Commit graph

380 commits

Author SHA1 Message Date
Peter Maydell f1011035f0
target-arm: Implement missing AMAIR registers
The AMAIR registers are for providing auxiliary implementation
defined memory attributes. We already implemented a RAZ/WI
AMAIR_EL1; add the EL2 and EL3 versions for consistency.

Backports commit 2179ef958c81480b841ffa0aab5e265688ffd2b0 from qemu
2018-02-17 15:23:30 -05:00
Peter Maydell 7d1422efc5
target-arm: Add missing MAIR_EL3 and TPIDR_EL3 registers
Add the AArch64 registers MAIR_EL3 and TPIDR_EL3, which are the only
two which we had implemented the 32-bit Secure equivalents of but
not the 64-bit Secure versions.

Backports commit 4cfb8ad896a6f85953038bd913ce3d82d347013d from qemu
2018-02-17 15:23:29 -05:00
Peter Maydell 0c3e33ee11
target-arm: Add AArch32 banked register access to secure physical timer
If EL3 is AArch32, then the secure physical timer is accessed via
banking of the registers used for the non-secure physical timer.
Implement this banking.

Note that the access controls for the AArch32 banked registers
remain the same as the physical-timer checks; they are not the
same as the controls on the AArch64 secure timer registers.

Backports commit 9ff9dd3c875956523bb4c19ca712e5d05aab3c65 from qemu
2018-02-17 15:23:26 -05:00
Peter Maydell 6c24603b23
target-arm: Add the AArch64 view of the Secure physical timer
On CPUs with EL3, there are two physical timers, one for Secure and one
for Non-secure. Implement this extra timer and the AArch64 registers
which access it.

Backports commit b4d3978c2fdf944e428a46d2850dbd950b6fbe78 from qemu
2018-02-17 15:23:26 -05:00
Peter Maydell 7a482198b2
target-arm: Add debug check for mismatched cpreg resets
It's easy to accidentally define two cpregs which both try
to reset the same underlying state field (for instance a
clash between an AArch64 EL3 definition and an AArch32
banked register definition). if the two definitions disagree
about the reset value then the result is dependent on which
one happened to be reached last in the hashtable enumeration.

Add a consistency check to detect and assert in these cases:
after reset, we run a second pass where we check that the
reset operation doesn't change the value of the register.

Backports commit 49a661910c1374858602a3002b67115893673c25 from qemu
2018-02-17 15:23:25 -05:00
Lioncash d706680ad6
target-arm: Add the Hypervisor timer
Backports commit b0e66d95e4f587b5818d2760668301ee0871ba5e from qemu
2018-02-17 15:23:25 -05:00
Lioncash ba27ba76a4
target-arm: Pass timeridx as argument to various timer functions
Prepare for adding the Hypervisor timer, no functional change.

Backports commit 0e3eca4c26d6aa4f082db8e63fd81a16df061f3c from qemu
2018-02-17 15:23:25 -05:00
Edgar E. Iglesias 4cbd161ea8
target-arm: Rename and move gt_cnt_reset
Rename gt_cnt_reset to gt_timer_reset as the function really
resets the timers and not the counters. Move the registration
from counter regs to timer regs.

Backports commit d57b9ee84f6b2786f025712609edb259d0de086d from qemu
2018-02-17 15:23:25 -05:00
Edgar E. Iglesias 38639f678c
target-arm: Add CNTHCTL_EL2
Adds control for trapping selected timer and counter accesses to EL2.

Backports commit 0b6440afb807a80c6d64dcc987bcfed87e1ace17 from qemu
2018-02-17 15:23:24 -05:00
Edgar E. Iglesias 1abe79e7cf
target-arm: Add CNTVOFF_EL2
Adds support for the virtual timer offset controlled by EL2.

Backports commit edac4d8a168b9c0c4a765bbc5507e46fa5557b78 from qemu
2018-02-17 15:23:24 -05:00
Peter Maydell 484a9cc21b
target-arm: Fix broken SCTLR_EL3 reset
The SCTLR_EL3 cpreg definition was implicitly resetting the
register state to 0, which is both wrong and clashes with
the reset done via the SCTLR definition (since sctlr[3]
is unioned with sctlr_s). This went unnoticed until recently,
when an unrelated change (commit a903c449b41f105aa) happened to
perturb the order of enumeration through the cpregs hashtable for
reset such that the erroneous reset happened after the correct one
rather than before it. Fix this by marking SCTLR_EL3 as an alias,
so its reset is left up to the AArch32 view.

Backports commit e46e1a74ef482f1ef773e750df9654ef4442ca29 from qemu
2018-02-17 15:23:19 -05:00
Peter Crosthwaite e51f8c9f6f
cpu-exec: Purge all uses of ENV_GET_CPU()
Remove un-needed usages of ENV_GET_CPU() by converting the APIs to use
CPUState pointers and retrieving the env_ptr as minimally needed.

Scripted conversion for target-* change:

for I in target-*/cpu.h; do
sed -i \
's/\(^int cpu_[^_]*_exec(\)[^ ][^ ]* \*s);$/\1CPUState *cpu);/' \
$I;
done

Backports commit ea3e9847408131abc840240bd61e892d28459452 from qemu
2018-02-17 15:23:18 -05:00
Peter Crosthwaite 9e23308b66
cpu: Change cpu_exec_init() arg to cpu, not env
The callers (most of them in target-foo/cpu.c) to this function all
have the cpu pointer handy. Just pass it to avoid an ENV_GET_CPU() from
core code (in exec.c).

Backports commit 4bad9e392e788a218967167a38ce2ae7a32a6231 from qemu
2018-02-17 15:23:18 -05:00
Daniel P. Berrange 2e97ecfbcd
crypto: move built-in AES implementation into crypto/
To prepare for a generic internal cipher API, move the
built-in AES implementation into the crypto/ directory

Backports commit 6f2945cde60545aae7f31ab9d5ef29531efbc94f from qemu
2018-02-17 15:23:17 -05:00
Peter Maydell 5c7389680e
target-arm: Implement YIELD insn to yield in ARM and Thumb translators
Implement the YIELD instruction in the ARM and Thumb translators to
actually yield control back to the top level loop rather than being
a simple no-op. (We already do this for A64.)

Backports commit c87e5a61c2b3024116f52f7e68273f864ff7ab82 from qemu
2018-02-17 15:23:14 -05:00
Peter Maydell 8840d8370d
target-arm: Split DISAS_YIELD from DISAS_WFE
Currently we use DISAS_WFE for both WFE and YIELD instructions.
This is functionally correct because at the moment both of them
are implemented as "yield this CPU back to the top level loop so
another CPU has a chance to run". However it's rather confusing
that YIELD ends up calling HELPER(wfe), and if we ever want to
implement real behaviour for WFE and SEV it's likely to trip us up.

Split out the yield codepath to use DISAS_YIELD and a new
HELPER(yield) function, and have HELPER(wfe) call HELPER(yield).

Backports commit 049e24a191c212d9468db84169197887f2c91586 from qemu
2018-02-17 15:23:14 -05:00
Sergey Fedorov bcf57618a8
target-arm: fix write helper for TLBI ALLE1IS
TLBI ALLE1IS is an operation that does invalidate TLB entries on all PEs
in the same Inner Sharable domain, not just on the current CPU. So we
must use tlbiall_is_write() here.

Backports commit 2a6332d968297266dbabf9d33f959e3a5efdd0f9 from qemu
2018-02-17 15:23:14 -05:00
Soren Brinkmann fd2ac3058f
target-arm: A64: Print ELR when taking exceptions
When taking an exception print the content of the exception link
register. This is useful especially for synchronous exceptions because
in that case this registers holds the address of the instruction that
generated the exception.

Backports commit b21ab1fc217b4a2b8f2f85d16bdd8510a7817a34 from qemu
2018-02-17 15:23:13 -05:00
Peter Crosthwaite 63e5f57bb2
target-arm: Add support for Cortex-R5
Introduce a CPU model for the Cortex R5 processor. ARMv7 with MPU,
and both thumb and ARM div instructions.

Also implement dummy ATCM and BTCM. These CPs are defined for R5 but
don't have a lot of meaning in QEMU yet. Raz them so the guest can
proceed if they are read. The TCM registers will return a size of 0,
indicating no TCM.

Backports commit d6a6b13ea1dfeb25c43a648e94cfe4395906f1da from qemu
2018-02-17 15:23:08 -05:00
Peter Crosthwaite 500d37e9b3
target-arm: Implement PMSAv7 MPU
Unified MPU only. Uses ARM architecture major revision to switch
between PMSAv5 and v7 when ARM_FEATURE_MPU is set. PMSA v6 remains
unsupported and is asserted against.

Backports commit f6bda88ff839e2adefe4959b7def420b90703855 from qemu
2018-02-17 15:23:08 -05:00
Peter Crosthwaite 65f70d7a08
target-arm: Add registers for PMSAv7
Define the arm CP registers for PMSAv7 and their accessor functions.
RGNR serves as a shared index that indexes into arrays storing the
DRBAR, DRSR and DRACR registers. DRBAR and friends have to be VMSDd
separately from the CP interface using a new PMSA specific VMSD
subsection.

Backports commit 6cb0b013a1fa421cdfb83257cd33f855cc90649a from qemu
2018-02-17 15:22:43 -05:00
Peter Crosthwaite 7d933a6ba9
target-arm/helper.c: define MPUIR register
Define the MPUIR register for MPU supporting ARMv6 and onwards.
Currently we only support unified MPU.

The size of the unified MPU is defined via the number of "dregions".
So just a single config is added to specify this size. (When split MPU
is implemented we will add an extra iregions config).

Backports commit 3281af8114c6b8ead02f08b58e3c36895c1ea047 from qemu
2018-02-17 15:22:43 -05:00
Sergey Fedorov 07ead14756
target-arm: Do not reset sysregs marked as ALIAS
cp_reg_reset() is called from g_hash_table_foreach() which does not
define a specific ordering of the hash table iteration. Thus doing reset
for registers marked as ALIAS would give an ambiguous result when
resetvalue is different for original and alias registers. Exit
cp_reg_reset() early when passed an alias register. Then clean up alias
register definitions from needless resetvalue and resetfn.

In particular, this fixes a bug in the handling of the PMCR register,
which had different resetvalues for its 32 and 64-bit views.

Backports commit b061a82b8afcc45ce09d770d9c0acdf429401054 from qemu
2018-02-17 15:22:43 -05:00
Aurelio C. Remonda 7ca21d4ab4
target-arm: Add the Cortex-M4 CPU
This patch adds the Cortex-M4 CPU. The M4 is basically the same as
the M3, the main differences being the DSP instructions and an
optional FPU. Only no-FPU cortex-M4 is implemented here, cortex-M4F
is not because the core target-arm code doesn't support the M-profile
FPU model yet.

Backports commit ba890a9b2509a0087bb7eafddae02ea5ecbb7bb4 from qemu
2018-02-17 15:22:43 -05:00
Peter Maydell 13db196792
target-arm: Correct "preferred return address" for cpreg access exceptions
The architecture defines that when taking an exception trying to
access a coprocessor register, the "preferred return address" for
the exception is the address of the instruction that caused the
exception. Correct an off-by-4 error which meant we were returning
the address after the instruction for traps which happened because
of a failure of a runtime access-check function on an AArch32
register. (Traps caused by translate-time checkable permissions
failures had the correct address, as did traps on AArch64 registers.)

This fixes https://bugs.launchpad.net/qemu/+bug/1463338

Backports commit 3977ee5d7a9f2e3664dd8b233f3224694e23b62b from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite c1554dbd06
arm: helper: rename get_phys_addr_mpu
This get_phys_addr is really for pmsav5. Rename it accordingly.

Backports commit 13689d43646482f7305282de1bdd662c0d2b8b77 from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite 0299851aa0
arm: Add has-mpu property
For processors that support MPUs, add a property to de-feature it. This
is similar to the implementation of the EL3 feature.

The processor definition in init sets ARM_FEATURE_MPU if it can support
an MPU. post_init exposes the property, defaulting to true. If cleared
by the instantiator, ARM_FEATURE_MPU is then removed at realize time.

This is to support R profile processors that may or may-not have an MPU
configured.

Backports commit 8f325f568fbd0158cd413e7d637573ba90b3eaab from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite 6f843a5484
arm: Implement uniprocessor with MP config
Add a boolean for indicating uniprocessors with MP extensions. This
drives the U bit in MPIDR. Prepares support for Cortex-R5.

Backports commit a8e81b319d1ae1224cc7059877dcdf04a5aad59d from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite e8499a8f9b
arm: Refactor get_phys_addr FSR return mechanism
Currently, the return code for get_phys_addr is overloaded for both
success/fail and FSR value return. This doesn't handle the case where
there is an error with a 0 FSR. This case exists in PMSAv7.

So rework get_phys_addr and friends to return a success/failure boolean
return code and populate the FSR via a caller provided uint32_t
pointer.

Backports commit b7cc4e82f04a1c5b218a657f677a2fdd1e1c2889 from qemu
2018-02-17 15:22:42 -05:00
Peter Crosthwaite 4c204e6f3f
arm: helper: Factor out CP regs common to [pv]msa
V6+ PMSA and VMSA share some common registers that are currently
in the VMSA definition block. Split them out into a new def that can
be shared to PMSA.

Backports commit 8e5d75c950a1241f6e1243c37f28cd58f68fedc9 from qemu
2018-02-17 15:22:31 -05:00
Peter Crosthwaite 62ddaba69f
arm: Don't add v7mp registers in MPU systems
These registers are VMSA specific so they should be conditional on
VMSA (i.e. !MPU).

Backports commit 5e5cf9e35f25f9f932a6ce25107c11b67b426a43 from qemu
2018-02-13 14:37:22 -05:00
Peter Crosthwaite 70fae13253
arm: Do not define TLBTR in PMSA systems
If doing a PMSA (MPU) system do not define the VMSA specific TLBTR CP.
The def is done separately from VMSA registers group as it is affected
by both the OMAP/STRONGARM RW errata and the MIDR backgrounding.

Backports commit 8085ce63c5967d200f1241b6c0a189371993c5df from qemu
2018-02-13 14:35:38 -05:00
Pavel Fedin caed2f123d
target-arm: Use the kernel's idea of MPIDR if we're using KVM
When we're using KVM, the kernel's internal idea of the MPIDR
affinity fields must match the values we tell it for the guest
vcpu cluster configuration in the device tree. Since at the moment
the kernel doesn't support letting userspace tell it the correct
affinity fields to use, we must read the kernel's view and
reflect that back in the device tree.

Backports commit eb5e1d3c85dffe677da2550d211f9304a7d5ba3b from qemu
2018-02-13 14:32:46 -05:00
Sergey Fedorov 614ecb2bf2
target-arm: add AArch32 MIDR aliases in ARMv8
According to ARMv8 ARM, there are additional aliases to MIDR system register in
AArch32 state. So add them to the list.

Backports commit ac00c79ff6635ae9fd732ff357ada0d05e795500 from qemu
2018-02-13 14:28:11 -05:00
Sergey Fedorov 113cda90c3
target-arm: Fix REVIDR reset value
According to ARM Cortex-A53/A57 TRM, REVIDR reset value should be zero. So let
REVIDR reset value be specified by CPU model and correct it for Cortex-A53/A57.

Backports commit 13b72b2b9aa7ab7ee129e38e9587acd6a1b9a932 from qemu
2018-02-13 14:24:08 -05:00
Alex Bennée f6d104b33a
target-arm/cpu.h: remove pending_exception
This isn't used by any of the code. In fact it looks like it was never
used as it came in with ARMv7 support.

Backports commit a79e0218e0ae27c9cdd2648bd46e5a916c903cc2 from qemu
2018-02-13 14:24:08 -05:00
Sergey Fedorov 7f53358ec1
target-arm: use extended address bits from supersection short descriptor
Since ARMv7 with LPAE support, a supersection short translation table
descriptor has had extended base address fields which hold bits 39:32 of
translated address. These fields are IMPDEF in ARMv6 and ARMv7 without
LPAE support.

Backports commit 4e42a6ca37e39e56725518851f4388e46bd91129 from qemu
2018-02-13 14:24:08 -05:00
Peter Maydell 84c75286f5
target-arm: Handle "extended small page" descriptors correctly
The old ARMv5-style page table format includes a kind of second level
descriptor named the "extended small page" format, whose primary purpose
is to allow specification of the TEX memory attribute bits on a 4K page.
This exists on ARMv6 and also (as an implementation extension) on XScale
CPUs; it's UNPREDICTABLE on v5.

We were mishandling this in two ways:
(1) we weren't implementing it for v6 (probably never noticed because
Linux will use the new-style v6 page table format there)
(2) we were not correctly setting the page_size, which is 4K, not 1K

The latter bug went unnoticed for years because the only thing which
the page_size affects is which TLB entries get flushed when the guest
does a TLB invalidate on an address in the page, and prior to commit
2f0d8631b7 we were doing a full TLB flush very frequently due to Linux's
habit of writing the SCTLR pointlessly a lot.

(We can assume that after commit 2f0d8631b7 the bug went unnoticed
for a year because nobody's actually using the Zaurus/XScale emulation...)

Report the correct page size for these descriptors, and permit them
on ARMv6 CPUs. This fixes a problem where a kernel image for Zaurus
can boot the kernel OK but gets random segfaults when it tries to
run userspace programs.

Backports commit fc1891c74ae122a9dc7854f38bae7db03cd911e6 from qemu
2018-02-13 14:19:53 -05:00
Lioncash 98e2ffba3a
unicorn_arm: m68k/translate: Build fixes 2018-02-13 09:15:46 -05:00
Peter Maydell ed58b3afac
target-arm: Remove v8_ prefix from names of non-v8-specific cpreg arrays
The ARMCPRegInfo arrays v8_el3_no_el2_cp_reginfo and v8_el2_cp_reginfo
are actually used on non-v8 CPUs as well. Remove the incorrect v8_
prefix from their names.

Backports commit 4771cd01daaccb2a8929fa04c88c608e378cf814 from qemu
2018-02-13 08:16:23 -05:00
Edgar E. Iglesias 8a8e174981
target-arm: Add TLBI_VAE2{IS}
Backports commit 8742d49d6f2278d353a1623dfa8a5e237dbfd906 from qemu
2018-02-13 08:13:37 -05:00
Edgar E. Iglesias a2bab5d679
target-arm: Add TLBI_ALLE2
Backports commit 51da90140bba4333eeb9c1d8d8d8afc2ca790628 from qemu
2018-02-13 08:10:37 -05:00
Edgar E. Iglesias 4fdfb4e39b
target-arm: Add TLBI_ALLE1{IS}
Backports commit bdb9e2d66afbe0571dce48a9430c35ae4d6bbd32 from qemu
2018-02-13 08:07:46 -05:00
Edgar E. Iglesias 74daefe28b
target-arm: Add TTBR0_EL2
Backports commit a57633c08fa861807a0713505785bd4d441d7df8 from qemu
2018-02-13 08:04:35 -05:00
Edgar E. Iglesias 2ec3c2da5d
target-arm: Add TPIDR_EL2
Backports commit ff05f37babe7874f28dcead6e9e4f1904d35a13a from qemu
2018-02-13 08:00:13 -05:00
Edgar E. Iglesias 0374ab0421
target-arm: Add SCTLR_EL2
Backports commit b9cb5323bb671a0f2bfecc36168d3a3763e90261 from qemu
2018-02-13 07:57:45 -05:00
Edgar E. Iglesias ca6a626ad6
target-arm: Add TCR_EL2
Backports commit 06ec4c8c9f9e21b7671c79296f3a47ab63d50067 from qemu
2018-02-12 23:33:29 -05:00
Edgar E. Iglesias 8fc0629227
target-arm: Add MAIR_EL2
Backports commit 95f949ac3dc7d4a6ebee512a9d122db18210df64 from qemu
2018-02-12 23:27:49 -05:00
Edgar E. Iglesias 956655f449
target-arm: Break down TLB_LOCKDOWN
Break down the overly broad wildcard definition of TLB_LOCKDOWN
down to v7 level.

Backports commit a903c449b41f105aadd5f762a7aede531b4950f0 from qemu
2018-02-12 23:22:29 -05:00
Edgar E. Iglesias 49d2795fd9
target-arm: Correct check for non-EL3
This fixes a compile warning from clang 3.5 (the assertion
could never fire).

Backports commit 3fc827d591679f3e262b9d1f8b34528eabfca8c0 from qemu
2018-02-12 23:15:53 -05:00
Greg Bellows 2ffb7d0707
target-arm: Add WFx instruction trap support
Add support for trapping WFI and WFE instructions to the proper EL when
SCTLR/SCR/HCR settings apply.

Backports commit b1eced713d9913a5c58ba9daa795f10e4c856c49 from qemu
2018-02-12 23:13:23 -05:00
Peter Maydell 6d7370457f
target-arm: Don't halt on WFI unless we don't have any work
Just NOP the WFI instruction if we have work to do.
This doesn't make much difference currently (though it does avoid
jumping out to the top level loop and immediately restarting),
but the distinction between "halt" and "don't halt" will become
more important when the decision to halt requires us to trap
to a higher exception level instead.

Backport commit 84549b6dcf9147559ec08b066de673587be6b763 from qemu
2018-02-12 23:10:45 -05:00
Peter Maydell db727fad68
target-arm: Move TB flags down to fill gap
Deleting the now-unused ARM_TBFLAG_CPACR_FPEN left a gap in the
bit usage; move the following ARM_TBFLAG_XSCALE_CPAR and
ARM_TBFLAG_NS_SHIFT down 3 bits to fill the gap.

Backports commit 647f767ba3b37fb229275086187e96242248a4ac from qemu
2018-02-12 23:07:55 -05:00
Lioncash 63f04de43b
target-arm: Amend assert conditional in access_check_cp_reg
This was present in the original backported patch
2018-02-12 23:06:24 -05:00
Greg Bellows 3c87e50745
target-arm: Extend FP checks to use an EL
Extend the ARM disassemble context to take a target exception EL instead of a
boolean enable. This change reverses the polarity of the check making a value
of 0 indicate floating point enabled (no exception).

Backports commit 9dbbc748d671c70599101836cd1c2719d92f3017 from qemu
2018-02-12 23:04:19 -05:00
Peter Maydell a41d967577
target-arm: Make singlestate TB flags common between AArch32/64
Currently we keep the TB flags PSTATE_SS and SS_ACTIVE in different
bit positions for AArch64 and AArch32. Replace these separate
definitions with a single common flag in the upper part of the
flags word.

Backports commit 3cf6a0fcedd429693d439556543400d5f0e31e1d from qemu
2018-02-12 22:57:53 -05:00
Greg Bellows 8c674b105c
target-arm: Add AArch64 CPTR registers
Adds CPTR_EL2/3 system registers definitions and access function.

Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
[PMM: merge CPTR_EL2 and HCPTR definitions into a single
def using STATE_BOTH;
don't use readfn/writefn to implement RAZ/WI registers;
don't use accessfn for the no-EL2 CPTR_EL2;
fix cpacr_access logic to catch EL2 accesses to CPACR being
trapped to EL3;
use new CP_ACCESS_TRAP_EL[23] rather than setting
exception.target_el directly]

Backports commit c6f191642a4027909813b4e6e288411f8371e951 from qemu
2018-02-12 22:54:14 -05:00
Peter Maydell 4d695cc85a
target-arm: Allow cp access functions to indicate traps to EL2 or EL3
Some coprocessor access functions will need to indicate that the
instruction should trap to EL2 or EL3 rather than the default
target exception level; add corresponding CPAccessResult enum
entries and handling code.

Backports commit 38836a2cd47c20daaaa84873e3d6020f19e4bfca from qemu
2018-02-12 22:45:18 -05:00
Greg Bellows 5ad81f095a
target-arm: Update interrupt handling to use target EL
Updated the interrupt handling to utilize and report through the target EL
exception field. This includes consolidating and cleaning up code where
needed. Target EL is now calculated once in arm_cpu_exec_interrupt() and
do_interrupt was updated to use the target_el exception field. The
necessary code from arm_excp_target_el() was merged in where needed and the
function removed.

Backports commit 012a906b19e99b126403ff4a257617dab9b34163 from qemu
2018-02-12 22:42:37 -05:00
Peter Maydell 9a97c94297
target-arm: Make raise_exception() take syndrome and target EL
Rather than making every caller of raise_exception set the
syndrome and target EL by hand, make these arguments to
raise_exception() and have that do the job.

Backports commit c63285991b371c031147ad620dd7671662a90303 from qemu
2018-02-12 22:35:15 -05:00
Peter Maydell 99dfc46ffe
target-arm: Set exception target EL in tlb_fill
Set the exception target EL for MMU faults in tlb_fill.

Backports commit 863b6589d738d0b4c8b283297b0ff228f3d3fb14 from qemu
2018-02-12 22:29:48 -05:00
Peter Maydell 171bf0fc3e
target-arm: Move setting of exception info into tlb_fill
Move the code which sets exception information out of
arm_cpu_handle_mmu_fault and into tlb_fill. tlb_fill
is the only caller which wants to raise_exception()
so it makes more sense for it to handle the whole of
the exception setup.

As part of this cleanup, move the user-mode-only
implementation function for the handle_mmu_fault CPU
method into cpu.c so we don't need to make it globally
visible, and rename the softmmu-only utility function
arm_cpu_handle_mmu_fault to arm_tlb_fill so it's clear
that it's not the same thing.

Backports commit 8c6084bf10fe721929ca94cf16acd6687e61d3ec from qemu
2018-02-12 22:28:34 -05:00
Peter Maydell f0ed9c807c
target-arm: Set correct syndrome for faults on MSR DAIF*, imm
If the SCTLR.UMA trap bit is set then attempts by EL0 to update
the PSTATE DAIF bits via "MSR DAIFSet, imm" and "MSR DAIFClr, imm"
instructions will raise an exception. We were failing to set
the syndrome information for this exception, which meant that
it would be reported as a repeat of whatever the previous
exception was. Set the correct syndrome information.

Backports commit f2932df777dace044719dc2f394f5a5a8aa1b1cd from qemu
2018-02-12 22:21:05 -05:00
Greg Bellows 6b2502ac4f
target-arm: Extend helpers to route exceptions
Updated the various helper routines to set the target EL as needed using a
dedicated function.

Backports commit e3b1d480995f6e2e86ef062038e618c1234dbcf1 from qemu
2018-02-12 22:19:30 -05:00
Greg Bellows edd8066082
target-arm: Add exception target el infrastructure
Add a CPU state exception target EL field that will be used for communicating
the EL to which an exception should be routed.

Add a disassembly context field for tracking the EL3 architecture needed for
determining the target exception EL.

Add a target EL argument to the generic exception helper for callers to specify
the EL to which the exception should be routed. Extended the helper to set
the newly added CPU state exception target el.

Added a function for setting the target exception EL and updated calls to helpers
to call it.

Backports commit 737103619869600668cc7e8700e4f6eab3943896 from qemu
2018-02-12 22:17:02 -05:00
Edgar E. Iglesias d409bb50e2
target-arm: Remove unneeded '+'
Backports commit 18084b2f71b22b3ec3bf4828b8cb83d1d39e8502 from qemu
2018-02-12 21:38:14 -05:00
Edgar E. Iglesias efe96d29f3
target-arm: Correct accessfn for CNTV_TVAL_EL0
Backports commit b65c08ee1a05760c1c5a786a6cedf240f924c53e from qemu
2018-02-12 21:37:14 -05:00
Edgar E. Iglesias a28d3e4bb7
target-arm: Correct accessfn for CNTP_{CT}VAL_EL0
Backports commit 12cde08aaf571de65d3fbbdf93c83f0a4321267f from qemu
2018-02-12 21:36:10 -05:00
Greg Bellows 3951997c2a
target-arm: Add WFx syndrome function
Adds a utility function for creating a WFx exception syndrome

Backports commit 06fbb2fdf7a7ac468d62c66cfe4537d3c71f7bb9 from qemu
2018-02-12 21:33:19 -05:00
Greg Bellows dbe23a7196
target-arm: Add EL3 and EL2 TCR checking
Updated get_phys_addr_lpae to check the appropriate TTBCR/TCR depending on the
current EL. Support includes using the different TCR format as well as checks to
insure TTBR1 is not used when in EL2 or EL3.

Backports commit 88e8add8b6656c349a96b447b074688d02dc5415 from qemu
2018-02-12 21:31:58 -05:00
Greg Bellows 61c9858458
target-arm: Add TTBR regime function and use
Add a utility function for choosing the correct TTBR system register based on
the specified MMU index. Add use of function on physical address lookup.

Backports commit aef878be4e7ab1bdb30b408007320400b0a29c83 from qemu
2018-02-12 21:29:35 -05:00
Peter Crosthwaite 5c41e8e7ed
target-arm: cpu64: Add support for Cortex-A53
Add the ARM Cortex-A53 processor definition. Similar to A57, but with
different L1 I cache policy, phys addr size and different cache
geometries. The cache sizes is implementation configurable, but use
these values (from Xilinx Zynq MPSoC) as a default until cache size
configurability is added.

Backports commit e35310260ec57d20301c65a5714ca55369e971cc from qemu
2018-02-12 21:26:34 -05:00
Peter Crosthwaite 91cf36e372
target-arm: cpu64: generalise name of A57 regs
Rename some A57 CP register variables in preparation for support for
Cortex A53. Use "a57_a53" to describe the shareable features. Some of
the CP15 registers (such as ACTLR) are specific to implementation, but
we currently just RAZ them so continue with that as the policy for both
A57 and A53 processors under a shared definition.

Backports commit ee804264ddc4d3cd36a5183a09847e391da0fc66 from qemu
2018-02-12 21:23:48 -05:00
Peter Crosthwaite 3501c34344
tcg: Delete unused cpu_pc_from_tb()
No code uses the cpu_pc_from_tb() function. Delete from tricore and
arm which each provide an unused implementation. Update the comment
in tcg.h to reflect that this is obsoleted by synchronize_from_tb.

Backports commit fee068e4f190a36ef3bda9aa7c802f90434ef8e5 from qemu
2018-02-12 21:14:22 -05:00
Peter Crosthwaite 8adf6aff7c
arm: cpu.h: Remove unused typdefs
These CP accessor function prototypes are unused. Remove them.

Backports commit ef1d27f4b17c4238ed3395724026910973026d2b from qemu
2018-02-12 21:11:58 -05:00
Sergey Fedorov 96a99a1bbe
Allow ARMv8 SCR.SMD updates
Updated scr_write to always allow updates to the SCR.SMD bit on ARMv8
regardless of whether virtualization (EL2) is enabled or not.

Backports commit 4eb276408363aef5435a72a8e818f24220b5edd0 from qemu
2018-02-12 20:48:34 -05:00
Sergey Fedorov f748c278b2
target-arm: Adjust id_aa64pfr0 when has_el3 CPU property disabled 2018-02-12 20:47:32 -05:00
Sergey Fedorov dd9e33bb6d
target-arm: rename c1_coproc to cpacr_el1
Rename the field holding CPACR_EL1 system register state in AArch64
naming style.

Backports commit 7ebd5f2e03a00889619bb97e83062d27066d4a26 from qemu
2018-02-12 20:46:00 -05:00
Peter Maydell e1a7c13fb4
target-arm: Add user-mode transaction attribute
Add a transaction attribute indicating that a memory access is being
done from user-mode (unprivileged). This corresponds to an equivalent
signal in ARM AMBA buses.

Backports commit 0995bf8cd91b81ec9c1078e37b808794080dc5c0 from qemu
2018-02-12 20:41:58 -05:00
Peter Maydell 2281d6c4c9
target-arm: Use correct memory attributes for page table walks
Factor out the page table walk memory accesses into their own function,
so that we can specify the correct S/NS memory attributes for them.
This will also provide a place to use the correct endianness and
handle the need for a stage-2 translation when virtualization is
supported.

Backports commit ebca90e4c3aaaae5ed1ee7c569dea00d5d6ed476 from qemu
2018-02-12 20:40:19 -05:00
Peter Maydell 6c8b7e0fed
target-arm: Honour NS bits in page tables
Honour the NS bit in ARM page tables:
* when adding entries to the TLB, include the Secure/NonSecure
transaction attribute
* set the NS bit in the PAR when doing ATS operations

Note that we don't yet correctly use the NSTable bit to
cause the page table walk itself to use the right attributes.

Backports commit 8bf5b6a9c1911d2c8473385fc0cebfaaeef42dbc from qem
2018-02-12 20:36:35 -05:00
Andrew Jones 92b1f22a45
target-arm: get_phys_addr_lpae: more xn control
This patch makes the following changes to the determination of
whether an address is executable, when translating addresses
using LPAE.

1. No longer assumes that PL0 can't execute when it can't read.
   It can in AArch64, a difference from AArch32.
2. Use va_size == 64 to determine we're in AArch64, rather than
   arm_feature(env, ARM_FEATURE_V8), which is insufficient.
3. Add additional XN determinants
   - NS && is_secure && (SCR & SCR_SIF)
   - WXN && (prot & PAGE_WRITE)
   - AArch64: (prot_PL0 & PAGE_WRITE)
   - AArch32: UWXN && (prot_PL0 & PAGE_WRITE)
   - XN determination should also work in secure mode (untested)
   - XN may even work in EL2 (currently impossible to test)
4. Cleans up the bloated PAGE_EXEC condition - by removing it.

The helper get_S1prot is introduced. It may even work in EL2,
when support for that comes, but, as the function name implies,
it only works for stage 1 translations.

Backports commit d8e052b387635639a6ba4a09a7874fd2f113b218 from qemu
2018-02-12 20:28:29 -05:00
Andrew Jones ea94701bd0
target-arm: fix get_phys_addr_v6/SCTLR_AFE access check
Introduce simple_ap_to_rw_prot(), which has the same behavior as
ap_to_rw_prot(), but takes the 2-bit simple AP[2:1] instead of
the 3-bit AP[2:0]. Use this in get_phys_addr_v6 when SCTLR_AFE
is set, as that bit indicates we should be using the simple AP
format.

It's unlikely this path is getting used. I don't see CR_AFE
getting used by Linux, so possibly not. If it had been, then
the check would have been wrong for all but AP[2:1] = 0b11.
Anyway, this should fix it up, in case it ever does get used.

Backports commit d76951b65dfb1be4e41cfae6abebf8db7a1243a3 from qemu
2018-02-12 20:22:55 -05:00
Andrew Jones dd8d05620f
target-arm: convert check_ap to ap_to_rw_prot
Instead of mixing access permission checking with access permissions
to page protection flags translation, just do the translation, and
leave it to the caller to check the protection flags against the access
type. Also rename to ap_to_rw_prot to better describe the new behavior.

Backports commit 0fbf5238203041f734c51b49778223686f14366b from qemu
2018-02-12 20:17:49 -05:00
Peter Maydell db9901f2ad
target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strd
A LDRD or STRD where rd is not an even number is UNPREDICTABLE.
We were letting this fall through, which is OK unless rd is 15,
in which case we would attempt to do a load_reg or store_reg
to a nonexistent r16 for the second half of the double-word.
Catch the odd-numbered-rd cases and UNDEF them instead.

To do this we rearrange the structure of the code a little
so we can put the UNDEF catches at the top before we've
allocated TCG temporaries.

Backports commit a4bb522ee51087af61998f290d12ba2e14c7910e from qemu
2018-02-12 17:17:23 -05:00
Peter Maydell d723e590f2
target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc)
The AArch64 SPSR_EL1 register is architecturally mandated to
be mapped to the AArch32 SPSR_svc register. This means its
state should live in QEMU's env->banked_spsr[1] field.
Correct the various places in the code that incorrectly
put it in banked_spsr[0].

Backports commit 7847f9ea9fce15a9ecfb62ab72c1e84ff516b0db from qemu
2018-02-12 16:36:44 -05:00
Peter Maydell 6bd44fb70a
target-arm: Ignore low bit of PC in M-profile exception return
For the ARM M-profile cores, exception return pops various registers
including the PC from the stack. The architecture defines that if the
lowest bit in the new PC value is set (ie the PC is not halfword
aligned) then behaviour is UNPREDICTABLE. In practice hardware
implementations seem to simply ignore the low bit, and some buggy
RTOSes incorrectly rely on this. QEMU's behaviour was architecturally
permitted, but bringing QEMU into line with the hardware behaviour
allows more guest code to run. We log the situation as a guest error.

This was reported as LP:1428657.

Backports commit fcf83ab103dce6d2951f24f48e30820e7dbb3622 from qemu
2018-02-12 16:18:07 -05:00
Peter Maydell 3497be0faa
target-arm: Fix handling of STM (user) with r15 in register list
The A32 encoding of LDM distinguishes LDM (user) from LDM (exception
return) based on whether r15 is in the register list. However for
STM (user) there is no equivalent distinction. We were incorrectly
treating "r15 in list" as indicating exception return for both LDM
and STM, with the result that an STM (user) involving r15 went into
an infinite loop. Fix this; note that the value stored for r15
in this case is the current PC regardless of our current mode.

Backports commit da3e53ddcb0ca924da97ca5a35605fc554aa3e05 from qemu
2018-02-12 16:16:05 -05:00
Peter Maydell 8287ec801e
target-arm: A64: Avoid signed shifts in disas_ldst_pair()
Avoid shifting potentially negative signed offset values in
disas_ldst_pair() by keeping the offset in a uint64_t rather
than an int64_t.

Backports commit c2ebd862a54b7e12175d65c03ba259926cb2237a from qemu
2018-02-12 15:05:09 -05:00
Peter Maydell 4ea6fdc986
target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr
Shifting a negative integer left is undefined behaviour in C.
Avoid it by assembling and shifting the offset fields as
unsigned values and then sign extending as the final action.

Backports commit 037e1d009e2fcb80784d37f0e12aa999787d46d4 from qemu
2018-02-12 15:04:03 -05:00
Peter Maydell 0e9a6a26f5
target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask
The code in logic_imm_decode_wmask attempts to rotate a mask
value within the bottom 'e' bits of the value with
mask = (mask >> r) | (mask << (e - r));
This has two issues:
* if the element size is 64 then a rotate by zero results
in a shift left by 64, which is undefined behaviour
* if the element size is smaller than 64 then this will
leave junk in the value at bit 'e' and above, which is
not valid input to bitfield_replicate(). As it happens,
the bits at bit 'e' to '2e - r' are exactly the ones
which bitfield_replicate is going to copy in there,
so this isn't a "wrong code generated" bug, but it's
confusing and if we ever put an assert in
bitfield_replicate it would fire on valid guest code.

Fix the former by not doing anything if r is zero, and
the latter by masking with bitmask64(e).

Backports commit e167adc9d9f5df4f8109aecd4552c407fdce094a from qemu
2018-02-12 15:02:34 -05:00
Peter Maydell b95cba4677
target-arm: A64: Fix shifts into sign bit
Fix attempts to shift into the sign bit of an int, which is undefined
behaviour in C and warned about by the clang sanitizer.

Backports commit 1743d55c8b38bcee632cf6eb2de81131635bb3d2 from qemu
2018-02-12 15:01:10 -05:00
Greg Bellows 8612f1d3e7
target-arm: Add 32/64-bit register sync
Add AArch32 to AArch64 register sychronization functions.
Replace manual register synchronization with new functions in
aarch64_cpu_do_interrupt() and HELPER(exception_return)().

Backports commit ce02049dbf1828b4bc77d921b108a9d84246e5aa from qemu
2018-02-12 14:57:20 -05:00
Greg Bellows 4df1ce63b8
target-arm: Add CPU property to disable AArch64
Adds registration and get/set functions for enabling/disabling the AArch64
execution state on AArch64 CPUs. By default AArch64 execution state is enabled
on AArch64 CPUs, setting the property to off, will disable the execution state.
The below QEMU invocation would have AArch64 execution state disabled.

$ ./qemu-system-aarch64 -machine virt -cpu cortex-a57,aarch64=off

Also adds stripping of features from CPU model string in acquiring the ARM CPU
by name.

Backports part of commit fb8d6c24b095c426151b9bba8c8b0e58b03d6503 from qemu
2018-02-12 13:56:44 -05:00
Ildar Isaev 73fa78f0bc
target-arm: fix for exponent comparison in recpe_f64
f64 exponent in HELPER(recpe_f64) should be compared to 2045 rather than 1023
(FPRecipEstimate in ARMV8 spec). This fixes incorrect underflow handling when
flushing denormals to zero in the FRECPE instructions operating on 64-bit
values.

Backports commit fc1792e9aa36227ee9994757974f9397684e1a48 from qemu
2018-02-12 12:04:39 -05:00
Pranavkumar Sawargaonkar 30f4d72db5
target-arm: Guest cpu endianness determination for virtio KVM ARM/ARM64
This patch implements a fucntion pointer "virtio_is_big_endian"
from "CPUClass" structure for arm/arm64.
Function arm_cpu_is_big_endian() is added to determine and
return the guest cpu endianness to virtio.
This is required for running cross endian guests with virtio on ARM/ARM64.

Backports commit 84f2bed3cf505f90b7918e2de32e11da27160563 from qemu
2018-02-12 12:03:10 -05:00
Peter Maydell e3c3cccb7a
target-arm: Fix brace style in reindented code
This patch fixes the brace style in the code reindented in the
previous commit.

Backports commit 87c3d486150917c8e286d29166c98a2035377b52 from qemu
2018-02-12 11:56:39 -05:00
Peter Maydell 11c6c143d7
target-arm: Reindent ancient page-table-walk code
A few of the oldest parts of the page-table-walk code have broken indent
(either hardcoded tabs or two-spaces). Reindent these sections.

For ease of review, this patch does not touch the brace style and
so is a whitespace-only change.

Backports commit 554b0b09aec4579c8164f363b18a263150e91a2c from qemu
2018-02-12 11:54:11 -05:00
Peter Maydell 0046642958
target-arm: Use mmu_idx in get_phys_addr()
Now we have the mmu_idx in get_phys_addr(), use it correctly to
determine the behaviour of virtual to physical address translations,
rather than using just an is_user flag and the current CPU state.

Some TODO comments have been added to indicate where changes will
need to be made to add EL2 and 64-bit EL3 support.

Backports commit 0480f69abf849ca0d48928cc6c669c1c7264239b from qemu
2018-02-12 11:49:55 -05:00
Peter Maydell 6031ae6540
target-arm: Pass mmu_idx to get_phys_addr()
Make all the callers of get_phys_addr() pass it the correct
mmu_idx rather than just a simple "is_user" flag. This includes
properly decoding the AT/ATS system instructions; we include the
logic for handling all the opc1/opc2 cases because we'll need
them later for supporting EL2/EL3, even if we don't have the
regdef stanzas yet.

Backports commit d364970287c0ba68979711928c15e5d37414f87f from qemu
2018-02-12 11:41:38 -05:00
Peter Maydell 04f30f91ed
target-arm: Split AArch64 cases out of ats_write()
Instead of simply reusing ats_write() as the handler for both AArch32
and AArch64 address translation operations, use a different function
for each with the common code in a third function. This is necessary
because the semantics for selecting the right translation regime are
different; we are only getting away with sharing currently because
we don't support EL2 and only support EL3 in AArch32.

Backports commit 060e8a48cb84d41d4ac36e4bb29d9c14ed7168b6 from qemu
2018-02-12 11:36:11 -05:00
Peter Maydell c0c5508a25
target-arm: Don't define any MMU_MODE*_SUFFIXes
target-arm doesn't use any of the MMU-mode specific cpu ldst
accessor functions. Suppress their generation by not defining
any of the MMU_MODE*_SUFFIX macros. ("user" and "kernel" are
too simplistic as descriptions of indexes 0 and 1 anyway.)

Backports commit 0dfef7b58f0c24b463e36630f08a45e93012b33a from qemu
2018-02-12 11:29:41 -05:00
Peter Maydell da216e211f
target-arm: Use correct mmu_idx for unprivileged loads and stores
The MMU index to use for unprivileged loads and stores is more
complicated than we currently implement:
* for A64, it should be "if at EL1, access as if EL0; otherwise
access at current EL"
* for A32/T32, it should be "if EL2, UNPREDICTABLE; otherwise
access as if at EL0".

In both cases, if we want to make the access for Secure EL0
this is not the same mmu_idx as for Non-Secure EL0.

Backports commit 579d21cce63f3dd2f6ee49c0b02a14e92cb4a836 from qemu
2018-02-12 11:28:17 -05:00
Peter Maydell 3261ed5801
target-arm: Define correct mmu_idx values and pass them in TB flags
We currently claim that for ARM the mmu_idx should simply be the current
exception level. However this isn't actually correct -- secure EL0 and EL1
should have separate indexes from non-secure EL0 and EL1 since their
VA->PA mappings may differ. We also will want an index for stage 2
translations when we properly support EL2.

Define and document all seven mmu index values that we require, and
pass the mmu index in the TB flags rather than exception level or
priv/user bit.

This change doesn't update the get_phys_addr() code, so our page
table walking still assumes a simplistic "user or priv?" model for
the moment.

Backports commit c1e3781090b9d36c60e1a254ba297cb34011d3d4 from qemu
2018-02-12 11:21:19 -05:00
Peter Maydell ec4dae08e4
target-arm: Make arm_current_el() return sensible values for M profile
Although M profile doesn't have the same concept of exception level
as A profile, it does have a notion of privileged versus not, which
we currently track in the privmode TB flag. Support returning this
information if arm_current_el() is called on an M profile core, so
that we can identify the correct MMU index to use (and put the MMU
index in the TB flags) without having to special-case M profile.

Backports commit 6d54ed3c93f1e05a483201b087142998381c9be8 from qemu
2018-02-12 11:07:49 -05:00
Kirill Batuzov d45ea1ba3b
target-arm: check that LSB <= MSB in BFI instruction
The documentation states that if LSB > MSB in BFI instruction behaviour
is unpredictable. Currently QEMU crashes because of assertion failure in
this case:

tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed.

While assertion failure may meet the "unpredictable" definition this
behaviour is undesirable because it allows an unprivileged guest program
to crash the emulator with the OS and other programs.

This patch addresses the issue by throwing illegal instruction exception
if LSB > MSB. Only ARM decoder is affected because Thumb decoder already
has this check in place.

To reproduce issue run the following program

int main(void) {
asm volatile (".long 0x07c00c12" :: );
return 0;
}

compiled with
gcc -marm -static badop_arm.c -o badop_arm

Backports commit 45140a57675ecb4b0daee71bf145c24dbdf9429c from qemu
2018-02-12 11:06:12 -05:00
Peter Maydell 1c275134ae
target-arm: Squash input denormals in FRECPS and FRSQRTS
The helper functions for FRECPS and FRSQRTS have special case
handling that includes checks for zero inputs, so squash input
denormals if necessary before those checks. This fixes incorrect
output when the FPCR DZ bit is set to enable squashing of input
denormals.

Backports commit a8eb6e19991d1a7a6a7b04ac447548d30d75eb4a from qemu
2018-02-12 11:04:28 -05:00
Peter Maydell 337e658869
target-arm: Add checks that cpreg raw accesses are handled
Add assertion checking when cpreg structures are registered that they
either forbid raw-access attempts or at least make an attempt at
handling them. Also add an assert in the raw-accessor-of-last-resort,
to avoid silently doing a read or write from offset zero, which is
actually AArch32 CPU register r0.

Backports commit 375421ccaeebae8212eb8f9a36835ad4d9dc60a8 from qemu
2018-02-12 11:02:00 -05:00
Peter Maydell 52afb392f2
target-arm: Split NO_MIGRATE into ALIAS and NO_RAW
We currently mark ARM coprocessor/system register definitions with
the flag ARM_CP_NO_MIGRATE for two different reasons:
1) register is an alias on to state that's also visible via
some other register, and that other register is the one
responsible for migrating the state
2) register is not actually state at all (for instance the TLB
or cache maintenance operation "registers") and it makes no
sense to attempt to migrate it or otherwise access the raw state

This works fine for identifying which registers should be ignored
when performing migration, but we also use the same functions for
synchronizing system register state between QEMU and the kernel
when using KVM. In this case we don't want to try to sync state
into registers in category 2, but we do want to sync into registers
in category 1, because the kernel might have picked a different
one of the aliases as its choice for which one to expose for
migration. (In particular, on 32 bit hosts the kernel will
expose the state in the AArch32 version of the register, but
TCG's convention is to mark the AArch64 version as the version
to migrate, even if the CPU being emulated happens to be 32 bit,
so almost all system registers will hit this issue now that we've
added AArch64 system emulation.)

Fix this by splitting the NO_MIGRATE flag in two (ALIAS and NO_RAW)
corresponding to the two different reasons we might not want to
migrate a register. When setting up the TCG list of registers to
migrate we honour both flags; when populating the list from KVM,
only ignore registers which are NO_RAW.

Backports commit 7a0e58fa648736a75f2a6943afd2ab08ea15b8e0 from qemu
2018-02-12 10:59:36 -05:00
Greg Bellows 301c3737e3
target-arm: Add missing SP_ELx register definition
Added CP register definitions for SP_EL1 and SP_EL2.

Backports commit 884b4deeeb8b158ed3db5792161902bc8b41b62d from qemu
2018-02-12 10:40:53 -05:00
Greg Bellows cce21771b3
target-arm: Change reset to highest available EL
Update to arm_cpu_reset() to reset into the highest available exception level
based on the set ARM features.

Backports commit 5097227c15aa89baec1123aac25dd9500a62684d from qemu
2018-02-12 10:40:53 -05:00
Greg Bellows 2cce33295b
target-arm: Add extended RVBAR support
Added RVBAR_EL2 and RVBAR_EL3 CP register support. All RVBAR_EL# registers
point to the same location and only the highest EL version exists at any one
time.

Backports commit be8e8128595b41b9f609c1507e67d121e65e7173 from qemu
2018-02-12 10:40:53 -05:00
Greg Bellows 6c33ec25fc
target-arm: Fix RVBAR_EL1 register encoding
Fix the RVBAR_EL1 CP register opc2 encoding from 2 to 1

Backports commit 569b49f864e7593a14182acae5a7f5981f6ec24f from qemu
2018-02-12 10:40:53 -05:00
Ard Biesheuvel 9b28dc55c8
target-arm: crypto: fix BE host support
The crypto emulation code in target-arm/crypto_helper.c never worked
correctly on big endian hosts, due to the fact that it uses a union
of array types to convert between the native VFP register size (64
bits) and the types used in the algorithms (bytes and 32 bit words)

We cannot just swab between LE and BE when reading and writing the
registers, as the SHA code performs word additions, so instead, add
array accessors for the CRYPTO_STATE type whose LE and BE specific
implementations ensure that the correct array elements are referenced.

Backports commit b449ca3c1874418d948878d5417a32fc0dbf9fea from qemu
2018-02-12 10:40:52 -05:00
Fabian Aggeler 912d271a9b
target-arm: add cpu feature EL3 to CPUs with Security Extensions
Set ARM_FEATURE_EL3 feature for CPUs that implement Security Extensions.

Backports commit c0ccb02db46c72b4b0fa8a475a6890c1e28064f0 from qemu
2018-02-12 10:40:52 -05:00
Greg Bellows e1576f314e
target-arm: Add ARMCPU secure property
Added a "has_el3" state property to the ARMCPU descriptor. This property
indicates whether the ARMCPU has security extensions enabled (EL3) or not.
By default it is disabled at this time.

Backports commit 51942aee3c51ca23b0dd78f95534a57e8dc1e582 from qemu
2018-02-12 10:40:52 -05:00
Greg Bellows 1d3719a39f
target-arm: Add feature unset function
Add an unset_feature() function to compliment the set_feature() function. This
will be used to disable functions after they have been enabled during
initialization.

Backports commit 08828484a5c1ec55a6cbb4b4d377bfcf41199b5c from qemu
2018-02-12 10:40:52 -05:00
Greg Bellows c457067e47
target-arm: Merge EL3 CP15 register lists
Merge of the v8_el2_cp_reginfo and el3_cp_reginfo ARMCPRegInfo lists.
Previously, some EL3 registers were restricted to the ARMv8 list under the
impression that they were not needed on ARMv7. However, this is not the case
as the ARMv7/32-bit variants rely on the ARMv8/64-bit variants to handle
migration and reset. For this reason they must always exist.

Backports commit 60fb1a87b47b14e4ea67043aa56f353e77fbd70a from qemu
2018-02-12 10:40:52 -05:00
Greg Bellows b711147cc3
target-arm: make MAIR0/1 banked
Added CP register info entries for the ARMv7 MAIR0/1 secure banks.

Backports commit be693c87e440e671ed913784554384349ce8331d from qemu
2018-02-12 10:40:52 -05:00
Fabian Aggeler 4bf69e19c6
target-arm: make c13 cp regs banked (FCSEIDR, ...)
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
FCSEIDR, CONTEXTIDR, TPIDRURW, TPIDRURO and TPIDRPRW have a secure
and a non-secure instance.

Backports commit 54bf36ed351c526cde0c853079f9ff1ab7e2ff89 from qemu
2018-02-12 10:40:51 -05:00
Greg Bellows 153e7e7331
target-arm: make VBAR banked
When EL3 is running in Aarch32 (or ARMv7 with Security Extensions)
VBAR has a secure and a non-secure instance, which are mapped to
VBAR_EL1 and VBAR_EL3.

Backports commit fb6c91ba2bb0b1c1b8662ceeeeb9474a025f9a6b from qemu
2018-02-12 10:40:51 -05:00
Fabian Aggeler ccccef3d41
target-arm: make PAR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
PAR has a secure and a non-secure instance.

Backports commit 01c097f7960b330c4bf038d34bae17ad6c1ba499 from qemu
2018-02-12 10:40:51 -05:00
Fabian Aggeler ff1ca0608d
target-arm: make IFAR/DFAR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
IFAR and DFAR have a secure and a non-secure instance.

Backports commit b848ce2b9cbd38da3f2530fd93dba76dba0621c0 from qemu
2018-02-12 10:40:51 -05:00
Fabian Aggeler 27ba8b30c5
target-arm: make DFSR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
DFSR has a secure and a non-secure instance.

Backports commit 4a7e2d7315bd2ce28e49ccd0bde73eabdfd7437b from qemu
2018-02-12 10:40:51 -05:00
Fabian Aggeler 192c5c665a
target-arm: make IFSR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
IFSR has a secure and a non-secure instance. Adds IFSR32_EL2 definition and
storage.

Backports commit 88ca1c2d70523486a952065f3ed7b8fc823b5863 from qemu
2018-02-12 10:40:45 -05:00
Fabian Aggeler e955687ca5
target-arm: make DACR banked
When EL3 is running in AArch32 (or ARMv7 with Security Extensions)
DACR has a secure and a non-secure instance. Adds definition for DACR32_EL2.

Backports commit 0c17d68c1d3d6c35f37f5692042d2edb65c8bcc0 from qemu
2018-02-12 09:01:38 -05:00
Fabian Aggeler e90e4b7190
target-arm: make TTBCR banked
Adds secure and non-secure bank register suport for TTBCR.
Added new struct to compartmentalize the TCR data and masks. Removed old
tcr/ttbcr data and added a 4 element array of the new structs in cp15. This
allows for one entry per EL. Added a CP register definition for TCR_EL3.

Backports commit 11f136ee25232a00f433cefe98ee33cd614ecccc from qemu
2018-02-11 19:59:03 -05:00
Fabian Aggeler adf48a1f81
target-arm: make TTBR0/1 banked
Adds secure and non-secure bank register suport for TTBR0 and TTBR1.
Changes include adding secure and non-secure instances of ttbr0 and ttbr1 as
well as a CP register definition for TTBR0_EL3. Added a union containing
both EL based array fields and secure and non-secure fields mapped to them.
Updated accesses to use A32_BANKED_CURRENT_REG_GET macro.

Backports commit 7dd8c9af0d9d18fb3e54a4843b3bb1398bd330bc to qemu
2018-02-11 19:46:15 -05:00
Fabian Aggeler 673cb7d93e
target-arm: make CSSELR banked
Rename CSSELR (cache size selection register) and add secure
instance (AArch32).

Backports commit b85a1fd61c4d72c7928cd9b70f9f59fb2895936d from qemu
2018-02-11 19:35:02 -05:00
Fabian Aggeler 44fc779c6a
target-arm: respect SCR.FW, SCR.AW and SCTLR.NMFI
Add checks of SCR AW/FW bits when performing writes of CPSR. These SCR bits
are used to control whether the CPSR masking bits can be adjusted from
non-secure state.

Backports commit 6e8801f9dea9e10449f4fd7d85dbe8cab708a686 from qemu
2018-02-11 19:30:21 -05:00
Fabian Aggeler 9087027b85
target-arm: add SCTLR_EL3 and make SCTLR banked
Implements SCTLR_EL3 and uses secure/non-secure instance when
needed.

Backports commit 137feaa9a1622620adf19c0b707883dd990738e2 from qemu
2018-02-11 19:28:34 -05:00
Fabian Aggeler ca0608f68d
target-arm: add MVBAR support
Use MVBAR register as exception vector base address for
exceptions taken to CPU monitor mode.

Backports commit e89e51a17ea0d8aef9bf9b766c98f963e835fbf2 from qemu
2018-02-11 19:09:28 -05:00
Greg Bellows e49d9d3f30
target-arm: add SDER definition
Added CP register defintions for SDER and SDER32_EL3 as well as cp15.sder for
register storage.

Backports commit 144634ae6c1618dcee6aced9c0d4427844154091 from qemu
2018-02-11 19:03:18 -05:00
Fabian Aggeler 461944980c
target-arm: add NSACR register
Implements NSACR register with corresponding read/write functions
for ARMv7 and ARMv8.

Backports commit 770225764f831031d2e1453f69c365eb1b647d87 from qemu
2018-02-11 18:57:34 -05:00
Fabian Aggeler f120ad5308
target-arm: implement IRQ/FIQ routing to Monitor mode
SCR.{IRQ/FIQ} bits allow to route IRQ/FIQ exceptions to monitor CPU
mode. When taking IRQ exception to monitor mode FIQ exception is
additionally masked.

Backports commit de38d23b542efca54108ef28bcc0efe96f378d2e from qemu
2018-02-11 18:51:21 -05:00
Fabian Aggeler 4d9c9f893e
target-arm: move AArch32 SCR into security reglist
Define a new ARM CP register info list for the ARMv7 Security Extension
feature. Register that list only for ARM cores with Security Extension/EL3
support. Moving AArch32 SCR into Security Extension register group.

Backports commit 0f1a3b2470d798ad5335eb9d6236f02ff64e31a8 from qemu
2018-02-11 18:48:33 -05:00
Fabian Aggeler 3494160ea6
target-arm: insert AArch32 cpregs twice into hashtable
Prepare for cp register banking by inserting every cp register twice,
once for secure world and once for non-secure world.

Backports commit 3f3c82a57d128aa3ec823aa8032867c3a6e2e795 from qemu
2018-02-11 18:41:25 -05:00
Peter Maydell fb78e79d72
target-arm: add secure state bit to CPREG hash
Added additional NS-bit to CPREG hash encoding. Updated hash lookup
locations to specify hash bit currently set to non-secure.

Backports commit 51a79b039728277e35fd19f7a7b4bc6cb323697f from qemu
2018-02-11 18:35:52 -05:00
Fabian Aggeler 4f5106b56d
target-arm: add CPREG secure state support
Prepare ARMCPRegInfo to support specifying two fieldoffsets per
register definition. This will allow us to keep one register
definition for banked registers (different offsets for secure/
non-secure world).

Also added secure state tracking field and flags. This allows for
identification of the register info secure state.

Backports commit c3e302606253a17568dc3ef30238f102468f7ee1 from qemu
2018-02-11 18:29:35 -05:00
Sergey Fedorov acdd665668
target-arm: add non-secure Translation Block flag
This patch is based on idea found in patch at
git://github.com/jowinter/qemu-trustzone.git
f3d955c6c0ed8c46bc0eb10b634201032a651dd2 by
Johannes Winter <johannes.winter@iaik.tugraz.at>.

The TBFLAG captures the SCR NS secure state at the time when a TB is created so
the correct bank is accessed on system register accesses.

Backports commit 3f342b9e0e64ad681cd39840bfa75ef12d2807c1 from qemu
2018-02-11 17:50:46 -05:00
Fabian Aggeler 90c47cb40f
target-arm: add banked register accessors
If EL3 is in AArch32 state certain cp registers are banked (secure and
non-secure instance). When reading or writing to coprocessor registers
the following macros can be used.

- A32_BANKED macros are used for choosing the banked register based on provided
input security argument. This macro is used to choose the bank during
translation of MRC/MCR instructions that are dependent on something other
than the current secure state.
- A32_BANKED_CURRENT macros are used for choosing the banked register based on
current secure state. This is NOT to be used for choosing the bank used
during translation as it breaks monitor mode.

If EL3 is operating in AArch64 state coprocessor registers are not
banked anymore. The macros use the non-secure instance (_ns) in this
case, which is architecturally mapped to the AArch64 EL register.

Backports commit ea30a4b824ecc3c829b70eb9999ac5457dc5790f from qemu
2018-02-11 17:46:52 -05:00
Greg Bellows 67d68df401
target-arm: add async excp target_el function
Adds a dedicated function and a lookup table for determining the target
exception level of IRQ and FIQ exceptions. The lookup table is taken from the
ARMv7 and ARMv8 specification exception routing tables.

Backports commit 0eeb17d618361a0f4faddc160e33598b23da6dd5 from qemu
2018-02-11 17:45:09 -05:00
Lioncash 2d8f0be9f8
target-arm: extend async excp masking
This patch extends arm_excp_unmasked() to use lookup tables for determining
whether IRQ and FIQ exceptions are masked. The lookup tables are based on the
ARMv8 and ARMv7 specification physical interrupt masking tables.

If EL3 is using AArch64 IRQ/FIQ masking is ignored in all exception levels
other than EL3 if SCR.{FIQ|IRQ} is set to 1 (routed to EL3).

Backports commit 57e3a0c7cb0ac2f0288890482e0a463adce2080a from qemu
2018-02-11 17:38:59 -05:00
Richard Henderson 2c091e5fb8
target-arm: Add condexec state to insn_start
Backports commit 52e971d9ff67e340ac2a86bd67e14bd31c7991e0 from qemu
2018-02-11 15:13:40 -05:00
Richard Henderson dd1ec408e5
target-*: Increment num_insns immediately after tcg_gen_insn_start
This does tidy the icount test common to all targets.

Backports commit 959082fc4a93a016a6b697e1e0c2b373d8a3a373 from qemu
2018-02-11 12:46:30 -05:00
Richard Henderson a64d0ff657
target-*: Unconditionally emit tcg_gen_insn_start
While we're at it, emit the opcode adjacent to where we currently
record data for search_pc. This puts gen_io_start et al on the
"correct" side of the marker.

Backports commit 667b8e29c5b1d8c5b4e6ad5f780ca60914eb6e96 from qemu
2018-02-11 12:41:20 -05:00
Lioncash b3f9ff667b
tcg: Rename debug_insn_start to insn_start
With an eye toward making it mandatory.

Backports commit 765b842adec4c5a359e69ca08785553599f71496 from qemu
2018-02-11 12:34:01 -05:00
Lioncash 3791fc69fd
target-arm: Use new revbit functions
Backports commit 42fedbca8f5b54324ed89be3484d4a3dc9946387 from qemu
2018-02-11 02:57:55 -05:00
Richard Henderson eb5ed2a844
target-arm: Use tcg_gen_extrh_i64_i32
Usually, eliminate an operation from the translator by combining
a shift with an extract.

In the case of gen_set_NZ64, we don't need a boolean value for cpu_ZF,
merely a non-zero value. Given that we can extract both halves of a
64-bit input in one call, this simplifies the code.

Backports commit 7cb36e18b2f1c1f971ebdc2121de22a8c2e94fd6 from qemu
2018-02-11 02:57:54 -05:00
Richard Henderson b94da3fc13
target-arm: Recognize ROR
Backports commit 8fb0ad8e16ab3d03433244a1a03e1df757342ad8 from qemu
2018-02-11 02:57:33 -05:00