Commit graph

1081 commits

Author SHA1 Message Date
Vincent Dehors 6127f08028 target/arm: Fix PAuth sbox functions
In the PAC computation, sbox was applied over wrong bits.
As this is a 4-bit sbox, bit index should be incremented by 4 instead of 16.

Test vector from QARMA paper (https://eprint.iacr.org/2016/444.pdf) was
used to verify one computation of the pauth_computepac() function which
uses sbox2.

Launchpad: https://bugs.launchpad.net/bugs/1859713

Backports commit de0b1bae6461f67243282555475f88b2384a1eb9 from qemu
2020-03-21 12:17:26 -04:00
Clement Deschamps 1d97d223c3 target/arm: add PMU feature to cortex-r5 and cortex-r5f
The PMU is not optional on cortex-r5 and cortex-r5f (see
the "Features" chapter of the Technical Reference Manual).

Backports commit 90f671581ac601fcc1b840d9e9abe7e3c3e672db from qemu
2020-03-21 12:16:11 -04:00
Richard Henderson dc9733e555 target/arm: Set ISSIs16Bit in make_issinfo
During the conversion to decodetree, the setting of
ISSIs16Bit got lost. This causes the guest os to
incorrectly adjust trapping memory operations.

Backports commit 1a1fbc6cbb34c26d43d8360c66c1d21681af14a9 from qemu
2020-03-21 12:09:05 -04:00
Jeff Kubascik c9aadd696f target/arm: Return correct IL bit in merge_syn_data_abort
The IL bit is set for 32-bit instructions, thus passing false
with the is_16bit parameter to syn_data_abort_with_iss() makes
a syn mask that always has the IL bit set.

Pass is_16bit as true to make the initial syn mask have IL=0,
so that the final IL value comes from or'ing template_syn.

Cc: qemu-stable@nongnu.org
Fixes: aaa1f954d4ca ("target-arm: A64: Create Instruction Syndromes for Data Aborts")

Backports commit 30d544839e278dc76017b9a42990c41e84a34377 from qemu
2020-03-21 12:08:05 -04:00
Jeff Kubascik 95e39f60be target/arm: adjust program counter for wfi exception in AArch32
The wfi instruction can be configured to be trapped by a higher exception
level, such as the EL2 hypervisor. When the instruction is trapped, the
program counter should contain the address of the wfi instruction that
caused the exception. The program counter is adjusted for this in the wfi op
helper function.

However, this correction is done to env->pc, which only applies to AArch64
mode. For AArch32, the program counter is stored in env->regs[15]. This
adds an if-else statement to modify the correct program counter location
based on the the current CPU mode.

Backports commit 855532912b0e1bf803ae393e5b0c7e80948cd6a4 from qemu
2020-03-21 12:07:11 -04:00
Richard Henderson fb1988190e target/arm: Fix sign-extension for SMLAL*
The 32-bit product should be sign-extended, not zero-extended.

Fixes: ea96b37

Backports commit 1ab170865202aab8301131f31bffd87ea0f60d16 from qemu
2020-03-21 11:34:43 -04:00
Charles Ferguson 0d0d054382 Add implementation of access to the ARM SPSR register. (#1178)
The SPSR register is named within the Unicorn headers, but the code
to access it is absent. This means that it will always read as 0 and
ignore writes. This makes it harder to work with changes in processor
mode, as the usual way to return from a CPU exception is a
`MOVS pc, lr` for undefined instructions or `SUBS pc, lr, #4`
for most other aborts - which implicitly restores the CPSR from SPSR.

This change adds the access to the SPSR so that it can be read and
written as the caller might expect.

Backports commit 99097cab4c39fb3fc50eea8f0006954f62a149b2 from unicorn.
2020-01-14 09:57:55 -05:00
Pan Nengyuan 134a026e6b arm/translate-a64: fix uninitialized variable warning
Fixes:
target/arm/translate-a64.c: In function 'disas_crypto_three_reg_sha512':
target/arm/translate-a64.c:13625:9: error: 'genfn' may be used uninitialized in this function [-Werror=maybe-uninitialized]
genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
qemu/target/arm/translate-a64.c:13609:8: error: 'feature' may be used uninitialized in this function [-Werror=maybe-uninitialized]
if (!feature) {

Backports commit c7a5e7910517e2711215a9e869a733ffde696091 from qemu
2020-01-14 08:46:42 -05:00
Alex Bennée 8f275077b0 target/arm: only update pc after semihosting completes
Before we introduce blocking semihosting calls we need to ensure we
can restart the system on semi hosting exception. To be able to do
this the EXCP_SEMIHOST operation should be idempotent until it finally
completes. Practically this means ensureing we only update the pc
after the semihosting call has completed.

Backports commit 4ff5ef9e911c670ca10cdd36dd27c5395ec2c753 from qemu
2020-01-14 08:28:25 -05:00
Alex Bennée ea2714796f target/arm: remove unused EXCP_SEMIHOST leg
All semihosting exceptions are dealt with earlier in the common code
so we should never get here.

Backports commit b906acbb3aceed5b1eca30d9d365d5bd7431400b from qemu
2020-01-14 08:18:51 -05:00
Alex Bennée 639c5c4fe2 target/arm: ensure we use current exception state after SCR update
A write to the SCR can change the effective EL by droppping the system
from secure to non-secure mode. However if we use a cached current_el
from before the change we'll rebuild the flags incorrectly. To fix
this we introduce the ARM_CP_NEWEL CP flag to indicate the new EL
should be used when recomputing the flags.

Backports partof commit f80741d107673f162e3b097fc76a1590036cc9d1 from
qemu
2020-01-14 07:51:10 -05:00
Beata Michalska 81c14bb595 target/arm: Add support for DC CVAP & DC CVADP ins
ARMv8.2 introduced support for Data Cache Clean instructions
to PoP (point-of-persistence) - DC CVAP and PoDP (point-of-deep-persistence)
- DV CVADP. Both specify conceptual points in a memory system where all writes
that are to reach them are considered persistent.
The support provided considers both to be actually the same so there is no
distinction between the two. If none is available (there is no backing store
for given memory) both will result in Data Cache Clean up to the point of
coherency. Otherwise sync for the specified range shall be performed.

Backports commit 0d57b49992200a926c4436eead97ecfc8cc710be from qemu
2020-01-14 07:47:48 -05:00
Niek Linnenbank 998714db1f arm/arm-powerctl: set NSACR.{CP11, CP10} bits in arm_set_cpu_on()
This change ensures that the FPU can be accessed in Non-Secure mode
when the CPU core is reset using the arm_set_cpu_on() function call.
The NSACR.{CP11,CP10} bits define the exception level required to
access the FPU in Non-Secure mode. Without these bits set, the CPU
will give an undefined exception trap on the first FPU access for the
secondary cores under Linux.

This is necessary because in this power-control codepath QEMU
is effectively emulating a bit of EL3 firmware, and has to set
the CPU up as the EL3 firmware would.

Fixes: fc1120a7f5

Backports commit 0c7f8c43daf6556078e51de98aa13f069e505985 from qemu
2020-01-07 18:10:29 -05:00
Marc Zyngier 9c3e512479 target/arm: Add support for missing Jazelle system registers
QEMU lacks the minimum Jazelle implementation that is required
by the architecture (everything is RAZ or RAZ/WI). Add it
together with the HCR_EL2.TID0 trapping that goes with it.

Backports commit f96f3d5f09973ef40f164cf2d5fd98ce5498b82a from qemu
2020-01-07 18:09:13 -05:00
Marc Zyngier 457934855b target/arm: Handle AArch32 CP15 trapping via HSTR_EL2
HSTR_EL2 offers a way to trap ranges of CP15 system register
accesses to EL2, and it looks like this register is completely
ignored by QEMU.

To avoid adding extra .accessfn filters all over the place (which
would have a direct performance impact), let's add a new TB flag
that gets set whenever HSTR_EL2 is non-zero and that QEMU translates
a context where this trap has a chance to apply, and only generate
the extra access check if the hypervisor is actively using this feature.

Tested with a hand-crafted KVM guest accessing CBAR.

Backports commit 5bb0a20b74ad17dee5dae38e3b8b70b383ee7c2d from qemu
2020-01-07 18:07:21 -05:00
Marc Zyngier 868de52f69 target/arm: Handle trapping to EL2 of AArch32 VMRS instructions
HCR_EL2.TID3 requires that AArch32 reads of MVFR[012] are trapped to
EL2, and HCR_EL2.TID0 does the same for reads of FPSID.
In order to handle this, introduce a new TCG helper function that
checks for these control bits before executing the VMRC instruction.

Tested with a hacked-up version of KVM/arm64 that sets the control
bits for 32bit guests.

Backports commit 9ca1d776cb49c09b09579d9edd0447542970c834 from qemu
2020-01-07 18:04:16 -05:00
Marc Zyngier 51062d3fc2 target/arm: Honor HCR_EL2.TID1 trapping requirements
HCR_EL2.TID1 mandates that access from EL1 to REVIDR_EL1, AIDR_EL1
(and their 32bit equivalents) as well as TCMTR, TLBTR are trapped
to EL2. QEMU ignores it, making it harder for a hypervisor to
virtualize the HW (though to be fair, no known hypervisor actually
cares).

Do the right thing by trapping to EL2 if HCR_EL2.TID1 is set.

Backports commit 93fbc983b29a2eb84e2f6065929caf14f99c3681 from qemu
2020-01-07 18:00:01 -05:00
Marc Zyngier d1e981c44b target/arm: Honor HCR_EL2.TID2 trapping requirements
HCR_EL2.TID2 mandates that access from EL1 to CTR_EL0, CCSIDR_EL1,
CCSIDR2_EL1, CLIDR_EL1, CSSELR_EL1 are trapped to EL2, and QEMU
completely ignores it, making it impossible for hypervisors to
virtualize the cache hierarchy.

Do the right thing by trapping to EL2 if HCR_EL2.TID2 is set.

Backports commit 630fcd4d2ba37050329e0adafdc552d656ebe2f3 from qemu
2020-01-07 17:55:40 -05:00
Christophe Lyon 1df67780cd target/arm: Add support for cortex-m7 CPU
This is derived from cortex-m4 description, adding DP support and FPv5
instructions with the corresponding flags in isar and mvfr2.

Checked that it could successfully execute
vrinta.f32 s15, s15
while cortex-m4 emulation rejects it with "illegal instruction".

Backports commit cf7beda5072e106ddce875c1996446540c5fe239 from qemu
2020-01-07 17:52:27 -05:00
Marc Zyngier 145d58c367
target/arm: Honor HCR_EL2.TID3 trapping requirements
HCR_EL2.TID3 mandates that access from EL1 to a long list of id
registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,
while the hypervisor doesn't want to expose the feature to its guest.
To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes
that the feature is present in the HW, starts using it, and dies
a horrible death when KVM injects an UNDEF, because the feature
*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR
registers from AArch32 (they are accessed via the VMRS
instruction and need to be handled in a different way).

Backports commit 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317 from qemu
2019-11-28 03:46:32 -05:00
Marc Zyngier 2e8c8b5a7c
target/arm: Fix ISR_EL1 tracking when executing at EL2
The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits
if not running in a virtualized context.

Backports commit 7cf95aed53c8770a338617ef40d5f37d2c197853 from qemu
2019-11-28 03:41:38 -05:00
Jean-Hugues Deschênes a2194585bb
target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
According to the PushStack() pseudocode in the armv7m RM,
bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
an FPU is present. Current implementation is doing it for
armv8, but not for armv7. This patch makes the existing
logic applicable to both code paths.

Backports commit f900b1e5b087a02199fbb6de7038828008e9e419 from qemu
2019-11-28 03:40:37 -05:00
Lioncash eadeae183d
target/arm: Amend bad merge 2019-11-28 03:29:56 -05:00
Richard Henderson f2ec6bc22d
target/arm: Support EL0 v7m msr/mrs for CONFIG_USER_ONLY
Simply moving the non-stub helper_v7m_mrs/msr outside of
!CONFIG_USER_ONLY is not an option, because of all of the
other system-mode helpers that are called.

But we can split out a few subroutines to handle the few
EL0 accessible registers without duplicating code.

Backports commit 04c9c81b8fa2ee33f59a26265700fae6fc646062 from qemu
2019-11-28 03:29:46 -05:00
Richard Henderson df5929cb69
target/arm: Relax r13 restriction for ldrex/strex for v8.0
Armv8-A removes UNPREDICTABLE for R13 for these cases.

Backports commit d46ad79efac7aaf9f0eb9f5a96a576e9f39200e0 from qemu
2019-11-28 03:29:31 -05:00
Richard Henderson fa7a6a5d91
target/arm: Do not reject rt == rt2 for strexd
There was too much cut and paste between ldrexd and strexd,
as ldrexd does prohibit two output registers the same.

Fixes: af288228995

Backports commit 655b02646dc175dc10666459b0a1e4346fc8d46a from qemu
2019-11-28 03:29:18 -05:00
Tony Nguyen f75368cd0f
tcg: TCGMemOp is now accelerator independent MemOp
Preparation for collapsing the two byte swaps, adjust_endianness and
handle_bswap, along the I/O path.

Target dependant attributes are conditionalized upon NEED_CPU_H.

Backports commit 14776ab5a12972ea439c7fb2203a4c15a09094b4 from qemu
2019-11-28 03:01:12 -05:00
Richard Henderson 654aaf9ebe
target/arm: Inline gen_bx_im into callers
There are only two remaining uses of gen_bx_im. In each case, we
know the destination mode -- not changing in the case of gen_jmp
or changing in the case of trans_BLX_i. Use this to simplify the
surrounding code.

For trans_BLX_i, use gen_jmp for the actual branch. For gen_jmp,
use gen_set_pc_im to set up the single-step.

Backports commit eac2f39602e0423adf56be410c9a22c31fec9a81 from qemu
2019-11-28 02:54:09 -05:00
Richard Henderson e61ca839d3
target/arm: Clean up disas_thumb_insn
Now that everything is converted, remove the rest of
the legacy decode.

Backports commit 0831403b08122b5bf801b0e3469cc63f019f60f0 from qemu
2019-11-28 02:53:59 -05:00
Richard Henderson a91de478cc
target/arm: Convert T16, long branches
Backports commit 67b54c554b39fd24f0c3aabc546e83b3082ee7ff from qemu
2019-11-28 02:53:54 -05:00
Richard Henderson 8d2fe3f6db
target/arm: Convert T16, Unconditional branch
Backports commit 8d4a4dc849a28aded8f335a25b223e8e3391b6f2 from qemu
2019-11-28 02:53:46 -05:00
Richard Henderson 482799d456
target/arm: Convert T16, Unconditional branch
Backports commit 8d4a4dc849a28aded8f335a25b223e8e3391b6f2 from qemu
2019-11-28 02:53:35 -05:00
Richard Henderson 2bc615157d
target/arm: Convert T16, load (literal)
Backports commit 46beb58efbb8a2a32f601a041aa22801a3138ece from qemu
2019-11-28 02:53:27 -05:00
Richard Henderson fad910c50b
target/arm: Convert T16, shift immediate
Backports commit 151c2f2841b01bf6fef079c9f1db15a86cae8276 from qemu
2019-11-28 02:53:18 -05:00
Richard Henderson ee96ab9ea9
target/arm: Convert T16, Miscellaneous 16-bit instructions
Backports commit 43f7e42c7d515f41ff243034f51b28267ae69938 from qemu
2019-11-28 02:53:08 -05:00
Richard Henderson dec55633dc
target/arm: Convert T16, Conditional branches, Supervisor call
Backports commit 629fcaa71ca9a5d6695d1664257b6a5327f38bd6 from qemu
2019-11-28 02:53:01 -05:00
Richard Henderson 336d6b3625
target/arm: Convert T16, push and pop
Backports commit 564b125fb9dec77e5bca9b4590786985ccc3d6cb from qemu
2019-11-28 02:52:44 -05:00
Richard Henderson 25d1de9005
target/arm: Split gen_nop_hint
Now that all callers pass a constant value, split the switch
statement into the individual trans_* functions.

Backports commit 279de61a21a1622cb875ead82d6e78c989ba2966 from qemu
2019-11-28 02:52:37 -05:00
Richard Henderson a45db7fcd1
target/arm: Convert T16, nop hints
Backports commit 56e6250ede81b4e4b4ddb623874d6c3cdad4a96d from qemu
2019-11-28 02:52:29 -05:00
Richard Henderson 676f1c8783
target/arm: Convert T16, Reverse bytes
Backports commit ae3002b0218a90f2088817c70b35d3832ec91c18 from qemu
2019-11-28 02:52:19 -05:00
Richard Henderson 692ad18e62
target/arm: Convert T16, Change processor state
Add a check for ARMv6 in trans_CPS. We had this correct in
the T16 path, but had previously forgotten the check on the
A32 and T32 paths.

Backports commit 20556e7bd6111266fbf1d81e4ff7a89bfa5795a7 from qemu
2019-11-28 02:52:13 -05:00
Richard Henderson cc7d3fe9da
target/arm: Convert T16, extract
Backports commit e6f69612cc79e2acc05dafda8695f791a916946f from qemu
2019-11-28 02:52:06 -05:00
Richard Henderson 40282af492
target/arm: Convert T16 adjust sp (immediate)
Backports commit 2e6a646d7b1304d9106baad73c655132e2736c6c from qemu
2019-11-28 02:51:54 -05:00
Richard Henderson 927fb85b51
target/arm: Convert T16 add, compare, move (two high registers)
Backports commit 90aa042115a0fe39fe4cb3bcae4c4f728e2f3fdb from qemu
2019-11-28 02:51:46 -05:00
Richard Henderson 7ca1b3f817
target/arm: Convert T16 branch and exchange
Backports commit a0ef07740425b679d010fac7d9954ae003c1b191 from qemu
2019-11-28 02:51:39 -05:00
Richard Henderson c690f562c4
target/arm: Convert T16 one low register and immediate
Backports commit 6c6d237a865041972ec5b226657398f3b3018561 from qemu
2019-11-28 02:51:31 -05:00
Richard Henderson d9184b16a9
target/arm: Convert T16 add/sub (3 low, 2 low and imm)
Backports commit c4d3095bb62bdac0b4f9cb180bd7aa0b40c2c270 from qemu
2019-11-28 02:51:24 -05:00
Richard Henderson c52cfb9aa6
target/arm: Convert T16 load/store multiple
Backports commit 6e8514ba408f3cc758cd47e2da5475d8684507ec from qemu
2019-11-28 02:51:16 -05:00
Richard Henderson 10c8008266
target/arm: Convert T16 add pc/sp (immediate)
Backports commit 1cb1323433dca657a42483b2291c1ae923a91726 from qemu
2019-11-28 02:51:08 -05:00
Richard Henderson 7f79c0f2a1
target/arm: Convert T16 load/store (immediate offset)
Backports commit 07afd747f9fdd79fabf3a51416c7d795f873d297 from qemu
2019-11-28 02:51:01 -05:00