Commit graph

5427 commits

Author SHA1 Message Date
Joseph Myers bbbf25fdd9 target/i386: fix fscale handling of invalid exponent encodings
The fscale implementation does not check for invalid encodings in the
exponent operand, thus treating them like INT_MIN (the value returned
for invalid encodings by floatx80_to_int32_round_to_zero). Fix it to
treat them similarly to signaling NaN exponents, thus generating a
quiet NaN result.

Backports commit b40eec96b26028b68c3594fbf34b6d6f029df26a from qemu
2020-06-15 13:03:54 -04:00
Joseph Myers d96c218664 target/i386: fix fscale handling of signaling NaN
The implementation of the fscale instruction returns a NaN exponent
unchanged. Fix it to return a quiet NaN when the provided exponent is
a signaling NaN.

Backports commit 0d48b436327955c69e2eb53f88aba9aa1e0dbaa0 from qemu
2020-06-15 13:03:16 -04:00
Joseph Myers 18fc17ca25 target/i386: implement special cases for fxtract
The implementation of the fxtract instruction treats all nonzero
operands as normal numbers, so yielding incorrect results for invalid
formats, infinities, NaNs and subnormal and pseudo-denormal operands.
Implement appropriate handling of all those cases.

Backports commit c415f2c58296d86e9abb7e4a133111acf7031da3 from qemu
2020-06-15 13:02:33 -04:00
Liran Alon 7373942623 i386/cpu: Store LAPIC bus frequency in CPU structure
No functional change.
This information will be used by following patches.

Backports commit 73b994f6d74ec00a1d78daf4145096ff9f0e2982 from qemu
2020-06-15 13:00:58 -04:00
Janne Grunau 6f41687234 target/i386: fix phadd* with identical destination and source register
Detected by asm test suite failures in dav1d
(https://code.videolan.org/videolan/dav1d). Can be reproduced by
`qemu-x86_64 -cpu core2duo ./tests/checkasm --test=mc_8bpc 1659890620`.

Backports commit 2dfbea1a872727fb747ca6adf2390e09956cdc6e from qemu
2020-06-15 12:59:49 -04:00
Philippe Mathieu-Daudé 34930da196 target/i386: Fix OUTL debug output
Fix OUTL instructions incorrectly displayed as OUTW.

Backports commit ce8540fde2cb535923a52a012f57b418eea85e1b from qemu
2020-06-15 12:56:33 -04:00
Richard Henderson a93d01c61d target/arm: Use a non-overlapping group for misc control
The miscellaneous control instructions are mutually exclusive
within the t32 decode sub-group.

Backports commit d6084fba47bb9aef79775c1102d4b647eb58c365 from qemu
2020-06-15 12:52:48 -04:00
Richard Henderson b45a02e2f7 decodetree: Multi-cleanup
Includes multiple changes by Richard Henderson as follows:

- Use proper varargs to print the arguments. (2fd51b19c9)
- Rename MultiPattern to IncMultiPattern (040145c4f8)
- Split out MultiPattern from IncMultiPattern (df63044d02)
- Allow group covering the entire insn space (b44b3449a0)
- Move semantic propagation into classes (08561fc128)
- Implement non-overlapping groups (067e8b0f45)
- Drop check for less than 2 patterns in a group (fe079aa13d)
2020-06-15 12:49:02 -04:00
Peter Maydell 7427cca6cc target/arm: Convert Neon one-register-and-immediate insns to decodetree
Convert the insns in the one-register-and-immediate group to decodetree.

In the new decode, our asimd_imm_const() function returns a 64-bit value
rather than a 32-bit one, which means we don't need to treat cmode=14 op=1
as a special case in the decoder (it is the only encoding where the two
halves of the 64-bit value are different).

Backports commit 2c35a39eda0b16c2ed85c94cec204bf5efb97812 from qemu
2020-06-15 12:44:54 -04:00
Peter Maydell 93e6d464c8 target/arm: Convert VCVT fixed-point ops to decodetree
Convert the VCVT fixed-point conversion operations in the
Neon 2-regs-and-shift group to decodetree.

Backports commit 3da26f11711caeaa18318b6afa14dfb81d7650ab from qemu
2020-06-15 12:40:59 -04:00
Peter Maydell a5f903b2a5 target/arm: Convert Neon VSHLL, VMOVL to decodetree
Convert the VSHLL and VMOVL insns from the 2-reg-shift group
to decodetree. Since the loop always has two passes, we unroll
it to avoid the awkward reassignment of one TCGv to another.

Backports commit 968bf842742a5ffbb0041cb31089e61a9f7a833d from qemu
2020-06-15 12:35:32 -04:00
Peter Maydell 6fc8fdaa2b target/arm: Convert Neon narrowing shifts with op==9 to decodetree
Convert the remaining Neon narrowing shifts to decodetree:
* VQSHRN
* VQRSHRN

Backports commit b4a3a77bb7a0dff1cc5673fe3be467d9e3635d44 from qemu
2020-06-15 12:31:35 -04:00
Peter Maydell ef29b91a43 target/arm: Convert Neon narrowing shifts with op==8 to decodetree
Convert the Neon narrowing shifts where op==8 to decodetree:
* VSHRN
* VRSHRN
* VQSHRUN
* VQRSHRUN

backports commit 712182d340e33c2ce86143f25fb2f04ae23d90de from qemu
2020-06-15 12:29:09 -04:00
Peter Maydell 69a3312e3a target/arm: Convert VQSHLU, VQSHL 2-reg-shift insns to decodetree
Convert the VQSHLU and QVSHL 2-reg-shift insns to decodetree.
These are the last of the simple shift-by-immediate insns.

Backports commit 37bfce81b10450071193c8495a07f182ec652e2a from qemu
2020-06-15 12:21:10 -04:00
Peter Maydell 055c96f985 target/arm: Convert Neon VSHR 2-reg-shift insns to decodetree
Convert the VSHR 2-reg-shift insns to decodetree.

Note that unlike the legacy decoder, we present the right shift
amount to the trans_ function as a positive integer.

Backports commit 66432d6b8294e3508218b360acfdf7c244eea993 from qemu
2020-06-15 12:15:29 -04:00
Peter Maydell bf18bf983d target/arm: Convert Neon VSHL and VSLI 2-reg-shift insn to decodetree
Convert the VSHL and VSLI insns from the Neon 2-registers-and-a-shift
group to decodetree.

Backports commit d3c8c736f8b4bdd02831076286b1788232f46ced from qemu
2020-06-15 12:07:02 -04:00
Richard Henderson 1d95dd1c89 target/arm: Split helper_crypto_sm3tt
Rather than passing an opcode to a helper, fully decode the
operation at translate time. Use clear_tail_16 to zap the
balance of the SVE register with the AdvSIMD write.

Backports commit 43fa36c96c24349145497adc1b451f9caf74e344 from qemu
2020-06-14 23:24:21 -04:00
Richard Henderson 5ca8caf656 target/arm: Split helper_crypto_sha1_3reg
Rather than passing an opcode to a helper, fully decode the
operation at translate time. Use clear_tail_16 to zap the
balance of the SVE register with the AdvSIMD write.

Backports commit afc8b7d32668547308bdd654a63cf5228936e0ba from qemu
2020-06-14 23:18:45 -04:00
Richard Henderson 41c4efdb22 target/arm: Convert sha1 and sha256 to gvec helpers
Do not yet convert the helpers to loop over opr_sz, but the
descriptor allows the vector tail to be cleared. Which fixes
an existing bug vs SVE.

Backports commit effa992f153f5e7ab97ab843b565690748c5b402 from qemu
2020-06-14 23:11:28 -04:00
Richard Henderson 2c6c4da80c target/arm: Convert sha512 and sm3 to gvec helpers
Do not yet convert the helpers to loop over opr_sz, but the
descriptor allows the vector tail to be cleared. Which fixes
an existing bug vs SVE.

Backports commit aaffebd6d3135b8aed7e61932af53b004d261579 from qemu
2020-06-14 23:01:49 -04:00
Richard Henderson 894f2168da target/arm: Convert rax1 to gvec helpers
With this conversion, we will be able to use the same helpers
with sve. This also fixes a bug in which we failed to clear
the high bits of the SVE register after an AdvSIMD operation.

Backports commit 1738860d7e60dec5dbeba17f8b44d31aae3accac from qemu
2020-06-14 22:49:36 -04:00
Richard Henderson 1df7314dc3 target/arm: Convert aes and sm4 to gvec helpers
With this conversion, we will be able to use the same helpers
with sve. In particular, pass 3 vector parameters for the
3-operand operations; for advsimd the destination register
is also an input.

This also fixes a bug in which we failed to clear the high bits
of the SVE register after an AdvSIMD operation.

Backports commit a04b68e1d4c4f0cd5cd7542697b1b230b84532f5 from qemu
2020-06-14 22:41:33 -04:00
Alistair Francis 2b2f91f82c target/riscv: Add the lowRISC Ibex CPU
The reset vector is set in the init function don't set it again in
realize.

Backports commit 36b80ad99f7ea4979a4c5fc6e4072619b405e3b0 from qemu
2020-06-14 22:28:55 -04:00
Alistair Francis 2584ab8ee5 target/riscv: Drop support for ISA spec version 1.09.1
The RISC-V ISA spec version 1.09.1 has been deprecated in QEMU since
4.1. It's not commonly used so let's remove support for it.

Backports commit 1a9540d1f1a9c5022d9273d0244e5809679dd33b from qemu
2020-06-14 22:23:26 -04:00
Alistair Francis e35d56a146 target/riscv: Remove the deprecated CPUs 2020-06-14 22:15:16 -04:00
Richard Henderson 0e68fa345e tcg: Improve move ops in liveness_pass_2
If the output of the move is dead, then the last use is in
the store. If we propagate the input to the store, then we
can remove the move opcode entirely.

Backports commit 61f15c487fc2aea14f6b0e52c459ae8b7d252a65 from qemu
2020-06-14 22:13:04 -04:00
Richard Henderson 6b91e9bae1 tcg/i386: Implement INDEX_op_rotl{i,s,v}_vec
For immediates, we must continue the special casing of 8-bit
elements. The other element sizes and shift types are trivially
implemented with shifts.

Backports commit 885b1706df6f0211a22e120fac910fb3abf3e733 from qemu
2020-06-14 22:09:24 -04:00
Richard Henderson cc3187b1e4 tcg: Implement gvec support for rotate by scalar
No host backend support yet, but the interfaces for rotls
are in place. Only implement left-rotate for now, as the
only known use of vector rotate by scalar is s390x, so any
right-rotate would be unused and untestable.

Backports commit 23850a74afb641102325b4b7f74071d929fc4594 from qemu
2020-06-14 22:00:50 -04:00
Richard Henderson 2aa9d13120 tcg: Remove expansion to shift by vector from do_shifts
We do not reflect this expansion in tcg_can_emit_vecop_list,
so it is unused and unusable. However, we actually perform
the same expansion in do_gvec_shifts, so it is also unneeded.

Backports commit 3d5bb2ea5cc9ed54f65a6929a6e6baa01cabd98b from qemu
2020-06-14 21:53:36 -04:00
Richard Henderson be78062fd8 tcg: Implement gvec support for rotate by vector
No host backend support yet, but the interfaces for rotlv
and rotrv are in place.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
v3: Drop the generic expansion from rot to shift; we can do better
for each backend, and then this code becomes unused.

Backports commit 5d0ceda902915e3f0e21c39d142c92c4e97c3ebb from qemu
2020-06-14 21:43:46 -04:00
Richard Henderson 5cce52a04b tcg: Implement gvec support for rotate by immediate
No host backend support yet, but the interfaces for rotli
are in place. Canonicalize immediate rotate to the left,
based on a survey of architectures, but provide both left
and right shift interfaces to the translators.

Backports commit b0f7e7444c03da17e41bf327c8aea590104a28ab from qemu
2020-06-14 21:26:58 -04:00
Laurent Vivier 50aa85e560 target/m68k: implement opcode fetoxm1
Example provided in the launchpad bug fails with:

qemu: uncaught target signal 4 (Illegal instruction) - core dumped
Illegal instruction (core dumped)

It appears fetoxm1 is not implemented:

IN: expm1f
0x800005cc: fetoxm1x %fp2,%fp0
Disassembler disagrees with translator over instruction decoding
Please report this to qemu-devel@nongnu.org

(gdb) x/2hx 0x800005cc
0x800005cc: 0xf200 0x0808

This patch adds the instruction.

Backports commit 250b1da35d579f42319af234f36207902ca4baa4 from qemu
2020-06-14 21:13:29 -04:00
Laurent Vivier aa69ab54ad target/m68k: implement fmove.l #<data>,FPCR
The immediate value mode was ignored and instruction execution
ends to an invalid access mode.

This was found running 'R' that set FPSR to 0 at startup with
a 'fmove.l #0,FPSR' in qemu-system-m68k emulation and triggers a
kernel crash:

[ 56.640000] *** ADDRESS ERROR *** FORMAT=2
[ 56.640000] Current process id is 728
[ 56.640000] BAD KERNEL TRAP: 00000000
[ 56.640000] Modules linked in: sg evdev mac_hid ip_tables x_tables sha1_generic hmac ipv6 nf_defrag_ipv6 autofs4 ext4 crc16 mbcache jbd2 crc32c_generic sd_mod t10_pi crc_t10dif crct10dif_generic crct10dif_common sr_mod cdrom mac_esp macsonic esp_scsi
[ 56.640000] PC: [<00016a2c>] X_UNSUPP+0x2c/0x3c
[ 56.640000] SR: 2004 SP: 3eb5e68c a2: c02e239a
[ 56.640000] d0: 00000040 d1: 00000002 d2: 8002adec d3: 8002ad50
[ 56.640000] d4: 8002c768 d5: 0000000d a0: ffffffc2 a1: ffffffc1
[ 56.640000] Process R (pid: 728, task=a3dfda5d)
[ 56.640000] Frame format=2 instr addr=00000000
[ 56.650000] Stack from 3a4d9f30:
[ 56.650000] 41000000 00000002 00000002 ffffffc2 ffffffc1 1fff0000 80000000 00000000
[ 56.650000] 3fbf0000 80000000 00000000 00000000 20000000 00000000 7fff0000 ffffffff
[ 56.650000] ffffffff 00000000 00050008 00000000 8000067c c02c2000 efffee20 000002d8
[ 56.650000] 00002a28 3a4d9f98 00000002 00000014 fffffffe 8002c768 00000002 00000041
[ 56.650000] 00000002 c041fc58 c0743758 ffffffff 00000000 0008c075 00002b24 00000012
[ 56.650000] 000007d0 00000024 00000002 c05bef04 c05bef04 0000005e 00000077 c28aca70
[ 56.650000] Call Trace: [<00050008>] copy_overflow+0x10/0x28
[ 56.650000] [<00002a28>] buserr+0x20/0x28
[ 56.650000] [<0008c075>] bpf_check+0x57f/0x1cfa
[ 56.650000] [<00002b24>] syscall+0x8/0xc
[ 56.650000] [<0000c019>] dn_sched_init+0x75/0x88
[ 56.650000] Code: 1017 0200 00f0 0c00 0040 66ff 0000 05ac <f23c> 8800 0000 0000 f23c 9000 0000 0000 222e ff84 082e 0005 ff1c 6600 000a 0281
[ 56.650000] Disabling lock debugging due to kernel taint
...

Backports commit 6a0e8bb4956c34328f4624e20bd3a6c2b1d90adc from qemu
2020-06-14 21:11:54 -04:00
Huacai Chen 504946fb79 target/mips: Support variable page size
Traditionally, MIPS use 4KB page size, but Loongson prefer 16KB page
size in system emulator. So, let's define TARGET_PAGE_BITS_VARY and
TARGET_PAGE_BITS_MIN to support variable page size.

Backports commit ee3863b9d414f0b4a59a88f2a79b496a99d4f6dd from qemu
2020-06-14 21:09:51 -04:00
Peter Maydell 1c6b0339e6 target/arm: Allow user-mode code to write CPSR.E via MSR
Using the MSR instruction to write to CPSR.E is deprecated, but it is
required to work from any mode including unprivileged code. We were
incorrectly forbidding usermode code from writing it because
CPSR_USER did not include the CPSR_E bit.

We use CPSR_USER in only three places:
* as the mask of what to allow userspace MSR to write to CPSR
* when deciding what bits a linux-user signal-return should be
able to write from the sigcontext structure
* in target_user_copy_regs() when we set up the initial
registers for the linux-user process

In the first two cases not being able to update CPSR.E is a bug, and
in the third case it doesn't matter because CPSR.E is always 0 there.
So we can fix both bugs by adding CPSR_E to CPSR_USER.

Because the cpsr_write() in restore_sigcontext() is now changing
a CPSR bit which is cached in hflags, we need to add an
arm_rebuild_hflags() call there; the callsite in
target_user_copy_regs() was already rebuilding hflags for other
reasons.

(The recommended way to change CPSR.E is to use the 'SETEND'
instruction, which we do correctly allow from usermode code.)

Backports commit 268b1b3dfbb92a9348406f728a33f39e3d8dcd8a from qemu
2020-06-14 21:08:03 -04:00
Richard Henderson acdd5c6065 target/arm: Use clear_vec_high more effectively
Do not explicitly store zero to the NEON high part
when we can pass !is_q to clear_vec_high.

Backports commit e1f778596ebfa8782276f4dd4651f2b285d734ff from qemu
2020-06-14 21:06:40 -04:00
Richard Henderson 3ac9b9b206 target/arm: Use tcg_gen_gvec_mov for clear_vec_high
The 8-byte store for the end a !is_q operation can be
merged with the other stores. Use a no-op vector move
to trigger the expand_clr portion of tcg_gen_gvec_mov.

Backports commit 5c27392dd08bd8534893abf25ef501f1bd8680fe from qemu
2020-06-14 21:00:57 -04:00
Richard Henderson 22004b8106 softfloat: Return bool from all classification predicates
This includes *_is_any_nan, *_is_neg, *_is_inf, etc.

Backports commit 150c7a91ce7862bcaf7422f6038dcf0ba4a7eee3 from qemu
2020-05-21 18:23:11 -04:00
Richard Henderson afd8d05aa2 softfloat: Inline floatx80 compare specializations
Replace the floatx80 compare specializations with inline functions
that call the standard floatx80_compare{,_quiet} functions.
Use bool as the return type.

Backports commit c6baf65000f826a713e8d9b5b35e617b0ca9ab5d from qemu
2020-05-21 18:17:53 -04:00
Richard Henderson 57d2419cd3 softfloat: Inline float128 compare specializations
Replace the float128 compare specializations with inline functions
that call the standard float128_compare{,_quiet} functions.
Use bool as the return type.

Backports commit b7b1ac684fea49c6bfe1ad8b706aed7b09116d15 from qemu
2020-05-21 18:15:55 -04:00
Richard Henderson 18a46c4d79 softfloat: Inline float64 compare specializations
Replace the float64 compare specializations with inline functions
that call the standard float64_compare{,_quiet} functions.
Use bool as the return type.

Backports commit 0673ecdf6cb2b1445a85283db8cbacb251c46516 from qemu
2020-05-21 18:13:44 -04:00
Richard Henderson a35333741a softfloat: Inline float32 compare specializations
Replace the float32 compare specializations with inline functions
that call the standard float32_compare{,_quiet} functions.
Use bool as the return type.

Backports commit 5da2d2d8e53d80e92a61720ea995c86b33cbf25d from qemu
2020-05-21 18:11:25 -04:00
Richard Henderson d960523cbd softfloat: Name compare relation enum
Give the previously unnamed enum a typedef name. Use it in the
prototypes of compare functions. Use it to hold the results
of the compare functions.

Backports commit 71bfd65c5fcd72f8af2735905415c7ce4220f6dc from qemu
2020-05-21 18:08:52 -04:00
Richard Henderson 8adc704058 softfloat: Name rounding mode enum
Give the previously unnamed enum a typedef name. Use the packed
attribute so that we do not affect the layout of the float_status
struct. Use it in the prototypes of relevant functions.

Adjust switch statements as necessary to avoid compiler warnings.

Backports commit 3dede407cc61b64997f0c30f6dbf4df09949abc9 from qemu
2020-05-21 18:02:05 -04:00
Richard Henderson a5c8178e35 softfloat: Change tininess_before_rounding to bool
Slightly tidies the usage within softfloat.c and the
representation in float_status.

Backports commit a828b373bdabc7e53d1e218e3fc76f85b6674688 from qemu
2020-05-21 17:52:50 -04:00
Richard Henderson a417227674 softfloat: Replace flag with bool
We have had this on the to-do list for quite some time.

Backports commit c120391c0090d9c40425c92cdb00f38ea8588ff6 from qemu
2020-05-21 17:48:12 -04:00
Richard Henderson 6530d6342f softfloat: Use post test for floatN_mul
The existing f{32,64}_addsub_post test, which checks for zero
inputs, is identical to f{32,64}_mul_fast_test. Which means
we can eliminate the fast_test/fast_op hooks in favor of
reusing the same post hook.

This means we have one fewer test along the fast path for multiply.

Backports commit b240c9c497b9880ac0ba29465907d5ebecd48083 from qemu
2020-05-21 17:24:00 -04:00
Joseph Myers c675454b27 softfloat: fix floatx80 pseudo-denormal round to integer
The softfloat function floatx80_round_to_int incorrectly handles the
case of a pseudo-denormal where only the high bit of the significand
is set, ignoring that bit (treating the number as an exact zero)
rather than treating the number as an alternative representation of
+/- 2^-16382 (which may round to +/- 1 depending on the rounding mode)
as hardware does. Fix this check (simplifying the code in the
process).

 Backports commit 9ecaf5ccec13ff2e8fe1e72f6e0f3367d2169c1c from qemu
2020-05-15 23:59:23 -04:00
Joseph Myers 3d4a7e34e1 softfloat: fix floatx80 pseudo-denormal comparisons
The softfloat floatx80 comparisons fail to allow for pseudo-denormals,
which should compare equal to corresponding values with biased
exponent 1 rather than 0. Add an adjustment for that case when
comparing numbers with the same sign.

Backports commit be53fa785ab766d2722628403edee75b3e6ab599 from qemu
2020-05-15 23:58:49 -04:00
Joseph Myers 85964d48d2 softfloat: fix floatx80 pseudo-denormal addition / subtraction
The softfloat function addFloatx80Sigs, used for addition of values
with the same sign and subtraction of values with opposite sign, fails
to handle the case where the two values both have biased exponent zero
and there is a carry resulting from adding the significands, which can
occur if one or both values are pseudo-denormals (biased exponent
zero, explicit integer bit 1). Add a check for that case, so making
the results match those seen on x86 hardware for pseudo-denormals.

Backports commit 41602807766e253ccb6fb761f3ff12767f786e2c from qemu
2020-05-15 23:56:24 -04:00
Joseph Myers 2ea23a5bbd softfloat: silence sNaN for conversions to/from floatx80
Conversions between IEEE floating-point formats should convert
signaling NaNs to quiet NaNs. Most of those in QEMU's softfloat code
do so, but those for floatx80 fail to. Fix those conversions to
silence signaling NaNs as well.

Backports commit 7537c2b4a363237534c96d089a02b0712b49d890 from qemu
2020-05-15 23:54:32 -04:00
Peter Maydell 7b2fb5bc63 target/arm: Convert NEON VFMA, VFMS 3-reg-same insns to decodetree
Convert the Neon floating point VFMA and VFMS insn to decodetree.
These are the last insns in the 3-reg-same group so we can
remove all the support/loop code from the old decoder.

Backports commit e95485f85657be21135c17a9226e297c21e73360 from qemu
2020-05-15 23:49:20 -04:00
Peter Maydell 82484db863 target/arm: Convert Neon fp VMAX/VMIN/VMAXNM/VMINNM/VRECPS/VRSQRTS to decodetree
Convert the Neon fp VMAX/VMIN/VMAXNM/VMINNM/VRECPS/VRSQRTS 3-reg-same
insns to decodetree. (These are all the remaining non-accumulation
instructions in this group.)

Backports commit d5fdf9e9e1c6f2bbb0a4bcaafd85d344cce9c298 from qemu
2020-05-15 23:44:52 -04:00
Peter Maydell a593866af6 target/arm: Move 'env' argument of recps_f32 and rsqrts_f32 helpers to usual place
The usual location for the env argument in the argument list of a TCG helper
is immediately after the return-value argument. recps_f32 and rsqrts_f32
differ in that they put it at the end.

Move the env argument to its usual place; this will allow us to
more easily use these helper functions with the gvec APIs.

Backports commit 26c6f695cfd2a3ccddb4d015a25b56f56aa62928 from qemu
2020-05-15 23:41:37 -04:00
Peter Maydell 05e72483f4 target/arm: Convert Neon 3-reg-same compare insns to decodetree
Convert the Neon integer 3-reg-same compare insns VCGE, VCGT,
VCEQ, VACGE and VACGT to decodetree.

Backports commit 727ff1d63213e6666e511956903b9e97a339ec7e from qemu
2020-05-15 23:37:53 -04:00
Peter Maydell 042df686ca target/arm: Convert Neon fp VMUL, VMLA, VMLS 3-reg-same insns to decodetree
Convert the Neon integer VMUL, VMLA, and VMLS 3-reg-same inssn to
decodetree.

We don't have a gvec helper for multiply-accumulate, so VMLA and VMLS
need a loop function do_3same_fp(). This takes a reads_vd parameter
to do_3same_fp() which tells it to load the old value into vd before
calling the callback function, in the same way that the do_vfp_3op_sp()
and do_vfp_3op_dp() functions in translate-vfp.inc.c work. (The
only uses in this patch pass reads_vd == true, but later commits
will use reads_vd == false.)

This conversion fixes in passing an underdecoding for VMUL

Backports commit 8aa71ead912ca0a9c0d29b74e0976f91952f950a from qemu
2020-05-15 23:35:21 -04:00
Peter Maydell 2527e76926 target/arm: Convert Neon VPMIN/VPMAX/VPADD float 3-reg-same insns to decodetree
Convert the Neon float VPMIN, VPMAX and VPADD 3-reg-same insns to
decodetree. These are the only remaining 'pairwise' operations,
so we can delete the pairwise-specific bits of the old decoder's
for-each-element loop now.

Backports commit ab978335a56e3618212868fdce3a54217c6e71e6 from qemu
2020-05-15 23:31:15 -04:00
Peter Maydell bb0aa79847 target/arm: Convert Neon VADD, VSUB, VABD 3-reg-same insns to decodetree
Convert the Neon VADD, VSUB, VABD 3-reg-same insns to decodetree.
We already have gvec helpers for addition and subtraction, but must
add one for fabd.

Backports commit a26a352bb498662cd0c205cb433a352f86fac7d2 from qemu
2020-05-15 23:26:51 -04:00
Peter Maydell 1df5d57e8a target/arm: Convert Neon VQDMULH/VQRDMULH 3-reg-same to decodetree
Convert the Neon VQDMULH and VQRDMULH 3-reg-same insns to
decodetree. These are the last integer operations in the
3-reg-same group.

Backports commit 7ecc28bc72b8033cf4e0c6332135ec20d4125dfb from qemu
2020-05-15 23:06:44 -04:00
Peter Maydell 59818edb3c target/arm: Convert Neon VPADD 3-reg-same insns to decodetree
Convert the Neon integer VPADD 3-reg-same insns to decodetree. These
are 'pairwise' operations. (Note that VQRDMLAH, which shares the
same primary opcode but has U=1, has already been converted.)

Backports commit fa22827d4eb078b6c58cd3d19af0b50ed951e832 from qemu
2020-05-15 23:01:25 -04:00
Peter Maydell 1cc6451cb6 target/arm: Convert Neon VPMAX/VPMIN 3-reg-same insns to decodetree
Convert the Neon integer VPMAX and VPMIN 3-reg-same insns to
decodetree. These are 'pairwise' operations.

Backports commit 059c2398a2b1ae86c6722c45e79fb0d0f4d95b1d from qemu
2020-05-15 22:59:10 -04:00
Peter Maydell f35ae14ab4 target/arm: Convert Neon VQSHL, VRSHL, VQRSHL 3-reg-same insns to decodetree
Convert the VQSHL, VRSHL and VQRSHL insns in the 3-reg-same
group to decodetree. We have already implemented the size==0b11
case of these insns; this commit handles the remaining sizes

Backports commit 6812dfdc6b0286730d6f903ebfbdc4f81b80c29b from qemu
2020-05-15 22:53:27 -04:00
Peter Maydell 5308fb324e target/arm: Convert Neon VRHADD, VHSUB 3-reg-same insns to decodetree
Convert the Neon VRHADD and VHSUB 3-reg-same insns to decodetree.
(These are all the other insns in 3-reg-same which were using
GEN_NEON_INTEGER_OP() and which are not pairwise or
reversed-operands.)

Backports commit 8e44d03f4b5590e19a4f7910ca1c327609933dd7 from qemu
2020-05-15 22:50:02 -04:00
Peter Maydell ec327c7fc8 target/arm: Convert Neon VABA/VABD 3-reg-same to decodetree
Convert the Neon VABA and VABD insns in the 3-reg-same group to
decodetree.

Backports commit 7715098f93ff5205334edf161e5fe156346122b0 from qemu
2020-05-15 22:46:02 -04:00
Peter Maydell f1028fe4a7 target/arm: Convert Neon VHADD 3-reg-same insns
Convert the Neon VHADD insns in the 3-reg-same group to decodetree.

Backports commit cb294bca866f1cd776e44e03e5e432942bc676e8 from qemu
2020-05-15 22:43:01 -04:00
Peter Maydell 4098e0b80a target/arm: Convert Neon 64-bit element 3-reg-same insns
Convert the 64-bit element insns in the 3-reg-same group
to decodetree. This covers VQSHL, VRSHL and VQRSHL where
size==0b11.

Backports commit 35d4352fa9e94b35bf17f58181cb16c184b98d56 from qemu
2020-05-15 22:40:48 -04:00
Peter Maydell e2b703a82c target/arm: Convert Neon 3-reg-same SHA to decodetree
Convert the Neon SHA instructions in the 3-reg-same group
to decodetree

Backports commit 21290edfc29d8929741c0ed043733c23c69bc3b9 from qemu
2020-05-15 22:34:40 -04:00
Richard Henderson 1740e018f4 target/arm: Convert Neon 3-reg-same VQRDMLAH/VQRDMLSH to decodetree
Convert the Neon VQRDMLAH and VQRDMLSH insns in the 3-reg-same group
to decodetree. These don't use do_3same() because they want to
operate on VFP double registers, whose offsets are different from the
neon_reg_offset() calculations do_3same does.

Backports commit a063569508af8295cf6271e06700e5b956bb402d from qemu
2020-05-15 22:20:23 -04:00
Richard Henderson 451683ee79 target/arm: Vectorize SABA/UABA
Include 64-bit element size in preparation for SVE2.

Backports commit cfdb2c0c95ae9205b0dd7f0f5e970cdec50fef20 from qemu
2020-05-15 22:15:14 -04:00
Richard Henderson 98c79f9afc target/arm: Vectorize SABD/UABD
Include 64-bit element size in preparation for SVE2.

Backports commit 50c160d44eb059c7fc7f348ae2c3b0cb41437044 from qemu
2020-05-15 22:01:29 -04:00
Richard Henderson 765dbb57f0 target/arm: Clear tail in gvec_fmul_idx_*, gvec_fmla_idx_*
Must clear the tail for AdvSIMD when SVE is enabled.

Fixes: ca40a6e6e39

Backports commit 525d9b6d42844e187211d25b69be8b378785bc24 from qemu
2020-05-15 21:50:30 -04:00
Richard Henderson 73d08253a2 target/arm: Pass pointer to qc to qrdmla/qrdmls
Pass a pointer directly to env->vfp.qc[0], rather than env.
This will allow SVE2, which does not modify QC, to pass a
pointer to dummy storage.

Change the return type of inl_qrdml.h_s16 to match the
sense of the operation: signed.

Backports commit e286bf4a72fe3a60490b8d6e3f28d6335677e08c from qemu
2020-05-15 21:48:35 -04:00
Richard Henderson 3c4f226e00 target/arm: Create gen_gvec_{qrdmla,qrdmls}
Provide a functional interface for the vector expansion.
This fits better with the existing set of helpers that
we provide for other operations.

Backports commit 146aa66ce58b686b8037d0eb3921c1125942dbde from qemu
2020-05-15 21:43:22 -04:00
Richard Henderson efdcad70b1 target/arm: Remove fp_status from helper_{recpe, rsqrte}_u32
These operations do not touch fp_status.

Backports commit fe6fb4beb2f9bb0afc813e565504b66a92bbf04b from qemu
2020-05-15 21:32:03 -04:00
Richard Henderson 9dfc0479ff target/arm: Create gen_gvec_{uqadd, sqadd, uqsub, sqsub}
Provide a functional interface for the vector expansion.
This fits better with the existing set of helpers that
we provide for other operations.

Backports commit c7715b6b51a6f7a5412c5fcb40a4c8586105e597 from qemu
2020-05-15 21:25:06 -04:00
Richard Henderson 4abfe5156d target/arm: Create gen_gvec_{cmtst,ushl,sshl}
Provide a functional interface for the vector expansion.
This fits better with the existing set of helpers that
we provide for other operations.

Backports commit 8161b75357095fef54c76b1a6ed1e54d0e8655e0 from qemu
2020-05-15 21:15:49 -04:00
Richard Henderson 15b2850f4d target/arm: Swap argument order for VSHL during decode
Rather than perform the argument swap during code generation,
perform it during decode. This means it doesn't have to be
special cased later, and we can share code with aarch64 code
generation. Hopefully the decode comment addresses any confusion
that might arise in between.

Backports commit e9eee5316ffec5f37643de806b2e5577c5c189cf from qemu
2020-05-15 21:07:59 -04:00
Richard Henderson 546db9089c target/arm: Create gen_gvec_{mla,mls}
Provide a functional interface for the vector expansion.
This fits better with the existing set of helpers that
we provide for other operations.

Backports commit 271063206a46062a45fc6bab8dabe45f0b88159d from qemu
2020-05-15 21:06:06 -04:00
Richard Henderson 340f97bf4c target/arm: Create gen_gvec_{ceq,clt,cle,cgt,cge}0
Provide a functional interface for the vector expansion.
This fits better with the existing set of helpers that
we provide for other operations.

Macro-ize the 5 nearly identical comparisons.

Backports commit 69d5e2bf8c3cefedbfa1c1670137e636dbd7faa5 from qemu
2020-05-15 20:57:33 -04:00
Richard Henderson e08c2b8ece target/arm: Tidy handle_vec_simd_shri
Now that we've converted all cases to gvec, there is quite a bit
of dead code at the end of the function. Remove it.

Sink the call to gen_gvec_fn2i to the end, loading a function
pointer within the switch statement.

Backports commit 3f08f0bce841e7857ec98ce7909629d0c335005e from qemu
2020-05-15 20:47:47 -04:00
Richard Henderson 7a1750d691 target/arm: Remove unnecessary range check for VSHL
In 1dc8425e551, while converting to gvec, I added an extra range check
against the shift count. This was unnecessary because the encoding of
the shift count produces 0 to the element size - 1.

Backports commit 2f27c5244db300387f15d9ffa5067a204ffd625d from qemu
2020-05-15 20:42:12 -04:00
Richard Henderson 6190be3191 target/arm: Create gen_gvec_{sri,sli}
The functions eliminate duplication of the special cases for
this operation. They match up with the GVecGen2iFn typedef.

Add out-of-line helpers. We got away with only having inline
expanders because the neon vector size is only 16 bytes, and
we know that the inline expansion will always succeed.
When we reuse this for SVE, tcg-gvec-op may decide to use an
out-of-line helper due to longer vector lengths.

Backports commit 893ab0542aa385a287cbe46d5535c8b9e95ce699 from qemu
2020-05-15 20:39:28 -04:00
Richard Henderson 2609e6f319 target/arm: Create gen_gvec_{u,s}{rshr,rsra}
Create vectorized versions of handle_shri_with_rndacc
for shift+round and shift+round+accumulate. Add out-of-line
helpers in preparation for longer vector lengths from SVE.

Backports commit 6ccd48d4ea244c1c46a24dfa50bfb547f11422dd from qemu
2020-05-15 20:28:44 -04:00
Richard Henderson 5d7c46204d target/arm: Create gen_gvec_[us]sra
The functions eliminate duplication of the special cases for
this operation. They match up with the GVecGen2iFn typedef.

Add out-of-line helpers. We got away with only having inline
expanders because the neon vector size is only 16 bytes, and
we know that the inline expansion will always succeed.
When we reuse this for SVE, tcg-gvec-op may decide to use an
out-of-line helper due to longer vector lengths.

Backports commit 631e565450c483e0622eec3d8b61d7fa41d16bca from qemu
2020-05-15 20:10:32 -04:00
Richard Henderson 4be4ca57b1 target/arm: Fix tcg_gen_gvec_dup_imm vs DUP (indexed)
DUP (indexed) can duplicate 128-bit elements, so using esz
unconditionally can assert in tcg_gen_gvec_dup_imm.

Fixes: 8711e71f9cbb

Backports commit 7e17d50ebd359ee5fa3d65d7fdc0fe0336d60694 from qemu
2020-05-11 17:22:52 -04:00
Lioncash 5c03efd5d6 arm/helper: Amend sign conversion warning 2020-05-11 17:21:25 -04:00
Lioncash 08cc2c6dcc arm/cpu64: Remove unused variable 2020-05-11 17:18:13 -04:00
Richard Henderson f93deb0786 target/arm: Use tcg_gen_gvec_5_ptr for sve FMLA/FCMLA
Now that we can pass 7 parameters, do not encode register
operands within simd_data.

Backports commit 08975da9f0bfcfa654628cae71201a351ba5449a from qemu
2020-05-11 17:17:17 -04:00
Thomas Huth dfe548117e target/arm: Make set_feature() available for other files
Move the common set_feature() and unset_feature() functions
from cpu.c and cpu64.c to cpu.h.

Backports commit 5fda95041d7237ab35733ceb66e0cb89f6107169 from qemu
2020-05-11 17:02:21 -04:00
Philippe Mathieu-Daudé cfe94f63f3 target/arm/cpu: Use ARRAY_SIZE() to iterate over ARMCPUInfo[]
Since on the aarch64-linux-user build, arm_cpus[] is empty, add
the cpu_count variable and only iterate when it is non-zero.

Backports commit 92b6a659388ab3735e5fbb17ac486923b681f57f from qemu
2020-05-11 16:59:54 -04:00
Richard Henderson 4016b667f3 accel/tcg: Add block comment for probe_access
Backports commit 857129b34190a4c2e782006dc255352a6cd3934b from qemu
2020-05-11 16:42:10 -04:00
Edgar E. Iglesias 91dbd53f77 target/arm: Drop access_el3_aa32ns_aa64any()
Calling access_el3_aa32ns() works for AArch32 only cores
but it does not handle 32-bit EL2 on top of 64-bit EL3
for mixed 32/64-bit cores.

Merge access_el3_aa32ns_aa64any() into access_el3_aa32ns()
and only use the latter.

Fixes: 68e9c2fe65 ("target-arm: Add VTCR_EL2")

Backports commit 93dd1e6140e2652347cfe7208591d4cd32762d08 from qemu
2020-05-11 16:39:40 -04:00
MerryMage 9255fbce96 target/arm: Introduce add_reg_for_lit (fixup)
Backports commit 16e0d8234ef9291747332d2c431e46808a060472 from qemu

Missed from original backporting commit a2e60445de
2020-05-10 12:30:52 +01:00
Richard Henderson 742301a7c1 tcg: Fix integral argument type to tcg_gen_rot[rl]i_i{32,64}
For the benefit of compatibility of function pointer types,
we have standardized on int32_t and int64_t as the integral
argument to tcg expanders.

We converted most of them in 474b2e8f0f7, but missed the rotates.

Backports commit 07dada0336a83002dfa8673a9220a88e13d9a45c from qemu
2020-05-07 10:41:01 -04:00
Richard Henderson 0bcd0ca93d tcg: Add load_dest parameter to GVecGen2
We have this same parameter for GVecGen2i, GVecGen3,
and GVecGen3i. This will make some SVE2 insns easier
to parameterize.

Backports commit ac09ae627e9a2c65c8a452b69c3dac33c29d0719 from qemu
2020-05-07 10:35:47 -04:00
Richard Henderson f02f71f38f tcg: Improve vector tail clearing
Better handling of non-power-of-2 tails as seen with Arm 8-byte
vector operations.

Backports commit f47db80cc073c0a7a22136c8296b5eca20c0e199 from qemu
2020-05-07 10:24:00 -04:00
Richard Henderson 549b0ec3c5 tcg: Add tcg_gen_gvec_dup_tl
For use when a target needs to pass a configure-specific
target_ulong value to duplicate.

Backports commit 0f039e3ad9131966d9fe509c231b756868b015e2 from qemu
2020-05-07 10:12:09 -04:00
Richard Henderson e65806c356 tcg: Remove tcg_gen_gvec_dup{8,16,32,64}i
These interfaces are now unused.

Backports commit 398f21412aeec158338963e3f71c9313bc126a71 form qemu
2020-05-07 10:11:00 -04:00
Richard Henderson 43a72b0540 tcg: Use tcg_gen_gvec_dup_imm in logical simplifications
Replace the outgoing interface.

Backports commit 03ddb6f315ca6d02dfdba0aecc43aa97c728c428 from qemu
2020-05-07 10:09:53 -04:00
Richard Henderson b0f6374149 target/arm: Use tcg_gen_gvec_dup_imm
In a few cases, we're able to remove some manual replication.

Backports commit 8711e71f9cbb692d614e6ecf5d51222372f7b77e from qemu
2020-05-07 10:05:49 -04:00
Richard Henderson 07f622e57d tcg: Add tcg_gen_gvec_dup_imm
Add a version of tcg_gen_dup_* that takes both immediate and
a vector element size operand. This will replace the set of
tcg_gen_gvec_dup{8,16,32,64}i functions that encode the element
size within the function name.

Backports commit 44c94677febd15488f9190b11eaa4a08e8ac696b from qemu
2020-05-07 09:55:25 -04:00
Peter Maydell d350125eab target/arm: Move gen_ function typedefs to translate.h
We're going to want at least some of the NeonGen* typedefs
for the refactored 32-bit Neon decoder, so move them all
to translate.h since it makes more sense to keep them in
one group.

Backports commit 9aefc6cf9b73f66062d2f914a0136756e7a28211 from qemu
2020-05-07 09:51:52 -04:00
Peter Maydell 652165d671 target/arm: Convert Neon 3-reg-same VMUL, VMLA, VMLS, VSHL to decodetree
Convert the Neon VMUL, VMLA, VMLS and VSHL insns in the
3-reg-same grouping to decodetree.

Backports commit 0de34fd48ad4e44bf5caa2330657ebefa93cea7d from qemu
2020-05-07 09:50:44 -04:00
Peter Maydell 17bd8930fc target/arm: Convert Neon 3-reg-same VQADD/VQSUB to decodetree
Convert the Neon VQADD/VQSUB insns in the 3-reg-same grouping
to decodetree.

Backports commit 7a9497f1cf73667a4744d09673b808c20e067915 from qemu
2020-05-07 09:47:18 -04:00
Peter Maydell d52b830ce3 target/arm: Convert Neon 3-reg-same comparisons to decodetree
Convert the Neon comparison ops in the 3-reg-same grouping
to decodetree.

Backports commit 02bd0cdb64b3e79419ba3a8746cb86430883b3ae from qemu
2020-05-07 09:45:03 -04:00
Peter Maydell c6f9fb54fd target/arm: Convert Neon 3-reg-same VMAX/VMIN to decodetree
Convert the Neon 3-reg-same VMAX and VMIN insns to decodetree.

Backports commit 36b59310c38d45213bf860affa90618aa5eeca93 from qemu
2020-05-07 09:42:04 -04:00
Peter Maydell d30f99ca79 target/arm: Convert Neon 3-reg-same logic ops to decodetree
Convert the Neon logic ops in the 3-reg-same grouping to decodetree.
Note that for the logic ops the 'size' field forms part of their
decode and the actual operations are always bitwise.

Backports commit 35a548edb6f5043386183b9f6b4139d99d1f130a from qemu
2020-05-07 09:40:10 -04:00
Peter Maydell eae3ce9899 target/arm: Convert Neon 3-reg-same VADD/VSUB to decodetree
Convert the Neon 3-reg-same VADD and VSUB insns to decodetree.

Note that we don't need the neon_3r_sizes[op] check here because all
size values are OK for VADD and VSUB; we'll add this when we convert
the first insn that has size restrictions.

For this we need one of the GVecGen*Fn typedefs currently in
translate-a64.h; move them all to translate.h as a block so they
are visible to the 32-bit decoder.

Backports commit a4e143ac5b9185f670d2f17ee9cc1a430047cb65 from qemu
2020-05-07 09:36:28 -04:00
Peter Maydell c7a31355fc target/arm: Convert Neon 'load/store single structure' to decodetree
Convert the Neon "load/store single structure to one lane" insns to
decodetree.

As this is the last set of insns in the neon load/store group,
we can remove the whole disas_neon_ls_insn() function.

Backports commit 123ce4e3daba26b760b472687e1fb1ad82cf1993 from qemu
2020-05-07 09:32:17 -04:00
Peter Maydell 302506f2f6 target/arm: Convert Neon 'load single structure to all lanes' to decodetree
Convert the Neon "load single structure to all lanes" insns to
decodetree.

Backports commit 3698747c48db871d876a398592c5a23d7580ed4a from qemu
2020-05-07 09:29:03 -04:00
Peter Maydell 7aad825fa6 target/arm: Convert Neon load/store multiple structures to decodetree
Convert the Neon "load/store multiple structures" insns to decodetree.

Backports commit a27b46304352a0eced45e560e96515dbe3cc174f from qemu
2020-05-07 09:25:51 -04:00
Peter Maydell 9814c1722f target/arm: Convert VFM[AS]L (scalar) to decodetree
Convert the VFM[AS]L (scalar) insns in the 2reg-scalar-ext group
to decodetree. These are the last ones in the group so we can remove
all the legacy decode for the group.

Note that in disas_thumb2_insn() the parts of this encoding space
where the decodetree decoder returns false will correctly be directed
to illegal_op by the "(insn & (1 << 28))" check so they won't fall
into disas_coproc_insn() by mistake.

Backports commit d27e82f7d02f35e5919bd9cbbcb157f3537069a0 from qemu
2020-05-07 09:20:35 -04:00
Peter Maydell 49cdb7e2db target/arm: Convert V[US]DOT (scalar) to decodetree
Convert the V[US]DOT (scalar) insns in the 2reg-scalar-ext group
to decodetree.

Backports commit 35f5d4d1747558c6af2d914bcd848dcc30c3b531 from qemu
2020-05-07 09:17:32 -04:00
Peter Maydell 73dbfbe4d7 target/arm: Convert VCMLA (scalar) to decodetree
Convert VCMLA (scalar) in the 2reg-scalar-ext group to decodetree.

Backports commit 7e1b5d615361bb0038cda0e08af41e350e42d081 from qemu
2020-05-07 09:15:30 -04:00
Peter Maydell 1ab06d3eb5 target/arm: Convert VFM[AS]L (vector) to decodetree
Convert the VFM[AS]L (vector) insns to decodetree. This is the last
insn in the legacy decoder for the 3same_ext group, so we can
delete the legacy decoder function for the group entirely.

Note that in disas_thumb2_insn() the parts of this encoding space
where the decodetree decoder returns false will correctly be directed
to illegal_op by the "(insn & (1 << 28))" check so they won't fall
into disas_coproc_insn() by mistake.

Backports commit 9a107e7b8a3c87ab63ec830d3d60f319fc577ff7 from qemu
2020-05-07 09:13:36 -04:00
Peter Maydell c06bdf4cc2 target/arm: Convert V[US]DOT (vector) to decodetree
Convert the V[US]DOT (vector) insns to decodetree.

Backports commit 32da0e330d3e5218b669079826496751fb52c1ca from qemu
2020-05-07 09:09:24 -04:00
Peter Maydell 1d4dba1e5a target/arm: Convert VCADD (vector) to decodetree
Convert the VCADD (vector) insns to decodetree.

Backports commit 94d5eb7b3f72fbbdee55d7908e9cb6de95949f4b from qemu
2020-05-07 09:05:55 -04:00
Peter Maydell d8287755b2 target/arm: Convert VCMLA (vector) to decodetree
Convert the VCMLA (vector) insns in the 3same extension group to
decodetree.

Backports commit afff8de0d4d55b4ce7c36eb9cdfafe477a35dd75 from qemu
2020-05-07 09:02:52 -04:00
Peter Maydell c2c628eb71 target/arm: Add stubs for AArch32 Neon decodetree
Add the infrastructure for building and invoking a decodetree decoder
for the AArch32 Neon encodings. At the moment the new decoder covers
nothing, so we always fall back to the existing hand-written decode.

We follow the same pattern we did for the VFP decodetree conversion
(commit 78e138bc1f672c145ef6ace74617d and following): code that deals
with Neon will be moving gradually out to translate-neon.vfp.inc,
which we #include into translate.c.

In order to share the decode files between A32 and T32, we
split Neon into 3 parts:
* data-processing
* load-store
* 'shared' encodings

The first two groups of instructions have similar but not identical
A32 and T32 encodings, so we need to manually transform the T32
encoding into the A32 one before calling the decoder; the third group
covers the Neon instructions which are identical in A32 and T32.

Backports commit 625e3dd44a15dfbe9532daa6454df3f86cf04d3e from qemu
2020-05-07 08:59:42 -04:00
Peter Maydell 518d18062f target/arm: Don't allow Thumb Neon insns without FEATURE_NEON
We were accidentally permitting decode of Thumb Neon insns even if
the CPU didn't have the FEATURE_NEON bit set, because the feature
check was being done before the call to disas_neon_data_insn() and
disas_neon_ls_insn() in the Arm decoder but was omitted from the
Thumb decoder. Push the feature bit check down into the called
functions so it is done for both Arm and Thumb encodings.

Backports commit d1a6d3b594157425232a1ae5ea7f51b7a1c1aa2e from qemu
2020-05-07 08:55:02 -04:00
Peter Maydell 1964e4b9c9 target/arm/translate-vfp.inc.c: Remove duplicate simd_r32 check
Somewhere along theline we accidentally added a duplicate
"using D16-D31 when they don't exist" check to do_vfm_dp()
(probably an artifact of a patchseries rebase). Remove it.

Backports commit 0d787cf1f3c88fa29477e054f8523f6d82d91c98 from qemu
2020-05-07 08:52:42 -04:00
Philippe Mathieu-Daudé 8f90b77a6d target/arm: Use uint64_t for midr field in CPU state struct
MIDR_EL1 is a 64-bit system register with the top 32-bit being RES0.
Represent it in QEMU's ARMCPU struct with a uint64_t, not a
uint32_t.

This fixes an error when compiling with -Werror=conversion
because we were manipulating the register value using a
local uint64_t variable:

target/arm/cpu64.c: In function ‘aarch64_max_initfn’:
target/arm/cpu64.c:628:21: error: conversion from ‘uint64_t’ {aka ‘long unsigned int’} to ‘uint32_t’ {aka ‘unsigned int’} may change value [-Werror=conversion]
628 | cpu->midr = t;
| ^

and future-proofs us against a possible future architecture
change using some of the top 32 bits.

Backports commit e544f80030121040c8932ff1bd4006f390266c0f from qemu
2020-05-07 08:51:28 -04:00
Peter Maydell d28059f4ea target/arm: Use correct variable for setting 'max' cpu's ID_AA64DFR0
In aarch64_max_initfn() we update both 32-bit and 64-bit ID
registers. The intended pattern is that for 64-bit ID registers we
use FIELD_DP64 and the uint64_t 't' register, while 32-bit ID
registers use FIELD_DP32 and the uint32_t 'u' register. For
ID_AA64DFR0 we accidentally used 'u', meaning that the top 32 bits of
this 64-bit ID register would end up always zero. Luckily at the
moment that's what they should be anyway, so this bug has no visible
effects.

Use the right-sized variable.

Backports commit 5a89dd2385a193aa954a7c9bf4e381f2ba6ae359 from qemu
2020-05-07 08:50:40 -04:00
Peter Maydell b427549ce4 target/arm: Implement ARMv8.2-TTS2UXN
The ARMv8.2-TTS2UXN feature extends the XN field in stage 2
translation table descriptors from just bit [54] to bits [54:53],
allowing stage 2 to control execution permissions separately for EL0
and EL1. Implement the new semantics of the XN field and enable
the feature for our 'max' CPU.

Backports commit ce3125bed935a12e619a8253c19340ecaa899347 from qemu
2020-05-07 08:49:18 -04:00
Peter Maydell 1e75276a89 target/arm: Add new 's1_is_el0' argument to get_phys_addr_lpae()
For ARMv8.2-TTS2UXN, the stage 2 page table walk wants to know
whether the stage 1 access is for EL0 or not, because whether
exec permission is given can depend on whether this is an EL0
or EL1 access. Add a new argument to get_phys_addr_lpae() so
the call sites can pass this information in.

Since get_phys_addr_lpae() doesn't already have a doc comment,
add one so we have a place to put the documentation of the
semantics of the new s1_is_el0 argument.

Backports commit ff7de2fc2c994030bfb83af9ddc9a3cd70ce3e88 from qemu
2020-05-07 08:45:23 -04:00
Peter Maydell bec9ee21b6 target/arm: Use enum constant in get_phys_addr_lpae() call
The access_type argument to get_phys_addr_lpae() is an MMUAccessType;
use the enum constant MMU_DATA_LOAD rather than a literal 0 when we
call it in S1_ptw_translate().

Backports commit 59dff859cd850876df2cfa561c7bcfc4bdda4599 from qemu
2020-05-07 08:42:41 -04:00
Peter Maydell 3df93e463d target/arm: Don't use a TLB for ARMMMUIdx_Stage2
We define ARMMMUIdx_Stage2 as being an MMU index which uses a QEMU
TLB. However we never actually use the TLB -- all stage 2 lookups
are done by direct calls to get_phys_addr_lpae() followed by a
physical address load via address_space_ld*().

Remove Stage2 from the list of ARM MMU indexes which correspond to
real core MMU indexes, and instead put it in the set of "NOTLB" ARM
MMU indexes.

This allows us to drop NB_MMU_MODES to 11. It also means we can
safely add support for the ARMv8.3-TTS2UXN extension, which adds
permission bits to the stage 2 descriptors which define execute
permission separatel for EL0 and EL1; supporting that while keeping
Stage2 in a QEMU TLB would require us to use separate TLBs for
"Stage2 for an EL0 access" and "Stage2 for an EL1 access", which is a
lot of extra complication given we aren't even using the QEMU TLB.

In the process of updating the comment on our MMU index use,
fix a couple of other minor errors:
* NS EL2 EL2&0 was missing from the list in the comment
* some text hadn't been updated from when we bumped NB_MMU_MODES
above 8

Backports commit bf05340cb655637451162c02dadcd6581a05c02c from qemu
2020-05-07 08:40:06 -04:00
Fredrik Strupe 65200d8aad target/arm: Make VQDMULL undefined when U=1
According to Arm ARM, VQDMULL is only valid when U=0, while having
U=1 is unallocated.

Backports commit ab553ef74ee52c0889679d0bd0da084aaf938f5c from qemu
2020-05-07 08:34:56 -04:00
Philippe Mathieu-Daudé 12cad29510 target/arm/cpu: Update coding style to make checkpatch.pl happy
We will move this code in the next commit. Clean it up
first to avoid checkpatch.pl errors.

Backports commit 51c510aa5876a681cd0059ed3bacaa17590dc2d5 from qemu
2020-04-30 21:40:07 -04:00
Thomas Huth 84f2729a29 target/arm: Make cpu_register() available for other files
Make cpu_register() (renamed to arm_cpu_register()) available
from internals.h so we can register CPUs also from other files
in the future.

Backports commit 37bcf244454f4efb82e2c0c64bbd7eabcc165a0c from qemu
2020-04-30 21:38:42 -04:00
Philippe Mathieu-Daudé afeb8ff2dc target/arm: Restrict the Address Translate write operation to TCG accel
Under KVM these registers are written by the hardware.
Restrict the writefn handlers to TCG to avoid when building
without TCG:

LINK aarch64-softmmu/qemu-system-aarch64
target/arm/helper.o: In function `do_ats_write':
target/arm/helper.c:3524: undefined reference to `raise_exception'

Backports commit 9fb005b02dbda7f47b789b7f19bf5f73622a4756 from qemu
2020-04-30 21:31:22 -04:00
Richard Henderson b26b4c06cd target/arm: Vectorize integer comparison vs zero
These instructions are often used in glibc's string routines.
They were the final uses of the 32-bit at a time neon helpers.

Backports commit 6b375d3546b009d1e63e07397ec9c6af256e15e9 from qemu
2020-04-30 21:29:17 -04:00
Corey Wharton bc097bd2ae target/riscv: Add a sifive-e34 cpu type
The sifive-e34 cpu type is the same as the sifive-e31 with the
single precision floating-point extension enabled.

Backports commit d784733bf1875c1ba355c69739518f24d56f1260 from qemu
2020-04-30 21:08:10 -04:00
Alistair Francis dc7cbbe2c1 target/riscv: Remove user version information
Remove the user version information. This was never used and never
publically exposed in a release of QEMU, so let's just remove it. In
future to manage versions we can extend the extension properties to
specify version.

Backports commit c9a73910c34a2147bcf6a3b5194d27abb19c2e54 from qemu
2020-04-30 21:06:51 -04:00
Anup Patel 15e558e9cc riscv: Fix Stage2 SV32 page table walk
As-per RISC-V H-Extension v0.5 draft, the Stage2 SV32 page table has
12bits of VPN[1] and 10bits of VPN[0]. The additional 2bits in VPN[1]
is required to handle the 34bit intermediate physical address coming
from Stage1 SV32 page table. The 12bits of VPN[1] implies that Stage2
SV32 level-0 page table will be 16KB in size with total 4096 enteries
where each entry maps 4MB of memory (same as Stage1 SV32 page table).

The get_physical_address() function is broken for Stage2 SV32 level-0
page table because it incorrectly computes output physical address for
Stage2 SV32 level-0 page table entry.

The root cause of the issue is that get_physical_address() uses the
"widened" variable to compute level-0 physical address mapping which
changes level-0 mapping size (instead of 4MB). We should use the
"widened" variable only for computing index of Stage2 SV32 level-0
page table.

Backports commit ee79e7cd47ef47074d7c20c221321c5d31d3683d from qemu
2020-04-30 20:54:08 -04:00
Alistair Francis 434f9b057f riscv: AND stage-1 and stage-2 protection flags
Take the result of stage-1 and stage-2 page table walks and AND the two
protection flags together. This way we require both to set permissions
instead of just stage-2.

Backports commit 8f67cd6db7375f9133d900b13b300931fbc2e1d8 from qemu
2020-04-30 20:53:11 -04:00
Alistair Francis b6e2cf33df riscv: Don't use stage-2 PTE lookup protection flags
When doing the fist of a two stage lookup (Hypervisor extensions) don't
set the current protection flags from the second stage lookup of the
base address PTE.

Backports commit 384728905441279e54fa3d714b11bf1b1bcbfd27 from qemu
2020-04-30 20:52:06 -04:00
Philippe Mathieu-Daudé 6d9233a542 various: Remove suspicious '\' character outside of #define in C code
Fixes the following coccinelle warnings:

$ spatch --sp-file --verbose-parsing ... \
scripts/coccinelle/remove_local_err.cocci
...
SUSPICIOUS: a \ character appears outside of a #define at ./target/ppc/translate_init.inc.c:5213
SUSPICIOUS: a \ character appears outside of a #define at ./target/ppc/translate_init.inc.c:5261
SUSPICIOUS: a \ character appears outside of a #define at ./target/microblaze/cpu.c:166
SUSPICIOUS: a \ character appears outside of a #define at ./target/microblaze/cpu.c:167
SUSPICIOUS: a \ character appears outside of a #define at ./target/microblaze/cpu.c:169
SUSPICIOUS: a \ character appears outside of a #define at ./target/microblaze/cpu.c:170
SUSPICIOUS: a \ character appears outside of a #define at ./target/microblaze/cpu.c:171
SUSPICIOUS: a \ character appears outside of a #define at ./target/microblaze/cpu.c:172
SUSPICIOUS: a \ character appears outside of a #define at ./target/microblaze/cpu.c:173
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:5787
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:5789
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:5800
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:5801
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:5802
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:5804
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:5805
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:5806
SUSPICIOUS: a \ character appears outside of a #define at ./target/i386/cpu.c:6329
SUSPICIOUS: a \ character appears outside of a #define at ./hw/sd/sdhci.c:1133
SUSPICIOUS: a \ character appears outside of a #define at ./hw/scsi/scsi-disk.c:3081
SUSPICIOUS: a \ character appears outside of a #define at ./hw/net/virtio-net.c:1529
SUSPICIOUS: a \ character appears outside of a #define at ./hw/riscv/sifive_u.c:468
SUSPICIOUS: a \ character appears outside of a #define at ./dump/dump.c:1895
SUSPICIOUS: a \ character appears outside of a #define at ./block/vhdx.c:2209
SUSPICIOUS: a \ character appears outside of a #define at ./block/vhdx.c:2215
SUSPICIOUS: a \ character appears outside of a #define at ./block/vhdx.c:2221
SUSPICIOUS: a \ character appears outside of a #define at ./block/vhdx.c:2222
SUSPICIOUS: a \ character appears outside of a #define at ./block/replication.c:172
SUSPICIOUS: a \ character appears outside of a #define at ./block/replication.c:173

Backports commit 78ee6bd04821847036a805cb4bdd46464e1d3098 from qemu
2020-04-30 07:31:45 -04:00
Peter Maydell 2a2bb20399 Open 5.1 development tree
Backports commit a7922a3c81f34f45b1ebc9670a7769edc4c42a43 from qemu
2020-04-30 07:30:38 -04:00
Peter Maydell 0bc85f116b Update version for v5.0.0 release
Backports commit fdd76fecdde1ad444ff4deb7f1c4f7e4a1ef97d6 from qemu
2020-04-30 07:30:12 -04:00
Peter Maydell 4dd2736c2b Update version for v5.0.0-rc4 release
Backports commit ee573f5326046223b6eef4ae7fbfec31d274e093 from qemu
2020-04-30 07:29:47 -04:00
Peter Maydell a4a171a9c9 target/arm: Fix ID_MMFR4 value on AArch64 'max' CPU
In commit 41a4bf1feab098da4cd the added code to set the CNP
field in ID_MMFR4 for the AArch64 'max' CPU had a typo
where it used the wrong variable name, resulting in ID_MMFR4
fields AC2, XNX and LSM being wrong. Fix the typo.

Fixes: 41a4bf1feab098da4cd

Backports commit e73c4443473107ddf11ad3a7fea5bef2001ee802 from qemu
2020-04-30 07:29:06 -04:00
Peter Maydell cecdfd5fca Update version for v5.0.0-rc3 release
Backports commit 20038cd7a8412feeb49c01f6ede89e36c8995472 from qemu
2020-04-30 07:28:15 -04:00
Peter Maydell c6509498da osdep.h: Drop no-longer-needed Coverity workarounds
In commit a1a98357e3fd in 2018 we added some workarounds for Coverity
not being able to handle the _Float* types introduced by recent
glibc. Newer versions of the Coverity scan tools have support for
these types, and will fail with errors about duplicate typedefs if we
have our workaround. Remove our copy of the typedefs.

Backports commit c160f17cd6f5fc3f8698b408a451149b34b1a647 from qemu
2020-04-30 07:27:24 -04:00
Alexander Duyck 05cd02d6c6 memory: Do not allow direct write access to rom_device regions
According to the documentation in memory.h a ROM memory region will be
backed by RAM for reads, but is supposed to go through a callback for
writes. Currently we were not checking for the existence of the rom_device
flag when determining if we could perform a direct write or not.

To correct that add a check to memory_region_is_direct so that if the
memory region has the rom_device flag set we will return false for all
checks where is_write is set.

Backports commit d489ae4ac57ebe14bde8384556cbac237ead988d from qemu
2020-04-30 07:26:06 -04:00
lixinyu 7c32c5b0a4 tcg/mips: mips sync* encode error
OPC_SYNC_WMB, OPC_SYNC_MB, OPC_SYNC_ACQUIRE, OPC_SYNC_RELEASE and
OPC_SYNC_RMB have wrong encode. According to the mips manual,
their encode should be 'OPC_SYNC | 0x?? << 6' rather than
'OPC_SYNC | 0x?? << 5'. Wrong encode can lead illegal instruction
errors. These instructions often appear with multi-threaded
simulation.

Fixes: 6f0b99104a3 ("tcg/mips: Add support for fence")

Backports commit a4e57084c16d5b0eff3651693fba04f26b30b551 from qemu
2020-04-30 07:24:57 -04:00
Peter Maydell eeeb5cde38 Update version for v5.0.0-rc2 release
Backports commit f3bac27cc1e303e1860cc55b9b6889ba39dee587 from qemu
2020-04-30 07:24:07 -04:00
Richard Henderson 3e934b99c8 softfloat: Fix BAD_SHIFT from normalizeFloatx80Subnormal
All other calls to normalize*Subnormal detect zero input before
the call -- this is the only outlier. This case can happen with
+0.0 + +0.0 = +0.0 or -0.0 + -0.0 = -0.0, so return a zero of
the correct sign.

Reported-by: Coverity (CID 1421991)

Backports commit 2f311075b7a74124098effc72290767b02869561 from qemu
2020-04-30 07:22:57 -04:00
Peter Maydell 6a015761ac target/arm: Remove obsolete TODO note from get_phys_addr_lpae()
An old comment in get_phys_addr_lpae() claims that the code does not
support the different format TCR for VTCR_EL2. This used to be true
but it is not true now (in particular the aa64_va_parameters() and
aa32_va_parameters() functions correctly handle the different
register format by checking whether the mmu_idx is Stage2).
Remove the out of date parts of the comment.

Backports commit 07d1be3b3aac20c21ac4a95c7f3f01a3622a31a3 from qemu
2020-04-30 07:21:17 -04:00
Peter Maydell 4228e7f155 target/arm: PSTATE.PAN should not clear exec bits
Our implementation of the PSTATE.PAN bit incorrectly cleared all
access permission bits for privileged access to memory which is
user-accessible. It should only affect the privileged read and write
permissions; execute permission is dealt with via XN/PXN instead.

Fixes: 81636b70c226dc27d7ebc8d

Backports commit f4e1dbc578a051db08a40c05276ebf525b98f949 from qemu
2020-04-30 07:20:20 -04:00