yuzu/unicorn
1
0
Fork 0
mirror of https://github.com/yuzu-emu/unicorn.git synced 2024-12-25 01:05:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
unicorn/qemu/target/arm/internals.h

919 lines
29 KiB
C
Raw Normal View History

import
2015-08-21 07:04:50 +00:00
/*
* QEMU ARM CPU -- internal functions and types
*
* Copyright (c) 2014 Linaro Ltd
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see
* <http://www.gnu.org/licenses/gpl-2.0.html>
*
* This header defines functions, types, etc which need to be shared
Move target-* CPU file into a target/ folder We've currently got 18 architectures in QEMU, and thus 18 target-xxx folders in the root folder of the QEMU source tree. More architectures (e.g. RISC-V, AVR) are likely to be included soon, too, so the main folder of the QEMU sources slowly gets quite overcrowded with the target-xxx folders. To disburden the main folder a little bit, let's move the target-xxx folders into a dedicated target/ folder, so that target-xxx/ simply becomes target/xxx/ instead. Backports commit fcf5ef2ab52c621a4617ebbef36bf43b4003f4c0 from qemu
2018-03-02 03:35:33 +00:00
* between different source files within target/arm/ but which are
import
2015-08-21 07:04:50 +00:00
* private to it and not required by the rest of QEMU.
*/
#ifndef TARGET_ARM_INTERNALS_H
#define TARGET_ARM_INTERNALS_H
armv7m: Fix reads of CONTROL register bit 1 The v7m CONTROL register bit 1 is SPSEL, which indicates the stack being used. We were storing this information not in v7m.control but in the separate v7m.other_sp structure field. Unfortunately, the code handling reads of the CONTROL register didn't take account of this, and so if SPSEL was updated by an exception entry or exit then a subsequent guest read of CONTROL would get the wrong value. Using a separate structure field doesn't really gain us anything in efficiency, so drop this unnecessary complexity in favour of simply storing all the bits in v7m.control. This is a migration compatibility break for M profile CPUs only. Backports commit abc24d86cc0364f402e438fae3acb14289b40734 from qemu
2018-03-02 18:25:58 +00:00
#include "hw/registerfields.h"
target-arm: Add and use symbolic names for register banks Add BANK_<cpumode> #defines to index banked registers. Backports commit 99a99c1fc8e9bfec1656ac5916c53977a93d3581 from qemu
2018-02-17 23:13:51 +00:00
/* register banks for CPU modes */
#define BANK_USRSYS 0
#define BANK_SVC 1
#define BANK_ABT 2
#define BANK_UND 3
#define BANK_IRQ 4
#define BANK_FIQ 5
#define BANK_HYP 6
#define BANK_MON 7
import
2015-08-21 07:04:50 +00:00
static inline bool excp_is_internal(int excp)
{
/* Return true if this exception number represents a QEMU-internal
* exception that will not be passed to the guest.
*/
return excp == EXCP_INTERRUPT
|| excp == EXCP_HLT
|| excp == EXCP_DEBUG
|| excp == EXCP_HALTED
|| excp == EXCP_EXCEPTION_EXIT
|| excp == EXCP_KERNEL_TRAP
target-arm: remove EXCP_STREX + cpu_exclusive_{test, info} The exception is not emitted anymore; remove it and the associated TCG variables. Backports commit 05188cc72f0399e99c92f608a8e7ca4c8e552c4b from qemu
2018-02-28 05:24:13 +00:00
|| excp == EXCP_SEMIHOST;
import
2015-08-21 07:04:50 +00:00
}
/* Scale factor for generic timers, ie number of ns per tick.
* This gives a 62.5MHz timer.
*/
#define GTIMER_SCALE 16
armv7m: Fix reads of CONTROL register bit 1 The v7m CONTROL register bit 1 is SPSEL, which indicates the stack being used. We were storing this information not in v7m.control but in the separate v7m.other_sp structure field. Unfortunately, the code handling reads of the CONTROL register didn't take account of this, and so if SPSEL was updated by an exception entry or exit then a subsequent guest read of CONTROL would get the wrong value. Using a separate structure field doesn't really gain us anything in efficiency, so drop this unnecessary complexity in favour of simply storing all the bits in v7m.control. This is a migration compatibility break for M profile CPUs only. Backports commit abc24d86cc0364f402e438fae3acb14289b40734 from qemu
2018-03-02 18:25:58 +00:00
/* Bit definitions for the v7M CONTROL register */
FIELD(V7M_CONTROL, NPRIV, 0, 1)
FIELD(V7M_CONTROL, SPSEL, 1, 1)
FIELD(V7M_CONTROL, FPCA, 2, 1)
target/arm: Implement BLXNS Implement the BLXNS instruction, which allows secure code to call non-secure code. Backports commit 3e3fa230e3b8ffe119f14ba57a6bc677a411be57 from qemu
2018-03-05 08:29:41 +00:00
FIELD(V7M_CONTROL, SFPA, 3, 1)
armv7m: Fix reads of CONTROL register bit 1 The v7m CONTROL register bit 1 is SPSEL, which indicates the stack being used. We were storing this information not in v7m.control but in the separate v7m.other_sp structure field. Unfortunately, the code handling reads of the CONTROL register didn't take account of this, and so if SPSEL was updated by an exception entry or exit then a subsequent guest read of CONTROL would get the wrong value. Using a separate structure field doesn't really gain us anything in efficiency, so drop this unnecessary complexity in favour of simply storing all the bits in v7m.control. This is a migration compatibility break for M profile CPUs only. Backports commit abc24d86cc0364f402e438fae3acb14289b40734 from qemu
2018-03-02 18:25:58 +00:00
target/arm: Add and use defines for EXCRET constants The exception-return magic values get some new bits in v8M, which makes some bit definitions for them worthwhile. We don't use the bit definitions for the switch on the low bits which checks the return type for v7M, because this is defined in the v7M ARM ARM as a set of valid values rather than via per-bit checks. Backports commit 4d1e7a4745c050f7ccac49a1c01437526b5130b5 from qemu
2018-03-05 04:12:35 +00:00
/* Bit definitions for v7M exception return payload */
FIELD(V7M_EXCRET, ES, 0, 1)
FIELD(V7M_EXCRET, RES0, 1, 1)
FIELD(V7M_EXCRET, SPSEL, 2, 1)
FIELD(V7M_EXCRET, MODE, 3, 1)
FIELD(V7M_EXCRET, FTYPE, 4, 1)
FIELD(V7M_EXCRET, DCRS, 5, 1)
FIELD(V7M_EXCRET, S, 6, 1)
FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
target/arm: Implement secure function return Secure function return happens when a non-secure function has been called using BLXNS and so has a particular magic LR value (either 0xfefffffe or 0xfeffffff). The function return via BX behaves specially when the new PC value is this magic value, in the same way that exception returns are handled. Adjust our BX excret guards so that they recognize the function return magic number as well, and perform the function-return unstacking in do_v7m_exception_exit(). Backports commit d02a8698d7ae2bfed3b11fe5b064cb0aa406863b from qemu
2018-03-05 08:33:39 +00:00
/* Minimum value which is a magic number for exception return */
#define EXC_RETURN_MIN_MAGIC 0xff000000
/* Minimum number which is a magic number for function or exception return
* when using v8M security extension
*/
#define FNC_RETURN_MIN_MAGIC 0xfefffffe
target/arm: Implement security attribute lookups for memory accesses Implement the security attribute lookups for memory accesses in the get_phys_addr() functions, causing these to generate various kinds of SecureFault for bad accesses. The major subtlety in this code relates to handling of the case when the security attributes the SAU assigns to the address don't match the current security state of the CPU. In the ARM ARM pseudocode for validating instruction accesses, the security attributes of the address determine whether the Secure or NonSecure MPU state is used. At face value, handling this would require us to encode the relevant bits of state into mmu_idx for both S and NS at once, which would result in our needing 16 mmu indexes. Fortunately we don't actually need to do this because a mismatch between address attributes and CPU state means either: * some kind of fault (usually a SecureFault, but in theory perhaps a UserFault for unaligned access to Device memory) * execution of the SG instruction in NS state from a Secure & NonSecure code region The purpose of SG is simply to flip the CPU into Secure state, so we can handle it by emulating execution of that instruction directly in arm_v7m_cpu_do_interrupt(), which means we can treat all the mismatch cases as "throw an exception" and we don't need to encode the state of the other MPU bank into our mmu_idx values. This commit doesn't include the actual emulation of SG; it also doesn't include implementation of the IDAU, which is a per-board way to specify hard-coded memory attributes for addresses, which override the CPU-internal SAU if they specify a more secure setting than the SAU is programmed to. Backports commit 35337cc391245f251bfb9134f181c33e6375d6c1 from qemu
2018-03-05 06:56:27 +00:00
/* We use a few fake FSR values for internal purposes in M profile.
* M profile cores don't have A/R format FSRs, but currently our
* get_phys_addr() code assumes A/R profile and reports failures via
* an A/R format FSR value. We then translate that into the proper
* M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
* Mostly the FSR values we use for this are those defined for v7PMSA,
* since we share some of that codepath. A few kinds of fault are
* only for M profile and have no A/R equivalent, though, so we have
* to pick a value from the reserved range (which we never otherwise
* generate) to use for these.
* These values will never be visible to the guest.
*/
#define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
#define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
target/arm: Add v8M stack limit checks on NS function calls
2018-10-08 18:12:15 +00:00
/**
* raise_exception: Raise the specified exception.
* Raise a guest exception with the specified value, syndrome register
* and target exception level. This should be called from helper functions,
* and never returns because we will longjump back up to the CPU main loop.
*/
void QEMU_NORETURN raise_exception(CPUARMState *env, uint32_t excp,
uint32_t syndrome, uint32_t target_el);
target/arm: Introduce raise_exception_ra This path uses cpu_loop_exit_restore to unwind current processor state. Backports commit 7469f6c696d74ad3b22b67c08e1e8f79e2b5d3d6 from qemu
2019-01-22 20:18:47 +00:00
/*
* Similarly, but also use unwinding to restore cpu state.
*/
void QEMU_NORETURN raise_exception_ra(CPUARMState *env, uint32_t excp,
uint32_t syndrome, uint32_t target_el,
uintptr_t ra);
import
2015-08-21 07:04:50 +00:00
/*
* For AArch64, map a given EL to an index in the banked_spsr array.
target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc) The AArch64 SPSR_EL1 register is architecturally mandated to be mapped to the AArch32 SPSR_svc register. This means its state should live in QEMU's env->banked_spsr[1] field. Correct the various places in the code that incorrectly put it in banked_spsr[0]. Backports commit 7847f9ea9fce15a9ecfb62ab72c1e84ff516b0db from qemu
2018-02-12 21:36:13 +00:00
* Note that this mapping and the AArch32 mapping defined in bank_number()
* must agree such that the AArch64<->AArch32 SPSRs have the architecturally
* mandated mapping between each other.
import
2015-08-21 07:04:50 +00:00
*/
static inline unsigned int aarch64_banked_spsr_index(unsigned int el)
{
static const unsigned int map[4] = {
target-arm: Add and use symbolic names for register banks Add BANK_<cpumode> #defines to index banked registers. Backports commit 99a99c1fc8e9bfec1656ac5916c53977a93d3581 from qemu
2018-02-17 23:13:51 +00:00
BANK_USRSYS,
BANK_SVC, /* EL1. */
BANK_HYP, /* EL2. */
BANK_MON, /* EL3. */
import
2015-08-21 07:04:50 +00:00
};
assert(el >= 1 && el <= 3);
return map[el];
}
target-arm: Move get/set_r13_banked() to op_helper.c Move get/set_r13_banked() from helper.c to op_helper.c. This will let us add exception-raising code to them, and also puts them in the same file as get/set_user_reg(), which makes some conceptual sense. (The original reason for the helper.c/op_helper.c split was that only op_helper.c had access to the CPU env pointer; this distinction has not been true for a long time, though, and so the split is now rather arbitrary.) Backports commit 72309cee482868d6c4711931c3f7e02ab9dec229 from qemu target-arm: Move bank_number() into internals.h Move bank_number()'s implementation into internals.h, so it's available in the user-mode-only compile as well. Backports commit c766568d3604082c6fd45cbabe42c48e4861a13f from qemu
2018-02-20 20:04:52 +00:00
/* Map CPU modes onto saved register banks. */
static inline int bank_number(int mode)
{
switch (mode) {
default:
case ARM_CPU_MODE_USR:
case ARM_CPU_MODE_SYS:
return BANK_USRSYS;
case ARM_CPU_MODE_SVC:
return BANK_SVC;
case ARM_CPU_MODE_ABT:
return BANK_ABT;
case ARM_CPU_MODE_UND:
return BANK_UND;
case ARM_CPU_MODE_IRQ:
return BANK_IRQ;
case ARM_CPU_MODE_FIQ:
return BANK_FIQ;
case ARM_CPU_MODE_HYP:
return BANK_HYP;
case ARM_CPU_MODE_MON:
return BANK_MON;
}
g_assert_not_reached();
}
target/arm: Hyp mode R14 is shared with User and System Hyp mode is an exception to the general rule that each AArch32 mode has its own r13, r14 and SPSR -- it has a banked r13 and SPSR but shares its r14 with User and System mode. We were incorrectly implementing it as banked, which meant that on entry to Hyp mode r14 was 0 rather than the USR/SYS r14. We provide a new function r14_bank_number() which is like the existing bank_number() but provides the index into env->banked_r14[]; bank_number() provides the index to use for env->banked_r13[] and env->banked_cpsr[]. All the points in the code that were using bank_number() to index into env->banked_r14[] are updated for consintency: * switch_mode() -- this is the only place where we fix an actual bug * aarch64_sync_32_to_64() and aarch64_sync_64_to_32(): no behavioural change as we already special-cased Hyp R14 * kvm32.c: no behavioural change since the guest can't ever be in Hyp mode, but conceptually the right thing to do * msr_banked()/mrs_banked(): we can never get to the case that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP, so no behavioural change Backports commit 593cfa2b637b92d37eef949653840dc065cdb960 from qemu
2018-11-17 02:58:25 +00:00
/**
* r14_bank_number: Map CPU mode onto register bank for r14
*
* Given an AArch32 CPU mode, return the index into the saved register
* banks to use for the R14 (LR) in that mode. This is the same as
* bank_number(), except for the special case of Hyp mode, where
* R14 is shared with USR and SYS, unlike its R13 and SPSR.
* This should be used as the index into env->banked_r14[], and
* bank_number() used for the index into env->banked_r13[] and
* env->banked_spsr[].
*/
static inline int r14_bank_number(int mode)
{
return (mode == ARM_CPU_MODE_HYP) ? BANK_USRSYS : bank_number(mode);
}
import
2015-08-21 07:04:50 +00:00
void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
void arm_translate_init(struct uc_struct *uc);
enum arm_fprounding {
FPROUNDING_TIEEVEN,
FPROUNDING_POSINF,
FPROUNDING_NEGINF,
FPROUNDING_ZERO,
FPROUNDING_TIEAWAY,
FPROUNDING_ODD
};
int arm_rmode_to_sf(int rmode);
static inline void aarch64_save_sp(CPUARMState *env, int el)
{
if (env->pstate & PSTATE_SP) {
env->sp_el[el] = env->xregs[31];
} else {
env->sp_el[0] = env->xregs[31];
}
}
static inline void aarch64_restore_sp(CPUARMState *env, int el)
{
if (env->pstate & PSTATE_SP) {
env->xregs[31] = env->sp_el[el];
} else {
env->xregs[31] = env->sp_el[0];
}
}
static inline void update_spsel(CPUARMState *env, uint32_t imm)
{
unsigned int cur_el = arm_current_el(env);
/* Update PSTATE SPSel bit; this requires us to update the
* working stack pointer in xregs[31].
*/
if (!((imm ^ env->pstate) & PSTATE_SP)) {
return;
}
aarch64_save_sp(env, cur_el);
env->pstate = deposit32(env->pstate, 0, 1, imm);
/* We rely on illegal updates to SPsel from EL0 to get trapped
* at translation time.
*/
assert(cur_el >= 1 && cur_el <= 3);
aarch64_restore_sp(env, cur_el);
}
target-arm: Add computation of starting level for S2 PTW The starting level for S2 pagetable walks is computed differently from the S1 starting level. Implement the S2 variant. Backports commit 1853d5a9dcac910322c6cc5b2fddec45fd052d25 from qemu
2018-02-17 18:23:53 +00:00
/*
* arm_pamax
* @cpu: ARMCPU
*
* Returns the implementation defined bit-width of physical addresses.
* The ARMv8 reference manuals refer to this as PAMax().
*/
static inline unsigned int arm_pamax(ARMCPU *cpu)
{
static const unsigned int pamax_map[] = {
32,
36,
40,
42,
44,
48,
};
target/arm: Move id_aa64mmfr* to ARMISARegisters At the same time, define the fields for these registers, and use those defines in arm_pamax(). Backports commit 3dc91ddbc68391f934bf6945853e99cf6810fc00 from qemu
2018-12-18 09:03:39 +00:00
unsigned int parange =
FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
target-arm: Add computation of starting level for S2 PTW The starting level for S2 pagetable walks is computed differently from the S1 starting level. Implement the S2 variant. Backports commit 1853d5a9dcac910322c6cc5b2fddec45fd052d25 from qemu
2018-02-17 18:23:53 +00:00
/* id_aa64mmfr0 is a read-only register so values outside of the
* supported mappings can be considered an implementation error. */
assert(parange < ARRAY_SIZE(pamax_map));
return pamax_map[parange];
}
import
2015-08-21 07:04:50 +00:00
/* Return true if extended addresses are enabled.
* This is always the case if our translation regime is 64 bit,
* but depends on TTBCR.EAE for 32 bit.
*/
static inline bool extended_addresses_enabled(CPUARMState *env)
{
target-arm: make TTBCR banked Adds secure and non-secure bank register suport for TTBCR. Added new struct to compartmentalize the TCR data and masks. Removed old tcr/ttbcr data and added a 4 element array of the new structs in cp15. This allows for one entry per EL. Added a CP register definition for TCR_EL3. Backports commit 11f136ee25232a00f433cefe98ee33cd614ecccc from qemu
2018-02-12 00:57:59 +00:00
TCR *tcr = &env->cp15.tcr_el[arm_is_secure(env) ? 3 : 1];
return arm_el_is_aa64(env, 1) ||
(arm_feature(env, ARM_FEATURE_LPAE) && (tcr->raw_tcr & TTBCR_EAE));
import
2015-08-21 07:04:50 +00:00
}
/* Valid Syndrome Register EC field values */
enum arm_exception_class {
EC_UNCATEGORIZED = 0x00,
EC_WFX_TRAP = 0x01,
EC_CP15RTTRAP = 0x03,
EC_CP15RRTTRAP = 0x04,
EC_CP14RTTRAP = 0x05,
EC_CP14DTTRAP = 0x06,
EC_ADVSIMDFPACCESSTRAP = 0x07,
EC_FPIDTRAP = 0x08,
EC_CP14RRTTRAP = 0x0c,
EC_ILLEGALSTATE = 0x0e,
EC_AA32_SVC = 0x11,
EC_AA32_HVC = 0x12,
EC_AA32_SMC = 0x13,
EC_AA64_SVC = 0x15,
EC_AA64_HVC = 0x16,
EC_AA64_SMC = 0x17,
EC_SYSTEMREGISTERTRAP = 0x18,
target/arm: Enforce access to ZCR_EL at translation This also makes sure that we get the correct ordering of SVE vs FP exceptions. Backports commit 490aa7f13a2ad31f92205879c4dc2387b602ef14 from qemu
2018-03-08 14:16:29 +00:00
EC_SVEACCESSTRAP = 0x19,
import
2015-08-21 07:04:50 +00:00
EC_INSNABORT = 0x20,
EC_INSNABORT_SAME_EL = 0x21,
EC_PCALIGNMENT = 0x22,
EC_DATAABORT = 0x24,
EC_DATAABORT_SAME_EL = 0x25,
EC_SPALIGNMENT = 0x26,
EC_AA32_FPTRAP = 0x28,
EC_AA64_FPTRAP = 0x2c,
EC_SERROR = 0x2f,
EC_BREAKPOINT = 0x30,
EC_BREAKPOINT_SAME_EL = 0x31,
EC_SOFTWARESTEP = 0x32,
EC_SOFTWARESTEP_SAME_EL = 0x33,
EC_WATCHPOINT = 0x34,
EC_WATCHPOINT_SAME_EL = 0x35,
EC_AA32_BKPT = 0x38,
EC_VECTORCATCH = 0x3a,
EC_AA64_BKPT = 0x3c,
};
#define ARM_EL_EC_SHIFT 26
#define ARM_EL_IL_SHIFT 25
target-arm: Split data abort syndrome generator Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Backports commit 094d028a7968236cd2b7f7b96394f7a3b8ad97c8 from qemu
2018-02-24 01:02:54 +00:00
#define ARM_EL_ISV_SHIFT 24
import
2015-08-21 07:04:50 +00:00
#define ARM_EL_IL (1 << ARM_EL_IL_SHIFT)
target-arm: Split data abort syndrome generator Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Backports commit 094d028a7968236cd2b7f7b96394f7a3b8ad97c8 from qemu
2018-02-24 01:02:54 +00:00
#define ARM_EL_ISV (1 << ARM_EL_ISV_SHIFT)
import
2015-08-21 07:04:50 +00:00
target/arm: New utility function to extract EC from syndrome Create and use a utility function to extract the EC field from a syndrome, rather than open-coding the shift. Backports commit 64b91e3f890a8c221b65c6820a5ee39107ee40f5 from qemu
2018-11-10 14:27:38 +00:00
static inline uint32_t syn_get_ec(uint32_t syn)
{
return syn >> ARM_EL_EC_SHIFT;
}
import
2015-08-21 07:04:50 +00:00
/* Utility functions for constructing various kinds of syndrome value.
* Note that in general we follow the AArch64 syndrome values; in a
* few cases the value in HSR for exceptions taken to AArch32 Hyp
target/arm: Get IL bit correct for v7 syndrome values For the v7 version of the Arm architecture, the IL bit in syndrome register values where the field is not valid was defined to be UNK/SBZP. In v8 this is RES1, which is what QEMU currently implements. Handle the desired v7 behaviour by squashing the IL bit for the affected cases: * EC == EC_UNCATEGORIZED * prefetch aborts * data aborts where ISV is 0 (The fourth case listed in the v8 Arm ARM DDI 0487C.a in section G7.2.70, "illegal state exception", can't happen on a v7 CPU.) This deals with a corner case noted in a comment. Backports commit 2ed08180db096ea5e44573529b85e09b1ed10b08 from qemu
2018-11-10 14:29:11 +00:00
* mode differs slightly, and we fix this up when populating HSR in
* arm_cpu_do_interrupt_aarch32_hyp().
target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode For traps of FP/SIMD instructions to AArch32 Hyp mode, the syndrome provided in HSR has more information than is reported to AArch64. Specifically, there are extra fields TA and coproc which indicate whether the trapped instruction was FP or SIMD. Add this extra information to the syndromes we construct, and mask it out when taking the exception to AArch64. Backports commit 4be42f4013fa1a9df47b48aae5148767bed8e80c from qemu
2018-11-10 14:36:39 +00:00
* The exception is FP/SIMD access traps -- these report extra information
* when taking an exception to AArch32. For those we include the extra coproc
* and TA fields, and mask them out when taking the exception to AArch64.
import
2015-08-21 07:04:50 +00:00
*/
static inline uint32_t syn_uncategorized(void)
{
return (EC_UNCATEGORIZED << ARM_EL_EC_SHIFT) | ARM_EL_IL;
}
static inline uint32_t syn_aa64_svc(uint32_t imm16)
{
return (EC_AA64_SVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
static inline uint32_t syn_aa64_hvc(uint32_t imm16)
{
return (EC_AA64_HVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
static inline uint32_t syn_aa64_smc(uint32_t imm16)
{
return (EC_AA64_SMC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
static inline uint32_t syn_aa32_svc(uint32_t imm16, bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_AA32_SVC << ARM_EL_EC_SHIFT) | (imm16 & 0xffff)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL);
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_aa32_hvc(uint32_t imm16)
{
return (EC_AA32_HVC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
static inline uint32_t syn_aa32_smc(void)
{
return (EC_AA32_SMC << ARM_EL_EC_SHIFT) | ARM_EL_IL;
}
static inline uint32_t syn_aa64_bkpt(uint32_t imm16)
{
return (EC_AA64_BKPT << ARM_EL_EC_SHIFT) | ARM_EL_IL | (imm16 & 0xffff);
}
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
static inline uint32_t syn_aa32_bkpt(uint32_t imm16, bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_AA32_BKPT << ARM_EL_EC_SHIFT) | (imm16 & 0xffff)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL);
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_aa64_sysregtrap(int op0, int op1, int op2,
int crn, int crm, int rt,
int isread)
{
return (EC_SYSTEMREGISTERTRAP << ARM_EL_EC_SHIFT) | ARM_EL_IL
| (op0 << 20) | (op2 << 17) | (op1 << 14) | (crn << 10) | (rt << 5)
| (crm << 1) | isread;
}
static inline uint32_t syn_cp14_rt_trap(int cv, int cond, int opc1, int opc2,
int crn, int crm, int rt, int isread,
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_CP14RTTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20) | (opc2 << 17) | (opc1 << 14)
| (crn << 10) | (rt << 5) | (crm << 1) | isread;
}
static inline uint32_t syn_cp15_rt_trap(int cv, int cond, int opc1, int opc2,
int crn, int crm, int rt, int isread,
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_CP15RTTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20) | (opc2 << 17) | (opc1 << 14)
| (crn << 10) | (rt << 5) | (crm << 1) | isread;
}
static inline uint32_t syn_cp14_rrt_trap(int cv, int cond, int opc1, int crm,
int rt, int rt2, int isread,
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_CP14RRTTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20) | (opc1 << 16)
| (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
}
static inline uint32_t syn_cp15_rrt_trap(int cv, int cond, int opc1, int crm,
int rt, int rt2, int isread,
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
return (EC_CP15RRTTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
import
2015-08-21 07:04:50 +00:00
| (cv << 24) | (cond << 20) | (opc1 << 16)
| (rt2 << 10) | (rt << 5) | (crm << 1) | isread;
}
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
import
2015-08-21 07:04:50 +00:00
{
target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode For traps of FP/SIMD instructions to AArch32 Hyp mode, the syndrome provided in HSR has more information than is reported to AArch64. Specifically, there are extra fields TA and coproc which indicate whether the trapped instruction was FP or SIMD. Add this extra information to the syndromes we construct, and mask it out when taking the exception to AArch64. Backports commit 4be42f4013fa1a9df47b48aae5148767bed8e80c from qemu
2018-11-10 14:36:39 +00:00
/* AArch32 FP trap or any AArch64 FP/SIMD trap: TA == 0 coproc == 0xa */
import
2015-08-21 07:04:50 +00:00
return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
target-arm: Correct misleading 'is_thumb' syn_* parameter names In syndrome register values, the IL bit indicates the instruction length, and is 1 for 4-byte instructions and 0 for 2-byte instructions. All A64 and A32 instructions are 4-byte, but Thumb instructions may be either 2 or 4 bytes long. Unfortunately we named the parameter to the syn_* functions for constructing syndromes "is_thumb", which falsely implies that it should be set for all Thumb instructions, rather than only the 16-bit ones. Fix the functions to name the parameter 'is_16bit' instead. Backports commit fc05f4a62c568b607ec3fe428a419bb38205b570 from qemu
2018-02-20 16:36:50 +00:00
| (is_16bit ? 0 : ARM_EL_IL)
target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode For traps of FP/SIMD instructions to AArch32 Hyp mode, the syndrome provided in HSR has more information than is reported to AArch64. Specifically, there are extra fields TA and coproc which indicate whether the trapped instruction was FP or SIMD. Add this extra information to the syndromes we construct, and mask it out when taking the exception to AArch64. Backports commit 4be42f4013fa1a9df47b48aae5148767bed8e80c from qemu
2018-11-10 14:36:39 +00:00
| (cv << 24) | (cond << 20) | 0xa;
}
static inline uint32_t syn_simd_access_trap(int cv, int cond, bool is_16bit)
{
/* AArch32 SIMD trap: TA == 1 coproc == 0 */
return (EC_ADVSIMDFPACCESSTRAP << ARM_EL_EC_SHIFT)
| (is_16bit ? 0 : ARM_EL_IL)
| (cv << 24) | (cond << 20) | (1 << 5);
import
2015-08-21 07:04:50 +00:00
}
target/arm: Enforce access to ZCR_EL at translation This also makes sure that we get the correct ordering of SVE vs FP exceptions. Backports commit 490aa7f13a2ad31f92205879c4dc2387b602ef14 from qemu
2018-03-08 14:16:29 +00:00
static inline uint32_t syn_sve_access_trap(void)
{
return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
}
import
2015-08-21 07:04:50 +00:00
static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
{
return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
target-arm: Set IL bit in syndromes for insn abort, watchpoint, swstep For some exception syndrome types, the IL bit should always be set. This includes the instruction abort, watchpoint and software step syndrome types; add the missing ARM_EL_IL bit to the syndrome values returned by syn_insn_abort(), syn_swstep() and syn_watchpoint(). Backports commit 04ce861ea545477425ad9e045eec3f61c8a27df9 from qemu
2018-02-24 21:48:48 +00:00
| ARM_EL_IL | (ea << 9) | (s1ptw << 7) | fsc;
import
2015-08-21 07:04:50 +00:00
}
target-arm: Split data abort syndrome generator Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Backports commit 094d028a7968236cd2b7f7b96394f7a3b8ad97c8 from qemu
2018-02-24 01:02:54 +00:00
static inline uint32_t syn_data_abort_no_iss(int same_el,
int ea, int cm, int s1ptw,
int wnr, int fsc)
import
2015-08-21 07:04:50 +00:00
{
return (EC_DATAABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
target-arm: Split data abort syndrome generator Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Backports commit 094d028a7968236cd2b7f7b96394f7a3b8ad97c8 from qemu
2018-02-24 01:02:54 +00:00
| ARM_EL_IL
| (ea << 9) | (cm << 8) | (s1ptw << 7) | (wnr << 6) | fsc;
}
static inline uint32_t syn_data_abort_with_iss(int same_el,
int sas, int sse, int srt,
int sf, int ar,
int ea, int cm, int s1ptw,
int wnr, int fsc,
bool is_16bit)
{
return (EC_DATAABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
| (is_16bit ? 0 : ARM_EL_IL)
| ARM_EL_ISV | (sas << 22) | (sse << 21) | (srt << 16)
| (sf << 15) | (ar << 14)
| (ea << 9) | (cm << 8) | (s1ptw << 7) | (wnr << 6) | fsc;
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_swstep(int same_el, int isv, int ex)
{
return (EC_SOFTWARESTEP << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
target-arm: Set IL bit in syndromes for insn abort, watchpoint, swstep For some exception syndrome types, the IL bit should always be set. This includes the instruction abort, watchpoint and software step syndrome types; add the missing ARM_EL_IL bit to the syndrome values returned by syn_insn_abort(), syn_swstep() and syn_watchpoint(). Backports commit 04ce861ea545477425ad9e045eec3f61c8a27df9 from qemu
2018-02-24 21:48:48 +00:00
| ARM_EL_IL | (isv << 24) | (ex << 6) | 0x22;
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_watchpoint(int same_el, int cm, int wnr)
{
return (EC_WATCHPOINT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
target-arm: Set IL bit in syndromes for insn abort, watchpoint, swstep For some exception syndrome types, the IL bit should always be set. This includes the instruction abort, watchpoint and software step syndrome types; add the missing ARM_EL_IL bit to the syndrome values returned by syn_insn_abort(), syn_swstep() and syn_watchpoint(). Backports commit 04ce861ea545477425ad9e045eec3f61c8a27df9 from qemu
2018-02-24 21:48:48 +00:00
| ARM_EL_IL | (cm << 8) | (wnr << 6) | 0x22;
import
2015-08-21 07:04:50 +00:00
}
static inline uint32_t syn_breakpoint(int same_el)
{
return (EC_BREAKPOINT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
| ARM_EL_IL | 0x22;
}
fix WFI/WFE length in syndrome register WFI/E are often, but not always, 4 bytes long. When they are, we need to set ARM_EL_IL_SHIFT in the syndrome register. Pass the instruction length to HELPER(wfi), use it to decrement pc appropriately and to pass an is_16bit flag to syn_wfx, which sets ARM_EL_IL_SHIFT if needed. Set dc->insn in both arm_tr_translate_insn and thumb_tr_translate_insn. Backports commit 58803318e5a546b2eb0efd7a053ed36b6c29ae6f from qemu
2018-03-05 16:21:40 +00:00
static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
target-arm: Add WFx syndrome function Adds a utility function for creating a WFx exception syndrome Backports commit 06fbb2fdf7a7ac468d62c66cfe4537d3c71f7bb9 from qemu
2018-02-13 02:33:00 +00:00
{
return (EC_WFX_TRAP << ARM_EL_EC_SHIFT) |
fix WFI/WFE length in syndrome register WFI/E are often, but not always, 4 bytes long. When they are, we need to set ARM_EL_IL_SHIFT in the syndrome register. Pass the instruction length to HELPER(wfi), use it to decrement pc appropriately and to pass an is_16bit flag to syn_wfx, which sets ARM_EL_IL_SHIFT if needed. Set dc->insn in both arm_tr_translate_insn and thumb_tr_translate_insn. Backports commit 58803318e5a546b2eb0efd7a053ed36b6c29ae6f from qemu
2018-03-05 16:21:40 +00:00
(is_16bit ? 0 : (1 << ARM_EL_IL_SHIFT)) |
target-arm: Add WFx syndrome function Adds a utility function for creating a WFx exception syndrome Backports commit 06fbb2fdf7a7ac468d62c66cfe4537d3c71f7bb9 from qemu
2018-02-13 02:33:00 +00:00
(cv << 24) | (cond << 20) | ti;
}
import
2015-08-21 07:04:50 +00:00
/* Update a QEMU watchpoint based on the information the guest has set in the
* DBGWCR<n>_EL1 and DBGWVR<n>_EL1 registers.
*/
void hw_watchpoint_update(ARMCPU *cpu, int n);
/* Update the QEMU watchpoints for every guest watchpoint. This does a
* complete delete-and-reinstate of the QEMU watchpoint list and so is
* suitable for use after migration or on reset.
*/
void hw_watchpoint_update_all(ARMCPU *cpu);
/* Update a QEMU breakpoint based on the information the guest has set in the
* DBGBCR<n>_EL1 and DBGBVR<n>_EL1 registers.
*/
void hw_breakpoint_update(ARMCPU *cpu, int n);
/* Update the QEMU breakpoints for every guest breakpoint. This does a
* complete delete-and-reinstate of the QEMU breakpoint list and so is
* suitable for use after migration or on reset.
*/
void hw_breakpoint_update_all(ARMCPU *cpu);
target-arm: Implement checking of fired watchpoint ARM stops before access to a location covered by watchpoint. Also, QEMU watchpoint fire is not necessarily an architectural watchpoint match. Unfortunately, that is hardly possible to ignore a fired watchpoint in debug exception handler. So move watchpoint check from debug exception handler to the dedicated watchpoint checking callback. Backports commit 3826121d9298cde1d29ead05910e1f40125ee9b0 from qemu
2018-02-20 16:50:26 +00:00
/* Callback function for checking if a watchpoint should trigger. */
bool arm_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
arm: Correctly handle watchpoints for BE32 CPUs In BE32 mode, sub-word size watchpoints can fail to trigger because the address of the access is adjusted in the opcode helpers before being compared with the watchpoint registers. This patch reverses the address adjustment before performing the comparison with the help of a new CPUClass hook. This version of the patch augments and tidies up comments a little. Backports commit 40612000599e52e792d23c998377a0fa429c4036 from qemu
2018-03-02 05:24:19 +00:00
/* Adjust addresses (in BE32 mode) before testing against watchpoint
* addresses.
*/
vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len);
import
2015-08-21 07:04:50 +00:00
/* Callback function for when a watchpoint or breakpoint triggers. */
void arm_debug_excp_handler(CPUState *cs);
#ifdef CONFIG_USER_ONLY
static inline bool arm_is_psci_call(ARMCPU *cpu, int excp_type)
{
return false;
}
#else
/* Return true if the r0/x0 value indicates that this SMC/HVC is a PSCI call. */
bool arm_is_psci_call(ARMCPU *cpu, int excp_type);
/* Actually handle a PSCI call */
void arm_handle_psci_call(ARMCPU *cpu);
#endif
target/arm: Clear exclusive monitor on v7M reset, exception entry/exit For M profile we must clear the exclusive monitor on reset, exception entry and exception exit. We weren't doing any of these things; fix this bug. Backports commit dc3c4c14f0f12854dbd967be3486f4db4e66d25b from qemu
2018-03-05 04:09:38 +00:00
/**
* arm_clear_exclusive: clear the exclusive monitor
* @env: CPU env
* Clear the CPU's exclusive monitor, like the guest CLREX instruction.
*/
static inline void arm_clear_exclusive(CPUARMState *env)
{
env->exclusive_addr = -1;
}
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
/**
* ARMFaultType: type of an ARM MMU fault
* This corresponds to the v8A pseudocode's Fault enumeration,
* with extensions for QEMU internal conditions.
*/
typedef enum ARMFaultType {
ARMFault_None,
ARMFault_AccessFlag,
ARMFault_Alignment,
ARMFault_Background,
ARMFault_Domain,
ARMFault_Permission,
ARMFault_Translation,
ARMFault_AddressSize,
ARMFault_SyncExternal,
ARMFault_SyncExternalOnWalk,
ARMFault_SyncParity,
ARMFault_SyncParityOnWalk,
ARMFault_AsyncParity,
ARMFault_AsyncExternal,
ARMFault_Debug,
ARMFault_TLBConflict,
ARMFault_Lockdown,
ARMFault_Exclusive,
ARMFault_ICacheMaint,
ARMFault_QEMU_NSCExec, /* v8M: NS executing in S&NSC memory */
ARMFault_QEMU_SFault, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */
} ARMFaultType;
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
/**
* ARMMMUFaultInfo: Information describing an ARM MMU Fault
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
* @type: Type of fault
* @level: Table walk level (for translation, access flag and permission faults)
* @domain: Domain of the fault address (for non-LPAE CPUs only)
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
* @s2addr: Address that caused a fault at stage 2
* @stage2: True if we faulted at stage 2
* @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
target/arm: Allow deliver_fault() caller to specify EA bit For external aborts, we will want to be able to specify the EA (external abort type) bit in the syndrome field. Allow callers of deliver_fault() to do that by adding a field to ARMMMUFaultInfo which we use when constructing the syndrome values. Backports commit c528af7aa64f159eb30b46e567b650c5440fc117 from qemu
2018-03-04 18:20:21 +00:00
* @ea: True if we should set the EA (external abort type) bit in syndrome
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
*/
typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
struct ARMMMUFaultInfo {
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
ARMFaultType type;
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
target_ulong s2addr;
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
int level;
int domain;
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
bool stage2;
bool s1ptw;
target/arm: Allow deliver_fault() caller to specify EA bit For external aborts, we will want to be able to specify the EA (external abort type) bit in the syndrome field. Allow callers of deliver_fault() to do that by adding a field to ARMMMUFaultInfo which we use when constructing the syndrome values. Backports commit c528af7aa64f159eb30b46e567b650c5440fc117 from qemu
2018-03-04 18:20:21 +00:00
bool ea;
target-arm: Add ARMMMUFaultInfo Introduce ARMMMUFaultInfo to propagate MMU Fault information across the MMU translation code path. This is in preparation for adding Stage-2 translation. No functional changes. Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 18:31:58 +00:00
};
target/arm: Provide fault type enum and FSR conversion functions Currently get_phys_addr() and its various subfunctions return a hard-coded fault status register value for translation failures. This is awkward because FSR values these days may be either long-descriptor format or short-descriptor format. Worse, the right FSR type to use doesn't depend only on the translation table being walked -- some cases, like fault info reported to AArch32 EL2 for some kinds of ATS operation, must be in long-descriptor format even if the translation table being walked was short format. We can't get those cases right with our current approach. Provide fields in the ARMMMUFaultInfo struct which allow get_phys_addr() to provide sufficient information for a caller to construct an FSR value themselves, and utility functions which do this for both long and short format FSR values, as a first step in switching get_phys_addr() and its children to only returning the failure cause in the ARMMMUFaultInfo struct. Backports commit 1fa498fe0de979030bd1f481046e9f1c5574a584 from qemu
2018-03-05 18:30:26 +00:00
/**
* arm_fi_to_sfsc: Convert fault info struct to short-format FSC
* Compare pseudocode EncodeSDFSC(), though unlike that function
* we set up a whole FSR-format code including domain field and
* putting the high bit of the FSC into bit 10.
*/
static inline uint32_t arm_fi_to_sfsc(ARMMMUFaultInfo *fi)
{
uint32_t fsc;
switch (fi->type) {
case ARMFault_None:
return 0;
case ARMFault_AccessFlag:
fsc = fi->level == 1 ? 0x3 : 0x6;
break;
case ARMFault_Alignment:
fsc = 0x1;
break;
case ARMFault_Permission:
fsc = fi->level == 1 ? 0xd : 0xf;
break;
case ARMFault_Domain:
fsc = fi->level == 1 ? 0x9 : 0xb;
break;
case ARMFault_Translation:
fsc = fi->level == 1 ? 0x5 : 0x7;
break;
case ARMFault_SyncExternal:
fsc = 0x8 | (fi->ea << 12);
break;
case ARMFault_SyncExternalOnWalk:
fsc = fi->level == 1 ? 0xc : 0xe;
fsc |= (fi->ea << 12);
break;
case ARMFault_SyncParity:
fsc = 0x409;
break;
case ARMFault_SyncParityOnWalk:
fsc = fi->level == 1 ? 0x40c : 0x40e;
break;
case ARMFault_AsyncParity:
fsc = 0x408;
break;
case ARMFault_AsyncExternal:
fsc = 0x406 | (fi->ea << 12);
break;
case ARMFault_Debug:
fsc = 0x2;
break;
case ARMFault_TLBConflict:
fsc = 0x400;
break;
case ARMFault_Lockdown:
fsc = 0x404;
break;
case ARMFault_Exclusive:
fsc = 0x405;
break;
case ARMFault_ICacheMaint:
fsc = 0x4;
break;
case ARMFault_Background:
fsc = 0x0;
break;
case ARMFault_QEMU_NSCExec:
fsc = M_FAKE_FSR_NSC_EXEC;
break;
case ARMFault_QEMU_SFault:
fsc = M_FAKE_FSR_SFAULT;
break;
default:
/* Other faults can't occur in a context that requires a
* short-format status code.
*/
g_assert_not_reached();
}
fsc |= (fi->domain << 4);
return fsc;
}
/**
* arm_fi_to_lfsc: Convert fault info struct to long-format FSC
* Compare pseudocode EncodeLDFSC(), though unlike that function
* we fill in also the LPAE bit 9 of a DFSR format.
*/
static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
{
uint32_t fsc;
switch (fi->type) {
case ARMFault_None:
return 0;
case ARMFault_AddressSize:
fsc = fi->level & 3;
break;
case ARMFault_AccessFlag:
fsc = (fi->level & 3) | (0x2 << 2);
break;
case ARMFault_Permission:
fsc = (fi->level & 3) | (0x3 << 2);
break;
case ARMFault_Translation:
fsc = (fi->level & 3) | (0x1 << 2);
break;
case ARMFault_SyncExternal:
fsc = 0x10 | (fi->ea << 12);
break;
case ARMFault_SyncExternalOnWalk:
fsc = (fi->level & 3) | (0x5 << 2) | (fi->ea << 12);
break;
case ARMFault_SyncParity:
fsc = 0x18;
break;
case ARMFault_SyncParityOnWalk:
fsc = (fi->level & 3) | (0x7 << 2);
break;
case ARMFault_AsyncParity:
fsc = 0x19;
break;
case ARMFault_AsyncExternal:
fsc = 0x11 | (fi->ea << 12);
break;
case ARMFault_Alignment:
fsc = 0x21;
break;
case ARMFault_Debug:
fsc = 0x22;
break;
case ARMFault_TLBConflict:
fsc = 0x30;
break;
case ARMFault_Lockdown:
fsc = 0x34;
break;
case ARMFault_Exclusive:
fsc = 0x35;
break;
default:
/* Other faults can't occur in a context that requires a
* long-format status code.
*/
g_assert_not_reached();
}
fsc |= 1 << 9;
return fsc;
}
target/arm: Handle page table walk load failures correctly Instead of ignoring the response from address_space_ld*() (indicating an attempt to read a page table descriptor from an invalid physical address), use it to report the failure correctly. Since this is another couple of locations where we need to decide the value of the ARMMMUFaultInfo ea bit based on a MemTxResult, we factor out that operation into a helper function. Backports commit 3b39d734141a71296d08af3d4c32f872fafd782e from qemu
2018-03-06 13:55:06 +00:00
static inline bool arm_extabort_type(MemTxResult result)
{
/* The EA bit in syndromes and fault status registers is an
* IMPDEF classification of external aborts. ARM implementations
* usually use this to indicate AXI bus Decode error (0) or
* Slave error (1); in QEMU we follow that.
*/
return result != MEMTX_DECODE_ERROR;
}
target-arm: Move setting of exception info into tlb_fill Move the code which sets exception information out of arm_cpu_handle_mmu_fault and into tlb_fill. tlb_fill is the only caller which wants to raise_exception() so it makes more sense for it to handle the whole of the exception setup. As part of this cleanup, move the user-mode-only implementation function for the handle_mmu_fault CPU method into cpu.c so we don't need to make it globally visible, and rename the softmmu-only utility function arm_cpu_handle_mmu_fault to arm_tlb_fill so it's clear that it's not the same thing. Backports commit 8c6084bf10fe721929ca94cf16acd6687e61d3ec from qemu
2018-02-13 03:26:33 +00:00
/* Do a page table walk and add page to TLB if possible */
target/arm: Use MMUAccessType enum rather than int In the ARM get_phys_addr() code, switch to using the MMUAccessType enum and its MMU_* values rather than int and literal 0/1/2. Backports commit 03ae85f858fc46495258a5dd4551fff2c34bd495 from qemu
2018-03-04 17:45:10 +00:00
bool arm_tlb_fill(CPUState *cpu, vaddr address,
MMUAccessType access_type, int mmu_idx,
target/arm: Extend PAR format determination Now that do_ats_write() is entirely in control of whether to generate a 32-bit PAR or a 64-bit PAR, we can make it use the correct (complicated) condition for doing so. Backports commit 1313e2d7e2cd8b21741e0cf542eb09dfc4188f79 from qemu
2018-03-05 19:08:43 +00:00
ARMMMUFaultInfo *fi);
target-arm: Move setting of exception info into tlb_fill Move the code which sets exception information out of arm_cpu_handle_mmu_fault and into tlb_fill. tlb_fill is the only caller which wants to raise_exception() so it makes more sense for it to handle the whole of the exception setup. As part of this cleanup, move the user-mode-only implementation function for the handle_mmu_fault CPU method into cpu.c so we don't need to make it globally visible, and rename the softmmu-only utility function arm_cpu_handle_mmu_fault to arm_tlb_fill so it's clear that it's not the same thing. Backports commit 8c6084bf10fe721929ca94cf16acd6687e61d3ec from qemu
2018-02-13 03:26:33 +00:00
target-arm: Use the right MMU index in arm_regime_using_lpae_format arm_regime_using_lpae_format checks whether the LPAE extension is used for stage 1 translation regimes. MMU indexes not exclusively of a stage 1 regime won't work with this method. In case of ARMMMUIdx_S12NSE0 or ARMMMUIdx_S12NSE1, offset these values by ARMMMUIdx_S1NSE0 to get the right index indicating a stage 1 translation regime. Rename also the function to arm_s1_regime_using_lpae_format and update the comments to reflect the change. Backports commit deb2db996cbb9470b39ae1e383791ef34c4eb3c2 from qemu
2018-02-18 01:54:16 +00:00
/* Return true if the stage 1 translation regime is using LPAE format page
* tables */
bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx);
target-arm: raise exception on misaligned LDREX operands Qemu does not generally perform alignment checks. However, the ARM ARM requires implementation of alignment exceptions for a number of cases including LDREX, and Windows-on-ARM relies on this. This change adds plumbing to enable alignment checks on loads using MO_ALIGN, a do_unaligned_access hook to raise the exception (data abort), and uses the new aligned loads in LDREX (for all but single-byte loads). Backports commit 30901475b91ef1f46304404ab4bfe89097f61b96 from qemu
2018-02-18 00:28:14 +00:00
/* Raise a data fault alignment exception for the specified virtual address */
Fix confusing argument names in some common functions There are functions tlb_fill(), cpu_unaligned_access() and do_unaligned_access() that are called with access type and mmu index arguments. But these arguments are named 'is_write' and 'is_user' in their declarations. The patches fix the arguments to avoid a confusion. Backports commit b35399bb4e9968296a12303b00f9f2066470e987 from qemu
2018-02-25 08:52:50 +00:00
void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
MMUAccessType access_type,
int mmu_idx, uintptr_t retaddr);
target-arm: raise exception on misaligned LDREX operands Qemu does not generally perform alignment checks. However, the ARM ARM requires implementation of alignment exceptions for a number of cases including LDREX, and Windows-on-ARM relies on this. This change adds plumbing to enable alignment checks on loads using MO_ALIGN, a do_unaligned_access hook to raise the exception (data abort), and uses the new aligned loads in LDREX (for all but single-byte loads). Backports commit 30901475b91ef1f46304404ab4bfe89097f61b96 from qemu
2018-02-18 00:28:14 +00:00
boards.h: Define new flag ignore_memory_transaction_failures Define a new MachineClass field ignore_memory_transaction_failures. If this is flag is true then the CPU will ignore memory transaction failures which should cause the CPU to take an exception due to an access to an unassigned physical address; the transaction will instead return zero (for a read) or be ignored (for a write). This should be set only by legacy board models which rely on the old RAZ/WI behaviour for handling devices that QEMU does not yet model. New board models should instead use "unimplemented-device" for all memory ranges where the guest will attempt to probe for a device that QEMU doesn't implement and a stub device is required. We need this for ARM boards, where we're about to implement support for generating external aborts on memory transaction failures. Too many of our legacy board models rely on the RAZ/WI behaviour and we would break currently working guests when their "probe for device" code provoked an external abort rather than a RAZ. Backports commit ed860129acd3fcd0b1e47884e810212aaca4d21b from qemu
2018-03-05 02:25:04 +00:00
/* arm_cpu_do_transaction_failed: handle a memory system error response
* (eg "no device/memory present at address") by raising an external abort
* exception
*/
void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
vaddr addr, unsigned size,
MMUAccessType access_type,
int mmu_idx, MemTxAttrs attrs,
MemTxResult response, uintptr_t retaddr);
target/arm: Support multiple EL change hooks Backports commit 08267487c99e8150382420936ab72c1e0ad74ce3 from qemu
2018-04-26 13:13:27 +00:00
/* Call any registered EL change hooks */
target/arm: Add pre-EL change hooks Because the design of the PMU requires that the counter values be converted between their delta and guest-visible forms for mode filtering, an additional hook which occurs before the EL is changed is necessary. Backports commit b5c53d1b3886387874f8c8582b205aeb3e4c3df6 from qemu
2018-04-26 13:19:21 +00:00
static inline void arm_call_pre_el_change_hook(ARMCPU *cpu)
{
ARMELChangeHook *hook, *next;
QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
hook->hook(cpu, hook->opaque);
}
}
target-arm: Provide hook to tell GICv3 about changes of security state The GICv3 CPU interface needs to know when the CPU it is attached to makes an exception level or mode transition that changes the security state, because whether it is asserting IRQ or FIQ can change depending on these things. Provide a mechanism for letting the GICv3 device register a hook to be called on such changes. Backports commit bd7d00fc50c9960876dd194ebf0c88889b53e765 from qemu
2018-02-25 00:07:35 +00:00
static inline void arm_call_el_change_hook(ARMCPU *cpu)
{
target/arm: Support multiple EL change hooks Backports commit 08267487c99e8150382420936ab72c1e0ad74ce3 from qemu
2018-04-26 13:13:27 +00:00
ARMELChangeHook *hook, *next;
QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
hook->hook(cpu, hook->opaque);
target-arm: Provide hook to tell GICv3 about changes of security state The GICv3 CPU interface needs to know when the CPU it is attached to makes an exception level or mode transition that changes the security state, because whether it is asserting IRQ or FIQ can change depending on these things. Provide a mechanism for letting the GICv3 device register a hook to be called on such changes. Backports commit bd7d00fc50c9960876dd194ebf0c88889b53e765 from qemu
2018-02-25 00:07:35 +00:00
}
}
target/arm: Move regime_is_secure() to target/arm/internals.h Move the regime_is_secure() utility function to internals.h; we are going to want to call it from translate.c. Backports commit 61fcd69b0db268e7612b07fadc436b93def91768 from qemu
2018-03-05 02:14:04 +00:00
/* Return true if this address translation regime is secure */
static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
{
switch (mmu_idx) {
case ARMMMUIdx_S12NSE0:
case ARMMMUIdx_S12NSE1:
case ARMMMUIdx_S1NSE0:
case ARMMMUIdx_S1NSE1:
case ARMMMUIdx_S1E2:
case ARMMMUIdx_S2NS:
target/arm: Split M profile MNegPri mmu index into user and priv For M profile, we currently have an mmu index MNegPri for "requested execution priority negative". This fails to distinguish "requested execution priority negative, privileged" from "requested execution priority negative, usermode", but the two can return different results for MPU lookups. Fix this by splitting MNegPri into MNegPriPriv and MNegPriUser, and similarly for the Secure equivalent MSNegPri. This takes us from 6 M profile MMU modes to 8, which means we need to bump NB_MMU_MODES; this is OK since the point where we are forced to reduce TLB sizes is 9 MMU modes. (It would in theory be possible to stick with 6 MMU indexes: {mpu-disabled,user,privileged} x {secure,nonsecure} since in the MPU-disabled case the result of an MPU lookup is always the same for both user and privileged code. However we would then need to rework the TB flags handling to put user/priv into the TB flags separately from the mmuidx. Adding an extra couple of mmu indexes is simpler.) Backports commit 62593718d77c06ad2b5e942727cead40775d2395 from qemu
2018-03-05 18:13:42 +00:00
case ARMMMUIdx_MPrivNegPri:
case ARMMMUIdx_MUserNegPri:
target/arm: Move regime_is_secure() to target/arm/internals.h Move the regime_is_secure() utility function to internals.h; we are going to want to call it from translate.c. Backports commit 61fcd69b0db268e7612b07fadc436b93def91768 from qemu
2018-03-05 02:14:04 +00:00
case ARMMMUIdx_MPriv:
case ARMMMUIdx_MUser:
return false;
case ARMMMUIdx_S1E3:
case ARMMMUIdx_S1SE0:
case ARMMMUIdx_S1SE1:
target/arm: Split M profile MNegPri mmu index into user and priv For M profile, we currently have an mmu index MNegPri for "requested execution priority negative". This fails to distinguish "requested execution priority negative, privileged" from "requested execution priority negative, usermode", but the two can return different results for MPU lookups. Fix this by splitting MNegPri into MNegPriPriv and MNegPriUser, and similarly for the Secure equivalent MSNegPri. This takes us from 6 M profile MMU modes to 8, which means we need to bump NB_MMU_MODES; this is OK since the point where we are forced to reduce TLB sizes is 9 MMU modes. (It would in theory be possible to stick with 6 MMU indexes: {mpu-disabled,user,privileged} x {secure,nonsecure} since in the MPU-disabled case the result of an MPU lookup is always the same for both user and privileged code. However we would then need to rework the TB flags handling to put user/priv into the TB flags separately from the mmuidx. Adding an extra couple of mmu indexes is simpler.) Backports commit 62593718d77c06ad2b5e942727cead40775d2395 from qemu
2018-03-05 18:13:42 +00:00
case ARMMMUIdx_MSPrivNegPri:
case ARMMMUIdx_MSUserNegPri:
target/arm: Move regime_is_secure() to target/arm/internals.h Move the regime_is_secure() utility function to internals.h; we are going to want to call it from translate.c. Backports commit 61fcd69b0db268e7612b07fadc436b93def91768 from qemu
2018-03-05 02:14:04 +00:00
case ARMMMUIdx_MSPriv:
case ARMMMUIdx_MSUser:
return true;
default:
g_assert_not_reached();
}
}
target/arm: Factor out code to calculate FSR for debug exceptions When a debug exception is taken to AArch32, it appears as a Prefetch Abort, and the Instruction Fault Status Register (IFSR) must be set. The IFSR has two possible formats, depending on whether LPAE is in use. Factor out the code in arm_debug_excp_handler() which picks an FSR value into its own utility function, update it to use arm_fi_to_lfsc() and arm_fi_to_sfsc() rather than hard-coded constants, and use the correct condition to select long or short format. In particular this fixes a bug where we could select the short format because we're at EL0 and the EL1 translation regime is not using LPAE, but then route the debug exception to EL2 because of MDCR_EL2.TDE and hand EL2 the wrong format FSR. Backports commit 81621d9ab8a0f07956e67850b15eebf6d6992eec from qemu
2018-03-25 20:35:12 +00:00
/* Return the FSR value for a debug exception (watchpoint, hardware
* breakpoint or BKPT insn) targeting the specified exception level.
*/
static inline uint32_t arm_debug_exception_fsr(CPUARMState *env)
{
ARMMMUFaultInfo fi = { ARMFault_Debug };
int target_el = arm_debug_target_el(env);
bool using_lpae = false;
if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
using_lpae = true;
} else {
if (arm_feature(env, ARM_FEATURE_LPAE) &&
(env->cp15.tcr_el[target_el].raw_tcr & TTBCR_EAE)) {
using_lpae = true;
}
}
if (using_lpae) {
return arm_fi_to_lfsc(&fi);
} else {
return arm_fi_to_sfsc(&fi);
}
}
target/arm: Pass TCGMemOpIdx to sve memory helpers There is quite a lot of code required to compute cpu_mem_index, or even put together the full TCGMemOpIdx. This can easily be done at translation time. Backports commit 500d04843ba953dc4560e44f04001efec38c14a6 from qemu
2018-10-08 17:36:57 +00:00
/* Note make_memop_idx reserves 4 bits for mmu_idx, and MO_BSWAP is bit 3.
* Thus a TCGMemOpIdx, without any MO_ALIGN bits, fits in 8 bits.
*/
#define MEMOPIDX_SHIFT 8
target/arm: Move v7m_using_psp() to internals.h We're going to want v7m_using_psp() in op_helper.c in the next patch, so move it from helper.c to internals.h. Backports commit 5529bf188d996391ff52a0e1801daf9c6a6bfcb0 from qemu
2018-10-08 17:50:21 +00:00
/**
* v7m_using_psp: Return true if using process stack pointer
* Return true if the CPU is currently using the process stack
* pointer, or false if it is using the main stack pointer.
*/
static inline bool v7m_using_psp(CPUARMState *env)
{
/* Handler mode always uses the main stack; for thread mode
* the CONTROL.SPSEL bit determines the answer.
* Note that in v7M it is not possible to be in Handler mode with
* CONTROL.SPSEL non-zero, but in v8M it is, so we must check both.
*/
return !arm_v7m_is_handler_mode(env) &&
env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
}
target/arm: Add v8M stack checks on ADD/SUB/MOV of SP Add code to insert calls to a helper function to do the stack limit checking when we handle these forms of instruction that write to SP: * ADD (SP plus immediate) * ADD (SP plus register) * SUB (SP minus immediate) * SUB (SP minus register) * MOV (register) Backports commit 5520318939fea5d659bf808157cd726cb967b761 from qemu
2018-10-08 17:58:07 +00:00
/**
* v7m_sp_limit: Return SP limit for current CPU state
* Return the SP limit value for the current CPU security state
* and stack pointer.
*/
static inline uint32_t v7m_sp_limit(CPUARMState *env)
{
if (v7m_using_psp(env)) {
return env->v7m.psplim[env->v7m.secure];
} else {
return env->v7m.msplim[env->v7m.secure];
}
}
target/arm: Improve debug logging of AArch32 exception return For AArch32, exception return happens through certain kinds of CPSR write. We don't currently have any CPU_LOG_INT logging of these events (unlike AArch64, where we log in the ERET instruction). Add some suitable logging. This will log exception returns like this: Exception return from AArch32 hyp to usr PC 0x80100374 paralleling the existing logging in the exception_return helper for AArch64 exception returns: Exception return from AArch64 EL2 to AArch64 EL0 PC 0x8003045c Exception return from AArch64 EL2 to AArch32 EL0 PC 0x8003045c (Note that an AArch32 exception return can only be AArch32->AArch32, never to AArch64.) Backports commit 81e3728407bf4a12f83e14fd410d5f0a7d29b5b4 from qemu
2018-11-10 14:09:47 +00:00
/**
* aarch32_mode_name(): Return name of the AArch32 CPU mode
* @psr: Program Status Register indicating CPU mode
*
* Returns, for debug logging purposes, a printable representation
* of the AArch32 CPU mode ("svc", "usr", etc) as indicated by
* the low bits of the specified PSR.
*/
static inline const char *aarch32_mode_name(uint32_t psr)
{
static const char cpu_mode_names[16][4] = {
"usr", "fiq", "irq", "svc", "???", "???", "mon", "abt",
"???", "???", "hyp", "und", "???", "???", "???", "sys"
};
return cpu_mode_names[psr & 0xf];
}
target/arm: Correctly implement handling of HCR_EL2.{VI, VF} In commit 8a0fc3a29fc2315325400 we tried to implement HCR_EL2.{VI,VF}, but we got it wrong and had to revert it. In that commit we implemented them as simply tracking whether there is a pending virtual IRQ or virtual FIQ. This is not correct -- these bits cause a software-generated VIRQ/VFIQ, which is distinct from whether there is a hardware-generated VIRQ/VFIQ caused by the external interrupt controller. So we need to track separately the HCR_EL2 bit state and the external virq/vfiq line state, and OR the two together to get the actual pending VIRQ/VFIQ state. Fixes: 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f Backports commit 89430fc6f80a5aef1d4cbd6fc26b40c30793786c from qemu
2018-11-17 02:53:21 +00:00
/**
* arm_cpu_update_virq: Update CPU_INTERRUPT_VIRQ bit in cs->interrupt_request
*
* Update the CPU_INTERRUPT_VIRQ bit in cs->interrupt_request, following
* a change to either the input VIRQ line from the GIC or the HCR_EL2.VI bit.
* Must be called with the iothread lock held.
*/
void arm_cpu_update_virq(ARMCPU *cpu);
/**
* arm_cpu_update_vfiq: Update CPU_INTERRUPT_VFIQ bit in cs->interrupt_request
*
* Update the CPU_INTERRUPT_VFIQ bit in cs->interrupt_request, following
* a change to either the input VFIQ line from the GIC or the HCR_EL2.VF bit.
* Must be called with the iothread lock held.
*/
void arm_cpu_update_vfiq(ARMCPU *cpu);
import
2015-08-21 07:04:50 +00:00
#endif
Reference in a new issue Copy permalink