Commit graph

4950 commits

Author SHA1 Message Date
Peter Maydell 8c41572624
target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)
The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp
from either Monitor or Hyp mode. Our translate time check
was overly strict and only permitted access from Monitor mode.

The runtime check we do in msr_mrs_banked_exc_checks() had the
correct code in it, but never got there because of the earlier
"currmode == tgtmode" check. Special case ELR_Hyp.

Backports commit aec4dd09f172ee64c19222b78269d5952fd9c1dc from qemu
2018-08-22 12:51:42 -04:00
Peter Maydell 858aa2d094
target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2
The AArch32 HSR is the equivalent of AArch64 ESR_EL2;
we can implement it by marking our existing ESR_EL2 regdef
as STATE_BOTH. It also needs to be "RES0 from EL3 if
EL2 not implemented", so add the missing stanza to
el3_no_el2_cp_reginfo.

Backports commit 68e78e332cb1c3f8b0317a0443acb2b5e190f0dd from qemu
2018-08-22 12:48:35 -04:00
Peter Maydell c21d2062e4
target/arm: Implement AArch32 Hyp FARs
The AArch32 virtualization extensions support these fault address
registers:
* HDFAR: aliased with AArch64 FAR_EL2[31:0] and AArch32 DFAR(S)
* HIFAR: aliased with AArch64 FAR_EL2[63:32] and AArch32 IFAR(S)

Implement the accessors for these. This fixes in passing a bug
where we weren't implementing the "RES0 from EL3 if EL2 not
implemented" behaviour for AArch64 FAR_EL2.

Backports commit cba517c31e7df8932c4473c477a0f01d8a0adc48 from qemu
2018-08-22 12:45:23 -04:00
Peter Maydell 763a71a962
target/arm: Implement AArch32 HVBAR
Implement the AArch32 HVBAR register; we can do this just by
making the existing VBAR_EL2 regdefs be STATE_BOTH.

Backports commit d79e0c0608899428281a17c414ccf1a82d86ab85 from qemu
2018-08-22 12:37:12 -04:00
Peter Maydell e9fb085aa1
target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs
ARMCPRegInfo structs will default to .cp = 15 if they
are ARM_CP_STATE_BOTH, but not if they are ARM_CP_STATE_AA32
(because a coprocessor number of 0 is valid for AArch32).
We forgot to explicitly set .cp = 15 for the HMAIR1 and
HAMAIR1 regdefs, which meant they would UNDEF when the guest
tried to access them under cp15.

Backports commit b5ede85bfb7ba1a8f6086494c82f400b29969f65 from qemu
2018-08-22 12:36:11 -04:00
Peter Maydell 2d2c6982ce
target/arm: Correct typo in HAMAIR1 regdef name
We implement the HAMAIR1 register as RAZ/WI; we had a typo in the
regdef, though, and were incorrectly naming it HMAIR1 (which is
a different register which we also implement as RAZ/WI).

Backports commit 55b53c718b2f684793eeefcf1c1a548ee97e23aa from qemu
2018-08-22 12:33:45 -04:00
Roman Kapl 0e2dc93e5f
target/arm: Fix crash on conditional instruction in an IT block
If an instruction is conditional (like CBZ) and it is executed
conditionally (using the ITx instruction), a jump to an undefined
label is generated, and QEMU crashes.

CBZ in IT block is an UNPREDICTABLE behavior, but we should not
crash. Honouring the condition code is allowed by the spec in this
case (constrained unpredictable, ARMv8, section K1.1.7), and matches
what we do for other "UNPREDICTABLE inside an IT block" instructions.

Fix the 'skip on condition' code to create a new label only if it
does not already exist. Previously multiple labels were created, but
only the last one of them was set.

Backports commit c2d9644e6d517170bf6520f633628259a8460d48 from qemu
2018-08-22 12:27:45 -04:00
Eduardo Habkost f4879ae89f
i386: Disable TOPOEXT by default on "-cpu host"
Enabling TOPOEXT is always allowed, but it can't be enabled
blindly by "-cpu host" because it may make guests crash if the
rest of the cache topology information isn't provided or isn't
consistent.

This addresses the bug reported at:
https://bugzilla.redhat.com/show_bug.cgi?id=1613277

Backports commit 7210a02c58572b2686a3a8d610c6628f87864aed from qemu
2018-08-17 14:34:02 -04:00
Wanpeng Li 1f85fbc4d6
target-i386: adds PV_SEND_IPI CPUID feature bit
Adds PV_SEND_IPI CPUID feature bit.

Backports commit 7f710c32bb893c68b931c68265f0427c032eb7f4 from qemu
2018-08-17 14:30:57 -04:00
Robert Hoo 5e97271942
i386: Add new CPU model Icelake-{Server,Client}
New CPU models mostly inherit features from ancestor Skylake, while addin new
features: UMIP, New Instructions ( PCONIFIG (server only), WBNOINVD,
AVX512_VBMI2, GFNI, AVX512_VNNI, VPCLMULQDQ, VAES, AVX512_BITALG),
Intel PT and 5-level paging (Server only). As well as
IA32_PRED_CMD, SSBD support for speculative execution
side channel mitigations.

Note:
For 5-level paging, Guest physical address width can be configured, with
parameter "phys-bits". Unless explicitly specified, we still use its default
value, even for Icelake-Server cpu model.
At present, hold on expose IA32_ARCH_CAPABILITIES to guest, as 1) This MSR
actually presents more than 1 'feature', maintainers are considering expanding current
features presentation of only CPUIDs to MSR bits; 2) a reasonable default value
for MSR_IA32_ARCH_CAPABILITIES needs to settled first. These 2 are actully
beyond Icelake CPU model itself but fundamental. So split these work apart
and do it later.
https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00774.html
https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00796.html

Backports commit 8a11c62da9146dd89aee98947e6bd831e65a970d from qemu
2018-08-17 14:30:13 -04:00
Robert Hoo 0e16ff259b
i386: Add CPUID bit for WBNOINVD
WBNOINVD: Write back and do not invalidate cache, enumerated by
CPUID.(EAX=80000008H, ECX=0):EBX[bit 9].

Backports commit 59a80a19ca31a6fff9fdbb6b4cf55a5a0767c3bc from qemu
2018-08-17 14:29:10 -04:00
Robert Hoo 8b59666ae6
i386: Add CPUID bit for PCONFIG
PCONFIG: Platform configuration, enumerated by CPUID.(EAX=07H, ECX=0):
EDX[bit18].

Backports commit 5131dc433df54b37e8e918d8fba7fe10344e7a7b from qemu
2018-08-17 14:28:11 -04:00
Robert Hoo 44e0a97e0b
i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR
Support of IA32_PRED_CMD MSR already be enumerated by same CPUID bit as
SPEC_CTRL.

At present, mark CPUID_7_0_EDX_ARCH_CAPABILITIES unmigratable, per Paolo's
comment.

Backports commit 3fc7c73139d2d38ae80c3b0bc963b1ac1555924c from qemu
2018-08-17 14:27:28 -04:00
Robert Hoo b3fccc4841
i386: Add new MSR indices for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES
IA32_PRED_CMD MSR gives software a way to issue commands that affect the state
of indirect branch predictors. Enumerated by CPUID.(EAX=7H,ECX=0):EDX[26].
IA32_ARCH_CAPABILITIES MSR enumerates architectural features of RDCL_NO and
IBRS_ALL. Enumerated by CPUID.(EAX=07H, ECX=0):EDX[29].

https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf

Backports commit 8c80c99fcceabd0708a5a83f08577e778c9419f5 from qemu
2018-08-17 14:26:10 -04:00
Yongbok Kim eb775926fd
target/mips: Check ELPA flag only in some cases of MFHC0 and MTHC0
MFHC0 and MTHC0 used to handle EntryLo0 and EntryLo1 registers only,
and placing ELPA flag checks before switch statement were technically
correct. However, after adding handling more registers, these checks
should be moved to act only in cases of handling EntryLo0 and
EntryLo1.

Backports commit 59488dda1f16c0259bc2610d8d71686ef436c649 from qemu
2018-08-17 14:25:22 -04:00
Yongbok Kim 9be6d4c6d2
target/mips: Don't update BadVAddr register in Debug Mode
BadVAddr should not be updated if (env->hflags & MIPS_HFLAG_DM) is
set.

Backports commit e807bcc1513f2d79c992a08b252fa32e69c6e8b2 from qemu
2018-08-17 14:24:19 -04:00
Stefan Markovic dbebd7f27f
target/mips: Implement CP0 Config1.WR bit functionality
Add testing Config1.WR bit into watch exception handling logic.

Backports commit fa192d4974de3ace960d03803ab9d2f09abd9282 from qemu
2018-08-17 14:23:35 -04:00
Stefan Markovic 4b6a9ce61b
target/mips: Add CP0 BadInstrX register
Add CP0 BadInstrX register. This register will be used in nanoMIPS.

Backports commit 25beba9bf76a677747b779e997c6540677a38311 from qemu
2018-08-17 14:22:02 -04:00
Aleksandar Markovic d70a2c1df1
target/mips: Update some CP0 registers bit definitions
Update CP0 registers Config0, Config1, Config2, Config3,
Config4, and Config5 bit definitions.

Some of these bits will be utilized by upcoming nanoMIPS changes.

Backports commit 0413d7a55a8161ebd33541ba1df4285bf180c583 from qemu
2018-08-17 14:21:18 -04:00
Aleksandar Markovic af31bc3982
target/mips: Fix two instances of shadow variables
Fix two instances of shadow variables. This cleans up entire file
translate.c from shadow variables.

Backports commit e1555d7ddf2c86fb92165e47eb092f1f5fa9e8bd from qemu
2018-08-17 14:18:38 -04:00
Aleksandar Markovic 0fd3ae0efb
target/mips: Mark switch fallthroughs with interpretable comments
Mark switch fallthroughs with comments, in cases fallthroughs
are intentional.

The comments "/* fall through */" are interpreted by compilers and
other tools, and they will not issue warnings in such cases. For gcc,
the warning is turnend on by -Wimplicit-fallthrough. With this patch,
there will be no such warnings in target/mips directory. If such
warning appears in future, it should be checked if it is intentional,
and, if yes, marked with a comment similar to those from this patch.

The comment must be just before next "case", otherwise gcc won't
understand it.

Backports commit 146dd620db815558938433eb9f57a571d424d2c6 from qemu
2018-08-17 14:17:45 -04:00
Aleksandar Rikalo 0f118a005b
target/mips: Avoid case statements formulated by ranges - part 2
Remove "range style" case statements to make code analysis easier.
This patch handles cases when the values in the range in question
were not properly defined.

Backports commit c38a1d52233c85976eeed99c9015e881de8cd68e from qemu
2018-08-17 14:16:40 -04:00
Aleksandar Markovic 0259ce5b6d
target/mips: Avoid case statements formulated by ranges - part 1
Remove "range style" case statements to make code analysis easier.

This is needed also for some upcoming nanoMIPS-related refactorings.

Backports commit c2e19f3c2b1a1bb5f4fc3c55ee8cfa28dde9b810 from qemu
2018-08-17 14:14:11 -04:00
Richard Henderson a456920fd7
softfloat: Fix missing inexact for floating-point add
For 0x1.0000000000003p+0 + 0x1.ffffffep+14 = 0x1.0001fffp+15
we dropped the sticky bit and so failed to raise inexact.

Backports commit 64d450a0eaad5f02f9d6bba1dd451446297bb4dc from qemu
2018-08-17 14:06:55 -04:00
Richard Henderson 0136ca773f
target/arm: Fix aa64 FCADD and FCMLA decode
These insns require u=1; failed to include that in the switch
cases. This probably happened during one of the rebases just
before final commit.

Fixes: d17b7cdcf4e

Backports commit b8a4a96db3639e17ab5e5cdc14fca4b19fbf5b3b from qemu
2018-08-17 14:06:01 -04:00
Richard Henderson c387d51c1d
target/arm: Use FZ not FZ16 for SVE FCVT single-half and double-half
We were using the wrong flush-to-zero bit for the non-half input.

Fixes: 46d33d1e3c9

Backports commit e4ab5124a5c2e2291006b24bdc21c3dd8d087ff4 from qemu
2018-08-17 14:05:10 -04:00
Richard Henderson 118495f4b1
target/arm: Use fp_status_fp16 for do_fmpa_zpzzz_h
This makes float16_muladd correctly use FZ16 not FZ.

Fixes: 6ceabaad110

Backports commit 52a339b11d1719a6589de40606859939875fda9a from qemu
2018-08-17 14:04:20 -04:00
Richard Henderson 15a68a354c
target/arm: Ignore float_flag_input_denormal from fp_status_f16
When FZ is set, input_denormal exceptions are recognized, but this does
not happen with FZ16. The softfloat code has no way to distinguish
these bits and will raise such exceptions into fp_status_f16.flags,
so ignore them when computing the accumulated flags.

Backports commit 19062c169e5bcdda3d60df9161228e107bf0f96e from qemu
2018-08-17 14:03:41 -04:00
Richard Henderson f787dd15fd
target/arm: Adjust FPCR_MASK for FZ16
When support for FZ16 was added, we failed to include the bit
within FPCR_MASK, which means that it could never be set.
Continue to zero FZ16 when ARMv8.2-FP16 is not enabled.

Fixes: d81ce0ef2c4

Backports commit 0b62159be33d45d00dfa34a317c6d3da30ffb480 from qemu
2018-08-17 14:02:49 -04:00
Stefan Hajnoczi d2f3a6c0d5
target/arm: add cortex-m0 CPU model
Define a "cortex-m0" ARMv6-M CPU model.

Most of the register reset values set by other CPU models are not
relevant for the cut-down ARMv6-M architecture.

Backports commit 191776b96a381b5d2b8d3f90c1c02b3e4779e5f7 from qemu
2018-08-17 14:01:00 -04:00
Richard Henderson cb11b3a6bd
target/arm: Add sve-max-vq cpu property to -cpu max
This allows the default (and maximum) vector length to be set
from the command-line. Which is extraordinarily helpful in
debugging problems depending on vector length without having to
bake knowledge of PR_SET_SVE_VL into every guest binary.

Backports relevant parts of commit
adf92eab90e3f5f34c285da6d14d48952b7a8e72 from qemu
2018-08-17 13:57:51 -04:00
Richard Henderson 1d3cf8a0b0
target/arm: Dump SVE state if enabled
Also fold the FPCR/FPSR state onto the same line as PSTATE,
and mention but do not dump disabled FPU state.

Backports commit 2bf5f3f91bb4e3faa2a19aec042138a938afbf6a from qemu
2018-08-17 13:52:28 -04:00
Richard Henderson 731bcd194b
target/arm: Fix offset scaling for LD_zprr and ST_zprr
The scaling should be solely on the memory operation size; the number
of registers being loaded does not come in to the initial computation.

Backports commit 50ef1cbf31caad21019ae6fa8036ed6f29244ba5 from qemu
2018-08-17 13:50:59 -04:00
Richard Henderson 86d6bb4d43
target/arm: Fix offset for LD1R instructions
The immediate should be scaled by the size of the memory reference,
not the size of the elements into which it is loaded.

Backports commit d0e372b0298f897993f831dbff7ad4f1c70f138e from qemu
2018-08-17 13:49:39 -04:00
Richard Henderson 7487c66bee
target/arm: Fix sign-extension in sve do_ldr/do_str
The expression (int) imm + (uint32_t) len_align turns into uint32_t
and thus with negative imm produces a memory operation at the wrong
offset. None of the numbers involved are particularly large, so
change everything to use int.

Backports commit 19f2acc915a0f8f443a959844540a6f09133cc96 from qemu
2018-08-17 13:48:44 -04:00
Richard Henderson 1ca7c30fbb
target/arm: Fix typo in helper_sve_ld1hss_r
Backports commit 573ec0fe40b9a412085ac7dfb41975a0fc2b28dd from qemu
2018-08-17 13:47:38 -04:00
Markus Armbruster f257623b9f
qapi: Fix some pycodestyle-3 complaints
Fix the following issues:

common.py:873:13: E129 visually indented line with same indent as next logical line
common.py:1766:5: E741 ambiguous variable name 'l'
common.py:1784:1: E305 expected 2 blank lines after class or function definition, found 1
common.py:1833:1: E305 expected 2 blank lines after class or function definition, found 1
common.py:1843:1: E305 expected 2 blank lines after class or function definition, found 1
visit.py:181:18: E127 continuation line over-indented for visual indent

Backports commit b736e25a1820c63f7d69baa03e624cef80c4de90 from qemu
2018-08-16 07:14:40 -04:00
Richard Henderson e2e7bb0e21
target/arm: Fix typo in helper_sve_movz_d
Backports commit 054e7adf4e64e4acb3b033348ebf7cc871baa34f from qemu
2018-08-16 07:12:18 -04:00
Lioncash 9a2581aff6
Comment out tailchaining code
Allows build to continue.
2018-08-16 07:11:31 -04:00
Richard Henderson f26356b930
target/arm: Reorganize SVE WHILE
The pseudocode for this operation is an increment + compare loop,
so comparing <= the maximum integer produces an all-true predicate.

Rather than bound in both the inline code and the helper, pass the
helper the number of predicate bits to set instead of the number
of predicate elements to set.

Backports commit bbd0968c458d48e34a08b8694fa3309a9fe1c9e7 from qemu
2018-08-16 07:09:33 -04:00
Lioncash eccda3afcc
target/arm: Fix typo in do_sat_addsub_64
Used the wrong temporary in the computation of subtractive overflow.

Backports commit 7a31e0c6c68baffab0867bdd92b8744568b1d3ba from qemu
2018-08-16 07:06:05 -04:00
Richard Henderson 46fd2c485a
target/arm: Fix sign of sve_cmpeq_ppzw/sve_cmpne_ppzw
The normal vector element is sign-extended before
comparing with the wide vector element.

Backports commit df4e001093988544d09887122ae824f18ba55c68 from qemu
2018-08-16 07:04:52 -04:00
Peter Maydell 8d34a271f6
target/arm: Implement tailchaining for M profile cores
Tailchaining is an optimization in handling of exception return
for M-profile cores: if we are about to pop the exception stack
for an exception return, but there is a pending exception which
is higher priority than the priority we are returning to, then
instead of unstacking and then immediately taking the exception
and stacking registers again, we can chain to the pending
exception without unstacking and stacking.

For v6M and v7M it is IMPDEF whether tailchaining happens for pending
exceptions; for v8M this is architecturally required. Implement it
in QEMU for all M-profile cores, since in practice v6M and v7M
hardware implementations generally do have it.

(We were already doing tailchaining for derived exceptions which
happened during exception return, like the validity checks and
stack access failures; these have always been required to be
tailchained for all versions of the architecture.)

Backports commit 5f62d3b9e67bfc3deb970e3c7fb7df7e57d46fc3 from qemu
2018-08-16 07:03:51 -04:00
Peter Maydell e3be0c4aa6
target/arm: Restore M-profile CONTROL.SPSEL before any tailchaining
On exception return for M-profile, we must restore the CONTROL.SPSEL
bit from the EXCRET value before we do any kind of tailchaining,
including for the derived exceptions on integrity check failures.
Otherwise we will give the guest an incorrect EXCRET.SPSEL value on
exception entry for the tailchained exception.

Backports commit 89b1fec193b81b6ad0bd2975f2fa179980cc722e from qemu
2018-08-16 06:58:34 -04:00
Peter Maydell e044c59cc1
target/arm: Initialize exc_secure correctly in do_v7m_exception_exit()
In do_v7m_exception_exit(), we use the exc_secure variable to track
whether the exception we're returning from is secure or non-secure.
Unfortunately the statement initializing this was accidentally
inside an "if (env->v7m.exception != ARMV7M_EXCP_NMI)" conditional,
which meant that we were using the wrong value for NMI handlers.
Move the initialization out to the right place.

Backports commit b8109608bc6f3337298d44ac4369bf0bc8c3a1e4 from qemu
2018-08-16 06:57:27 -04:00
Peter Maydell c79ebe4965
target/arm: Treat SCTLR_EL1.M as if it were zero when HCR_EL2.TGE is set
One of the required effects of setting HCR_EL2.TGE is that when
SCR_EL3.NS is 1 then SCTLR_EL1.M must behave as if it is zero for
all purposes except direct reads. That is, it effectively disables
the MMU for the NS EL0/EL1 translation regime.

Backports commit 3d0e3080d8b7abcddc038d18e8401861c369c4c1 from qemu
2018-08-16 06:46:09 -04:00
Peter Maydell 12248b8685
target/arm: Provide accessor functions for HCR_EL2.{IMO, FMO, AMO}
The IMO, FMO and AMO bits in HCR_EL2 are defined to "behave as
1 for all purposes other than direct reads" if HCR_EL2.TGE
is set and HCR_EL2.E2H is 0, and to "behave as 0 for all
purposes other than direct reads" if HCR_EL2.TGE is set
and HRC_EL2.E2H is 1.

To avoid having to check E2H and TGE everywhere where we test IMO and
FMO, provide accessors arm_hcr_el2_imo(), arm_hcr_el2_fmo()and
arm_hcr_el2_amo(). We don't implement ARMv8.1-VHE yet, so the E2H
case will never be true, but we include the logic to save effort when
we eventually do get to that.

(Note that in several of these callsites the change doesn't
actually make a difference as either the callsite is handling
TGE specially anyway, or the CPU can't get into that situation
with TGE set; we change everywhere for consistency.)

Backports commit ac656b166b57332ee397e9781810c956f4f5fde5 from qemu
2018-08-16 06:41:45 -04:00
Peter Maydell 3979058dcb
target/arm: Honour HCR_EL2.TGE when raising synchronous exceptions
Whene we raise a synchronous exception, if HCR_EL2.TGE is set then
exceptions targeting NS EL1 must be redirected to EL2. Implement
this in raise_exception() -- all synchronous exceptions go through
this function.

(Asynchronous exceptions go via arm_cpu_exec_interrupt(), which
already honours HCR_EL2.TGE when it determines the target EL
in arm_phys_excp_target_el().)

Backports commit 7556edfb4d7bf0583c852c8cfc49ef494c41dd8a from qemu
2018-08-16 06:41:57 -04:00
Peter Maydell 6b8d98bcd2
target/arm: Honour HCR_EL2.TGE and MDCR_EL2.TDE in debug register access checks
Some debug registers can be trapped via MDCR_EL2 bits TDRA, TDOSA,
and TDA, which we implement in the functions access_tdra(),
access_tdosa() and access_tda(). If MDCR_EL2.TDE or HCR_EL2.TGE
are 1, the TDRA, TDOSA and TDA bits should behave as if they were 1.
Implement this by having the access functions check MDCR_EL2.TDE
and HCR_EL2.TGE.

Backports commit 30ac6339dca3fe0d05a611f12eedd5af20af585a from qemu
2018-08-16 06:41:02 -04:00
Peter Maydell f0bf1160e4
target/arm: Mask virtual interrupts if HCR_EL2.TGE is set
If the "trap general exceptions" bit HCR_EL2.TGE is set, we
must mask all virtual interrupts (as per DDI0487C.a D1.14.3).
Implement this in arm_excp_unmasked().

Backports commit 2ccf0fef632f3d54b2cc9ea08f1e6904ff1f8df4 from qemu
2018-08-16 06:39:27 -04:00