Commit graph

313 commits

Author SHA1 Message Date
Aaron Lindsay OS 0dd5bf84fc
target/arm: Send interrupts on PMU counter overflow
Whenever we notice that a counter overflow has occurred, send an
interrupt. This is made more reliable with the addition of a timer in a
follow-on commit.

Backports commit f4efb4b2a17528837cb445f9bdfaef8df4a5acf7 from qemu
2019-02-03 17:55:30 -05:00
Aaron Lindsay OS 8d7bb2cab3
target/arm: Don't clear supported PMU events when initializing PMCEID1
A bug was introduced during a respin of:

commit 57a4a11b2b281bb548b419ca81bfafb214e4c77a
target/arm: Add array for supported PMU events, generate PMCEID[01]_EL0

This patch introduced two calls to get_pmceid() during CPU
initialization - one each for PMCEID0 and PMCEID1. In addition to
building the register values, get_pmceid() clears an internal array
mapping event numbers to their implementations (supported_event_map)
before rebuilding it. This is an optimization since much of the logic is
shared. However, since it was called twice, the contents of
supported_event_map reflect only the events in PMCEID1 (the second call
to get_pmceid()).

Fix this bug by moving the initialization of PMCEID0 and PMCEID1 back
into a single function call, and name it more appropriately since it is
doing more than simply generating the contents of the PMCEID[01]
registers.

Backports commit bf8d09694ccc07487cd73d7562081fdaec3370c8 from qemu
2019-01-29 17:12:23 -05:00
Richard Henderson 64f10fa075
target/arm: Fix validation of 32-bit address spaces for aa32
When tsz == 0, aarch32 selects the address space via exclusion,
and there are no "top_bits" remaining that require validation.

Fixes: ba97be9f4a4

Backports commit 36d820af0eddf4fc6a533579b052d8f0085a9fb8 from qemu
2019-01-29 16:46:36 -05:00
Aaron Lindsay cfd84d84f6
target/arm: Implement PMSWINC
Backports commit 0d4bfd7df809863b1f45fad35229fb9419527d06 from qemu
2019-01-22 18:59:26 -05:00
Aaron Lindsay 9727b7c3e0
target/arm: PMU: Set PMCR.N to 4
This both advertises that we support four counters and enables them
because the pmu_num_counters() reads this value from PMCR.

Backports commit ac689a2e5155d129acaa39603e2a7a29abd90d89 from qemu
2019-01-22 18:55:34 -05:00
Aaron Lindsay dede23994a
target/arm: PMU: Add instruction and cycle events
The instruction event is only enabled when icount is used, cycles are
always supported. Always defining get_cycle_count (but altering its
behavior depending on CONFIG_USER_ONLY) allows us to remove some
CONFIG_USER_ONLY #defines throughout the rest of the code.

Backports commit b2e2372511946fae86fbb8709edec7a41c6f3167 from qemu
2019-01-22 18:54:01 -05:00
Aaron Lindsay 1a815a1afc
target/arm: Finish implementation of PM[X]EVCNTR and PM[X]EVTYPER
Add arrays to hold the registers, the definitions themselves, access
functions, and logic to reset counters when PMCR.P is set. Update
filtering code to support counters other than PMCCNTR. Support migration
with raw read/write functions.

Backports commit 5ecdd3e47cadae83a62dc92b472f1fe163b56f59 from qemu
2019-01-22 18:07:53 -05:00
Aaron Lindsay c8c3defb18
target/arm: Add array for supported PMU events, generate PMCEID[01]_EL0
This commit doesn't add any supported events, but provides the framework
for adding them. We store the pm_event structs in a simple array, and
provide the mapping from the event numbers to array indexes in the
supported_event_map array. Because the value of PMCEID[01] depends upon
which events are supported at runtime, generate it dynamically.

Backports commit 57a4a11b2b281bb548b419ca81bfafb214e4c77a from qemu
2019-01-22 17:45:36 -05:00
Aaron Lindsay 67accd4d88
target/arm: Make PMCEID[01]_EL0 64 bit registers, add PMCEID[23]
Backports commit cad8673744d0914587cd7380e70df11e8c4a0f50 from qemu
2019-01-22 17:32:29 -05:00
Aaron Lindsay 4ff0389d2d
target/arm: Implement PMOVSSET
Add an array for PMOVSSET so we only define it for v7ve+ platforms

Backports commit 327dd5108bb3b66bb5102b659e83a4348a005f5e from qemu
2019-01-22 17:25:22 -05:00
Aaron Lindsay d6d1d49cdd
target/arm: Allow AArch32 access for PMCCFILTR
Backports commit 4b8afa1f99c3575f6cfb26770f90e9fd7bc45468 from qemu
2019-01-22 17:19:03 -05:00
Aaron Lindsay b916fb2cae
target/arm: Filter cycle counter based on PMCCFILTR_EL0
Rename arm_ccnt_enabled to pmu_counter_enabled, and add logic to only
return 'true' if the specified counter is enabled and neither prohibited
or filtered.

Backports commit 033614c47de78409ad3fb39bb7bd1483b71c6789 from qemu
2019-01-22 17:12:46 -05:00
Aaron Lindsay b6b0c18ce5
target/arm: Swap PMU values before/after migrations
Because of the PMU's design, many register accesses have side effects
which are inter-related, meaning that the normal method of saving CP
registers can result in inconsistent state. These side-effects are
largely handled in pmu_op_start/finish functions which can be called
before and after the state is saved/restored. By doing this and adding
raw read/write functions for the affected registers, we avoid
migration-related inconsistencies.

Backports relevant parts of commit
980ebe87053792a5bdefaa87777c40914fd4f673 from qemu
2019-01-22 17:01:34 -05:00
Aaron Lindsay 001283c45b
target/arm: Reorganize PMCCNTR accesses
pmccntr_read and pmccntr_write contained duplicate code that was already
being handled by pmccntr_sync. Consolidate the duplicated code into two
functions: pmccntr_op_start and pmccntr_op_finish. Add a companion to
c15_ccnt in CPUARMState so that we can simultaneously save both the
architectural register value and the last underlying cycle count - this
ensures time isn't lost and will also allow us to access the 'old'
architectural register value in order to detect overflows in later
patches.

Backports commit 5d05b9d462666ed21b7fef61aa45dec9aaa9f0ff from qemu
2019-01-22 16:57:29 -05:00
Richard Henderson 6e1c9df11f
target/arm: Add PAuth system registers
Backports commit 967aa94f2b0df08d744b6d0bfa21031175e8a0e6 from qemu
2019-01-22 16:36:55 -05:00
Richard Henderson 048d8da45c
target/arm: Reuse aa64_va_parameters for setting tbflags
The arm_regime_tbi{0,1} functions are replacable with the new function
by giving the lowest and highest address.

Backports commit 5d8634f5a3a8474525edcfd581a659830e9e97c0 from qemu
2019-01-22 16:29:54 -05:00
Richard Henderson 028aef155a
target/arm: Decode TBID from TCR
Use TBID in aa64_va_parameters depending on the data parameter.
This automatically updates all existing users of the function.

Backports commit 8220af7e4d34c858898fbfe55943aeea8f4e875f from qemu
2019-01-22 16:27:37 -05:00
Richard Henderson b99e2f920b
target/arm: Add aa64_va_parameters_both
We will want to check TBI for I and D simultaneously.

Backports commit e737ed2ad8c14b4b82ed241646ffa370d29d0937 from qemu
2019-01-22 16:25:12 -05:00
Richard Henderson 23b162f2fb
target/arm: Export aa64_va_parameters to internals.h
We need to reuse this from helper-a64.c. Provide a stub
definition for CONFIG_USER_ONLY. This matches the stub
definitions that we removed for arm_regime_tbi{0,1} before.

Backports commit bf0be433878935e824479e8ae890493e1fb646ed from qemu
2019-01-22 16:22:57 -05:00
Richard Henderson 3fbde0ab73
target/arm: Merge TBFLAG_AA_TB{0, 1} to TBII
We will shortly want to talk about TBI as it relates to data.
Passing around a pair of variables is less convenient than a
single variable.

Backports commit 476a4692f06e381117fb7ad0d04d37c9c2612198 from qemu
2019-01-22 16:19:57 -05:00
Richard Henderson b6415f7a4b
target/arm: Create ARMVAParameters and helpers
Split out functions to extract the virtual address parameters.
Let the functions choose T0 or T1 address space half, if present.
Extract (most of) the control bits that vary between EL or Tx.

Backports commit ba97be9f4a4ecaf16a1454dc669e5f3d935d3b63 from qemu
2019-01-22 16:17:16 -05:00
Richard Henderson 377bd123bd
target/arm: Introduce arm_stage1_mmu_idx
While we could expose stage_1_mmu_idx, the combination is
probably going to be more useful.

Backports commit 64be86ab1b5ef10b660a4230ee7f27c0da499043 from qemu
2019-01-22 16:08:37 -05:00
Richard Henderson 9743787d0f
target/arm: Introduce arm_mmu_idx
The pattern

ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));

is computing the full ARMMMUIdx, stripping off the ARM bits,
and then putting them back.

Avoid the extra two steps with the appropriate helper function.

Backports commit 50494a279dab22a015aba9501a94fcc3cd52140e from qemu
2019-01-22 16:06:34 -05:00
Richard Henderson 8856234574
target/arm: Move cpu_mmu_index out of line
This function is, or will shortly become, too big to inline.

Backports commit 65e4655c609a4a2fd428459d3efb62b704488fd6 from qemu
2019-01-22 16:02:39 -05:00
Richard Henderson e6ffbc22c2
target/arm: Add PAuth active bit to tbflags
There are 5 bits of state that could be added, but to save
space within tbflags, add only a single enable bit.
Helpers will determine the rest of the state at runtime.

Backports commit 0816ef1bfcd3ac53e7454b62ca436727887f6056 from qemu
2019-01-22 15:15:59 -05:00
Alexander Graf f2682ff309
target/arm: Allow Aarch32 exception return to switch from Mon->Hyp
In U-boot, we switch from S-SVC -> Mon -> Hyp mode when we want to
enter Hyp mode. The change into Hyp mode is done by doing an
exception return from Mon. This doesn't work with current QEMU.

The problem is that in bad_mode_switch() we refuse to allow
the change of mode.

Note that bad_mode_switch() is used to do validation for two situations:

(1) changes to mode by instructions writing to CPSR.M
(ie not exception take/return) -- this corresponds to the
Armv8 Arm ARM pseudocode Arch32.WriteModeByInstr
(2) changes to mode by exception return

Attempting to enter or leave Hyp mode via case (1) is forbidden in
v8 and UNPREDICTABLE in v7, and QEMU is correct to disallow it
there. However, we're already doing that check at the top of the
bad_mode_switch() function, so if that passes then we should allow
the case (2) exception return mode changes to switch into Hyp mode.

We want to test whether we're trying to return to the nonexistent
"secure Hyp" mode, so we need to look at arm_is_secure_below_el3()
rather than arm_is_secure(), since the latter is always true if
we're in Mon (EL3).

Backports commit 2d2a4549cc29850aab891495685a7b31f5254b12 from qemu
2019-01-22 15:09:30 -05:00
Richard Henderson 4d8b7a9967
target/arm: Convert ARM_TBFLAG_* to FIELDs
Use "register" TBFLAG_ANY to indicate shared state between
A32 and A64, and "registers" TBFLAG_A32 & TBFLAG_A64 for
fields that are specific to the given cpu state.

Move ARM_TBFLAG_BE_DATA to shared state, instead of its current
placement within "Bit usage when in AArch32 state".

Backports commit aad821ac4faad369fad8941d25e59edf2514246b from qemu
2019-01-13 19:21:18 -05:00
Richard Henderson 8816550c10
target/arm: Implement the ARMv8.1-LOR extension
Provide a trivial implementation with zero limited ordering regions,
which causes the LDLAR and STLLR instructions to devolve into the
LDAR and STLR instructions from the base ARMv8.0 instruction set.

Backports commit 2d7137c10fafefe40a0a049ff8a7bd78b66e661f from qemu
2018-12-18 04:36:58 -05:00
Richard Henderson 32208e482b
target/arm: Use arm_hcr_el2_eff more places
Since arm_hcr_el2_eff includes a check against
arm_is_secure_below_el3, we can often remove a
nearby check against secure state.

In some cases, sort the call to arm_hcr_el2_eff
to the end of a short-circuit logical sequence.

Backports commit 7c208e0f4171c9e2cc35efc12e1bf264a45c229f from qemu
2018-12-18 04:33:07 -05:00
Richard Henderson 78798d10eb
target/arm: Introduce arm_hcr_el2_eff
Replace arm_hcr_el2_{fmo,imo,amo} with a more general routine
that also takes SCR_EL3.NS (aka arm_is_secure_below_el3) into
account, as documented for the plethora of bits in HCR_EL2.

Backports commit f77784446045231f7dfa46c9b872091241fa1557 from qemu
2018-12-18 04:27:34 -05:00
Richard Henderson 4515df5ee7
target/arm: Implement the ARMv8.2-AA32HPD extension
The bulk of the work here, beyond base HPD, is defining the
TTBCR2 register. In addition we must check TTBCR.T2E, which
is not present (RES0) for AArch64.

Backports commit ab638a328fd099ba0b23c8c818eb39f2c35414f3 from qemu
2018-12-18 04:23:37 -05:00
Richard Henderson 3cfd660814
target/arm: Implement the ARMv8.1-HPD extension
Since the TCR_*.HPD bits were RES0 in ARMv8.0, we can simply
interpret the bits as if ARMv8.1-HPD is present without checking.
We will need a slightly different check for hpd for aarch32.

Backports commit 037c13c5904f5fc67bb0ab7dd91ae07347aedee9 from qemu
2018-12-18 04:20:39 -05:00
Richard Henderson 0e08c37773
target/arm: Tidy scr_write
Because EL3 has a fixed execution mode, we can properly decide
which of the bits are RES{0,1}.

Backports commit ea22747c63c9a894777aa41a7af85c3d08e39f81 from qemu
2018-12-18 04:18:09 -05:00
Richard Henderson 52ac2b2f7c
target/arm: Fix HCR_EL2.TGE check in arm_phys_excp_target_el
The enable for TGE has already occurred within arm_hcr_el2_amo
and friends. Moreover, when E2H is also set, the sense is
supposed to be reversed, which has also already occurred within
the helpers.

Backports commit 619959c3583dad325c36f09ce670e7d091382cae from qemu
2018-12-18 04:17:08 -05:00
Peter Maydell 8b69824de7
target/arm: Move id_aa64mmfr* to ARMISARegisters
At the same time, define the fields for these registers,
and use those defines in arm_pamax().

Backports commit 3dc91ddbc68391f934bf6945853e99cf6810fc00 from qemu
2018-12-18 04:03:50 -05:00
Peter Maydell 61c0f40ac3
target/arm: Hyp mode R14 is shared with User and System
Hyp mode is an exception to the general rule that each AArch32
mode has its own r13, r14 and SPSR -- it has a banked r13 and
SPSR but shares its r14 with User and System mode. We were
incorrectly implementing it as banked, which meant that on
entry to Hyp mode r14 was 0 rather than the USR/SYS r14.

We provide a new function r14_bank_number() which is like
the existing bank_number() but provides the index into
env->banked_r14[]; bank_number() provides the index to use
for env->banked_r13[] and env->banked_cpsr[].

All the points in the code that were using bank_number()
to index into env->banked_r14[] are updated for consintency:
* switch_mode() -- this is the only place where we fix
an actual bug
* aarch64_sync_32_to_64() and aarch64_sync_64_to_32():
no behavioural change as we already special-cased Hyp R14
* kvm32.c: no behavioural change since the guest can't ever
be in Hyp mode, but conceptually the right thing to do
* msr_banked()/mrs_banked(): we can never get to the case
that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP,
so no behavioural change

Backports commit 593cfa2b637b92d37eef949653840dc065cdb960 from qemu
2018-11-16 21:58:29 -05:00
Peter Maydell 92bf8ee620
target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
In commit 8a0fc3a29fc2315325400 we tried to implement HCR_EL2.{VI,VF},
but we got it wrong and had to revert it.

In that commit we implemented them as simply tracking whether there
is a pending virtual IRQ or virtual FIQ. This is not correct -- these
bits cause a software-generated VIRQ/VFIQ, which is distinct from
whether there is a hardware-generated VIRQ/VFIQ caused by the
external interrupt controller. So we need to track separately
the HCR_EL2 bit state and the external virq/vfiq line state, and
OR the two together to get the actual pending VIRQ/VFIQ state.

Fixes: 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f

Backports commit 89430fc6f80a5aef1d4cbd6fc26b40c30793786c from qemu
2018-11-16 21:53:53 -05:00
Peter Maydell 730c99bcc2
Revert "target/arm: Implement HCR.VI and VF"
This reverts commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f.

The implementation of HCR.VI and VF in that commit is not
correct -- they do not track the overall "is there a pending
VIRQ or VFIQ" status, but whether there is a pending interrupt
due to "this mechanism", ie the hypervisor having set the VI/VF
bits. The overall pending state for VIRQ and VFIQ is effectively
the logical OR of the inbound lines from the GIC with the
VI and VF bits. Commit 8a0fc3a29fc231 would result in pending
VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR.

As a preliminary to implementing the HCR.VI/VF feature properly,
revert the broken one entirely.

Backports commit c624ea0fa7ffc9e2cc3e2b36c92b5c960954489f from qemu
2018-11-16 21:46:29 -05:00
Richard Henderson 295dd866b4
target/arm: Fix typo in tlbi_aa64_vmalle1_write
This would cause an infinite recursion or loop.

Backports commit 09a86dfa3f07904792a85990b0b41939417785cd from qemu
2018-11-16 21:41:28 -05:00
Peter Maydell 3edbb8180a
target/arm: Remove workaround for small SAU regions
Before we supported direct execution from MMIO regions, we
implemented workarounds in commit 720424359917887c926a33d2
which let us avoid doing so, even if the SAU or MPU region
was less than page-sized.

Once we implemented execute-from-MMIO, we removed part
of those workarounds in commit d4b6275df320cee76; but
we forgot the one in get_phys_addr_pmsav8() which
suppressed use of small SAU regions in executable regions.
Remove that workaround now.

Backports commit 521ed6b4015ba39a2e39c65a94643f3e6412edc4 from qemu
2018-11-16 21:40:10 -05:00
Peter Maydell 680c79956d
target/arm: Allow execution from small regions
Now that we have full support for small regions, including execution,
we can remove the workarounds where we marked all small regions as
non-executable for the M-profile MPU and SAU.

Backports commit d4b6275df320cee764d56b194b1898547f545857 from qemu
2018-11-16 21:39:33 -05:00
Peter Maydell f694264212
target/arm: Remove antique TODO comment
Remove a TODO comment about implementing the vectored interrupt
controller. We have had an implementation of that for a decade;
it's in hw/intc/pl190.c.

Backports commit e24ad484909e7a00ca4f6332f3698facf0ba3394 from qemu
2018-11-16 18:24:49 -05:00
Peter Maydell 84d5a60c15
target/arm: Fix ATS1Hx instructions
ATS1HR and ATS1HW (which allow AArch32 EL2 to do address translations
on the EL2 translation regime) were implemented in commit 14db7fe09a2c8.
However, we got them wrong: these should do stage 1 address translations
as defined for NS-EL2, which is ARMMMUIdx_S1E2. We were incorrectly
making them perform stage 2 translations.

A few years later in commit 1313e2d7e2cd we forgot entirely that
we'd implemented ATS1Hx, and added a comment that ATS1Hx were
"not supported yet". Remove the comment; there is no extra code
needed to handle these operations in do_ats_write(), because
arm_s1_regime_using_lpae_format() returns true for ARMMMUIdx_S1E2,
which forces 64-bit PAR format.

Backports commit 23463e0e4aeb2f0a9c60549a2c163f4adc0b8512 from qemu
2018-11-11 08:39:19 -05:00
Peter Maydell a445db5c02
target/arm: Set S and PTW in 64-bit PAR format
In do_ats_write() we construct a PAR value based on the result
of the translation. A comment says "S2WLK and FSTAGE are always
zero, because we don't implement virtualization".
Since we do in fact now implement virtualization, add the missing
code that sets these bits based on the reported ARMMMUFaultInfo.

(These bits are named PTW and S in ARMv8, so we follow that
convention in the new comments in this patch.)

Backports commit 0f7b791b35f24cb1333f779705a3f6472e6935de from qemu
2018-11-11 08:38:23 -05:00
Richard Henderson e9fe7d3c8d
target/arm: Only flush tlb if ASID changes
Since QEMU does not implement ASIDs, changes to the ASID must flush the
tlb. However, if the ASID does not change there is no reason to flush.

In testing a boot of the Ubuntu installer to the first menu, this reduces
the number of flushes by 30%, or nearly 600k instances.

Backports commit 93f379b0c43617b1361f742f261479eaed4959cb from qemu
2018-11-10 11:26:24 -05:00
Richard Henderson 15a6b3f771
target/arm: Remove writefn from TTBR0_EL3
The EL3 version of this register does not include an ASID,
and so the tlb_flush performed by vmsa_ttbr_write is not needed.

Backports commit f478847f1ee0df9397f561025ab2f687fd923571 from qemu
2018-11-10 11:25:39 -05:00
Peter Maydell d60fe610bb
target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode
For traps of FP/SIMD instructions to AArch32 Hyp mode, the syndrome
provided in HSR has more information than is reported to AArch64.
Specifically, there are extra fields TA and coproc which indicate
whether the trapped instruction was FP or SIMD. Add this extra
information to the syndromes we construct, and mask it out when
taking the exception to AArch64.

Backports commit 4be42f4013fa1a9df47b48aae5148767bed8e80c from qemu
2018-11-10 09:36:41 -05:00
Peter Maydell 075bac4d57
target/arm: Get IL bit correct for v7 syndrome values
For the v7 version of the Arm architecture, the IL bit in
syndrome register values where the field is not valid was
defined to be UNK/SBZP. In v8 this is RES1, which is what
QEMU currently implements. Handle the desired v7 behaviour
by squashing the IL bit for the affected cases:
* EC == EC_UNCATEGORIZED
* prefetch aborts
* data aborts where ISV is 0

(The fourth case listed in the v8 Arm ARM DDI 0487C.a in
section G7.2.70, "illegal state exception", can't happen
on a v7 CPU.)

This deals with a corner case noted in a comment.

Backports commit 2ed08180db096ea5e44573529b85e09b1ed10b08 from qemu
2018-11-10 09:29:13 -05:00
Peter Maydell 99516b43a3
target/arm: New utility function to extract EC from syndrome
Create and use a utility function to extract the EC field
from a syndrome, rather than open-coding the shift.

Backports commit 64b91e3f890a8c221b65c6820a5ee39107ee40f5 from qemu
2018-11-10 09:28:23 -05:00
Peter Maydell ebe442b1d4
target/arm: Implement HCR.PTW
If the HCR_EL2 PTW virtualizaiton configuration register bit
is set, then this means that a stage 2 Permission fault must
be generated if a stage 1 translation table access is made
to an address that is mapped as Device memory in stage 2.
Implement this.

Backports commit eadb2febf05452bd8062c4c7823d7d789142500c from qemu
2018-11-10 09:25:57 -05:00
Peter Maydell 28fcb58c69
target/arm: Implement HCR.VI and VF
The HCR_EL2 VI and VF bits are supposed to track whether there is
a pending virtual IRQ or virtual FIQ. For QEMU we store the
pending VIRQ/VFIQ status in cs->interrupt_request, so this means:
* if the register is read we must get these bit values from
cs->interrupt_request
* if the register is written then we must write the bit
values back into cs->interrupt_request

Backports commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f from qemu
2018-11-10 09:23:21 -05:00
Peter Maydell 0f0befc90a
target/arm: ISR_EL1 bits track virtual interrupts if IMO/FMO set
The A/I/F bits in ISR_EL1 should track the virtual interrupt
status, not the physical interrupt status, if the associated
HCR_EL2.AMO/IMO/FMO bit is set. Implement this, rather than
always showing the physical interrupt status.

We don't currently implement anything to do with external
aborts, so this applies only to the I and F bits (though it
ought to be possible for the outer guest to present a virtual
external abort to the inner guest, even if QEMU doesn't
emulate physical external aborts, so there is missing
functionality in this area).

Backports commit 636540e9c40bd0931ef3022cb953bb7dbecd74ed from qemu
2018-11-10 09:20:58 -05:00
Peter Maydell f0c9e690fb
target/arm: Implement HCR.DC
The HCR.DC virtualization configuration register bit has the
following effects:
* SCTLR.M behaves as if it is 0 for all purposes except
direct reads of the bit
* HCR.VM behaves as if it is 1 for all purposes except
direct reads of the bit
* the memory type produced by the first stage of the EL1&EL0
translation regime is Normal Non-Shareable,
Inner Write-Back Read-Allocate Write-Allocate,
Outer Write-Back Read-Allocate Write-Allocate.

Implement this behaviour.

Backports commit 9d1bab337caf2324a233e5937f415fad4ce1641b from qemu
2018-11-10 09:19:44 -05:00
Peter Maydell b9e7fa2d80
target/arm: Implement HCR.FB
The HCR.FB virtualization configuration register bit requests that
TLB maintenance, branch predictor invalidate-all and icache
invalidate-all operations performed in NS EL1 should be upgraded
from "local CPU only to "broadcast within Inner Shareable domain".
For QEMU we NOP the branch predictor and icache operations, so
we only need to upgrade the TLB invalidates:
AArch32 TLBIALL, TLBIMVA, TLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID,
ITLBIALL, ITLBIMVA, ITLBIASID, TLBIMVAA, TLBIMVAL, TLBIMVAAL
AArch64 TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1,
TLBI VALE1, TLBI VAALE1

Backports commit b4ab8ce98b8c482c8986785800f238d32a1578a9 from qemu
2018-11-10 09:17:51 -05:00
Lioncash a0358202a7
target/arm: Improve debug logging of AArch32 exception return
For AArch32, exception return happens through certain kinds
of CPSR write. We don't currently have any CPU_LOG_INT logging
of these events (unlike AArch64, where we log in the ERET
instruction). Add some suitable logging.

This will log exception returns like this:
Exception return from AArch32 hyp to usr PC 0x80100374

paralleling the existing logging in the exception_return
helper for AArch64 exception returns:
Exception return from AArch64 EL2 to AArch64 EL0 PC 0x8003045c
Exception return from AArch64 EL2 to AArch32 EL0 PC 0x8003045c

(Note that an AArch32 exception return can only be
AArch32->AArch32, never to AArch64.)

Backports commit 81e3728407bf4a12f83e14fd410d5f0a7d29b5b4 from qemu
2018-11-10 09:09:52 -05:00
Richard Henderson 03ec90f39b
target/arm: Convert v8.2-fp16 from feature bit to aa64pfr0 test
Backports commit 5763190fa8705863b4b725aa1657661a97113eb4 from qemu
2018-11-10 08:34:32 -05:00
Richard Henderson 0286f9525d
target/arm: Convert sve from feature bit to aa64pfr0 test
Backports commit cd208a1c3923bc097ec55c5b207d79294ab0e719 from qemu
2018-11-10 08:27:35 -05:00
Richard Henderson e5797bb0b7
target/arm: V8M should not imply V7VE
Instantiating mps2-an505 (cortex-m33) will fail make check when
V7VE asserts that ID_ISAR0.Divide includes ARM division. It is
also wrong to include ARM_FEATURE_LPAE.

Backports commit 5256df880d1312a58472af3fb0a3c51e708f2161 from qemu
2018-11-10 08:02:26 -05:00
Richard Henderson 1a714e97af
target/arm: Move some system registers into a substructure
Create struct ARMISARegisters, to be accessed during translation.

Backports commit 47576b94af5c406fc6521fb336fb5c12beeac3f8 from qemu
2018-11-10 08:00:32 -05:00
Peter Maydell 64661a9165
target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
The get_phys_addr() functions take a pointer to an ARMMMUFaultInfo
struct, which they fill in only if a fault occurs. This means that
the caller must always zero-initialize the struct before passing
it in. We forgot to do this in v7m_stack_read() and v7m_stack_write().
Correct the error.

Backports commit ab44c7b71fa683b9402bea0d367b87c881704188 from qemu
2018-10-23 12:58:39 -04:00
Aaron Lindsay 1596801693
target/arm: Mask PMOVSR writes based on supported counters
This is an amendment to my earlier patch:
commit 7ece99b17e832065236c07a158dfac62619ef99b

Backports commit 599b71e277ac7e92807191b20b7163a28c5450ad from qemu
2018-10-23 12:56:45 -04:00
Aaron Lindsay 10c6887e0b
target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
I previously fixed this for PMINTENSET_EL1, but missed these.

Backports commit fc5f6856a02168864a5c1a46866a12839322222f from qemu
2018-10-23 12:56:06 -04:00
Richard Henderson ce9485a63e
target/arm: Fix aarch64_sve_change_el wrt EL0
At present we assert:

arm_el_is_aa64: Assertion `el >= 1 && el <= 3' failed.

The comment in arm_el_is_aa64 explains why asking about EL0 without
extra information is impossible. Add an extra argument to provide
it from the surrounding context.

Fixes: 0ab5953b00b3

Backports commit 9a05f7b67436abdc52bce899f56acfde2e831454 from qemu
2018-10-23 12:44:04 -04:00
Peter Maydell ff812cc152
target/arm: Add v8M stack checks for MSR to SP_NS
Updating the NS stack pointer via MSR to SP_NS should include
a check whether the new SP value is below the stack limit.
No other kinds of update to the various stack pointer and
limit registers via MSR should perform a check.

Backports commit 167765f0739e4a108e8c2e2ff2f37917df5658f9 from qemu
2018-10-08 14:24:30 -04:00
Lioncash cb935d868e
target/arm: Add v8M stack limit checks on NS function calls 2018-10-08 14:15:15 -04:00
Peter Maydell ed3c951fb6
target/arm: Add v8M stack checks on exception entry
Add checks for breaches of the v8M stack limit when the
stack pointer is decremented to push the exception frame
for exception entry.

Note that the exception-entry case is unique in that the
stack pointer is updated to be the limit value if the limit
is hit (per rule R_ZLZG).

Backports commit c32da7aa6205a5ff62ae8d5062f7cad0eae4c1fd from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell b2146058c3
target/arm: Move v7m_using_psp() to internals.h
We're going to want v7m_using_psp() in op_helper.c in the
next patch, so move it from helper.c to internals.h.

Backports commit 5529bf188d996391ff52a0e1801daf9c6a6bfcb0 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell ae4900fba2
target/arm: Define new EXCP type for v8M stack overflows
Define EXCP_STKOF, and arrange for it to cause us to take
a UsageFault with CFSR.STKOF set.

Backports commit 86f026de22d8854eecc004af44895de74225794f from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell 8b3b548961
target/arm: Define new TBFLAG for v8M stack checking
The Arm v8M architecture includes hardware stack limit checking.
When certain instructions update the stack pointer, if the new
value of SP is below the limit set in the associated limit register
then an exception is taken. Add a TB flag that tracks whether
the limit-checking code needs to be emitted.

Backports commit 4730fb85035e99c909db7d14ef76cd17f28f4423 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson a37f24aa11
target/arm: Adjust aarch64_cpu_dump_state for system mode SVE
Use the existing helpers to determine if (1) the fpu is enabled,
(2) sve state is enabled, and (3) the current sve vector length.

Backports commit ced3155141755ba244c988c72c4bde32cc819670 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 87c20b52c0
target/arm: Handle SVE vector length changes in system mode
SVE vector length can change when changing EL, or when writing
to one of the ZCR_ELn registers.

For correctness, our implementation requires that predicate bits
that are inaccessible are never set. Which means noticing length
changes and zeroing the appropriate register bits.

Backports commit 0ab5953b00b3165877d00cf75de628c51670b550 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 2fb9c4c41d
target/arm: Pass in current_el to fp and sve_exception_el
We are going to want to determine whether sve is enabled
for EL other than current.

Backports commit 2de7ace292cf7846b0cda0e940272d2cb0e06859 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 00fc5d43fd
target/arm: Adjust sve_exception_el
Check for EL3 before testing CPTR_EL3.EZ. Return 0 when the exception
should be routed via AdvSIMDFPAccessTrap. Mirror the structure of
CheckSVEEnabled more closely.

Fixes: 5be5e8eda78

Backports commit 60eed0869d68b91eff71cc0a0facb01983726a5d from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 1081e5e7a4
target/arm: Define ID_AA64ZFR0_EL1
Given that the only field defined for this new register may only
be 0, we don't actually need to change anything except the name.

Backports commit 9516d7725ec1deaa6ef5ccc5a26d005650d6c524 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell d82046cafc
target/arm: Don't read r4 from v8M exception stackframe twice
A cut-and-paste error meant we were reading r4 from the v8M
callee-saves exception stack frame twice. This is harmless
since it just meant we did two memory accesses to the same
location, but it's unnecessary. Delete it.

Backports commit e5ae4d0c063fbcca4cbbd26bcefbf1760cfac2aa from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell f628cbdfc3
target/arm: Correct condition for v8M callee stack push
In v7m_exception_taken() we were incorrectly using a
"LR bit EXCRET.ES is 1" check when it should be 0
(compare the pseudocode ExceptionTaken() function).
This meant we didn't stack the callee-saved registers
when tailchaining from a NonSecure to a Secure exception.

Backports commit 7b73a1ca05b33d42278ce29cea4652e22d408165 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 994038c817
target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs
Not only are the sve-related tb_flags fields unused when SVE is
disabled, but not all of the cpu registers are initialized properly
for computing same. This can corrupt other fields by ORing in -1,
which might result in QEMU crashing.

This bug was not present in 3.0, but this patch is cc'd to
stable because adf92eab90e3f5f34c285 where the bug was
introduced was marked for stable.

Backports commit e79b445d896deb61909be52b61b87c98a9ed96f7 from qemu
2018-09-25 21:17:32 -04:00
Peter Maydell 3619f707a6
target/arm: Clear CPSR.IL and CPSR.J on 32-bit exception entry
On 32-bit exception entry, CPSR.J must always be set to 0
(see v7A Arm ARM DDI0406C.c B1.8.5). CPSR.IL must also
be cleared on 32-bit exception entry (see v8A Arm ARM
DDI0487C.a G1.10).

Clear these bits. (This fixes a bug which will never be noticed
by non-buggy guests.)

Backports commit 829f9fd394ab082753308cbda165c13eaf8fae49 from qemu
2018-08-25 04:28:22 -04:00
Peter Maydell 16477f908e
target/arm: Implement support for taking exceptions to Hyp mode
Implement the necessary support code for taking exceptions
to Hyp mode in AArch32.

Backports commit b9bc21ff9f9bb2d841adf1dc7f6f8ddfb9ab8b5e from qemu
2018-08-25 04:27:18 -04:00
Peter Maydell 4c445c2300
target/arm: Factor out code for taking an AArch32 exception
Factor out the code which changes the CPU state so as to
actually take an exception to AArch32. We're going to want
to use this for handling exception entry to Hyp mode.

Backports commit dea8378bb3e86f2c6bd05afb3927619f7c51bb47 from qemu
2018-08-25 04:23:53 -04:00
Peter Maydell c238d5cc6b
target/arm: Implement AArch32 HCR and HCR2
The AArch32 HCR and HCR2 registers alias HCR_EL2
bits [31:0] and [63:32]; implement them.

Since HCR2 exists in ARMv8 but not ARMv7, we need new
regdef arrays for "we have EL3, not EL2, we're ARMv8"
and "we have EL2, we're ARMv8" to hold the definitions.

Backports commit ce4afed8396aabaf87cd42fbe8a4c14f7a9d5c10 from qemu
2018-08-25 04:21:57 -04:00
Peter Maydell cc57e03da4
target/arm: Implement RAZ/WI HACTLR2
The v8 AArch32 HACTLR2 register maps to bits [63:32] of ACTLR_EL2.
We implement ACTLR_EL2 as RAZ/WI, so make HACTLR2 also RAZ/WI.
(We put the regdef next to ACTLR_EL2 as a reminder in case we
ever make ACTLR_EL2 something other than RAZ/WI).

Backports commit 0e0456ab8895a5e85998904549e331d36c2692a5 from qemu
2018-08-25 04:13:37 -04:00
Richard Henderson 241fb78efc
target/arm: Use the float-to-int-scale softfloat routines
Backports commit 323cd490845acf663159ca26e35cb977ad9b85a2 from qemu
2018-08-25 04:11:51 -04:00
Richard Henderson 7d3ad3e053
target/arm: Use the int-to-float-scale softfloat routines
Backports commit b9b903cf245e4df1199cc7b2b80381ef85a6b1ab from qemu
2018-08-25 04:07:43 -04:00
Peter Maydell 858aa2d094
target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2
The AArch32 HSR is the equivalent of AArch64 ESR_EL2;
we can implement it by marking our existing ESR_EL2 regdef
as STATE_BOTH. It also needs to be "RES0 from EL3 if
EL2 not implemented", so add the missing stanza to
el3_no_el2_cp_reginfo.

Backports commit 68e78e332cb1c3f8b0317a0443acb2b5e190f0dd from qemu
2018-08-22 12:48:35 -04:00
Peter Maydell c21d2062e4
target/arm: Implement AArch32 Hyp FARs
The AArch32 virtualization extensions support these fault address
registers:
* HDFAR: aliased with AArch64 FAR_EL2[31:0] and AArch32 DFAR(S)
* HIFAR: aliased with AArch64 FAR_EL2[63:32] and AArch32 IFAR(S)

Implement the accessors for these. This fixes in passing a bug
where we weren't implementing the "RES0 from EL3 if EL2 not
implemented" behaviour for AArch64 FAR_EL2.

Backports commit cba517c31e7df8932c4473c477a0f01d8a0adc48 from qemu
2018-08-22 12:45:23 -04:00
Peter Maydell 763a71a962
target/arm: Implement AArch32 HVBAR
Implement the AArch32 HVBAR register; we can do this just by
making the existing VBAR_EL2 regdefs be STATE_BOTH.

Backports commit d79e0c0608899428281a17c414ccf1a82d86ab85 from qemu
2018-08-22 12:37:12 -04:00
Peter Maydell e9fb085aa1
target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs
ARMCPRegInfo structs will default to .cp = 15 if they
are ARM_CP_STATE_BOTH, but not if they are ARM_CP_STATE_AA32
(because a coprocessor number of 0 is valid for AArch32).
We forgot to explicitly set .cp = 15 for the HMAIR1 and
HAMAIR1 regdefs, which meant they would UNDEF when the guest
tried to access them under cp15.

Backports commit b5ede85bfb7ba1a8f6086494c82f400b29969f65 from qemu
2018-08-22 12:36:11 -04:00
Peter Maydell 2d2c6982ce
target/arm: Correct typo in HAMAIR1 regdef name
We implement the HAMAIR1 register as RAZ/WI; we had a typo in the
regdef, though, and were incorrectly naming it HMAIR1 (which is
a different register which we also implement as RAZ/WI).

Backports commit 55b53c718b2f684793eeefcf1c1a548ee97e23aa from qemu
2018-08-22 12:33:45 -04:00
Richard Henderson 15a68a354c
target/arm: Ignore float_flag_input_denormal from fp_status_f16
When FZ is set, input_denormal exceptions are recognized, but this does
not happen with FZ16. The softfloat code has no way to distinguish
these bits and will raise such exceptions into fp_status_f16.flags,
so ignore them when computing the accumulated flags.

Backports commit 19062c169e5bcdda3d60df9161228e107bf0f96e from qemu
2018-08-17 14:03:41 -04:00
Richard Henderson f787dd15fd
target/arm: Adjust FPCR_MASK for FZ16
When support for FZ16 was added, we failed to include the bit
within FPCR_MASK, which means that it could never be set.
Continue to zero FZ16 when ARMv8.2-FP16 is not enabled.

Fixes: d81ce0ef2c4

Backports commit 0b62159be33d45d00dfa34a317c6d3da30ffb480 from qemu
2018-08-17 14:02:49 -04:00
Lioncash 9a2581aff6
Comment out tailchaining code
Allows build to continue.
2018-08-16 07:11:31 -04:00
Peter Maydell 8d34a271f6
target/arm: Implement tailchaining for M profile cores
Tailchaining is an optimization in handling of exception return
for M-profile cores: if we are about to pop the exception stack
for an exception return, but there is a pending exception which
is higher priority than the priority we are returning to, then
instead of unstacking and then immediately taking the exception
and stacking registers again, we can chain to the pending
exception without unstacking and stacking.

For v6M and v7M it is IMPDEF whether tailchaining happens for pending
exceptions; for v8M this is architecturally required. Implement it
in QEMU for all M-profile cores, since in practice v6M and v7M
hardware implementations generally do have it.

(We were already doing tailchaining for derived exceptions which
happened during exception return, like the validity checks and
stack access failures; these have always been required to be
tailchained for all versions of the architecture.)

Backports commit 5f62d3b9e67bfc3deb970e3c7fb7df7e57d46fc3 from qemu
2018-08-16 07:03:51 -04:00
Peter Maydell e3be0c4aa6
target/arm: Restore M-profile CONTROL.SPSEL before any tailchaining
On exception return for M-profile, we must restore the CONTROL.SPSEL
bit from the EXCRET value before we do any kind of tailchaining,
including for the derived exceptions on integrity check failures.
Otherwise we will give the guest an incorrect EXCRET.SPSEL value on
exception entry for the tailchained exception.

Backports commit 89b1fec193b81b6ad0bd2975f2fa179980cc722e from qemu
2018-08-16 06:58:34 -04:00
Peter Maydell e044c59cc1
target/arm: Initialize exc_secure correctly in do_v7m_exception_exit()
In do_v7m_exception_exit(), we use the exc_secure variable to track
whether the exception we're returning from is secure or non-secure.
Unfortunately the statement initializing this was accidentally
inside an "if (env->v7m.exception != ARMV7M_EXCP_NMI)" conditional,
which meant that we were using the wrong value for NMI handlers.
Move the initialization out to the right place.

Backports commit b8109608bc6f3337298d44ac4369bf0bc8c3a1e4 from qemu
2018-08-16 06:57:27 -04:00
Peter Maydell c79ebe4965
target/arm: Treat SCTLR_EL1.M as if it were zero when HCR_EL2.TGE is set
One of the required effects of setting HCR_EL2.TGE is that when
SCR_EL3.NS is 1 then SCTLR_EL1.M must behave as if it is zero for
all purposes except direct reads. That is, it effectively disables
the MMU for the NS EL0/EL1 translation regime.

Backports commit 3d0e3080d8b7abcddc038d18e8401861c369c4c1 from qemu
2018-08-16 06:46:09 -04:00
Peter Maydell 12248b8685
target/arm: Provide accessor functions for HCR_EL2.{IMO, FMO, AMO}
The IMO, FMO and AMO bits in HCR_EL2 are defined to "behave as
1 for all purposes other than direct reads" if HCR_EL2.TGE
is set and HCR_EL2.E2H is 0, and to "behave as 0 for all
purposes other than direct reads" if HCR_EL2.TGE is set
and HRC_EL2.E2H is 1.

To avoid having to check E2H and TGE everywhere where we test IMO and
FMO, provide accessors arm_hcr_el2_imo(), arm_hcr_el2_fmo()and
arm_hcr_el2_amo(). We don't implement ARMv8.1-VHE yet, so the E2H
case will never be true, but we include the logic to save effort when
we eventually do get to that.

(Note that in several of these callsites the change doesn't
actually make a difference as either the callsite is handling
TGE specially anyway, or the CPU can't get into that situation
with TGE set; we change everywhere for consistency.)

Backports commit ac656b166b57332ee397e9781810c956f4f5fde5 from qemu
2018-08-16 06:41:45 -04:00
Peter Maydell 6b8d98bcd2
target/arm: Honour HCR_EL2.TGE and MDCR_EL2.TDE in debug register access checks
Some debug registers can be trapped via MDCR_EL2 bits TDRA, TDOSA,
and TDA, which we implement in the functions access_tdra(),
access_tdosa() and access_tda(). If MDCR_EL2.TDE or HCR_EL2.TGE
are 1, the TDRA, TDOSA and TDA bits should behave as if they were 1.
Implement this by having the access functions check MDCR_EL2.TDE
and HCR_EL2.TGE.

Backports commit 30ac6339dca3fe0d05a611f12eedd5af20af585a from qemu
2018-08-16 06:41:02 -04:00
Julia Suvorova 9d7deb2997
arm: Add ARMv6-M programmer's model support
Forbid stack alignment change. (CCR)
Reserve FAULTMASK, BASEPRI registers.
Report any fault as a HardFault. Disable MemManage, BusFault and
UsageFault, so they always escalated to HardFault. (SHCSR)

Backports commit 22ab3460017cfcfb6b50f05838ad142e08becce5 from qemu
2018-08-16 06:36:27 -04:00
Julia Suvorova b67b948feb
target/arm: Forbid unprivileged mode for M Baseline
MSR handling is the only place where CONTROL.nPRIV is modified.

Backports commit def183446cebc0090f6d885383a6502302249f33 from qemu
2018-08-16 06:34:29 -04:00