Commit graph

1031 commits

Author SHA1 Message Date
Peter Maydell 719231b4c0
target/arm: Activate M-profile floating point context when FPCCR.ASPEN is set
The M-profile FPCCR.ASPEN bit indicates that automatic floating-point
context preservation is enabled. Before executing any floating-point
instruction, if FPCCR.ASPEN is set and the CONTROL FPCA/SFPA bits
indicate that there is no active floating point context then we
must create a new context (by initializing FPSCR and setting
FPCA/SFPA to indicate that the context is now active). In the
pseudocode this is handled by ExecuteFPCheck().

Implement this with a new TB flag which tracks whether we
need to create a new FP context.

Backports commit 6000531e19964756673a5f4b694a649ef883605a from qemu
2019-04-30 10:51:31 -04:00
Peter Maydell 87c8c0fde7
target/arm: Set FPCCR.S when executing M-profile floating point insns
The M-profile FPCCR.S bit indicates the security status of
the floating point context. In the pseudocode ExecuteFPCheck()
function it is unconditionally set to match the current
security state whenever a floating point instruction is
executed.

Implement this by adding a new TB flag which tracks whether
FPCCR.S is different from the current security state, so
that we only need to emit the code to update it in the
less-common case when it is not already set correctly.

Note that we will add the handling for the other work done
by ExecuteFPCheck() in later commits.

Backports commit 6d60c67a1a03be32c3342aff6604cdc5095088d1 from qemu
2019-04-30 10:50:17 -04:00
Peter Maydell 8d726490ff
target/arm: Overlap VECSTRIDE and XSCALE_CPAR TB flags
We are close to running out of TB flags for AArch32; we could
start using the cs_base word, but before we do that we can
economise on our usage by sharing the same bits for the VFP
VECSTRIDE field and the XScale XSCALE_CPAR field. This
works because no XScale CPU ever had VFP.

Backports commit ea7ac69d124c94c6e5579145e727adec9ccbefef from qemu
2019-04-30 10:45:14 -04:00
Peter Maydell 3c1f3548c4
target/arm: Move NS TBFLAG from bit 19 to bit 6
Move the NS TBFLAG down from bit 19 to bit 6, which has not
been used since commit c1e3781090b9d36c60 in 2015, when we
started passing the entire MMU index in the TB flags rather
than just a 'privilege level' bit.

This rearrangement is not strictly necessary, but means that
we can put M-profile-only bits next to each other rather
than scattered across the flag word.

Backports commit 7fbb535f7aeb22896fedfcf18a1eeff48165f1d7 from qemu
2019-04-30 10:41:04 -04:00
Peter Maydell 86776d451e
target/arm: Handle floating point registers in exception return
Handle floating point registers in exception return.
This corresponds to pseudocode functions ValidateExceptionReturn(),
ExceptionReturn(), PopStack() and ConsumeExcStackFrame().

Backports commit 6808c4d2d2826920087533f517472c09edc7b0d2 from qemu
2019-04-30 10:40:12 -04:00
Peter Maydell 2244bb085a
target/arm: Allow for floating point in callee stack integrity check
The magic value pushed onto the callee stack as an integrity
check is different if floating point is present.

Backports commit 0dc51d66fcfcc4c72011cdafb401fd876ca216e7 from qemu
2019-04-30 10:36:58 -04:00
Peter Maydell 746d377221
target/arm: Clean excReturn bits when tail chaining
The TailChain() pseudocode specifies that a tail chaining
exception should sanitize the excReturn all-ones bits and
(if there is no FPU) the excReturn FType bits; we weren't
doing this.

Backports commit 60fba59a2f9a092a44b688df5d058cdd6dd9c276 from qemu
2019-04-30 10:35:36 -04:00
Peter Maydell ca0ac5dca9
target/arm: Clear CONTROL.SFPA in BXNS and BLXNS
For v8M floating point support, transitions from Secure
to Non-secure state via BLNS and BLXNS must clear the
CONTROL.SFPA bit. (This corresponds to the pseudocode
BranchToNS() function.)

Backports commit 3cd6726f0ba7cc77342ee721bd86094e13b2a42a from qemu
2019-04-30 10:33:25 -04:00
Peter Maydell c7f5633cfe
target/arm: Implement v7m_update_fpccr()
Implement the code which updates the FPCCR register on an
exception entry where we are going to use lazy FP stacking.
We have to defer to the NVIC to determine whether the
various exceptions are currently ready or not.

Backports commit b593c2b81287040ab6f452afec6281e2f7ee487b from qemu
2019-04-30 10:32:12 -04:00
Peter Maydell 065e60503f
target/arm: Handle floating point registers in exception entry
Handle floating point registers in exception entry.
This corresponds to the FP-specific parts of the pseudocode
functions ActivateException() and PushStack().

We defer the code corresponding to UpdateFPCCR() to a later patch.

Backports commit 0ed377a8013f40653a83f6ad2c9693897522d7dc from qemu
2019-04-30 10:25:23 -04:00
Peter Maydell c164a9f191
target/arm/helper: don't return early for STKOF faults during stacking
Currently the code in v7m_push_stack() which detects a violation
of the v8M stack limit simply returns early if it does so. This
is OK for the current integer-only code, but won't work for the
floating point handling we're about to add. We need to continue
executing the rest of the function so that we check for other
exceptions like not having permission to use the FPU and so
that we correctly set the FPCCR state if we are doing lazy
stacking. Refactor to avoid the early return.

Backports commit 3432c79a4e7345818d2defcf9e61a1bcb2907f9f from qemu
2019-04-30 10:22:36 -04:00
Peter Maydell 05add081a3
target/arm: Handle SFPA and FPCA bits in reads and writes of CONTROL
The M-profile CONTROL register has two bits -- SFPA and FPCA --
which relate to floating-point support, and should be RES0 otherwise.
Handle them correctly in the MSR/MRS register access code.
Neither is banked between security states, so they are stored
in v7m.control[M_REG_S] regardless of current security state.

Backports commit 2e1c5bcd32014c9ede1b604ae6c2c653de17fc53 from qemu
2019-04-30 10:21:24 -04:00
Peter Maydell c0cebeb5b5
target/arm: Clear CONTROL_S.SFPA in SG insn if FPU present
If the floating point extension is present, then the SG instruction
must clear the CONTROL_S.SFPA bit. Implement this.

(On a no-FPU system the bit will always be zero, so we don't need
to make the clearing of the bit conditional on ARM_FEATURE_VFP.)

Backports commit 1702071302934af77a072b7ee7c5eadc45b37573 from qemu
2019-04-30 10:20:45 -04:00
Peter Maydell 89baa5cffa
target/arm: Decode FP instructions for M profile
Correct the decode of the M-profile "coprocessor and
floating-point instructions" space:
* op0 == 0b11 is always unallocated
* if the CPU has an FPU then all insns with op1 == 0b101
are floating point and go to disas_vfp_insn()

For the moment we leave VLLDM and VLSTM as NOPs; in
a later commit we will fill in the proper implementation
for the case where an FPU is present.

Backports commit 8859ba3c9625e7ceb5599f457a344bcd7c5e112b from qemu
2019-04-30 10:19:45 -04:00
Peter Maydell 18bb21c035
target/arm: Honour M-profile FP enable bits
Like AArch64, M-profile floating point has no FPEXC enable
bit to gate floating point; so always set the VFPEN TB flag.

M-profile also has CPACR and NSACR similar to A-profile;
they behave slightly differently:
* the CPACR is banked between Secure and Non-Secure
* if the NSACR forces a trap then this is taken to
the Secure state, not the Non-Secure state

Honour the CPACR and NSACR settings. The NSACR handling
requires us to borrow the exception.target_el field
(usually meaningless for M profile) to distinguish the
NOCP UsageFault taken to Secure state from the more
usual fault taken to the current security state.

Backports commit d87513c0abcbcd856f8e1dee2f2d18903b2c3ea2 from qemu
2019-04-30 10:18:21 -04:00
Peter Maydell c6bb8d483d
target/arm: Disable most VFP sysregs for M-profile
The only "system register" that M-profile floating point exposes
via the VMRS/VMRS instructions is FPSCR, and it does not have
the odd special case for rd==15. Add a check to ensure we only
expose FPSCR.

Backports commit ef9aae2522c22c05df17dd898099dd5c3f20d688 from qemu
2019-04-30 10:15:25 -04:00
Peter Maydell a4f332f3e9
target/arm: Implement dummy versions of M-profile FP-related registers
The M-profile floating point support has three associated config
registers: FPCAR, FPCCR and FPDSCR. It also makes the registers
CPACR and NSACR have behaviour other than reads-as-zero.
Add support for all of these as simple reads-as-written registers.
We will hook up actual functionality later.

The main complexity here is handling the FPCCR register, which
has a mix of banked and unbanked bits.

Note that we don't share storage with the A-profile
cpu->cp15.nsacr and cpu->cp15.cpacr_el1, though the behaviour
is quite similar, for two reasons:
* the M profile CPACR is banked between security states
* it preserves the invariant that M profile uses no state
inside the cp15 substruct

Backports commit d33abe82c7c9847284a23e575e1078cccab540b5 from qemu
2019-04-30 10:13:41 -04:00
Peter Maydell 978cd9c524
target/arm: Make sure M-profile FPSCR RES0 bits are not settable
Enforce that for M-profile various FPSCR bits which are RES0 there
but have defined meanings on A-profile are never settable. This
ensures that M-profile code can't enable the A-profile behaviour
(notably vector length/stride handling) by accident.

Backports commit 5bcf8ed9401e62c73158ba110864ee1375558bf7 from qemu
2019-04-30 10:12:17 -04:00
Richard Henderson bca82cde84
tcg: Hoist max_insns computation to tb_gen_code
In order to handle TB's that translate to too much code, we
need to place the control of the length of the translation
in the hands of the code gen master loop.

Backports commit 8b86d6d25807e13a63ab6ea879f976b9f18cc45a from qemu
2019-04-30 09:49:57 -04:00
Lioncash f6911ea73d
target/arm: Handle AArch32 CRC instructions 2019-04-27 10:50:25 -04:00
Lioncash c3df12e534
target/arm/translate: Synchronize with Qemu 2019-04-27 10:13:01 -04:00
Lioncash 6d80445fe1
unicorn_arm: Treat registers as unsigned values in casts
It isn't particularly advisable to treat these as signed values, given
the registers themselves have no notion of signedness associated with
them.
2019-04-26 08:48:31 -04:00
Lioncash f419015aa3
unicorn_arm: Don't steamroll CPSR bits defined as RAZ/SBZP
Prevents bits from being set that should always read as zero according
to the ARM architecture reference manual.
2019-04-26 08:47:50 -04:00
Lioncash d844d7cc9d
exec: Backport tb_cflags accessor 2019-04-22 06:12:59 -04:00
Lioncash 14f1cb03e9
target/arm/unicorn_arm: Get rid of magic constants where applicable 2019-04-19 20:23:41 -04:00
Lioncash 5968b3d96f
target/arm: Synchronize with qemu 2019-04-19 15:31:18 -04:00
Lioncash bf6dfeb175
target/arm/translate: Synchronize with qemu
Backports a few other missing pieces from mainline qemu.
2019-04-18 06:22:36 -04:00
Lioncash 5b062dacf2
target/arm: Simplify and correct thumb instruction tracing
This wasn't subtracting the size of the instruction off the PC like how
the ARM mode tracing was performing the tracing. This simplifies it and
makes the behavior identical.
2019-04-18 06:00:15 -04:00
Lioncash 5d6ddec7fb
target/arm/translate: Subtract PC value properly for thumb tracecode calls 2019-04-18 05:44:48 -04:00
Lioncash 3521e72580
target/arm: Sychronize with qemu
Synchronizes with bits and pieces that were missed due to merging
incorrectly (sorry :<)
2019-04-18 04:49:11 -04:00
Lioncash ddcf400955
arm: Always enable access to coprocessors initially
Allows non-AArch64 environments to always access coprocessors initially.
Removes the need to do avoidable register management when testing
floating-point code.
2019-04-13 19:49:43 -04:00
Richard Henderson f5cb1a5865
target/arm: Set SIMDMISC and FPMISC for 32-bit -cpu max
Fixes: https://bugs.launchpad.net/bugs/1821430

Backports commit c8877d0f2f662bf01346a03bc9fd279954b4132d from qemu
2019-03-26 20:41:01 -04:00
Andrew Jones 8719b3edb3
target/arm: make pmccntr_op_start/finish static
These functions are not used outside helper.c

Backports commit f2b2f53f6429b5abd7cd86bd65747f5f13e195eb from qemu
2019-03-26 20:35:34 -04:00
Andrew Jones 6482182ba5
target/arm: cortex-a7 and cortex-a15 have pmus
cortex-a7 and cortex-a15 have pmus (PMUv2) and they advertise
them in ID_DFR0. Let's allow them to function. This also enables
the pmu cpu property to work with these cpu types, i.e. we can
now do '-cpu cortex-a15,pmu=off' to remove the pmu.

Backports commit a46118fc16537a593119e5b316052a98514046bb from qemu
2019-03-26 20:34:11 -04:00
Andrew Jones 3c50e72c40
target/arm: fix crash on pmu register access
Fix a QEMU NULL derefence that occurs when the guest attempts to
enable PMU counters with a non-v8 cpu model or a v8 cpu model
which has not configured a PMU.

Backports commit cbbb3041fe2f57a475cef5d6b0ef836118aad106 from qemu
2019-03-26 20:32:49 -04:00
Richard Henderson 2427ace0c0
target/arm: Fix non-parallel expansion of CASP
The second word has been loaded from the unincremented
address since the first commit.

Backports commit a036f5302c13634f3d375615b2949fd1fa1657b6 from qemu
2019-03-26 20:31:01 -04:00
Amir Charif 2392d8b8ab
target/arm: Check access permission to ADDVL/ADDPL/RDVL
These instructions do not trap when SVE is disabled in EL0,
causing them to be executed with wrong size information.

Backports commit 5de56742a3c91de3d646326bec43a989bba83ca4 from qemu
2019-03-19 05:42:59 -04:00
Dongjiu Geng 4dc3d59fd3
target/arm: change arch timer registers access permission
Some generic arch timer registers are Config-RW in the EL0,
which means the EL0 exception level can have write permission
if it is appropriately configured.

When VM access registers, QEMU firstly checks whether they have RW
permission, then check whether it is appropriately configured.
If they are defined to read only in EL0, even though they have been
appropriately configured, they still do not have write permission.
So need to add the write permission according to ARMV8 spec when
define it.

Backports commit daf1dc5f82cefe2a57f184d5053e8b274ad2ba9a from qemu
2019-03-19 05:40:44 -04:00
yhql 1723cb1015
Add ARM MSP, PSP and CONTROL register access (#1071)
Necessary for NVIC exception emulation from user.

Backports commit 31851280316d37305f412fff42f45bb375999074 from unicorn
2019-03-08 02:24:49 -05:00
Lioncash 5075a0158a
target/arm: Restore Qemu's organization of coprocessor registers
These changes were mostly made in upstream unicorn for what I can guess,
was to support old versions of MSVC's compiler.

This is also a pain to maintain, since everything needs to be done
manually and can be a source of errors. It also makes it take more work
than it needs to, to backport changes from qemu.

Because of that, this change restores Qemu's organization of the
coprocessor registers.
2019-03-08 01:32:47 -05:00
Richard Henderson f116560d2c
target/arm: Implement ARMv8.5-FRINT
Backports 6bea25631af92531027d3bf3ef972a4d51d62e7c from qemu.
2019-03-05 23:17:33 -05:00
Richard Henderson f855ac073d
target/arm: Restructure handle_fp_1src_{single, double}
This will allow sharing code that adjusts rmode beyond
the existing users.

Backports commit 0e4db23d1fdbfed4fc1ec19b6e59820209600358 from qemu
2019-03-05 23:09:48 -05:00
Richard Henderson 94b5aab8f8
target/arm: Implement ARMv8.5-CondM
Backports commit 5ef84f111483e3f7b57efc690e22081ca8f99544 from qemu
2019-03-05 23:04:06 -05:00
Richard Henderson 1dfa15a683
target/arm: Implement ARMv8.4-CondM
Backports commit b89d9c988a988d5547c73e2bc43f59b0c07420a5 from qemu
2019-03-05 22:59:51 -05:00
Richard Henderson 65a3f3be5b
target/arm: Rearrange disas_data_proc_reg
This decoding more closely matches the ARMv8.4 Table C4-6,
Encoding table for Data Processing - Register Group.

In particular, op2 == 0 is now more than just Add/sub (with carry).

Backports commit 2fba34f70d9a81bab56e61bb99a4d6632bdfe531 from qemu
2019-03-05 22:55:27 -05:00
Richard Henderson 45c297c99b
target/arm: Add set/clear_pstate_bits, share gen_ss_advance
We do not need an out-of-line helper for manipulating bits in pstate.
While changing things, share the implementation of gen_ss_advance.

Backports commit 22ac3c49641f6eed93dca5b852030b4d3eacf6c4 from qemu
2019-03-05 22:55:22 -05:00
Richard Henderson 60742608f5
target/arm: Split helper_msr_i_pstate into 3
The EL0+UMA check is unique to DAIF. While SPSel had avoided the
check by nature of already checking EL >= 1, the other post v8.0
extensions to MSR (imm) allow EL0 and do not require UMA. Avoid
the unconditional write to pc and use raise_exception_ra to unwind.

Backports commit ff730e9666a716b669ac4a8ca7c521177d1d2b15 from qemu
2019-03-05 22:45:11 -05:00
Richard Henderson 5d42ca6a65
target/arm: Implement ARMv8.0-PredInv
Backports commit cb570bd318beb2ecce83cabf8016dacceb824dce from qemu
2019-03-05 22:37:57 -05:00
Richard Henderson 1721e429c2
target/arm: Implement ARMv8.0-SB
Backports commit 9888bd1e20425dfe4dcca5dcd1ca2fac8e90ad19 from qemu
2019-03-05 22:35:16 -05:00
Richard Henderson a552a7b2e0
target/arm: Split out arm_sctlr
Minimize the number of places that will need updating when
the virtual host extensions are added.

Backports commit 64e40755cd41fbe8cd266cf387e42ddc57a449ef from qemu
2019-03-05 22:29:25 -05:00
Richard Henderson fa70a2bc69
target/arm: Fix PC test for LDM (exception return)
Found by inspection: Rn is the base register against which the
load began; I is the register within the mask being processed.
The exception return should of course be processed from the loaded PC.

Backports commit 9d090d17234058f55c3c439d285db78c94d7d4de from qemu
2019-03-05 22:27:38 -05:00
Lioncash 0868015992
target/arm: Move TCGContext variable within arm_post_translate_insn into a narrower scope
This is only used within the scope of the if statement, so we can just
move it there.
2019-02-28 18:53:33 -05:00
Lioncash 15440a83c5
target/arm: Fix execution of ARM instructions
Previously we'd be checking prior to the actual decoding if we were at
the ending address. This worked fine using the old model of the
translation process in qemu. However, this causes the wrong behavior to
occur in both ARM and Thumb/Thumb-2 modes using the newer translator
model.

Given the translator itself checks for the end address already, this
needs to be placed within arm_post_translate_insn().

This prevents the emulation process being off-by-one as well when it
comes to actually executing the instructions.
2019-02-28 18:49:22 -05:00
cfrantz 5ad3a0ea82
Add support for the ARM IPSR register. (#1067)
1. Create an enum name for the IPSR register.
2. Implement read and write of the IPSR via the xpsr helper functions.

Fixes #1065

Backports commit 6c319941a5462ee3a4af4593c371f5674394d6ce from unicorn.
2019-02-28 16:40:54 -05:00
Richard Henderson fbe1ee25ff
target/arm: Enable ARMv8.2-FHM for -cpu max
Backports commit 991c05995a7bbafbebc1e4d405e947f2edcee063 from qemu
2019-02-28 15:47:03 -05:00
Richard Henderson 4ae3ff8e61
target/arm: Implement VFMAL and VFMSL for aarch32
Backports commit 87732318c5d68a366fc2d6fc394d9c20412099fa from qemu
2019-02-28 15:44:59 -05:00
Richard Henderson 625d3f3cfb
target/arm: Implement FMLAL and FMLSL for aarch64
Backports commit 0caa5af802ff622c854ff4ee2e2b8cdd135b4d73 from qemu
2019-02-28 15:36:41 -05:00
Richard Henderson 5473c3603f
target/arm: Add helpers for FMLAL
Note that float16_to_float32 rightly squashes SNaN to QNaN.
But of course pickNaNMulAdd, for ARM, selects SNaNs first.
So we have to preserve SNaN long enough for the correct NaN
to be selected. Thus float16_to_float32_by_bits.

Backports commit a4e943a716d5fac923d82df3eabc65d1e3624019 from qemu
2019-02-28 15:31:48 -05:00
Peter Maydell 82b8e97f76
target/arm: Gate "miscellaneous FP" insns by ID register field
There is a set of VFP instructions which we implement in
disas_vfp_v8_insn() and gate on the ARM_FEATURE_V8 bit.
These were all first introduced in v8 for A-profile, but in
M-profile they appeared in v7M. Gate them on the MVFR2
FPMisc field instead, and rename the function appropriately.

Backports commit c0c760afe800b60b48c80ddf3509fec413594778 from qemu
2019-02-28 15:26:27 -05:00
Peter Maydell 118a2bde5c
target/arm: Use MVFR1 feature bits to gate A32/T32 FP16 instructions
Instead of gating the A32/T32 FP16 conversion instructions on
the ARM_FEATURE_VFP_FP16 flag, switch to our new approach of
looking at ID register bits. In this case MVFR1 fields FPHP
and SIMDHP indicate the presence of these insns.

This change doesn't alter behaviour for any of our CPUs.

Backports commit 602f6e42cfbfe9278be34e9b91d2ceb695837e02 from qemu
2019-02-28 15:23:51 -05:00
Richard Henderson c9ad233678
target/arm: Implement ARMv8.3-JSConv
Backports commit 6c1f6f2733a7692793135ea5ce72b829add99a50 from qemu
2019-02-22 19:08:57 -05:00
Richard Henderson f16dcbe226
target/arm: Rearrange Floating-point data-processing (2 regs)
There are lots of special cases within these insns. Split the
major argument decode/loading/saving into no_output (compares),
rd_is_dp, and rm_is_dp.

We still need to special case argument load for compare (rd as
input, rm as zero) and vcvt fixed (rd as input+output), but lots
of special cases do disappear.

Now that we have a full switch at the beginning, hoist the ISA
checks from the code generation.

Backports commit e80941bd64cc388554770fd72334e9e7d459a1ef from qemu
2019-02-22 18:57:25 -05:00
Richard Henderson dbe623dacc
target/arm: Split out vfp_helper.c
Move all of the fp helpers out of helper.c into a new file.
This is code movement only. Since helper.c has no copyright
header, take the one from cpu.h for the new file.

Backports commit 37356079fcdb34e13abbed8ea0c00ca880c31247 from qemu
2019-02-22 18:48:44 -05:00
Richard Henderson d6fbc0f4f3
target/arm: Restructure disas_fp_int_conv
For opcodes 0-5, move some if conditions into the structure
of a switch statement. For opcodes 6 & 7, decode everything
at once with a second switch.

Backports commit 3c3ff68492c2d00bd8cb39ed2d02bdaf5caf5cb8 from qemu
2019-02-22 18:39:08 -05:00
Aaron Lindsay OS 5c153537f5
target/arm: Stop unintentional sign extension in pmu_init
This was introduced by
commit bf8d09694ccc07487cd73d7562081fdaec3370c8
target/arm: Don't clear supported PMU events when initializing PMCEID1
and identified by Coverity (CID 1398645).

Backports commit 67da43d668320e1bcb0a0195aaf2de4ff2a001a0 from qemu
2019-02-22 18:32:10 -05:00
Peter Maydell 928f226ed6
target/arm: v8M MPU should use background region as default, not always
The "background region" for a v8M MPU is a default which will be used
(if enabled, and if the access is privileged) if the access does
not match any specific MPU region. We were incorrectly using it
always (by putting the condition at the wrong nesting level). This
meant that we would always return the default background permissions
rather than the correct permissions for a specific region, and also
that we would not return the right information in response to a
TT instruction.

Move the check for the background region to the same place in the
logic as the equivalent v8M MPUCheck() pseudocode puts it.
This in turn means we must adjust the condition we use to detect
matches in multiple regions to avoid false-positives.

Backports commit cff21316c666c8053b1f425577e324038d0ca30d from qemu
2019-02-22 18:30:44 -05:00
Richard Henderson 5c34cab41c
target/arm: Add missing clear_tail calls
Fortunately, the functions affected are so far only called from SVE,
so there is no tail to be cleared. But as we convert more of AdvSIMD
to gvec, this will matter.

Backports commit d8efe78e8039511b95c23d75bb48eca6873fbb0f from qemu
2019-02-15 18:15:20 -05:00
Richard Henderson f3cb92c86c
target/arm: Use vector operations for saturation
For same-sign saturation, we have tcg vector operations. We can
compute the QC bit by comparing the saturated value against the
unsaturated value.

Backports commit 89e68b575e138d0af1435f11a8ffcd8779c237bd from qemu
2019-02-15 18:14:09 -05:00
Richard Henderson 10d468f601
target/arm: Split out FPSCR.QC to a vector field
Change the representation of this field such that it is easy
to set from vector code.

Backports commit a4d5846245c5e029e5aa3945a9bda1de1c3fedbf from qemu
2019-02-15 18:04:13 -05:00
Richard Henderson 356b70e931
target/arm: Fix set of bits kept in xregs[ARM_VFP_FPSCR]
Given that we mask bits properly on set, there is no reason
to mask them again on get. We failed to clear the exception
status bits, 0x9f, which means that the wrong value would be
returned on get. Except in the (probably normal) case in which
the set clears all of the bits.

Simplify the code in set to also clear the RES0 bits.

Backports commit 18aaa59c622208743565307668a2100ab24f7de9 from qemu
2019-02-15 18:00:57 -05:00
Richard Henderson ca4bb1b4bc
target/arm: Split out flags setting from vfp compares
Minimize the code within a macro by splitting out a helper function.
Use deposit32 instead of manual bit manipulation.

Backports commit 55a889456ef78f3f9b8eae9846c2f1453b1dd77b from qemu
2019-02-15 17:59:34 -05:00
Richard Henderson 4e44043956
target/arm: Fix arm_cpu_dump_state vs FPSCR
Backports commit ec527e4eeccc31e3beadf3b61b66c61bbd873811 from qemu
2019-02-15 17:58:25 -05:00
Richard Henderson ed7c9d0710
target/arm: Remove neon min/max helpers
These are now unused.

Backports commit a5c5dc53c4688efc149b235361d2d49869e77139 from qemu
2019-02-15 17:57:18 -05:00
Richard Henderson 198befc50e
target/arm: Use tcg integer min/max primitives for neon
The 32-bit PMIN/PMAX has been decomposed to scalars,
and so can be trivially expanded inline.

Backports commit 9ecd3c5c1651fa7f9adbedff4806a2da0b50490c from qemu
2019-02-15 17:55:11 -05:00
Richard Henderson eee33bd692
target/arm: Use vector minmax expanders for aarch32
Backports commit 6f2782218230bbb33fa22f9a2f73f8a570046007 from qemu
2019-02-15 17:54:05 -05:00
Richard Henderson 96d1df966b
target/arm: Use vector minmax expanders for aarch64
Backports commit 264d2a481a6c34dfda53be3fbea66116bcef9c5a from qemu
2019-02-15 17:52:36 -05:00
Richard Henderson d147946edc
target/arm: Rely on optimization within tcg_gen_gvec_or
Since we're now handling a == b generically, we no longer need
to do it by hand within target/arm/.

Backports commit 2900847ff4c862887af750935a875059615f509a from qemu
2019-02-15 17:50:28 -05:00
Alex Bennée bf9c8499ca
target/arm: expose remaining CPUID registers as RAZ
There are a whole bunch more registers in the CPUID space which are
currently not used but are exposed as RAZ. To avoid too much
duplication we expand ARMCPRegUserSpaceInfo to understand glob
patterns so we only need one entry to tweak whole ranges of registers.

Backports commit d040242effe47850060d2ef1c461ff637d88a84d from qemu
2019-02-15 17:48:37 -05:00
Alex Bennée 890983f186
target/arm: expose MPIDR_EL1 to userspace
As this is a single register we could expose it with a simple ifdef
but we use the existing modify_arm_cp_regs mechanism for consistency.

Backports commit 522641660c3de64ed8322b8636c58625cd564a3f from qemu
2019-02-15 17:29:23 -05:00
Alex Bennée babf31dfa0
target/arm: expose CPUID registers to userspace
A number of CPUID registers are exposed to userspace by modern Linux
kernels thanks to the "ARM64 CPU Feature Registers" ABI. For QEMU's
user-mode emulation we don't need to emulate the kernels trap but just
return the value the trap would have done. To avoid too much #ifdef
hackery we process ARMCPRegInfo with a new helper (modify_arm_cp_regs)
before defining the registers. The modify routine is driven by a
simple data structure which describes which bits are exported and
which are fixed.

Backports commit 6c5c0fec29bbfe36c64eca1edfd8455be46b77c6 from qemu
2019-02-15 17:27:30 -05:00
Alex Bennée 0a51e5055f
target/arm: relax permission checks for HWCAP_CPUID registers
Although technically not visible to userspace the kernel does make
them visible via a trap and emulate ABI. We provide a new permission
mask (PL0U_R) which maps to PL0_R for CONFIG_USER builds and adjust
the minimum permission check accordingly.

Backports commit b5bd7440422bb66deaceb812bb9287a6a3cdf10c from qemu
2019-02-15 17:18:06 -05:00
Catherine Ho 841ac2b3bb
target/arm: Fix int128_make128 lo, hi order in paired_cmpxchg64_be
The lo,hi order is different from the comments. And in commit
1ec182c33379 ("target/arm: Convert to HAVE_CMPXCHG128"), it changes
the original code logic. So just restore the old code logic before this
commit:
do_paired_cmpxchg64_be():
cmpv = int128_make128(env->exclusive_high, env->exclusive_val);
newv = int128_make128(new_hi, new_lo);

This fixes a bug that would only be visible for big-endian
AArch64 guest code.

Fixes: 1ec182c33379 ("target/arm: Convert to HAVE_CMPXCHG128")

Backports commit abd5abc58c5d4c9bd23427b0998a44eb87ed47a2 from qemu
2019-02-15 17:16:55 -05:00
Peter Maydell 31813bafe2
target/arm: Implement HACR_EL2
HACR_EL2 is a register with IMPDEF behaviour, which allows
implementation specific trapping to EL2. Implement it as RAZ/WI,
since QEMU's implementation has no extra traps. This also
matches what h/w implementations like Cortex-A53 and A57 do.

Backports commit 831a2fca343ebcd6651eab9102bd7a36b77da65d from qemu
2019-02-15 17:15:41 -05:00
Aaron Lindsay OS af17f7fa59
target/arm: Fix CRn to be 14 for PMEVTYPER/PMEVCNTR
This bug was introduced in:
commit 5ecdd3e47cadae83a62dc92b472f1fe163b56f59
target/arm: Finish implementation of PM[X]EVCNTR and PM[X]EVTYPER

Backports commit 62c7ec3488fe0dcbabffd543f458914e27736115 from qemu
2019-02-15 17:12:04 -05:00
Peter Maydell 04676ed074
target/arm: Make FPSCR/FPCR trapped-exception bits RAZ/WI
The {IOE, DZE, OFE, UFE, IXE, IDE} bits in the FPSCR/FPCR are for
enabling trapped IEEE floating point exceptions (where IEEE exception
conditions cause a CPU exception rather than updating the FPSR status
bits). QEMU doesn't implement this (and nor does the hardware we're
modelling), but for implementations which don't implement trapped
exception handling these control bits are supposed to be RAZ/WI.
This allows guest code to test for whether the feature is present
by trying to write to the bit and checking whether it sticks.

QEMU is incorrectly making these bits read as written. Make them
RAZ/WI as the architecture requires.

In particular this was causing problems for the NetBSD automatic
test suite.

Backports commit a15945d98d3a3390c3da344d1b47218e91e49d8b from qemu
2019-02-05 17:45:22 -05:00
Richard Henderson 9b0e04f3ab
target/arm: Enable TBI for user-only
This has been enabled in the linux kernel since v3.11
(commit d50240a5f6cea, 2013-09-03,
"arm64: mm: permit use of tagged pointers at EL0").

Backports commit f6a148fef63698826e69ca91cc11877ab1ed786f from qemu
2019-02-05 17:44:17 -05:00
Peter Maydell 8124b9f975
target/arm: Compute TB_FLAGS for TBI for user-only
Enables, but does not turn on, TBI for CONFIG_USER_ONLY.

Backports commit c47eaf9fc2af68cfbdbd9ae31f8e2e5ebb7022b4 from qemu
2019-02-05 17:43:11 -05:00
Richard Henderson b928902908
target/arm: Clean TBI for data operations in the translator
This will allow TBI to be used in user-only mode, as well as
avoid ping-ponging the softmmu TLB when TBI is in use. It
will also enable other armv8 extensions.

Backports commit 3a471103ac1823bafc907962dcaf6bd4fc0942a2 from qemu
2019-02-05 17:39:12 -05:00
Richard Henderson 5c6ffde710
target/arm: Add TBFLAG_A64_TBID, split out gen_top_byte_ignore
Split out gen_top_byte_ignore in preparation of handling these
data accesses; the new tbflags field is not yet honored.

Backports commit 4a9ee99db38ba513bf1e8f43665b79c60accd017 from qemu
2019-02-05 17:20:11 -05:00
Richard Henderson fbd8992e27
target/arm: Enable BTI for -cpu max
Backports commit a15daafa1cba96ff28abdfb6c860e0939655dbd1 from qemu
2019-02-05 17:15:32 -05:00
Richard Henderson 4dc5f80683
target/arm: Set btype for indirect branches
Backports commit 001d47b6efbe4795ed77366986b8ef384ab8b127 from qemu
2019-02-05 17:14:16 -05:00
Richard Henderson 11736a659b
target/arm: Reset btype for direct branches
This is all of the non-exception cases of DISAS_NORETURN.

Backports commit 358622703583d2e2967e0a93da990e747dcc3ac6 from qemu
2019-02-05 17:11:59 -05:00
Richard Henderson 88193cf7c3
target/arm: Default handling of BTYPE during translation
The branch target exception for guarded pages has high priority,
and only 8 instructions are valid for that case. Perform this
check before doing any other decode.

Clear BTYPE after all insns that neither set BTYPE nor exit via
exception (DISAS_NORETURN).

Not yet handled are insns that exit via DISAS_NORETURN for some
other reason, like direct branches.

Backports commit 51bf0d7aa91a9d4e2563240a42e6cb705cef84aa from qemu
2019-02-05 17:05:31 -05:00
Richard Henderson d594b2047f
target/arm: Cache the GP bit for a page in MemTxAttrs
Caching the bit means that we will not have to re-walk the
page tables to look up the bit during translation.

Backports commit 1bafc2ba7e6bfe89fff3503fdac8db39c973de48 from qemu
2019-02-05 17:02:19 -05:00
Richard Henderson cf3ac035bc
target/arm: Add BT and BTYPE to tb->flags
Backports commit 08f1434a71ddf2bdfdb034dcd24b24464d1efd72 from qemu
2019-02-05 16:59:53 -05:00
Richard Henderson a99119ce39
target/arm: Add PSTATE.BTYPE
Place this in its own field within ENV, as that will
make it easier to reset from within TCG generated code.

With the change to pstate_read/write, exception entry
and return are automatically handled.

Backports commit f6e52eaac13b6947f4406c127e3090c898e439c9 from qemu
2019-02-05 16:57:51 -05:00
Richard Henderson 6b4f7a28b5
target/arm: Introduce isar_feature_aa64_bti
Also create field definitions for id_aa64pfr1 from ARMv8.5.

Backports commit be53b6f4d7ace2e6a018e45af825069ccb7bab66 from qemu
2019-02-05 16:56:01 -05:00
Remi Denis-Courmont 0b7f1ff086
target/arm: fix decoding of B{,L}RA{A,B}
A flawed test lead to the instructions always being treated as
unallocated encodings.

Fixes: https://bugs.launchpad.net/bugs/1813460

Backports commit 1cf86a8618644beb860951ff4383457ee88a7f4a from qemu
2019-02-03 17:55:31 -05:00
Remi Denis-Courmont a20bb60f06
target/arm: fix AArch64 virtual address space size
Since QEMU does not support the ARMv8.2-LVA, Large Virtual Address,
extension (yet), the VA address space is 48-bits plus a sign bit. User
mode can only handle the positive half of the address space, so that
makes a limit of 48 bits.

(With LVA, it would be 53 and 52 bits respectively.)

The incorrectly large address space conflicts with PAuth instructions,
which use bits 48-54 and 56-63 for the pointer authentication code. This
also conflicts with (as yet unsupported by QEMU) data tagging and with
the ARMv8.5-MTE extension.

Backports commit f6768aa1b4c6a80448eabd22bb9b4123c709caea from qemu
2019-02-03 17:55:30 -05:00
Richard Henderson 932c4e8569
target/arm: Always enable pac keys for user-only
Drop the pac properties. This approach cannot work as written
because the properties are applied before arm_cpu_reset, which
zeros SCTLR_EL1 (amongst everything else).

We can re-introduce the properties if they turn out to be useful.
But since linux 5.0 enables all of the keys, they may not be.

Backports commit 276c6e813719568bdc9743e87ff8f42115006206 from qemu
2019-02-03 17:55:30 -05:00
Julia Suvorova 93acc4dc56
arm: Clarify the logic of set_pc()
Until now, the set_pc logic was unclear, which raised questions about
whether it should be used directly, applying a value to PC or adding
additional checks, for example, set the Thumb bit in Arm cpu. Let's set
the set_pc logic for “Configure the PC, as was done in the ELF file”
and implement synchronize_with_tb hook for preserving PC to cpu_tb_exec.

Backports commit 42f6ed919325413392bea247a1e6f135deb469cd from qemu
2019-02-03 17:55:30 -05:00
Richard Henderson 50cf5634da
target/arm: Enable API, APK bits in SCR, HCR
These bits become writable with the ARMv8.3-PAuth extension.

Backports commit ef682cdb4aded5c65a018e175482e875de66059d from qemu
2019-02-03 17:55:30 -05:00
Aaron Lindsay OS 0dd5bf84fc
target/arm: Send interrupts on PMU counter overflow
Whenever we notice that a counter overflow has occurred, send an
interrupt. This is made more reliable with the addition of a timer in a
follow-on commit.

Backports commit f4efb4b2a17528837cb445f9bdfaef8df4a5acf7 from qemu
2019-02-03 17:55:30 -05:00
Peter Maydell edfb13f8eb
target/arm/translate-a64: Fix mishandling of size in FCMLA decode
In disas_simd_indexed(), for the case of "complex fp", each indexable
element is a complex pair, so the total size is twice that indicated
in the 'size' field in the encoding. We were trying to do this
"double the size" operation with a left shift by 1, but this is
incorrect because the 'size' field is a MO_8/MO_16/MO_32/MO_64
value, and doubling the size should be done by a simple increment.

This meant we were mishandling FCMLA (by element) of values where
the real and imaginary parts are 32-bit floats, and would incorrectly
UNDEF this encoding. (No other insns take this code path, and for
16-bit floats it happens that 1 << 1 and 1 + 1 are both the same).

Backports commit eaefb97a8b97dbf42c016fe65b68b92f99a346f6 from qemu
2019-02-03 17:55:30 -05:00
Peter Maydell f999e06c22
target/arm/translate-a64: Fix FCMLA decoding error
The FCMLA (by element) instruction exists in the
"vector x indexed element" encoding group, but not in
the "scalar x indexed element" group. Correctly UNDEF
the unallocated encodings.

Backports commit 4dfabb6d568e6b315594d7d464dacaf3368aff60 from qemu
2019-02-03 17:55:30 -05:00
Peter Maydell eaecbe7901
target/arm/translate-a64: Don't underdecode SDOT and UDOT
In the AdvSIMD scalar x indexed element and vector x indexed element
encoding group, the SDOT and UDOT instructions are vector only,
and their opcode is unallocated in the scalar group. Correctly
UNDEF this unallocated encoding.

Backports commit 4977986ca38fb1d5357532e1a8032b984047a369 from qemu
2019-02-03 17:55:30 -05:00
Peter Maydell f7d78d9e08
target/arm/translate-a64: Don't underdecode FP insns
In the encoding groups
* floating-point data-processing (1 source)
* floating-point data-processing (2 source)
* floating-point data-processing (3 source)
* floating-point immediate
* floating-point compare
* floating-ponit conditional compare
* floating-point conditional select

bit 31 is M and bit 29 is S (and bit 30 is 0, already checked at
this point in the decode). None of these groups allocate any
encoding for M=1 or S=1. We checked this in disas_fp_compare(),
disas_fp_ccomp() and disas_fp_csel(), but missed it in disas_fp_1src(),
disas_fp_2src(), disas_fp_3src() and disas_fp_imm().

We also missed that in the fp immediate encoding the imm5 field
must be all zeroes.

Correctly UNDEF the unallocated encodings here.

Backports commit c1e20801f5ee53472dbf2757df605543f3f4ce0b from qemu
2019-02-03 17:55:29 -05:00
Peter Maydell 1128b4d77d
target/arm/translate-a64: Don't underdecode add/sub extended register
In the "add/subtract (extended register)" encoding group, the "opt"
field in bits [23:22] must be zero. Correctly UNDEF the unallocated
encodings where this field is not zero.

Backports commit 4f61106614410945b1d1c93081544ad5b13044fc from qemu
2019-02-03 17:55:29 -05:00
Peter Maydell decebb5936
target/arm/translate-a64: Don't underdecode SIMD ld/st single
In the AdvSIMD load/store single structure encodings, the
non-post-indexed case should have zeroes in [20:16] (which is the
Rm field for the post-indexed case). Bit 31 must also be zero
(a check we got right in ldst_multiple but not here). Correctly
UNDEF these unallocated encodings.

Backports commit 9c72b68ad746a51f63822cffab4d144b5957823a from qemu
2019-02-03 17:55:29 -05:00
Peter Maydell 60ccaf56ac
target/arm/translate-a64: Don't underdecode SIMD ld/st multiple
In the AdvSIMD load/store multiple structures encodings,
the non-post-indexed case should have zeroes in [20:16]
(which is the Rm field for the post-indexed case).
Correctly UNDEF the currently unallocated encodings which
have non-zeroes in those bits.

Backports commit e1f220811dbd5d85fb02ff286358f9ee6188938f from qemu
2019-02-03 17:55:29 -05:00
Peter Maydell 80248fecb6
target/arm/translate-a64: Don't underdecode PRFM
The PRFM prefetch insn in the load/store with imm9 encodings
requires idx field 0b00; we were underdecoding this by
only checking !is_unpriv (which is equivalent to idx != 2).
Correctly UNDEF the unallocated encodings where idx == 0b01
and 0b11 as well as 0b10.

Backports commit a80c4256543987ca88407349ee012a673a10a2ae from qemu
2019-02-03 17:55:29 -05:00
Peter Maydell 147269ed81
target/arm/translate-a64: Don't underdecode system instructions
The "system instructions" and "system register move" subcategories
of "branches, exception generating and system instructions" for A64
only apply if bits [23:22] are zero; other values are currently
unallocated. Correctly UNDEF these unallocated encodings.

Backports commit 08d5e3bde6b4ad32996bf69d93aa66ae43d3f3ff from qemu
2019-02-03 17:55:29 -05:00
Lioncash 8eaa850287
target/arm/vec_helper: Remove use of void pointer arithmetic
This is a GNU-specific extension.
2019-01-30 14:03:26 -05:00
Aaron Lindsay OS 8d7bb2cab3
target/arm: Don't clear supported PMU events when initializing PMCEID1
A bug was introduced during a respin of:

commit 57a4a11b2b281bb548b419ca81bfafb214e4c77a
target/arm: Add array for supported PMU events, generate PMCEID[01]_EL0

This patch introduced two calls to get_pmceid() during CPU
initialization - one each for PMCEID0 and PMCEID1. In addition to
building the register values, get_pmceid() clears an internal array
mapping event numbers to their implementations (supported_event_map)
before rebuilding it. This is an optimization since much of the logic is
shared. However, since it was called twice, the contents of
supported_event_map reflect only the events in PMCEID1 (the second call
to get_pmceid()).

Fix this bug by moving the initialization of PMCEID0 and PMCEID1 back
into a single function call, and name it more appropriately since it is
doing more than simply generating the contents of the PMCEID[01]
registers.

Backports commit bf8d09694ccc07487cd73d7562081fdaec3370c8 from qemu
2019-01-29 17:12:23 -05:00
Richard Henderson 64f10fa075
target/arm: Fix validation of 32-bit address spaces for aa32
When tsz == 0, aarch32 selects the address space via exclusion,
and there are no "top_bits" remaining that require validation.

Fixes: ba97be9f4a4

Backports commit 36d820af0eddf4fc6a533579b052d8f0085a9fb8 from qemu
2019-01-29 16:46:36 -05:00
Lioncash 29d84a9296
target: Resolve repeated typedef warnings 2019-01-22 20:27:35 -05:00
Aaron Lindsay cfd84d84f6
target/arm: Implement PMSWINC
Backports commit 0d4bfd7df809863b1f45fad35229fb9419527d06 from qemu
2019-01-22 18:59:26 -05:00
Aaron Lindsay 9727b7c3e0
target/arm: PMU: Set PMCR.N to 4
This both advertises that we support four counters and enables them
because the pmu_num_counters() reads this value from PMCR.

Backports commit ac689a2e5155d129acaa39603e2a7a29abd90d89 from qemu
2019-01-22 18:55:34 -05:00
Aaron Lindsay dede23994a
target/arm: PMU: Add instruction and cycle events
The instruction event is only enabled when icount is used, cycles are
always supported. Always defining get_cycle_count (but altering its
behavior depending on CONFIG_USER_ONLY) allows us to remove some
CONFIG_USER_ONLY #defines throughout the rest of the code.

Backports commit b2e2372511946fae86fbb8709edec7a41c6f3167 from qemu
2019-01-22 18:54:01 -05:00
Aaron Lindsay 1a815a1afc
target/arm: Finish implementation of PM[X]EVCNTR and PM[X]EVTYPER
Add arrays to hold the registers, the definitions themselves, access
functions, and logic to reset counters when PMCR.P is set. Update
filtering code to support counters other than PMCCNTR. Support migration
with raw read/write functions.

Backports commit 5ecdd3e47cadae83a62dc92b472f1fe163b56f59 from qemu
2019-01-22 18:07:53 -05:00
Aaron Lindsay c8c3defb18
target/arm: Add array for supported PMU events, generate PMCEID[01]_EL0
This commit doesn't add any supported events, but provides the framework
for adding them. We store the pm_event structs in a simple array, and
provide the mapping from the event numbers to array indexes in the
supported_event_map array. Because the value of PMCEID[01] depends upon
which events are supported at runtime, generate it dynamically.

Backports commit 57a4a11b2b281bb548b419ca81bfafb214e4c77a from qemu
2019-01-22 17:45:36 -05:00
Aaron Lindsay 67accd4d88
target/arm: Make PMCEID[01]_EL0 64 bit registers, add PMCEID[23]
Backports commit cad8673744d0914587cd7380e70df11e8c4a0f50 from qemu
2019-01-22 17:32:29 -05:00
Aaron Lindsay 346e4226ec
target/arm: Define FIELDs for ID_DFR0
This is immediately necessary for the PMUv3 implementation to check
ID_DFR0.PerfMon to enable/disable specific features, but defines the
full complement of fields for possible future use elsewhere.

Backports commit beceb99c0c1218d0b55cc04ce6ef77579d3416cb from qemu
2019-01-22 17:26:25 -05:00
Aaron Lindsay 4ff0389d2d
target/arm: Implement PMOVSSET
Add an array for PMOVSSET so we only define it for v7ve+ platforms

Backports commit 327dd5108bb3b66bb5102b659e83a4348a005f5e from qemu
2019-01-22 17:25:22 -05:00
Aaron Lindsay d6d1d49cdd
target/arm: Allow AArch32 access for PMCCFILTR
Backports commit 4b8afa1f99c3575f6cfb26770f90e9fd7bc45468 from qemu
2019-01-22 17:19:03 -05:00
Aaron Lindsay b916fb2cae
target/arm: Filter cycle counter based on PMCCFILTR_EL0
Rename arm_ccnt_enabled to pmu_counter_enabled, and add logic to only
return 'true' if the specified counter is enabled and neither prohibited
or filtered.

Backports commit 033614c47de78409ad3fb39bb7bd1483b71c6789 from qemu
2019-01-22 17:12:46 -05:00
Aaron Lindsay b6b0c18ce5
target/arm: Swap PMU values before/after migrations
Because of the PMU's design, many register accesses have side effects
which are inter-related, meaning that the normal method of saving CP
registers can result in inconsistent state. These side-effects are
largely handled in pmu_op_start/finish functions which can be called
before and after the state is saved/restored. By doing this and adding
raw read/write functions for the affected registers, we avoid
migration-related inconsistencies.

Backports relevant parts of commit
980ebe87053792a5bdefaa87777c40914fd4f673 from qemu
2019-01-22 17:01:34 -05:00
Aaron Lindsay 001283c45b
target/arm: Reorganize PMCCNTR accesses
pmccntr_read and pmccntr_write contained duplicate code that was already
being handled by pmccntr_sync. Consolidate the duplicated code into two
functions: pmccntr_op_start and pmccntr_op_finish. Add a companion to
c15_ccnt in CPUARMState so that we can simultaneously save both the
architectural register value and the last underlying cycle count - this
ensures time isn't lost and will also allow us to access the 'old'
architectural register value in order to detect overflows in later
patches.

Backports commit 5d05b9d462666ed21b7fef61aa45dec9aaa9f0ff from qemu
2019-01-22 16:57:29 -05:00
Richard Henderson 8c14f0ea57
target/arm: Tidy TBI handling in gen_a64_set_pc
We can perform this with fewer operations.

Backports commit 8733d762d5e089a017ac7c5bc71077a8d75d1b46 from qemu
2019-01-22 16:46:11 -05:00
Richard Henderson 1939b28276
target/arm: Enable PAuth for user-only
Add 4 attributes that controls the EL1 enable bits, as we may not
always want to turn on pointer authentication with -cpu max.
However, by default they are enabled.

Backports relevant parts of commit
1ae9cfbd470bffb8d9bacd761344e9b5e8adecb6 from qemu.
2019-01-22 16:42:18 -05:00
Richard Henderson 7f03b024d2
target/arm: Enable PAuth for -cpu max
Backports commit 1ce32e47db52e3511132c7104770eae65d412144 from qemu
2019-01-22 16:38:07 -05:00
Richard Henderson 6e1c9df11f
target/arm: Add PAuth system registers
Backports commit 967aa94f2b0df08d744b6d0bfa21031175e8a0e6 from qemu
2019-01-22 16:36:55 -05:00
Richard Henderson d633a04e61
target/arm: Implement pauth_computepac
This is the main crypto routine, an implementation of QARMA.
This matches, as much as possible, ARM pseudocode.

Backports commit 990870b205ddfdba3fd3c1321e6083005ef59d1a from qemu
2019-01-22 16:35:07 -05:00
Richard Henderson e23d1ef408
target/arm: Implement pauth_addpac
This is not really functional yet, because the crypto is not yet
implemented. This, however follows the AddPAC pseudo function.

Backports commit 63ff0ca94cb84764d2aee45b37c5502a54811dab from qemu
2019-01-22 16:33:25 -05:00
Richard Henderson 4281ae11c4
target/arm: Implement pauth_auth
This is not really functional yet, because the crypto is not yet
implemented. This, however follows the Auth pseudo function.

Backports commit a7bfa086c973a51fc18116c9d2e22a0e0069edba from qemu
2019-01-22 16:32:19 -05:00
Richard Henderson 2545f8cf84
target/arm: Implement pauth_strip
Stripping out the authentication data does not require any crypto,
it merely requires the virtual address parameters.

Backports commit 04d13549fa10bb9775a90701e4e6fd0a2cbf83cb from qemu
2019-01-22 16:31:11 -05:00
Richard Henderson 048d8da45c
target/arm: Reuse aa64_va_parameters for setting tbflags
The arm_regime_tbi{0,1} functions are replacable with the new function
by giving the lowest and highest address.

Backports commit 5d8634f5a3a8474525edcfd581a659830e9e97c0 from qemu
2019-01-22 16:29:54 -05:00
Richard Henderson 028aef155a
target/arm: Decode TBID from TCR
Use TBID in aa64_va_parameters depending on the data parameter.
This automatically updates all existing users of the function.

Backports commit 8220af7e4d34c858898fbfe55943aeea8f4e875f from qemu
2019-01-22 16:27:37 -05:00
Richard Henderson b99e2f920b
target/arm: Add aa64_va_parameters_both
We will want to check TBI for I and D simultaneously.

Backports commit e737ed2ad8c14b4b82ed241646ffa370d29d0937 from qemu
2019-01-22 16:25:12 -05:00
Richard Henderson 23b162f2fb
target/arm: Export aa64_va_parameters to internals.h
We need to reuse this from helper-a64.c. Provide a stub
definition for CONFIG_USER_ONLY. This matches the stub
definitions that we removed for arm_regime_tbi{0,1} before.

Backports commit bf0be433878935e824479e8ae890493e1fb646ed from qemu
2019-01-22 16:22:57 -05:00
Richard Henderson 3fbde0ab73
target/arm: Merge TBFLAG_AA_TB{0, 1} to TBII
We will shortly want to talk about TBI as it relates to data.
Passing around a pair of variables is less convenient than a
single variable.

Backports commit 476a4692f06e381117fb7ad0d04d37c9c2612198 from qemu
2019-01-22 16:19:57 -05:00
Richard Henderson b6415f7a4b
target/arm: Create ARMVAParameters and helpers
Split out functions to extract the virtual address parameters.
Let the functions choose T0 or T1 address space half, if present.
Extract (most of) the control bits that vary between EL or Tx.

Backports commit ba97be9f4a4ecaf16a1454dc669e5f3d935d3b63 from qemu
2019-01-22 16:17:16 -05:00
Richard Henderson 377bd123bd
target/arm: Introduce arm_stage1_mmu_idx
While we could expose stage_1_mmu_idx, the combination is
probably going to be more useful.

Backports commit 64be86ab1b5ef10b660a4230ee7f27c0da499043 from qemu
2019-01-22 16:08:37 -05:00
Richard Henderson 9743787d0f
target/arm: Introduce arm_mmu_idx
The pattern

ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));

is computing the full ARMMMUIdx, stripping off the ARM bits,
and then putting them back.

Avoid the extra two steps with the appropriate helper function.

Backports commit 50494a279dab22a015aba9501a94fcc3cd52140e from qemu
2019-01-22 16:06:34 -05:00
Richard Henderson 8856234574
target/arm: Move cpu_mmu_index out of line
This function is, or will shortly become, too big to inline.

Backports commit 65e4655c609a4a2fd428459d3efb62b704488fd6 from qemu
2019-01-22 16:02:39 -05:00
Richard Henderson 5de5903d1c
target/arm: Decode Load/store register (pac)
Not that there are any stores involved, but why argue with ARM's
naming convention.

Backports commit bd889f4810839a2b68e339696ccf7c406cd62879 from qemu
2019-01-22 15:58:22 -05:00
Richard Henderson 8356fc365f
target/arm: Decode PAuth within disas_uncond_b_reg
Backports commit 561c0a33080f1058a7671d0223122c98e4c9c1f0 from qemu
2019-01-22 15:55:14 -05:00
Richard Henderson 0c09366d68
target/arm: Rearrange decode in disas_uncond_b_reg
This will enable PAuth decode in a subsequent patch.

Backports commit f7cf3bfc1b65a8c550b8439374c0060f7311ad50 from qemu
2019-01-22 15:50:45 -05:00
Richard Henderson 4329ded5e2
target/arm: Add new_pc argument to helper_exception_return
Backports commit d9f482a0279773c3253092ea149daaf00358c635 from qemu
2019-01-22 15:48:15 -05:00
Richard Henderson 0c6f58ebc6
target/arm: Move helper_exception_return to helper-a64.c
This function is only used by AArch64. Code movement only.

Backports commit ce02fd99e6d53df6f3cf5eca85bcac403b402510 from qemu
2019-01-22 15:44:53 -05:00
Richard Henderson febfda4e98
target/arm: Decode PAuth within disas_data_proc_2src
Backports commit b6342a9f929b5946beb6726eef2ef2c5f4a11f09 from qemu
2019-01-22 15:41:44 -05:00
Richard Henderson 999222f0a1
target/arm: Decode PAuth within disas_data_proc_1src
Backports commit 95ebd99dcd37b8574426c876502bfcc7c299584b from qemu
2019-01-22 15:39:53 -05:00
Richard Henderson 967e6a1e90
target/arm: Rearrange decode in disas_data_proc_1src
Now properly signals unallocated for REV64 with SF=0.
Allows for the opcode2 field to be decoded shortly.

Backports commit 18de2813c35e359621a24a0a2a77570e83cb73b9 from qemu
2019-01-22 15:35:44 -05:00
Richard Henderson 02fd7e2472
target/arm: Decode PAuth within system hint space
Backports commit 7c94c8343c6a0eea1633a65ed27987b6a71b9089 from qemu
2019-01-22 15:33:27 -05:00
Richard Henderson e6196b2040
target/arm: Add PAuth helpers
The cryptographic internals are stubbed out for now,
but the enable and trap bits are checked.

Backports commit 0d43e1a2d29a05f7b0d5629caaff18733cbdf3bb from qemu
2019-01-22 15:27:15 -05:00
Richard Henderson 1f7d228c8a
target/arm: Introduce raise_exception_ra
This path uses cpu_loop_exit_restore to unwind current processor state.

Backports commit 7469f6c696d74ad3b22b67c08e1e8f79e2b5d3d6 from qemu
2019-01-22 15:20:06 -05:00
Richard Henderson e6ffbc22c2
target/arm: Add PAuth active bit to tbflags
There are 5 bits of state that could be added, but to save
space within tbflags, add only a single enable bit.
Helpers will determine the rest of the state at runtime.

Backports commit 0816ef1bfcd3ac53e7454b62ca436727887f6056 from qemu
2019-01-22 15:15:59 -05:00
Richard Henderson 54721be30e
target/arm: Add SCTLR bits through ARMv8.5
Post v8.4 bits taken from SysReg_v85_xml-00bet8.

Backports commit b2af69d0b6e0edcb789ca1fcc1199bbfde6ed986 from qemu
2019-01-22 15:14:02 -05:00
Richard Henderson 8ef39cc2d5
target/arm: Add state for the ARMv8.3-PAuth extension
Add storage space for the 5 encryption keys.

Backports commit 991ad91b6a1f09a6ad62b6e6da78d83b548daec7 from qemu
2019-01-22 15:11:39 -05:00
Alexander Graf f2682ff309
target/arm: Allow Aarch32 exception return to switch from Mon->Hyp
In U-boot, we switch from S-SVC -> Mon -> Hyp mode when we want to
enter Hyp mode. The change into Hyp mode is done by doing an
exception return from Mon. This doesn't work with current QEMU.

The problem is that in bad_mode_switch() we refuse to allow
the change of mode.

Note that bad_mode_switch() is used to do validation for two situations:

(1) changes to mode by instructions writing to CPSR.M
(ie not exception take/return) -- this corresponds to the
Armv8 Arm ARM pseudocode Arch32.WriteModeByInstr
(2) changes to mode by exception return

Attempting to enter or leave Hyp mode via case (1) is forbidden in
v8 and UNPREDICTABLE in v7, and QEMU is correct to disallow it
there. However, we're already doing that check at the top of the
bad_mode_switch() function, so if that passes then we should allow
the case (2) exception return mode changes to switch into Hyp mode.

We want to test whether we're trying to return to the nonexistent
"secure Hyp" mode, so we need to look at arm_is_secure_below_el3()
rather than arm_is_secure(), since the latter is always true if
we're in Mon (EL3).

Backports commit 2d2a4549cc29850aab891495685a7b31f5254b12 from qemu
2019-01-22 15:09:30 -05:00
Peter Maydell 55bc017af4
target/arm: Emit barriers for A32/T32 load-acquire/store-release insns
Now that MTTCG is here, the comment in the 32-bit Arm decoder that
"Since the emulation does not have barriers, the acquire/release
semantics need no special handling" is no longer true. Emit the
correct barriers for the load-acquire/store-release insns, as
we already do in the A64 decoder.

Backports commit 96c552958dbb63453b5f02bea6e704006d50e39a from qemu
2019-01-13 19:48:27 -05:00
Richard Henderson 254f882efc
target/arm: SVE brk[ab] merging does not have s bit
While brk[ab] zeroing has a flags setting option, the merging variant
does not. Retain the same argument structure, to share expansion but
force the flag zero and do not decode bit 22.

Backports commit 407e6ce7f1f428cb242d424cd35381a77b5b2071 from qemu
2019-01-13 19:39:34 -05:00
Richard Henderson 4d8b7a9967
target/arm: Convert ARM_TBFLAG_* to FIELDs
Use "register" TBFLAG_ANY to indicate shared state between
A32 and A64, and "registers" TBFLAG_A32 & TBFLAG_A64 for
fields that are specific to the given cpu state.

Move ARM_TBFLAG_BE_DATA to shared state, instead of its current
placement within "Bit usage when in AArch32 state".

Backports commit aad821ac4faad369fad8941d25e59edf2514246b from qemu
2019-01-13 19:21:18 -05:00
Peter Maydell b9d5e1d927
target/arm: Free name string in ARMCPRegInfo hashtable entries'
When we add a new entry to the ARMCPRegInfo hash table in
add_cpreg_to_hashtable(), we allocate memory for tehe
ARMCPRegInfo struct itself, and we also g_strdup() the
name string. So the hashtable's value destructor function
must free the name string as well as the struct.

Spotted by clang's leak sanitizer. The leak here is a
small one-off leak at startup, because we don't support
CPU hotplug, and so the only time when we destroy
hash table entries is for the case where ARM_CP_OVERRIDE
means we register a wildcard entry and then override it later.

Backports commit ac87e5072e2cbfcf8e80caac7ef43ceb6914c7af from qemu
2018-12-18 05:09:59 -05:00
Richard Henderson 8816550c10
target/arm: Implement the ARMv8.1-LOR extension
Provide a trivial implementation with zero limited ordering regions,
which causes the LDLAR and STLLR instructions to devolve into the
LDAR and STLR instructions from the base ARMv8.0 instruction set.

Backports commit 2d7137c10fafefe40a0a049ff8a7bd78b66e661f from qemu
2018-12-18 04:36:58 -05:00
Richard Henderson 32208e482b
target/arm: Use arm_hcr_el2_eff more places
Since arm_hcr_el2_eff includes a check against
arm_is_secure_below_el3, we can often remove a
nearby check against secure state.

In some cases, sort the call to arm_hcr_el2_eff
to the end of a short-circuit logical sequence.

Backports commit 7c208e0f4171c9e2cc35efc12e1bf264a45c229f from qemu
2018-12-18 04:33:07 -05:00
Richard Henderson 78798d10eb
target/arm: Introduce arm_hcr_el2_eff
Replace arm_hcr_el2_{fmo,imo,amo} with a more general routine
that also takes SCR_EL3.NS (aka arm_is_secure_below_el3) into
account, as documented for the plethora of bits in HCR_EL2.

Backports commit f77784446045231f7dfa46c9b872091241fa1557 from qemu
2018-12-18 04:27:34 -05:00
Richard Henderson 4515df5ee7
target/arm: Implement the ARMv8.2-AA32HPD extension
The bulk of the work here, beyond base HPD, is defining the
TTBCR2 register. In addition we must check TTBCR.T2E, which
is not present (RES0) for AArch64.

Backports commit ab638a328fd099ba0b23c8c818eb39f2c35414f3 from qemu
2018-12-18 04:23:37 -05:00
Richard Henderson 3cfd660814
target/arm: Implement the ARMv8.1-HPD extension
Since the TCR_*.HPD bits were RES0 in ARMv8.0, we can simply
interpret the bits as if ARMv8.1-HPD is present without checking.
We will need a slightly different check for hpd for aarch32.

Backports commit 037c13c5904f5fc67bb0ab7dd91ae07347aedee9 from qemu
2018-12-18 04:20:39 -05:00
Richard Henderson 0e08c37773
target/arm: Tidy scr_write
Because EL3 has a fixed execution mode, we can properly decide
which of the bits are RES{0,1}.

Backports commit ea22747c63c9a894777aa41a7af85c3d08e39f81 from qemu
2018-12-18 04:18:09 -05:00
Richard Henderson 52ac2b2f7c
target/arm: Fix HCR_EL2.TGE check in arm_phys_excp_target_el
The enable for TGE has already occurred within arm_hcr_el2_amo
and friends. Moreover, when E2H is also set, the sense is
supposed to be reversed, which has also already occurred within
the helpers.

Backports commit 619959c3583dad325c36f09ce670e7d091382cae from qemu
2018-12-18 04:17:08 -05:00
Richard Henderson a8fb6fc8d5
target/arm: Add SCR_EL3 bits up to ARMv8.5
Post v8.4 bits taken from SysReg_v85_xml-00bet8.

Backports commit 99f8f86d365701fad695be606266aa7dac97ca1c from qemu
2018-12-18 04:16:30 -05:00
Richard Henderson ad27526b58
target/arm: Add HCR_EL2 bits up to ARMv8.5
Post v8.3 bits taken from SysReg_v85_xml-00bet8.

Backports commit 099bf53b7a4bf69f4c4007c769895263a9c3f6f4 from qemu
2018-12-18 04:15:50 -05:00
Peter Maydell 8b69824de7
target/arm: Move id_aa64mmfr* to ARMISARegisters
At the same time, define the fields for these registers,
and use those defines in arm_pamax().

Backports commit 3dc91ddbc68391f934bf6945853e99cf6810fc00 from qemu
2018-12-18 04:03:50 -05:00
Luc Michel 1ae9d988c6
target/arm: fix smc incorrectly trapping to EL3 when secure is off
This commit fixes a case where the CPU would try to go to EL3 when
executing an smc instruction, even though ARM_FEATURE_EL3 is false. This
case is raised when the PSCI conduit is set to smc, but the smc
instruction does not lead to a valid PSCI call.

QEMU crashes with an assertion failure latter on because of incoherent
mmu_idx.

This commit refactors the pre_smc helper by enumerating all the possible
way of handling an scm instruction, and covering the previously missing
case leading to the crash.

The following minimal test would crash before this commit:

.global _start
.text
_start:
ldr x0, =0xdeadbeef ; invalid PSCI call
smc #0

run with the following command line:

aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \
-o test test.s

qemu-system-aarch64 -M virt,virtualization=on,secure=off \
-cpu cortex-a57 -kernel test

Backports commit 7760da729ac88f112f98f36395ac3b55fc9e4211 from qemu
2018-11-23 18:57:23 -05:00
Peter Maydell 900747236f
target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature
The Cortex-A15 and Cortex-A7 both have EL2; now we've implemented
it properly we can enable the feature bit.

Backports commit 436c0cbbeb38dd97c02fe921a7cb253a18afdd86 from qemu
2018-11-16 21:59:55 -05:00
Peter Maydell 61c0f40ac3
target/arm: Hyp mode R14 is shared with User and System
Hyp mode is an exception to the general rule that each AArch32
mode has its own r13, r14 and SPSR -- it has a banked r13 and
SPSR but shares its r14 with User and System mode. We were
incorrectly implementing it as banked, which meant that on
entry to Hyp mode r14 was 0 rather than the USR/SYS r14.

We provide a new function r14_bank_number() which is like
the existing bank_number() but provides the index into
env->banked_r14[]; bank_number() provides the index to use
for env->banked_r13[] and env->banked_cpsr[].

All the points in the code that were using bank_number()
to index into env->banked_r14[] are updated for consintency:
* switch_mode() -- this is the only place where we fix
an actual bug
* aarch64_sync_32_to_64() and aarch64_sync_64_to_32():
no behavioural change as we already special-cased Hyp R14
* kvm32.c: no behavioural change since the guest can't ever
be in Hyp mode, but conceptually the right thing to do
* msr_banked()/mrs_banked(): we can never get to the case
that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP,
so no behavioural change

Backports commit 593cfa2b637b92d37eef949653840dc065cdb960 from qemu
2018-11-16 21:58:29 -05:00
Peter Maydell 92bf8ee620
target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
In commit 8a0fc3a29fc2315325400 we tried to implement HCR_EL2.{VI,VF},
but we got it wrong and had to revert it.

In that commit we implemented them as simply tracking whether there
is a pending virtual IRQ or virtual FIQ. This is not correct -- these
bits cause a software-generated VIRQ/VFIQ, which is distinct from
whether there is a hardware-generated VIRQ/VFIQ caused by the
external interrupt controller. So we need to track separately
the HCR_EL2 bit state and the external virq/vfiq line state, and
OR the two together to get the actual pending VIRQ/VFIQ state.

Fixes: 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f

Backports commit 89430fc6f80a5aef1d4cbd6fc26b40c30793786c from qemu
2018-11-16 21:53:53 -05:00
Peter Maydell a9d07a19c0
target/arm: Track the state of our irq lines from the GIC explicitly
Currently we track the state of the four irq lines from the GIC
only via the cs->interrupt_request or KVM irq state. That means
that we assume that an interrupt is asserted if and only if the
external line is set. This assumption is incorrect for VIRQ
and VFIQ, because the HCR_EL2.{VI,VF} bits allow assertion
of VIRQ and VFIQ separately from the state of the external line.

To handle this, start tracking the state of the external lines
explicitly in a CPU state struct field, as is common practice
for devices.

The complicated part of this is dealing with inbound migration
from an older QEMU which didn't have this state. We assume in
that case that the older QEMU did not implement the HCR_EL2.{VI,VF}
bits as generating interrupts, and so the line state matches
the current state in cs->interrupt_request. (This is not quite
true between commit 8a0fc3a29fc2315325400c7 and its revert, but
that commit is broken and never made it into any released QEMU
version.)

Backports relevant parts of commit  ed89f078ff3d6684ce3e538e4777a3bb4ec3e2b1 from qemu
2018-11-16 21:47:59 -05:00
Peter Maydell 730c99bcc2
Revert "target/arm: Implement HCR.VI and VF"
This reverts commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f.

The implementation of HCR.VI and VF in that commit is not
correct -- they do not track the overall "is there a pending
VIRQ or VFIQ" status, but whether there is a pending interrupt
due to "this mechanism", ie the hypervisor having set the VI/VF
bits. The overall pending state for VIRQ and VFIQ is effectively
the logical OR of the inbound lines from the GIC with the
VI and VF bits. Commit 8a0fc3a29fc231 would result in pending
VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR.

As a preliminary to implementing the HCR.VI/VF feature properly,
revert the broken one entirely.

Backports commit c624ea0fa7ffc9e2cc3e2b36c92b5c960954489f from qemu
2018-11-16 21:46:29 -05:00
Alex Bennée 5b4c46eeab
arm: fix aa64_generate_debug_exceptions to work with EL2
The test was incomplete and incorrectly caused debug exceptions to be
generated when returning to EL2 after a failed attempt to single-step
an EL1 instruction. Fix this while cleaning up the function a little.

Backports commit 22af90255ec2100a44cbbb7f0460ba15eed79538 from qemu
2018-11-16 21:43:41 -05:00
Alex Bennée 2a3edfce37
arm: use symbolic MDCR_TDE in arm_debug_target_el
We already have this symbol defined so lets use it.

Backports commit b281ba4223c302c41ff8104152bfdd44de4fe798 from qemu
2018-11-16 21:42:30 -05:00
Richard Henderson 295dd866b4
target/arm: Fix typo in tlbi_aa64_vmalle1_write
This would cause an infinite recursion or loop.

Backports commit 09a86dfa3f07904792a85990b0b41939417785cd from qemu
2018-11-16 21:41:28 -05:00
Peter Maydell 3edbb8180a
target/arm: Remove workaround for small SAU regions
Before we supported direct execution from MMIO regions, we
implemented workarounds in commit 720424359917887c926a33d2
which let us avoid doing so, even if the SAU or MPU region
was less than page-sized.

Once we implemented execute-from-MMIO, we removed part
of those workarounds in commit d4b6275df320cee76; but
we forgot the one in get_phys_addr_pmsav8() which
suppressed use of small SAU regions in executable regions.
Remove that workaround now.

Backports commit 521ed6b4015ba39a2e39c65a94643f3e6412edc4 from qemu
2018-11-16 21:40:10 -05:00
Peter Maydell 680c79956d
target/arm: Allow execution from small regions
Now that we have full support for small regions, including execution,
we can remove the workarounds where we marked all small regions as
non-executable for the M-profile MPU and SAU.

Backports commit d4b6275df320cee764d56b194b1898547f545857 from qemu
2018-11-16 21:39:33 -05:00
Peter Maydell f694264212
target/arm: Remove antique TODO comment
Remove a TODO comment about implementing the vectored interrupt
controller. We have had an implementation of that for a decade;
it's in hw/intc/pl190.c.

Backports commit e24ad484909e7a00ca4f6332f3698facf0ba3394 from qemu
2018-11-16 18:24:49 -05:00
Peter Maydell 84d5a60c15
target/arm: Fix ATS1Hx instructions
ATS1HR and ATS1HW (which allow AArch32 EL2 to do address translations
on the EL2 translation regime) were implemented in commit 14db7fe09a2c8.
However, we got them wrong: these should do stage 1 address translations
as defined for NS-EL2, which is ARMMMUIdx_S1E2. We were incorrectly
making them perform stage 2 translations.

A few years later in commit 1313e2d7e2cd we forgot entirely that
we'd implemented ATS1Hx, and added a comment that ATS1Hx were
"not supported yet". Remove the comment; there is no extra code
needed to handle these operations in do_ats_write(), because
arm_s1_regime_using_lpae_format() returns true for ARMMMUIdx_S1E2,
which forces 64-bit PAR format.

Backports commit 23463e0e4aeb2f0a9c60549a2c163f4adc0b8512 from qemu
2018-11-11 08:39:19 -05:00
Peter Maydell a445db5c02
target/arm: Set S and PTW in 64-bit PAR format
In do_ats_write() we construct a PAR value based on the result
of the translation. A comment says "S2WLK and FSTAGE are always
zero, because we don't implement virtualization".
Since we do in fact now implement virtualization, add the missing
code that sets these bits based on the reported ARMMMUFaultInfo.

(These bits are named PTW and S in ARMv8, so we follow that
convention in the new comments in this patch.)

Backports commit 0f7b791b35f24cb1333f779705a3f6472e6935de from qemu
2018-11-11 08:38:23 -05:00
Peter Maydell 5aa5ebbcc9
target/arm: Remove can't-happen if() from handle_vec_simd_shli()
In handle_vec_simd_shli() we have a check:

if (size > 3 && !is_q) {
    unallocated_encoding(s);
    return;
}

However this can never be true, because we calculate
int size = 32 - clz32(immh) - 1;
where immh is a 4 bit field which we know cannot be all-zeroes.
So the clz32() return must be in {28,29,30,31} and the resulting
size is in {0,1,2,3}, and "size > 3" is never true.

This unnecessary code confuses Coverity's analysis:
in CID 1396476 it thinks we might later index off the
end of an array because the condition implies that we
might have a size > 3.

Remove the code, and instead assert that the size is in [0..3],
since the decode that enforces that is somewhat distant from
this function.

Backports commit f6c98f91f56031141a47f86225fdc30f0f9f84fb from qemu
2018-11-11 08:37:16 -05:00
Richard Henderson 0557899c8e
target/arm: Conditionalize some asserts on aarch32 support
When populating id registers from kvm, on a host that doesn't support
aarch32 mode at all, neither arm_div nor jazelle will be supported either.

Backports commit 0f8d06f16c9d1041d728d09d464462ebe713c662 from qemu
2018-11-11 08:32:46 -05:00
Richard Henderson 4d49c004e4
decodetree: Remove insn argument from trans_* expanders
This allows trans_* expanders to be shared between decoders
for 32 and 16-bit insns, by not tying the expander to the
size of the insn that produced it.

This change requires adjusting the two existing users to match.

Backports commit 3a7be5546506be62d5c6c4b804119cedf9e367d6 from qemu
2018-11-11 08:27:01 -05:00
Richard Henderson e9fe7d3c8d
target/arm: Only flush tlb if ASID changes
Since QEMU does not implement ASIDs, changes to the ASID must flush the
tlb. However, if the ASID does not change there is no reason to flush.

In testing a boot of the Ubuntu installer to the first menu, this reduces
the number of flushes by 30%, or nearly 600k instances.

Backports commit 93f379b0c43617b1361f742f261479eaed4959cb from qemu
2018-11-10 11:26:24 -05:00
Richard Henderson 15a6b3f771
target/arm: Remove writefn from TTBR0_EL3
The EL3 version of this register does not include an ASID,
and so the tlb_flush performed by vmsa_ttbr_write is not needed.

Backports commit f478847f1ee0df9397f561025ab2f687fd923571 from qemu
2018-11-10 11:25:39 -05:00
Richard Henderson 1bcba0737e
target/arm: Reorg NEON VLD/VST single element to one lane
Instead of shifts and masks, use direct loads and stores from
the neon register file.

Backports commit 2d6ac920837f558be214ad2ddd28cad7f3b15e5c from qemu
2018-11-10 11:24:37 -05:00
Richard Henderson 37103f1bc4
target/arm: Promote consecutive memory ops for aa32
For a sequence of loads or stores from a single register,
little-endian operations can be promoted to an 8-byte op.
This can reduce the number of operations by a factor of 8.

Backports commit e23f12b3a252352b575908ca7b94587acd004641 from qemu
2018-11-10 11:19:15 -05:00
Richard Henderson 1cab7a41ac
target/arm: Reorg NEON VLD/VST all elements
Instead of shifts and masks, use direct loads and stores from the neon
register file. Mirror the iteration structure of the ARM pseudocode
more closely. Correct the parameters of the VLD2 A2 insn.

Note that this includes a bugfix for handling of the insn
"VLD2 (multiple 2-element structures)" -- we were using an
incorrect stride value.

Backports commit ac55d00709e78cd39dfa298dcaac7aecb58762e8 from qemu
2018-11-10 11:18:45 -05:00
Richard Henderson a2239b9f5b
target/arm: Use gvec for NEON VLD all lanes
Backports commit 7377c2c97e20e64ed9b481eb2d9b9084bfd5b7e9 from qemu
2018-11-10 11:08:29 -05:00
Richard Henderson 985acb9cde
target/arm: Use gvec for NEON_3R_VTST_VCEQ, NEON_3R_VCGT, NEON_3R_VCGE
Move cmtst_op expanders from translate-a64.c.

Backports commit ea580fa312674c1ba82a8b137caf42b0609ce3e3 from qemu
2018-11-10 11:03:42 -05:00
Richard Henderson 5d9c0e52bf
target/arm: Use gvec for NEON_3R_VML
Move mla_op and mls_op expanders from translate-a64.c.

Backports commit 4a7832b095b9ce97a815749a13516f5cfb3c5dd4 from qemu
2018-11-10 10:58:44 -05:00
Richard Henderson 79bbb7c730
target/arm: Use gvec for VSRI, VSLI
Move shi_op and sli_op expanders from translate-a64.c.

Backports commit f3cd8218d1d3e534877ce3f3cb61c6757d10f9df from qemu
2018-11-10 10:53:28 -05:00
Lioncash edb36c7505
target/arm: Use gvec for VSRA 2018-11-10 10:32:29 -05:00
Richard Henderson b5877f1dfb
target/arm: Use gvec for VSHR, VSHL
Backports commit 1dc8425e551be1371d657e94367f37130cd7aede from qemu
2018-11-10 10:14:31 -05:00
Lioncash 7790ca1ccb
target/arm: Use gvec for NEON_3R_VMUL 2018-11-10 10:11:10 -05:00
Richard Henderson dfdc6bc05c
target/arm: Use gvec for NEON_2RM_VMN, NEON_2RM_VNEG
Backports commit 4bf940bebad273e4b3534ae3f83f2c9d1191d3a2 from qemu
2018-11-10 10:09:38 -05:00
Richard Henderson 7b4b5ac249
target/arm: Use gvec for NEON_3R_VADD_VSUB insns
Backports commit e4717ae02dd0c2e544a07302c1ed473775209aba from qemu
2018-11-10 10:08:23 -05:00
Richard Henderson 0965b9513a
target/arm: Use gvec for NEON_3R_LOGIC insns
Move expanders for VBSL, VBIT, and VBIF from translate-a64.c.

Backports commit eabcd6faa90461e0b7463f4ebe75b8d050487c9c from qemu
2018-11-10 10:06:13 -05:00
Richard Henderson 9f767248a2
target/arm: Use gvec for NEON VMOV, VMVN, VBIC & VORR (immediate)
Backports commit 246fa4aca95e213fba10c8222dbc6bd0a9a2a8d4 from qemu
2018-11-10 09:56:30 -05:00
Richard Henderson c1251a19e1
target/arm: Use gvec for NEON VDUP
Also introduces neon_element_offset to find the env offset
of a specific element within a neon register.

Backports commit 32f91fb71f4c32113ec8c2af5f74f14abe6c7162 from qemu
2018-11-10 09:51:40 -05:00
Richard Henderson 3d5f040608
target/arm: Mark some arrays const
Backports commit 308e5636152594daa4c5597b1188d44d7266db04 from qemu
2018-11-10 09:49:25 -05:00
Richard Henderson 931b49fb06
target/arm: Promote consecutive memory ops for aa64
For a sequence of loads or stores from a single register,
little-endian operations can be promoted to an 8-byte op.
This can reduce the number of operations by a factor of 8.

Backports commit 87f9a7f0c8d5122c36743885158782c2348a6d21 from qemu
2018-11-10 09:46:04 -05:00
Richard Henderson e6707b900c
target/arm: Use tcg_gen_gvec_dup_i64 for LD[1-4]R
Backports commit 10e0b33c676b4e8ac80d5929980f4fa6be617c5a from qemu
2018-11-10 09:41:14 -05:00
Richard Henderson 74aba4ba51
target/arm: Don't call tcg_clear_temp_count
This is done generically in translator_loop.

Backports commit 7108e255c2d95b44c9dfee8075d0d6fb391281a8 from qemu
2018-11-10 09:40:06 -05:00
Richard Henderson 9bbc412c66
target/arm: Hoist address increment for vector memory ops
This can reduce the number of opcodes required for certain
complex forms of load-multiple (e.g. ld4.16b).

Backports commit a7d8143aed2268f147cc1abfebc848ed6282a313 from qemu
2018-11-10 09:39:20 -05:00
Peter Maydell d60fe610bb
target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode
For traps of FP/SIMD instructions to AArch32 Hyp mode, the syndrome
provided in HSR has more information than is reported to AArch64.
Specifically, there are extra fields TA and coproc which indicate
whether the trapped instruction was FP or SIMD. Add this extra
information to the syndromes we construct, and mask it out when
taking the exception to AArch64.

Backports commit 4be42f4013fa1a9df47b48aae5148767bed8e80c from qemu
2018-11-10 09:36:41 -05:00
Peter Maydell 075bac4d57
target/arm: Get IL bit correct for v7 syndrome values
For the v7 version of the Arm architecture, the IL bit in
syndrome register values where the field is not valid was
defined to be UNK/SBZP. In v8 this is RES1, which is what
QEMU currently implements. Handle the desired v7 behaviour
by squashing the IL bit for the affected cases:
* EC == EC_UNCATEGORIZED
* prefetch aborts
* data aborts where ISV is 0

(The fourth case listed in the v8 Arm ARM DDI 0487C.a in
section G7.2.70, "illegal state exception", can't happen
on a v7 CPU.)

This deals with a corner case noted in a comment.

Backports commit 2ed08180db096ea5e44573529b85e09b1ed10b08 from qemu
2018-11-10 09:29:13 -05:00
Peter Maydell 99516b43a3
target/arm: New utility function to extract EC from syndrome
Create and use a utility function to extract the EC field
from a syndrome, rather than open-coding the shift.

Backports commit 64b91e3f890a8c221b65c6820a5ee39107ee40f5 from qemu
2018-11-10 09:28:23 -05:00
Peter Maydell ebe442b1d4
target/arm: Implement HCR.PTW
If the HCR_EL2 PTW virtualizaiton configuration register bit
is set, then this means that a stage 2 Permission fault must
be generated if a stage 1 translation table access is made
to an address that is mapped as Device memory in stage 2.
Implement this.

Backports commit eadb2febf05452bd8062c4c7823d7d789142500c from qemu
2018-11-10 09:25:57 -05:00
Peter Maydell 28fcb58c69
target/arm: Implement HCR.VI and VF
The HCR_EL2 VI and VF bits are supposed to track whether there is
a pending virtual IRQ or virtual FIQ. For QEMU we store the
pending VIRQ/VFIQ status in cs->interrupt_request, so this means:
* if the register is read we must get these bit values from
cs->interrupt_request
* if the register is written then we must write the bit
values back into cs->interrupt_request

Backports commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f from qemu
2018-11-10 09:23:21 -05:00
Peter Maydell 0f0befc90a
target/arm: ISR_EL1 bits track virtual interrupts if IMO/FMO set
The A/I/F bits in ISR_EL1 should track the virtual interrupt
status, not the physical interrupt status, if the associated
HCR_EL2.AMO/IMO/FMO bit is set. Implement this, rather than
always showing the physical interrupt status.

We don't currently implement anything to do with external
aborts, so this applies only to the I and F bits (though it
ought to be possible for the outer guest to present a virtual
external abort to the inner guest, even if QEMU doesn't
emulate physical external aborts, so there is missing
functionality in this area).

Backports commit 636540e9c40bd0931ef3022cb953bb7dbecd74ed from qemu
2018-11-10 09:20:58 -05:00
Peter Maydell f0c9e690fb
target/arm: Implement HCR.DC
The HCR.DC virtualization configuration register bit has the
following effects:
* SCTLR.M behaves as if it is 0 for all purposes except
direct reads of the bit
* HCR.VM behaves as if it is 1 for all purposes except
direct reads of the bit
* the memory type produced by the first stage of the EL1&EL0
translation regime is Normal Non-Shareable,
Inner Write-Back Read-Allocate Write-Allocate,
Outer Write-Back Read-Allocate Write-Allocate.

Implement this behaviour.

Backports commit 9d1bab337caf2324a233e5937f415fad4ce1641b from qemu
2018-11-10 09:19:44 -05:00
Peter Maydell b9e7fa2d80
target/arm: Implement HCR.FB
The HCR.FB virtualization configuration register bit requests that
TLB maintenance, branch predictor invalidate-all and icache
invalidate-all operations performed in NS EL1 should be upgraded
from "local CPU only to "broadcast within Inner Shareable domain".
For QEMU we NOP the branch predictor and icache operations, so
we only need to upgrade the TLB invalidates:
AArch32 TLBIALL, TLBIMVA, TLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID,
ITLBIALL, ITLBIMVA, ITLBIASID, TLBIMVAA, TLBIMVAL, TLBIMVAAL
AArch64 TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1,
TLBI VALE1, TLBI VAALE1

Backports commit b4ab8ce98b8c482c8986785800f238d32a1578a9 from qemu
2018-11-10 09:17:51 -05:00
Lioncash a0358202a7
target/arm: Improve debug logging of AArch32 exception return
For AArch32, exception return happens through certain kinds
of CPSR write. We don't currently have any CPU_LOG_INT logging
of these events (unlike AArch64, where we log in the ERET
instruction). Add some suitable logging.

This will log exception returns like this:
Exception return from AArch32 hyp to usr PC 0x80100374

paralleling the existing logging in the exception_return
helper for AArch64 exception returns:
Exception return from AArch64 EL2 to AArch64 EL0 PC 0x8003045c
Exception return from AArch64 EL2 to AArch32 EL0 PC 0x8003045c

(Note that an AArch32 exception return can only be
AArch32->AArch32, never to AArch64.)

Backports commit 81e3728407bf4a12f83e14fd410d5f0a7d29b5b4 from qemu
2018-11-10 09:09:52 -05:00
Richard Henderson 03ec90f39b
target/arm: Convert v8.2-fp16 from feature bit to aa64pfr0 test
Backports commit 5763190fa8705863b4b725aa1657661a97113eb4 from qemu
2018-11-10 08:34:32 -05:00
Richard Henderson 0286f9525d
target/arm: Convert sve from feature bit to aa64pfr0 test
Backports commit cd208a1c3923bc097ec55c5b207d79294ab0e719 from qemu
2018-11-10 08:27:35 -05:00
Richard Henderson 03e2d64aed
target/arm: Convert jazelle from feature bit to isar1 test
Having V6 alone imply jazelle was wrong for cortex-m0.
Change to an assertion for V6 & !M.

This was harmless, because the only place we tested ARM_FEATURE_JAZELLE
was for 'bxj' in disas_arm(), which is unreachable for M-profile cores.

Backports commit 09cbd50198d5dcac8bea2e47fa5dd641ec505fae from qemu
2018-11-10 08:24:11 -05:00
Richard Henderson 4a58a81e31
target/arm: Convert division from feature bits to isar0 tests
Both arm and thumb2 division are controlled by the same ISAR field,
which takes care of the arm implies thumb case. Having M imply
thumb2 division was wrong for cortex-m0, which is v6m and does not
have thumb2 at all, much less thumb2 division.

Backports commit 7e0cf8b47f0e67cebbc3dfa73f304e56ad1a090f from qemu
2018-11-10 08:21:02 -05:00
Richard Henderson 4221703f18
target/arm: Convert v8 extensions from feature bits to isar tests
Most of the v8 extensions are self-contained within the ISAR
registers and are not implied by other feature bits, which
makes them the easiest to convert.

Backports commit 962fcbf2efe57231a9f5df0ae0f40c05e35628ba from qemu
2018-11-10 08:17:57 -05:00
Richard Henderson e5797bb0b7
target/arm: V8M should not imply V7VE
Instantiating mps2-an505 (cortex-m33) will fail make check when
V7VE asserts that ID_ISAR0.Divide includes ARM division. It is
also wrong to include ARM_FEATURE_LPAE.

Backports commit 5256df880d1312a58472af3fb0a3c51e708f2161 from qemu
2018-11-10 08:02:26 -05:00
Richard Henderson 1a714e97af
target/arm: Move some system registers into a substructure
Create struct ARMISARegisters, to be accessed during translation.

Backports commit 47576b94af5c406fc6521fb336fb5c12beeac3f8 from qemu
2018-11-10 08:00:32 -05:00
Dongjiu Geng 7087f7f398
target/arm: Add support for VCPU event states
This patch extends the qemu-kvm state sync logic with support for
KVM_GET/SET_VCPU_EVENTS, giving access to yet missing SError exception.
And also it can support the exception state migration.

The SError exception states include SError pending state and ESR value,
the kvm_put/get_vcpu_events() will be called when set or get system
registers. When do migration, if source machine has SError pending,
QEMU will do this migration regardless whether the target machine supports
to specify guest ESR value, because if target machine does not support that,
it can also inject the SError with zero ESR value.

Backports the relevant parts of commit
202ccb6bab5fe26bca2c82bff23302f7acfd1940 from qemu
2018-11-10 07:49:15 -05:00
Richard Henderson af6c47e192
target/arm: Check HAVE_CMPXCHG128 at translate time
Backports part of commit 62823083b8a2da8e126bb82b7b70f68eaa27b338 from
qemu
2018-10-23 15:29:46 -04:00
Richard Henderson 65beab9dd9
target/arm: Convert to HAVE_CMPXCHG128
Backports commit 1ec182c3337993a7d8b3983a1ac4f608c1d0fd64 from qemu
2018-10-23 15:25:30 -04:00
Lioncash 5f12065284
sve_helper: Use the QEMU_FLATTEN macro instead of the compiler attribute directly
Keeps the code compiler-independent.
2018-10-23 13:05:02 -04:00
Peter Maydell 64661a9165
target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
The get_phys_addr() functions take a pointer to an ARMMMUFaultInfo
struct, which they fill in only if a fault occurs. This means that
the caller must always zero-initialize the struct before passing
it in. We forgot to do this in v7m_stack_read() and v7m_stack_write().
Correct the error.

Backports commit ab44c7b71fa683b9402bea0d367b87c881704188 from qemu
2018-10-23 12:58:39 -04:00
Aaron Lindsay 1596801693
target/arm: Mask PMOVSR writes based on supported counters
This is an amendment to my earlier patch:
commit 7ece99b17e832065236c07a158dfac62619ef99b

Backports commit 599b71e277ac7e92807191b20b7163a28c5450ad from qemu
2018-10-23 12:56:45 -04:00
Aaron Lindsay 10c6887e0b
target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
I previously fixed this for PMINTENSET_EL1, but missed these.

Backports commit fc5f6856a02168864a5c1a46866a12839322222f from qemu
2018-10-23 12:56:06 -04:00
Edgar E. Iglesias 0595aa5ade
target/arm: Add the Cortex-A72
Backports commit f11b452b95df4a0fc6561c278721cad03b24098b from qemu
2018-10-23 12:54:57 -04:00
Edgar E. Iglesias fa9828845f
target-arm: powerctl: Enable HVC when starting CPUs to EL2
When QEMU provides the equivalent of the EL3 firmware, we
need to enable HVCs in scr_el3 when turning on CPUs that
target EL2.

Backports commit 86278c33d1d71196f5e22ce3ce82a1b34a199754 from qemu
2018-10-23 12:53:40 -04:00
Richard Henderson 3b3bce7d4e
target/arm: Fix cortex-a7 id_isar0
The incorrect value advertised only thumb2 div without arm div.

Backports commit 37bdda89eb7615cb225f781c9fb552e144c68ea7 from qemu
2018-10-23 12:47:15 -04:00
Richard Henderson 3023a9723a
target/arm: Align cortex-r5 id_isar0
The missing nibble made it more difficult to read.

Backports commit aaab8f3400ea5ec9c6cce3607ff26f9be89321d6 from qemu
2018-10-23 12:46:28 -04:00
Richard Henderson 767242174a
target/arm: Define fields of ISAR registers
Backports commit a62e62af9f26bf655fe95ada796f28a6a16c0561 from qemu
2018-10-23 12:45:55 -04:00
Richard Henderson ce9485a63e
target/arm: Fix aarch64_sve_change_el wrt EL0
At present we assert:

arm_el_is_aa64: Assertion `el >= 1 && el <= 3' failed.

The comment in arm_el_is_aa64 explains why asking about EL0 without
extra information is impossible. Add an extra argument to provide
it from the surrounding context.

Fixes: 0ab5953b00b3

Backports commit 9a05f7b67436abdc52bce899f56acfde2e831454 from qemu
2018-10-23 12:44:04 -04:00
Peter Maydell ff812cc152
target/arm: Add v8M stack checks for MSR to SP_NS
Updating the NS stack pointer via MSR to SP_NS should include
a check whether the new SP value is below the stack limit.
No other kinds of update to the various stack pointer and
limit registers via MSR should perform a check.

Backports commit 167765f0739e4a108e8c2e2ff2f37917df5658f9 from qemu
2018-10-08 14:24:30 -04:00
Peter Maydell 76f521e6c3
target/arm: Add v8M stack checks for VLDM/VSTM
Add the v8M stack checks for the VLDM/VSTM
(aka VPUSH/VPOP) instructions. This code is currently
unreachable because we haven't yet implemented M profile
floating point support, but since the change is simple,
we add it now because otherwise we're likely to forget to
do it later.

Backports commit 8a954faf5412d5073d585d85a1da63a09bb5d84e from qemu
2018-10-08 14:23:02 -04:00
Peter Maydell 37d0c7fcf1
target/arm: Add v8M stack checks for Thumb push/pop
Add v8M stack checks for the 16-bit Thumb push/pop
encodings: STMDB, STMFD, LDM, LDMIA, LDMFD.

Backports commit aa369e5c08bbe2748d2be96f13f4ef469a4d3080 from qemu
2018-10-08 14:22:08 -04:00
Peter Maydell ef9afb1855
target/arm: Add v8M stack checks for T32 load/store single
Add v8M stack checks for the instructions in the T32
"load/store single" encoding class: these are the
"immediate pre-indexed" and "immediate, post-indexed"
LDR and STR instructions.

Backports commit 0bc003bad9752afc61624cb680226c922f34f82c from qemu
2018-10-08 14:20:58 -04:00
Peter Maydell de30651f5e
target/arm: Add v8M stack checks for Thumb2 LDM/STM
Add the v8M stack checks for:
* LDM (T2 encoding)
* STM (T2 encoding)

This includes the 32-bit encodings of the instructions listed
in v8M ARM ARM rule R_YVWT as
* LDM, LDMIA, LDMFD
* LDMDB, LDMEA
* POP (multiple registers)
* PUSH (muliple registers)
* STM, STMIA, STMEA
* STMDB, STMFD

We perform the stack limit before doing any other part
of the load or store.

Backports commit 7c0ed88e7d6bee3e55c3d8935c46226cb544191a from qemu
2018-10-08 14:19:14 -04:00
Peter Maydell bb97240df6
target/arm: Add v8M stack checks for LDRD/STRD (imm)
Add the v8M stack checks for:
* LDRD (immediate)
* STRD (immediate)

Loads and stores are more complicated than ADD/SUB/MOV, because we
must ensure that memory accesses below the stack limit are not
performed, so we can't simply do the check when we actually update
SP.

For these instructions, if the stack limit check triggers
we must not:
* perform any memory access below the SP limit
* update PC, SP or the load/store base register
but it is IMPDEF whether we:
* perform any accesses above or equal to the SP limit
* update destination registers for loads

For QEMU we choose to always check the limit before doing any other
part of the load or store, so we won't update any registers or
perform any memory accesses.

It is UNKNOWN whether the limit check triggers for a load or store
where the initial SP value is below the limit and one of the stores
would be below the limit, but the writeback moves SP to above the
limit. For QEMU we choose to trigger the check in this situation.

Note that limit checks happen only for loads and stores which update
SP via writeback; they do not happen for loads and stores which
simply use SP as a base register.

Backports commit 910d7692e5b60f2c2d08cc3d6d36076e85b6a69d from qemu
2018-10-08 14:17:27 -04:00
Lioncash cb935d868e
target/arm: Add v8M stack limit checks on NS function calls 2018-10-08 14:15:15 -04:00
Peter Maydell ed3c951fb6
target/arm: Add v8M stack checks on exception entry
Add checks for breaches of the v8M stack limit when the
stack pointer is decremented to push the exception frame
for exception entry.

Note that the exception-entry case is unique in that the
stack pointer is updated to be the limit value if the limit
is hit (per rule R_ZLZG).

Backports commit c32da7aa6205a5ff62ae8d5062f7cad0eae4c1fd from qemu
2018-10-08 14:15:15 -04:00