fixed value for it.
*
* To avoid having to transfer exception bits around, we simply
* say that the FPSCR cumulative exception flags are the logical
* OR of the flags in the four fp statuses. This relies on the
* only thing which needs to read the exception flags being
* an explicit FPSCR read.
*/
float_status fp_status;
float_status fp_status_f16;
float_status standard_fp_status;
float_status standard_fp_status_f16;
/* ZCR_EL[1-3] */
uint64_t zcr_el[4];
} vfp;
uint64_t exclusive_addr;
uint64_t exclusive_val;
uint64_t exclusive_high;
/* iwMMXt coprocessor state. */
struct {
uint64_t regs[16];
uint64_t val;
uint32_t cregs[16];
} iwmmxt;
#ifdef TARGET_AARCH64
struct {
ARMPACKey apia;
ARMPACKey apib;
ARMPACKey apda;
ARMPACKey apdb;
ARMPACKey apga;
} keys;
uint64_t scxtnum_el[4];
#endif
#if defined(CONFIG_USER_ONLY)
/* For usermode syscall translation. */
int eabi;
#endif
struct CPUBreakpoint *cpu_breakpoint[16];
struct CPUWatchpoint *cpu_watchpoint[16];
/* Fields up to this point are cleared by a CPU reset */
struct {} end_reset_fields;
/* Fields after this point are preserved across CPU reset. */
/* Internal CPU feature flags. */
uint64_t features;
/* PMSAv7 MPU */
struct {
uint32_t *drbar;
uint32_t *drsr;
uint32_t *dracr;
uint32_t rnr[M_REG_NUM_BANKS];
} pmsav7;
/* PMSAv8 MPU */
struct {
/* The PMSAv8 implementation also shares some PMSAv7 config
* and state:
* pmsav7.rnr (region number register)
* pmsav7_dregion (number of configured regions)
*/
uint32_t *rbar[M_REG_NUM_BANKS];
uint32_t *rlar[M_REG_NUM_BANKS];
uint32_t mair0[M_REG_NUM_BANKS];
uint32_t mair1[M_REG_NUM_BANKS];
} pmsav8;
/* v8M SAU */
struct {
uint32_t *rbar;
uint32_t *rlar;
uint32_t rnr;
uint32_t ctrl;
} sau;
void *nvic;
const struct arm_boot_info *boot_info;
/* Store GICv3CPUState to access from this struct */
void *gicv3state;
#ifdef TARGET_TAGGED_ADDRESSES
/* Linux syscall tagged address support */
bool tagged_addr_enable;
#endif
} CPUARMState;
static inline void set_feature(CPUARMState *env, int feature)
{
env->features |= 1ULL << feature;
}
static inline void unset_feature(CPUARMState *env, int feature)
{
env->features &= ~(1ULL << feature);
}
/**
* ARMELChangeHookFn:
* type of a function which can be registered via arm_register_el_change_hook()
* to get callbacks when the CPU changes its exception level or mode.
*/
typedef void ARMELChangeHookFn(ARMCPU *cpu, void *opaque);
typedef struct ARMELChangeHook ARMELChangeHook;
struct ARMELChangeHook {
ARMELChangeHookFn *hook;
void *opaque;
QLIST_ENTRY(ARMELChangeHook) node;
};
/* These values map onto the return values for
* QEMU_PSCI_0_2_FN_AFFINITY_INFO */
typedef enum ARMPSCIState {
PSCI_ON = 0,
PSCI_OFF = 1,
PSCI_ON_PENDING = 2
} ARMPSCIState;
typedef struct ARMISARegisters ARMISARegisters;
/**
* ARMCPU:
* @env: #CPUARMState
*
* An ARM CPU core.
*/
struct ArchCPU {
/*< private >*/
CPUState parent_obj;
/*< public >*/
CPUNegativeOffsetState neg;
CPUARMState env;
/* Coprocessor information */
GHashTable *cp_regs;
/* For marshalling (mostly coprocessor) register state between the
* kernel and QEMU (for KVM) and between two QEMUs (for migration),
* we use these arrays.
*/
/* List of register indexes managed via these arrays; (full KVM style
* 64 bit indexes, not CPRegInfo 32 bit indexes)
*/
uint64_t *cpreg_indexes;
/* Values of the registers (cpreg_indexes[i]'s value is cpreg_values[i]) */
uint64_t *cpreg_values;
/* Length of the indexes, values, reset_values arrays */
int32_t cpreg_array_len;
/* These are used only for migration: incoming data arrives in
* these fields and is sanity checked in post_load before copying
* to the working data structures above.
*/
uint64_t *cpreg_vmstate_indexes;
uint64_t *cpreg_vmstate_values;
int32_t cpreg_vmstate_array_len;
DynamicGDBXMLInfo dyn_sysreg_xml;
DynamicGDBXMLInfo dyn_svereg_xml;
/* Timers used by the generic (architected) timer */
QEMUTimer *gt_timer[NUM_GTIMERS];
/*
* Timer used by the PMU. Its state is restored after migration by
* pmu_op_finish() - it does not need other handling during migration
*/
QEMUTimer *pmu_timer;
/* GPIO outputs for generic timer */
qemu_irq gt_timer_outputs[NUM_GTIMERS];
/* GPIO output for GICv3 maintenance interrupt signal */
qemu_irq gicv3_maintenance_interrupt;
/* GPIO output for the PMU interrupt */
qemu_irq pmu_interrupt;
/* MemoryRegion to use for secure physical accesses */
MemoryRegion *secure_memory;
/* MemoryRegion to use for allocation tag accesses */
MemoryRegion *tag_memory;
MemoryRegion *secure_tag_memory;
/* For v8M, pointer to the IDAU interface provided by board/SoC */
Object *idau;
/* 'compatible' string for this CPU for Linux device trees */
const char *dtb_compatible;
/* PSCI version for this CPU
* Bits[31:16] = Major Version
* Bits[15:0] = Minor Version
*/
uint32_t psci_version;
/* Current power state, access guarded by BQL */
ARMPSCIState power_state;
/* CPU has virtualization extension */
bool has_el2;
/* CPU has security extension */
bool has_el3;
/* CPU has PMU (Performance Monitor Unit) */
bool has_pmu;
/* CPU has VFP */
bool has_vfp;
/* CPU has Neon */
bool has_neon;
/* CPU has M-profile DSP extension */
bool has_dsp;
/* CPU has memory protection unit */
bool has_mpu;
/* PMSAv7 MPU number of supported regions */
uint32_t pmsav7_dregion;
/* v8M SAU number of supported regions */
uint32_t sau_sregion;
/* PSCI conduit used to invoke PSCI methods
* 0 - disabled, 1 - smc, 2 - hvc
*/
uint32_t psci_conduit;
/* For v8M, initial value of the Secure VTOR */
uint32_t init_svtor;
/* For v8M, initial value of the Non-secure VTOR */
uint32_t init_nsvtor;
/* [QEMU_]KVM_ARM_TARGET_* constant for this CPU, or
* QEMU_KVM_ARM_TARGET_NONE if the kernel doesn't support this CPU type.
*/
uint32_t kvm_target;
/* KVM init features for this CPU */
uint32_t kvm_init_features[7];
/* KVM CPU state */
/* KVM virtual time adjustment */
bool kvm_adjvtime;
bool kvm_vtime_dirty;
uint64_t kvm_vtime;
/* KVM steal time */
OnOffAuto kvm_steal_time;
/* Uniprocessor system with MP extensions */
bool mp_is_up;
/* True if we tried kvm_arm_host_cpu_features() during CPU instance_init
* and the probe failed (so we need to report the error in realize)
*/
bool host_cpu_probe_failed;
/* Specify the number of cores in this CPU cluster. Used for the L2CTLR
* register.
*/
int32_t core_count;
/* The instance init functions for implementation-specific subclasses
* set these fields to specify the implementation-dependent values of
* various constant registers and reset values of non-constant
* registers.
* Some of these might become QOM properties eventually.
* Field names match the official register names as defined in the
* ARMv7AR ARM Architecture Reference Manual. A reset_ prefix
* is used for reset values of non-constant registers; no reset_
* prefix means a constant register.
* Some of these registers are split out into a substructure that
* is shared with the translators to control the ISA.
*
* Note that if you add an ID register to the ARMISARegisters struct
* you need to also update the 32-bit and 64-bit versions of the
* kvm_arm_get_host_cpu_features() function to correctly populate the
* field by reading the value from the KVM vCPU.
*/
struct ARMISARegisters {
uint32_t id_isar0;
uint32_t id_isar1;
uint32_t id_isar2;
uint32_t id_isar3;
uint32_t id_isar4;
uint32_t id_isar5;
uint32_t id_isar6;
uint32_t id_mmfr0;
uint32_t id_mmfr1;
uint32_t id_mmfr2;
uint32_t id_mmfr3;
uint32_t id_mmfr4;
uint32_t id_pfr0;
uint32_t id_pfr1;
uint32_t id_pfr2;
uint32_t mvfr0;
uint32_t mvfr1;
uint32_t mvfr2;
uint32_t id_dfr0;
uint32_t dbgdidr;
uint64_t id_aa64isar0;
uint64_t id_aa64isar1;
uint64_t id_aa64pfr0;
uint64_t id_aa64pfr1;
uint64_t id_aa64mmfr0;
uint64_t id_aa64mmfr1;
uint64_t id_aa64mmfr2;
uint64_t id_aa64dfr0;
uint64_t id_aa64dfr1;
uint64_t id_aa64zfr0;
} isar;
uint64_t midr;
uint32_t revidr;
uint32_t reset_fpsid;
uint64_t ctr;
uint32_t reset_sctlr;
uint64_t pmceid0;
uint64_t pmceid1;
uint32_t id_afr0;
uint64_t id_aa64afr0;
uint64_t id_aa64afr1;
uint64_t clidr;
uint64_t mp_affinity; /* MP ID without feature bits */
/* The elements of this array are the CCSIDR values for each cache,
* in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
*/
uint64_t ccsidr[16];
uint64_t reset_cbar;
uint32_t reset_auxcr;
bool reset_hivecs;
/*
* Intermediate values used during property parsing.
* Once finalized, the values should be read from ID_AA64*.
*/
bool prop_pauth;
bool prop_pauth_impdef;
bool prop_lpa2;
/* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
uint32_t dcz_blocksize;
uint64_t rvbar_prop; /* Property/input signals. */