Commit graph

370 commits

Author SHA1 Message Date
Peter Maydell 22dadac875
target-arm: Implement FPEXC32_EL2 system register
The AArch64 FPEXC32_EL2 system register is visible at EL2 and EL3,
and allows those exception levels to read and write the FPEXC
register for a lower exception level that is using AArch32.

Backports commit 03fbf20f4da58f41998dc10ec7542f65d37ba759 from qemu
2018-02-18 22:52:54 -05:00
Peter Maydell f4ae64e78a
target-arm: ignore ELR_ELx[1] for exception return to 32-bit ARM mode
The architecture requires that for an exception return to AArch32 the
low bits of ELR_ELx are ignored when the PC is set from them:
* if returning to Thumb mode, ignore ELR_ELx[0]
* if returning to ARM mode, ignore ELR_ELx[1:0]

We were only squashing bit 0; also squash bit 1 if the SPSR T bit
indicates this is a return to ARM code.

Backports commit c1e0371442bf3a7e42ad53c2a3d816ed7099f81d from qemu
2018-02-18 22:50:18 -05:00
Peter Maydell 9826fc4414
target-arm: Implement remaining illegal return event checks
We already implement almost all the checks for the illegal
return events from AArch64 state described in the ARM ARM section
D1.11.2. Add the two missing ones:
* return to EL2 when EL3 is implemented and SCR_EL3.NS is 0
* return to Non-secure EL1 when EL2 is implemented and HCR_EL2.TGE is 1

(We don't implement external debug, so the case of "debug state exit
from EL0 using AArch64 state to EL0 using AArch32 state" doesn't apply
for QEMU.)

Backports commit e393f339af87da7210f6c86902b321df6a2e8bf5 from qemu
2018-02-18 22:47:23 -05:00
Peter Maydell 2ffb545ec3
target-arm: Handle exception return from AArch64 to non-EL0 AArch32
Remove the assumptions that the AArch64 exception return code was
making about a return to AArch32 always being a return to EL0.
This includes pulling out the illegal-SPSR checks so we can apply
them for return to 32 bit as well as return to 64-bit.

Backports commit 3809951bf61605974b91578c582de4da28f8ed07 from qemu
2018-02-18 22:46:50 -05:00
Peter Maydell 134eeeeacc
target-arm: Fix wrong AArch64 entry offset for EL2/EL3 target
The entry offset when taking an exception to AArch64 from a lower
exception level may be 0x400 or 0x600. 0x400 is used if the
implemented exception level immediately lower than the target level
is using AArch64, and 0x600 if it is using AArch32. We were
incorrectly implementing this as checking the exception level
that the exception was taken from. (The two can be different if
for example we take an exception from EL0 to AArch64 EL3; we should
in this case be checking EL2 if EL2 is implemented, and EL1 if
EL2 is not implemented.)

Backports commit 3d6f761713745dfed7d2ccfe98077d213a6a6eba from qemu
2018-02-18 22:43:52 -05:00
Peter Maydell d7c3ba6fa0
target-arm: Pull semihosting handling out to arm_cpu_do_interrupt()
Handling of semihosting calls should depend on the register width
of the calling code, not on that of any higher exception level,
so we need to identify and handle semihosting calls before we
decide whether to deliver the exception as an entry to AArch32
or AArch64. (EXCP_SEMIHOST is also an "internal exception" so
it has no target exception level in the first place.)

This will allow AArch32 EL1 code to use semihosting calls when
running under an AArch64 EL3.

Backports commit 904c04de2e1b425e7bc8c4ce2fae3d652eeed242 from qemu
2018-02-18 22:41:58 -05:00
Peter Maydell 4d0bdc61b6
target-arm: Use a single entry point for AArch64 and AArch32 exceptions
If EL2 or EL3 is present on an AArch64 CPU, then exceptions can be
taken to an exception level which is running AArch32 (if only EL0
and EL1 are present then EL1 must be AArch64 and all exceptions are
taken to AArch64). To support this we need to have a single
implementation of the CPU do_interrupt() method which can handle both
32 and 64 bit exception entry.

Pull the common parts of aarch64_cpu_do_interrupt() and
arm_cpu_do_interrupt() out into a new function which calls
either the AArch32 or AArch64 specific entry code once it has
worked out which one is needed.

We temporarily special-case the handling of EXCP_SEMIHOST to
avoid an assertion in arm_el_is_aa64(); the next patch will
pull all the semihosting handling out to the arm_cpu_do_interrupt()
level (since semihosting semantics depend on the register width
of the calling code, not on that of any higher EL).

Backports commit 966f758c49ff478c4757efa5970ce649161bff92 from qemu
2018-02-18 22:34:31 -05:00
Peter Maydell e1925bb5fb
target-arm: Move aarch64_cpu_do_interrupt() to helper.c
Move the aarch64_cpu_do_interrupt() function to helper.c. We want
to be able to call this from code that isn't AArch64-only, and
the move allows us to avoid awkward #ifdeffery at the callsite.

Backports commit f3a9b6945cbbb23f3a70da14e9ffdf1e60c580a8 from qemu
2018-02-18 22:23:06 -05:00
Peter Maydell c06519a2fd
target-arm: Properly support EL2 and EL3 in arm_el_is_aa64()
Support EL2 and EL3 in arm_el_is_aa64() by implementing the
logic for checking the SCR_EL3 and HCR_EL2 register-width bits
as appropriate to determine the register width of lower exception
levels.

Backports commit 446c81abf8e0572b8d5d23fe056516ac62af278d from qemu
2018-02-18 22:20:51 -05:00
Lioncash f1f3ff39eb
target-arm: Support multiple address spaces in page table walks
If we have a secure address space, use it in page table walks:
when doing the physical accesses to read descriptors, make them
through the correct address space.

(The descriptor reads are the only direct physical accesses
made in target-arm/ for CPUs which might have TrustZone.)

Backports commit 5ce4ff6502fc6ae01a30c3917996c6c41be1d176 from qemu
2018-02-18 22:18:28 -05:00
Peter Maydell d3eb5fb710
target-arm: Implement cpu_get_phys_page_attrs_debug
Implement cpu_get_phys_page_attrs_debug instead of cpu_get_phys_page_debug.

Backports commit 0faea0c7e6b729c64035b3591b184eeeeef6f1d4 from qemu
2018-02-18 22:15:50 -05:00
Peter Maydell f96988503a
target-arm: Implement asidx_from_attrs
Implement the asidx_from_attrs CPU method to return the
Secure or NonSecure address space as appropriate.

(The function is inline so we can use it directly in target-arm
code to be added in later patches.)

Backports commit 017518c1f6ed9939c7f390cb91078f0919b5494c from qemu
2018-02-18 22:11:55 -05:00
Peter Maydell c13497c369
target-arm: Add QOM property for Secure memory region
Add QOM property to the ARM CPU which boards can use to tell us what
memory region to use for secure accesses. Nonsecure accesses
go via the memory region specified with the base CPU class 'memory'
property.

By default, if no secure region is specified it is the same as the
nonsecure region, and if no nonsecure region is specified we will use
address_space_memory.

Backports commit 9e273ef2174d7cd5b14a16d8638812541d3eb6bb from qemu
2018-02-18 22:09:46 -05:00
Peter Maydell e07cd2542c
exec.c: Drop TARGET_HAS_ICE define and checks
The TARGET_HAS_ICE #define is intended to indicate whether a target-*
guest CPU implementation supports the breakpoint handling. However,
all our guest CPUs have that support (the only two which do not
define TARGET_HAS_ICE are unicore32 and openrisc, and in both those
cases the bp support is present and the lack of the #define is just
a bug). So remove the #define entirely: all new guest CPU support
should include breakpoint handling as part of the basic implementation.

Backports commit ec53b45bcd1f74f7a4c31331fa6d50b402cd6d26 from qemu
2018-02-18 18:17:14 -05:00
Peter Maydell cd5c4037ac
target-arm: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit 74c21bd07491739c6e56bcb1f962e4df730e77f3 from qemu
2018-02-17 21:09:32 -05:00
Alvise Rigo 1e3e75fa44
target-arm: Use the right MMU index in arm_regime_using_lpae_format
arm_regime_using_lpae_format checks whether the LPAE extension is used
for stage 1 translation regimes. MMU indexes not exclusively of a stage 1
regime won't work with this method.

In case of ARMMMUIdx_S12NSE0 or ARMMMUIdx_S12NSE1, offset these values
by ARMMMUIdx_S1NSE0 to get the right index indicating a stage 1
translation regime.

Rename also the function to arm_s1_regime_using_lpae_format and update
the comments to reflect the change.

Backports commit deb2db996cbb9470b39ae1e383791ef34c4eb3c2 from qemu
2018-02-17 20:56:32 -05:00
Sergey Fedorov 587c9f0570
target-arm: Fix and improve AA32 singlestep translation completion code 2018-02-17 19:34:52 -05:00
Andrew Baumann e1701b069f
target-arm: raise exception on misaligned LDREX operands
Qemu does not generally perform alignment checks. However, the ARM ARM
requires implementation of alignment exceptions for a number of cases
including LDREX, and Windows-on-ARM relies on this.

This change adds plumbing to enable alignment checks on loads using
MO_ALIGN, a do_unaligned_access hook to raise the exception (data
abort), and uses the new aligned loads in LDREX (for all but
single-byte loads).

Backports commit 30901475b91ef1f46304404ab4bfe89097f61b96 from qemu
2018-02-17 19:29:29 -05:00
Peter Maydell 386e398c56
target-arm: Don't mask out bits [47:40] in LPAE descriptors for v8
In an LPAE format descriptor in ARMv8 the address field extends
up to bit 47, not just bit 39. Correct the masking so we don't
give incorrect results if the output address size is greater
than 40 bits, as it can be for AArch64.

(Note that we don't yet support the new-in-v8 Address Size fault which
should be generated if any translation table entry or TTBR contains
an address with non-zero bits above the most significant bit of the
maximum output address size.)

Backports commit 6109769a8b42bd0c3d5b1601c9b35fe7ea6a603e from qemu
2018-02-17 18:55:32 -05:00
Sergey Fedorov 5df03a909c
target-arm: Update condexec before arch BP check in AA32 translation
Architectural breakpoint check could raise an exceptions, thus condexec
bits should be updated before calling gen_helper_check_breakpoints().

Backports commit ce8a1b5449cd8c4c2831abb581d3208c3a3745a0 from qemu
2018-02-17 18:35:50 -05:00
Sergey Fedorov b42bfc59f1
target-arm: Update condexec before CP access check in AA32 translation
Coprocessor access instructions are allowed inside IT block.
gen_helper_access_check_cp_reg() can raise an exceptions thus condexec
bits should be updated before.

Backports commit 43bfa4a100687af8d293fef0a197839b51400fca from qemu
2018-02-17 18:33:58 -05:00
Soren Brinkmann 3f4efdd95e
target-arm: Add and use symbolic names for register banks
Add BANK_<cpumode> #defines to index banked registers.

Backports commit 99a99c1fc8e9bfec1656ac5916c53977a93d3581 from qemu
2018-02-17 18:14:14 -05:00
Sergey Fedorov 23ece1622c
target-arm: Clean up DISAS_UPDATE usage in AArch32 translation code
AArch32 translation code does not distinguish between DISAS_UPDATE and
DISAS_JUMP. Thus, we cannot use any of them without first updating PC in
CPU state. Furthermore, it is too complicated to update PC in CPU state
before PC gets updated in disas context. So it is hardly possible to
correctly end TB early if is is not likely to be executed before calling
disas_*_insn(), e.g. just after calling breakpoint check helper.

Modify DISAS_UPDATE and DISAS_JUMP usage in AArch32 translation and
apply to them the same semantic as AArch64 translation does:
- DISAS_UPDATE: update PC in CPU state when finishing translation
- DISAS_JUMP: preserve current PC value in CPU state when finishing
translation

This patch fixes a bug in AArch32 breakpoint handling: when
check_breakpoints helper does not generate an exception, ending the TB
early with DISAS_UPDATE couldn't update PC in CPU state and execution
hangs.

Backports commit 577bf808958d06497928c639efaa473bf8c5e099 from qemu
2018-02-17 17:43:21 -05:00
Sergey Fedorov f8c43c69b2
target-arm: Fix gdb singlestep handling in arm_debug_excp_handler()
Do not raise a CPU exception if no CPU breakpoint has fired, since
singlestep is also done by generating a debug internal exception. This
fixes a bug with singlestepping in gdbstub.

Backports commit 5c629f4ff4dc9ae79cc732f59a8df15ede796ff7 from qemu
2018-02-17 17:32:27 -05:00
Peter Maydell 0ed5787f89
target-arm: Report S/NS status in the CPU debug logs
If this CPU supports EL3, enhance the printing of the current
CPU mode in debug logging to distinguish S from NS modes as
appropriate.

Backports commit 06e5cf7acd1f94ab7c1cd6945974a1f039672940 from qemu
2018-02-17 15:24:14 -05:00
Peter Maydell 78d26764b7
target-arm: Bring AArch64 debug CPU display of PSTATE into line with AArch32
The AArch64 debug CPU display of PSTATE as "PSTATE=200003c5 (flags --C-)"
on the end of the same line as the last of the general purpose registers
is unnecessarily different from the AArch32 display of PSR as
"PSR=200001d3 --C- A svc32" on its own line. Update the AArch64
code to put PSTATE in its own line and in the same format, including
printing the exception level (mode).

Backports commit 08b8e0f527930208a548b424d2ab3103bf3c8c02 from qemu
2018-02-17 15:24:14 -05:00
Richard Henderson c01a6dab0a
target-*: Advance pc after recognizing a breakpoint
Some targets already had this within their logic, but make sure
it's present for all targets.

Backports commit 522a0d4e3c0d397ffb45ec400d8cbd426dad9d17 from qemu
2018-02-17 15:24:11 -05:00
Richard Henderson 3ec0adcc07
target-*: Introduce and use cpu_breakpoint_test
Reduce the boilerplate required for each target. At the same time,
move the test for breakpoint after calling tcg_gen_insn_start.

Note that arm and aarch64 do not use cpu_breakpoint_test, but still
move the inline test down after tcg_gen_insn_start.

Backports commit b933066ae03d924a92b2616b4a24e7d91cd5b841 from qemu
2018-02-17 15:24:10 -05:00
Edgar E. Iglesias 942c18ead7
target-arm: Add support for S1 + S2 MMU translations
Backports commit 9b539263faa5c1b7fce2551092b5c7b6eea92081 from qemu
2018-02-17 15:24:10 -05:00
Edgar E. Iglesias 753a530ac8
target-arm: Route S2 MMU faults to EL2
Backports commit d759a457a144844bff259aafda093b24e92c116d from qemu
2018-02-17 15:24:10 -05:00
Edgar E. Iglesias f779375656
target-arm: Add S2 translation to 32bit S1 PTWs
Add support for applying S2 translation to 32bit S1
page-table walks.

Backports commit a614e69854a2e601716ee44dfe15c09b8b88f620 from qemu
2018-02-17 15:24:10 -05:00
Edgar E. Iglesias 085a94faac
target-arm: Add S2 translation to 64bit S1 PTWs
Add support for applying S2 translation to 64bit S1
page-table walks.

Backports commit 37785977627295162bff58b1f8777d94e20f4c5b from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias 716f1ac28c
target-arm: Add ARMMMUFaultInfo
Introduce ARMMMUFaultInfo to propagate MMU Fault information
across the MMU translation code path. This is in preparation for
adding Stage-2 translation.

No functional changes.

Backports commit e14b5a23d8c83304559f31397f95d22ada60a19a from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias 9156b8f3ce
target-arm: Avoid inline for get_phys_addr
Avoid inline for get_phys_addr() to prepare for future recursive use.

Backports commit af51f566ec7106d5e834476e78681a7b354f3c7c from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias 9f5af4cb22
target-arm: Add support for S2 page-table protection bits
Backports commit 6ab1a5ee1c9d328cacf78805439ed4d3d132decd from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias bf0313353e
target-arm: Add computation of starting level for S2 PTW
The starting level for S2 pagetable walks is computed
differently from the S1 starting level. Implement the S2
variant.

Backports commit 1853d5a9dcac910322c6cc5b2fddec45fd052d25 from qemu
2018-02-17 15:24:09 -05:00
Edgar E. Iglesias f63705e614
target-arm: lpae: Rename granule_sz to stride
Rename granule_sz to stride to better match the reference manuals.

No functional change.

Backports commit 973a5434825c076995218868b5b3047e5de400c6 from qemu
2018-02-17 15:24:08 -05:00
Edgar E. Iglesias 0323d25f86
target-arm: lpae: Replace tsz with computed inputsize
Remove the tsz variable and introduce inputsize.
This simplifies the code a little and makes it easier to
compare with the reference manuals.

No functional change.

Backports commit 4ca6a051758edf625a17dfc4ce4ab72edabac170 from qemu
2018-02-17 15:24:08 -05:00
Edgar E. Iglesias a33fca93b3
target-arm: Add support for AArch32 S2 negative t0sz
Add support for AArch32 S2 negative t0sz. In preparation for
using 40bit IPAs on AArch32.

Backports commit 4ee38098010240e0b390061fdd0151ff62d80279 from qemu
2018-02-17 15:24:08 -05:00
Edgar E. Iglesias 7be3cda1ea
target-arm: lpae: Move declaration of t0sz and t1sz
Move declaration of t0sz and t1sz to the top of the function
avoiding a mix of code and variable declarations.

No functional change.

Backports commit 1f4c8c18a5b6f4fad13e13b7e3828124c6c8f34d from qemu
2018-02-17 15:24:08 -05:00
Edgar E. Iglesias 0c1c636b96
target-arm: lpae: Make t0sz and t1sz signed integers
Make t0sz and t1sz signed integers to match tsz and to make
it easier to implement support for AArch32 negative t0sz.
t1sz is changed for consistensy.

No functional change.

Backports commit 5c31a10d16c595d6a59e3e7fc1808c3b1d03e02f from qemu
2018-02-17 15:24:07 -05:00
Edgar E. Iglesias 7409da7a4e
target-arm: Add HPFAR_EL2
Backports commit 59e055307392fdf99b86c8cbcd33a7e261dcbdb1 from qemu
2018-02-17 15:24:07 -05:00
Soren Brinkmann 9432e3a285
target-arm: Add support for SPSR_(ABT|UND|IRQ|FIQ)
Backports commit b876452507d0b719cff0b478efafb34ac41db683 from qemu
2018-02-17 15:24:07 -05:00
Peter Maydell 93386e2dd4
target-arm/translate.c: Handle non-executable page-straddling Thumb insns
When the memory we're trying to translate code from is not executable we have
to turn this into a guest fault. In order to report the correct PC for this
fault, and to make sure it is not reported until after any other possible
faults for instructions earlier in execution, we must terminate TBs at
the end of a page, in case the next instruction is in a non-executable page.
This is simple for T16, A32 and A64 instructions, which are always aligned
to their size. However T32 instructions may be 32-bits but only 16-aligned,
so they can straddle a page boundary.

Correct the condition that checks whether the next instruction will touch
the following page, to ensure that if we're 2 bytes before the boundary
and this insn is T32 then we end the TB.

Backports commit 541ebcd401ee47f3c1a3ce503ef5466b75e9d20a from qemu
2018-02-17 15:24:07 -05:00
Peter Maydell 91941f8d3c
target-arm: Fix "no 64-bit EL2" assumption in arm_excp_unmasked()
The code in arm_excp_unmasked() suppresses the ability of PSTATE.AIF
to mask exceptions from a lower EL targeting EL2 or EL3 if the
CPU is 64-bit. This is correct for a target of EL3, but not correct
for targeting EL2. Further, we go to some effort to calculate
scr and hcr values which are not used at all for the 64-bit CPU
case.

Rearrange the code to correctly implement the 64-bit CPU logic
and keep the hcr/scr calculations in the 32-bit CPU codepath.

Backports commit 7cd6de3bb1ca55dfa8f53fb9894803eb33f497b3 from qemu
2018-02-17 15:24:07 -05:00
Sergey Fedorov e4e0c75f0f
target-arm: Fix CPU breakpoint handling
A QEMU breakpoint match is not definitely an architectural breakpoint
match. If an exception is generated unconditionally during translation,
it is hardly possible to ignore it in the debug exception handler.

Generate a call to a helper to check CPU breakpoints and raise an
exception only if any breakpoint matches architecturally.

Backports commit 5d98bf8f38c17a348ab6e8af196088cd4953acd0 from qemu
2018-02-17 15:24:02 -05:00
Sergey Fedorov 4706e10887
target-arm: Fix GDB breakpoint handling
GDB breakpoints have higher priority so they have to be checked first.
Should GDB breakpoint match, just return from the debug exception
handler.

Backports commit e63a2d4d9ed73e33a0b7483085808048be8bbcb1 from qemu
2018-02-17 15:24:02 -05:00
Sergey Fedorov cb04e919ab
target-arm: implement arm_debug_target_el()
Implement debug exception routing according to ARM ARM D2.3.1 Pseudocode
description of routing debug exceptions.

Backports commit 81669b8b81eb450d7b89ee5fdd57bdb73d87022d from qemu
2018-02-17 15:24:02 -05:00
Sergey Fedorov 9b5cd0cec1
target-arm: Add MDCR_EL2
Add the MDCR_EL2 register. We don't implement any of
the debug-related traps this register controls yet, so
currently it simply reads back as written.

Backports commit 14cc7b54372995a6ba72c7719372e4f710fc9b5a from qemu
2018-02-17 15:24:02 -05:00
Davorin Mista cc2e6fc4e4
target-arm: Implement AArch64 OSLAR/OSLSR_EL1 sysregs
Added oslar_write function to OSLAR_EL1 sysreg, using a status variable
in ARMCPUState.cp15 struct (oslsr_el1). This variable is also linked
to the newly added read-only OSLSR_EL1 register.

Linux reads from this register during its suspend/resume procedure.

Backports commit 1424ca8d4320427c3e93722b65e19077969808a2 from qemu
2018-02-17 15:24:01 -05:00