Statistics
| Branch: | Revision:

root / target-arm / helper.c @ 6ebbf390

History | View | Annotate | Download (30.2 kB)

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <string.h>
4

    
5
#include "cpu.h"
6
#include "exec-all.h"
7

    
8
static inline void set_feature(CPUARMState *env, int feature)
9
{
10
    env->features |= 1u << feature;
11
}
12

    
13
static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
14
{
15
    env->cp15.c0_cpuid = id;
16
    switch (id) {
17
    case ARM_CPUID_ARM926:
18
        set_feature(env, ARM_FEATURE_VFP);
19
        env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
20
        env->cp15.c0_cachetype = 0x1dd20d2;
21
        env->cp15.c1_sys = 0x00090078;
22
        break;
23
    case ARM_CPUID_ARM946:
24
        set_feature(env, ARM_FEATURE_MPU);
25
        env->cp15.c0_cachetype = 0x0f004006;
26
        env->cp15.c1_sys = 0x00000078;
27
        break;
28
    case ARM_CPUID_ARM1026:
29
        set_feature(env, ARM_FEATURE_VFP);
30
        set_feature(env, ARM_FEATURE_AUXCR);
31
        env->vfp.xregs[ARM_VFP_FPSID] = 0x410110a0;
32
        env->cp15.c0_cachetype = 0x1dd20d2;
33
        env->cp15.c1_sys = 0x00090078;
34
        break;
35
    case ARM_CPUID_TI915T:
36
    case ARM_CPUID_TI925T:
37
        set_feature(env, ARM_FEATURE_OMAPCP);
38
        env->cp15.c0_cpuid = ARM_CPUID_TI925T; /* Depends on wiring.  */
39
        env->cp15.c0_cachetype = 0x5109149;
40
        env->cp15.c1_sys = 0x00000070;
41
        env->cp15.c15_i_max = 0x000;
42
        env->cp15.c15_i_min = 0xff0;
43
        break;
44
    case ARM_CPUID_PXA250:
45
    case ARM_CPUID_PXA255:
46
    case ARM_CPUID_PXA260:
47
    case ARM_CPUID_PXA261:
48
    case ARM_CPUID_PXA262:
49
        set_feature(env, ARM_FEATURE_XSCALE);
50
        /* JTAG_ID is ((id << 28) | 0x09265013) */
51
        env->cp15.c0_cachetype = 0xd172172;
52
        env->cp15.c1_sys = 0x00000078;
53
        break;
54
    case ARM_CPUID_PXA270_A0:
55
    case ARM_CPUID_PXA270_A1:
56
    case ARM_CPUID_PXA270_B0:
57
    case ARM_CPUID_PXA270_B1:
58
    case ARM_CPUID_PXA270_C0:
59
    case ARM_CPUID_PXA270_C5:
60
        set_feature(env, ARM_FEATURE_XSCALE);
61
        /* JTAG_ID is ((id << 28) | 0x09265013) */
62
        set_feature(env, ARM_FEATURE_IWMMXT);
63
        env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
64
        env->cp15.c0_cachetype = 0xd172172;
65
        env->cp15.c1_sys = 0x00000078;
66
        break;
67
    default:
68
        cpu_abort(env, "Bad CPU ID: %x\n", id);
69
        break;
70
    }
71
}
72

    
73
void cpu_reset(CPUARMState *env)
74
{
75
    uint32_t id;
76
    id = env->cp15.c0_cpuid;
77
    memset(env, 0, offsetof(CPUARMState, breakpoints));
78
    if (id)
79
        cpu_reset_model_id(env, id);
80
#if defined (CONFIG_USER_ONLY)
81
    env->uncached_cpsr = ARM_CPU_MODE_USR;
82
    env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
83
#else
84
    /* SVC mode with interrupts disabled.  */
85
    env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
86
    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
87
#endif
88
    env->regs[15] = 0;
89
    tlb_flush(env, 1);
90
}
91

    
92
CPUARMState *cpu_arm_init(void)
93
{
94
    CPUARMState *env;
95

    
96
    env = qemu_mallocz(sizeof(CPUARMState));
97
    if (!env)
98
        return NULL;
99
    cpu_exec_init(env);
100
    cpu_reset(env);
101
    return env;
102
}
103

    
104
struct arm_cpu_t {
105
    uint32_t id;
106
    const char *name;
107
};
108

    
109
static const struct arm_cpu_t arm_cpu_names[] = {
110
    { ARM_CPUID_ARM926, "arm926"},
111
    { ARM_CPUID_ARM946, "arm946"},
112
    { ARM_CPUID_ARM1026, "arm1026"},
113
    { ARM_CPUID_TI925T, "ti925t" },
114
    { ARM_CPUID_PXA250, "pxa250" },
115
    { ARM_CPUID_PXA255, "pxa255" },
116
    { ARM_CPUID_PXA260, "pxa260" },
117
    { ARM_CPUID_PXA261, "pxa261" },
118
    { ARM_CPUID_PXA262, "pxa262" },
119
    { ARM_CPUID_PXA270, "pxa270" },
120
    { ARM_CPUID_PXA270_A0, "pxa270-a0" },
121
    { ARM_CPUID_PXA270_A1, "pxa270-a1" },
122
    { ARM_CPUID_PXA270_B0, "pxa270-b0" },
123
    { ARM_CPUID_PXA270_B1, "pxa270-b1" },
124
    { ARM_CPUID_PXA270_C0, "pxa270-c0" },
125
    { ARM_CPUID_PXA270_C5, "pxa270-c5" },
126
    { 0, NULL}
127
};
128

    
129
void arm_cpu_list(FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
130
{
131
    int i;
132

    
133
    (*cpu_fprintf)(f, "Available CPUs:\n");
134
    for (i = 0; arm_cpu_names[i].name; i++) {
135
        (*cpu_fprintf)(f, "  %s\n", arm_cpu_names[i].name);
136
    }
137
}
138

    
139
void cpu_arm_set_model(CPUARMState *env, const char *name)
140
{
141
    int i;
142
    uint32_t id;
143

    
144
    id = 0;
145
    i = 0;
146
    for (i = 0; arm_cpu_names[i].name; i++) {
147
        if (strcmp(name, arm_cpu_names[i].name) == 0) {
148
            id = arm_cpu_names[i].id;
149
            break;
150
        }
151
    }
152
    if (!id) {
153
        cpu_abort(env, "Unknown CPU '%s'", name);
154
        return;
155
    }
156
    cpu_reset_model_id(env, id);
157
}
158

    
159
void cpu_arm_close(CPUARMState *env)
160
{
161
    free(env);
162
}
163

    
164
#if defined(CONFIG_USER_ONLY)
165

    
166
void do_interrupt (CPUState *env)
167
{
168
    env->exception_index = -1;
169
}
170

    
171
int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
172
                              int mmu_idx, int is_softmmu)
173
{
174
    if (rw == 2) {
175
        env->exception_index = EXCP_PREFETCH_ABORT;
176
        env->cp15.c6_insn = address;
177
    } else {
178
        env->exception_index = EXCP_DATA_ABORT;
179
        env->cp15.c6_data = address;
180
    }
181
    return 1;
182
}
183

    
184
target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
185
{
186
    return addr;
187
}
188

    
189
/* These should probably raise undefined insn exceptions.  */
190
void helper_set_cp(CPUState *env, uint32_t insn, uint32_t val)
191
{
192
    int op1 = (insn >> 8) & 0xf;
193
    cpu_abort(env, "cp%i insn %08x\n", op1, insn);
194
    return;
195
}
196

    
197
uint32_t helper_get_cp(CPUState *env, uint32_t insn)
198
{
199
    int op1 = (insn >> 8) & 0xf;
200
    cpu_abort(env, "cp%i insn %08x\n", op1, insn);
201
    return 0;
202
}
203

    
204
void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
205
{
206
    cpu_abort(env, "cp15 insn %08x\n", insn);
207
}
208

    
209
uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
210
{
211
    cpu_abort(env, "cp15 insn %08x\n", insn);
212
    return 0;
213
}
214

    
215
void switch_mode(CPUState *env, int mode)
216
{
217
    if (mode != ARM_CPU_MODE_USR)
218
        cpu_abort(env, "Tried to switch out of user mode\n");
219
}
220

    
221
#else
222

    
223
extern int semihosting_enabled;
224

    
225
/* Map CPU modes onto saved register banks.  */
226
static inline int bank_number (int mode)
227
{
228
    switch (mode) {
229
    case ARM_CPU_MODE_USR:
230
    case ARM_CPU_MODE_SYS:
231
        return 0;
232
    case ARM_CPU_MODE_SVC:
233
        return 1;
234
    case ARM_CPU_MODE_ABT:
235
        return 2;
236
    case ARM_CPU_MODE_UND:
237
        return 3;
238
    case ARM_CPU_MODE_IRQ:
239
        return 4;
240
    case ARM_CPU_MODE_FIQ:
241
        return 5;
242
    }
243
    cpu_abort(cpu_single_env, "Bad mode %x\n", mode);
244
    return -1;
245
}
246

    
247
void switch_mode(CPUState *env, int mode)
248
{
249
    int old_mode;
250
    int i;
251

    
252
    old_mode = env->uncached_cpsr & CPSR_M;
253
    if (mode == old_mode)
254
        return;
255

    
256
    if (old_mode == ARM_CPU_MODE_FIQ) {
257
        memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
258
        memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
259
    } else if (mode == ARM_CPU_MODE_FIQ) {
260
        memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
261
        memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
262
    }
263

    
264
    i = bank_number(old_mode);
265
    env->banked_r13[i] = env->regs[13];
266
    env->banked_r14[i] = env->regs[14];
267
    env->banked_spsr[i] = env->spsr;
268

    
269
    i = bank_number(mode);
270
    env->regs[13] = env->banked_r13[i];
271
    env->regs[14] = env->banked_r14[i];
272
    env->spsr = env->banked_spsr[i];
273
}
274

    
275
/* Handle a CPU exception.  */
276
void do_interrupt(CPUARMState *env)
277
{
278
    uint32_t addr;
279
    uint32_t mask;
280
    int new_mode;
281
    uint32_t offset;
282

    
283
    /* TODO: Vectored interrupt controller.  */
284
    switch (env->exception_index) {
285
    case EXCP_UDEF:
286
        new_mode = ARM_CPU_MODE_UND;
287
        addr = 0x04;
288
        mask = CPSR_I;
289
        if (env->thumb)
290
            offset = 2;
291
        else
292
            offset = 4;
293
        break;
294
    case EXCP_SWI:
295
        if (semihosting_enabled) {
296
            /* Check for semihosting interrupt.  */
297
            if (env->thumb) {
298
                mask = lduw_code(env->regs[15] - 2) & 0xff;
299
            } else {
300
                mask = ldl_code(env->regs[15] - 4) & 0xffffff;
301
            }
302
            /* Only intercept calls from privileged modes, to provide some
303
               semblance of security.  */
304
            if (((mask == 0x123456 && !env->thumb)
305
                    || (mask == 0xab && env->thumb))
306
                  && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
307
                env->regs[0] = do_arm_semihosting(env);
308
                return;
309
            }
310
        }
311
        new_mode = ARM_CPU_MODE_SVC;
312
        addr = 0x08;
313
        mask = CPSR_I;
314
        /* The PC already points to the next instructon.  */
315
        offset = 0;
316
        break;
317
    case EXCP_PREFETCH_ABORT:
318
    case EXCP_BKPT:
319
        new_mode = ARM_CPU_MODE_ABT;
320
        addr = 0x0c;
321
        mask = CPSR_A | CPSR_I;
322
        offset = 4;
323
        break;
324
    case EXCP_DATA_ABORT:
325
        new_mode = ARM_CPU_MODE_ABT;
326
        addr = 0x10;
327
        mask = CPSR_A | CPSR_I;
328
        offset = 8;
329
        break;
330
    case EXCP_IRQ:
331
        new_mode = ARM_CPU_MODE_IRQ;
332
        addr = 0x18;
333
        /* Disable IRQ and imprecise data aborts.  */
334
        mask = CPSR_A | CPSR_I;
335
        offset = 4;
336
        break;
337
    case EXCP_FIQ:
338
        new_mode = ARM_CPU_MODE_FIQ;
339
        addr = 0x1c;
340
        /* Disable FIQ, IRQ and imprecise data aborts.  */
341
        mask = CPSR_A | CPSR_I | CPSR_F;
342
        offset = 4;
343
        break;
344
    default:
345
        cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
346
        return; /* Never happens.  Keep compiler happy.  */
347
    }
348
    /* High vectors.  */
349
    if (env->cp15.c1_sys & (1 << 13)) {
350
        addr += 0xffff0000;
351
    }
352
    switch_mode (env, new_mode);
353
    env->spsr = cpsr_read(env);
354
    /* Switch to the new mode, and switch to Arm mode.  */
355
    /* ??? Thumb interrupt handlers not implemented.  */
356
    env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
357
    env->uncached_cpsr |= mask;
358
    env->thumb = 0;
359
    env->regs[14] = env->regs[15] + offset;
360
    env->regs[15] = addr;
361
    env->interrupt_request |= CPU_INTERRUPT_EXITTB;
362
}
363

    
364
/* Check section/page access permissions.
365
   Returns the page protection flags, or zero if the access is not
366
   permitted.  */
367
static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
368
                           int is_user)
369
{
370
  if (domain == 3)
371
    return PAGE_READ | PAGE_WRITE;
372

    
373
  switch (ap) {
374
  case 0:
375
      if (access_type == 1)
376
          return 0;
377
      switch ((env->cp15.c1_sys >> 8) & 3) {
378
      case 1:
379
          return is_user ? 0 : PAGE_READ;
380
      case 2:
381
          return PAGE_READ;
382
      default:
383
          return 0;
384
      }
385
  case 1:
386
      return is_user ? 0 : PAGE_READ | PAGE_WRITE;
387
  case 2:
388
      if (is_user)
389
          return (access_type == 1) ? 0 : PAGE_READ;
390
      else
391
          return PAGE_READ | PAGE_WRITE;
392
  case 3:
393
      return PAGE_READ | PAGE_WRITE;
394
  default:
395
      abort();
396
  }
397
}
398

    
399
static int get_phys_addr(CPUState *env, uint32_t address, int access_type,
400
                         int is_user, uint32_t *phys_ptr, int *prot)
401
{
402
    int code;
403
    uint32_t table;
404
    uint32_t desc;
405
    int type;
406
    int ap;
407
    int domain;
408
    uint32_t phys_addr;
409

    
410
    /* Fast Context Switch Extension.  */
411
    if (address < 0x02000000)
412
        address += env->cp15.c13_fcse;
413

    
414
    if ((env->cp15.c1_sys & 1) == 0) {
415
        /* MMU/MPU disabled.  */
416
        *phys_ptr = address;
417
        *prot = PAGE_READ | PAGE_WRITE;
418
    } else if (arm_feature(env, ARM_FEATURE_MPU)) {
419
        int n;
420
        uint32_t mask;
421
        uint32_t base;
422

    
423
        *phys_ptr = address;
424
        for (n = 7; n >= 0; n--) {
425
            base = env->cp15.c6_region[n];
426
            if ((base & 1) == 0)
427
                continue;
428
            mask = 1 << ((base >> 1) & 0x1f);
429
            /* Keep this shift separate from the above to avoid an
430
               (undefined) << 32.  */
431
            mask = (mask << 1) - 1;
432
            if (((base ^ address) & ~mask) == 0)
433
                break;
434
        }
435
        if (n < 0)
436
            return 2;
437

    
438
        if (access_type == 2) {
439
            mask = env->cp15.c5_insn;
440
        } else {
441
            mask = env->cp15.c5_data;
442
        }
443
        mask = (mask >> (n * 4)) & 0xf;
444
        switch (mask) {
445
        case 0:
446
            return 1;
447
        case 1:
448
            if (is_user)
449
              return 1;
450
            *prot = PAGE_READ | PAGE_WRITE;
451
            break;
452
        case 2:
453
            *prot = PAGE_READ;
454
            if (!is_user)
455
                *prot |= PAGE_WRITE;
456
            break;
457
        case 3:
458
            *prot = PAGE_READ | PAGE_WRITE;
459
            break;
460
        case 5:
461
            if (is_user)
462
                return 1;
463
            *prot = PAGE_READ;
464
            break;
465
        case 6:
466
            *prot = PAGE_READ;
467
            break;
468
        default:
469
            /* Bad permission.  */
470
            return 1;
471
        }
472
    } else {
473
        /* Pagetable walk.  */
474
        /* Lookup l1 descriptor.  */
475
        table = (env->cp15.c2_base & 0xffffc000) | ((address >> 18) & 0x3ffc);
476
        desc = ldl_phys(table);
477
        type = (desc & 3);
478
        domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
479
        if (type == 0) {
480
            /* Secton translation fault.  */
481
            code = 5;
482
            goto do_fault;
483
        }
484
        if (domain == 0 || domain == 2) {
485
            if (type == 2)
486
                code = 9; /* Section domain fault.  */
487
            else
488
                code = 11; /* Page domain fault.  */
489
            goto do_fault;
490
        }
491
        if (type == 2) {
492
            /* 1Mb section.  */
493
            phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
494
            ap = (desc >> 10) & 3;
495
            code = 13;
496
        } else {
497
            /* Lookup l2 entry.  */
498
            if (type == 1) {
499
                /* Coarse pagetable.  */
500
                table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
501
            } else {
502
                /* Fine pagetable.  */
503
                table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
504
            }
505
            desc = ldl_phys(table);
506
            switch (desc & 3) {
507
            case 0: /* Page translation fault.  */
508
                code = 7;
509
                goto do_fault;
510
            case 1: /* 64k page.  */
511
                phys_addr = (desc & 0xffff0000) | (address & 0xffff);
512
                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
513
                break;
514
            case 2: /* 4k page.  */
515
                phys_addr = (desc & 0xfffff000) | (address & 0xfff);
516
                ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
517
                break;
518
            case 3: /* 1k page.  */
519
                if (type == 1) {
520
                    if (arm_feature(env, ARM_FEATURE_XSCALE))
521
                        phys_addr = (desc & 0xfffff000) | (address & 0xfff);
522
                    else {
523
                        /* Page translation fault.  */
524
                        code = 7;
525
                        goto do_fault;
526
                    }
527
                } else
528
                    phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
529
                ap = (desc >> 4) & 3;
530
                break;
531
            default:
532
                /* Never happens, but compiler isn't smart enough to tell.  */
533
                abort();
534
            }
535
            code = 15;
536
        }
537
        *prot = check_ap(env, ap, domain, access_type, is_user);
538
        if (!*prot) {
539
            /* Access permission fault.  */
540
            goto do_fault;
541
        }
542
        *phys_ptr = phys_addr;
543
    }
544
    return 0;
545
do_fault:
546
    return code | (domain << 4);
547
}
548

    
549
int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
550
                              int access_type, int mmu_idx, int is_softmmu)
551
{
552
    uint32_t phys_addr;
553
    int prot;
554
    int ret, is_user;
555

    
556
    is_user = mmu_idx == MMU_USER_IDX;
557
    ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot);
558
    if (ret == 0) {
559
        /* Map a single [sub]page.  */
560
        phys_addr &= ~(uint32_t)0x3ff;
561
        address &= ~(uint32_t)0x3ff;
562
        return tlb_set_page (env, address, phys_addr, prot, mmu_idx,
563
                             is_softmmu);
564
    }
565

    
566
    if (access_type == 2) {
567
        env->cp15.c5_insn = ret;
568
        env->cp15.c6_insn = address;
569
        env->exception_index = EXCP_PREFETCH_ABORT;
570
    } else {
571
        env->cp15.c5_data = ret;
572
        env->cp15.c6_data = address;
573
        env->exception_index = EXCP_DATA_ABORT;
574
    }
575
    return 1;
576
}
577

    
578
target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
579
{
580
    uint32_t phys_addr;
581
    int prot;
582
    int ret;
583

    
584
    ret = get_phys_addr(env, addr, 0, 0, &phys_addr, &prot);
585

    
586
    if (ret != 0)
587
        return -1;
588

    
589
    return phys_addr;
590
}
591

    
592
void helper_set_cp(CPUState *env, uint32_t insn, uint32_t val)
593
{
594
    int cp_num = (insn >> 8) & 0xf;
595
    int cp_info = (insn >> 5) & 7;
596
    int src = (insn >> 16) & 0xf;
597
    int operand = insn & 0xf;
598

    
599
    if (env->cp[cp_num].cp_write)
600
        env->cp[cp_num].cp_write(env->cp[cp_num].opaque,
601
                                 cp_info, src, operand, val);
602
}
603

    
604
uint32_t helper_get_cp(CPUState *env, uint32_t insn)
605
{
606
    int cp_num = (insn >> 8) & 0xf;
607
    int cp_info = (insn >> 5) & 7;
608
    int dest = (insn >> 16) & 0xf;
609
    int operand = insn & 0xf;
610

    
611
    if (env->cp[cp_num].cp_read)
612
        return env->cp[cp_num].cp_read(env->cp[cp_num].opaque,
613
                                       cp_info, dest, operand);
614
    return 0;
615
}
616

    
617
/* Return basic MPU access permission bits.  */
618
static uint32_t simple_mpu_ap_bits(uint32_t val)
619
{
620
    uint32_t ret;
621
    uint32_t mask;
622
    int i;
623
    ret = 0;
624
    mask = 3;
625
    for (i = 0; i < 16; i += 2) {
626
        ret |= (val >> i) & mask;
627
        mask <<= 2;
628
    }
629
    return ret;
630
}
631

    
632
/* Pad basic MPU access permission bits to extended format.  */
633
static uint32_t extended_mpu_ap_bits(uint32_t val)
634
{
635
    uint32_t ret;
636
    uint32_t mask;
637
    int i;
638
    ret = 0;
639
    mask = 3;
640
    for (i = 0; i < 16; i += 2) {
641
        ret |= (val & mask) << i;
642
        mask <<= 2;
643
    }
644
    return ret;
645
}
646

    
647
void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
648
{
649
    uint32_t op2;
650
    uint32_t crm;
651

    
652
    op2 = (insn >> 5) & 7;
653
    crm = insn & 0xf;
654
    switch ((insn >> 16) & 0xf) {
655
    case 0: /* ID codes.  */
656
        if (arm_feature(env, ARM_FEATURE_XSCALE))
657
            break;
658
        if (arm_feature(env, ARM_FEATURE_OMAPCP))
659
            break;
660
        goto bad_reg;
661
    case 1: /* System configuration.  */
662
        if (arm_feature(env, ARM_FEATURE_OMAPCP))
663
            op2 = 0;
664
        switch (op2) {
665
        case 0:
666
            if (!arm_feature(env, ARM_FEATURE_XSCALE) || crm == 0)
667
                env->cp15.c1_sys = val;
668
            /* ??? Lots of these bits are not implemented.  */
669
            /* This may enable/disable the MMU, so do a TLB flush.  */
670
            tlb_flush(env, 1);
671
            break;
672
        case 1:
673
            if (arm_feature(env, ARM_FEATURE_XSCALE)) {
674
                env->cp15.c1_xscaleauxcr = val;
675
                break;
676
            }
677
            goto bad_reg;
678
        case 2:
679
            if (arm_feature(env, ARM_FEATURE_XSCALE))
680
                goto bad_reg;
681
            env->cp15.c1_coproc = val;
682
            /* ??? Is this safe when called from within a TB?  */
683
            tb_flush(env);
684
            break;
685
        default:
686
            goto bad_reg;
687
        }
688
        break;
689
    case 2: /* MMU Page table control / MPU cache control.  */
690
        if (arm_feature(env, ARM_FEATURE_MPU)) {
691
            switch (op2) {
692
            case 0:
693
                env->cp15.c2_data = val;
694
                break;
695
            case 1:
696
                env->cp15.c2_insn = val;
697
                break;
698
            default:
699
                goto bad_reg;
700
            }
701
        } else {
702
            env->cp15.c2_base = val;
703
        }
704
        break;
705
    case 3: /* MMU Domain access control / MPU write buffer control.  */
706
        env->cp15.c3 = val;
707
        break;
708
    case 4: /* Reserved.  */
709
        goto bad_reg;
710
    case 5: /* MMU Fault status / MPU access permission.  */
711
        if (arm_feature(env, ARM_FEATURE_OMAPCP))
712
            op2 = 0;
713
        switch (op2) {
714
        case 0:
715
            if (arm_feature(env, ARM_FEATURE_MPU))
716
                val = extended_mpu_ap_bits(val);
717
            env->cp15.c5_data = val;
718
            break;
719
        case 1:
720
            if (arm_feature(env, ARM_FEATURE_MPU))
721
                val = extended_mpu_ap_bits(val);
722
            env->cp15.c5_insn = val;
723
            break;
724
        case 2:
725
            if (!arm_feature(env, ARM_FEATURE_MPU))
726
                goto bad_reg;
727
            env->cp15.c5_data = val;
728
            break;
729
        case 3:
730
            if (!arm_feature(env, ARM_FEATURE_MPU))
731
                goto bad_reg;
732
            env->cp15.c5_insn = val;
733
            break;
734
        default:
735
            goto bad_reg;
736
        }
737
        break;
738
    case 6: /* MMU Fault address / MPU base/size.  */
739
        if (arm_feature(env, ARM_FEATURE_MPU)) {
740
            if (crm >= 8)
741
                goto bad_reg;
742
            env->cp15.c6_region[crm] = val;
743
        } else {
744
            if (arm_feature(env, ARM_FEATURE_OMAPCP))
745
                op2 = 0;
746
            switch (op2) {
747
            case 0:
748
                env->cp15.c6_data = val;
749
                break;
750
            case 1:
751
                env->cp15.c6_insn = val;
752
                break;
753
            default:
754
                goto bad_reg;
755
            }
756
        }
757
        break;
758
    case 7: /* Cache control.  */
759
        env->cp15.c15_i_max = 0x000;
760
        env->cp15.c15_i_min = 0xff0;
761
        /* No cache, so nothing to do.  */
762
        break;
763
    case 8: /* MMU TLB control.  */
764
        switch (op2) {
765
        case 0: /* Invalidate all.  */
766
            tlb_flush(env, 0);
767
            break;
768
        case 1: /* Invalidate single TLB entry.  */
769
#if 0
770
            /* ??? This is wrong for large pages and sections.  */
771
            /* As an ugly hack to make linux work we always flush a 4K
772
               pages.  */
773
            val &= 0xfffff000;
774
            tlb_flush_page(env, val);
775
            tlb_flush_page(env, val + 0x400);
776
            tlb_flush_page(env, val + 0x800);
777
            tlb_flush_page(env, val + 0xc00);
778
#else
779
            tlb_flush(env, 1);
780
#endif
781
            break;
782
        default:
783
            goto bad_reg;
784
        }
785
        break;
786
    case 9:
787
        if (arm_feature(env, ARM_FEATURE_OMAPCP))
788
            break;
789
        switch (crm) {
790
        case 0: /* Cache lockdown.  */
791
            switch (op2) {
792
            case 0:
793
                env->cp15.c9_data = val;
794
                break;
795
            case 1:
796
                env->cp15.c9_insn = val;
797
                break;
798
            default:
799
                goto bad_reg;
800
            }
801
            break;
802
        case 1: /* TCM memory region registers.  */
803
            /* Not implemented.  */
804
            goto bad_reg;
805
        default:
806
            goto bad_reg;
807
        }
808
        break;
809
    case 10: /* MMU TLB lockdown.  */
810
        /* ??? TLB lockdown not implemented.  */
811
        break;
812
    case 12: /* Reserved.  */
813
        goto bad_reg;
814
    case 13: /* Process ID.  */
815
        switch (op2) {
816
        case 0:
817
            if (!arm_feature(env, ARM_FEATURE_MPU))
818
                goto bad_reg;
819
            /* Unlike real hardware the qemu TLB uses virtual addresses,
820
               not modified virtual addresses, so this causes a TLB flush.
821
             */
822
            if (env->cp15.c13_fcse != val)
823
              tlb_flush(env, 1);
824
            env->cp15.c13_fcse = val;
825
            break;
826
        case 1:
827
            /* This changes the ASID, so do a TLB flush.  */
828
            if (env->cp15.c13_context != val
829
                && !arm_feature(env, ARM_FEATURE_MPU))
830
              tlb_flush(env, 0);
831
            env->cp15.c13_context = val;
832
            break;
833
        default:
834
            goto bad_reg;
835
        }
836
        break;
837
    case 14: /* Reserved.  */
838
        goto bad_reg;
839
    case 15: /* Implementation specific.  */
840
        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
841
            if (op2 == 0 && crm == 1) {
842
                if (env->cp15.c15_cpar != (val & 0x3fff)) {
843
                    /* Changes cp0 to cp13 behavior, so needs a TB flush.  */
844
                    tb_flush(env);
845
                    env->cp15.c15_cpar = val & 0x3fff;
846
                }
847
                break;
848
            }
849
            goto bad_reg;
850
        }
851
        if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
852
            switch (crm) {
853
            case 0:
854
                break;
855
            case 1: /* Set TI925T configuration.  */
856
                env->cp15.c15_ticonfig = val & 0xe7;
857
                env->cp15.c0_cpuid = (val & (1 << 5)) ? /* OS_TYPE bit */
858
                        ARM_CPUID_TI915T : ARM_CPUID_TI925T;
859
                break;
860
            case 2: /* Set I_max.  */
861
                env->cp15.c15_i_max = val;
862
                break;
863
            case 3: /* Set I_min.  */
864
                env->cp15.c15_i_min = val;
865
                break;
866
            case 4: /* Set thread-ID.  */
867
                env->cp15.c15_threadid = val & 0xffff;
868
                break;
869
            case 8: /* Wait-for-interrupt (deprecated).  */
870
                cpu_interrupt(env, CPU_INTERRUPT_HALT);
871
                break;
872
            default:
873
                goto bad_reg;
874
            }
875
        }
876
        break;
877
    }
878
    return;
879
bad_reg:
880
    /* ??? For debugging only.  Should raise illegal instruction exception.  */
881
    cpu_abort(env, "Unimplemented cp15 register write\n");
882
}
883

    
884
uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
885
{
886
    uint32_t op2;
887
    uint32_t crm;
888

    
889
    op2 = (insn >> 5) & 7;
890
    crm = insn & 0xf;
891
    switch ((insn >> 16) & 0xf) {
892
    case 0: /* ID codes.  */
893
        switch (op2) {
894
        default: /* Device ID.  */
895
            return env->cp15.c0_cpuid;
896
        case 1: /* Cache Type.  */
897
            return env->cp15.c0_cachetype;
898
        case 2: /* TCM status.  */
899
            if (arm_feature(env, ARM_FEATURE_XSCALE))
900
                goto bad_reg;
901
            return 0;
902
        }
903
    case 1: /* System configuration.  */
904
        if (arm_feature(env, ARM_FEATURE_OMAPCP))
905
            op2 = 0;
906
        switch (op2) {
907
        case 0: /* Control register.  */
908
            return env->cp15.c1_sys;
909
        case 1: /* Auxiliary control register.  */
910
            if (arm_feature(env, ARM_FEATURE_AUXCR))
911
                return 1;
912
            if (arm_feature(env, ARM_FEATURE_XSCALE))
913
                return env->cp15.c1_xscaleauxcr;
914
            goto bad_reg;
915
        case 2: /* Coprocessor access register.  */
916
            if (arm_feature(env, ARM_FEATURE_XSCALE))
917
                goto bad_reg;
918
            return env->cp15.c1_coproc;
919
        default:
920
            goto bad_reg;
921
        }
922
    case 2: /* MMU Page table control / MPU cache control.  */
923
        if (arm_feature(env, ARM_FEATURE_MPU)) {
924
            switch (op2) {
925
            case 0:
926
                return env->cp15.c2_data;
927
                break;
928
            case 1:
929
                return env->cp15.c2_insn;
930
                break;
931
            default:
932
                goto bad_reg;
933
            }
934
        } else {
935
            return env->cp15.c2_base;
936
        }
937
    case 3: /* MMU Domain access control / MPU write buffer control.  */
938
        return env->cp15.c3;
939
    case 4: /* Reserved.  */
940
        goto bad_reg;
941
    case 5: /* MMU Fault status / MPU access permission.  */
942
        if (arm_feature(env, ARM_FEATURE_OMAPCP))
943
            op2 = 0;
944
        switch (op2) {
945
        case 0:
946
            if (arm_feature(env, ARM_FEATURE_MPU))
947
                return simple_mpu_ap_bits(env->cp15.c5_data);
948
            return env->cp15.c5_data;
949
        case 1:
950
            if (arm_feature(env, ARM_FEATURE_MPU))
951
                return simple_mpu_ap_bits(env->cp15.c5_data);
952
            return env->cp15.c5_insn;
953
        case 2:
954
            if (!arm_feature(env, ARM_FEATURE_MPU))
955
                goto bad_reg;
956
            return env->cp15.c5_data;
957
        case 3:
958
            if (!arm_feature(env, ARM_FEATURE_MPU))
959
                goto bad_reg;
960
            return env->cp15.c5_insn;
961
        default:
962
            goto bad_reg;
963
        }
964
    case 6: /* MMU Fault address / MPU base/size.  */
965
        if (arm_feature(env, ARM_FEATURE_MPU)) {
966
            int n;
967
            n = (insn & 0xf);
968
            if (n >= 8)
969
                goto bad_reg;
970
            return env->cp15.c6_region[n];
971
        } else {
972
            if (arm_feature(env, ARM_FEATURE_OMAPCP))
973
                op2 = 0;
974
            switch (op2) {
975
            case 0:
976
                return env->cp15.c6_data;
977
            case 1:
978
                /* Arm9 doesn't have an IFAR, but implementing it anyway
979
                   shouldn't do any harm.  */
980
                return env->cp15.c6_insn;
981
            default:
982
                goto bad_reg;
983
            }
984
        }
985
    case 7: /* Cache control.  */
986
        /* ??? This is for test, clean and invaidate operations that set the
987
           Z flag.  We can't represent N = Z = 1, so it also clears
988
           the N flag.  Oh well.  */
989
        env->NZF = 0;
990
        return 0;
991
    case 8: /* MMU TLB control.  */
992
        goto bad_reg;
993
    case 9: /* Cache lockdown.  */
994
        if (arm_feature(env, ARM_FEATURE_OMAPCP))
995
            return 0;
996
        switch (op2) {
997
        case 0:
998
            return env->cp15.c9_data;
999
        case 1:
1000
            return env->cp15.c9_insn;
1001
        default:
1002
            goto bad_reg;
1003
        }
1004
    case 10: /* MMU TLB lockdown.  */
1005
        /* ??? TLB lockdown not implemented.  */
1006
        return 0;
1007
    case 11: /* TCM DMA control.  */
1008
    case 12: /* Reserved.  */
1009
        goto bad_reg;
1010
    case 13: /* Process ID.  */
1011
        switch (op2) {
1012
        case 0:
1013
            return env->cp15.c13_fcse;
1014
        case 1:
1015
            return env->cp15.c13_context;
1016
        default:
1017
            goto bad_reg;
1018
        }
1019
    case 14: /* Reserved.  */
1020
        goto bad_reg;
1021
    case 15: /* Implementation specific.  */
1022
        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
1023
            if (op2 == 0 && crm == 1)
1024
                return env->cp15.c15_cpar;
1025

    
1026
            goto bad_reg;
1027
        }
1028
        if (arm_feature(env, ARM_FEATURE_OMAPCP)) {
1029
            switch (crm) {
1030
            case 0:
1031
                return 0;
1032
            case 1: /* Read TI925T configuration.  */
1033
                return env->cp15.c15_ticonfig;
1034
            case 2: /* Read I_max.  */
1035
                return env->cp15.c15_i_max;
1036
            case 3: /* Read I_min.  */
1037
                return env->cp15.c15_i_min;
1038
            case 4: /* Read thread-ID.  */
1039
                return env->cp15.c15_threadid;
1040
            case 8: /* TI925T_status */
1041
                return 0;
1042
            }
1043
            goto bad_reg;
1044
        }
1045
        return 0;
1046
    }
1047
bad_reg:
1048
    /* ??? For debugging only.  Should raise illegal instruction exception.  */
1049
    cpu_abort(env, "Unimplemented cp15 register read\n");
1050
    return 0;
1051
}
1052

    
1053
void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
1054
                ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
1055
                void *opaque)
1056
{
1057
    if (cpnum < 0 || cpnum > 14) {
1058
        cpu_abort(env, "Bad coprocessor number: %i\n", cpnum);
1059
        return;
1060
    }
1061

    
1062
    env->cp[cpnum].cp_read = cp_read;
1063
    env->cp[cpnum].cp_write = cp_write;
1064
    env->cp[cpnum].opaque = opaque;
1065
}
1066

    
1067
#endif