Archipelago » qemu

#include "cpu.h"

#include "exec/gdbstub.h"

#include "helper.h"

#include "qemu/host-utils.h"

#include "sysemu/arch_init.h"

#include "sysemu/sysemu.h"

#include "qemu/bitops.h"

#ifndef CONFIG_USER_ONLY

static inline int get_phys_addr(CPUARMState *env, uint32_t address,

                                int access_type, int is_user,

                                hwaddr *phys_ptr, int *prot,

                                target_ulong *page_size);

#endif

static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)

{

    int nregs;

    /* VFP data registers are always little-endian.  */

    nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;

    if (reg < nregs) {

        stfq_le_p(buf, env->vfp.regs[reg]);

        return 8;

    }

    if (arm_feature(env, ARM_FEATURE_NEON)) {

        /* Aliases for Q regs.  */

        nregs += 16;

        if (reg < nregs) {

            stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);

            stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);

            return 16;

        }

    }

    switch (reg - nregs) {

    case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;

    case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;

    case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;

    }

    return 0;

}

static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)

{

    int nregs;

    nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;

    if (reg < nregs) {

        env->vfp.regs[reg] = ldfq_le_p(buf);

        return 8;

    }

    if (arm_feature(env, ARM_FEATURE_NEON)) {

        nregs += 16;

        if (reg < nregs) {

            env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);

            env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);

            return 16;

        }

    }

    switch (reg - nregs) {

    case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;

    case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;

    case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;

    }

    return 0;

}

static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)

{

    switch (reg) {

    case 0 ... 31:

        /* 128 bit FP register */

        stfq_le_p(buf, env->vfp.regs[reg * 2]);

        stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);

        return 16;

    case 32:

        /* FPSR */

        stl_p(buf, vfp_get_fpsr(env));

        return 4;

    case 33:

        /* FPCR */

        stl_p(buf, vfp_get_fpcr(env));

        return 4;

    default:

        return 0;

    }

}

static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)

{

    switch (reg) {

    case 0 ... 31:

        /* 128 bit FP register */

        env->vfp.regs[reg * 2] = ldfq_le_p(buf);

        env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);

        return 16;

    case 32:

        /* FPSR */

        vfp_set_fpsr(env, ldl_p(buf));

        return 4;

    case 33:

        /* FPCR */

        vfp_set_fpcr(env, ldl_p(buf));

        return 4;

    default:

        return 0;

    }

}

static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

    if (cpreg_field_is_64bit(ri)) {

        return CPREG_FIELD64(env, ri);

    } else {

        return CPREG_FIELD32(env, ri);

    }

}

static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,

                      uint64_t value)

{

    if (cpreg_field_is_64bit(ri)) {

        CPREG_FIELD64(env, ri) = value;

    } else {

        CPREG_FIELD32(env, ri) = value;

    }

}

static uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)

{

    /* Raw read of a coprocessor register (as needed for migration, etc). */

    if (ri->type & ARM_CP_CONST) {

        return ri->resetvalue;

    } else if (ri->raw_readfn) {

        return ri->raw_readfn(env, ri);

    } else if (ri->readfn) {

        return ri->readfn(env, ri);

    } else {

        return raw_read(env, ri);

    }

}

static void write_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri,

                             uint64_t v)

{

    /* Raw write of a coprocessor register (as needed for migration, etc).

     * Note that constant registers are treated as write-ignored; the

     * caller should check for success by whether a readback gives the

     * value written.

     */

    if (ri->type & ARM_CP_CONST) {

        return;

    } else if (ri->raw_writefn) {

        ri->raw_writefn(env, ri, v);

    } else if (ri->writefn) {

        ri->writefn(env, ri, v);

    } else {

        raw_write(env, ri, v);

    }

}

bool write_cpustate_to_list(ARMCPU *cpu)

{

    /* Write the coprocessor state from cpu->env to the (index,value) list. */

    int i;

    bool ok = true;

    for (i = 0; i < cpu->cpreg_array_len; i++) {

        uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);

        const ARMCPRegInfo *ri;

        ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);

        if (!ri) {

            ok = false;

            continue;

        }

        if (ri->type & ARM_CP_NO_MIGRATE) {

            continue;

        }

        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);

    }

    return ok;

}

bool write_list_to_cpustate(ARMCPU *cpu)

{

    int i;

    bool ok = true;

    for (i = 0; i < cpu->cpreg_array_len; i++) {

        uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);

        uint64_t v = cpu->cpreg_values[i];

        const ARMCPRegInfo *ri;

        ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);

        if (!ri) {

            ok = false;

            continue;

        }

        if (ri->type & ARM_CP_NO_MIGRATE) {

            continue;

        }

        /* Write value and confirm it reads back as written

         * (to catch read-only registers and partially read-only

         * registers where the incoming migration value doesn't match)

         */

        write_raw_cp_reg(&cpu->env, ri, v);

        if (read_raw_cp_reg(&cpu->env, ri) != v) {

            ok = false;

        }

    }

    return ok;

}

static void add_cpreg_to_list(gpointer key, gpointer opaque)

{

    ARMCPU *cpu = opaque;

    uint64_t regidx;

    const ARMCPRegInfo *ri;

    regidx = *(uint32_t *)key;

    ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);

    if (!(ri->type & ARM_CP_NO_MIGRATE)) {

        cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);

        /* The value array need not be initialized at this point */

        cpu->cpreg_array_len++;

    }

}

static void count_cpreg(gpointer key, gpointer opaque)

{

    ARMCPU *cpu = opaque;

    uint64_t regidx;

    const ARMCPRegInfo *ri;

    regidx = *(uint32_t *)key;

    ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);

    if (!(ri->type & ARM_CP_NO_MIGRATE)) {

        cpu->cpreg_array_len++;

    }

}

static gint cpreg_key_compare(gconstpointer a, gconstpointer b)

{

    uint64_t aidx = cpreg_to_kvm_id(*(uint32_t *)a);

    uint64_t bidx = cpreg_to_kvm_id(*(uint32_t *)b);

    if (aidx > bidx) {

        return 1;

    }

    if (aidx < bidx) {

        return -1;

    }

    return 0;

}

static void cpreg_make_keylist(gpointer key, gpointer value, gpointer udata)

{

    GList **plist = udata;

    *plist = g_list_prepend(*plist, key);

}

void init_cpreg_list(ARMCPU *cpu)

{

    /* Initialise the cpreg_tuples[] array based on the cp_regs hash.

     * Note that we require cpreg_tuples[] to be sorted by key ID.

     */

    GList *keys = NULL;

    int arraylen;

    g_hash_table_foreach(cpu->cp_regs, cpreg_make_keylist, &keys);

    keys = g_list_sort(keys, cpreg_key_compare);

    cpu->cpreg_array_len = 0;

    g_list_foreach(keys, count_cpreg, cpu);

    arraylen = cpu->cpreg_array_len;

    cpu->cpreg_indexes = g_new(uint64_t, arraylen);

    cpu->cpreg_values = g_new(uint64_t, arraylen);

    cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);

    cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);

    cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;

    cpu->cpreg_array_len = 0;

    g_list_foreach(keys, add_cpreg_to_list, cpu);

    assert(cpu->cpreg_array_len == arraylen);

    g_list_free(keys);

}

static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

{

    env->cp15.c3 = value;

    tlb_flush(env, 1); /* Flush TLB as domain not tracked in TLB */

}

static void fcse_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

{

    if (env->cp15.c13_fcse != value) {

        /* Unlike real hardware the qemu TLB uses virtual addresses,

         * not modified virtual addresses, so this causes a TLB flush.

         */

        tlb_flush(env, 1);

        env->cp15.c13_fcse = value;

    }

}

static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                             uint64_t value)

{

    if (env->cp15.c13_context != value && !arm_feature(env, ARM_FEATURE_MPU)) {

        /* For VMSA (when not using the LPAE long descriptor page table

         * format) this register includes the ASID, so do a TLB flush.

         * For PMSA it is purely a process ID and no action is needed.

         */

        tlb_flush(env, 1);

    }

    env->cp15.c13_context = value;

}

static void tlbiall_write(CPUARMState *env, const ARMCPRegInfo *ri,

                          uint64_t value)

{

    /* Invalidate all (TLBIALL) */

    tlb_flush(env, 1);

}

static void tlbimva_write(CPUARMState *env, const ARMCPRegInfo *ri,

                          uint64_t value)

{

    /* Invalidate single TLB entry by MVA and ASID (TLBIMVA) */

    tlb_flush_page(env, value & TARGET_PAGE_MASK);

}

static void tlbiasid_write(CPUARMState *env, const ARMCPRegInfo *ri,

                           uint64_t value)

{

    /* Invalidate by ASID (TLBIASID) */

    tlb_flush(env, value == 0);

}

static void tlbimvaa_write(CPUARMState *env, const ARMCPRegInfo *ri,

                           uint64_t value)

{

    /* Invalidate single entry by MVA, all ASIDs (TLBIMVAA) */

    tlb_flush_page(env, value & TARGET_PAGE_MASK);

}

static const ARMCPRegInfo cp_reginfo[] = {

    /* DBGDIDR: just RAZ. In particular this means the "debug architecture

     * version" bits will read as a reserved value, which should cause

     * Linux to not try to use the debug hardware.

     */

    { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,

      .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },

    /* MMU Domain access control / MPU write buffer control */

    { .name = "DACR", .cp = 15,

      .crn = 3, .crm = CP_ANY, .opc1 = CP_ANY, .opc2 = CP_ANY,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c3),

      .resetvalue = 0, .writefn = dacr_write, .raw_writefn = raw_write, },

    { .name = "FCSEIDR", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 0,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c13_fcse),

      .resetvalue = 0, .writefn = fcse_write, .raw_writefn = raw_write, },

    { .name = "CONTEXTIDR", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 1,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c13_context),

      .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },

    /* ??? This covers not just the impdef TLB lockdown registers but also

     * some v7VMSA registers relating to TEX remap, so it is overly broad.

     */

    { .name = "TLB_LOCKDOWN", .cp = 15, .crn = 10, .crm = CP_ANY,

      .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_RW, .type = ARM_CP_NOP },

    /* MMU TLB control. Note that the wildcarding means we cover not just

     * the unified TLB ops but also the dside/iside/inner-shareable variants.

     */

    { .name = "TLBIALL", .cp = 15, .crn = 8, .crm = CP_ANY,

      .opc1 = CP_ANY, .opc2 = 0, .access = PL1_W, .writefn = tlbiall_write,

      .type = ARM_CP_NO_MIGRATE },

    { .name = "TLBIMVA", .cp = 15, .crn = 8, .crm = CP_ANY,

      .opc1 = CP_ANY, .opc2 = 1, .access = PL1_W, .writefn = tlbimva_write,

      .type = ARM_CP_NO_MIGRATE },

    { .name = "TLBIASID", .cp = 15, .crn = 8, .crm = CP_ANY,

      .opc1 = CP_ANY, .opc2 = 2, .access = PL1_W, .writefn = tlbiasid_write,

      .type = ARM_CP_NO_MIGRATE },

    { .name = "TLBIMVAA", .cp = 15, .crn = 8, .crm = CP_ANY,

      .opc1 = CP_ANY, .opc2 = 3, .access = PL1_W, .writefn = tlbimvaa_write,

      .type = ARM_CP_NO_MIGRATE },

    /* Cache maintenance ops; some of this space may be overridden later. */

    { .name = "CACHEMAINT", .cp = 15, .crn = 7, .crm = CP_ANY,

      .opc1 = 0, .opc2 = CP_ANY, .access = PL1_W,

      .type = ARM_CP_NOP | ARM_CP_OVERRIDE },

    REGINFO_SENTINEL

};

static const ARMCPRegInfo not_v6_cp_reginfo[] = {

    /* Not all pre-v6 cores implemented this WFI, so this is slightly

     * over-broad.

     */

    { .name = "WFI_v5", .cp = 15, .crn = 7, .crm = 8, .opc1 = 0, .opc2 = 2,

      .access = PL1_W, .type = ARM_CP_WFI },

    REGINFO_SENTINEL

};

static const ARMCPRegInfo not_v7_cp_reginfo[] = {

    /* Standard v6 WFI (also used in some pre-v6 cores); not in v7 (which

     * is UNPREDICTABLE; we choose to NOP as most implementations do).

     */

    { .name = "WFI_v6", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,

      .access = PL1_W, .type = ARM_CP_WFI },

    /* L1 cache lockdown. Not architectural in v6 and earlier but in practice

     * implemented in 926, 946, 1026, 1136, 1176 and 11MPCore. StrongARM and

     * OMAPCP will override this space.

     */

    { .name = "DLOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 0,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_data),

      .resetvalue = 0 },

    { .name = "ILOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 0, .opc2 = 1,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_insn),

      .resetvalue = 0 },

    /* v6 doesn't have the cache ID registers but Linux reads them anyway */

    { .name = "DUMMY", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = CP_ANY,

      .access = PL1_R, .type = ARM_CP_CONST | ARM_CP_NO_MIGRATE,

      .resetvalue = 0 },

    REGINFO_SENTINEL

};

static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                        uint64_t value)

{

    if (env->cp15.c1_coproc != value) {

        env->cp15.c1_coproc = value;

        /* ??? Is this safe when called from within a TB?  */

        tb_flush(env);

    }

}

static const ARMCPRegInfo v6_cp_reginfo[] = {

    /* prefetch by MVA in v6, NOP in v7 */

    { .name = "MVA_prefetch",

      .cp = 15, .crn = 7, .crm = 13, .opc1 = 0, .opc2 = 1,

      .access = PL1_W, .type = ARM_CP_NOP },

    { .name = "ISB", .cp = 15, .crn = 7, .crm = 5, .opc1 = 0, .opc2 = 4,

      .access = PL0_W, .type = ARM_CP_NOP },

    { .name = "DSB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 4,

      .access = PL0_W, .type = ARM_CP_NOP },

    { .name = "DMB", .cp = 15, .crn = 7, .crm = 10, .opc1 = 0, .opc2 = 5,

      .access = PL0_W, .type = ARM_CP_NOP },

    { .name = "IFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 2,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c6_insn),

      .resetvalue = 0, },

    /* Watchpoint Fault Address Register : should actually only be present

     * for 1136, 1176, 11MPCore.

     */

    { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,

      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },

    { .name = "CPACR", .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_coproc),

      .resetvalue = 0, .writefn = cpacr_write },

    REGINFO_SENTINEL

};

static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri)

{

    /* Perfomance monitor registers user accessibility is controlled

     * by PMUSERENR.

     */

    if (arm_current_pl(env) == 0 && !env->cp15.c9_pmuserenr) {

        return CP_ACCESS_TRAP;

    }

    return CP_ACCESS_OK;

}

static void pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                       uint64_t value)

{

    /* only the DP, X, D and E bits are writable */

    env->cp15.c9_pmcr &= ~0x39;

    env->cp15.c9_pmcr |= (value & 0x39);

}

static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,

                            uint64_t value)

{

    value &= (1 << 31);

    env->cp15.c9_pmcnten |= value;

}

static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                             uint64_t value)

{

    value &= (1 << 31);

    env->cp15.c9_pmcnten &= ~value;

}

static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                         uint64_t value)

{

    env->cp15.c9_pmovsr &= ~value;

}

static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,

                             uint64_t value)

{

    env->cp15.c9_pmxevtyper = value & 0xff;

}

static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                            uint64_t value)

{

    env->cp15.c9_pmuserenr = value & 1;

}

static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,

                             uint64_t value)

{

    /* We have no event counters so only the C bit can be changed */

    value &= (1 << 31);

    env->cp15.c9_pminten |= value;

}

static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                             uint64_t value)

{

    value &= (1 << 31);

    env->cp15.c9_pminten &= ~value;

}

static void vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,

                       uint64_t value)

{

    /* Note that even though the AArch64 view of this register has bits

     * [10:0] all RES0 we can only mask the bottom 5, to comply with the

     * architectural requirements for bits which are RES0 only in some

     * contexts. (ARMv8 would permit us to do no masking at all, but ARMv7

     * requires the bottom five bits to be RAZ/WI because they're UNK/SBZP.)

     */

    env->cp15.c12_vbar = value & ~0x1Ful;

}

static uint64_t ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

    ARMCPU *cpu = arm_env_get_cpu(env);

    return cpu->ccsidr[env->cp15.c0_cssel];

}

static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                         uint64_t value)

{

    env->cp15.c0_cssel = value & 0xf;

}

static const ARMCPRegInfo v7_cp_reginfo[] = {

    /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped

     * debug components

     */

    { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,

      .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },

    { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,

      .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 },

    /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */

    { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,

      .access = PL1_W, .type = ARM_CP_NOP },

    /* Performance monitors are implementation defined in v7,

     * but with an ARM recommended set of registers, which we

     * follow (although we don't actually implement any counters)

     *

     * Performance registers fall into three categories:

     *  (a) always UNDEF in PL0, RW in PL1 (PMINTENSET, PMINTENCLR)

     *  (b) RO in PL0 (ie UNDEF on write), RW in PL1 (PMUSERENR)

     *  (c) UNDEF in PL0 if PMUSERENR.EN==0, otherwise accessible (all others)

     * For the cases controlled by PMUSERENR we must set .access to PL0_RW

     * or PL0_RO as appropriate and then check PMUSERENR in the helper fn.

     */

    { .name = "PMCNTENSET", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 1,

      .access = PL0_RW, .resetvalue = 0,

      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),

      .writefn = pmcntenset_write,

      .accessfn = pmreg_access,

      .raw_writefn = raw_write },

    { .name = "PMCNTENCLR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 2,

      .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),

      .accessfn = pmreg_access,

      .writefn = pmcntenclr_write,

      .type = ARM_CP_NO_MIGRATE },

    { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,

      .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),

      .accessfn = pmreg_access,

      .writefn = pmovsr_write,

      .raw_writefn = raw_write },

    /* Unimplemented so WI. */

    { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,

      .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },

    /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.

     * We choose to RAZ/WI.

     */

    { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,

      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,

      .accessfn = pmreg_access },

    /* Unimplemented, RAZ/WI. */

    { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,

      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,

      .accessfn = pmreg_access },

    { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,

      .access = PL0_RW,

      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),

      .accessfn = pmreg_access, .writefn = pmxevtyper_write,

      .raw_writefn = raw_write },

    /* Unimplemented, RAZ/WI. */

    { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,

      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,

      .accessfn = pmreg_access },

    { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,

      .access = PL0_R | PL1_RW,

      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),

      .resetvalue = 0,

      .writefn = pmuserenr_write, .raw_writefn = raw_write },

    { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,

      .access = PL1_RW,

      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),

      .resetvalue = 0,

      .writefn = pmintenset_write, .raw_writefn = raw_write },

    { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,

      .access = PL1_RW, .type = ARM_CP_NO_MIGRATE,

      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),

      .resetvalue = 0, .writefn = pmintenclr_write, },

    { .name = "VBAR", .state = ARM_CP_STATE_BOTH,

      .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,

      .access = PL1_RW, .writefn = vbar_write,

      .fieldoffset = offsetof(CPUARMState, cp15.c12_vbar),

      .resetvalue = 0 },

    { .name = "SCR", .cp = 15, .crn = 1, .crm = 1, .opc1 = 0, .opc2 = 0,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c1_scr),

      .resetvalue = 0, },

    { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,

      .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 0,

      .access = PL1_R, .readfn = ccsidr_read, .type = ARM_CP_NO_MIGRATE },

    { .name = "CSSELR", .state = ARM_CP_STATE_BOTH,

      .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 2, .opc2 = 0,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c0_cssel),

      .writefn = csselr_write, .resetvalue = 0 },

    /* Auxiliary ID register: this actually has an IMPDEF value but for now

     * just RAZ for all cores:

     */

    { .name = "AIDR", .cp = 15, .crn = 0, .crm = 0, .opc1 = 1, .opc2 = 7,

      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 },

    /* MAIR can just read-as-written because we don't implement caches

     * and so don't need to care about memory attributes.

     */

    { .name = "MAIR_EL1", .state = ARM_CP_STATE_AA64,

      .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el1),

      .resetvalue = 0 },

    /* For non-long-descriptor page tables these are PRRR and NMRR;

     * regardless they still act as reads-as-written for QEMU.

     * The override is necessary because of the overly-broad TLB_LOCKDOWN

     * definition.

     */

    { .name = "MAIR0", .state = ARM_CP_STATE_AA32, .type = ARM_CP_OVERRIDE,

      .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 0, .access = PL1_RW,

      .fieldoffset = offsetoflow32(CPUARMState, cp15.mair_el1),

      .resetfn = arm_cp_reset_ignore },

    { .name = "MAIR1", .state = ARM_CP_STATE_AA32, .type = ARM_CP_OVERRIDE,

      .cp = 15, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, .access = PL1_RW,

      .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el1),

      .resetfn = arm_cp_reset_ignore },

    REGINFO_SENTINEL

};

static void teecr_write(CPUARMState *env, const ARMCPRegInfo *ri,

                        uint64_t value)

{

    value &= 1;

    env->teecr = value;

}

static CPAccessResult teehbr_access(CPUARMState *env, const ARMCPRegInfo *ri)

{

    if (arm_current_pl(env) == 0 && (env->teecr & 1)) {

        return CP_ACCESS_TRAP;

    }

    return CP_ACCESS_OK;

}

static const ARMCPRegInfo t2ee_cp_reginfo[] = {

    { .name = "TEECR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 6, .opc2 = 0,

      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, teecr),

      .resetvalue = 0,

      .writefn = teecr_write },

    { .name = "TEEHBR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 6, .opc2 = 0,

      .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, teehbr),

      .accessfn = teehbr_access, .resetvalue = 0 },

    REGINFO_SENTINEL

};

static const ARMCPRegInfo v6k_cp_reginfo[] = {

    { .name = "TPIDR_EL0", .state = ARM_CP_STATE_AA64,

      .opc0 = 3, .opc1 = 3, .opc2 = 2, .crn = 13, .crm = 0,

      .access = PL0_RW,

      .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el0), .resetvalue = 0 },

    { .name = "TPIDRURW", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 2,

      .access = PL0_RW,

      .fieldoffset = offsetoflow32(CPUARMState, cp15.tpidr_el0),

      .resetfn = arm_cp_reset_ignore },

    { .name = "TPIDRRO_EL0", .state = ARM_CP_STATE_AA64,

      .opc0 = 3, .opc1 = 3, .opc2 = 3, .crn = 13, .crm = 0,

      .access = PL0_R|PL1_W,

      .fieldoffset = offsetof(CPUARMState, cp15.tpidrro_el0), .resetvalue = 0 },

    { .name = "TPIDRURO", .cp = 15, .crn = 13, .crm = 0, .opc1 = 0, .opc2 = 3,

      .access = PL0_R|PL1_W,

      .fieldoffset = offsetoflow32(CPUARMState, cp15.tpidrro_el0),

      .resetfn = arm_cp_reset_ignore },

    { .name = "TPIDR_EL1", .state = ARM_CP_STATE_BOTH,

      .opc0 = 3, .opc1 = 0, .opc2 = 4, .crn = 13, .crm = 0,

      .access = PL1_RW,

      .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el1), .resetvalue = 0 },

    REGINFO_SENTINEL

};

#ifndef CONFIG_USER_ONLY

static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri)

{

    /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */

    if (arm_current_pl(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) {

        return CP_ACCESS_TRAP;

    }

    return CP_ACCESS_OK;

}

static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx)

{

    /* CNT[PV]CT: not visible from PL0 if ELO[PV]CTEN is zero */

    if (arm_current_pl(env) == 0 &&

        !extract32(env->cp15.c14_cntkctl, timeridx, 1)) {

        return CP_ACCESS_TRAP;

    }

    return CP_ACCESS_OK;

}

static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx)

{

    /* CNT[PV]_CVAL, CNT[PV]_CTL, CNT[PV]_TVAL: not visible from PL0 if

     * EL0[PV]TEN is zero.

     */

    if (arm_current_pl(env) == 0 &&

        !extract32(env->cp15.c14_cntkctl, 9 - timeridx, 1)) {

        return CP_ACCESS_TRAP;

    }

    return CP_ACCESS_OK;

}

static CPAccessResult gt_pct_access(CPUARMState *env,

                                         const ARMCPRegInfo *ri)

{

    return gt_counter_access(env, GTIMER_PHYS);

}

static CPAccessResult gt_vct_access(CPUARMState *env,

                                         const ARMCPRegInfo *ri)

{

    return gt_counter_access(env, GTIMER_VIRT);

}

static CPAccessResult gt_ptimer_access(CPUARMState *env, const ARMCPRegInfo *ri)

{

    return gt_timer_access(env, GTIMER_PHYS);

}

static CPAccessResult gt_vtimer_access(CPUARMState *env, const ARMCPRegInfo *ri)

{

    return gt_timer_access(env, GTIMER_VIRT);

}

static uint64_t gt_get_countervalue(CPUARMState *env)

{

    return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;

}

static void gt_recalc_timer(ARMCPU *cpu, int timeridx)

{

    ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];

    if (gt->ctl & 1) {

        /* Timer enabled: calculate and set current ISTATUS, irq, and

         * reset timer to when ISTATUS next has to change

         */

        uint64_t count = gt_get_countervalue(&cpu->env);

        /* Note that this must be unsigned 64 bit arithmetic: */

        int istatus = count >= gt->cval;

        uint64_t nexttick;

        gt->ctl = deposit32(gt->ctl, 2, 1, istatus);

        qemu_set_irq(cpu->gt_timer_outputs[timeridx],

                     (istatus && !(gt->ctl & 2)));

        if (istatus) {

            /* Next transition is when count rolls back over to zero */

            nexttick = UINT64_MAX;

        } else {

            /* Next transition is when we hit cval */

            nexttick = gt->cval;

        }

        /* Note that the desired next expiry time might be beyond the

         * signed-64-bit range of a QEMUTimer -- in this case we just

         * set the timer for as far in the future as possible. When the

         * timer expires we will reset the timer for any remaining period.

         */

        if (nexttick > INT64_MAX / GTIMER_SCALE) {

            nexttick = INT64_MAX / GTIMER_SCALE;

        }

        timer_mod(cpu->gt_timer[timeridx], nexttick);

    } else {

        /* Timer disabled: ISTATUS and timer output always clear */

        gt->ctl &= ~4;

        qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);

        timer_del(cpu->gt_timer[timeridx]);

    }

}

static void gt_cnt_reset(CPUARMState *env, const ARMCPRegInfo *ri)

{

    ARMCPU *cpu = arm_env_get_cpu(env);

    int timeridx = ri->opc1 & 1;

    timer_del(cpu->gt_timer[timeridx]);

}

static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

    return gt_get_countervalue(env);

}

static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,

                          uint64_t value)

{

    int timeridx = ri->opc1 & 1;

    env->cp15.c14_timer[timeridx].cval = value;

    gt_recalc_timer(arm_env_get_cpu(env), timeridx);

}

static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

    int timeridx = ri->crm & 1;

    return (uint32_t)(env->cp15.c14_timer[timeridx].cval -

                      gt_get_countervalue(env));

}

static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,

                          uint64_t value)

{

    int timeridx = ri->crm & 1;

    env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) +

        + sextract64(value, 0, 32);

    gt_recalc_timer(arm_env_get_cpu(env), timeridx);

}

static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,