Commit graph

971 commits

Author SHA1 Message Date
Paolo Bonzini 5c85c564b5
exec: Atomic access to bounce buffer
There could be a race condition when two processes call
address_space_map concurrently and both want to use the bounce buffer.

Add an in_use flag in BounceBuffer to sync it.

Backports commit c2cba0ffe495b60c4cc58080281e99c7a6580d4b from qemu
2018-02-12 21:00:17 -05:00
Eduardo Habkost 141754beea
target-i386: Remove AMD feature flag aliases from CPU model table
When CPU vendor is AMD, the AMD feature alias bits on
CPUID[0x80000001].EDX are already automatically copied from CPUID[1].EDX
on x86_cpu_realizefn(). When CPU vendor is Intel, those bits are
reserved and should be zero. On either case, those bits shouldn't be set
in the CPU model table.

Backports commit 726a8ff68677d8d5fba17eb0ffb85076bfb598dc from qemu
2018-02-12 20:55:52 -05:00
Eduardo Habkost 43ab099a13
target-i386: X86CPU::xlevel2 QOM property
We already have "level" and "xlevel", only "xlevel2" is missing.

Backports commit 01431f3ce0f31e123172cc99c12c98c0ddbe9917 from qemu
2018-02-12 20:53:22 -05:00
Eduardo Habkost f75d72bc3d
target-i386: Make level and xlevel properties static
Static properties require only 1 line of code, much simpler than the
existing code that requires writing new getters/setters.

As a nice side-effect, this fixes an existing bug where the setters were
incorrectly allowing the properties to be changed after the CPU was
already realized.

Backports commit b9472b76d273c7796d877c49af50969c0a879c50 from qemu
2018-02-12 20:50:25 -05:00
Sergey Fedorov 96a99a1bbe
Allow ARMv8 SCR.SMD updates
Updated scr_write to always allow updates to the SCR.SMD bit on ARMv8
regardless of whether virtualization (EL2) is enabled or not.

Backports commit 4eb276408363aef5435a72a8e818f24220b5edd0 from qemu
2018-02-12 20:48:34 -05:00
Sergey Fedorov f748c278b2
target-arm: Adjust id_aa64pfr0 when has_el3 CPU property disabled 2018-02-12 20:47:32 -05:00
Sergey Fedorov dd9e33bb6d
target-arm: rename c1_coproc to cpacr_el1
Rename the field holding CPACR_EL1 system register state in AArch64
naming style.

Backports commit 7ebd5f2e03a00889619bb97e83062d27066d4a26 from qemu
2018-02-12 20:46:00 -05:00
Peter Maydell e1a7c13fb4
target-arm: Add user-mode transaction attribute
Add a transaction attribute indicating that a memory access is being
done from user-mode (unprivileged). This corresponds to an equivalent
signal in ARM AMBA buses.

Backports commit 0995bf8cd91b81ec9c1078e37b808794080dc5c0 from qemu
2018-02-12 20:41:58 -05:00
Peter Maydell 2281d6c4c9
target-arm: Use correct memory attributes for page table walks
Factor out the page table walk memory accesses into their own function,
so that we can specify the correct S/NS memory attributes for them.
This will also provide a place to use the correct endianness and
handle the need for a stage-2 translation when virtualization is
supported.

Backports commit ebca90e4c3aaaae5ed1ee7c569dea00d5d6ed476 from qemu
2018-02-12 20:40:19 -05:00
Peter Maydell 6c8b7e0fed
target-arm: Honour NS bits in page tables
Honour the NS bit in ARM page tables:
* when adding entries to the TLB, include the Secure/NonSecure
transaction attribute
* set the NS bit in the PAR when doing ATS operations

Note that we don't yet correctly use the NSTable bit to
cause the page table walk itself to use the right attributes.

Backports commit 8bf5b6a9c1911d2c8473385fc0cebfaaeef42dbc from qem
2018-02-12 20:36:35 -05:00
Andrew Jones 92b1f22a45
target-arm: get_phys_addr_lpae: more xn control
This patch makes the following changes to the determination of
whether an address is executable, when translating addresses
using LPAE.

1. No longer assumes that PL0 can't execute when it can't read.
   It can in AArch64, a difference from AArch32.
2. Use va_size == 64 to determine we're in AArch64, rather than
   arm_feature(env, ARM_FEATURE_V8), which is insufficient.
3. Add additional XN determinants
   - NS && is_secure && (SCR & SCR_SIF)
   - WXN && (prot & PAGE_WRITE)
   - AArch64: (prot_PL0 & PAGE_WRITE)
   - AArch32: UWXN && (prot_PL0 & PAGE_WRITE)
   - XN determination should also work in secure mode (untested)
   - XN may even work in EL2 (currently impossible to test)
4. Cleans up the bloated PAGE_EXEC condition - by removing it.

The helper get_S1prot is introduced. It may even work in EL2,
when support for that comes, but, as the function name implies,
it only works for stage 1 translations.

Backports commit d8e052b387635639a6ba4a09a7874fd2f113b218 from qemu
2018-02-12 20:28:29 -05:00
Andrew Jones ea94701bd0
target-arm: fix get_phys_addr_v6/SCTLR_AFE access check
Introduce simple_ap_to_rw_prot(), which has the same behavior as
ap_to_rw_prot(), but takes the 2-bit simple AP[2:1] instead of
the 3-bit AP[2:0]. Use this in get_phys_addr_v6 when SCTLR_AFE
is set, as that bit indicates we should be using the simple AP
format.

It's unlikely this path is getting used. I don't see CR_AFE
getting used by Linux, so possibly not. If it had been, then
the check would have been wrong for all but AP[2:1] = 0b11.
Anyway, this should fix it up, in case it ever does get used.

Backports commit d76951b65dfb1be4e41cfae6abebf8db7a1243a3 from qemu
2018-02-12 20:22:55 -05:00
Andrew Jones dd8d05620f
target-arm: convert check_ap to ap_to_rw_prot
Instead of mixing access permission checking with access permissions
to page protection flags translation, just do the translation, and
leave it to the caller to check the protection flags against the access
type. Also rename to ap_to_rw_prot to better describe the new behavior.

Backports commit 0fbf5238203041f734c51b49778223686f14366b from qemu
2018-02-12 20:17:49 -05:00
Peter Maydell a3ab677e63
Switch non-CPU callers from ld/st*_phys to address_space_ld/st*
Switch all the uses of ld/st*_phys to address_space_ld/st*,
except for those cases where the address space is the CPU's
(ie cs->as). This was done with the following script which
generates a Coccinelle patch.

A few over-80-columns lines in the result were rewrapped by
hand where Coccinelle failed to do the wrapping automatically,
as well as one location where it didn't put a line-continuation
'\' when wrapping lines on a change made to a match inside
a macro definition.

===begin===

for FN in ub uw_le uw_be l_le l_be q_le q_be uw l q; do
cat <<EOF
@ cpu_matches_ld_${FN} @
expression E1,E2;
identifier as;
@@

ld${FN}_phys(E1->as,E2)

@ other_matches_ld_${FN} depends on !cpu_matches_ld_${FN} @
expression E1,E2;
@@

-ld${FN}_phys(E1,E2)
+address_space_ld${FN}(E1,E2, MEMTXATTRS_UNSPECIFIED, NULL)

EOF

done

for FN in b w_le w_be l_le l_be q_le q_be w l q; do
cat <<EOF
@ cpu_matches_st_${FN} @
expression E1,E2,E3;
identifier as;
@@

st${FN}_phys(E1->as,E2,E3)

@ other_matches_st_${FN} depends on !cpu_matches_st_${FN} @
expression E1,E2,E3;
@@

-st${FN}_phys(E1,E2,E3)
+address_space_st${FN}(E1,E2,E3, MEMTXATTRS_UNSPECIFIED, NULL)

EOF

done
===endit===

Backports commit 42874d3a8c6267ff7789a0396843c884b1d0933a from qemu
2018-02-12 19:27:02 -05:00
Peter Maydell df0fac6b6a
exec.c: Add new address_space_ld*/st* functions
Add new address_space_ld*/st* functions which allow transaction
attributes and error reporting for basic load and stores. These
are named to be in line with the address_space_read/write/rw
buffer operations.

The existing ld/st*_phys functions are now wrappers around
the new functions.

Backports commit 500131154d677930fce35ec3a6f0b5a26bcd2973 from qemu
2018-02-12 19:22:47 -05:00
Peter Maydell b94c89e559
exec.c: Make address_space_rw take transaction attributes
Make address_space_rw take transaction attributes, rather
than always using the 'unspecified' attributes.

Backports commit 5c9eb0286c819c1836220a32f2e1a7b5004ac79a from qemu
2018-02-12 19:04:09 -05:00
Peter Maydell 6143189cce
exec.c: Convert subpage memory ops to _with_attrs
Convert the subpage memory ops to _with_attrs; this will allow
us to pass the attributes through to the underlying access
functions. (Nothing uses the attributes yet.)

Backports commit f25a49e0057bbfcc2b1111f60785d919b6ddaeea from qemu
2018-02-12 18:47:38 -05:00
Peter Maydell 933e3bd8d1
Add MemTxAttrs to the IOTLB
Add a MemTxAttrs field to the IOTLB, and allow target-specific
code to set it via a new tlb_set_page_with_attrs() function;
pass the attributes through to the device when making IO accesses.

Backports commit fadc1cbe85c6b032d5842ec0d19d209f50fcb375 from qemu
2018-02-12 18:38:38 -05:00
Peter Maydell 2aecce835b
Make CPU iotlb a structure rather than a plain hwaddr
Make the CPU iotlb a structure rather than a plain hwaddr;
this will allow us to add transaction attributes to it.

Backports commit e469b22ffda40188954fafaf6e3308f58d50f8f8 from qemu
2018-02-12 18:34:05 -05:00
Peter Maydell 825e74410f
memory: Replace io_mem_read/write with memory_region_dispatch_read/write
Rather than retaining io_mem_read/write as simple wrappers around
the memory_region_dispatch_read/write functions, make the latter
public and change all the callers to use them, since we need to
touch all the callsites anyway to add MemTxAttrs and MemTxResult
support. Delete io_mem_read and io_mem_write entirely.

(All the callers currently pass MEMTXATTRS_UNSPECIFIED
and convert the return value back to bool or ignore it.)

Backports commit 3b6434953934e6d4a776ed426d8c6d6badee176f from qemu
2018-02-12 17:26:52 -05:00
Peter Maydell b2962f4613
memory: Define API for MemoryRegionOps to take attrs and return status
Define an API so that devices can register MemoryRegionOps whose read
and write callback functions are passed an arbitrary pointer to some
transaction attributes and can return a success-or-failure status code.
This will allow us to model devices which:
* behave differently for ARM Secure/NonSecure memory accesses
* behave differently for privileged/unprivileged accesses
* may return a transaction failure (causing a guest exception)
for erroneous accesses

This patch defines the new API and plumbs the attributes parameter through
to the memory.c public level functions io_mem_read() and io_mem_write(),
where it is currently dummied out.

The success/failure response indication is also propagated out to
io_mem_read() and io_mem_write(), which retain the old-style
boolean true-for-error return.

Backports commit cc05c43ad942165ecc6ffd39e41991bee43af044 from qemu
2018-02-12 17:17:27 -05:00
Peter Maydell db9901f2ad
target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strd
A LDRD or STRD where rd is not an even number is UNPREDICTABLE.
We were letting this fall through, which is OK unless rd is 15,
in which case we would attempt to do a load_reg or store_reg
to a nonexistent r16 for the second half of the double-word.
Catch the odd-numbered-rd cases and UNDEF them instead.

To do this we rearrange the structure of the code a little
so we can put the UNDEF catches at the top before we've
allocated TCG temporaries.

Backports commit a4bb522ee51087af61998f290d12ba2e14c7910e from qemu
2018-02-12 17:17:23 -05:00
Emilio G. Cota df41e9ffd3
target-i386: remove superfluous TARGET_HAS_SMC macro
Backports commit 9c04146ad4696b20c440bfbb4a6ab27ea254e7ca from qemu
2018-02-12 16:41:55 -05:00
Nadav Amit 8debf8cc3c
target-i386: clear bsp bit when designating bsp
Since the BSP bit is writable on real hardware, during reset all the CPUs which
were not chosen to be the BSP should have their BSP bit cleared. This fix is
required for KVM to work correctly when it changes the BSP bit.

An additional fix is required for QEMU tcg to allow software to change the BSP
bit.

Backports commit 9cb11fd7539b5b787d8fb3834004804a58dd16ae from qemu
2018-02-12 16:40:35 -05:00
Peter Maydell d723e590f2
target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc)
The AArch64 SPSR_EL1 register is architecturally mandated to
be mapped to the AArch32 SPSR_svc register. This means its
state should live in QEMU's env->banked_spsr[1] field.
Correct the various places in the code that incorrectly
put it in banked_spsr[0].

Backports commit 7847f9ea9fce15a9ecfb62ab72c1e84ff516b0db from qemu
2018-02-12 16:36:44 -05:00
Andreas Färber 15b820e72b
qom: Fix object_property_add_alias() with [*]
Commit 8074264 (qom: Add description field in ObjectProperty struct)
introduced property descriptions and copied them for alias properties.

Instead of using the caller-supplied property name, use the returned
property name for setting the description. This avoids an Error when
setting a property description for a property with literal "[*]" that
doesn't exist due to automatic property naming in object_property_add().

Backports commit a18bb417e954ceea0a30b46c38b0d58c3a7ca6a1 from qemu
2018-02-12 16:33:58 -05:00
Leon Alrae 2d07e60f61
target-mips: save cpu state before calling MSA load and store helpers
PC needs to be saved if an exception can be generated by an helper.
This fixes a problem related to resuming the execution at unexpected address
after an exception (caused by MSA load/store instruction) has been serviced.

Backports commit 0af7a37054310384e00209e0a43efe95b7c19ef0 from qemu
2018-02-12 16:31:17 -05:00
Leon Alrae 6cd0c5d775
target-mips: fix hflags modified in delay / forbidden slot
All instructions which may change hflags terminate tb. However, this doesn't
work if such an instruction is placed in delay or forbidden slot.
gen_branch() clears MIPS_HFLAG_BMASK in ctx->hflags and then generates code
to overwrite hflags with ctx->hflags, consequently we loose any execution-time
hflags modifications. For example, in the following scenario hflag related to
Status.CU1 will not be updated:
/* Set Status.CU1 in delay slot */
mfc0 $24, $12, 0
lui $25, 0x2000
or $25, $25, $24
b check_Status_CU1
mtc0 $25, $12, 0

With this change we clear MIPS_HFLAG_BMASK in execution-time hflags if
instruction in delay or forbidden slot wants to terminate tb for some reason
(i.e. ctx->bstate != BS_NONE).

Also, die early and loudly if "unknown branch" is encountered as this should
never happen.

Backports commit a5f533909e746ca6e534b232fb42c9c6fd81b468 from qemu
2018-02-12 16:29:40 -05:00
Leon Alrae cdc72c7db1
target-mips: fix CP0.BadVAddr by stopping translation on Address Error
CP0.BadVAddr is supposed to capture the most recent virtual address that caused
the exception. Currently this does not work correctly for unaligned instruction
fetch as translation is not stopped and CP0.BadVAddr is updated with subsequent
addresses.

Backports commit 62c688693bf2f0355fc5bad5dcc59c1cd2a51f1a from qemu
2018-02-12 16:22:25 -05:00
Peter Maydell 6bd44fb70a
target-arm: Ignore low bit of PC in M-profile exception return
For the ARM M-profile cores, exception return pops various registers
including the PC from the stack. The architecture defines that if the
lowest bit in the new PC value is set (ie the PC is not halfword
aligned) then behaviour is UNPREDICTABLE. In practice hardware
implementations seem to simply ignore the low bit, and some buggy
RTOSes incorrectly rely on this. QEMU's behaviour was architecturally
permitted, but bringing QEMU into line with the hardware behaviour
allows more guest code to run. We log the situation as a guest error.

This was reported as LP:1428657.

Backports commit fcf83ab103dce6d2951f24f48e30820e7dbb3622 from qemu
2018-02-12 16:18:07 -05:00
Peter Maydell 3497be0faa
target-arm: Fix handling of STM (user) with r15 in register list
The A32 encoding of LDM distinguishes LDM (user) from LDM (exception
return) based on whether r15 is in the register list. However for
STM (user) there is no equivalent distinction. We were incorrectly
treating "r15 in list" as indicating exception return for both LDM
and STM, with the result that an STM (user) involving r15 went into
an infinite loop. Fix this; note that the value stored for r15
in this case is the current PC regardless of our current mode.

Backports commit da3e53ddcb0ca924da97ca5a35605fc554aa3e05 from qemu
2018-02-12 16:16:05 -05:00
Leon Alrae e475e68c94
target-mips: add missing MSACSR and restore fp_status and hflags
Save MSACSR state. Also remove fp_status, msa_fp_status, hflags and restore
them in post_load() from the architectural registers.
Float exception flags are not present in vmstate. Information they carry
is used only by softfloat caller who translates them into MIPS FCSR.Cause,
FCSR.Flags and then they are cleared. Therefore there is no need for saving
them in vmstate.

Backports commit 644511117e7ca9f26d633a59c202a297113a796c from qemu
2018-02-12 16:12:17 -05:00
Lioncash c55c8b24f9
bitops.h: sextract64() return type should be int64_t, not uint64_t
The documentation for sextract64() claims that the return type is
an int64_t, but the code itself disagrees. Fix the return type to
conform to the documentation and to bring it into line with
sextract32(), which returns int32_t.

Backports commit 4f9950520a115acf9c0a209f0befa45758ad0215 from qemu
2018-02-12 16:08:14 -05:00
Paolo Bonzini aed1972af9
x86: fix SS selector in SYSRET
According to my reading of the Intel documentation, the SYSRET instruction
is supposed to force the RPL bits of the %ss register to 3 when returning
to user mode. The actual sequence is:

SS.Selector <-- (IA32_STAR[63:48]+8) OR 3; (* RPL forced to 3 *)

However, the code in helper_sysret() leaves them at 0 (in other words, the "OR
3" part of the above sequence is missing). It does set the privilege level
bits of %cs correctly though.

This has caused me trouble with some of my VxWorks development: code that runs
okay on real hardware will crash on QEMU, unless I apply the patch below.

Backports commit ac57622985220de064059971f9ccb00905e9bd04 from qemu
2018-02-12 16:03:43 -05:00
Eduardo Habkost fc39930347
target-i386: Move APIC ID compatibility code to pc.c
The APIC ID compatibility code is required only for PC, and now that
x86_cpu_initfn() doesn't use x86_cpu_apic_id_from_index() anymore, that
code can be moved to pc.c.

Backports commit de13197a38cf45c990802661a057f64a05426cbc from qemu
2018-02-12 15:59:20 -05:00
Eduardo Habkost a55484021b
target-i386: Require APIC ID to be explicitly set before CPU realize
Instead of setting APIC ID automatically when creating a X86CPU, require
the property to be set before realizing the object (which all callers of
cpu_x86_create() already do).

Backports commit e1356dd70aef11425883dd4d2885f1d208eb9d57 from qemu
2018-02-12 15:52:53 -05:00
Eduardo Habkost ce36141f10
target-i386: Set APIC ID using cpu_index on CONFIG_USER
The PC CPU initialization code already sets apic-id based on the CPU
topology, and CONFIG_USER doesn't need the topology-based APIC ID
calculation code.

Make CONFIG_USER set apic-id before realizing the CPU (just like PC
already does), so we can simplify x86_cpu_initfn later. As there is no
CPU topology configuration in CONFIG_USER, just use cpu_index as the
APIC ID.

Backports commit 9c235e83f1c3437be6ca45755909efb745c10deb from qemu
2018-02-12 15:46:26 -05:00
Eduardo Habkost 81cae9834a
target-i386: Move CPUX86State.cpuid_apic_id to X86CPU.apic_id
The field doesn't need to be inside CPUState, and it is not specific for
the CPUID instruction, so move and rename it.

Backports commit 9e9d3863adcbd1ffeca30f240f49805b00ba0d87 from qemu
2018-02-12 15:44:11 -05:00
Lioncash 92c076c042
target-i386: Simplify error handling on cpu_x86_init_user()
Isolate error handling path from the "if (error)" checks.

Backports commit 18b0e4e77142ace948497a053bd5b56c1b849592 from qemu
2018-02-12 15:37:46 -05:00
Eduardo Habkost 51b49a5b97
target-i386: Eliminate cpu_init() function
Instead of putting extra logic inside cpu.h, just do everything inside
cpu_x86_init_user().

Backports commit 15258d46baef5f8265ad5f1002905664cf58f051 from qem
2018-02-12 15:35:44 -05:00
Eduardo Habkost 68fa057b7c
target-i386: Rename cpu_x86_init() to cpu_x86_init_user()
The function is used only for CONFIG_USER, so make its purpose clear.

Backports commit 644dba250a3ed04079792f0d6cc918fb1483e6a5 from qemu
2018-02-12 15:31:29 -05:00
Eduardo Habkost bba9634578
target-i386: Eliminate unnecessary get_cpuid_vendor() function
The function was used in only two places. In one of them, the function
made the code less readable by requiring temporary te[bcd]x variables.
In the other one we can simply inline the existing code.

Backports commit 08e1a1e5a175ecbfdb761db5a62090498f736969 from qemu
2018-02-12 15:31:26 -05:00
Paolo Bonzini a46accd252
exec: make iotlb RCU-friendly
After the previous patch, TLBs will be flushed on every change to
the memory mapping. This patch augments that with synchronization
of the MemoryRegionSections referred to in the iotlb array.

With this change, it is guaranteed that iotlb_to_region will access
the correct memory map, even once the TLB will be accessed outside
the BQL.

Backports commit 9d82b5a792236db31a75b9db5c93af69ac07c7c5 from qemu
2018-02-12 15:20:39 -05:00
Paolo Bonzini 2348a02a8d
docs: clarify memory region lifecycle
Now that objects actually obey the rules, document them.

Backports commit 8b5c216025c312ab01542c4595393e0fdcbed015 from qemu
2018-02-12 15:11:21 -05:00
Paolo Bonzini 3fbda890df
exec: introduce cpu_reload_memory_map
This for now is a simple TLB flush. This can change later for two
reasons:

1) an AddressSpaceDispatch will be cached in the CPUState object

2) it will not be possible to do tlb_flush once the TCG-generated code
runs outside the BQL.

Backports commit 76e5c76f2e2e0d20bab2cd5c7a87452f711654fb from qemu
2018-02-12 15:09:49 -05:00
Peter Maydell 8287ec801e
target-arm: A64: Avoid signed shifts in disas_ldst_pair()
Avoid shifting potentially negative signed offset values in
disas_ldst_pair() by keeping the offset in a uint64_t rather
than an int64_t.

Backports commit c2ebd862a54b7e12175d65c03ba259926cb2237a from qemu
2018-02-12 15:05:09 -05:00
Peter Maydell 4ea6fdc986
target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr
Shifting a negative integer left is undefined behaviour in C.
Avoid it by assembling and shifting the offset fields as
unsigned values and then sign extending as the final action.

Backports commit 037e1d009e2fcb80784d37f0e12aa999787d46d4 from qemu
2018-02-12 15:04:03 -05:00
Peter Maydell 0e9a6a26f5
target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask
The code in logic_imm_decode_wmask attempts to rotate a mask
value within the bottom 'e' bits of the value with
mask = (mask >> r) | (mask << (e - r));
This has two issues:
* if the element size is 64 then a rotate by zero results
in a shift left by 64, which is undefined behaviour
* if the element size is smaller than 64 then this will
leave junk in the value at bit 'e' and above, which is
not valid input to bitfield_replicate(). As it happens,
the bits at bit 'e' to '2e - r' are exactly the ones
which bitfield_replicate is going to copy in there,
so this isn't a "wrong code generated" bug, but it's
confusing and if we ever put an assert in
bitfield_replicate it would fire on valid guest code.

Fix the former by not doing anything if r is zero, and
the latter by masking with bitmask64(e).

Backports commit e167adc9d9f5df4f8109aecd4552c407fdce094a from qemu
2018-02-12 15:02:34 -05:00
Peter Maydell b95cba4677
target-arm: A64: Fix shifts into sign bit
Fix attempts to shift into the sign bit of an int, which is undefined
behaviour in C and warned about by the clang sanitizer.

Backports commit 1743d55c8b38bcee632cf6eb2de81131635bb3d2 from qemu
2018-02-12 15:01:10 -05:00
Greg Bellows 8612f1d3e7
target-arm: Add 32/64-bit register sync
Add AArch32 to AArch64 register sychronization functions.
Replace manual register synchronization with new functions in
aarch64_cpu_do_interrupt() and HELPER(exception_return)().

Backports commit ce02049dbf1828b4bc77d921b108a9d84246e5aa from qemu
2018-02-12 14:57:20 -05:00
Greg Bellows 4df1ce63b8
target-arm: Add CPU property to disable AArch64
Adds registration and get/set functions for enabling/disabling the AArch64
execution state on AArch64 CPUs. By default AArch64 execution state is enabled
on AArch64 CPUs, setting the property to off, will disable the execution state.
The below QEMU invocation would have AArch64 execution state disabled.

$ ./qemu-system-aarch64 -machine virt -cpu cortex-a57,aarch64=off

Also adds stripping of features from CPU model string in acquiring the ARM CPU
by name.

Backports part of commit fb8d6c24b095c426151b9bba8c8b0e58b03d6503 from qemu
2018-02-12 13:56:44 -05:00
Peter Maydell 997ca2f6ea
softfloat: expand out STATUS macro
Expand out and remove the STATUS macro.

Backports commit a2f2d288b5a06e6c680c387c9980d91363f59c61 from qemu
2018-02-12 13:43:13 -05:00
Peter Maydell 48e9546efc
softfloat: expand out STATUS_VAR
Expand out and remove the STATUS_VAR macro.

Backports commit ff32e16e865c78fb54187723f3fd09650cd9b962 from qemu
2018-02-12 13:36:42 -05:00
Peter Maydell 20f696343b
softfloat: Expand out the STATUS_PARAM macro
Expand out STATUS_PARAM wherever it is used and delete the definition.

Backports commit e5a41ffa870ad096eb2f084447fea5dd00a51b31 from qemu
2018-02-12 13:07:53 -05:00
Peter Maydell 606cff6e81
softfloat: Clarify license status
The code in the softfloat source files is under a mixture of
licenses: the original code and many changes from QEMU contributors
are under the base SoftFloat-2a license; changes from Stefan Weil
and RedHat employees are GPLv2-or-later; changes from Fabrice Bellard
are under the BSD license. Clarify this in the comments at the
top of each affected source file, including a statement about
the assumed licensing for future contributions, so we don't need
to remember to ask patch submitters explicitly to pick a license.

Backports commit 16017c48547960539fcadb1f91d252124f442482 from qemu
2018-02-12 13:00:01 -05:00
Peter Maydell eaf3805f36
softfloat: Revert and reimplement remaining parts of b645bb4885 and 5a6932d51d
Revert the parts of commits b645bb4885 and 5a6932d51d which are still
in the codebase and under a SoftFloat-2b license.

Reimplement support for architectures where the most significant bit
in the mantissa is 1 for a signaling NaN rather than a quiet NaN,
by adding handling for SNAN_BIT_IS_ONE being set to the functions
which test values for NaN-ness.

This includes restoring the bugfixes lost in the reversion where
some of the float*_is_quiet_nan() functions were returning true
for both signaling and quiet NaNs.

[This is a mechanical squashing together of two separate "revert"
and "reimplement" patches.]

Backports commit 332d5849708d11b835e0b36f4e26e8b36bfb3f5a from qemu
2018-02-12 12:57:15 -05:00
Peter Maydell 5ad42fb01b
softfloat: Revert and reimplement remaining portions of 75d62a5856 and 3430b0be36f
Revert the remaining portions of commits 75d62a5856 and 3430b0be36f
which are under a SoftFloat-2b license, ie the functions
uint64_to_float32() and uint64_to_float64(). (The float64_to_uint64()
and float64_to_uint64_round_to_zero() functions were completely
rewritten in commits fb3ea83aa and 0a87a3107d so can stay.)

Reimplement from scratch the uint64_to_float64() and uint64_to_float32()
conversion functions.

[This is a mechanical squashing together of two separate "revert"
and "reimplement" patches.]

Backports commit 6bb8e0f130bd4aecfe835a0caa94390fa2235fde from qemu
2018-02-12 12:52:32 -05:00
Peter Maydell a9079657e8
softfloat: Apply patch corresponding to rebasing to softfloat-2a
This commit applies the changes to master which correspond to
replacing commit 158142c2c2df with a set of changes made by:
* taking the SoftFloat-2a release
* mechanically transforming the block comment style
* reapplying Fabrice's original changes from 158142c2c2df

This commit was created by:
diff -u 158142c2c2df import-sf-2a
patch -p1 --fuzz 10 <../relicense-patch.txt
(where import-sf-2a is the branch resulting from the changes above).

Backports commit a7d1ac78e0f1101df2ff84502029a4b0da6024ae from qemu
2018-02-12 12:49:49 -05:00
Paolo Bonzini 5b02b2728a
target-i386: make xmm_regs 512-bit wide
Right now, the AVX512 registers are split in many different fields:
xmm_regs for the low 128 bits of the first 16 registers, ymmh_regs
for the next 128 bits of the same first 16 registers, zmmh_regs
for the next 256 bits of the same first 16 registers, and finally
hi16_zmm_regs for the full 512 bits of the second 16 bit registers.

This makes it simple to move data in and out of the xsave region,
but would be a nightmare for a hypothetical TCG implementation and
leads to a proliferation of [XYZ]MM_[BWLSQD] macros. Instead,
this patch marshals data manually from the xsave region to a single
32x512-bit array, simplifying the macro jungle and clarifying which
bits are in which vmstate subsection.

The migration format is unaffected.

Backports commit b7711471f551aa4419f9d46a11121f48ced422da from qemu
2018-02-12 12:38:43 -05:00
Ildar Isaev 73fa78f0bc
target-arm: fix for exponent comparison in recpe_f64
f64 exponent in HELPER(recpe_f64) should be compared to 2045 rather than 1023
(FPRecipEstimate in ARMV8 spec). This fixes incorrect underflow handling when
flushing denormals to zero in the FRECPE instructions operating on 64-bit
values.

Backports commit fc1792e9aa36227ee9994757974f9397684e1a48 from qemu
2018-02-12 12:04:39 -05:00
Pranavkumar Sawargaonkar 30f4d72db5
target-arm: Guest cpu endianness determination for virtio KVM ARM/ARM64
This patch implements a fucntion pointer "virtio_is_big_endian"
from "CPUClass" structure for arm/arm64.
Function arm_cpu_is_big_endian() is added to determine and
return the guest cpu endianness to virtio.
This is required for running cross endian guests with virtio on ARM/ARM64.

Backports commit 84f2bed3cf505f90b7918e2de32e11da27160563 from qemu
2018-02-12 12:03:10 -05:00
Peter Maydell e3c3cccb7a
target-arm: Fix brace style in reindented code
This patch fixes the brace style in the code reindented in the
previous commit.

Backports commit 87c3d486150917c8e286d29166c98a2035377b52 from qemu
2018-02-12 11:56:39 -05:00
Peter Maydell 11c6c143d7
target-arm: Reindent ancient page-table-walk code
A few of the oldest parts of the page-table-walk code have broken indent
(either hardcoded tabs or two-spaces). Reindent these sections.

For ease of review, this patch does not touch the brace style and
so is a whitespace-only change.

Backports commit 554b0b09aec4579c8164f363b18a263150e91a2c from qemu
2018-02-12 11:54:11 -05:00
Peter Maydell 0046642958
target-arm: Use mmu_idx in get_phys_addr()
Now we have the mmu_idx in get_phys_addr(), use it correctly to
determine the behaviour of virtual to physical address translations,
rather than using just an is_user flag and the current CPU state.

Some TODO comments have been added to indicate where changes will
need to be made to add EL2 and 64-bit EL3 support.

Backports commit 0480f69abf849ca0d48928cc6c669c1c7264239b from qemu
2018-02-12 11:49:55 -05:00
Peter Maydell 6031ae6540
target-arm: Pass mmu_idx to get_phys_addr()
Make all the callers of get_phys_addr() pass it the correct
mmu_idx rather than just a simple "is_user" flag. This includes
properly decoding the AT/ATS system instructions; we include the
logic for handling all the opc1/opc2 cases because we'll need
them later for supporting EL2/EL3, even if we don't have the
regdef stanzas yet.

Backports commit d364970287c0ba68979711928c15e5d37414f87f from qemu
2018-02-12 11:41:38 -05:00
Peter Maydell 04f30f91ed
target-arm: Split AArch64 cases out of ats_write()
Instead of simply reusing ats_write() as the handler for both AArch32
and AArch64 address translation operations, use a different function
for each with the common code in a third function. This is necessary
because the semantics for selecting the right translation regime are
different; we are only getting away with sharing currently because
we don't support EL2 and only support EL3 in AArch32.

Backports commit 060e8a48cb84d41d4ac36e4bb29d9c14ed7168b6 from qemu
2018-02-12 11:36:11 -05:00
Peter Maydell c0c5508a25
target-arm: Don't define any MMU_MODE*_SUFFIXes
target-arm doesn't use any of the MMU-mode specific cpu ldst
accessor functions. Suppress their generation by not defining
any of the MMU_MODE*_SUFFIX macros. ("user" and "kernel" are
too simplistic as descriptions of indexes 0 and 1 anyway.)

Backports commit 0dfef7b58f0c24b463e36630f08a45e93012b33a from qemu
2018-02-12 11:29:41 -05:00
Peter Maydell da216e211f
target-arm: Use correct mmu_idx for unprivileged loads and stores
The MMU index to use for unprivileged loads and stores is more
complicated than we currently implement:
* for A64, it should be "if at EL1, access as if EL0; otherwise
access at current EL"
* for A32/T32, it should be "if EL2, UNPREDICTABLE; otherwise
access as if at EL0".

In both cases, if we want to make the access for Secure EL0
this is not the same mmu_idx as for Non-Secure EL0.

Backports commit 579d21cce63f3dd2f6ee49c0b02a14e92cb4a836 from qemu
2018-02-12 11:28:17 -05:00
Peter Maydell 3261ed5801
target-arm: Define correct mmu_idx values and pass them in TB flags
We currently claim that for ARM the mmu_idx should simply be the current
exception level. However this isn't actually correct -- secure EL0 and EL1
should have separate indexes from non-secure EL0 and EL1 since their
VA->PA mappings may differ. We also will want an index for stage 2
translations when we properly support EL2.

Define and document all seven mmu index values that we require, and
pass the mmu index in the TB flags rather than exception level or
priv/user bit.

This change doesn't update the get_phys_addr() code, so our page
table walking still assumes a simplistic "user or priv?" model for
the moment.

Backports commit c1e3781090b9d36c60e1a254ba297cb34011d3d4 from qemu
2018-02-12 11:21:19 -05:00
Peter Maydell 9d02c52b8a
cpu_ldst.h: Allow NB_MMU_MODES to be 7
Support guest CPUs which need 7 MMU index values.
Add a comment about what would be required to raise the limit
further (trivial for 8, TCG backend rework for 9 or more).

Backports commit 8f3ae2ae2d02727f6d56610c09d7535e43650dd4 from qemu
2018-02-12 11:21:19 -05:00
Peter Maydell ec4dae08e4
target-arm: Make arm_current_el() return sensible values for M profile
Although M profile doesn't have the same concept of exception level
as A profile, it does have a notion of privileged versus not, which
we currently track in the privmode TB flag. Support returning this
information if arm_current_el() is called on an M profile core, so
that we can identify the correct MMU index to use (and put the MMU
index in the TB flags) without having to special-case M profile.

Backports commit 6d54ed3c93f1e05a483201b087142998381c9be8 from qemu
2018-02-12 11:07:49 -05:00
Kirill Batuzov d45ea1ba3b
target-arm: check that LSB <= MSB in BFI instruction
The documentation states that if LSB > MSB in BFI instruction behaviour
is unpredictable. Currently QEMU crashes because of assertion failure in
this case:

tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed.

While assertion failure may meet the "unpredictable" definition this
behaviour is undesirable because it allows an unprivileged guest program
to crash the emulator with the OS and other programs.

This patch addresses the issue by throwing illegal instruction exception
if LSB > MSB. Only ARM decoder is affected because Thumb decoder already
has this check in place.

To reproduce issue run the following program

int main(void) {
asm volatile (".long 0x07c00c12" :: );
return 0;
}

compiled with
gcc -marm -static badop_arm.c -o badop_arm

Backports commit 45140a57675ecb4b0daee71bf145c24dbdf9429c from qemu
2018-02-12 11:06:12 -05:00
Peter Maydell 1c275134ae
target-arm: Squash input denormals in FRECPS and FRSQRTS
The helper functions for FRECPS and FRSQRTS have special case
handling that includes checks for zero inputs, so squash input
denormals if necessary before those checks. This fixes incorrect
output when the FPCR DZ bit is set to enable squashing of input
denormals.

Backports commit a8eb6e19991d1a7a6a7b04ac447548d30d75eb4a from qemu
2018-02-12 11:04:28 -05:00
Peter Maydell 337e658869
target-arm: Add checks that cpreg raw accesses are handled
Add assertion checking when cpreg structures are registered that they
either forbid raw-access attempts or at least make an attempt at
handling them. Also add an assert in the raw-accessor-of-last-resort,
to avoid silently doing a read or write from offset zero, which is
actually AArch32 CPU register r0.

Backports commit 375421ccaeebae8212eb8f9a36835ad4d9dc60a8 from qemu
2018-02-12 11:02:00 -05:00
Peter Maydell 52afb392f2
target-arm: Split NO_MIGRATE into ALIAS and NO_RAW
We currently mark ARM coprocessor/system register definitions with
the flag ARM_CP_NO_MIGRATE for two different reasons:
1) register is an alias on to state that's also visible via
some other register, and that other register is the one
responsible for migrating the state
2) register is not actually state at all (for instance the TLB
or cache maintenance operation "registers") and it makes no
sense to attempt to migrate it or otherwise access the raw state

This works fine for identifying which registers should be ignored
when performing migration, but we also use the same functions for
synchronizing system register state between QEMU and the kernel
when using KVM. In this case we don't want to try to sync state
into registers in category 2, but we do want to sync into registers
in category 1, because the kernel might have picked a different
one of the aliases as its choice for which one to expose for
migration. (In particular, on 32 bit hosts the kernel will
expose the state in the AArch32 version of the register, but
TCG's convention is to mark the AArch64 version as the version
to migrate, even if the CPU being emulated happens to be 32 bit,
so almost all system registers will hit this issue now that we've
added AArch64 system emulation.)

Fix this by splitting the NO_MIGRATE flag in two (ALIAS and NO_RAW)
corresponding to the two different reasons we might not want to
migrate a register. When setting up the TCG list of registers to
migrate we honour both flags; when populating the list from KVM,
only ignore registers which are NO_RAW.

Backports commit 7a0e58fa648736a75f2a6943afd2ab08ea15b8e0 from qemu
2018-02-12 10:59:36 -05:00
Greg Bellows 301c3737e3
target-arm: Add missing SP_ELx register definition
Added CP register definitions for SP_EL1 and SP_EL2.

Backports commit 884b4deeeb8b158ed3db5792161902bc8b41b62d from qemu
2018-02-12 10:40:53 -05:00
Greg Bellows cce21771b3
target-arm: Change reset to highest available EL
Update to arm_cpu_reset() to reset into the highest available exception level
based on the set ARM features.

Backports commit 5097227c15aa89baec1123aac25dd9500a62684d from qemu
2018-02-12 10:40:53 -05:00
Greg Bellows 2cce33295b
target-arm: Add extended RVBAR support
Added RVBAR_EL2 and RVBAR_EL3 CP register support. All RVBAR_EL# registers
point to the same location and only the highest EL version exists at any one
time.

Backports commit be8e8128595b41b9f609c1507e67d121e65e7173 from qemu
2018-02-12 10:40:53 -05:00
Greg Bellows 6c33ec25fc
target-arm: Fix RVBAR_EL1 register encoding
Fix the RVBAR_EL1 CP register opc2 encoding from 2 to 1

Backports commit 569b49f864e7593a14182acae5a7f5981f6ec24f from qemu
2018-02-12 10:40:53 -05:00
Ard Biesheuvel 9b28dc55c8
target-arm: crypto: fix BE host support
The crypto emulation code in target-arm/crypto_helper.c never worked
correctly on big endian hosts, due to the fact that it uses a union
of array types to convert between the native VFP register size (64
bits) and the types used in the algorithms (bytes and 32 bit words)

We cannot just swab between LE and BE when reading and writing the
registers, as the SHA code performs word additions, so instead, add
array accessors for the CRYPTO_STATE type whose LE and BE specific
implementations ensure that the correct array elements are referenced.

Backports commit b449ca3c1874418d948878d5417a32fc0dbf9fea from qemu
2018-02-12 10:40:52 -05:00
Fabian Aggeler 912d271a9b
target-arm: add cpu feature EL3 to CPUs with Security Extensions
Set ARM_FEATURE_EL3 feature for CPUs that implement Security Extensions.

Backports commit c0ccb02db46c72b4b0fa8a475a6890c1e28064f0 from qemu
2018-02-12 10:40:52 -05:00
Greg Bellows e1576f314e
target-arm: Add ARMCPU secure property
Added a "has_el3" state property to the ARMCPU descriptor. This property
indicates whether the ARMCPU has security extensions enabled (EL3) or not.
By default it is disabled at this time.

Backports commit 51942aee3c51ca23b0dd78f95534a57e8dc1e582 from qemu
2018-02-12 10:40:52 -05:00
Greg Bellows 1d3719a39f
target-arm: Add feature unset function
Add an unset_feature() function to compliment the set_feature() function. This
will be used to disable functions after they have been enabled during
initialization.

Backports commit 08828484a5c1ec55a6cbb4b4d377bfcf41199b5c from qemu
2018-02-12 10:40:52 -05:00
Greg Bellows c457067e47
target-arm: Merge EL3 CP15 register lists
Merge of the v8_el2_cp_reginfo and el3_cp_reginfo ARMCPRegInfo lists.
Previously, some EL3 registers were restricted to the ARMv8 list under the
impression that they were not needed on ARMv7. However, this is not the case
as the ARMv7/32-bit variants rely on the ARMv8/64-bit variants to handle
migration and reset. For this reason they must always exist.

Backports commit 60fb1a87b47b14e4ea67043aa56f353e77fbd70a from qemu
2018-02-12 10:40:52 -05:00
Greg Bellows b711147cc3
target-arm: make MAIR0/1 banked
Added CP register info entries for the ARMv7 MAIR0/1 secure banks.

Backports commit be693c87e440e671ed913784554384349ce8331d from qemu
2018-02-12 10:40:52 -05:00
Fabian Aggeler 4bf69e19c6
target-arm: make c13 cp regs banked (FCSEIDR, ...)
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
FCSEIDR, CONTEXTIDR, TPIDRURW, TPIDRURO and TPIDRPRW have a secure
and a non-secure instance.

Backports commit 54bf36ed351c526cde0c853079f9ff1ab7e2ff89 from qemu
2018-02-12 10:40:51 -05:00
Greg Bellows 153e7e7331
target-arm: make VBAR banked
When EL3 is running in Aarch32 (or ARMv7 with Security Extensions)
VBAR has a secure and a non-secure instance, which are mapped to
VBAR_EL1 and VBAR_EL3.

Backports commit fb6c91ba2bb0b1c1b8662ceeeeb9474a025f9a6b from qemu
2018-02-12 10:40:51 -05:00
Fabian Aggeler ccccef3d41
target-arm: make PAR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
PAR has a secure and a non-secure instance.

Backports commit 01c097f7960b330c4bf038d34bae17ad6c1ba499 from qemu
2018-02-12 10:40:51 -05:00
Fabian Aggeler ff1ca0608d
target-arm: make IFAR/DFAR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
IFAR and DFAR have a secure and a non-secure instance.

Backports commit b848ce2b9cbd38da3f2530fd93dba76dba0621c0 from qemu
2018-02-12 10:40:51 -05:00
Fabian Aggeler 27ba8b30c5
target-arm: make DFSR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
DFSR has a secure and a non-secure instance.

Backports commit 4a7e2d7315bd2ce28e49ccd0bde73eabdfd7437b from qemu
2018-02-12 10:40:51 -05:00
Fabian Aggeler 192c5c665a
target-arm: make IFSR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
IFSR has a secure and a non-secure instance. Adds IFSR32_EL2 definition and
storage.

Backports commit 88ca1c2d70523486a952065f3ed7b8fc823b5863 from qemu
2018-02-12 10:40:45 -05:00
Fabian Aggeler e955687ca5
target-arm: make DACR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
DACR has a secure and a non-secure instance. Adds definition for DACR32_EL2.

Backports commit 0c17d68c1d3d6c35f37f5692042d2edb65c8bcc0 from qemu
2018-02-12 09:01:38 -05:00
Fabian Aggeler e90e4b7190
target-arm: make TTBCR banked
Adds secure and non-secure bank register suport for TTBCR.
Added new struct to compartmentalize the TCR data and masks. Removed old
tcr/ttbcr data and added a 4 element array of the new structs in cp15. This
allows for one entry per EL. Added a CP register definition for TCR_EL3.

Backports commit 11f136ee25232a00f433cefe98ee33cd614ecccc from qemu
2018-02-11 19:59:03 -05:00
Fabian Aggeler adf48a1f81
target-arm: make TTBR0/1 banked
Adds secure and non-secure bank register suport for TTBR0 and TTBR1.
Changes include adding secure and non-secure instances of ttbr0 and ttbr1 as
well as a CP register definition for TTBR0_EL3. Added a union containing
both EL based array fields and secure and non-secure fields mapped to them.
Updated accesses to use A32_BANKED_CURRENT_REG_GET macro.

Backports commit 7dd8c9af0d9d18fb3e54a4843b3bb1398bd330bc to qemu
2018-02-11 19:46:15 -05:00
Fabian Aggeler 673cb7d93e
target-arm: make CSSELR banked
Rename CSSELR (cache size selection register) and add secure
instance (AArch32).

Backports commit b85a1fd61c4d72c7928cd9b70f9f59fb2895936d from qemu
2018-02-11 19:35:02 -05:00
Fabian Aggeler 44fc779c6a
target-arm: respect SCR.FW, SCR.AW and SCTLR.NMFI
Add checks of SCR AW/FW bits when performing writes of CPSR. These SCR bits
are used to control whether the CPSR masking bits can be adjusted from
non-secure state.

Backports commit 6e8801f9dea9e10449f4fd7d85dbe8cab708a686 from qemu
2018-02-11 19:30:21 -05:00
Fabian Aggeler 9087027b85
target-arm: add SCTLR_EL3 and make SCTLR banked
Implements SCTLR_EL3 and uses secure/non-secure instance when
needed.

Backports commit 137feaa9a1622620adf19c0b707883dd990738e2 from qemu
2018-02-11 19:28:34 -05:00
Fabian Aggeler ca0608f68d
target-arm: add MVBAR support
Use MVBAR register as exception vector base address for
exceptions taken to CPU monitor mode.

Backports commit e89e51a17ea0d8aef9bf9b766c98f963e835fbf2 from qemu
2018-02-11 19:09:28 -05:00
Greg Bellows e49d9d3f30
target-arm: add SDER definition
Added CP register defintions for SDER and SDER32_EL3 as well as cp15.sder for
register storage.

Backports commit 144634ae6c1618dcee6aced9c0d4427844154091 from qemu
2018-02-11 19:03:18 -05:00
Fabian Aggeler 461944980c
target-arm: add NSACR register
Implements NSACR register with corresponding read/write functions
for ARMv7 and ARMv8.

Backports commit 770225764f831031d2e1453f69c365eb1b647d87 from qemu
2018-02-11 18:57:34 -05:00
Fabian Aggeler f120ad5308
target-arm: implement IRQ/FIQ routing to Monitor mode
SCR.{IRQ/FIQ} bits allow to route IRQ/FIQ exceptions to monitor CPU
mode. When taking IRQ exception to monitor mode FIQ exception is
additionally masked.

Backports commit de38d23b542efca54108ef28bcc0efe96f378d2e from qemu
2018-02-11 18:51:21 -05:00
Fabian Aggeler 4d9c9f893e
target-arm: move AArch32 SCR into security reglist
Define a new ARM CP register info list for the ARMv7 Security Extension
feature. Register that list only for ARM cores with Security Extension/EL3
support. Moving AArch32 SCR into Security Extension register group.

Backports commit 0f1a3b2470d798ad5335eb9d6236f02ff64e31a8 from qemu
2018-02-11 18:48:33 -05:00
Fabian Aggeler 3494160ea6
target-arm: insert AArch32 cpregs twice into hashtable
Prepare for cp register banking by inserting every cp register twice,
once for secure world and once for non-secure world.

Backports commit 3f3c82a57d128aa3ec823aa8032867c3a6e2e795 from qemu
2018-02-11 18:41:25 -05:00
Peter Maydell fb78e79d72
target-arm: add secure state bit to CPREG hash
Added additional NS-bit to CPREG hash encoding. Updated hash lookup
locations to specify hash bit currently set to non-secure.

Backports commit 51a79b039728277e35fd19f7a7b4bc6cb323697f from qemu
2018-02-11 18:35:52 -05:00
Fabian Aggeler 4f5106b56d
target-arm: add CPREG secure state support
Prepare ARMCPRegInfo to support specifying two fieldoffsets per
register definition. This will allow us to keep one register
definition for banked registers (different offsets for secure/
non-secure world).

Also added secure state tracking field and flags. This allows for
identification of the register info secure state.

Backports commit c3e302606253a17568dc3ef30238f102468f7ee1 from qemu
2018-02-11 18:29:35 -05:00
Sergey Fedorov acdd665668
target-arm: add non-secure Translation Block flag
This patch is based on idea found in patch at
git://github.com/jowinter/qemu-trustzone.git
f3d955c6c0ed8c46bc0eb10b634201032a651dd2 by
Johannes Winter <johannes.winter@iaik.tugraz.at>.

The TBFLAG captures the SCR NS secure state at the time when a TB is created so
the correct bank is accessed on system register accesses.

Backports commit 3f342b9e0e64ad681cd39840bfa75ef12d2807c1 from qemu
2018-02-11 17:50:46 -05:00
Fabian Aggeler 90c47cb40f
target-arm: add banked register accessors
If EL3 is in AArch32 state certain cp registers are banked (secure and
non-secure instance). When reading or writing to coprocessor registers
the following macros can be used.

- A32_BANKED macros are used for choosing the banked register based on provided
input security argument. This macro is used to choose the bank during
translation of MRC/MCR instructions that are dependent on something other
than the current secure state.
- A32_BANKED_CURRENT macros are used for choosing the banked register based on
current secure state. This is NOT to be used for choosing the bank used
during translation as it breaks monitor mode.

If EL3 is operating in AArch64 state coprocessor registers are not
banked anymore. The macros use the non-secure instance (_ns) in this
case, which is architecturally mapped to the AArch64 EL register.

Backports commit ea30a4b824ecc3c829b70eb9999ac5457dc5790f from qemu
2018-02-11 17:46:52 -05:00
Greg Bellows 67d68df401
target-arm: add async excp target_el function
Adds a dedicated function and a lookup table for determining the target
exception level of IRQ and FIQ exceptions. The lookup table is taken from the
ARMv7 and ARMv8 specification exception routing tables.

Backports commit 0eeb17d618361a0f4faddc160e33598b23da6dd5 from qemu
2018-02-11 17:45:09 -05:00
Lioncash 2d8f0be9f8
target-arm: extend async excp masking
This patch extends arm_excp_unmasked() to use lookup tables for determining
whether IRQ and FIQ exceptions are masked. The lookup tables are based on the
ARMv8 and ARMv7 specification physical interrupt masking tables.

If EL3 is using AArch64 IRQ/FIQ masking is ignored in all exception levels
other than EL3 if SCR.{FIQ|IRQ} is set to 1 (routed to EL3).

Backports commit 57e3a0c7cb0ac2f0288890482e0a463adce2080a from qemu
2018-02-11 17:38:59 -05:00
Leon Alrae da22a00c10
target-mips: pass 0 instead of -1 as rs in microMIPS LUI instruction
Using rs = -1 in gen_logic_imm() for microMIPS LUI instruction is dangerous
and may bite us when implementing microMIPS R6 because in R6 AUI and LUI
are distinguished by rs value. Therefore use 0 for safety.

Backports commit 5e88759a52934a32502298f2c78c6dfaa144364b from qemu
2018-02-11 17:18:08 -05:00
Leon Alrae 69974ce1dc
target-mips: use CP0EnLo_XI instead of magic number
Backports commit d3b1979d7b37c7fa6b187442e0990afa6f88fe3b from qemu
2018-02-11 17:16:31 -05:00
Leon Alrae 4d259dda9a
target-mips: ll and lld cause AdEL exception for unaligned address
Backports commit 6489dd250a4d6e86ecbb4badf82cc102afe26f33 from qemu
2018-02-11 17:14:43 -05:00
Leon Alrae c0fc9b280e
target-mips: fix detection of the end of the page during translation
The test is supposed to terminate TB if the end of the page is reached.
However, with current implementation it may never succeed for microMIPS or
mips16.

Backports commit fe2372910a09034591fd2cfc2d70cca43fccaa95 from qemu
2018-02-11 17:12:49 -05:00
Maciej W. Rozycki 6d1bc2c3c7
target-mips: Make CP0.Status.CU1 read-only for the 5Kc and 5KEc processors
Backports commit 196a7958c65778d05a491309377a65c58f643a1c from qemu
2018-02-11 17:10:59 -05:00
Markus Armbruster 4ee3955e11
target-mips: Clean up switch fall through after commit fecd264
Commit fecd264 added a number of fall-throughs, but neglected to
properly document them as intentional. Commit d922445 cleaned that up
for many, but not all cases. Take care of the remaining ones.

Backports commit b6f3b233eabb4df5d65ae9fbfb3d3c8befea0de7 from qemu
2018-02-11 17:09:40 -05:00
Peter Maydell 3190a32782
target-mips: Don't use _raw load/store accessors
Use cpu_*_data instead of the direct *_raw load/store accessors.

Backports commit 15353001197c413f3ddebd51152a514dce08c458 from qemu
2018-02-11 17:06:58 -05:00
Leon Alrae 6c68869076
target-mips: remove excp_names[] from linux-user as it is unused
Backports commit d4fa5354a246a1c6cb538a5d8ebcc21206d502fb from qemu
2018-02-11 17:05:40 -05:00
Leon Alrae 30e7d6e4a4
target-mips: convert single case switch into if statement
Backports commit 00fb4a118142650e7fa3d5007b197bc11fec6ea9 from qemu
2018-02-11 17:02:09 -05:00
Maciej W. Rozycki 49cf18a8ff
target-mips: Fix DisasContext's ulri member initialization
Set DisasContext's ulri member to 0 or 1 as with other bool members.

Backports commit 66991d1103562591eba6b801049720976317fe61 from qemu
2018-02-11 17:00:31 -05:00
Lioncash bbe062a658
target-mips: Use local float status pointer across MSA macros
Reduce line wrapping throughout MSA helper macros by using a local float
status pointer rather than referring to the float status through the
environment each time. No functional change.

Backports commit 1a4d570017bf35d99340781ecb59dd3772464031 from qemu
2018-02-11 16:58:31 -05:00
Maciej W. Rozycki e97c07cdca
target-mips: Add missing calls to synchronise SoftFloat status
Add missing calls to synchronise the SoftFloat status with the CP1.FSCR:

+ for the rounding and flush-to-zero modes upon processor reset,

+ for the flush-to-zero mode on FSCR updates through the GDB stub.

Refactor code accordingly and remove the redundant RESTORE_ROUNDING_MODE
macro.

Backports commit bb962386b82c1b0e9e12fdb6b9bb62106bf1f822 from qemu
2018-02-11 16:51:46 -05:00
Maciej W. Rozycki e4ce0e92b1
target-mips: Also apply the CP0.Status mask to MTTC0
Make CP0.Status writes made with the MTTC0 instruction respect this
register's mask just like all the other places. Also preserve the
current values of masked out bits.

Backports commit 1d725ae952a14b30c84b7bc81b218b8ba77dd311 from qemu
2018-02-11 16:48:34 -05:00
Maciej W. Rozycki 29cd1237ba
target-mips: Correct 32-bit address space wrapping
Make sure the address space is unconditionally wrapped on 32-bit
processors, that is ones that do not implement at least the MIPS III
ISA.

Also make MIPS16 SAVE and RESTORE instructions use address calculation
rather than plain arithmetic operations for stack pointer manipulation
so that their semantics for stack accesses follows the architecture
specification. That in particular applies to user software run on
64-bit processors with the CP0.Status.UX bit clear where the address
space is wrapped to 32 bits.

Backports commit c48245f0c62405f27266fcf08722d8c290520418 from qemu
2018-02-11 16:47:12 -05:00
Maciej W. Rozycki 15bfd1dde7
target-mips: Tighten ISA level checks
Tighten ISA level checks down to MIPS II that many of our instructions
are missing. Also make sure any 64-bit instruction enables are only
applied to 64-bit processors, that is ones that implement at least the
MIPS III ISA.

Backports commit d9224450208e0de62323b64ace91f98bc31d6e2c from qemu
2018-02-11 16:37:17 -05:00
Maciej W. Rozycki a4c4834545
target-mips: Fix CP0.Config3.ISAOnExc write accesses
Fix CP0.Config3.ISAOnExc write accesses on microMIPS processors. This
bit is mandatory for any processor that implements the microMIPS
instruction set. This bit is r/w for processors that implement both the
standard MIPS and the microMIPS instruction set. This bit is r/o and
hardwired to 1 if only the microMIPS instruction set is implemented.

There is no other bit ever writable in CP0.Config3 so defining a
corresponding `CP0_Config3_rw_bitmask' member in `CPUMIPSState' is I
think an overkill. Therefore make the ability to write the bit rely on
the presence of ASE_MICROMIPS set in the instruction flags.

The read-only case of the microMIPS instruction set being implemented
only can be added when we add support for such a configuration. We do
not currently have such support, we have no instruction flag that would
control the presence of the standard MIPS instruction set nor any
associated code in instruction decoding.

This change is needed to boot a microMIPS Linux kernel successfully,
otherwise it hangs early on as interrupts are enabled and then the
exception handler invoked loops as its first instruction is interpreted
in the wrong execution mode and triggers another exception right away.
And then over and over again.

We already check the current setting of the CP0.Config3.ISAOnExc in
`set_hflags_for_handler' to set the ISA bit correctly on the exception
handler entry so it is the ability to set it that is missing only.

Backports commit 90f12d735d66ac1196d9a2bced039a432eefc03d from qemu
2018-02-11 16:24:19 -05:00
Maciej W. Rozycki 611933d18d
target-mips: Fix the 64-bit case for microMIPS MOVE16 and MOVEP
Fix microMIPS MOVE16 and MOVEP instructions on 64-bit processors by
using register addition operations.

This copies the approach taken with MIPS16 MOVE instructions (I8_MOV32R
and I8_MOVR32 opcodes) and follows the observation that OPC_ADDU expands
to tcg_gen_mov_tl whenever `rt' is 0 and `rs' is not, therefore copying
`rs' to `rd' verbatim. This is not the case with OPC_ADDIU where a
sign-extension from bit #31 is made, unless in the uninteresting case of
`rs' being 0, losing the upper 32 bits of the value copied for any
proper 64-bit values.

This also serves as an optimization as one op is produced in generated
code rather than two (again, unless `rs' is 0, where it doesn't change
anything).

Backports commit 7215d7e7aea85699bf516c3e8d84f6a22584da35 from qemu
2018-02-11 16:17:41 -05:00
Maciej W. Rozycki 45c45541d0
target-mips: Correct the writes to Status and Cause registers via gdbstub
Make writes to CP0.Status and CP0.Cause have the same effect as
executing corresponding MTC0 instructions would in Kernel Mode. Also
ignore writes in the user emulation mode.

Currently for requests from the GDB stub we write all the bits across
both registers, ignoring any read-only locations, and do not synchronise
the environment to evaluate side effects. We also write these registers
in the user emulation mode even though a real kernel presents them as
read only.

Backports commit 81a423e6c6d3ccaa79de4e58024369c660c1eeb4 from qemu
2018-02-11 16:16:16 -05:00
Lioncash 8f64168d1f
target-mips: Correct the handling of writes to CP0.Status for MIPSr6
Correct these issues with the handling of CP0.Status for MIPSr6:

* only ignore the bit pattern of 0b11 on writes to CP0.Status.KSU, that
is for processors that do implement Supervisor Mode, let the bit
pattern be written to CP0.Status.UM:R0 freely (of course the value
written to read-only CP0.Status.R0 will be discarded anyway); this is
in accordance to the relevant architecture specification[1],

* check the newly written pattern rather than the current contents of
CP0.Status for the KSU bits being 0b11,

* use meaningful macro names to refer to CP0.Status bits rather than
magic numbers.

References:

[1] "MIPS Architecture For Programmers, Volume III: MIPS64 / microMIPS64
Privileged Resource Architecture", MIPS Technologies, Inc., Document
Number: MD00091, Revision 6.00, March 31, 2014, Table 9.45 "Status
Register Field Descriptions", pp. 210-211.

Backports commit f88f79ec9df06d26d84e1d2e0c02d2634b4d8583 from qemu
2018-02-11 16:10:54 -05:00
Maciej W. Rozycki 4d9107be8a
target-mips: Correct MIPS16/microMIPS branch size calculation
Correct MIPS16/microMIPS branch size calculation in PC adjustment
needed:

- to set the value of CP0.ErrorEPC at the entry to the reset exception,

- for the purpose of branch reexecution in the context of device I/O.

Follow the approach taken in `exception_resume_pc' for ordinary, Debug
and NMI exceptions.

MIPS16 and microMIPS branches can be 2 or 4 bytes in size and that has
to be reflected in calculation. Original MIPS ISA branches, which is
where this code originates from, are always 4 bytes long, just as all
original MIPS ISA instructions.

Backports commit c3577479815f5bcf9d38993967bca2115af245d8 from qemu
2018-02-11 16:09:33 -05:00
Lioncash 283cbd0317
target-mips: Restore the order of helpers
Restore the order of helpers that used to be: unary operations (generic,
then MIPS-specific), binary operations (generic, then MIPS-specific),
compare operations. At one point FMA operations were inserted at a
random place in the file, disregarding the preexisting order, and later
on even more operations sprinkled across the file. Revert the mess by
moving FMA operations to a new ternary class inserted after the binary
class and move the misplaced unary and binary operations to where they
belong.

Backports commit 8fc605b8aa257feb3e69d44794a765bd492b573b from qemu
2018-02-11 16:07:02 -05:00
Maciej W. Rozycki 802b5d9a3d
target-mips: Remove unused 'FLOAT_OP' macro
Remove the `FLOAT_OP' macro, unused since commit
b6d96beda3a6cbf20a2d04a609eff78adebd8859 [Use temporary registers for
the MIPS FPU emulation.].

Backports commit 51fdea945ae7adae8d7e4a1624e35bb7f714b58f from qemu
2018-02-11 16:03:56 -05:00
Lioncash f62664948e
target-mips: Make 'helper_float_cvtw_s' consistent with the remaining helpers
Move the call to `update_fcr31' in `helper_float_cvtw_s' after the
exception flag check, for consistency with the remaining helpers that do
it last too.

Backports commit 2b09f94cdbf5c54e2278d7f3aed2eceff3494790 from qemu
2018-02-11 16:02:38 -05:00
Maciej W. Rozycki 0f82a7f89f
target-mips: assorted formatting fixes
Backports commits d75de74967f631a7d0b538d4b88f96f9c426bfe2, 6225a4a0e39cb24e7b9e1d4d2c1a3e6eaee18e85, and d2bfa6e6222baa0218bd0658499d38bac56ac34c from qemu
2018-02-11 16:01:23 -05:00
Maciej W. Rozycki ca496991ea
target-mips: Enable vectored interrupt support for the 74Kf CPU
Enable vectored interrupt support for the 74Kf CPU, reflecting hardware.

Backports commit 4386f08767240080334539ac0b07a8bfe30bffe9 from qemu
2018-02-11 15:57:17 -05:00
Maciej W. Rozycki 338e34290d
target-mips: Add M14K and M14Kc MIPS32r2 microMIPS processors
Add the M14K and M14Kc processors from MIPS Technologies that are the
original implementation of the microMIPS ISA. They are dual instruction
set processors, implementing both the microMIPS and the standard MIPSr32
ISA.

These processors correspond to the M4K and 4KEc CPUs respectively,
except with support for the microMIPS instruction set added, support for
the MCU ASE added and two extra interrupt lines, making a total of 8
hardware interrupts plus 2 software interrupts. The remaining parts of
the microarchitecture, in particular the pipeline, stayed unchanged.

The presence of the microMIPS ASE is is reflected in the configuration
added. We currently have no support for the MCU ASE, including in
particular the ACLR, ASET and IRET instructions in either encoding, and
we have no support for the extra interrupt lines, including bits in
CP0.Status and CP0.Cause registers, so these features are not marked,
making our support diverge from real hardware.

Backports commit 11f5ea105c06bec72e9bc9a700fa65d60afb5ec3 from qemu
2018-02-11 15:56:28 -05:00
Lioncash 833b0ff964
target-mips: Make CP0.Config4 and CP0.Config5 registers signed
Make the data type used for the CP0.Config4 and CP0.Config5 registers
and their mask signed, for consistency with the remaining 32-bit CP0
registers, like CP0.Config0, etc.

Backports commit 8280b12c0e4b515d707509dde4ddde05d9bda4ef from qemu
2018-02-11 15:48:10 -05:00
Maciej W. Rozycki 5eea73c534
target-mips: Add 5KEc and 5KEf MIPS64r2 processors
Add the 5KEc and 5KEf processors from MIPS Technologies that are the
original implementation of the MIPS64r2 ISA.

Silicon for these processors has never been taped out and no soft cores
were released even. They do exist though, a CP0.PRId value has been
assigned and experimental RTLs produced at the time the MIPS64r2 ISA has
been finalized. The settings introduced here faithfully reproduce that
hardware.

As far the implementation goes these processors are the same as the 5Kc
and the 5Kf CPUs respectively, except implementing the MIPS64r2 rather
than the original MIPS64 instruction set. There must have been some
updates to the CP0 architecture as mandated by the ISA, such as the
addition of the EBase register, although I am not sure about the exact
details, no documentation has ever been produced for these processors.
The remaining parts of the microarchitecture, in particular the
pipeline, stayed unchanged. Or to put it another way, the difference
between a 5K and a 5KE CPU corresponds to one between a 4K and a 4KE
CPU, except for the 64-bit rather than 32-bit ISA.

Backports commit 36b86e0dc2be93fc538fe7e11e0fda1a198f0135 from qemu
2018-02-11 15:47:13 -05:00
Richard Henderson 2c091e5fb8
target-arm: Add condexec state to insn_start
Backports commit 52e971d9ff67e340ac2a86bd67e14bd31c7991e0 from qemu
2018-02-11 15:13:40 -05:00
Richard Henderson 3f9502dc8b
tcg: Allow extra data to be attached to insn_start
With an eye toward having this data replace the gen_opc_* arrays
that each target collects in order to enable restore_state_from_tb.

Backports commit 9aef40ed1f6e2bd794bbb3ba8c8b773e506334c9 from qemu
2018-02-11 13:03:51 -05:00
Richard Henderson dd1ec408e5
target-*: Increment num_insns immediately after tcg_gen_insn_start
This does tidy the icount test common to all targets.

Backports commit 959082fc4a93a016a6b697e1e0c2b373d8a3a373 from qemu
2018-02-11 12:46:30 -05:00
Richard Henderson a64d0ff657
target-*: Unconditionally emit tcg_gen_insn_start
While we're at it, emit the opcode adjacent to where we currently
record data for search_pc. This puts gen_io_start et al on the
"correct" side of the marker.

Backports commit 667b8e29c5b1d8c5b4e6ad5f780ca60914eb6e96 from qemu
2018-02-11 12:41:20 -05:00
Lioncash b3f9ff667b
tcg: Rename debug_insn_start to insn_start
With an eye toward making it mandatory.

Backports commit 765b842adec4c5a359e69ca08785553599f71496 from qemu
2018-02-11 12:34:01 -05:00
Richard Henderson 77b03e0973
target-i386: Make check_hw_breakpoints static
The function is now only used from within a single file.

Backports commit dd941cdcfec536aad6a310a153778142ed9f3e92 from qemu
2018-02-11 12:28:08 -05:00
Richard Henderson 10e0920fa0
target-i386: Move breakpoint related functions to new file
Backports commit ba4b5c65a98ea91dc3b13e42dd9404808c999dda from qemu
2018-02-11 12:25:24 -05:00
Lioncash fb2fe4580f
optimize: Add missing extrh/extrl case 2018-02-11 02:57:55 -05:00
Lioncash 3791fc69fd
target-arm: Use new revbit functions
Backports commit 42fedbca8f5b54324ed89be3484d4a3dc9946387 from qemu
2018-02-11 02:57:55 -05:00
Richard Henderson a5d6a31d69
host-utils: Add revbit functions
Backports commit 652a4b7e736f432a6809d1d2b52d169ab0b9aa3b from qemu.
2018-02-11 02:57:55 -05:00
Richard Henderson eb5ed2a844
target-arm: Use tcg_gen_extrh_i64_i32
Usually, eliminate an operation from the translator by combining
a shift with an extract.

In the case of gen_set_NZ64, we don't need a boolean value for cpu_ZF,
merely a non-zero value. Given that we can extract both halves of a
64-bit input in one call, this simplifies the code.

Backports commit 7cb36e18b2f1c1f971ebdc2121de22a8c2e94fd6 from qemu
2018-02-11 02:57:54 -05:00
Richard Henderson b94da3fc13
target-arm: Recognize ROR
Backports commit 8fb0ad8e16ab3d03433244a1a03e1df757342ad8 from qemu
2018-02-11 02:57:33 -05:00
Richard Henderson 3173269986
target-arm: Eliminate unnecessary zero-extend in disas_bitfield
For !SF, this initial ext32u can't be optimized away by the
current TCG code generator. (It would require backward bit
liveness propagation.)

Backports commit d3a77b42decd0cbfa62a5526e67d1d6d380c83a9 from qemu
2018-02-11 01:35:58 -05:00
Richard Henderson c637a97270
target-arm: Recognize UXTB, UXTH, LSR, LSL
These are all special case aliases of UBFM.

Backports commit 9924e85829fe21b5f38a5d267c9aea44c5d478ac from qemu
2018-02-11 01:34:11 -05:00
Richard Henderson d9e4e70636
target-arm: Recognize SXTB, SXTH, SXTW, ASR
These are all special case aliases of SBFM.

Backports commit ef60151bee9a95e3a5cc98b345a19ed7eb435ddb from qemu
2018-02-11 01:31:54 -05:00
Richard Henderson 5ee72ff9f5
target-arm: Implement fcsel with movcond
Backports commit 6e061029d74455d83f6fa070ac33de7a356cf60d from qemu
2018-02-11 01:29:14 -05:00
Richard Henderson 53bd2b1d5c
target-arm: Implement ccmp branchless
This can allow much of a ccmp to be elided when particular
flags are subsequently dead.

Backports commit 7dd03d773e0dafae9271318fc8d6b2b14de74403 from qemu
2018-02-11 01:25:51 -05:00
Richard Henderson 2c71ddefb1
target-arm: Use setcond and movcond for csel
Backports commit 259cb68491ab36427e7e5d820fe543d53b006ec6 from qemu
2018-02-10 23:57:11 -05:00
Richard Henderson 70dd48b855
target-arm: Handle always condition codes within arm_test_cc
Handling this with TCG_COND_ALWAYS will allow these unlikely
cases to be handled without special cases in the rest of the
translator. The TCG optimizer ought to be able to reduce
these ALWAYS conditions completely.

Backports commit 9305eac09e61d857c9cc11e20db754dfc25a82db from qemu
2018-02-10 23:48:10 -05:00
Lioncash 94f1227f7a
target-arm: Introduce DisasCompare
Split arm_gen_test_cc into 3 functions, so that it can be reused
for non-branch TCG comparisons.

Backports commit 6c2c63d3a02c79e9035ca0370cc549d0f938a4dd from qemu
2018-02-10 23:45:47 -05:00
Richard Henderson 352f93a119
tcg/aarch64: Fix tcg_out_qemu_{ld, st} for guest_base == 0
In ffc6372851d8631a9f9fa56ec613b3244dc635b9, we swapped the guest
base to the address base register from the address index register.
Except that 31 in the base slot is SP not XZR, so we need to be
more intelligent about which reg gets placed in which slot.

Backports commit 352bcb0a2b816ff9ab9d75d0f2384650d9e9ab19 from qemu
2018-02-10 23:33:24 -05:00
Richard Henderson 7d57c2e4ce
tcg/aarch64: Use softmmu fast path for unaligned accesses
Backports commit 9ee14902bf107e37fb2c8119fa7bca424396237c from qemu
2018-02-10 23:25:34 -05:00
Lioncash f8388a6c03
header_gen: Fix mips platform 2018-02-10 23:21:41 -05:00
Richard Henderson aaf89ed84d
tcg/s390: Use softmmu fast path for unaligned accesses
Backports commit a5e39810b9088b5d20fac8e0293f281e1c8b608f from qemu
2018-02-10 23:14:14 -05:00
Richard Henderson a3aaf5a864
tcg: Remove tcg_gen_trunc_i64_i32
Replacing it with tcg_gen_extrl_i64_i32.

Backports commit ecc7b3aa71f5fdcf9ee87e74ca811d988282641d from qemu
2018-02-10 23:11:02 -05:00
Richard Henderson 58e939b91f
tcg: Split trunc_shr_i32 opcode into extr[lh]_i64_i32
Rather than allow arbitrary shift+trunc, only concern ourselves
with low and high parts. This is all that was being used anyway.

Backports commit 609ad70562793937257c89d07bf7c1370b9fc9aa from qemu
2018-02-10 23:00:45 -05:00
Aurelien Jarno a05256b206
tcg: update README about size changing ops
Backports commit 870ad1547ac53bc79c21d86cf453b3b20cc660a2 from qemu
2018-02-10 22:49:36 -05:00
Aurelien Jarno 4bd3d5005e
tcg/optimize: add optimizations for ext_i32_i64 and extu_i32_i64 ops
They behave the same as ext32s_i64 and ext32u_i64 from the constant
folding and zero propagation point of view, except that they can't
be replaced by a mov, so we don't compute the affected value.

Backports commit 8bcb5c8f34f9215d4f88f388c7ff14c9bd5cecd3 from qemu
2018-02-10 22:47:26 -05:00
Aurelien Jarno f279c93768
tcg: implement real ext_i32_i64 and extu_i32_i64 ops
Implement real ext_i32_i64 and extu_i32_i64 ops. They ensure that a
32-bit value is always converted to a 64-bit value and not propagated
through the register allocator or the optimizer.

Backports commit 4f2331e5b67af8172419eb1c8db510b497b30a7b from qemu
2018-02-10 22:45:13 -05:00
Aurelien Jarno 80223e7ad5
tcg: rename trunc_shr_i32 into trunc_shr_i64_i32
The op is sometimes named trunc_shr_i32 and sometimes trunc_shr_i64_i32,
and the name in the README doesn't match the name offered to the
frontends.

Always use the long name to make it clear it is a size changing op.

Backports commit 0632e555fc4d281d69cb08d98d500d96185b041f from qemu
2018-02-10 22:29:30 -05:00
Aurelien Jarno 5f0920ad0f
tcg/optimize: allow constant to have copies
Now that copies and constants are tracked separately, we can allow
constant to have copies, deferring the choice to use a register or a
constant to the register allocation pass. This prevent this kind of
regular constant reloading:

-OUT: [size=338]
+OUT: [size=298]
   mov    -0x4(%r14),%ebp
   test   %ebp,%ebp
   jne    0x7ffbe9cb0ed6
   mov    $0x40002219f8,%rbp
   mov    %rbp,(%r14)
-  mov    $0x40002219f8,%rbp
   mov    $0x4000221a20,%rbx
   mov    %rbp,(%rbx)
   mov    $0x4000000000,%rbp
   mov    %rbp,(%r14)
-  mov    $0x4000000000,%rbp
   mov    $0x4000221d38,%rbx
   mov    %rbp,(%rbx)
   mov    $0x40002221a8,%rbp
   mov    %rbp,(%r14)
-  mov    $0x40002221a8,%rbp
   mov    $0x4000221d40,%rbx
   mov    %rbp,(%rbx)
   mov    $0x4000019170,%rbp
   mov    %rbp,(%r14)
-  mov    $0x4000019170,%rbp
   mov    $0x4000221d48,%rbx
   mov    %rbp,(%rbx)
   mov    $0x40000049ee,%rbp
   mov    %rbp,0x80(%r14)
   mov    %r14,%rdi
   callq  0x7ffbe99924d0
   mov    $0x4000001680,%rbp
   mov    %rbp,0x30(%r14)
   mov    0x10(%r14),%rbp
   mov    $0x4000001680,%rbp
   mov    %rbp,0x30(%r14)
   mov    0x10(%r14),%rbp
   shl    $0x20,%rbp
   mov    (%r14),%rbx
   mov    %ebx,%ebx
   mov    %rbx,(%r14)
   or     %rbx,%rbp
   mov    %rbp,0x10(%r14)
   mov    %rbp,0x90(%r14)
   mov    0x60(%r14),%rbx
   mov    %rbx,0x38(%r14)
   mov    0x28(%r14),%rbx
   mov    $0x4000220e60,%r12
   mov    %rbx,(%r12)
   mov    $0x40002219c8,%rbx
   mov    %rbp,(%rbx)
   mov    0x20(%r14),%rbp
   sub    $0x8,%rbp
   mov    $0x4000004a16,%rbx
   mov    %rbx,0x0(%rbp)
   mov    %rbp,0x20(%r14)
   mov    $0x19,%ebp
   mov    %ebp,0xa8(%r14)
   mov    $0x4000015110,%rbp
   mov    %rbp,0x80(%r14)
   xor    %eax,%eax
   jmpq   0x7ffbebcae426
   lea    -0x5f6d72a(%rip),%rax        # 0x7ffbe3d437b3
   jmpq   0x7ffbebcae426

Backports commit 299f80130401153af1a6ddb3cc011781bcd47600 from qemu
2018-02-10 22:18:03 -05:00
Aurelien Jarno 59909fe549
tcg/optimize: track const/copy status separately
Instead of using an enum which could be either a copy or a const, track
them separately. This will be used in the next patch.

Constants are tracked through a bool. Copies are tracked by initializing
temp's next_copy and prev_copy to itself, allowing to simplify the code
a bit.

Backports commit b41059dd9deec367a4ccd296659f0bc5de2dc705 from qemu
2018-02-10 22:15:43 -05:00
Aurelien Jarno 134a7dfe82
tcg/optimize: add temp_is_const and temp_is_copy functions
Add two accessor functions temp_is_const and temp_is_copy, to make the
code more readable and make code change easier.

Backports commit d9c769c60948815ee03b2684b1c1c68ee4375149 from qemu
2018-02-10 22:07:02 -05:00
Aurelien Jarno b450b79622
tcg/optimize: optimize temps tracking
The tcg_temp_info structure uses 24 bytes per temp. Now that we emulate
vector registers on most guests, it's not uncommon to have more than 100
used temps. This means we have initialize more than 2kB at least twice
per TB, often more when there is a few goto_tb.

Instead used a TCGTempSet bit array to track which temps are in used in
the current basic block. This means there are only around 16 bytes to
initialize.

This improves the boot time of a MIPS guest on an x86-64 host by around
7% and moves out tcg_optimize from the the top of the profiler list.

Backports commit 1208d7dd5fddc1fbd98de800d17429b4e5578848 from qemu
2018-02-10 21:51:46 -05:00
Aurelien Jarno 5f67ab74e7
tcg/optimize: fix constant signedness
By convention, on a 64-bit host TCG internally stores 32-bit constants
as sign-extended. This is not the case in the optimizer when a 32-bit
constant is folded.

This doesn't seem to have more consequences than suboptimal code
generation. For instance the x86 backend assumes sign-extended constants,
and in some rare cases uses a 32-bit unsigned immediate 0xffffffff
instead of a 8-bit signed immediate 0xff for the constant -1. This is
with a ppc guest:

before
------

 ---- 0x9f29cc
 movi_i32 tmp1,$0xffffffff
 movi_i32 tmp2,$0x0
 add2_i32 tmp0,CA,CA,tmp2,r6,tmp2
 add2_i32 tmp0,CA,tmp0,CA,tmp1,tmp2
 mov_i32 r10,tmp0

0x7fd8c7dfe90c:  xor    %ebp,%ebp
0x7fd8c7dfe90e:  mov    %ebp,%r11d
0x7fd8c7dfe911:  mov    0x18(%r14),%r9d
0x7fd8c7dfe915:  add    %r9d,%r10d
0x7fd8c7dfe918:  adc    %ebp,%r11d
0x7fd8c7dfe91b:  add    $0xffffffff,%r10d
0x7fd8c7dfe922:  adc    %ebp,%r11d
0x7fd8c7dfe925:  mov    %r11d,0x134(%r14)
0x7fd8c7dfe92c:  mov    %r10d,0x28(%r14)

after
-----

 ---- 0x9f29cc
 movi_i32 tmp1,$0xffffffffffffffff
 movi_i32 tmp2,$0x0
 add2_i32 tmp0,CA,CA,tmp2,r6,tmp2
 add2_i32 tmp0,CA,tmp0,CA,tmp1,tmp2
 mov_i32 r10,tmp0

0x7f37010d490c:  xor    %ebp,%ebp
0x7f37010d490e:  mov    %ebp,%r11d
0x7f37010d4911:  mov    0x18(%r14),%r9d
0x7f37010d4915:  add    %r9d,%r10d
0x7f37010d4918:  adc    %ebp,%r11d
0x7f37010d491b:  add    $0xffffffffffffffff,%r10d
0x7f37010d491f:  adc    %ebp,%r11d
0x7f37010d4922:  mov    %r11d,0x134(%r14)
0x7f37010d4929:  mov    %r10d,0x28(%r14)

Backports commit 29f3ff8d6cbc28f79933aeaa25805408d0984a8f from qemu
2018-02-10 21:40:20 -05:00
Aurelien Jarno e273acf87a
tcg/optimize: fix tcg_opt_gen_movi
Due to a copy&paste, the new op value is tested against mov_i32 instead
of movi_i32. The test is therefore always false. Fix that.

Backports commit 961521261a3d600b0695b2e6d2b0f490076f7e90 from qemu
2018-02-10 21:38:09 -05:00
Aurelien Jarno 42dd2addbe
tcg/optimize: rename tcg_constant_folding
The tcg_constant_folding folding ends up doing all the optimizations
(which is a good thing to avoid looping on all ops multiple time), so
make it clear and just rename it tcg_optimize.

Backports commit 36e60ef6ac5d8a262d0fbeedfdb2b588514cb1ea from qemu
2018-02-10 21:36:34 -05:00
Aurelien Jarno 7b0055d742
tcg/optimize: fold constant test in tcg_opt_gen_mov
Most of the calls to tcg_opt_gen_mov are preceeded by a test to check if
the source temp is a constant. Fold that into the tcg_opt_gen_mov
function.

Backports commit 97a79eb70dd35a24fda87d86196afba5e6f21c5d from qemu
2018-02-10 21:34:00 -05:00
Aurelien Jarno 517fac57c3
tcg/optimize: fold temp copies test in tcg_opt_gen_mov
Each call to tcg_opt_gen_mov is preceeded by a test to check if the
source and destination temps are copies. Fold that into the
tcg_opt_gen_mov function.

Backports commit 5365718a9afeeabde3784d82a542f8ad909b18cf from qemu
2018-02-10 21:27:06 -05:00
Aurelien Jarno d21f474c39
tcg/optimize: remove opc argument from tcg_opt_gen_mov
We can get the opcode using the TCGOp pointer. It needs to be
dereferenced, but it's anyway done a few lines below to write
the new value.

Backports commit 8d6a91602ea824ef4435ea38fd475387eecc098c from qemu
2018-02-10 21:23:34 -05:00
Aurelien Jarno 0fd0afad13
tcg/optimize: remove opc argument from tcg_opt_gen_movi
We can get the opcode using the TCGOp pointer. It needs to be
dereferenced, but it's anyway done a few lines below to write
the new value.

Backports commit ebd27391b00cdafc81e0541a940686137b3b48df from qemu
2018-02-10 21:21:13 -05:00
Richard Henderson dafc44c0a5
target-mips: Use CPU_LOG_INT for logging related to interrupts
There are now no unconditional uses of qemu_log in the subdirectory.

Backports commit c85570163bdf1ba29cb52a63f22ff1c48f1b9398 from qemu
2018-02-10 21:12:41 -05:00
Richard Henderson 6f66fb4bd5
target-mips: Copy restrictions from ext/ins to dext/dins
The checks in dins is required to avoid triggering an assertion
in tcg_gen_deposit_tl. The check in dext is just for completeness.
Fold the other D cases in via fallthru.

Backports commit b7f26e523914b982a1c1bfa8295f77ff9787c33c from qemu
2018-02-10 21:09:26 -05:00
Richard Henderson f5e38ea71e
tcg/aarch64: use 32-bit offset for 32-bit softmmu emulation
Similar to the same fix for user-mode, except this instance
occurs on the softmmu path. Again, the tlb addend must be
the base register, while the guest address is the index.

Backports commit 80adb8fcad4778376a11d394a9e01516819e2327 from qemu
2018-02-10 20:59:13 -05:00
Paolo Bonzini cfc9356a8e
tcg/aarch64: use 32-bit offset for 32-bit user-mode emulation
Thanks to the previous patch, it is now easy for tcg_out_qemu_ld and
tcg_out_qemu_st to use a 32-bit zero extended offset.  However, the
guest base register x28 must be the base and addr_reg must be the
index.

Backports commit ffc6372851d8631a9f9fa56ec613b3244dc635b9 from qemu
2018-02-10 20:55:51 -05:00
Paolo Bonzini 85bac3c96d
tcg/aarch64: add ext argument to tcg_out_insn_3310
The new argument lets you pick uxtw or uxtx mode for the offset
register.  For now, all callers pass TCG_TYPE_I64 so that uxtx
is generated.  The bits for uxtx are removed from I3312_TO_I3310.

Backports commit 6c0f0c0f124718650a8d682ba275044fc02f6fe2 from qemu
2018-02-10 20:51:37 -05:00
Richard Henderson 95e666c547
tcg/i386: Extend addresses for 32-bit guests
Removing the ??? comment explaining why it (mostly) worked.

Backports commit ee8ba9e4d8458b8bba5455a7ae704620c4f2ef4b from qemu
2018-02-10 20:42:33 -05:00
Richard Henderson 17c1f027c1
tcg: Handle MO_AMASK in tcg_dump_ops
Backports commit 59c4b7e8dfab0cdc41434fedbf2686222f541e57 from qemu
2018-02-10 20:32:52 -05:00
Richard Henderson c5a2a50c06
tcg: Mask TCGMemOp appropriately for indexing
The addition of MO_AMASK means that places that used inverted masks
need to be changed to use positive masks, and places that failed to
mask the intended bits need updating.

Backports commit 2b7ec66f025263a5331f37d5ad78a625496fd7bd from qemu
2018-02-10 20:29:36 -05:00
Richard Henderson 336833c11e
tcg: Add MO_ALIGN, MO_UNALN
These modifiers control, on a per-memory-op basis, whether
unaligned memory accesses are allowed. The default setting
reflects the target's definition of ALIGNED_ONLY.

Backports commit dfb36305626636e2e07e0c5acd3a002a5419399e from qemu
2018-02-10 20:18:53 -05:00
Richard Henderson ac713c7034
tcg: Push merged memop+mmu_idx parameter to softmmu routines
The extra information is not yet used but it is now available.
This requires minor changes through all of the tcg backends.

Backports commit 3972ef6f830d65e9bacbd31257abedc055fd6dc8 from qemu
2018-02-10 20:03:22 -05:00
Richard Henderson 6234d07489
tcg: Merge memop and mmu_idx parameters to qemu_ld/st
At the tcg opcode level, not at the tcg-op.h generator level.
This requires minor changes through all of the tcg backends,
but none of the cpu translators.

Backports commit 59227d5d45bb3c31dc2118011691c35b3c00879c from qemu
2018-02-10 19:01:49 -05:00
Richard Henderson 7532c92358
tcg/optimize: Handle or r,a,a with constant a
Backports commit 2374c4b8375072da1f401c6daccc68ae76c73e63 from qemu
2018-02-09 14:56:12 -05:00
Richard Henderson e0d99a1a06
tcg: Complete handling of ALWAYS and NEVER
Missing from movcond, and brcondi_i32 (but not brcondi_i64).

Backports commit 37ed3bf1ee07bb1a26adca0df8718f601f231c0b from qemu
2018-02-09 14:52:21 -05:00
Richard Henderson 6bd102ba86
tcg: Use tcg_malloc to allocate TCGLabel
Pre-allocating 512 of them per TB is a waste.

Backports commit 51e3972c41598adc91fe3f4767057f5198dcc15c from qemu
2018-02-09 14:48:20 -05:00
Richard Henderson 00b0a50f47
tcg: Change generator-side labels to a pointer
This is less about improved type checking than enabling a
subsequent change to the representation of labels.

Backports commit bec1631100323fac0900aea71043d5c4e22fc2fa from qemu
2018-02-09 14:40:59 -05:00
Richard Henderson 232632e76c
tcg: Change translator-side labels to a pointer
This is improved type checking for the translators -- it's no longer
possible to accidentally swap arguments to the branch functions.

Note that the code generating backends still manipulate labels as int.

With notable exceptions, the scope of the change is just a few lines
for each target, so it's not worth building extra machinery to do this
change in per-target increments.

Backports commit 42a268c241183877192c376d03bd9b6d527407c7 from qemu
2018-02-09 14:17:56 -05:00
Richard Henderson 255a160c66
tcg: Remove unused opcodes
We no longer need INDEX_op_end to terminate the list, nor do we
need 5 forms of nop, since we just remove the TCGOp instead.

Backports commit 15fc7daa770764cc795158cbb525569f156f3659 from qemu
2018-02-09 13:20:41 -05:00
Richard Henderson 70f28c8bd5
tcg: Implement insert_op_before
Rather reserving space in the op stream for optimization,
let the optimizer add ops as necessary.

Backports commit a4ce099a7a4b4734c372f6bf28f3362e370f23c1 from qemu
2018-02-09 13:11:50 -05:00
Richard Henderson 4fcaabf38c
tcg: Remove opcodes instead of noping them out
With the linked list scheme we need not leave nops in the stream
that we need to process later.

Backports commit 0c627cdca20155753a536c51385abb73941a59a0 from qemu
2018-02-09 13:03:58 -05:00
Lioncash 0273e6ae18
tcg: Put opcodes in a linked list
The previous setup required ops and args to be completely sequential,
and was error prone when it came to both iteration and optimization.
2018-02-09 12:54:05 -05:00
Richard Henderson a41b9acc0c
tcg: Introduce tcg_op_buf_count and tcg_op_buf_full
The method by which we count the number of ops emitted
is going to change. Abstract that away into some inlines.

Backports commit fe700adb3db5b028b504423b946d4ee5200a8f2f from qemu.
2018-02-09 09:31:17 -05:00
Richard Henderson 78378289e3
tcg: Move emit of INDEX_op_end into gen_tb_end
Backports commit 0a7df5da986bd7ee0789f2d7b8611f2e8eee5046 from qemu
2018-02-09 08:51:01 -05:00
Richard Henderson 4d46959c3b
tcg: Reduce ifdefs in tcg-op.c
Almost completely eliminates the ifdefs in this file, improving
confidence in the lesser used 32-bit builds.

Backports commit 3a13c3f34ce2058e0c2decc3b0f9f56be24c9400 from qemu
2018-02-09 08:35:52 -05:00
Richard Henderson 500c546444
tcg: Move some opcode generation functions out of line
Some of these functions are really quite large.  We have a number of
things that ought to be circularly dependent, but we duplicated code
to break that chain for the inlines.

This saved 25% of the code size of one of the translators I examined.
2018-02-09 08:10:00 -05:00
Richard Henderson cb7b19ad26
tcg: Change ts->mem_reg to ts->mem_base
Chain the temporaries together via pointers intstead of indices.
The mem_reg value is now mem_base->reg.  This will be important later.

This does require that the frame pointer have a global temporary
allocated for it.  This is simple bar the existing reserved_regs check.

Backports commit b3a62939561e07bc34493444fa926b6137cba4e8 from qemu
2018-02-08 13:04:48 -05:00
Richard Henderson 6b4b493dae
tcg: Change tcg_global_mem_new_* to take a TCGv_ptr
Thus, use cpu_env as the parameter, not TCG_AREG0 directly.
Update all uses in the translators.

Backports commit e1ccc05444676b92c63708096e36582be27fbee1 from qemu
2018-02-08 12:33:33 -05:00
Richard Henderson afb67fc002
target/arm: Fix aa64 ldp register writeback
Backports commit 3e4d91b94ce400326fae0850578d9e9f30a71adb from qemu
2018-02-08 08:29:51 -05:00
Eric Blake 37cdcbf771
maint: Fix macros with broken 'do/while(0); ' usage 2018-02-07 20:27:37 -05:00
Lioncash 0f453b0595
target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers
Backports commit 9a2b5256ea1f68c89d5da4b54f180f576c2c82d6 from qemu
2018-02-07 10:09:26 -05:00
Lioncash dd577f5ea5
target/arm: Change the type of vfp.regs
Backports commit 3f68b8a5a6862f856524bb347bf348ae364dd43c from qemu
2018-02-07 09:57:43 -05:00
Lioncash ef07c136b6
target/arm: Add fp16 support to vfp_expand_imm
Backports commit 8081796a75414f9ed5ec3d97158e543ed45908ec from qemu.
2018-02-07 09:47:04 -05:00
Lioncash b55f35ba92
target/arm: Split out vfp_expand_imm
Backports commit e90a99fe6bde9b85bff8c052ade51520f20d9bce from qemu.
2018-02-07 09:44:52 -05:00
Lioncash 4c165ed788
translate-a64: Silence unused variable warning 2018-02-06 08:38:01 -05:00
Merry 29d38d7c22
Merge pull request #10 from lioncash/el-busto-ldst-exclusive
translate-a64: Backport fix for incorrect load/store exclusive unallocated checks
2018-02-05 20:59:25 +00:00
Merry b7bb608197
Merge pull request #9 from lioncash/ia64
tcg: Drop ia64 host support
2018-02-05 20:59:18 +00:00
Merry 82c4212ce3
Merge pull request #8 from lioncash/optimize
Backport REV16 optimizations from qemu
2018-02-05 20:58:58 +00:00
Lioncash 1e451b386a
translate-a64: Backport fix for incorrect load/store exclusive unallocated checks
Backports commit e14f0eb12f920fd96b9f79d15cedd437648e8667 from qemu
2018-02-04 23:17:45 -05:00
Lioncash 7f665d8c1e
tcg: Drop ia64 host support
Backports commit a46c1244a0d65d5f37fc12e4d42f2479eac87b52 from qemu
2018-02-04 18:33:02 -05:00
Lioncash 5a37b8c28e
Backport optimizations to AArch32's REV16 handling
Backports commit 68cedf733ae32363ccf54f0b52c8a424d5ec98ed from qemu
2018-02-04 14:53:28 -05:00
Lioncash 4a8a92bad2
Backport optimizations to AArch64's REV16 handling
Backports commits abb1066df313602ef0ca631126bd342d399d5359 and e4256c3cbf7eefebc0bc6e1f472c47c6dd20b996 from qemu.
2018-02-04 14:45:39 -05:00
Lioncash 122d54e23e
Backport the SVE feature flag
Backports commit 0d0a16c647650d476219a5e1313dec434f9fbebb in qemu to unicorn
2018-02-02 08:52:15 -05:00
Lioncash 4fb2fbfacf
Backport the JAZELLE feature flag
Backports commit c99a55d38dd5b5131f3fcbbaf41828a09ee62544 in qemu to unicorn
2018-02-02 08:50:18 -05:00
Lioncash 84319130cd
Backport the M_SECURITY feature flag
Backports relevant parts from commit 1e577cc7cffd3de14dbd321de5c3ef191c6ab07f in qemu to unicorn
2018-02-02 08:44:46 -05:00
Lioncash 20038fb801
Backport the PMU feature flag
Backports the applicable code from commit 929e754d5a621cd53f30e69b766ccf381b58d124 to unicorn
2018-02-02 08:28:27 -05:00
Lioncash 35100ce4e0
Backport the VBAR feature flag
Backports commit 91db4642f868cf2e591b62d31a19d35b02ea791e from qemu to unicorn
2018-02-02 08:24:12 -05:00
Lioncash 291b5753eb
Backport the THUMB_DSP feature flag
Backports commit 62b44f059a84d1ac580a653fc4110dfabaef6b83 in qemu to unicorn.
2018-02-02 07:59:26 -05:00
Lioncash 438e2836e0
helper_a64: Fix CRC32's implementation 2018-01-29 09:24:36 -05:00
Lioncash d41b200fd4
A64: Add EOR3 and BCAX support
Backported to unicorn from: https://lists.nongnu.org/archive/html/qemu-devel/2018-01/msg05003.html
2018-01-25 21:18:36 -05:00
MerryMage 4128f3b259 aarch64: Add FPCR and FPSR registers 2018-01-16 17:37:47 +00:00
MerryMage f90c819a33 aarch64: Add pstate pseudoregister 2018-01-16 17:37:17 +00:00
bunnei 73f4573535 aarch64: Add exception syndrome pseudo register. 2018-01-03 19:41:12 -05:00
Nguyen Anh Quynh d5f83a9c2e arm: cleanup for ARM_CPU 2017-12-21 09:43:33 +08:00
Nguyen Anh Quynh e67be36c88 arm: remove unused variable in arm_cpu_get_phys_page_debug() 2017-12-20 22:12:35 +08:00
Nguyen Anh Quynh 3e0d0cfab7 i386: fix signed int overflow in #923 & #924 2017-12-16 10:28:45 +08:00
Andrew Dutcher d7735487f7 Use the qemu helpers to get/set the x86 eflags (#878) 2017-09-15 22:18:38 +07:00
Andrew Dutcher 363cbacee4 Only set eip to the instruction pointer after an interrupt if the interrupt was user-generated (#875) 2017-08-29 17:14:36 +07:00
darkf 42d0632108 Fix typo in ARM tcg-target.c (#859) 2017-07-22 23:36:38 +08:00
vardyh ad767abda8 x86::trans: handle illegal case for opc c6/c7
Reference Intel software developer manual vol2 Appendix A Table A-6 for
detailed decoding information.

Signed-off-by: vardyh <vardyh.dev@gmail.com>
2017-05-25 15:22:45 +08:00
misson20000 014ccfb94a Aarch64 add thread registers (#834)
* add thread registers to AArch64

* update bindings to add AArch64 thread registers

* fix indentation for register read/write switch-case in unicorn_aarch64.c
2017-05-14 14:42:49 +07:00
bulaza 4b9efdc986 Adding INSN hook checks for x86 (#833)
* adding INSN hook checking for x86

* tabs to spaces

* need to return bool not uc_err

* fixed conditional after switching to bool
2017-05-14 00:16:17 +07:00
Ryan Hileman ae6ea3b91d fix arm64 hang (fix #827) (#828) 2017-05-09 20:19:32 +08:00
Samuel Groß 5385baba39 Implemented read and write access to the YMM registers (#819) 2017-05-05 09:02:58 +08:00
zhangwm 4a62409949 arm64eb: arm64 big endian also using little endian instructions. (#816)
* arm64eb: arm64 big endian also using little endian instructions.

* arm64: using another example that depends on endians.

example:
1. store a word: 0x12345678
2. load a byte:
   * little endian : 0x78
   * big endian    : 0x12
2017-05-04 20:00:48 +08:00
Ryan Hileman 1b00d3f89a remove slow cpu QOM casts (#815) 2017-05-02 14:56:39 +08:00
Ryan Hileman 187b470245 add arm64 CPACR_EL1 register support (#814) 2017-05-02 14:51:19 +08:00
zhangwm 2e973a13f0 arm64eb: add support for ARM64 big endian. 2017-04-24 23:30:01 +08:00
Nguyen Anh Quynh 513075e061 arm: fix an warning reported by GCC 2017-04-21 21:12:57 +08:00
Nguyen Anh Quynh e917c9de10 Merge branch 'master' into msvc2 2017-04-21 01:17:00 +08:00
0xSeb 605400e10e determine correct Thumb/Thumb2 instruction size (16/32-bit) for code … (#796)
* determine correct Thumb/Thumb2 instruction size (16/32-bit) for code hook

* determine correct Thumb/Thumb2 instruction size (16/32-bit) for code hook

* determine correct Thumb/Thumb2 instruction size (16/32-bit) for code hook
2017-04-15 00:39:56 +08:00
Nguyen Anh Quynh f915f14e74 Merge branch 'master' of https://github.com/unicorn-engine/unicorn 2017-04-12 22:06:40 +08:00
Nguyen Anh Quynh cb44f77ac3 mips: fix uc_reg_read() for MIPS64 2017-04-12 22:06:26 +08:00
Nguyen Anh Quynh 3315f288d3 fix an warning in glib_compat.c 2017-04-12 14:01:58 +08:00
bunnei 4eca426fb6 unicorn_aarch64: Expose UC_ARM64_REG_NZCV register. (#791) 2017-03-31 10:21:45 +08:00
Nguyen Anh Quynh 094ca80092 fix conflicts 2017-03-30 12:23:24 +08:00
zhangwm ccdb0ff523 armeb: rename arm's and mips's *REGS_STORAGE_SIZE to avoid big-endian and little-endian's duplicated definition. 2017-03-15 22:25:35 +08:00
Nguyen Anh Quynh a267af7d95 add arm_release to qemu/header_gen.py, and regenerate qemu/armeb.h 2017-03-14 23:41:31 +08:00
zhangwm d8fe34a2e8 armeb: Add support for ARM big endian. 2017-03-13 22:32:44 +08:00
Nguyen Anh Quynh c01dcf0a14 fix merge conflicts 2017-03-10 21:04:33 +08:00
feliam 0150ca24b1 Add support for ARM application flags - APSR register (#776) 2017-03-09 22:28:03 +08:00
Matt Thomas 2749b8412e fix register widths for MIPS64 reg_read/write (#775)
* fix register widths for MIPS64 reg_read/write

* fix preprocessor typedef error for qemu/target-mips
2017-03-08 08:40:30 +08:00
stevielavern b3a5eae81c uc_reg_read & uc_reg_write now support ARM64 Neon registers (#774)
* uc_reg_read & uc_reg_write now support ARM64 Neon registers

* Do not reuse uc_x86_xmm for uc_arm64_neon128. TODO: refactor both classes to use the same parent.
2017-03-07 21:29:34 +08:00
Nguyen Anh Quynh c3808179e1 another attempt to fix #766 2017-02-26 15:22:24 +08:00
Nguyen Anh Quynh e65fef70dc add missing TCG context arg to few functions in tcg.c. see #766 2017-02-26 09:47:40 +08:00
Nguyen Anh Quynh d52f85d16e add back missing ELF symbols reported in #766 2017-02-26 09:39:11 +08:00
Ahmed Samy 02e6c14e12 x86: add MSR API via reg API (#755)
Writing / reading to model specific registers should be as easy as
calling a function, it's a bit stupid to write shell code and run them
just to write/read to a MSR, and even worse, you need more than just a
shellcode to read...

So, add a special register ID called UC_X86_REG_MSR, which should be
passed to uc_reg_write()/uc_reg_read() as the register ID, and then a
data structure which is uc_x86_msr (12 bytes), as the value (always), where:
	Byte	Value		Size
	0	MSR ID		4
	4       MSR val		8
2017-02-24 21:37:19 +08:00
Nguyen Anh Quynh f3ada41b99 fix the last fix that crashes samples 2017-02-24 20:34:52 +08:00
Nguyen Anh Quynh 7c29558a95 msvc: fix a warning in qemu/exec.c when merging master to msvc 2017-02-24 19:29:55 +08:00
Nguyen Anh Quynh 6ea39f7d5a merge msvc with master 2017-02-24 10:39:36 +08:00
Nguyen Anh Quynh e7ecbf7889 m68k: fix a compilation warning 2017-02-23 20:34:17 +08:00
Nguyen Anh Quynh 714cf2c609 arm: fix a warning 2017-02-23 20:32:09 +08:00
Nguyen Anh Quynh 736d9857d2 recover some ELF symbols for building on Arm, PPC, Sparc & S390. issue #752 2017-02-20 15:16:50 +08:00
Chris Eagle a03e908611 Fix initial state of segment registers (#751)
* Remove glib from samples makefile

* changes to 16 bit segment registers needs to update segment base as well as segment selector

* change how x86 segment registers are set in 16-bit mode

* more appropriate solution to initial state of x86 segment registers in 16-bit mode

* remove commented lines
2017-02-09 23:49:54 +08:00
Chris Eagle f05984961b Fix 16-bit address computations (#747)
* Remove glib from samples makefile

* changes to 16 bit segment registers needs to update segment base as well as segment selector

* change how x86 segment registers are set in 16-bit mode
2017-02-08 09:37:41 +08:00
vardyh 7f9251511e MSVC port (vardyh) (#746)
* unicorn: use waitable timer to implement usleep() on Windows

Signed-off-by: vardyh <vardyh.dev@gmail.com>

* atomic: implement barrier() for msvc

Signed-off-by: vardyh <vardyh.dev@gmail.com>
2017-02-07 21:31:35 +08:00
Parker Thompson 053ecd7bf4 Added ARM coproc registers (#684)
* Added ARM coproc registers

* Added regression test for vfp
2017-01-25 11:56:19 +08:00
Nguyen Anh Quynh ef52d9a9d1 cleanup qemu/include/qemu/module.h 2017-01-25 00:20:08 +08:00
xorstream e08d1bf7c6 Arm issue fix. (#738)
* Fix for MIPS issue.

* Sparc support added.

* M68K support added.

* Arm support ported.

* Fix issue with VS2015 shlobj.h file

* Arm issue fix.
2017-01-24 17:45:01 +08:00
xorstream 8e45102b43 Arm support ported. (#736)
* Fix for MIPS issue.

* Sparc support added.

* M68K support added.

* Arm support ported.

* Fix issue with VS2015 shlobj.h file
2017-01-23 23:30:57 +08:00
xorstream 2695a0ffe8 M68K support added. (#735)
* Fix for MIPS issue.

* Sparc support added.

* M68K support added.
2017-01-23 14:40:02 +08:00
xorstream a40921ce32 Sparc support added. (#734)
* Fix for MIPS issue.

* Sparc support added.
2017-01-23 13:29:41 +08:00
xorstream 69ae8f7987 Fix for MIPS issue. (#733) 2017-01-23 12:39:34 +08:00
Nguyen Anh Quynh 2ecbe89cc1 cleanup Sparc unused code 2017-01-23 12:34:00 +08:00
Nguyen Anh Quynh e4c7c3dbe4 cleanup Sparc unused code 2017-01-23 12:33:39 +08:00
Nguyen Anh Quynh 0680b85920 cleanup Monitor related code 2017-01-23 10:07:01 +08:00
Nguyen Anh Quynh 81b8a685be cleanup 2017-01-23 10:06:49 +08:00
Nguyen Anh Quynh 55d472c62c cleanup Monitor related code 2017-01-23 00:53:31 +08:00
Nguyen Anh Quynh b3faed1df9 cleanup 2017-01-23 00:30:13 +08:00
Nguyen Anh Quynh a95fdbc5aa cleanup qemu/include/exec/memory.h 2017-01-22 23:21:47 +08:00
Nguyen Anh Quynh 5de0785a1b cleanup qemu/memory.c 2017-01-22 23:07:17 +08:00
xorstream e46f86c80b Merging with current msvc. 2017-01-23 01:07:06 +11:00
xorstream 72a497bc14 Added MIPS support and projects for all samples. 2017-01-23 01:05:08 +11:00
Nguyen Anh Quynh 206819bd98 cleanup after msvc port 2017-01-22 21:27:17 +08:00
xorstream 1a9ebbecde isnan() fix for msvc2013 onwards (#729)
* Changed some MSVC compatibility defines based on MSVC version.

* Added prebuild_script.bat to remove leftover configure generated files before building.

Also added project files and MSVC copies of configure generated files for all supported CPUs.

* Moved ./bindings/msvc_native into ./msvc

* Remove old project dir.

* isnan() fix for msvc2013 onwards
2017-01-22 16:14:05 +08:00
xorstream 03dcce40b2 isnan() fix for msvc2013 onwards 2017-01-22 18:13:28 +11:00
Nguyen Anh Quynh 49c904a629 cleanup qemu/configure 2017-01-22 05:57:29 +08:00
Nguyen Anh Quynh d04cc8671d cleanup qemu/configure 2017-01-22 05:56:37 +08:00
Nguyen Anh Quynh 2a1b9d8e1b cleanup qemu/Makefile.objs 2017-01-21 21:50:12 +08:00
xorstream 9fac29d154 Changed some MSVC compatibility defines based on MSVC version. (#724) 2017-01-21 20:21:27 +08:00
Nguyen Anh Quynh 0d51163abc cleanup qemu/util/qemu-timer-common.c 2017-01-21 14:55:35 +08:00
Nguyen Anh Quynh 45717c61ba cleanup qemu/util/qemu-timer-common.c 2017-01-21 14:53:33 +08:00
Nguyen Anh Quynh 647c97ddc3 ffs() is redundant 2017-01-21 11:11:22 +08:00
Nguyen Anh Quynh 5d0797afe7 ffs() is redundant 2017-01-21 11:10:48 +08:00
Nguyen Anh Quynh c8550b86f0 fix conflicts 2017-01-21 11:06:05 +08:00
Nguyen Anh Quynh fa12120d75 termios.h & strings.h are not needed 2017-01-21 11:02:17 +08:00
xorstream 770c5616e2 Automated leading tab to spaces conversion. 2017-01-21 12:28:22 +11:00
xorstream df41c49e2d Fixed warning about {} initialisers. 2017-01-21 11:41:11 +11:00
xorstream 429bfca48e Fixes for MSVC native support to still work with GCC/GNU. 2017-01-21 01:07:10 +11:00
xorstream 8840d5b42b Save copies of generated qapi files. 2017-01-21 00:30:50 +11:00
xorstream fac6a66860 platform.h move #3 2017-01-21 00:13:21 +11:00
xorstream 1aaf57ca54 Some more little edits to prepare for pull request. 2017-01-20 22:46:32 +11:00
xorstream b0ae2138fb Merge remote-tracking branch 'unicorn-engine/master' into msvc_native 2017-01-20 22:37:51 +11:00
Nguyen Anh Quynh ac68745a9c we dont need to handle VGA & Migration memories 2017-01-20 17:03:39 +08:00
Nguyen Anh Quynh fff532fc20 timer is redundant 2017-01-20 16:46:58 +08:00
Nguyen Anh Quynh 6daa8581cd win32_start_routine() looks broken. TODO 2017-01-20 16:12:49 +08:00
xorstream ee294eebb0 Fixed double free in win32 threads and changed free() to g_free(). (#722) 2017-01-20 16:03:35 +08:00
Nguyen Anh Quynh c6de7930c9 remove mutex code 2017-01-20 15:44:03 +08:00
xorstream 92392e0f57 Merge with current master. 2017-01-20 18:22:28 +11:00
Nguyen Anh Quynh 42771848d6 no more spinlock 2017-01-20 14:57:33 +08:00
Nguyen Anh Quynh a7fca49f7a delete qemu/include/qemu/notify.h 2017-01-20 14:47:41 +08:00
xorstream 002151874a Unicorn interface working with test app in 32bit and 64bit builds. 2017-01-20 17:27:22 +11:00
Nguyen Anh Quynh b887c3bb25 delete qemu/include/exec/poison.h 2017-01-20 13:58:50 +08:00
Nguyen Anh Quynh 94e55f45c1 del qemu/target-m68k/m68k-semi.c 2017-01-20 11:52:31 +08:00
Nguyen Anh Quynh b678512fc1 remove kvm stuffs 2017-01-20 01:03:59 +08:00
Nguyen Anh Quynh 7e2234237c del qemu/scripts/dump-guest-memory.py 2017-01-19 20:56:07 +08:00
xorstream 1aeaf5c40d This code should now build the x86_x64-softmmu part 2. 2017-01-19 22:50:28 +11:00
Nguyen Anh Quynh b9b82591a1 cleanup 2017-01-19 18:07:30 +08:00
Nguyen Anh Quynh 8a5b12c6f9 more cleanup in qemu/include/hw/ 2017-01-19 15:20:06 +08:00
Nguyen Anh Quynh 287e047fdb delete sparc32_dma.h & arm-semi.c 2017-01-19 15:10:41 +08:00
Nguyen Anh Quynh f4f756e6dd cleanup qemu/include/qemu/module.h 2017-01-19 15:00:25 +08:00
Nguyen Anh Quynh 7789a06d2d cleanup qemu/default-configs/ 2017-01-19 14:52:30 +08:00
Nguyen Anh Quynh 86e5d29b74 more cleanup qemu/configure 2017-01-19 14:15:00 +08:00
Nguyen Anh Quynh f2691b0107 more cleanup qemu/configure 2017-01-19 14:11:54 +08:00
Nguyen Anh Quynh 37410d02f1 cleanup qemu/configure 2017-01-19 14:02:50 +08:00
Nguyen Anh Quynh 9735c6e28e cleanup qemu/include/elf.h 2017-01-19 13:46:17 +08:00
Nguyen Anh Quynh a6fa35430a del qemu/include/qapi/opts-visitor.h 2017-01-19 13:23:48 +08:00
Nguyen Anh Quynh d836ec62fc del qemu/include/hw/irq.h 2017-01-19 13:14:15 +08:00
Nguyen Anh Quynh 0640b35943 mips: remove qemu/hw/mips/mips_int.c 2017-01-19 13:07:28 +08:00
Nguyen Anh Quynh a154b251e3 cleanup 2017-01-19 12:18:46 +08:00
Nguyen Anh Quynh 326a9a5fba cleanup qemu docs 2017-01-18 15:23:40 +08:00
Elton G 47150b6df3 reg_read and reg_write now work with registers W0 through W30 in Aarch64 (#716)
* reg_read and reg_write now work with registers W0 through W30 in Aarch64 emulaton

* Added a regress test for the ARM64 reg_read and reg_write on 32-bit registers (W0-W30)
Added a new macro in uc_priv.h (WRITE_DWORD_TO_QWORD), in order to write to the lower 32 bits of a 64 bit value without overwriting the whole value when using reg_write

* Fixed WRITE_DWORD macro

reg_write would zero out the high order bits when writing to 32 bit registers

e.g. uc.reg_write(UC_X86_REG_EAX, 0) would also set register RAX to zero
2017-01-15 20:13:35 +08:00
Nguyen Anh Quynh 7512ff57de more cleanup 2017-01-10 16:29:47 +08:00
Nguyen Anh Quynh c1f39c3db2 cleanup qemu/util code 2017-01-10 12:57:12 +08:00
Nguyen Anh Quynh af165d254c clean all qobject json code 2017-01-09 16:09:53 +08:00
Nguyen Anh Quynh 16894fdb6c cleanup some qemu/util code 2017-01-09 15:48:21 +08:00
Nguyen Anh Quynh 52cb0ba78e cleanup more synchronization code 2017-01-09 14:05:39 +08:00
Nguyen Anh Quynh d7ead1135d cleanup 2017-01-09 13:28:28 +08:00
Nguyen Anh Quynh ffa97dc2a1 cleanup qemu/configure 2017-01-08 01:35:19 +08:00
Agustin Gianni a63a34bfbc Allow the client to write to CPSR 2017-01-05 00:00:15 +01:00
Nguyen Anh Quynh 2e8fa1dbf6 glib_compat: add guint64 type 2017-01-02 01:24:54 +08:00
Nguyen Anh Quynh 3fa50fc06a macro GPOINTER_TO_UINT 2017-01-02 01:00:11 +08:00
Nguyen Anh Quynh d5f513cbfe Merge branch 'master' into noglib2 2016-12-27 22:49:59 +08:00
cojocar 428cb83060 Support for MCLASS ARM cpu (Cortex-M3) (#700)
Support for Cortex-M ARM CPU already exists in Qemu. This patch just
exposes a "cortex-m3" CPU.

"uc_open(UC_ARCH_ARM, UC_MODE_THUMB | UC_MODE_MCLASS, &uc);"
Instantiates a CPU with this feature on.

Signed-off-by: Lucian Cojocar <lucian@cojocar.com>
2016-12-27 22:49:06 +08:00