cpregs.h (19610B)
1 /* 2 * QEMU ARM CP Register access and descriptions 3 * 4 * Copyright (c) 2022 Linaro Ltd 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 2 9 * of the License, or (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program; if not, see 18 * <http://www.gnu.org/licenses/gpl-2.0.html> 19 */ 20 21 #ifndef TARGET_ARM_CPREGS_H 22 #define TARGET_ARM_CPREGS_H 23 24 /* 25 * ARMCPRegInfo type field bits: 26 */ 27 enum { 28 /* 29 * Register must be handled specially during translation. 30 * The method is one of the values below: 31 */ 32 ARM_CP_SPECIAL_MASK = 0x000f, 33 /* Special: no change to PE state: writes ignored, reads ignored. */ 34 ARM_CP_NOP = 0x0001, 35 /* Special: sysreg is WFI, for v5 and v6. */ 36 ARM_CP_WFI = 0x0002, 37 /* Special: sysreg is NZCV. */ 38 ARM_CP_NZCV = 0x0003, 39 /* Special: sysreg is CURRENTEL. */ 40 ARM_CP_CURRENTEL = 0x0004, 41 /* Special: sysreg is DC ZVA or similar. */ 42 ARM_CP_DC_ZVA = 0x0005, 43 ARM_CP_DC_GVA = 0x0006, 44 ARM_CP_DC_GZVA = 0x0007, 45 46 /* Flag: reads produce resetvalue; writes ignored. */ 47 ARM_CP_CONST = 1 << 4, 48 /* Flag: For ARM_CP_STATE_AA32, sysreg is 64-bit. */ 49 ARM_CP_64BIT = 1 << 5, 50 /* 51 * Flag: TB should not be ended after a write to this register 52 * (the default is that the TB ends after cp writes). 53 */ 54 ARM_CP_SUPPRESS_TB_END = 1 << 6, 55 /* 56 * Flag: Permit a register definition to override a previous definition 57 * for the same (cp, is64, crn, crm, opc1, opc2) tuple: either the new 58 * or the old must have the ARM_CP_OVERRIDE bit set. 59 */ 60 ARM_CP_OVERRIDE = 1 << 7, 61 /* 62 * Flag: Register is an alias view of some underlying state which is also 63 * visible via another register, and that the other register is handling 64 * migration and reset; registers marked ARM_CP_ALIAS will not be migrated 65 * but may have their state set by syncing of register state from KVM. 66 */ 67 ARM_CP_ALIAS = 1 << 8, 68 /* 69 * Flag: Register does I/O and therefore its accesses need to be marked 70 * with gen_io_start() and also end the TB. In particular, registers which 71 * implement clocks or timers require this. 72 */ 73 ARM_CP_IO = 1 << 9, 74 /* 75 * Flag: Register has no underlying state and does not support raw access 76 * for state saving/loading; it will not be used for either migration or 77 * KVM state synchronization. Typically this is for "registers" which are 78 * actually used as instructions for cache maintenance and so on. 79 */ 80 ARM_CP_NO_RAW = 1 << 10, 81 /* 82 * Flag: The read or write hook might raise an exception; the generated 83 * code will synchronize the CPU state before calling the hook so that it 84 * is safe for the hook to call raise_exception(). 85 */ 86 ARM_CP_RAISES_EXC = 1 << 11, 87 /* 88 * Flag: Writes to the sysreg might change the exception level - typically 89 * on older ARM chips. For those cases we need to re-read the new el when 90 * recomputing the translation flags. 91 */ 92 ARM_CP_NEWEL = 1 << 12, 93 /* 94 * Flag: Access check for this sysreg is identical to accessing FPU state 95 * from an instruction: use translation fp_access_check(). 96 */ 97 ARM_CP_FPU = 1 << 13, 98 /* 99 * Flag: Access check for this sysreg is identical to accessing SVE state 100 * from an instruction: use translation sve_access_check(). 101 */ 102 ARM_CP_SVE = 1 << 14, 103 /* Flag: Do not expose in gdb sysreg xml. */ 104 ARM_CP_NO_GDB = 1 << 15, 105 /* 106 * Flags: If EL3 but not EL2... 107 * - UNDEF: discard the cpreg, 108 * - KEEP: retain the cpreg as is, 109 * - C_NZ: set const on the cpreg, but retain resetvalue, 110 * - else: set const on the cpreg, zero resetvalue, aka RES0. 111 * See rule RJFFP in section D1.1.3 of DDI0487H.a. 112 */ 113 ARM_CP_EL3_NO_EL2_UNDEF = 1 << 16, 114 ARM_CP_EL3_NO_EL2_KEEP = 1 << 17, 115 ARM_CP_EL3_NO_EL2_C_NZ = 1 << 18, 116 /* 117 * Flag: Access check for this sysreg is constrained by the 118 * ARM pseudocode function CheckSMEAccess(). 119 */ 120 ARM_CP_SME = 1 << 19, 121 }; 122 123 /* 124 * Valid values for ARMCPRegInfo state field, indicating which of 125 * the AArch32 and AArch64 execution states this register is visible in. 126 * If the reginfo doesn't explicitly specify then it is AArch32 only. 127 * If the reginfo is declared to be visible in both states then a second 128 * reginfo is synthesised for the AArch32 view of the AArch64 register, 129 * such that the AArch32 view is the lower 32 bits of the AArch64 one. 130 * Note that we rely on the values of these enums as we iterate through 131 * the various states in some places. 132 */ 133 typedef enum { 134 ARM_CP_STATE_AA32 = 0, 135 ARM_CP_STATE_AA64 = 1, 136 ARM_CP_STATE_BOTH = 2, 137 } CPState; 138 139 /* 140 * ARM CP register secure state flags. These flags identify security state 141 * attributes for a given CP register entry. 142 * The existence of both or neither secure and non-secure flags indicates that 143 * the register has both a secure and non-secure hash entry. A single one of 144 * these flags causes the register to only be hashed for the specified 145 * security state. 146 * Although definitions may have any combination of the S/NS bits, each 147 * registered entry will only have one to identify whether the entry is secure 148 * or non-secure. 149 */ 150 typedef enum { 151 ARM_CP_SECSTATE_BOTH = 0, /* define one cpreg for each secstate */ 152 ARM_CP_SECSTATE_S = (1 << 0), /* bit[0]: Secure state register */ 153 ARM_CP_SECSTATE_NS = (1 << 1), /* bit[1]: Non-secure state register */ 154 } CPSecureState; 155 156 /* 157 * Access rights: 158 * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM 159 * defines as PL0 (user), PL1 (fiq/irq/svc/abt/und/sys, ie privileged), and 160 * PL2 (hyp). The other level which has Read and Write bits is Secure PL1 161 * (ie any of the privileged modes in Secure state, or Monitor mode). 162 * If a register is accessible in one privilege level it's always accessible 163 * in higher privilege levels too. Since "Secure PL1" also follows this rule 164 * (ie anything visible in PL2 is visible in S-PL1, some things are only 165 * visible in S-PL1) but "Secure PL1" is a bit of a mouthful, we bend the 166 * terminology a little and call this PL3. 167 * In AArch64 things are somewhat simpler as the PLx bits line up exactly 168 * with the ELx exception levels. 169 * 170 * If access permissions for a register are more complex than can be 171 * described with these bits, then use a laxer set of restrictions, and 172 * do the more restrictive/complex check inside a helper function. 173 */ 174 typedef enum { 175 PL3_R = 0x80, 176 PL3_W = 0x40, 177 PL2_R = 0x20 | PL3_R, 178 PL2_W = 0x10 | PL3_W, 179 PL1_R = 0x08 | PL2_R, 180 PL1_W = 0x04 | PL2_W, 181 PL0_R = 0x02 | PL1_R, 182 PL0_W = 0x01 | PL1_W, 183 184 /* 185 * For user-mode some registers are accessible to EL0 via a kernel 186 * trap-and-emulate ABI. In this case we define the read permissions 187 * as actually being PL0_R. However some bits of any given register 188 * may still be masked. 189 */ 190 #ifdef CONFIG_USER_ONLY 191 PL0U_R = PL0_R, 192 #else 193 PL0U_R = PL1_R, 194 #endif 195 196 PL3_RW = PL3_R | PL3_W, 197 PL2_RW = PL2_R | PL2_W, 198 PL1_RW = PL1_R | PL1_W, 199 PL0_RW = PL0_R | PL0_W, 200 } CPAccessRights; 201 202 typedef enum CPAccessResult { 203 /* Access is permitted */ 204 CP_ACCESS_OK = 0, 205 206 /* 207 * Combined with one of the following, the low 2 bits indicate the 208 * target exception level. If 0, the exception is taken to the usual 209 * target EL (EL1 or PL1 if in EL0, otherwise to the current EL). 210 */ 211 CP_ACCESS_EL_MASK = 3, 212 213 /* 214 * Access fails due to a configurable trap or enable which would 215 * result in a categorized exception syndrome giving information about 216 * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6, 217 * 0xc or 0x18). 218 */ 219 CP_ACCESS_TRAP = (1 << 2), 220 CP_ACCESS_TRAP_EL2 = CP_ACCESS_TRAP | 2, 221 CP_ACCESS_TRAP_EL3 = CP_ACCESS_TRAP | 3, 222 223 /* 224 * Access fails and results in an exception syndrome 0x0 ("uncategorized"). 225 * Note that this is not a catch-all case -- the set of cases which may 226 * result in this failure is specifically defined by the architecture. 227 */ 228 CP_ACCESS_TRAP_UNCATEGORIZED = (2 << 2), 229 CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = CP_ACCESS_TRAP_UNCATEGORIZED | 2, 230 CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = CP_ACCESS_TRAP_UNCATEGORIZED | 3, 231 } CPAccessResult; 232 233 typedef struct ARMCPRegInfo ARMCPRegInfo; 234 235 /* 236 * Access functions for coprocessor registers. These cannot fail and 237 * may not raise exceptions. 238 */ 239 typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque); 240 typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *opaque, 241 uint64_t value); 242 /* Access permission check functions for coprocessor registers. */ 243 typedef CPAccessResult CPAccessFn(CPUARMState *env, 244 const ARMCPRegInfo *opaque, 245 bool isread); 246 /* Hook function for register reset */ 247 typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *opaque); 248 249 #define CP_ANY 0xff 250 251 /* Definition of an ARM coprocessor register */ 252 struct ARMCPRegInfo { 253 /* Name of register (useful mainly for debugging, need not be unique) */ 254 const char *name; 255 /* 256 * Location of register: coprocessor number and (crn,crm,opc1,opc2) 257 * tuple. Any of crm, opc1 and opc2 may be CP_ANY to indicate a 258 * 'wildcard' field -- any value of that field in the MRC/MCR insn 259 * will be decoded to this register. The register read and write 260 * callbacks will be passed an ARMCPRegInfo with the crn/crm/opc1/opc2 261 * used by the program, so it is possible to register a wildcard and 262 * then behave differently on read/write if necessary. 263 * For 64 bit registers, only crm and opc1 are relevant; crn and opc2 264 * must both be zero. 265 * For AArch64-visible registers, opc0 is also used. 266 * Since there are no "coprocessors" in AArch64, cp is purely used as a 267 * way to distinguish (for KVM's benefit) guest-visible system registers 268 * from demuxed ones provided to preserve the "no side effects on 269 * KVM register read/write from QEMU" semantics. cp==0x13 is guest 270 * visible (to match KVM's encoding); cp==0 will be converted to 271 * cp==0x13 when the ARMCPRegInfo is registered, for convenience. 272 */ 273 uint8_t cp; 274 uint8_t crn; 275 uint8_t crm; 276 uint8_t opc0; 277 uint8_t opc1; 278 uint8_t opc2; 279 /* Execution state in which this register is visible: ARM_CP_STATE_* */ 280 CPState state; 281 /* Register type: ARM_CP_* bits/values */ 282 int type; 283 /* Access rights: PL*_[RW] */ 284 CPAccessRights access; 285 /* Security state: ARM_CP_SECSTATE_* bits/values */ 286 CPSecureState secure; 287 /* 288 * The opaque pointer passed to define_arm_cp_regs_with_opaque() when 289 * this register was defined: can be used to hand data through to the 290 * register read/write functions, since they are passed the ARMCPRegInfo*. 291 */ 292 void *opaque; 293 /* 294 * Value of this register, if it is ARM_CP_CONST. Otherwise, if 295 * fieldoffset is non-zero, the reset value of the register. 296 */ 297 uint64_t resetvalue; 298 /* 299 * Offset of the field in CPUARMState for this register. 300 * This is not needed if either: 301 * 1. type is ARM_CP_CONST or one of the ARM_CP_SPECIALs 302 * 2. both readfn and writefn are specified 303 */ 304 ptrdiff_t fieldoffset; /* offsetof(CPUARMState, field) */ 305 306 /* 307 * Offsets of the secure and non-secure fields in CPUARMState for the 308 * register if it is banked. These fields are only used during the static 309 * registration of a register. During hashing the bank associated 310 * with a given security state is copied to fieldoffset which is used from 311 * there on out. 312 * 313 * It is expected that register definitions use either fieldoffset or 314 * bank_fieldoffsets in the definition but not both. It is also expected 315 * that both bank offsets are set when defining a banked register. This 316 * use indicates that a register is banked. 317 */ 318 ptrdiff_t bank_fieldoffsets[2]; 319 320 /* 321 * Function for making any access checks for this register in addition to 322 * those specified by the 'access' permissions bits. If NULL, no extra 323 * checks required. The access check is performed at runtime, not at 324 * translate time. 325 */ 326 CPAccessFn *accessfn; 327 /* 328 * Function for handling reads of this register. If NULL, then reads 329 * will be done by loading from the offset into CPUARMState specified 330 * by fieldoffset. 331 */ 332 CPReadFn *readfn; 333 /* 334 * Function for handling writes of this register. If NULL, then writes 335 * will be done by writing to the offset into CPUARMState specified 336 * by fieldoffset. 337 */ 338 CPWriteFn *writefn; 339 /* 340 * Function for doing a "raw" read; used when we need to copy 341 * coprocessor state to the kernel for KVM or out for 342 * migration. This only needs to be provided if there is also a 343 * readfn and it has side effects (for instance clear-on-read bits). 344 */ 345 CPReadFn *raw_readfn; 346 /* 347 * Function for doing a "raw" write; used when we need to copy KVM 348 * kernel coprocessor state into userspace, or for inbound 349 * migration. This only needs to be provided if there is also a 350 * writefn and it masks out "unwritable" bits or has write-one-to-clear 351 * or similar behaviour. 352 */ 353 CPWriteFn *raw_writefn; 354 /* 355 * Function for resetting the register. If NULL, then reset will be done 356 * by writing resetvalue to the field specified in fieldoffset. If 357 * fieldoffset is 0 then no reset will be done. 358 */ 359 CPResetFn *resetfn; 360 361 /* 362 * "Original" writefn and readfn. 363 * For ARMv8.1-VHE register aliases, we overwrite the read/write 364 * accessor functions of various EL1/EL0 to perform the runtime 365 * check for which sysreg should actually be modified, and then 366 * forwards the operation. Before overwriting the accessors, 367 * the original function is copied here, so that accesses that 368 * really do go to the EL1/EL0 version proceed normally. 369 * (The corresponding EL2 register is linked via opaque.) 370 */ 371 CPReadFn *orig_readfn; 372 CPWriteFn *orig_writefn; 373 }; 374 375 /* 376 * Macros which are lvalues for the field in CPUARMState for the 377 * ARMCPRegInfo *ri. 378 */ 379 #define CPREG_FIELD32(env, ri) \ 380 (*(uint32_t *)((char *)(env) + (ri)->fieldoffset)) 381 #define CPREG_FIELD64(env, ri) \ 382 (*(uint64_t *)((char *)(env) + (ri)->fieldoffset)) 383 384 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, const ARMCPRegInfo *reg, 385 void *opaque); 386 387 static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs) 388 { 389 define_one_arm_cp_reg_with_opaque(cpu, regs, NULL); 390 } 391 392 void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs, 393 void *opaque, size_t len); 394 395 #define define_arm_cp_regs_with_opaque(CPU, REGS, OPAQUE) \ 396 do { \ 397 QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0); \ 398 define_arm_cp_regs_with_opaque_len(CPU, REGS, OPAQUE, \ 399 ARRAY_SIZE(REGS)); \ 400 } while (0) 401 402 #define define_arm_cp_regs(CPU, REGS) \ 403 define_arm_cp_regs_with_opaque(CPU, REGS, NULL) 404 405 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp); 406 407 /* 408 * Definition of an ARM co-processor register as viewed from 409 * userspace. This is used for presenting sanitised versions of 410 * registers to userspace when emulating the Linux AArch64 CPU 411 * ID/feature ABI (advertised as HWCAP_CPUID). 412 */ 413 typedef struct ARMCPRegUserSpaceInfo { 414 /* Name of register */ 415 const char *name; 416 417 /* Is the name actually a glob pattern */ 418 bool is_glob; 419 420 /* Only some bits are exported to user space */ 421 uint64_t exported_bits; 422 423 /* Fixed bits are applied after the mask */ 424 uint64_t fixed_bits; 425 } ARMCPRegUserSpaceInfo; 426 427 void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len, 428 const ARMCPRegUserSpaceInfo *mods, 429 size_t mods_len); 430 431 #define modify_arm_cp_regs(REGS, MODS) \ 432 do { \ 433 QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0); \ 434 QEMU_BUILD_BUG_ON(ARRAY_SIZE(MODS) == 0); \ 435 modify_arm_cp_regs_with_len(REGS, ARRAY_SIZE(REGS), \ 436 MODS, ARRAY_SIZE(MODS)); \ 437 } while (0) 438 439 /* CPWriteFn that can be used to implement writes-ignored behaviour */ 440 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri, 441 uint64_t value); 442 /* CPReadFn that can be used for read-as-zero behaviour */ 443 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri); 444 445 /* CPWriteFn that just writes the value to ri->fieldoffset */ 446 void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value); 447 448 /* 449 * CPResetFn that does nothing, for use if no reset is required even 450 * if fieldoffset is non zero. 451 */ 452 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque); 453 454 /* 455 * Return true if this reginfo struct's field in the cpu state struct 456 * is 64 bits wide. 457 */ 458 static inline bool cpreg_field_is_64bit(const ARMCPRegInfo *ri) 459 { 460 return (ri->state == ARM_CP_STATE_AA64) || (ri->type & ARM_CP_64BIT); 461 } 462 463 static inline bool cp_access_ok(int current_el, 464 const ARMCPRegInfo *ri, int isread) 465 { 466 return (ri->access >> ((current_el * 2) + isread)) & 1; 467 } 468 469 /* Raw read of a coprocessor register (as needed for migration, etc) */ 470 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri); 471 472 /* 473 * Return true if the cp register encoding is in the "feature ID space" as 474 * defined by FEAT_IDST (and thus should be reported with ER_ELx.EC 475 * as EC_SYSTEMREGISTERTRAP rather than EC_UNCATEGORIZED). 476 */ 477 static inline bool arm_cpreg_encoding_in_idspace(uint8_t opc0, uint8_t opc1, 478 uint8_t opc2, 479 uint8_t crn, uint8_t crm) 480 { 481 return opc0 == 3 && (opc1 == 0 || opc1 == 1 || opc1 == 3) && 482 crn == 0 && crm < 8; 483 } 484 485 /* 486 * As arm_cpreg_encoding_in_idspace(), but take the encoding from an 487 * ARMCPRegInfo. 488 */ 489 static inline bool arm_cpreg_in_idspace(const ARMCPRegInfo *ri) 490 { 491 return ri->state == ARM_CP_STATE_AA64 && 492 arm_cpreg_encoding_in_idspace(ri->opc0, ri->opc1, ri->opc2, 493 ri->crn, ri->crm); 494 } 495 496 #endif /* TARGET_ARM_CPREGS_H */