target/arm/cpregs.h

   1 /*
   2  * QEMU ARM CP Register access and descriptions
   3  *
   4  * Copyright (c) 2022 Linaro Ltd
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, see
  18  * <http://www.gnu.org/licenses/gpl-2.0.html>
  19  */
  20
  21 #ifndef TARGET_ARM_CPREGS_H
  22 #define TARGET_ARM_CPREGS_H
  23
  24 /*
  25  * ARMCPRegInfo type field bits:
  26  */
  27 enum {
  28     /*
  29      * Register must be handled specially during translation.
  30      * The method is one of the values below:
  31      */
  32     ARM_CP_SPECIAL_MASK          = 0x000f,
  33     /* Special: no change to PE state: writes ignored, reads ignored. */
  34     ARM_CP_NOP                   = 0x0001,
  35     /* Special: sysreg is WFI, for v5 and v6. */
  36     ARM_CP_WFI                   = 0x0002,
  37     /* Special: sysreg is NZCV. */
  38     ARM_CP_NZCV                  = 0x0003,
  39     /* Special: sysreg is CURRENTEL. */
  40     ARM_CP_CURRENTEL             = 0x0004,
  41     /* Special: sysreg is DC ZVA or similar. */
  42     ARM_CP_DC_ZVA                = 0x0005,
  43     ARM_CP_DC_GVA                = 0x0006,
  44     ARM_CP_DC_GZVA               = 0x0007,
  45
  46     /* Flag: reads produce resetvalue; writes ignored. */
  47     ARM_CP_CONST                 = 1 << 4,
  48     /* Flag: For ARM_CP_STATE_AA32, sysreg is 64-bit. */
  49     ARM_CP_64BIT                 = 1 << 5,
  50     /*
  51      * Flag: TB should not be ended after a write to this register
  52      * (the default is that the TB ends after cp writes).
  53      */
  54     ARM_CP_SUPPRESS_TB_END       = 1 << 6,
  55     /*
  56      * Flag: Permit a register definition to override a previous definition
  57      * for the same (cp, is64, crn, crm, opc1, opc2) tuple: either the new
  58      * or the old must have the ARM_CP_OVERRIDE bit set.
  59      */
  60     ARM_CP_OVERRIDE              = 1 << 7,
  61     /*
  62      * Flag: Register is an alias view of some underlying state which is also
  63      * visible via another register, and that the other register is handling
  64      * migration and reset; registers marked ARM_CP_ALIAS will not be migrated
  65      * but may have their state set by syncing of register state from KVM.
  66      */
  67     ARM_CP_ALIAS                 = 1 << 8,
  68     /*
  69      * Flag: Register does I/O and therefore its accesses need to be marked
  70      * with gen_io_start() and also end the TB. In particular, registers which
  71      * implement clocks or timers require this.
  72      */
  73     ARM_CP_IO                    = 1 << 9,
  74     /*
  75      * Flag: Register has no underlying state and does not support raw access
  76      * for state saving/loading; it will not be used for either migration or
  77      * KVM state synchronization. Typically this is for "registers" which are
  78      * actually used as instructions for cache maintenance and so on.
  79      */
  80     ARM_CP_NO_RAW                = 1 << 10,
  81     /*
  82      * Flag: The read or write hook might raise an exception; the generated
  83      * code will synchronize the CPU state before calling the hook so that it
  84      * is safe for the hook to call raise_exception().
  85      */
  86     ARM_CP_RAISES_EXC            = 1 << 11,
  87     /*
  88      * Flag: Writes to the sysreg might change the exception level - typically
  89      * on older ARM chips. For those cases we need to re-read the new el when
  90      * recomputing the translation flags.
  91      */
  92     ARM_CP_NEWEL                 = 1 << 12,
  93     /*
  94      * Flag: Access check for this sysreg is identical to accessing FPU state
  95      * from an instruction: use translation fp_access_check().
  96      */
  97     ARM_CP_FPU                   = 1 << 13,
  98     /*
  99      * Flag: Access check for this sysreg is identical to accessing SVE state
 100      * from an instruction: use translation sve_access_check().
 101      */
 102     ARM_CP_SVE                   = 1 << 14,
 103     /* Flag: Do not expose in gdb sysreg xml. */
 104     ARM_CP_NO_GDB                = 1 << 15,
 105 };
 106
 107 /*
 108  * Valid values for ARMCPRegInfo state field, indicating which of
 109  * the AArch32 and AArch64 execution states this register is visible in.
 110  * If the reginfo doesn't explicitly specify then it is AArch32 only.
 111  * If the reginfo is declared to be visible in both states then a second
 112  * reginfo is synthesised for the AArch32 view of the AArch64 register,
 113  * such that the AArch32 view is the lower 32 bits of the AArch64 one.
 114  * Note that we rely on the values of these enums as we iterate through
 115  * the various states in some places.
 116  */
 117 typedef enum {
 118     ARM_CP_STATE_AA32 = 0,
 119     ARM_CP_STATE_AA64 = 1,
 120     ARM_CP_STATE_BOTH = 2,
 121 } CPState;
 122
 123 /*
 124  * ARM CP register secure state flags.  These flags identify security state
 125  * attributes for a given CP register entry.
 126  * The existence of both or neither secure and non-secure flags indicates that
 127  * the register has both a secure and non-secure hash entry.  A single one of
 128  * these flags causes the register to only be hashed for the specified
 129  * security state.
 130  * Although definitions may have any combination of the S/NS bits, each
 131  * registered entry will only have one to identify whether the entry is secure
 132  * or non-secure.
 133  */
 134 typedef enum {
 135     ARM_CP_SECSTATE_BOTH = 0,       /* define one cpreg for each secstate */
 136     ARM_CP_SECSTATE_S =   (1 << 0), /* bit[0]: Secure state register */
 137     ARM_CP_SECSTATE_NS =  (1 << 1), /* bit[1]: Non-secure state register */
 138 } CPSecureState;
 139
 140 /*
 141  * Access rights:
 142  * We define bits for Read and Write access for what rev C of the v7-AR ARM ARM
 143  * defines as PL0 (user), PL1 (fiq/irq/svc/abt/und/sys, ie privileged), and
 144  * PL2 (hyp). The other level which has Read and Write bits is Secure PL1
 145  * (ie any of the privileged modes in Secure state, or Monitor mode).
 146  * If a register is accessible in one privilege level it's always accessible
 147  * in higher privilege levels too. Since "Secure PL1" also follows this rule
 148  * (ie anything visible in PL2 is visible in S-PL1, some things are only
 149  * visible in S-PL1) but "Secure PL1" is a bit of a mouthful, we bend the
 150  * terminology a little and call this PL3.
 151  * In AArch64 things are somewhat simpler as the PLx bits line up exactly
 152  * with the ELx exception levels.
 153  *
 154  * If access permissions for a register are more complex than can be
 155  * described with these bits, then use a laxer set of restrictions, and
 156  * do the more restrictive/complex check inside a helper function.
 157  */
 158 typedef enum {
 159     PL3_R = 0x80,
 160     PL3_W = 0x40,
 161     PL2_R = 0x20 | PL3_R,
 162     PL2_W = 0x10 | PL3_W,
 163     PL1_R = 0x08 | PL2_R,
 164     PL1_W = 0x04 | PL2_W,
 165     PL0_R = 0x02 | PL1_R,
 166     PL0_W = 0x01 | PL1_W,
 167
 168     /*
 169      * For user-mode some registers are accessible to EL0 via a kernel
 170      * trap-and-emulate ABI. In this case we define the read permissions
 171      * as actually being PL0_R. However some bits of any given register
 172      * may still be masked.
 173      */
 174 #ifdef CONFIG_USER_ONLY
 175     PL0U_R = PL0_R,
 176 #else
 177     PL0U_R = PL1_R,
 178 #endif
 179
 180     PL3_RW = PL3_R | PL3_W,
 181     PL2_RW = PL2_R | PL2_W,
 182     PL1_RW = PL1_R | PL1_W,
 183     PL0_RW = PL0_R | PL0_W,
 184 } CPAccessRights;
 185
 186 typedef enum CPAccessResult {
 187     /* Access is permitted */
 188     CP_ACCESS_OK = 0,
 189
 190     /*
 191      * Combined with one of the following, the low 2 bits indicate the
 192      * target exception level.  If 0, the exception is taken to the usual
 193      * target EL (EL1 or PL1 if in EL0, otherwise to the current EL).
 194      */
 195     CP_ACCESS_EL_MASK = 3,
 196
 197     /*
 198      * Access fails due to a configurable trap or enable which would
 199      * result in a categorized exception syndrome giving information about
 200      * the failing instruction (ie syndrome category 0x3, 0x4, 0x5, 0x6,
 201      * 0xc or 0x18).
 202      */
 203     CP_ACCESS_TRAP = (1 << 2),
 204     CP_ACCESS_TRAP_EL2 = CP_ACCESS_TRAP | 2,
 205     CP_ACCESS_TRAP_EL3 = CP_ACCESS_TRAP | 3,
 206
 207     /*
 208      * Access fails and results in an exception syndrome 0x0 ("uncategorized").
 209      * Note that this is not a catch-all case -- the set of cases which may
 210      * result in this failure is specifically defined by the architecture.
 211      */
 212     CP_ACCESS_TRAP_UNCATEGORIZED = (2 << 2),
 213     CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = CP_ACCESS_TRAP_UNCATEGORIZED | 2,
 214     CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = CP_ACCESS_TRAP_UNCATEGORIZED | 3,
 215 } CPAccessResult;
 216
 217 typedef struct ARMCPRegInfo ARMCPRegInfo;
 218
 219 /*
 220  * Access functions for coprocessor registers. These cannot fail and
 221  * may not raise exceptions.
 222  */
 223 typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque);
 224 typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *opaque,
 225                        uint64_t value);
 226 /* Access permission check functions for coprocessor registers. */
 227 typedef CPAccessResult CPAccessFn(CPUARMState *env,
 228                                   const ARMCPRegInfo *opaque,
 229                                   bool isread);
 230 /* Hook function for register reset */
 231 typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *opaque);
 232
 233 #define CP_ANY 0xff
 234
 235 /* Definition of an ARM coprocessor register */
 236 struct ARMCPRegInfo {
 237     /* Name of register (useful mainly for debugging, need not be unique) */
 238     const char *name;
 239     /*
 240      * Location of register: coprocessor number and (crn,crm,opc1,opc2)
 241      * tuple. Any of crm, opc1 and opc2 may be CP_ANY to indicate a
 242      * 'wildcard' field -- any value of that field in the MRC/MCR insn
 243      * will be decoded to this register. The register read and write
 244      * callbacks will be passed an ARMCPRegInfo with the crn/crm/opc1/opc2
 245      * used by the program, so it is possible to register a wildcard and
 246      * then behave differently on read/write if necessary.
 247      * For 64 bit registers, only crm and opc1 are relevant; crn and opc2
 248      * must both be zero.
 249      * For AArch64-visible registers, opc0 is also used.
 250      * Since there are no "coprocessors" in AArch64, cp is purely used as a
 251      * way to distinguish (for KVM's benefit) guest-visible system registers
 252      * from demuxed ones provided to preserve the "no side effects on
 253      * KVM register read/write from QEMU" semantics. cp==0x13 is guest
 254      * visible (to match KVM's encoding); cp==0 will be converted to
 255      * cp==0x13 when the ARMCPRegInfo is registered, for convenience.
 256      */
 257     uint8_t cp;
 258     uint8_t crn;
 259     uint8_t crm;
 260     uint8_t opc0;
 261     uint8_t opc1;
 262     uint8_t opc2;
 263     /* Execution state in which this register is visible: ARM_CP_STATE_* */
 264     CPState state;
 265     /* Register type: ARM_CP_* bits/values */
 266     int type;
 267     /* Access rights: PL*_[RW] */
 268     CPAccessRights access;
 269     /* Security state: ARM_CP_SECSTATE_* bits/values */
 270     CPSecureState secure;
 271     /*
 272      * The opaque pointer passed to define_arm_cp_regs_with_opaque() when
 273      * this register was defined: can be used to hand data through to the
 274      * register read/write functions, since they are passed the ARMCPRegInfo*.
 275      */
 276     void *opaque;
 277     /*
 278      * Value of this register, if it is ARM_CP_CONST. Otherwise, if
 279      * fieldoffset is non-zero, the reset value of the register.
 280      */
 281     uint64_t resetvalue;
 282     /*
 283      * Offset of the field in CPUARMState for this register.
 284      * This is not needed if either:
 285      *  1. type is ARM_CP_CONST or one of the ARM_CP_SPECIALs
 286      *  2. both readfn and writefn are specified
 287      */
 288     ptrdiff_t fieldoffset; /* offsetof(CPUARMState, field) */
 289
 290     /*
 291      * Offsets of the secure and non-secure fields in CPUARMState for the
 292      * register if it is banked.  These fields are only used during the static
 293      * registration of a register.  During hashing the bank associated
 294      * with a given security state is copied to fieldoffset which is used from
 295      * there on out.
 296      *
 297      * It is expected that register definitions use either fieldoffset or
 298      * bank_fieldoffsets in the definition but not both.  It is also expected
 299      * that both bank offsets are set when defining a banked register.  This
 300      * use indicates that a register is banked.
 301      */
 302     ptrdiff_t bank_fieldoffsets[2];
 303
 304     /*
 305      * Function for making any access checks for this register in addition to
 306      * those specified by the 'access' permissions bits. If NULL, no extra
 307      * checks required. The access check is performed at runtime, not at
 308      * translate time.
 309      */
 310     CPAccessFn *accessfn;
 311     /*
 312      * Function for handling reads of this register. If NULL, then reads
 313      * will be done by loading from the offset into CPUARMState specified
 314      * by fieldoffset.
 315      */
 316     CPReadFn *readfn;
 317     /*
 318      * Function for handling writes of this register. If NULL, then writes
 319      * will be done by writing to the offset into CPUARMState specified
 320      * by fieldoffset.
 321      */
 322     CPWriteFn *writefn;
 323     /*
 324      * Function for doing a "raw" read; used when we need to copy
 325      * coprocessor state to the kernel for KVM or out for
 326      * migration. This only needs to be provided if there is also a
 327      * readfn and it has side effects (for instance clear-on-read bits).
 328      */
 329     CPReadFn *raw_readfn;
 330     /*
 331      * Function for doing a "raw" write; used when we need to copy KVM
 332      * kernel coprocessor state into userspace, or for inbound
 333      * migration. This only needs to be provided if there is also a
 334      * writefn and it masks out "unwritable" bits or has write-one-to-clear
 335      * or similar behaviour.
 336      */
 337     CPWriteFn *raw_writefn;
 338     /*
 339      * Function for resetting the register. If NULL, then reset will be done
 340      * by writing resetvalue to the field specified in fieldoffset. If
 341      * fieldoffset is 0 then no reset will be done.
 342      */
 343     CPResetFn *resetfn;
 344
 345     /*
 346      * "Original" writefn and readfn.
 347      * For ARMv8.1-VHE register aliases, we overwrite the read/write
 348      * accessor functions of various EL1/EL0 to perform the runtime
 349      * check for which sysreg should actually be modified, and then
 350      * forwards the operation.  Before overwriting the accessors,
 351      * the original function is copied here, so that accesses that
 352      * really do go to the EL1/EL0 version proceed normally.
 353      * (The corresponding EL2 register is linked via opaque.)
 354      */
 355     CPReadFn *orig_readfn;
 356     CPWriteFn *orig_writefn;
 357 };
 358
 359 /*
 360  * Macros which are lvalues for the field in CPUARMState for the
 361  * ARMCPRegInfo *ri.
 362  */
 363 #define CPREG_FIELD32(env, ri) \
 364     (*(uint32_t *)((char *)(env) + (ri)->fieldoffset))
 365 #define CPREG_FIELD64(env, ri) \
 366     (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
 367
 368 void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, const ARMCPRegInfo *reg,
 369                                        void *opaque);
 370
 371 static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
 372 {
 373     define_one_arm_cp_reg_with_opaque(cpu, regs, NULL);
 374 }
 375
 376 void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs,
 377                                         void *opaque, size_t len);
 378
 379 #define define_arm_cp_regs_with_opaque(CPU, REGS, OPAQUE)               \
 380     do {                                                                \
 381         QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0);                       \
 382         define_arm_cp_regs_with_opaque_len(CPU, REGS, OPAQUE,           \
 383                                            ARRAY_SIZE(REGS));           \
 384     } while (0)
 385
 386 #define define_arm_cp_regs(CPU, REGS) \
 387     define_arm_cp_regs_with_opaque(CPU, REGS, NULL)
 388
 389 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
 390
 391 /*
 392  * Definition of an ARM co-processor register as viewed from
 393  * userspace. This is used for presenting sanitised versions of
 394  * registers to userspace when emulating the Linux AArch64 CPU
 395  * ID/feature ABI (advertised as HWCAP_CPUID).
 396  */
 397 typedef struct ARMCPRegUserSpaceInfo {
 398     /* Name of register */
 399     const char *name;
 400
 401     /* Is the name actually a glob pattern */
 402     bool is_glob;
 403
 404     /* Only some bits are exported to user space */
 405     uint64_t exported_bits;
 406
 407     /* Fixed bits are applied after the mask */
 408     uint64_t fixed_bits;
 409 } ARMCPRegUserSpaceInfo;
 410
 411 void modify_arm_cp_regs_with_len(ARMCPRegInfo *regs, size_t regs_len,
 412                                  const ARMCPRegUserSpaceInfo *mods,
 413                                  size_t mods_len);
 414
 415 #define modify_arm_cp_regs(REGS, MODS)                                  \
 416     do {                                                                \
 417         QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0);                       \
 418         QEMU_BUILD_BUG_ON(ARRAY_SIZE(MODS) == 0);                       \
 419         modify_arm_cp_regs_with_len(REGS, ARRAY_SIZE(REGS),             \
 420                                     MODS, ARRAY_SIZE(MODS));            \
 421     } while (0)
 422
 423 /* CPWriteFn that can be used to implement writes-ignored behaviour */
 424 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
 425                          uint64_t value);
 426 /* CPReadFn that can be used for read-as-zero behaviour */
 427 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
 428
 429 /*
 430  * CPResetFn that does nothing, for use if no reset is required even
 431  * if fieldoffset is non zero.
 432  */
 433 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque);
 434
 435 /*
 436  * Return true if this reginfo struct's field in the cpu state struct
 437  * is 64 bits wide.
 438  */
 439 static inline bool cpreg_field_is_64bit(const ARMCPRegInfo *ri)
 440 {
 441     return (ri->state == ARM_CP_STATE_AA64) || (ri->type & ARM_CP_64BIT);
 442 }
 443
 444 static inline bool cp_access_ok(int current_el,
 445                                 const ARMCPRegInfo *ri, int isread)
 446 {
 447     return (ri->access >> ((current_el * 2) + isread)) & 1;
 448 }
 449
 450 /* Raw read of a coprocessor register (as needed for migration, etc) */
 451 uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri);
 452
 453 #endif /* TARGET_ARM_CPREGS_H */