Commit graph

141 commits

Author SHA1 Message Date
Aaron Lindsay 4ed7524444
target/arm: Fix bitmask for PMCCFILTR writes
It was shifted to the left one bit too few.

Backports commit ac57fd24cd864d42e7551f82266bc0930bd39547 from qemu
2018-04-26 09:23:04 -04:00
Aaron Lindsay 99a0be89a8
target/arm: Add pre-EL change hooks
Because the design of the PMU requires that the counter values be
converted between their delta and guest-visible forms for mode
filtering, an additional hook which occurs before the EL is changed is
necessary.

Backports commit b5c53d1b3886387874f8c8582b205aeb3e4c3df6 from qemu
2018-04-26 09:21:54 -04:00
Aaron Lindsay 1228bcf45d
target/arm: Mask PMU register writes based on PMCR_EL0.N
This is in preparation for enabling counters other than PMCCNTR

Backports commit 7ece99b17e832065236c07a158dfac62619ef99b from qemu
2018-04-26 09:09:12 -04:00
Aaron Lindsay e1d021ad74
target/arm: Treat PMCCNTR as alias of PMCCNTR_EL0
They share the same underlying state

Backports commit 169c893874977eee8303a6dad4a3f25c5464858f from qemu
2018-04-26 09:07:50 -04:00
Aaron Lindsay e1bffbf7df
target/arm: Check PMCNTEN for whether PMCCNTR is enabled
Backports commit ccbc0e338486b21cb0eb52e52cd309bbbe6a7507 from qemu
2018-04-26 09:07:02 -04:00
Peter Maydell 43e7478d3f
target/arm: Use v7m_stack_read() for reading the frame signature
In commit 95695effe8caa552b8f2 we changed the v7M/v8M stack
pop code to use a new v7m_stack_read() function that checks
whether the read should fail due to an MPU or bus abort.
We missed one call though, the one which reads the signature
word for the callee-saved register part of the frame.

Correct the omission.

Backports commit 4818bad98c8212fbbb0525d10761b6b65279ab92 from qemu
2018-04-26 09:02:11 -04:00
Peter Maydell bec50934ad
target/arm: Remove stale TODO comment
Remove a stale TODO comment -- we have now made the arm_ldl_ptw()
and arm_ldq_ptw() functions propagate physical memory read errors
out to their callers.

Backports commit 145772707fe80395b87c244ccf5699a756f1946b from qemu
2018-04-26 09:00:08 -04:00
Peter Maydell 8f26d8e556
target/arm: Report unsupported MPU region sizes more clearly
Currently our PMSAv7 and ARMv7M MPU implementation cannot handle
MPU region sizes smaller than our TARGET_PAGE_SIZE. However we
report that in a slightly confusing way:

DRSR[3]: No support for MPU (sub)region alignment of 9 bits. Minimum is 10

The problem is not the alignment of the region, but its size;
tweak the error message to say so:
DRSR[3]: No support for MPU (sub)region size of 512 bytes. Minimum is 1024.

Backports commit 8aec759b45fa6986c0b159cb27353d6abb0d5d73 from qemu
2018-04-11 19:32:16 -04:00
Peter Maydell d6eafe5982
target/arm: Set FSR for BKPT, BRK when raising exception
Now that we have a helper function specifically for the BRK and
BKPT instructions, we can set the exception.fsr there rather
than in arm_cpu_do_interrupt_aarch32(). This allows us to
use our new arm_debug_exception_fsr() helper.

In particular this fixes a bug where we were hardcoding the
short-form IFSR value, which is wrong if the target exception
level has LPAE enabled.

Fixes: https://bugs.launchpad.net/qemu/+bug/1756927

Backports commit 62b94f31d0df75187bb00684fc29e8639eacc0c5 from qemu
2018-03-25 16:36:51 -04:00
Eduardo Habkost 074865ff98
cpu: Generify CPU init functions
Backports commits 2994fd96d986578a342f2342501b4ad30f6d0a85,
701e3c78ce45fa630ffc6826c4b9a4218954bc7f, and
d1853231c60d16af78cf4d1608d043614bfbac0b from qemuu
2018-03-20 08:21:51 -04:00
Lioncash c93c3bd4b3
target/arm/helper: Correct bad merge 2018-03-12 11:33:45 -04:00
Alex Bennée 068143595e
arm/helper.c: re-factor rsqrte and add rsqrte_f16
Much like recpe the ARM ARM has simplified the pseudo code for the
calculation which is done on a fixed point 9 bit integer maths. So
while adding f16 we can also clean this up to be a little less heavy
on the floating point and just return the fractional part and leave
the calle's to do the final packing of the result.

Backports commit d719cbc7641991d16b891ffbbfc3a16a04e37b9a from qemu

Also removes a load of symbols that seem unnecessary from the header_gen script
2018-03-08 22:42:04 -05:00
Alex Bennée 5f3864c2c2
arm/helper.c: re-factor recpe and add recepe_f16
It looks like the ARM ARM has simplified the pseudo code for the
calculation which is done on a fixed point 9 bit integer maths. So
while adding f16 we can also clean this up to be a little less heavy
on the floating point and just return the fractional part and leave
the calle's to do the final packing of the result.

Backports commit 5eb70735af1c0b607bf2671a53aff3710cc1672f from qemu
2018-03-08 19:05:48 -05:00
Alex Bennée 7161c1ed52
arm/translate-a64: add FP16 SCVTF/UCVFT to simd_two_reg_misc_fp16 2018-03-08 18:48:25 -05:00
Alex Bennée 27d8d01566
target/arm/helper: pass explicit fpst to set_rmode
As the rounding mode is now split between FP16 and the rest of
floating point we need to be explicit when tweaking it. Instead of
passing the CPU env we now pass the appropriate fpst pointer directly.

Backports commit 9b04991686785e18b18a36d193b68f08f7c91648 from qemu
2018-03-08 12:41:54 -05:00
Alex Bennée 996f38056f
target/arm/cpu.h: add additional float_status flags
Half-precision flush to zero behaviour is controlled by a separate
FZ16 bit in the FPCR. To handle this we pass a pointer to
fp_status_fp16 when working on half-precision operations. The value of
the presented FPCR is calculated from an amalgam of the two when read.

Backports commit d81ce0ef2c4f1052fcdef891a12499eca3084db7 from qemu
2018-03-08 12:34:39 -05:00
Peter Maydell f4df29ca4f
target/arm: Fix register definitions for VMIDR and VMPIDR
The register definitions for VMIDR and VMPIDR have separate
reginfo structs for the AArch32 and AArch64 registers. However
the 32-bit versions are wrong:
* they use offsetof instead of offsetoflow32 to mark where
the 32-bit value lives in the uint64_t CPU state field
* they don't mark themselves as ARM_CP_ALIAS

In particular this means that if you try to use an Arm guest CPU
which enables EL2 on a big-endian host it will assert at reset:
target/arm/cpu.c:114: cp_reg_check_reset: Assertion `oldvalue == newvalue' failed.

because the reset of the 32-bit register writes to the top
half of the uint64_t.

Correct the errors in the structures.

Backports commit 36476562d57a3b64bbe86db26e63677dd21907c5 from qemu
2018-03-08 12:26:09 -05:00
Alex Bennée 0eee5afd0e
target/*/cpu.h: remove softfloat.h
As cpu.h is another typically widely included file which doesn't need
full access to the softfloat API we can remove the includes from here
as well. Where they do need types it's typically for float_status and
the rounding modes so we move that to softfloat-types.h as well.

As a result of not having softfloat in every cpu.h call we now need to
add it to various helpers that do need the full softfloat.h
definitions.

Backports commit 24f91e81b65fcdd0552d1f0fcb0ea7cfe3829c19 from qemu
2018-03-08 09:58:47 -05:00
Peter Maydell 19baeb5120
target/arm: Implement v8M MSPLIM and PSPLIM registers
The v8M architecture includes hardware support for enforcing
stack pointer limits. We don't implement this behaviour yet,
but provide the MSPLIM and PSPLIM stack pointer limit registers
as reads-as-written, so that when we do implement the checks
in future this won't break guest migration.

Backports commit 57bb31568114023f67680d6fe478ceb13c51aa7d from qemu
2018-03-08 09:42:04 -05:00
Peter Maydell 5812f7e3a3
target/arm: Implement writing to CONTROL_NS for v8M
In commit 50f11062d4c896 we added support for MSR/MRS access
to the NS banked special registers, but we forgot to implement
the support for writing to CONTROL_NS. Correct the omission.

Backports commit 6eb3a64e2a96f5ced1f7896042b01f002bf0a91f from qemu
2018-03-08 09:39:43 -05:00
Richard Henderson 07b928eca4
target/arm: Enforce access to ZCR_EL at translation
This also makes sure that we get the correct ordering of
SVE vs FP exceptions.

Backports commit 490aa7f13a2ad31f92205879c4dc2387b602ef14 from qemu
2018-03-08 09:17:33 -05:00
Richard Henderson c095dc9e83
target/arm: Suppress TB end for FPCR/FPSR
Nothing in either register affects the TB.

Backports commit b916c9c35ce8158bf7f9ed5514eb279e52875de2 from qemu
2018-03-08 09:15:02 -05:00
Richard Henderson d5c4d3e3c3
target/arm: Enforce FP access to FPCR/FPSR
Backports commit fe03d45f9e9baa89e8c4da50de771767d5d48990 from qemu
2018-03-08 09:14:52 -05:00
Richard Henderson 1bff556dbc
target/arm: Remove ARM_CP_64BIT from ZCR_EL registers
Because they are ARM_CP_STATE_AA64, ARM_CP_64BIT is implied.

Backports commit 5d1e699988cdb1494ab4ac9a2b67d4c539143654 from qemu
2018-03-08 09:06:46 -05:00
Richard Henderson 02516c53ff
target/arm: Add SVE state to TB->FLAGS
Add both SVE exception state and vector length.

Backports commit 1db5e96c54d8b3d1df0a6fed6771390be6b010da from qemu
2018-03-07 11:44:32 -05:00
Richard Henderson 523e5114c0
target/arm: Add ZCR_ELx
Define ZCR_EL[1-3].

Backports commit 5be5e8eda78474f6e89a54af12ee6f44234115ed from qemu
2018-03-07 11:41:46 -05:00
Peter Maydell c1f778a438
target/arm: Handle exceptions during exception stack pop
Handle possible MPU faults, SAU faults or bus errors when
popping register state off the stack during exception return.

Backports commit 95695effe8caa552b8f243bceb3a08de4003c882 from qemu
2018-03-07 08:33:21 -05:00
Peter Maydell 0dadc2575f
target/arm: Make exception vector loads honour the SAU
Make the load of the exception vector from the vector table honour
the SAU and any bus error on the load (possibly provoking a derived
exception), rather than simply aborting if the load fails.

Backports commit 600c33f24752a00e81e9372261e35c2befea612b from qemu
2018-03-07 08:31:57 -05:00
Peter Maydell 630a38cf94
target/arm: Make v7m_push_callee_stack() honour MPU
Make v7m_push_callee_stack() honour the MPU by using the
new v7m_stack_write() function. We return a flag to indicate
whether the pushes failed, which we can then use in
v7m_exception_taken() to cause us to handle the derived
exception correctly.

Backports commit 65b4234ff73a4d4865438ce30bdfaaa499464efa from qemu
2018-03-07 08:23:04 -05:00
Peter Maydell 0bc82ea78f
target/arm: Make v7M exception entry stack push check MPU
The memory writes done to push registers on the stack
on exception entry in M profile CPUs are supposed to
go via MPU permissions checks, which may cause us to
take a derived exception instead of the original one of
the MPU lookup fails. We were implementing these as
always-succeeds direct writes to physical memory.
Rewrite v7m_push_stack() to do the necessary checks.

Backports commit fd592d890ec40e3686760de84044230a8ebb1eb3 from qemu
2018-03-07 08:20:02 -05:00
Peter Maydell a10b65bd47
target/arm: Add ignore_stackfaults argument to v7m_exception_taken()
In the v8M architecture, if the process of taking an exception
results in a further exception this is called a derived exception
(for example, an MPU exception when writing the exception frame to
memory). If the derived exception happens while pushing the initial
stack frame, we must ignore any subsequent possible exception
pushing the callee-saves registers.

In preparation for making the stack writes check for exceptions,
add a return value from v7m_push_stack() and a new parameter to
v7m_exception_taken(), so that the former can tell the latter that
it needs to ignore failures to write to the stack. We also plumb
the argument through to v7m_push_callee_stack(), which is where
the code to ignore the failures will be.

(Note that the v8M ARM pseudocode structures this slightly differently:
derived exceptions cause the attempt to process the original
exception to be abandoned; then at the top level it calls
DerivedLateArrival to prioritize the derived exception and call
TakeException from there. We choose to let the NVIC do the prioritization
and continue forward with a call to TakeException which will then
take either the original or the derived exception. The effect is
the same, but this structure works better for QEMU because we don't
have a convenient top level place to do the abandon-and-retry logic.)

Backports commit 0094ca70e165cfb69882fa2e100d935d45f1c983 from qemu
2018-03-07 08:17:25 -05:00
Peter Maydell e1349f817a
target/arm: Split "get pending exception info" from "acknowledge it"
Currently armv7m_nvic_acknowledge_irq() does three things:
* make the current highest priority pending interrupt active
* return a bool indicating whether that interrupt is targeting
Secure or NonSecure state
* implicitly tell the caller which is the highest priority
pending interrupt by setting env->v7m.exception

We need to split these jobs, because v7m_exception_taken()
needs to know whether the pending interrupt targets Secure so
it can choose to stack callee-saves registers or not, but it
must not make the interrupt active until after it has done
that stacking, in case the stacking causes a derived exception.
Similarly, it needs to know the number of the pending interrupt
so it can read the correct vector table entry before the
interrupt is made active, because vector table reads might
also cause a derived exception.

Create a new armv7m_nvic_get_pending_irq_info() function which simply
returns information about the highest priority pending interrupt, and
use it to rearrange the v7m_exception_taken() code so we don't
acknowledge the exception until we've done all the things which could
possibly cause a derived exception.

Backports part of commit 6c9485188170e11ad31ce477c8ce200b8e8ce59d from qemu
2018-03-07 08:12:35 -05:00
Richard Henderson 0af3b16b5b
target/arm: Simplify fp_exception_el for user-only
Backports commit 55faa21273151259de38da271c8a2f2b37d6c250 from qemu
2018-03-06 10:37:30 -05:00
Richard Henderson 11688c4b12
target/arm: Hoist store to flags output in cpu_get_tb_cpu_state
Backports commit b9adaa70a0dfce7a8e4bdb27a7c6bec5c6f633c4 from qemu
2018-03-06 10:36:51 -05:00
Richard Henderson 7dfbe4e104
target/arm: Move cpu_get_tb_cpu_state out of line
Backports commit a9e013112f03bf1644a549a769be599a3ceb6155 from qemu
2018-03-06 10:33:49 -05:00
Ard Biesheuvel aeee985cc9
target/arm: Fix 32-bit address truncation
Commit ("3b39d734141a target/arm: Handle page table walk load failures
correctly") modified both versions of the page table walking code (i.e.,
arm_ldl_ptw and arm_ldq_ptw) to record the result of the translation in
a temporary 'data' variable so that it can be inspected before being
returned. However, arm_ldq_ptw() returns an uint64_t, and using a
temporary uint32_t variable truncates the upper bits, corrupting the
result. This causes problems when using more than 4 GB of memory in
a TCG guest. So use a uint64_t instead.

Backports commit 9aea1ea31af25fe344a88da086ff913cca09c667 from qemu
2018-03-06 09:19:19 -05:00
Peter Maydell b658f1f36c
target/arm: Handle page table walk load failures correctly
Instead of ignoring the response from address_space_ld*()
(indicating an attempt to read a page table descriptor from
an invalid physical address), use it to report the failure
correctly.

Since this is another couple of locations where we need to
decide the value of the ARMMMUFaultInfo ea bit based on a
MemTxResult, we factor out that operation into a helper
function.

Backports commit 3b39d734141a71296d08af3d4c32f872fafd782e from qemu
2018-03-06 08:55:08 -05:00
Peter Maydell fe9271d5bd
get_phys_addr_pmsav7: Support AP=0b111 for v7M
For PMSAv7, the v7A/R Arm ARM defines that setting AP to 0b111
is an UNPREDICTABLE reserved combination. However, for v7M
this value is documented as having the same behaviour as 0b110:
read-only for both privileged and unprivileged. Accept this
value on an M profile core rather than treating it as a guest
error and a no-access page.

Backports commit 8638f1ad7403b63db880dadce38e6690b5d82b64 from qemu
2018-03-06 08:51:55 -05:00
Edgar E. Iglesias 60136b485c
target/arm: Extend PAR format determination
Now that do_ats_write() is entirely in control of whether to
generate a 32-bit PAR or a 64-bit PAR, we can make it use the
correct (complicated) condition for doing so.

Backports commit 1313e2d7e2cd8b21741e0cf542eb09dfc4188f79 from qemu
2018-03-05 14:08:50 -05:00
Peter Maydell 0dfb84ea50
target/arm: Remove fsr argument from get_phys_addr() and arm_tlb_fill()
All of the callers of get_phys_addr() and arm_tlb_fill() now ignore
the FSR values they return, so we can just remove the argument
entirely.

Backports commit bc52bfeb3be2052942b7dac8ba284f342ac9605b from qemu
2018-03-05 14:05:08 -05:00
Peter Maydell ec686af668
target/arm: Ignore fsr from get_phys_addr() in do_ats_write()
In do_ats_write(), rather than using the FSR value from get_phys_addr(),
construct the PAR values using the information in the ARMMMUFaultInfo
struct. This allows us to create a PAR of the correct format regardless
of what the translation table format is.

For the moment we leave the condition for "when should this be a
64 bit PAR" as it was previously; this will need to be fixed to
properly support AArch32 Hyp mode.

Backports commit 5efe9ed45dec775ebe91ce72bd805ee780d16064 from qemu
2018-03-05 14:01:26 -05:00
Peter Maydell 4d666dbb99
target/arm: Convert get_phys_addr_pmsav8() to not return FSC values
Make get_phys_addr_pmsav8() return a fault type in the ARMMMUFaultInfo
structure, which we convert to the FSC at the callsite.

Backports commit 3f551b5b7380ff131fe22944aa6f5b166aa13caf from qemu
2018-03-05 13:57:33 -05:00
Peter Maydell 3eb4a2ea84
target/arm: Convert get_phys_addr_pmsav7() to not return FSC values
Make get_phys_addr_pmsav7() return a fault type in the ARMMMUFaultInfo
structure, which we convert to the FSC at the callsite.

Backports commit 9375ad15338b24e06109071ac3a85df48a2cc2e6 from qemu
2018-03-05 13:55:20 -05:00
Peter Maydell 79b2c4b1e7
target/arm: Convert get_phys_addr_pmsav5() to not return FSC values
Make get_phys_addr_pmsav5() return a fault type in the ARMMMUFaultInfo
structure, which we convert to the FSC at the callsite.

Note that PMSAv5 does not define any guest-visible fault status
register, so the different "fsr" values we were previously
returning are entirely arbitrary. So we can just switch to using
the most appropriae fi->type values without worrying that we
need to special-case FaultInfo->FSC conversion for PMSAv5.

Backports commit 53a4e5c5b07b2f50c538511b74b0d3d4964695ea from qemu
2018-03-05 13:54:05 -05:00
Peter Maydell 013e7873ee
target/arm: Convert get_phys_addr_lpae() to not return FSC values
Make get_phys_addr_v6() return a fault type in the ARMMMUFaultInfo
structure, which we convert to the FSC at the callsite.

Backports commit da909b2c23a68e57bbcb6be98229e40df606f0c8 from qemu
2018-03-05 13:52:18 -05:00
Peter Maydell c6496ec00a
target/arm: Convert get_phys_addr_v6() to not return FSC values
Make get_phys_addr_v6() return a fault type in the ARMMMUFaultInfo
structure, which we convert to the FSC at the callsite.

Backports commit f06cf243945ccb24cb9578304306ae7fcb4cf3fd from qemu
2018-03-05 13:48:32 -05:00
Peter Maydell 4ccf3c3927
target/arm: Convert get_phys_addr_v5() to not return FSC values
Make get_phys_addr_v5() return a fault type in the ARMMMUFaultInfo
structure, which we convert to the FSC at the callsite.

Backports commit f989983e8dc9be6bc3468c6dbe46fcb1501a740c from qemu
2018-03-05 13:48:32 -05:00
Peter Maydell 457e4f35ac
target/arm: Remove fsr argument from arm_ld*_ptw()
All the callers of arm_ldq_ptw() and arm_ldl_ptw() ignore the value
that those functions store in the fsr argument on failure: if they
return failure to their callers they will always overwrite the fsr
value with something else.

Remove the argument from these functions and S1_ptw_translate().
This will simplify removing fsr from the calling functions.

Backports commit 3795a6de9f7ec4a7e3dcb8bf02a88a014147b0b0 from qemu
2018-03-05 13:48:32 -05:00
Peter Maydell 8fe6b6c308
target/arm: Implement TT instruction
Implement the TT instruction which queries the security
state and access permissions of a memory location.

Backports commit 5158de241b0fb344a6c948dfcbc4e611ab5fafbe from qemu
2018-03-05 13:48:31 -05:00
Peter Maydell 4e5ec9c0dc
target/arm: Factor MPU lookup code out of get_phys_addr_pmsav8()
For the TT instruction we're going to need to do an MPU lookup that
also tells us which MPU region the access hit. This requires us
to do the MPU lookup without first doing the SAU security access
check, so pull the MPU lookup parts of get_phys_addr_pmsav8()
out into their own function.

The TT instruction also needs to know the MPU region number which
the lookup hit, so provide this information to the caller of the
MPU lookup code, even though get_phys_addr_pmsav8() doesn't
need to know it.

Backports commit 54317c0ff3a3c0f6b2c3a1d3c8b5d93686a86d24 from qemu
2018-03-05 13:48:31 -05:00