Commit graph

61 commits

Author SHA1 Message Date
Sergey Fedorov 5df03a909c
target-arm: Update condexec before arch BP check in AA32 translation
Architectural breakpoint check could raise an exceptions, thus condexec
bits should be updated before calling gen_helper_check_breakpoints().

Backports commit ce8a1b5449cd8c4c2831abb581d3208c3a3745a0 from qemu
2018-02-17 18:35:50 -05:00
Sergey Fedorov b42bfc59f1
target-arm: Update condexec before CP access check in AA32 translation
Coprocessor access instructions are allowed inside IT block.
gen_helper_access_check_cp_reg() can raise an exceptions thus condexec
bits should be updated before.

Backports commit 43bfa4a100687af8d293fef0a197839b51400fca from qemu
2018-02-17 18:33:58 -05:00
Sergey Fedorov 23ece1622c
target-arm: Clean up DISAS_UPDATE usage in AArch32 translation code
AArch32 translation code does not distinguish between DISAS_UPDATE and
DISAS_JUMP. Thus, we cannot use any of them without first updating PC in
CPU state. Furthermore, it is too complicated to update PC in CPU state
before PC gets updated in disas context. So it is hardly possible to
correctly end TB early if is is not likely to be executed before calling
disas_*_insn(), e.g. just after calling breakpoint check helper.

Modify DISAS_UPDATE and DISAS_JUMP usage in AArch32 translation and
apply to them the same semantic as AArch64 translation does:
- DISAS_UPDATE: update PC in CPU state when finishing translation
- DISAS_JUMP: preserve current PC value in CPU state when finishing
translation

This patch fixes a bug in AArch32 breakpoint handling: when
check_breakpoints helper does not generate an exception, ending the TB
early with DISAS_UPDATE couldn't update PC in CPU state and execution
hangs.

Backports commit 577bf808958d06497928c639efaa473bf8c5e099 from qemu
2018-02-17 17:43:21 -05:00
Peter Maydell 0ed5787f89
target-arm: Report S/NS status in the CPU debug logs
If this CPU supports EL3, enhance the printing of the current
CPU mode in debug logging to distinguish S from NS modes as
appropriate.

Backports commit 06e5cf7acd1f94ab7c1cd6945974a1f039672940 from qemu
2018-02-17 15:24:14 -05:00
Richard Henderson c01a6dab0a
target-*: Advance pc after recognizing a breakpoint
Some targets already had this within their logic, but make sure
it's present for all targets.

Backports commit 522a0d4e3c0d397ffb45ec400d8cbd426dad9d17 from qemu
2018-02-17 15:24:11 -05:00
Richard Henderson 3ec0adcc07
target-*: Introduce and use cpu_breakpoint_test
Reduce the boilerplate required for each target. At the same time,
move the test for breakpoint after calling tcg_gen_insn_start.

Note that arm and aarch64 do not use cpu_breakpoint_test, but still
move the inline test down after tcg_gen_insn_start.

Backports commit b933066ae03d924a92b2616b4a24e7d91cd5b841 from qemu
2018-02-17 15:24:10 -05:00
Peter Maydell 93386e2dd4
target-arm/translate.c: Handle non-executable page-straddling Thumb insns
When the memory we're trying to translate code from is not executable we have
to turn this into a guest fault. In order to report the correct PC for this
fault, and to make sure it is not reported until after any other possible
faults for instructions earlier in execution, we must terminate TBs at
the end of a page, in case the next instruction is in a non-executable page.
This is simple for T16, A32 and A64 instructions, which are always aligned
to their size. However T32 instructions may be 32-bits but only 16-aligned,
so they can straddle a page boundary.

Correct the condition that checks whether the next instruction will touch
the following page, to ensure that if we're 2 bytes before the boundary
and this insn is T32 then we end the TB.

Backports commit 541ebcd401ee47f3c1a3ce503ef5466b75e9d20a from qemu
2018-02-17 15:24:07 -05:00
Sergey Fedorov e4e0c75f0f
target-arm: Fix CPU breakpoint handling
A QEMU breakpoint match is not definitely an architectural breakpoint
match. If an exception is generated unconditionally during translation,
it is hardly possible to ignore it in the debug exception handler.

Generate a call to a helper to check CPU breakpoints and raise an
exception only if any breakpoint matches architecturally.

Backports commit 5d98bf8f38c17a348ab6e8af196088cd4953acd0 from qemu
2018-02-17 15:24:02 -05:00
Sergey Sorokin 04992f0fb3
target-arm: Break the TB after ISB to execute self-modified code correctly
If any store instruction writes the code inside the same TB
after this store insn, the execution of the TB must be stopped
to execute new code correctly.
As described in ARMv8 manual D3.4.6 self-modifying code must do an
IC invalidation to be valid, and an ISB after it. So it's enough to end
the TB after ISB instruction on the code translation.
Also this TB break is necessary to take any pending interrupts immediately
after an ISB (as required by ARMv8 ARM D1.14.4).

Backports commit 6df99dec9e81838423d723996e96236693fa31fe from qemu
2018-02-17 15:24:01 -05:00
Richard Henderson a5ac288135
tcg: Remove gen_intermediate_code_pc
It is no longer used, so tidy up everything reached by it.
This includes the gen_opc_* arrays, the search_pc parameter
and the inline gen_intermediate_code_internal functions.

Backports commit 4e5e1215156662b2b153255c49d4640d82c5568b from qemu
2018-02-17 15:23:59 -05:00
Richard Henderson 1cbd175736
tcg: Pass data argument to restore_state_to_opc
The gen_opc_* arrays are already redundant with the data stored in
the insn_start arguments. Transition restore_state_to_opc to use
data from the latter.

Backports commit bad729e272387de7dbfa3ec4319036552fc6c107 from qemu
2018-02-17 15:23:58 -05:00
Lioncash b115c5509d
tcg: Add TCG_MAX_INSNS
Adjust all translators to respect it.

Backports commit 190ce7fbc79fd0883a6170d7f30da59d366e6830 from qemu
2018-02-17 15:23:58 -05:00
Sergey Sorokin a883d349fe
target-arm: Fix default_exception_el() function for the case when EL3 is not supported
If EL3 is not supported in current configuration,
we should not try to get EL3 bitness.

Backports commit cef9ee706792b1e205fe472b67053a0e82cd058e from qemu
2018-02-17 15:23:36 -05:00
Peter Maydell 5c7389680e
target-arm: Implement YIELD insn to yield in ARM and Thumb translators
Implement the YIELD instruction in the ARM and Thumb translators to
actually yield control back to the top level loop rather than being
a simple no-op. (We already do this for A64.)

Backports commit c87e5a61c2b3024116f52f7e68273f864ff7ab82 from qemu
2018-02-17 15:23:14 -05:00
Peter Maydell 13db196792
target-arm: Correct "preferred return address" for cpreg access exceptions
The architecture defines that when taking an exception trying to
access a coprocessor register, the "preferred return address" for
the exception is the address of the instruction that caused the
exception. Correct an off-by-4 error which meant we were returning
the address after the instruction for traps which happened because
of a failure of a runtime access-check function on an AArch32
register. (Traps caused by translate-time checkable permissions
failures had the correct address, as did traps on AArch64 registers.)

This fixes https://bugs.launchpad.net/qemu/+bug/1463338

Backports commit 3977ee5d7a9f2e3664dd8b233f3224694e23b62b from qemu
2018-02-17 15:22:42 -05:00
Peter Maydell 6d7370457f
target-arm: Don't halt on WFI unless we don't have any work
Just NOP the WFI instruction if we have work to do.
This doesn't make much difference currently (though it does avoid
jumping out to the top level loop and immediately restarting),
but the distinction between "halt" and "don't halt" will become
more important when the decision to halt requires us to trap
to a higher exception level instead.

Backport commit 84549b6dcf9147559ec08b066de673587be6b763 from qemu
2018-02-12 23:10:45 -05:00
Greg Bellows 3c87e50745
target-arm: Extend FP checks to use an EL
Extend the ARM disassemble context to take a target exception EL instead of a
boolean enable. This change reverses the polarity of the check making a value
of 0 indicate floating point enabled (no exception).

Backports commit 9dbbc748d671c70599101836cd1c2719d92f3017 from qemu
2018-02-12 23:04:19 -05:00
Greg Bellows edd8066082
target-arm: Add exception target el infrastructure
Add a CPU state exception target EL field that will be used for communicating
the EL to which an exception should be routed.

Add a disassembly context field for tracking the EL3 architecture needed for
determining the target exception EL.

Add a target EL argument to the generic exception helper for callers to specify
the EL to which the exception should be routed. Extended the helper to set
the newly added CPU state exception target el.

Added a function for setting the target exception EL and updated calls to helpers
to call it.

Backports commit 737103619869600668cc7e8700e4f6eab3943896 from qemu
2018-02-12 22:17:02 -05:00
Peter Maydell db9901f2ad
target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strd
A LDRD or STRD where rd is not an even number is UNPREDICTABLE.
We were letting this fall through, which is OK unless rd is 15,
in which case we would attempt to do a load_reg or store_reg
to a nonexistent r16 for the second half of the double-word.
Catch the odd-numbered-rd cases and UNDEF them instead.

To do this we rearrange the structure of the code a little
so we can put the UNDEF catches at the top before we've
allocated TCG temporaries.

Backports commit a4bb522ee51087af61998f290d12ba2e14c7910e from qemu
2018-02-12 17:17:23 -05:00
Peter Maydell 3497be0faa
target-arm: Fix handling of STM (user) with r15 in register list
The A32 encoding of LDM distinguishes LDM (user) from LDM (exception
return) based on whether r15 is in the register list. However for
STM (user) there is no equivalent distinction. We were incorrectly
treating "r15 in list" as indicating exception return for both LDM
and STM, with the result that an STM (user) involving r15 went into
an infinite loop. Fix this; note that the value stored for r15
in this case is the current PC regardless of our current mode.

Backports commit da3e53ddcb0ca924da97ca5a35605fc554aa3e05 from qemu
2018-02-12 16:16:05 -05:00
Peter Maydell da216e211f
target-arm: Use correct mmu_idx for unprivileged loads and stores
The MMU index to use for unprivileged loads and stores is more
complicated than we currently implement:
* for A64, it should be "if at EL1, access as if EL0; otherwise
access at current EL"
* for A32/T32, it should be "if EL2, UNPREDICTABLE; otherwise
access as if at EL0".

In both cases, if we want to make the access for Secure EL0
this is not the same mmu_idx as for Non-Secure EL0.

Backports commit 579d21cce63f3dd2f6ee49c0b02a14e92cb4a836 from qemu
2018-02-12 11:28:17 -05:00
Peter Maydell 3261ed5801
target-arm: Define correct mmu_idx values and pass them in TB flags
We currently claim that for ARM the mmu_idx should simply be the current
exception level. However this isn't actually correct -- secure EL0 and EL1
should have separate indexes from non-secure EL0 and EL1 since their
VA->PA mappings may differ. We also will want an index for stage 2
translations when we properly support EL2.

Define and document all seven mmu index values that we require, and
pass the mmu index in the TB flags rather than exception level or
priv/user bit.

This change doesn't update the get_phys_addr() code, so our page
table walking still assumes a simplistic "user or priv?" model for
the moment.

Backports commit c1e3781090b9d36c60e1a254ba297cb34011d3d4 from qemu
2018-02-12 11:21:19 -05:00
Kirill Batuzov d45ea1ba3b
target-arm: check that LSB <= MSB in BFI instruction
The documentation states that if LSB > MSB in BFI instruction behaviour
is unpredictable. Currently QEMU crashes because of assertion failure in
this case:

tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed.

While assertion failure may meet the "unpredictable" definition this
behaviour is undesirable because it allows an unprivileged guest program
to crash the emulator with the OS and other programs.

This patch addresses the issue by throwing illegal instruction exception
if LSB > MSB. Only ARM decoder is affected because Thumb decoder already
has this check in place.

To reproduce issue run the following program

int main(void) {
asm volatile (".long 0x07c00c12" :: );
return 0;
}

compiled with
gcc -marm -static badop_arm.c -o badop_arm

Backports commit 45140a57675ecb4b0daee71bf145c24dbdf9429c from qemu
2018-02-12 11:06:12 -05:00
Peter Maydell fb78e79d72
target-arm: add secure state bit to CPREG hash
Added additional NS-bit to CPREG hash encoding. Updated hash lookup
locations to specify hash bit currently set to non-secure.

Backports commit 51a79b039728277e35fd19f7a7b4bc6cb323697f from qemu
2018-02-11 18:35:52 -05:00
Sergey Fedorov acdd665668
target-arm: add non-secure Translation Block flag
This patch is based on idea found in patch at
git://github.com/jowinter/qemu-trustzone.git
f3d955c6c0ed8c46bc0eb10b634201032a651dd2 by
Johannes Winter <johannes.winter@iaik.tugraz.at>.

The TBFLAG captures the SCR NS secure state at the time when a TB is created so
the correct bank is accessed on system register accesses.

Backports commit 3f342b9e0e64ad681cd39840bfa75ef12d2807c1 from qemu
2018-02-11 17:50:46 -05:00
Richard Henderson 2c091e5fb8
target-arm: Add condexec state to insn_start
Backports commit 52e971d9ff67e340ac2a86bd67e14bd31c7991e0 from qemu
2018-02-11 15:13:40 -05:00
Richard Henderson dd1ec408e5
target-*: Increment num_insns immediately after tcg_gen_insn_start
This does tidy the icount test common to all targets.

Backports commit 959082fc4a93a016a6b697e1e0c2b373d8a3a373 from qemu
2018-02-11 12:46:30 -05:00
Richard Henderson a64d0ff657
target-*: Unconditionally emit tcg_gen_insn_start
While we're at it, emit the opcode adjacent to where we currently
record data for search_pc. This puts gen_io_start et al on the
"correct" side of the marker.

Backports commit 667b8e29c5b1d8c5b4e6ad5f780ca60914eb6e96 from qemu
2018-02-11 12:41:20 -05:00
Lioncash b3f9ff667b
tcg: Rename debug_insn_start to insn_start
With an eye toward making it mandatory.

Backports commit 765b842adec4c5a359e69ca08785553599f71496 from qemu
2018-02-11 12:34:01 -05:00
Richard Henderson 70dd48b855
target-arm: Handle always condition codes within arm_test_cc
Handling this with TCG_COND_ALWAYS will allow these unlikely
cases to be handled without special cases in the rest of the
translator. The TCG optimizer ought to be able to reduce
these ALWAYS conditions completely.

Backports commit 9305eac09e61d857c9cc11e20db754dfc25a82db from qemu
2018-02-10 23:48:10 -05:00
Lioncash 94f1227f7a
target-arm: Introduce DisasCompare
Split arm_gen_test_cc into 3 functions, so that it can be reused
for non-branch TCG comparisons.

Backports commit 6c2c63d3a02c79e9035ca0370cc549d0f938a4dd from qemu
2018-02-10 23:45:47 -05:00
Richard Henderson a3aaf5a864
tcg: Remove tcg_gen_trunc_i64_i32
Replacing it with tcg_gen_extrl_i64_i32.

Backports commit ecc7b3aa71f5fdcf9ee87e74ca811d988282641d from qemu
2018-02-10 23:11:02 -05:00
Richard Henderson 232632e76c
tcg: Change translator-side labels to a pointer
This is improved type checking for the translators -- it's no longer
possible to accidentally swap arguments to the branch functions.

Note that the code generating backends still manipulate labels as int.

With notable exceptions, the scope of the change is just a few lines
for each target, so it's not worth building extra machinery to do this
change in per-target increments.

Backports commit 42a268c241183877192c376d03bd9b6d527407c7 from qemu
2018-02-09 14:17:56 -05:00
Lioncash 0273e6ae18
tcg: Put opcodes in a linked list
The previous setup required ops and args to be completely sequential,
and was error prone when it came to both iteration and optimization.
2018-02-09 12:54:05 -05:00
Richard Henderson a41b9acc0c
tcg: Introduce tcg_op_buf_count and tcg_op_buf_full
The method by which we count the number of ops emitted
is going to change. Abstract that away into some inlines.

Backports commit fe700adb3db5b028b504423b946d4ee5200a8f2f from qemu.
2018-02-09 09:31:17 -05:00
Richard Henderson 78378289e3
tcg: Move emit of INDEX_op_end into gen_tb_end
Backports commit 0a7df5da986bd7ee0789f2d7b8611f2e8eee5046 from qemu
2018-02-09 08:51:01 -05:00
Richard Henderson 6b4b493dae
tcg: Change tcg_global_mem_new_* to take a TCGv_ptr
Thus, use cpu_env as the parameter, not TCG_AREG0 directly.
Update all uses in the translators.

Backports commit e1ccc05444676b92c63708096e36582be27fbee1 from qemu
2018-02-08 12:33:33 -05:00
Lioncash 0f453b0595
target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers
Backports commit 9a2b5256ea1f68c89d5da4b54f180f576c2c82d6 from qemu
2018-02-07 10:09:26 -05:00
Lioncash dd577f5ea5
target/arm: Change the type of vfp.regs
Backports commit 3f68b8a5a6862f856524bb347bf348ae364dd43c from qemu
2018-02-07 09:57:43 -05:00
Merry 82c4212ce3
Merge pull request #8 from lioncash/optimize
Backport REV16 optimizations from qemu
2018-02-05 20:58:58 +00:00
Lioncash 5a37b8c28e
Backport optimizations to AArch32's REV16 handling
Backports commit 68cedf733ae32363ccf54f0b52c8a424d5ec98ed from qemu
2018-02-04 14:53:28 -05:00
Lioncash 4fb2fbfacf
Backport the JAZELLE feature flag
Backports commit c99a55d38dd5b5131f3fcbbaf41828a09ee62544 in qemu to unicorn
2018-02-02 08:50:18 -05:00
Lioncash 84319130cd
Backport the M_SECURITY feature flag
Backports relevant parts from commit 1e577cc7cffd3de14dbd321de5c3ef191c6ab07f in qemu to unicorn
2018-02-02 08:44:46 -05:00
Lioncash 291b5753eb
Backport the THUMB_DSP feature flag
Backports commit 62b44f059a84d1ac580a653fc4110dfabaef6b83 in qemu to unicorn.
2018-02-02 07:59:26 -05:00
Nguyen Anh Quynh 513075e061 arm: fix an warning reported by GCC 2017-04-21 21:12:57 +08:00
Nguyen Anh Quynh e917c9de10 Merge branch 'master' into msvc2 2017-04-21 01:17:00 +08:00
0xSeb 605400e10e determine correct Thumb/Thumb2 instruction size (16/32-bit) for code … (#796)
* determine correct Thumb/Thumb2 instruction size (16/32-bit) for code hook

* determine correct Thumb/Thumb2 instruction size (16/32-bit) for code hook

* determine correct Thumb/Thumb2 instruction size (16/32-bit) for code hook
2017-04-15 00:39:56 +08:00
xorstream 8e45102b43 Arm support ported. (#736)
* Fix for MIPS issue.

* Sparc support added.

* M68K support added.

* Arm support ported.

* Fix issue with VS2015 shlobj.h file
2017-01-23 23:30:57 +08:00
xorstream fac6a66860 platform.h move #3 2017-01-21 00:13:21 +11:00
xorstream 1aeaf5c40d This code should now build the x86_x64-softmmu part 2. 2017-01-19 22:50:28 +11:00