8 static inline void set_feature(CPUARMState *env, int feature)
10 env->features |= 1u << feature;
13 static void cpu_reset_model_id(CPUARMState *env, uint32_t id)
15 env->cp15.c0_cpuid = id;
17 case ARM_CPUID_ARM926:
18 set_feature(env, ARM_FEATURE_VFP);
19 env->vfp.xregs[ARM_VFP_FPSID] = 0x41011090;
20 env->cp15.c0_cachetype = 0x1dd20d2;
22 case ARM_CPUID_ARM946:
23 set_feature(env, ARM_FEATURE_MPU);
24 env->cp15.c0_cachetype = 0x0f004006;
26 case ARM_CPUID_ARM1026:
27 set_feature(env, ARM_FEATURE_VFP);
28 set_feature(env, ARM_FEATURE_AUXCR);
29 env->vfp.xregs[ARM_VFP_FPSID] = 0x410110a0;
30 env->cp15.c0_cachetype = 0x1dd20d2;
32 case ARM_CPUID_PXA250:
33 case ARM_CPUID_PXA255:
34 case ARM_CPUID_PXA260:
35 case ARM_CPUID_PXA261:
36 case ARM_CPUID_PXA262:
37 set_feature(env, ARM_FEATURE_XSCALE);
38 /* JTAG_ID is ((id << 28) | 0x09265013) */
39 env->cp15.c0_cachetype = 0xd172172;
41 case ARM_CPUID_PXA270_A0:
42 case ARM_CPUID_PXA270_A1:
43 case ARM_CPUID_PXA270_B0:
44 case ARM_CPUID_PXA270_B1:
45 case ARM_CPUID_PXA270_C0:
46 case ARM_CPUID_PXA270_C5:
47 set_feature(env, ARM_FEATURE_XSCALE);
48 /* JTAG_ID is ((id << 28) | 0x09265013) */
49 set_feature(env, ARM_FEATURE_IWMMXT);
50 env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
51 env->cp15.c0_cachetype = 0xd172172;
54 cpu_abort(env, "Bad CPU ID: %x\n", id);
59 void cpu_reset(CPUARMState *env)
62 id = env->cp15.c0_cpuid;
63 memset(env, 0, offsetof(CPUARMState, breakpoints));
65 cpu_reset_model_id(env, id);
66 #if defined (CONFIG_USER_ONLY)
67 env->uncached_cpsr = ARM_CPU_MODE_USR;
68 env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
70 /* SVC mode with interrupts disabled. */
71 env->uncached_cpsr = ARM_CPU_MODE_SVC | CPSR_A | CPSR_F | CPSR_I;
72 env->vfp.xregs[ARM_VFP_FPEXC] = 0;
78 CPUARMState *cpu_arm_init(void)
82 env = qemu_mallocz(sizeof(CPUARMState));
95 static const struct arm_cpu_t arm_cpu_names[] = {
96 { ARM_CPUID_ARM926, "arm926"},
97 { ARM_CPUID_ARM946, "arm946"},
98 { ARM_CPUID_ARM1026, "arm1026"},
99 { ARM_CPUID_PXA250, "pxa250" },
100 { ARM_CPUID_PXA255, "pxa255" },
101 { ARM_CPUID_PXA260, "pxa260" },
102 { ARM_CPUID_PXA261, "pxa261" },
103 { ARM_CPUID_PXA262, "pxa262" },
104 { ARM_CPUID_PXA270, "pxa270" },
105 { ARM_CPUID_PXA270_A0, "pxa270-a0" },
106 { ARM_CPUID_PXA270_A1, "pxa270-a1" },
107 { ARM_CPUID_PXA270_B0, "pxa270-b0" },
108 { ARM_CPUID_PXA270_B1, "pxa270-b1" },
109 { ARM_CPUID_PXA270_C0, "pxa270-c0" },
110 { ARM_CPUID_PXA270_C5, "pxa270-c5" },
114 void arm_cpu_list(void)
118 printf ("Available CPUs:\n");
119 for (i = 0; arm_cpu_names[i].name; i++) {
120 printf(" %s\n", arm_cpu_names[i].name);
124 void cpu_arm_set_model(CPUARMState *env, const char *name)
131 for (i = 0; arm_cpu_names[i].name; i++) {
132 if (strcmp(name, arm_cpu_names[i].name) == 0) {
133 id = arm_cpu_names[i].id;
138 cpu_abort(env, "Unknown CPU '%s'", name);
141 cpu_reset_model_id(env, id);
144 void cpu_arm_close(CPUARMState *env)
149 #if defined(CONFIG_USER_ONLY)
151 void do_interrupt (CPUState *env)
153 env->exception_index = -1;
156 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address, int rw,
157 int is_user, int is_softmmu)
160 env->exception_index = EXCP_PREFETCH_ABORT;
161 env->cp15.c6_insn = address;
163 env->exception_index = EXCP_DATA_ABORT;
164 env->cp15.c6_data = address;
169 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
174 /* These should probably raise undefined insn exceptions. */
175 void helper_set_cp(CPUState *env, uint32_t insn, uint32_t val)
177 int op1 = (insn >> 8) & 0xf;
178 cpu_abort(env, "cp%i insn %08x\n", op1, insn);
182 uint32_t helper_get_cp(CPUState *env, uint32_t insn)
184 int op1 = (insn >> 8) & 0xf;
185 cpu_abort(env, "cp%i insn %08x\n", op1, insn);
189 void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
191 cpu_abort(env, "cp15 insn %08x\n", insn);
194 uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
196 cpu_abort(env, "cp15 insn %08x\n", insn);
200 void switch_mode(CPUState *env, int mode)
202 if (mode != ARM_CPU_MODE_USR)
203 cpu_abort(env, "Tried to switch out of user mode\n");
208 extern int semihosting_enabled;
210 /* Map CPU modes onto saved register banks. */
211 static inline int bank_number (int mode)
214 case ARM_CPU_MODE_USR:
215 case ARM_CPU_MODE_SYS:
217 case ARM_CPU_MODE_SVC:
219 case ARM_CPU_MODE_ABT:
221 case ARM_CPU_MODE_UND:
223 case ARM_CPU_MODE_IRQ:
225 case ARM_CPU_MODE_FIQ:
228 cpu_abort(cpu_single_env, "Bad mode %x\n", mode);
232 void switch_mode(CPUState *env, int mode)
237 old_mode = env->uncached_cpsr & CPSR_M;
238 if (mode == old_mode)
241 if (old_mode == ARM_CPU_MODE_FIQ) {
242 memcpy (env->fiq_regs, env->regs + 8, 5 * sizeof(uint32_t));
243 memcpy (env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
244 } else if (mode == ARM_CPU_MODE_FIQ) {
245 memcpy (env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
246 memcpy (env->regs + 8, env->fiq_regs, 5 * sizeof(uint32_t));
249 i = bank_number(old_mode);
250 env->banked_r13[i] = env->regs[13];
251 env->banked_r14[i] = env->regs[14];
252 env->banked_spsr[i] = env->spsr;
254 i = bank_number(mode);
255 env->regs[13] = env->banked_r13[i];
256 env->regs[14] = env->banked_r14[i];
257 env->spsr = env->banked_spsr[i];
260 /* Handle a CPU exception. */
261 void do_interrupt(CPUARMState *env)
268 /* TODO: Vectored interrupt controller. */
269 switch (env->exception_index) {
271 new_mode = ARM_CPU_MODE_UND;
280 if (semihosting_enabled) {
281 /* Check for semihosting interrupt. */
283 mask = lduw_code(env->regs[15] - 2) & 0xff;
285 mask = ldl_code(env->regs[15] - 4) & 0xffffff;
287 /* Only intercept calls from privileged modes, to provide some
288 semblance of security. */
289 if (((mask == 0x123456 && !env->thumb)
290 || (mask == 0xab && env->thumb))
291 && (env->uncached_cpsr & CPSR_M) != ARM_CPU_MODE_USR) {
292 env->regs[0] = do_arm_semihosting(env);
296 new_mode = ARM_CPU_MODE_SVC;
299 /* The PC already points to the next instructon. */
302 case EXCP_PREFETCH_ABORT:
304 new_mode = ARM_CPU_MODE_ABT;
306 mask = CPSR_A | CPSR_I;
309 case EXCP_DATA_ABORT:
310 new_mode = ARM_CPU_MODE_ABT;
312 mask = CPSR_A | CPSR_I;
316 new_mode = ARM_CPU_MODE_IRQ;
318 /* Disable IRQ and imprecise data aborts. */
319 mask = CPSR_A | CPSR_I;
323 new_mode = ARM_CPU_MODE_FIQ;
325 /* Disable FIQ, IRQ and imprecise data aborts. */
326 mask = CPSR_A | CPSR_I | CPSR_F;
330 cpu_abort(env, "Unhandled exception 0x%x\n", env->exception_index);
331 return; /* Never happens. Keep compiler happy. */
334 if (env->cp15.c1_sys & (1 << 13)) {
337 switch_mode (env, new_mode);
338 env->spsr = cpsr_read(env);
339 /* Switch to the new mode, and switch to Arm mode. */
340 /* ??? Thumb interrupt handlers not implemented. */
341 env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
342 env->uncached_cpsr |= mask;
344 env->regs[14] = env->regs[15] + offset;
345 env->regs[15] = addr;
346 env->interrupt_request |= CPU_INTERRUPT_EXITTB;
349 /* Check section/page access permissions.
350 Returns the page protection flags, or zero if the access is not
352 static inline int check_ap(CPUState *env, int ap, int domain, int access_type,
356 return PAGE_READ | PAGE_WRITE;
360 if (access_type == 1)
362 switch ((env->cp15.c1_sys >> 8) & 3) {
364 return is_user ? 0 : PAGE_READ;
371 return is_user ? 0 : PAGE_READ | PAGE_WRITE;
374 return (access_type == 1) ? 0 : PAGE_READ;
376 return PAGE_READ | PAGE_WRITE;
378 return PAGE_READ | PAGE_WRITE;
384 static int get_phys_addr(CPUState *env, uint32_t address, int access_type,
385 int is_user, uint32_t *phys_ptr, int *prot)
395 /* Fast Context Switch Extension. */
396 if (address < 0x02000000)
397 address += env->cp15.c13_fcse;
399 if ((env->cp15.c1_sys & 1) == 0) {
400 /* MMU/MPU disabled. */
402 *prot = PAGE_READ | PAGE_WRITE;
403 } else if (arm_feature(env, ARM_FEATURE_MPU)) {
409 for (n = 7; n >= 0; n--) {
410 base = env->cp15.c6_region[n];
413 mask = 1 << ((base >> 1) & 0x1f);
414 /* Keep this shift separate from the above to avoid an
415 (undefined) << 32. */
416 mask = (mask << 1) - 1;
417 if (((base ^ address) & ~mask) == 0)
423 if (access_type == 2) {
424 mask = env->cp15.c5_insn;
426 mask = env->cp15.c5_data;
428 mask = (mask >> (n * 4)) & 0xf;
435 *prot = PAGE_READ | PAGE_WRITE;
443 *prot = PAGE_READ | PAGE_WRITE;
454 /* Bad permission. */
458 /* Pagetable walk. */
459 /* Lookup l1 descriptor. */
460 table = (env->cp15.c2_base & 0xffffc000) | ((address >> 18) & 0x3ffc);
461 desc = ldl_phys(table);
463 domain = (env->cp15.c3 >> ((desc >> 4) & 0x1e)) & 3;
465 /* Secton translation fault. */
469 if (domain == 0 || domain == 2) {
471 code = 9; /* Section domain fault. */
473 code = 11; /* Page domain fault. */
478 phys_addr = (desc & 0xfff00000) | (address & 0x000fffff);
479 ap = (desc >> 10) & 3;
482 /* Lookup l2 entry. */
484 /* Coarse pagetable. */
485 table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
487 /* Fine pagetable. */
488 table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
490 desc = ldl_phys(table);
492 case 0: /* Page translation fault. */
495 case 1: /* 64k page. */
496 phys_addr = (desc & 0xffff0000) | (address & 0xffff);
497 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
499 case 2: /* 4k page. */
500 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
501 ap = (desc >> (4 + ((address >> 13) & 6))) & 3;
503 case 3: /* 1k page. */
504 if (arm_feature(env, ARM_FEATURE_XSCALE))
505 phys_addr = (desc & 0xfffff000) | (address & 0xfff);
508 /* Page translation fault. */
512 phys_addr = (desc & 0xfffffc00) | (address & 0x3ff);
514 ap = (desc >> 4) & 3;
517 /* Never happens, but compiler isn't smart enough to tell. */
522 *prot = check_ap(env, ap, domain, access_type, is_user);
524 /* Access permission fault. */
527 *phys_ptr = phys_addr;
531 return code | (domain << 4);
534 int cpu_arm_handle_mmu_fault (CPUState *env, target_ulong address,
535 int access_type, int is_user, int is_softmmu)
541 ret = get_phys_addr(env, address, access_type, is_user, &phys_addr, &prot);
543 /* Map a single [sub]page. */
544 phys_addr &= ~(uint32_t)0x3ff;
545 address &= ~(uint32_t)0x3ff;
546 return tlb_set_page (env, address, phys_addr, prot, is_user,
550 if (access_type == 2) {
551 env->cp15.c5_insn = ret;
552 env->cp15.c6_insn = address;
553 env->exception_index = EXCP_PREFETCH_ABORT;
555 env->cp15.c5_data = ret;
556 env->cp15.c6_data = address;
557 env->exception_index = EXCP_DATA_ABORT;
562 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
568 ret = get_phys_addr(env, addr, 0, 0, &phys_addr, &prot);
576 void helper_set_cp(CPUState *env, uint32_t insn, uint32_t val)
578 int cp_num = (insn >> 8) & 0xf;
579 int cp_info = (insn >> 5) & 7;
580 int src = (insn >> 16) & 0xf;
581 int operand = insn & 0xf;
583 if (env->cp[cp_num].cp_write)
584 env->cp[cp_num].cp_write(env->cp[cp_num].opaque,
585 cp_info, src, operand, val);
588 uint32_t helper_get_cp(CPUState *env, uint32_t insn)
590 int cp_num = (insn >> 8) & 0xf;
591 int cp_info = (insn >> 5) & 7;
592 int dest = (insn >> 16) & 0xf;
593 int operand = insn & 0xf;
595 if (env->cp[cp_num].cp_read)
596 return env->cp[cp_num].cp_read(env->cp[cp_num].opaque,
597 cp_info, dest, operand);
601 /* Return basic MPU access permission bits. */
602 static uint32_t simple_mpu_ap_bits(uint32_t val)
609 for (i = 0; i < 16; i += 2) {
610 ret |= (val >> i) & mask;
616 /* Pad basic MPU access permission bits to extended format. */
617 static uint32_t extended_mpu_ap_bits(uint32_t val)
624 for (i = 0; i < 16; i += 2) {
625 ret |= (val & mask) << i;
631 void helper_set_cp15(CPUState *env, uint32_t insn, uint32_t val)
636 op2 = (insn >> 5) & 7;
638 switch ((insn >> 16) & 0xf) {
639 case 0: /* ID codes. */
641 case 1: /* System configuration. */
644 if (!arm_feature(env, ARM_FEATURE_XSCALE) || crm == 0)
645 env->cp15.c1_sys = val;
646 /* ??? Lots of these bits are not implemented. */
647 /* This may enable/disable the MMU, so do a TLB flush. */
651 /* XScale doesn't implement AUX CR (P-Bit) but allows
652 * writing with zero and reading. */
653 if (arm_feature(env, ARM_FEATURE_XSCALE))
657 env->cp15.c1_coproc = val;
658 /* ??? Is this safe when called from within a TB? */
665 case 2: /* MMU Page table control / MPU cache control. */
666 if (arm_feature(env, ARM_FEATURE_MPU)) {
669 env->cp15.c2_data = val;
672 env->cp15.c2_insn = val;
678 env->cp15.c2_base = val;
681 case 3: /* MMU Domain access control / MPU write buffer control. */
684 case 4: /* Reserved. */
686 case 5: /* MMU Fault status / MPU access permission. */
689 if (arm_feature(env, ARM_FEATURE_MPU))
690 val = extended_mpu_ap_bits(val);
691 env->cp15.c5_data = val;
694 if (arm_feature(env, ARM_FEATURE_MPU))
695 val = extended_mpu_ap_bits(val);
696 env->cp15.c5_insn = val;
699 if (!arm_feature(env, ARM_FEATURE_MPU))
701 env->cp15.c5_data = val;
704 if (!arm_feature(env, ARM_FEATURE_MPU))
706 env->cp15.c5_insn = val;
712 case 6: /* MMU Fault address / MPU base/size. */
713 if (arm_feature(env, ARM_FEATURE_MPU)) {
716 env->cp15.c6_region[crm] = val;
720 env->cp15.c6_data = val;
723 env->cp15.c6_insn = val;
730 case 7: /* Cache control. */
731 /* No cache, so nothing to do. */
733 case 8: /* MMU TLB control. */
735 case 0: /* Invalidate all. */
738 case 1: /* Invalidate single TLB entry. */
740 /* ??? This is wrong for large pages and sections. */
741 /* As an ugly hack to make linux work we always flush a 4K
744 tlb_flush_page(env, val);
745 tlb_flush_page(env, val + 0x400);
746 tlb_flush_page(env, val + 0x800);
747 tlb_flush_page(env, val + 0xc00);
758 case 0: /* Cache lockdown. */
761 env->cp15.c9_data = val;
764 env->cp15.c9_insn = val;
770 case 1: /* TCM memory region registers. */
771 /* Not implemented. */
777 case 10: /* MMU TLB lockdown. */
778 /* ??? TLB lockdown not implemented. */
780 case 12: /* Reserved. */
782 case 13: /* Process ID. */
785 if (!arm_feature(env, ARM_FEATURE_MPU))
787 /* Unlike real hardware the qemu TLB uses virtual addresses,
788 not modified virtual addresses, so this causes a TLB flush.
790 if (env->cp15.c13_fcse != val)
792 env->cp15.c13_fcse = val;
795 /* This changes the ASID, so do a TLB flush. */
796 if (env->cp15.c13_context != val
797 && !arm_feature(env, ARM_FEATURE_MPU))
799 env->cp15.c13_context = val;
805 case 14: /* Reserved. */
807 case 15: /* Implementation specific. */
808 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
809 if (op2 == 0 && crm == 1) {
810 /* Changes cp0 to cp13 behavior, so needs a TB flush. */
812 env->cp15.c15_cpar = (val & 0x3fff) | 2;
821 /* ??? For debugging only. Should raise illegal instruction exception. */
822 cpu_abort(env, "Unimplemented cp15 register write\n");
825 uint32_t helper_get_cp15(CPUState *env, uint32_t insn)
829 op2 = (insn >> 5) & 7;
830 switch ((insn >> 16) & 0xf) {
831 case 0: /* ID codes. */
833 default: /* Device ID. */
834 return env->cp15.c0_cpuid;
835 case 1: /* Cache Type. */
836 return env->cp15.c0_cachetype;
837 case 2: /* TCM status. */
840 case 1: /* System configuration. */
842 case 0: /* Control register. */
843 return env->cp15.c1_sys;
844 case 1: /* Auxiliary control register. */
845 if (arm_feature(env, ARM_FEATURE_AUXCR))
847 if (arm_feature(env, ARM_FEATURE_XSCALE))
850 case 2: /* Coprocessor access register. */
851 return env->cp15.c1_coproc;
855 case 2: /* MMU Page table control / MPU cache control. */
856 if (arm_feature(env, ARM_FEATURE_MPU)) {
859 return env->cp15.c2_data;
862 return env->cp15.c2_insn;
868 return env->cp15.c2_base;
870 case 3: /* MMU Domain access control / MPU write buffer control. */
872 case 4: /* Reserved. */
874 case 5: /* MMU Fault status / MPU access permission. */
877 if (arm_feature(env, ARM_FEATURE_MPU))
878 return simple_mpu_ap_bits(env->cp15.c5_data);
879 return env->cp15.c5_data;
881 if (arm_feature(env, ARM_FEATURE_MPU))
882 return simple_mpu_ap_bits(env->cp15.c5_data);
883 return env->cp15.c5_insn;
885 if (!arm_feature(env, ARM_FEATURE_MPU))
887 return env->cp15.c5_data;
889 if (!arm_feature(env, ARM_FEATURE_MPU))
891 return env->cp15.c5_insn;
895 case 6: /* MMU Fault address / MPU base/size. */
896 if (arm_feature(env, ARM_FEATURE_MPU)) {
901 return env->cp15.c6_region[n];
905 return env->cp15.c6_data;
907 /* Arm9 doesn't have an IFAR, but implementing it anyway
908 shouldn't do any harm. */
909 return env->cp15.c6_insn;
914 case 7: /* Cache control. */
915 /* ??? This is for test, clean and invaidate operations that set the
916 Z flag. We can't represent N = Z = 1, so it also clears
917 the N flag. Oh well. */
920 case 8: /* MMU TLB control. */
922 case 9: /* Cache lockdown. */
925 return env->cp15.c9_data;
927 return env->cp15.c9_insn;
931 case 10: /* MMU TLB lockdown. */
932 /* ??? TLB lockdown not implemented. */
934 case 11: /* TCM DMA control. */
935 case 12: /* Reserved. */
937 case 13: /* Process ID. */
940 return env->cp15.c13_fcse;
942 return env->cp15.c13_context;
946 case 14: /* Reserved. */
948 case 15: /* Implementation specific. */
949 if (arm_feature(env, ARM_FEATURE_XSCALE)) {
950 if (op2 == 0 && (insn & 0xf) == 1)
951 return env->cp15.c15_cpar;
958 /* ??? For debugging only. Should raise illegal instruction exception. */
959 cpu_abort(env, "Unimplemented cp15 register read\n");
963 void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
964 ARMReadCPFunc *cp_read, ARMWriteCPFunc *cp_write,
967 if (cpnum < 0 || cpnum > 14) {
968 cpu_abort(env, "Bad coprocessor number: %i\n", cpnum);
972 env->cp[cpnum].cp_read = cp_read;
973 env->cp[cpnum].cp_write = cp_write;
974 env->cp[cpnum].opaque = opaque;