Commit graph

853 commits

Author SHA1 Message Date
Peter Maydell a9d07a19c0
target/arm: Track the state of our irq lines from the GIC explicitly
Currently we track the state of the four irq lines from the GIC
only via the cs->interrupt_request or KVM irq state. That means
that we assume that an interrupt is asserted if and only if the
external line is set. This assumption is incorrect for VIRQ
and VFIQ, because the HCR_EL2.{VI,VF} bits allow assertion
of VIRQ and VFIQ separately from the state of the external line.

To handle this, start tracking the state of the external lines
explicitly in a CPU state struct field, as is common practice
for devices.

The complicated part of this is dealing with inbound migration
from an older QEMU which didn't have this state. We assume in
that case that the older QEMU did not implement the HCR_EL2.{VI,VF}
bits as generating interrupts, and so the line state matches
the current state in cs->interrupt_request. (This is not quite
true between commit 8a0fc3a29fc2315325400c7 and its revert, but
that commit is broken and never made it into any released QEMU
version.)

Backports relevant parts of commit  ed89f078ff3d6684ce3e538e4777a3bb4ec3e2b1 from qemu
2018-11-16 21:47:59 -05:00
Peter Maydell 730c99bcc2
Revert "target/arm: Implement HCR.VI and VF"
This reverts commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f.

The implementation of HCR.VI and VF in that commit is not
correct -- they do not track the overall "is there a pending
VIRQ or VFIQ" status, but whether there is a pending interrupt
due to "this mechanism", ie the hypervisor having set the VI/VF
bits. The overall pending state for VIRQ and VFIQ is effectively
the logical OR of the inbound lines from the GIC with the
VI and VF bits. Commit 8a0fc3a29fc231 would result in pending
VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR.

As a preliminary to implementing the HCR.VI/VF feature properly,
revert the broken one entirely.

Backports commit c624ea0fa7ffc9e2cc3e2b36c92b5c960954489f from qemu
2018-11-16 21:46:29 -05:00
Alex Bennée 5b4c46eeab
arm: fix aa64_generate_debug_exceptions to work with EL2
The test was incomplete and incorrectly caused debug exceptions to be
generated when returning to EL2 after a failed attempt to single-step
an EL1 instruction. Fix this while cleaning up the function a little.

Backports commit 22af90255ec2100a44cbbb7f0460ba15eed79538 from qemu
2018-11-16 21:43:41 -05:00
Alex Bennée 2a3edfce37
arm: use symbolic MDCR_TDE in arm_debug_target_el
We already have this symbol defined so lets use it.

Backports commit b281ba4223c302c41ff8104152bfdd44de4fe798 from qemu
2018-11-16 21:42:30 -05:00
Richard Henderson 295dd866b4
target/arm: Fix typo in tlbi_aa64_vmalle1_write
This would cause an infinite recursion or loop.

Backports commit 09a86dfa3f07904792a85990b0b41939417785cd from qemu
2018-11-16 21:41:28 -05:00
Peter Maydell 3edbb8180a
target/arm: Remove workaround for small SAU regions
Before we supported direct execution from MMIO regions, we
implemented workarounds in commit 720424359917887c926a33d2
which let us avoid doing so, even if the SAU or MPU region
was less than page-sized.

Once we implemented execute-from-MMIO, we removed part
of those workarounds in commit d4b6275df320cee76; but
we forgot the one in get_phys_addr_pmsav8() which
suppressed use of small SAU regions in executable regions.
Remove that workaround now.

Backports commit 521ed6b4015ba39a2e39c65a94643f3e6412edc4 from qemu
2018-11-16 21:40:10 -05:00
Peter Maydell 680c79956d
target/arm: Allow execution from small regions
Now that we have full support for small regions, including execution,
we can remove the workarounds where we marked all small regions as
non-executable for the M-profile MPU and SAU.

Backports commit d4b6275df320cee764d56b194b1898547f545857 from qemu
2018-11-16 21:39:33 -05:00
Peter Maydell f694264212
target/arm: Remove antique TODO comment
Remove a TODO comment about implementing the vectored interrupt
controller. We have had an implementation of that for a decade;
it's in hw/intc/pl190.c.

Backports commit e24ad484909e7a00ca4f6332f3698facf0ba3394 from qemu
2018-11-16 18:24:49 -05:00
Peter Maydell 84d5a60c15
target/arm: Fix ATS1Hx instructions
ATS1HR and ATS1HW (which allow AArch32 EL2 to do address translations
on the EL2 translation regime) were implemented in commit 14db7fe09a2c8.
However, we got them wrong: these should do stage 1 address translations
as defined for NS-EL2, which is ARMMMUIdx_S1E2. We were incorrectly
making them perform stage 2 translations.

A few years later in commit 1313e2d7e2cd we forgot entirely that
we'd implemented ATS1Hx, and added a comment that ATS1Hx were
"not supported yet". Remove the comment; there is no extra code
needed to handle these operations in do_ats_write(), because
arm_s1_regime_using_lpae_format() returns true for ARMMMUIdx_S1E2,
which forces 64-bit PAR format.

Backports commit 23463e0e4aeb2f0a9c60549a2c163f4adc0b8512 from qemu
2018-11-11 08:39:19 -05:00
Peter Maydell a445db5c02
target/arm: Set S and PTW in 64-bit PAR format
In do_ats_write() we construct a PAR value based on the result
of the translation. A comment says "S2WLK and FSTAGE are always
zero, because we don't implement virtualization".
Since we do in fact now implement virtualization, add the missing
code that sets these bits based on the reported ARMMMUFaultInfo.

(These bits are named PTW and S in ARMv8, so we follow that
convention in the new comments in this patch.)

Backports commit 0f7b791b35f24cb1333f779705a3f6472e6935de from qemu
2018-11-11 08:38:23 -05:00
Peter Maydell 5aa5ebbcc9
target/arm: Remove can't-happen if() from handle_vec_simd_shli()
In handle_vec_simd_shli() we have a check:

if (size > 3 && !is_q) {
    unallocated_encoding(s);
    return;
}

However this can never be true, because we calculate
int size = 32 - clz32(immh) - 1;
where immh is a 4 bit field which we know cannot be all-zeroes.
So the clz32() return must be in {28,29,30,31} and the resulting
size is in {0,1,2,3}, and "size > 3" is never true.

This unnecessary code confuses Coverity's analysis:
in CID 1396476 it thinks we might later index off the
end of an array because the condition implies that we
might have a size > 3.

Remove the code, and instead assert that the size is in [0..3],
since the decode that enforces that is somewhat distant from
this function.

Backports commit f6c98f91f56031141a47f86225fdc30f0f9f84fb from qemu
2018-11-11 08:37:16 -05:00
Richard Henderson 0557899c8e
target/arm: Conditionalize some asserts on aarch32 support
When populating id registers from kvm, on a host that doesn't support
aarch32 mode at all, neither arm_div nor jazelle will be supported either.

Backports commit 0f8d06f16c9d1041d728d09d464462ebe713c662 from qemu
2018-11-11 08:32:46 -05:00
Richard Henderson 4d49c004e4
decodetree: Remove insn argument from trans_* expanders
This allows trans_* expanders to be shared between decoders
for 32 and 16-bit insns, by not tying the expander to the
size of the insn that produced it.

This change requires adjusting the two existing users to match.

Backports commit 3a7be5546506be62d5c6c4b804119cedf9e367d6 from qemu
2018-11-11 08:27:01 -05:00
Richard Henderson e9fe7d3c8d
target/arm: Only flush tlb if ASID changes
Since QEMU does not implement ASIDs, changes to the ASID must flush the
tlb. However, if the ASID does not change there is no reason to flush.

In testing a boot of the Ubuntu installer to the first menu, this reduces
the number of flushes by 30%, or nearly 600k instances.

Backports commit 93f379b0c43617b1361f742f261479eaed4959cb from qemu
2018-11-10 11:26:24 -05:00
Richard Henderson 15a6b3f771
target/arm: Remove writefn from TTBR0_EL3
The EL3 version of this register does not include an ASID,
and so the tlb_flush performed by vmsa_ttbr_write is not needed.

Backports commit f478847f1ee0df9397f561025ab2f687fd923571 from qemu
2018-11-10 11:25:39 -05:00
Richard Henderson 1bcba0737e
target/arm: Reorg NEON VLD/VST single element to one lane
Instead of shifts and masks, use direct loads and stores from
the neon register file.

Backports commit 2d6ac920837f558be214ad2ddd28cad7f3b15e5c from qemu
2018-11-10 11:24:37 -05:00
Richard Henderson 37103f1bc4
target/arm: Promote consecutive memory ops for aa32
For a sequence of loads or stores from a single register,
little-endian operations can be promoted to an 8-byte op.
This can reduce the number of operations by a factor of 8.

Backports commit e23f12b3a252352b575908ca7b94587acd004641 from qemu
2018-11-10 11:19:15 -05:00
Richard Henderson 1cab7a41ac
target/arm: Reorg NEON VLD/VST all elements
Instead of shifts and masks, use direct loads and stores from the neon
register file. Mirror the iteration structure of the ARM pseudocode
more closely. Correct the parameters of the VLD2 A2 insn.

Note that this includes a bugfix for handling of the insn
"VLD2 (multiple 2-element structures)" -- we were using an
incorrect stride value.

Backports commit ac55d00709e78cd39dfa298dcaac7aecb58762e8 from qemu
2018-11-10 11:18:45 -05:00
Richard Henderson a2239b9f5b
target/arm: Use gvec for NEON VLD all lanes
Backports commit 7377c2c97e20e64ed9b481eb2d9b9084bfd5b7e9 from qemu
2018-11-10 11:08:29 -05:00
Richard Henderson 985acb9cde
target/arm: Use gvec for NEON_3R_VTST_VCEQ, NEON_3R_VCGT, NEON_3R_VCGE
Move cmtst_op expanders from translate-a64.c.

Backports commit ea580fa312674c1ba82a8b137caf42b0609ce3e3 from qemu
2018-11-10 11:03:42 -05:00
Richard Henderson 5d9c0e52bf
target/arm: Use gvec for NEON_3R_VML
Move mla_op and mls_op expanders from translate-a64.c.

Backports commit 4a7832b095b9ce97a815749a13516f5cfb3c5dd4 from qemu
2018-11-10 10:58:44 -05:00
Richard Henderson 79bbb7c730
target/arm: Use gvec for VSRI, VSLI
Move shi_op and sli_op expanders from translate-a64.c.

Backports commit f3cd8218d1d3e534877ce3f3cb61c6757d10f9df from qemu
2018-11-10 10:53:28 -05:00
Lioncash edb36c7505
target/arm: Use gvec for VSRA 2018-11-10 10:32:29 -05:00
Richard Henderson b5877f1dfb
target/arm: Use gvec for VSHR, VSHL
Backports commit 1dc8425e551be1371d657e94367f37130cd7aede from qemu
2018-11-10 10:14:31 -05:00
Lioncash 7790ca1ccb
target/arm: Use gvec for NEON_3R_VMUL 2018-11-10 10:11:10 -05:00
Richard Henderson dfdc6bc05c
target/arm: Use gvec for NEON_2RM_VMN, NEON_2RM_VNEG
Backports commit 4bf940bebad273e4b3534ae3f83f2c9d1191d3a2 from qemu
2018-11-10 10:09:38 -05:00
Richard Henderson 7b4b5ac249
target/arm: Use gvec for NEON_3R_VADD_VSUB insns
Backports commit e4717ae02dd0c2e544a07302c1ed473775209aba from qemu
2018-11-10 10:08:23 -05:00
Richard Henderson 0965b9513a
target/arm: Use gvec for NEON_3R_LOGIC insns
Move expanders for VBSL, VBIT, and VBIF from translate-a64.c.

Backports commit eabcd6faa90461e0b7463f4ebe75b8d050487c9c from qemu
2018-11-10 10:06:13 -05:00
Richard Henderson 9f767248a2
target/arm: Use gvec for NEON VMOV, VMVN, VBIC & VORR (immediate)
Backports commit 246fa4aca95e213fba10c8222dbc6bd0a9a2a8d4 from qemu
2018-11-10 09:56:30 -05:00
Richard Henderson c1251a19e1
target/arm: Use gvec for NEON VDUP
Also introduces neon_element_offset to find the env offset
of a specific element within a neon register.

Backports commit 32f91fb71f4c32113ec8c2af5f74f14abe6c7162 from qemu
2018-11-10 09:51:40 -05:00
Richard Henderson 3d5f040608
target/arm: Mark some arrays const
Backports commit 308e5636152594daa4c5597b1188d44d7266db04 from qemu
2018-11-10 09:49:25 -05:00
Richard Henderson 931b49fb06
target/arm: Promote consecutive memory ops for aa64
For a sequence of loads or stores from a single register,
little-endian operations can be promoted to an 8-byte op.
This can reduce the number of operations by a factor of 8.

Backports commit 87f9a7f0c8d5122c36743885158782c2348a6d21 from qemu
2018-11-10 09:46:04 -05:00
Richard Henderson e6707b900c
target/arm: Use tcg_gen_gvec_dup_i64 for LD[1-4]R
Backports commit 10e0b33c676b4e8ac80d5929980f4fa6be617c5a from qemu
2018-11-10 09:41:14 -05:00
Richard Henderson 74aba4ba51
target/arm: Don't call tcg_clear_temp_count
This is done generically in translator_loop.

Backports commit 7108e255c2d95b44c9dfee8075d0d6fb391281a8 from qemu
2018-11-10 09:40:06 -05:00
Richard Henderson 9bbc412c66
target/arm: Hoist address increment for vector memory ops
This can reduce the number of opcodes required for certain
complex forms of load-multiple (e.g. ld4.16b).

Backports commit a7d8143aed2268f147cc1abfebc848ed6282a313 from qemu
2018-11-10 09:39:20 -05:00
Peter Maydell d60fe610bb
target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode
For traps of FP/SIMD instructions to AArch32 Hyp mode, the syndrome
provided in HSR has more information than is reported to AArch64.
Specifically, there are extra fields TA and coproc which indicate
whether the trapped instruction was FP or SIMD. Add this extra
information to the syndromes we construct, and mask it out when
taking the exception to AArch64.

Backports commit 4be42f4013fa1a9df47b48aae5148767bed8e80c from qemu
2018-11-10 09:36:41 -05:00
Peter Maydell 075bac4d57
target/arm: Get IL bit correct for v7 syndrome values
For the v7 version of the Arm architecture, the IL bit in
syndrome register values where the field is not valid was
defined to be UNK/SBZP. In v8 this is RES1, which is what
QEMU currently implements. Handle the desired v7 behaviour
by squashing the IL bit for the affected cases:
* EC == EC_UNCATEGORIZED
* prefetch aborts
* data aborts where ISV is 0

(The fourth case listed in the v8 Arm ARM DDI 0487C.a in
section G7.2.70, "illegal state exception", can't happen
on a v7 CPU.)

This deals with a corner case noted in a comment.

Backports commit 2ed08180db096ea5e44573529b85e09b1ed10b08 from qemu
2018-11-10 09:29:13 -05:00
Peter Maydell 99516b43a3
target/arm: New utility function to extract EC from syndrome
Create and use a utility function to extract the EC field
from a syndrome, rather than open-coding the shift.

Backports commit 64b91e3f890a8c221b65c6820a5ee39107ee40f5 from qemu
2018-11-10 09:28:23 -05:00
Peter Maydell ebe442b1d4
target/arm: Implement HCR.PTW
If the HCR_EL2 PTW virtualizaiton configuration register bit
is set, then this means that a stage 2 Permission fault must
be generated if a stage 1 translation table access is made
to an address that is mapped as Device memory in stage 2.
Implement this.

Backports commit eadb2febf05452bd8062c4c7823d7d789142500c from qemu
2018-11-10 09:25:57 -05:00
Peter Maydell 28fcb58c69
target/arm: Implement HCR.VI and VF
The HCR_EL2 VI and VF bits are supposed to track whether there is
a pending virtual IRQ or virtual FIQ. For QEMU we store the
pending VIRQ/VFIQ status in cs->interrupt_request, so this means:
* if the register is read we must get these bit values from
cs->interrupt_request
* if the register is written then we must write the bit
values back into cs->interrupt_request

Backports commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f from qemu
2018-11-10 09:23:21 -05:00
Peter Maydell 0f0befc90a
target/arm: ISR_EL1 bits track virtual interrupts if IMO/FMO set
The A/I/F bits in ISR_EL1 should track the virtual interrupt
status, not the physical interrupt status, if the associated
HCR_EL2.AMO/IMO/FMO bit is set. Implement this, rather than
always showing the physical interrupt status.

We don't currently implement anything to do with external
aborts, so this applies only to the I and F bits (though it
ought to be possible for the outer guest to present a virtual
external abort to the inner guest, even if QEMU doesn't
emulate physical external aborts, so there is missing
functionality in this area).

Backports commit 636540e9c40bd0931ef3022cb953bb7dbecd74ed from qemu
2018-11-10 09:20:58 -05:00
Peter Maydell f0c9e690fb
target/arm: Implement HCR.DC
The HCR.DC virtualization configuration register bit has the
following effects:
* SCTLR.M behaves as if it is 0 for all purposes except
direct reads of the bit
* HCR.VM behaves as if it is 1 for all purposes except
direct reads of the bit
* the memory type produced by the first stage of the EL1&EL0
translation regime is Normal Non-Shareable,
Inner Write-Back Read-Allocate Write-Allocate,
Outer Write-Back Read-Allocate Write-Allocate.

Implement this behaviour.

Backports commit 9d1bab337caf2324a233e5937f415fad4ce1641b from qemu
2018-11-10 09:19:44 -05:00
Peter Maydell b9e7fa2d80
target/arm: Implement HCR.FB
The HCR.FB virtualization configuration register bit requests that
TLB maintenance, branch predictor invalidate-all and icache
invalidate-all operations performed in NS EL1 should be upgraded
from "local CPU only to "broadcast within Inner Shareable domain".
For QEMU we NOP the branch predictor and icache operations, so
we only need to upgrade the TLB invalidates:
AArch32 TLBIALL, TLBIMVA, TLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID,
ITLBIALL, ITLBIMVA, ITLBIASID, TLBIMVAA, TLBIMVAL, TLBIMVAAL
AArch64 TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1,
TLBI VALE1, TLBI VAALE1

Backports commit b4ab8ce98b8c482c8986785800f238d32a1578a9 from qemu
2018-11-10 09:17:51 -05:00
Lioncash a0358202a7
target/arm: Improve debug logging of AArch32 exception return
For AArch32, exception return happens through certain kinds
of CPSR write. We don't currently have any CPU_LOG_INT logging
of these events (unlike AArch64, where we log in the ERET
instruction). Add some suitable logging.

This will log exception returns like this:
Exception return from AArch32 hyp to usr PC 0x80100374

paralleling the existing logging in the exception_return
helper for AArch64 exception returns:
Exception return from AArch64 EL2 to AArch64 EL0 PC 0x8003045c
Exception return from AArch64 EL2 to AArch32 EL0 PC 0x8003045c

(Note that an AArch32 exception return can only be
AArch32->AArch32, never to AArch64.)

Backports commit 81e3728407bf4a12f83e14fd410d5f0a7d29b5b4 from qemu
2018-11-10 09:09:52 -05:00
Richard Henderson 03ec90f39b
target/arm: Convert v8.2-fp16 from feature bit to aa64pfr0 test
Backports commit 5763190fa8705863b4b725aa1657661a97113eb4 from qemu
2018-11-10 08:34:32 -05:00
Richard Henderson 0286f9525d
target/arm: Convert sve from feature bit to aa64pfr0 test
Backports commit cd208a1c3923bc097ec55c5b207d79294ab0e719 from qemu
2018-11-10 08:27:35 -05:00
Richard Henderson 03e2d64aed
target/arm: Convert jazelle from feature bit to isar1 test
Having V6 alone imply jazelle was wrong for cortex-m0.
Change to an assertion for V6 & !M.

This was harmless, because the only place we tested ARM_FEATURE_JAZELLE
was for 'bxj' in disas_arm(), which is unreachable for M-profile cores.

Backports commit 09cbd50198d5dcac8bea2e47fa5dd641ec505fae from qemu
2018-11-10 08:24:11 -05:00
Richard Henderson 4a58a81e31
target/arm: Convert division from feature bits to isar0 tests
Both arm and thumb2 division are controlled by the same ISAR field,
which takes care of the arm implies thumb case. Having M imply
thumb2 division was wrong for cortex-m0, which is v6m and does not
have thumb2 at all, much less thumb2 division.

Backports commit 7e0cf8b47f0e67cebbc3dfa73f304e56ad1a090f from qemu
2018-11-10 08:21:02 -05:00
Richard Henderson 4221703f18
target/arm: Convert v8 extensions from feature bits to isar tests
Most of the v8 extensions are self-contained within the ISAR
registers and are not implied by other feature bits, which
makes them the easiest to convert.

Backports commit 962fcbf2efe57231a9f5df0ae0f40c05e35628ba from qemu
2018-11-10 08:17:57 -05:00
Richard Henderson e5797bb0b7
target/arm: V8M should not imply V7VE
Instantiating mps2-an505 (cortex-m33) will fail make check when
V7VE asserts that ID_ISAR0.Divide includes ARM division. It is
also wrong to include ARM_FEATURE_LPAE.

Backports commit 5256df880d1312a58472af3fb0a3c51e708f2161 from qemu
2018-11-10 08:02:26 -05:00
Richard Henderson 1a714e97af
target/arm: Move some system registers into a substructure
Create struct ARMISARegisters, to be accessed during translation.

Backports commit 47576b94af5c406fc6521fb336fb5c12beeac3f8 from qemu
2018-11-10 08:00:32 -05:00
Dongjiu Geng 7087f7f398
target/arm: Add support for VCPU event states
This patch extends the qemu-kvm state sync logic with support for
KVM_GET/SET_VCPU_EVENTS, giving access to yet missing SError exception.
And also it can support the exception state migration.

The SError exception states include SError pending state and ESR value,
the kvm_put/get_vcpu_events() will be called when set or get system
registers. When do migration, if source machine has SError pending,
QEMU will do this migration regardless whether the target machine supports
to specify guest ESR value, because if target machine does not support that,
it can also inject the SError with zero ESR value.

Backports the relevant parts of commit
202ccb6bab5fe26bca2c82bff23302f7acfd1940 from qemu
2018-11-10 07:49:15 -05:00
Richard Henderson af6c47e192
target/arm: Check HAVE_CMPXCHG128 at translate time
Backports part of commit 62823083b8a2da8e126bb82b7b70f68eaa27b338 from
qemu
2018-10-23 15:29:46 -04:00
Richard Henderson 65beab9dd9
target/arm: Convert to HAVE_CMPXCHG128
Backports commit 1ec182c3337993a7d8b3983a1ac4f608c1d0fd64 from qemu
2018-10-23 15:25:30 -04:00
Lioncash 5f12065284
sve_helper: Use the QEMU_FLATTEN macro instead of the compiler attribute directly
Keeps the code compiler-independent.
2018-10-23 13:05:02 -04:00
Peter Maydell 64661a9165
target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
The get_phys_addr() functions take a pointer to an ARMMMUFaultInfo
struct, which they fill in only if a fault occurs. This means that
the caller must always zero-initialize the struct before passing
it in. We forgot to do this in v7m_stack_read() and v7m_stack_write().
Correct the error.

Backports commit ab44c7b71fa683b9402bea0d367b87c881704188 from qemu
2018-10-23 12:58:39 -04:00
Aaron Lindsay 1596801693
target/arm: Mask PMOVSR writes based on supported counters
This is an amendment to my earlier patch:
commit 7ece99b17e832065236c07a158dfac62619ef99b

Backports commit 599b71e277ac7e92807191b20b7163a28c5450ad from qemu
2018-10-23 12:56:45 -04:00
Aaron Lindsay 10c6887e0b
target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
I previously fixed this for PMINTENSET_EL1, but missed these.

Backports commit fc5f6856a02168864a5c1a46866a12839322222f from qemu
2018-10-23 12:56:06 -04:00
Edgar E. Iglesias 0595aa5ade
target/arm: Add the Cortex-A72
Backports commit f11b452b95df4a0fc6561c278721cad03b24098b from qemu
2018-10-23 12:54:57 -04:00
Edgar E. Iglesias fa9828845f
target-arm: powerctl: Enable HVC when starting CPUs to EL2
When QEMU provides the equivalent of the EL3 firmware, we
need to enable HVCs in scr_el3 when turning on CPUs that
target EL2.

Backports commit 86278c33d1d71196f5e22ce3ce82a1b34a199754 from qemu
2018-10-23 12:53:40 -04:00
Richard Henderson 3b3bce7d4e
target/arm: Fix cortex-a7 id_isar0
The incorrect value advertised only thumb2 div without arm div.

Backports commit 37bdda89eb7615cb225f781c9fb552e144c68ea7 from qemu
2018-10-23 12:47:15 -04:00
Richard Henderson 3023a9723a
target/arm: Align cortex-r5 id_isar0
The missing nibble made it more difficult to read.

Backports commit aaab8f3400ea5ec9c6cce3607ff26f9be89321d6 from qemu
2018-10-23 12:46:28 -04:00
Richard Henderson 767242174a
target/arm: Define fields of ISAR registers
Backports commit a62e62af9f26bf655fe95ada796f28a6a16c0561 from qemu
2018-10-23 12:45:55 -04:00
Richard Henderson ce9485a63e
target/arm: Fix aarch64_sve_change_el wrt EL0
At present we assert:

arm_el_is_aa64: Assertion `el >= 1 && el <= 3' failed.

The comment in arm_el_is_aa64 explains why asking about EL0 without
extra information is impossible. Add an extra argument to provide
it from the surrounding context.

Fixes: 0ab5953b00b3

Backports commit 9a05f7b67436abdc52bce899f56acfde2e831454 from qemu
2018-10-23 12:44:04 -04:00
Peter Maydell ff812cc152
target/arm: Add v8M stack checks for MSR to SP_NS
Updating the NS stack pointer via MSR to SP_NS should include
a check whether the new SP value is below the stack limit.
No other kinds of update to the various stack pointer and
limit registers via MSR should perform a check.

Backports commit 167765f0739e4a108e8c2e2ff2f37917df5658f9 from qemu
2018-10-08 14:24:30 -04:00
Peter Maydell 76f521e6c3
target/arm: Add v8M stack checks for VLDM/VSTM
Add the v8M stack checks for the VLDM/VSTM
(aka VPUSH/VPOP) instructions. This code is currently
unreachable because we haven't yet implemented M profile
floating point support, but since the change is simple,
we add it now because otherwise we're likely to forget to
do it later.

Backports commit 8a954faf5412d5073d585d85a1da63a09bb5d84e from qemu
2018-10-08 14:23:02 -04:00
Peter Maydell 37d0c7fcf1
target/arm: Add v8M stack checks for Thumb push/pop
Add v8M stack checks for the 16-bit Thumb push/pop
encodings: STMDB, STMFD, LDM, LDMIA, LDMFD.

Backports commit aa369e5c08bbe2748d2be96f13f4ef469a4d3080 from qemu
2018-10-08 14:22:08 -04:00
Peter Maydell ef9afb1855
target/arm: Add v8M stack checks for T32 load/store single
Add v8M stack checks for the instructions in the T32
"load/store single" encoding class: these are the
"immediate pre-indexed" and "immediate, post-indexed"
LDR and STR instructions.

Backports commit 0bc003bad9752afc61624cb680226c922f34f82c from qemu
2018-10-08 14:20:58 -04:00
Peter Maydell de30651f5e
target/arm: Add v8M stack checks for Thumb2 LDM/STM
Add the v8M stack checks for:
* LDM (T2 encoding)
* STM (T2 encoding)

This includes the 32-bit encodings of the instructions listed
in v8M ARM ARM rule R_YVWT as
* LDM, LDMIA, LDMFD
* LDMDB, LDMEA
* POP (multiple registers)
* PUSH (muliple registers)
* STM, STMIA, STMEA
* STMDB, STMFD

We perform the stack limit before doing any other part
of the load or store.

Backports commit 7c0ed88e7d6bee3e55c3d8935c46226cb544191a from qemu
2018-10-08 14:19:14 -04:00
Peter Maydell bb97240df6
target/arm: Add v8M stack checks for LDRD/STRD (imm)
Add the v8M stack checks for:
* LDRD (immediate)
* STRD (immediate)

Loads and stores are more complicated than ADD/SUB/MOV, because we
must ensure that memory accesses below the stack limit are not
performed, so we can't simply do the check when we actually update
SP.

For these instructions, if the stack limit check triggers
we must not:
* perform any memory access below the SP limit
* update PC, SP or the load/store base register
but it is IMPDEF whether we:
* perform any accesses above or equal to the SP limit
* update destination registers for loads

For QEMU we choose to always check the limit before doing any other
part of the load or store, so we won't update any registers or
perform any memory accesses.

It is UNKNOWN whether the limit check triggers for a load or store
where the initial SP value is below the limit and one of the stores
would be below the limit, but the writeback moves SP to above the
limit. For QEMU we choose to trigger the check in this situation.

Note that limit checks happen only for loads and stores which update
SP via writeback; they do not happen for loads and stores which
simply use SP as a base register.

Backports commit 910d7692e5b60f2c2d08cc3d6d36076e85b6a69d from qemu
2018-10-08 14:17:27 -04:00
Lioncash cb935d868e
target/arm: Add v8M stack limit checks on NS function calls 2018-10-08 14:15:15 -04:00
Peter Maydell ed3c951fb6
target/arm: Add v8M stack checks on exception entry
Add checks for breaches of the v8M stack limit when the
stack pointer is decremented to push the exception frame
for exception entry.

Note that the exception-entry case is unique in that the
stack pointer is updated to be the limit value if the limit
is hit (per rule R_ZLZG).

Backports commit c32da7aa6205a5ff62ae8d5062f7cad0eae4c1fd from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell 0fc6e2c183
target/arm: Add some comments in Thumb decode
Add some comments to the Thumb decoder indicating what bits
of the instruction have been decoded at various points in
the code.

This is not an exhaustive set of comments; we're gradually
adding comments as we work with particular bits of the code.

Backports commit a2d12f0f34e9c5ef8a193556fde983aa186fa73a from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell ca5d7b8fd2
target/arm: Add v8M stack checks on ADD/SUB/MOV of SP
Add code to insert calls to a helper function to do the stack
limit checking when we handle these forms of instruction
that write to SP:
* ADD (SP plus immediate)
* ADD (SP plus register)
* SUB (SP minus immediate)
* SUB (SP minus register)
* MOV (register)

Backports commit 5520318939fea5d659bf808157cd726cb967b761 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell b2146058c3
target/arm: Move v7m_using_psp() to internals.h
We're going to want v7m_using_psp() in op_helper.c in the
next patch, so move it from helper.c to internals.h.

Backports commit 5529bf188d996391ff52a0e1801daf9c6a6bfcb0 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell ae4900fba2
target/arm: Define new EXCP type for v8M stack overflows
Define EXCP_STKOF, and arrange for it to cause us to take
a UsageFault with CFSR.STKOF set.

Backports commit 86f026de22d8854eecc004af44895de74225794f from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell 8b3b548961
target/arm: Define new TBFLAG for v8M stack checking
The Arm v8M architecture includes hardware stack limit checking.
When certain instructions update the stack pointer, if the new
value of SP is below the limit set in the associated limit register
then an exception is taken. Add a TB flag that tracks whether
the limit-checking code needs to be emitted.

Backports commit 4730fb85035e99c909db7d14ef76cd17f28f4423 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 66ffb372e7
target/arm: Pass TCGMemOpIdx to sve memory helpers
There is quite a lot of code required to compute cpu_mem_index,
or even put together the full TCGMemOpIdx. This can easily be
done at translation time.

Backports commit 500d04843ba953dc4560e44f04001efec38c14a6 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 606e8cdb8c
target/arm: Rewrite vector gather first-fault loads
This implements the feature for softmmu, and moves the
main loop out of a macro and into a function.

Backports commit 116347ce20bb7b5cac17bf2b0e6f607530b50862 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 1cd3c2a408
target/arm: Split contiguous stores for endianness
We can choose the endianness at translation time, rather than
re-computing it at execution time.

Backports commit 28d57f2dc59c287e1c40239509b0a325fd00e32f from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson c9569b3fe0
target/arm: Split contiguous loads for endianness
We can choose the endianness at translation time, rather than
re-computing it at execution time.

Backports commit 7d0a57a2e1cea188b9023261a404d7a211117230 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 2542ad17d0
target/arm: Rewrite vector gather stores
This fixes the endianness problem for softmmu, and moves
the main loop out of a macro and into an inlined function.

Backports commit 78cf1b886aa1b95c97fc5114641515c2892bb240 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson ff63807164
target/arm: Rewrite vector gather loads
This fixes the endianness problem for softmmu, and moves
the main loop out of a macro and into an inlined function.

Backports commit d4f75f25b43041e7a46d12352b3c70ae457d8cea from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 966ea163a3
target/arm: Rewrite helper_sve_st[1234]*_r
This fixes the endianness problem for softmmu, and moves the
main loop out of a macro and into an inlined function

Backports commit 9fd46c8362e0a45d04ccceae7051d06dd65c1d57 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 4978d77039
target/arm: Rewrite helper_sve_ld[234]*_r
Use the same *_tlb primitives as we use for ld1.

For linux-user, this hoists the set of helper_retaddr. For softmmu,
hoists the computation of the current mmu_idx outside the loop,
fixes the endianness problem, and moves the main loop out of a
macro and into an inlined function.

Backports commit f27d4dc2af0de9b7b45c955882b8420905c6efe8 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 5b88176e1d
target/arm: Rewrite helper_sve_ld1*_r using pages
Uses tlb_vaddr_to_host for correct operation with softmmu.
Optimize for accesses within a single page or pair of pages.

Backports commit 9123aeb6fcb14e0955ebe4e2a613802cfa0503ea from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 935eb43b5e
target/arm: Clear unused predicate bits for LD1RQ
The 16-byte load only uses 16 predicate bits. But while
reusing the other load infrastructure, we find other bits
that are set and trigger an assert. To avoid this and
retain the assert, zero-extend the predicate that we pass
to the LD1 helper.

Backports commit 2a99ab2b3545133961de034df27e24f4c22e3707 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson a37f24aa11
target/arm: Adjust aarch64_cpu_dump_state for system mode SVE
Use the existing helpers to determine if (1) the fpu is enabled,
(2) sve state is enabled, and (3) the current sve vector length.

Backports commit ced3155141755ba244c988c72c4bde32cc819670 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 87c20b52c0
target/arm: Handle SVE vector length changes in system mode
SVE vector length can change when changing EL, or when writing
to one of the ZCR_ELn registers.

For correctness, our implementation requires that predicate bits
that are inaccessible are never set. Which means noticing length
changes and zeroing the appropriate register bits.

Backports commit 0ab5953b00b3165877d00cf75de628c51670b550 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 2fb9c4c41d
target/arm: Pass in current_el to fp and sve_exception_el
We are going to want to determine whether sve is enabled
for EL other than current.

Backports commit 2de7ace292cf7846b0cda0e940272d2cb0e06859 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 00fc5d43fd
target/arm: Adjust sve_exception_el
Check for EL3 before testing CPTR_EL3.EZ. Return 0 when the exception
should be routed via AdvSIMDFPAccessTrap. Mirror the structure of
CheckSVEEnabled more closely.

Fixes: 5be5e8eda78

Backports commit 60eed0869d68b91eff71cc0a0facb01983726a5d from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 1081e5e7a4
target/arm: Define ID_AA64ZFR0_EL1
Given that the only field defined for this new register may only
be 0, we don't actually need to change anything except the name.

Backports commit 9516d7725ec1deaa6ef5ccc5a26d005650d6c524 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell d82046cafc
target/arm: Don't read r4 from v8M exception stackframe twice
A cut-and-paste error meant we were reading r4 from the v8M
callee-saves exception stack frame twice. This is harmless
since it just meant we did two memory accesses to the same
location, but it's unnecessary. Delete it.

Backports commit e5ae4d0c063fbcca4cbbd26bcefbf1760cfac2aa from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell f628cbdfc3
target/arm: Correct condition for v8M callee stack push
In v7m_exception_taken() we were incorrectly using a
"LR bit EXCRET.ES is 1" check when it should be 0
(compare the pseudocode ExceptionTaken() function).
This meant we didn't stack the callee-saved registers
when tailchaining from a NonSecure to a Secure exception.

Backports commit 7b73a1ca05b33d42278ce29cea4652e22d408165 from qemu
2018-10-08 14:15:15 -04:00
Lioncash b62e892b20
mips: Use DisasContext for parameters in place of TCGContext where applicable
This is more future-friendly with qemu's main repo, as it's more
generic.
2018-10-06 04:37:28 -04:00
Lioncash 47b45f1bc2
arm: Take DisasContext as a parameter instead of TCGContext where applicable
This is more future-friendly with qemu, as it's more generic.
2018-10-06 04:17:12 -04:00
Lioncash 766c70f608
arm: Move cpu_M0 to DisasContext 2018-10-06 03:32:39 -04:00
Lioncash 787fd448b1
arm: Move cpu_V1 to DisasContext 2018-10-06 03:28:42 -04:00
Lioncash 1aa20da917
arm: Move cpu_V0 to DisasContext 2018-10-06 03:26:52 -04:00
Lioncash 06c21baaa4
arm: Move cpu_F1d to DisasContext 2018-10-06 03:11:54 -04:00
Lioncash 5f3dd68f9c
arm: Move cpu_F0d to DisasContext 2018-10-06 03:07:42 -04:00
Lioncash e457ce8ccc
arm: Move cpu_F1s to DisasContext 2018-10-06 03:02:06 -04:00
Lioncash a4f23de55f
arm: Move cpu_F0 to DisasContext
Decreases the size of the TCGContext struct for targets that don't need
to use this variable.
2018-10-06 02:58:11 -04:00
Peter Maydell 04fead0dcb
target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode
The ARMv8 architecture defines that an AArch32 CPU starts
in SVC mode, unless EL2 is the highest available EL, in
which case it starts in Hyp mode. (In ARMv7 a CPU with EL2
but not EL3 was not a valid configuration, but we don't
specifically reject this if the user asks for one.)

Backports commit 060a65df056a5d6ca3a6a91e7bf150ca1fbccddf from qemu
2018-09-25 21:19:44 -04:00
Richard Henderson 994038c817
target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs
Not only are the sve-related tb_flags fields unused when SVE is
disabled, but not all of the cpu registers are initialized properly
for computing same. This can corrupt other fields by ORing in -1,
which might result in QEMU crashing.

This bug was not present in 3.0, but this patch is cc'd to
stable because adf92eab90e3f5f34c285 where the bug was
introduced was marked for stable.

Backports commit e79b445d896deb61909be52b61b87c98a9ed96f7 from qemu
2018-09-25 21:17:32 -04:00
Lioncash e81fa596bc
target/arm/cpu: Use type_register instead of type_register_static() in arm_cpu_register_types()
The lifetime of the TypeInfo instance doesn't live indefinitely, so we
should be using the regular type_register().
2018-09-03 17:34:08 -04:00
MerryMage 9b87d0f61a unicorn_arm: Allow for read/write of UC_ARM_REG_FPSCR 2018-09-03 21:03:55 +01:00
MerryMage a13d51f756 unicorn_aarch64: Use aa64_vfp_qreg instead of aa32_vfp_dreg 2018-09-03 07:47:40 +01:00
MerryMage 896a8e1320 unicorn_arm: Use ARM offset not ARM64 offset
Was introduced by 5439b4a542
2018-09-03 07:44:29 +01:00
Peter Maydell 39045d67df
target/arm: Remove a handful of stray tabs
Following the bulk conversion of the iwMMXt code, there are
just a handful of hard coded tabs in target/arm; fix them.
This is a whitespace-only patch.

Backports commit 6e0fafe2ef02378c696e7cf84ef41511e3b3b81a from qemu
2018-08-25 04:34:44 -04:00
Peter Maydell 1b8534bf31
target/arm: Untabify iwmmxt_helper.c
Untabify the arm iwmmxt_helper.c. This affects only the iwMMXt code.
We've never touched that code in years, so it's not going to get
fixed up by our "change when touched" process, and a bulk change is
not going to be too disruptive.

This commit was produced using Emacs "untabify" (plus one
by-hand removal of a space to fix a checkpatch nit); it is
a whitespace-only change.

Backports commit 67aed15551f9814712d5ac25a155919b34fbd627 from qemu
2018-08-25 04:33:44 -04:00
Peter Maydell 3619f707a6
target/arm: Clear CPSR.IL and CPSR.J on 32-bit exception entry
On 32-bit exception entry, CPSR.J must always be set to 0
(see v7A Arm ARM DDI0406C.c B1.8.5). CPSR.IL must also
be cleared on 32-bit exception entry (see v8A Arm ARM
DDI0487C.a G1.10).

Clear these bits. (This fixes a bug which will never be noticed
by non-buggy guests.)

Backports commit 829f9fd394ab082753308cbda165c13eaf8fae49 from qemu
2018-08-25 04:28:22 -04:00
Peter Maydell 16477f908e
target/arm: Implement support for taking exceptions to Hyp mode
Implement the necessary support code for taking exceptions
to Hyp mode in AArch32.

Backports commit b9bc21ff9f9bb2d841adf1dc7f6f8ddfb9ab8b5e from qemu
2018-08-25 04:27:18 -04:00
Peter Maydell 4c445c2300
target/arm: Factor out code for taking an AArch32 exception
Factor out the code which changes the CPU state so as to
actually take an exception to AArch32. We're going to want
to use this for handling exception entry to Hyp mode.

Backports commit dea8378bb3e86f2c6bd05afb3927619f7c51bb47 from qemu
2018-08-25 04:23:53 -04:00
Peter Maydell c238d5cc6b
target/arm: Implement AArch32 HCR and HCR2
The AArch32 HCR and HCR2 registers alias HCR_EL2
bits [31:0] and [63:32]; implement them.

Since HCR2 exists in ARMv8 but not ARMv7, we need new
regdef arrays for "we have EL3, not EL2, we're ARMv8"
and "we have EL2, we're ARMv8" to hold the definitions.

Backports commit ce4afed8396aabaf87cd42fbe8a4c14f7a9d5c10 from qemu
2018-08-25 04:21:57 -04:00
Peter Maydell cc57e03da4
target/arm: Implement RAZ/WI HACTLR2
The v8 AArch32 HACTLR2 register maps to bits [63:32] of ACTLR_EL2.
We implement ACTLR_EL2 as RAZ/WI, so make HACTLR2 also RAZ/WI.
(We put the regdef next to ACTLR_EL2 as a reminder in case we
ever make ACTLR_EL2 something other than RAZ/WI).

Backports commit 0e0456ab8895a5e85998904549e331d36c2692a5 from qemu
2018-08-25 04:13:37 -04:00
Richard Henderson 241fb78efc
target/arm: Use the float-to-int-scale softfloat routines
Backports commit 323cd490845acf663159ca26e35cb977ad9b85a2 from qemu
2018-08-25 04:11:51 -04:00
Richard Henderson 7d3ad3e053
target/arm: Use the int-to-float-scale softfloat routines
Backports commit b9b903cf245e4df1199cc7b2b80381ef85a6b1ab from qemu
2018-08-25 04:07:43 -04:00
Peter Maydell 214dadf7e7
target/arm: Implement AArch32 ERET instruction
ARMv7VE introduced the ERET instruction, which is necessary to
return from an exception taken to Hyp mode. Implement this.
In A32 encoding it is a completely new encoding; in T32 it
is an adjustment of the behaviour of the existing
"SUBS PC, LR, #<imm8>" instruction.

Backports commit 55c544ed2709bd202e71e77ddfe3ea0327852211 from qemu
2018-08-22 12:56:14 -04:00
Peter Maydell 8c41572624
target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)
The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp
from either Monitor or Hyp mode. Our translate time check
was overly strict and only permitted access from Monitor mode.

The runtime check we do in msr_mrs_banked_exc_checks() had the
correct code in it, but never got there because of the earlier
"currmode == tgtmode" check. Special case ELR_Hyp.

Backports commit aec4dd09f172ee64c19222b78269d5952fd9c1dc from qemu
2018-08-22 12:51:42 -04:00
Peter Maydell 858aa2d094
target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2
The AArch32 HSR is the equivalent of AArch64 ESR_EL2;
we can implement it by marking our existing ESR_EL2 regdef
as STATE_BOTH. It also needs to be "RES0 from EL3 if
EL2 not implemented", so add the missing stanza to
el3_no_el2_cp_reginfo.

Backports commit 68e78e332cb1c3f8b0317a0443acb2b5e190f0dd from qemu
2018-08-22 12:48:35 -04:00
Peter Maydell c21d2062e4
target/arm: Implement AArch32 Hyp FARs
The AArch32 virtualization extensions support these fault address
registers:
* HDFAR: aliased with AArch64 FAR_EL2[31:0] and AArch32 DFAR(S)
* HIFAR: aliased with AArch64 FAR_EL2[63:32] and AArch32 IFAR(S)

Implement the accessors for these. This fixes in passing a bug
where we weren't implementing the "RES0 from EL3 if EL2 not
implemented" behaviour for AArch64 FAR_EL2.

Backports commit cba517c31e7df8932c4473c477a0f01d8a0adc48 from qemu
2018-08-22 12:45:23 -04:00
Peter Maydell 763a71a962
target/arm: Implement AArch32 HVBAR
Implement the AArch32 HVBAR register; we can do this just by
making the existing VBAR_EL2 regdefs be STATE_BOTH.

Backports commit d79e0c0608899428281a17c414ccf1a82d86ab85 from qemu
2018-08-22 12:37:12 -04:00
Peter Maydell e9fb085aa1
target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs
ARMCPRegInfo structs will default to .cp = 15 if they
are ARM_CP_STATE_BOTH, but not if they are ARM_CP_STATE_AA32
(because a coprocessor number of 0 is valid for AArch32).
We forgot to explicitly set .cp = 15 for the HMAIR1 and
HAMAIR1 regdefs, which meant they would UNDEF when the guest
tried to access them under cp15.

Backports commit b5ede85bfb7ba1a8f6086494c82f400b29969f65 from qemu
2018-08-22 12:36:11 -04:00
Peter Maydell 2d2c6982ce
target/arm: Correct typo in HAMAIR1 regdef name
We implement the HAMAIR1 register as RAZ/WI; we had a typo in the
regdef, though, and were incorrectly naming it HMAIR1 (which is
a different register which we also implement as RAZ/WI).

Backports commit 55b53c718b2f684793eeefcf1c1a548ee97e23aa from qemu
2018-08-22 12:33:45 -04:00
Roman Kapl 0e2dc93e5f
target/arm: Fix crash on conditional instruction in an IT block
If an instruction is conditional (like CBZ) and it is executed
conditionally (using the ITx instruction), a jump to an undefined
label is generated, and QEMU crashes.

CBZ in IT block is an UNPREDICTABLE behavior, but we should not
crash. Honouring the condition code is allowed by the spec in this
case (constrained unpredictable, ARMv8, section K1.1.7), and matches
what we do for other "UNPREDICTABLE inside an IT block" instructions.

Fix the 'skip on condition' code to create a new label only if it
does not already exist. Previously multiple labels were created, but
only the last one of them was set.

Backports commit c2d9644e6d517170bf6520f633628259a8460d48 from qemu
2018-08-22 12:27:45 -04:00
Richard Henderson 0136ca773f
target/arm: Fix aa64 FCADD and FCMLA decode
These insns require u=1; failed to include that in the switch
cases. This probably happened during one of the rebases just
before final commit.

Fixes: d17b7cdcf4e

Backports commit b8a4a96db3639e17ab5e5cdc14fca4b19fbf5b3b from qemu
2018-08-17 14:06:01 -04:00
Richard Henderson c387d51c1d
target/arm: Use FZ not FZ16 for SVE FCVT single-half and double-half
We were using the wrong flush-to-zero bit for the non-half input.

Fixes: 46d33d1e3c9

Backports commit e4ab5124a5c2e2291006b24bdc21c3dd8d087ff4 from qemu
2018-08-17 14:05:10 -04:00
Richard Henderson 118495f4b1
target/arm: Use fp_status_fp16 for do_fmpa_zpzzz_h
This makes float16_muladd correctly use FZ16 not FZ.

Fixes: 6ceabaad110

Backports commit 52a339b11d1719a6589de40606859939875fda9a from qemu
2018-08-17 14:04:20 -04:00
Richard Henderson 15a68a354c
target/arm: Ignore float_flag_input_denormal from fp_status_f16
When FZ is set, input_denormal exceptions are recognized, but this does
not happen with FZ16. The softfloat code has no way to distinguish
these bits and will raise such exceptions into fp_status_f16.flags,
so ignore them when computing the accumulated flags.

Backports commit 19062c169e5bcdda3d60df9161228e107bf0f96e from qemu
2018-08-17 14:03:41 -04:00
Richard Henderson f787dd15fd
target/arm: Adjust FPCR_MASK for FZ16
When support for FZ16 was added, we failed to include the bit
within FPCR_MASK, which means that it could never be set.
Continue to zero FZ16 when ARMv8.2-FP16 is not enabled.

Fixes: d81ce0ef2c4

Backports commit 0b62159be33d45d00dfa34a317c6d3da30ffb480 from qemu
2018-08-17 14:02:49 -04:00
Stefan Hajnoczi d2f3a6c0d5
target/arm: add cortex-m0 CPU model
Define a "cortex-m0" ARMv6-M CPU model.

Most of the register reset values set by other CPU models are not
relevant for the cut-down ARMv6-M architecture.

Backports commit 191776b96a381b5d2b8d3f90c1c02b3e4779e5f7 from qemu
2018-08-17 14:01:00 -04:00
Richard Henderson cb11b3a6bd
target/arm: Add sve-max-vq cpu property to -cpu max
This allows the default (and maximum) vector length to be set
from the command-line. Which is extraordinarily helpful in
debugging problems depending on vector length without having to
bake knowledge of PR_SET_SVE_VL into every guest binary.

Backports relevant parts of commit
adf92eab90e3f5f34c285da6d14d48952b7a8e72 from qemu
2018-08-17 13:57:51 -04:00
Richard Henderson 1d3cf8a0b0
target/arm: Dump SVE state if enabled
Also fold the FPCR/FPSR state onto the same line as PSTATE,
and mention but do not dump disabled FPU state.

Backports commit 2bf5f3f91bb4e3faa2a19aec042138a938afbf6a from qemu
2018-08-17 13:52:28 -04:00
Richard Henderson 731bcd194b
target/arm: Fix offset scaling for LD_zprr and ST_zprr
The scaling should be solely on the memory operation size; the number
of registers being loaded does not come in to the initial computation.

Backports commit 50ef1cbf31caad21019ae6fa8036ed6f29244ba5 from qemu
2018-08-17 13:50:59 -04:00
Richard Henderson 86d6bb4d43
target/arm: Fix offset for LD1R instructions
The immediate should be scaled by the size of the memory reference,
not the size of the elements into which it is loaded.

Backports commit d0e372b0298f897993f831dbff7ad4f1c70f138e from qemu
2018-08-17 13:49:39 -04:00
Richard Henderson 7487c66bee
target/arm: Fix sign-extension in sve do_ldr/do_str
The expression (int) imm + (uint32_t) len_align turns into uint32_t
and thus with negative imm produces a memory operation at the wrong
offset. None of the numbers involved are particularly large, so
change everything to use int.

Backports commit 19f2acc915a0f8f443a959844540a6f09133cc96 from qemu
2018-08-17 13:48:44 -04:00
Richard Henderson 1ca7c30fbb
target/arm: Fix typo in helper_sve_ld1hss_r
Backports commit 573ec0fe40b9a412085ac7dfb41975a0fc2b28dd from qemu
2018-08-17 13:47:38 -04:00
Richard Henderson e2e7bb0e21
target/arm: Fix typo in helper_sve_movz_d
Backports commit 054e7adf4e64e4acb3b033348ebf7cc871baa34f from qemu
2018-08-16 07:12:18 -04:00
Lioncash 9a2581aff6
Comment out tailchaining code
Allows build to continue.
2018-08-16 07:11:31 -04:00
Richard Henderson f26356b930
target/arm: Reorganize SVE WHILE
The pseudocode for this operation is an increment + compare loop,
so comparing <= the maximum integer produces an all-true predicate.

Rather than bound in both the inline code and the helper, pass the
helper the number of predicate bits to set instead of the number
of predicate elements to set.

Backports commit bbd0968c458d48e34a08b8694fa3309a9fe1c9e7 from qemu
2018-08-16 07:09:33 -04:00
Lioncash eccda3afcc
target/arm: Fix typo in do_sat_addsub_64
Used the wrong temporary in the computation of subtractive overflow.

Backports commit 7a31e0c6c68baffab0867bdd92b8744568b1d3ba from qemu
2018-08-16 07:06:05 -04:00
Richard Henderson 46fd2c485a
target/arm: Fix sign of sve_cmpeq_ppzw/sve_cmpne_ppzw
The normal vector element is sign-extended before
comparing with the wide vector element.

Backports commit df4e001093988544d09887122ae824f18ba55c68 from qemu
2018-08-16 07:04:52 -04:00
Peter Maydell 8d34a271f6
target/arm: Implement tailchaining for M profile cores
Tailchaining is an optimization in handling of exception return
for M-profile cores: if we are about to pop the exception stack
for an exception return, but there is a pending exception which
is higher priority than the priority we are returning to, then
instead of unstacking and then immediately taking the exception
and stacking registers again, we can chain to the pending
exception without unstacking and stacking.

For v6M and v7M it is IMPDEF whether tailchaining happens for pending
exceptions; for v8M this is architecturally required. Implement it
in QEMU for all M-profile cores, since in practice v6M and v7M
hardware implementations generally do have it.

(We were already doing tailchaining for derived exceptions which
happened during exception return, like the validity checks and
stack access failures; these have always been required to be
tailchained for all versions of the architecture.)

Backports commit 5f62d3b9e67bfc3deb970e3c7fb7df7e57d46fc3 from qemu
2018-08-16 07:03:51 -04:00
Peter Maydell e3be0c4aa6
target/arm: Restore M-profile CONTROL.SPSEL before any tailchaining
On exception return for M-profile, we must restore the CONTROL.SPSEL
bit from the EXCRET value before we do any kind of tailchaining,
including for the derived exceptions on integrity check failures.
Otherwise we will give the guest an incorrect EXCRET.SPSEL value on
exception entry for the tailchained exception.

Backports commit 89b1fec193b81b6ad0bd2975f2fa179980cc722e from qemu
2018-08-16 06:58:34 -04:00
Peter Maydell e044c59cc1
target/arm: Initialize exc_secure correctly in do_v7m_exception_exit()
In do_v7m_exception_exit(), we use the exc_secure variable to track
whether the exception we're returning from is secure or non-secure.
Unfortunately the statement initializing this was accidentally
inside an "if (env->v7m.exception != ARMV7M_EXCP_NMI)" conditional,
which meant that we were using the wrong value for NMI handlers.
Move the initialization out to the right place.

Backports commit b8109608bc6f3337298d44ac4369bf0bc8c3a1e4 from qemu
2018-08-16 06:57:27 -04:00
Peter Maydell c79ebe4965
target/arm: Treat SCTLR_EL1.M as if it were zero when HCR_EL2.TGE is set
One of the required effects of setting HCR_EL2.TGE is that when
SCR_EL3.NS is 1 then SCTLR_EL1.M must behave as if it is zero for
all purposes except direct reads. That is, it effectively disables
the MMU for the NS EL0/EL1 translation regime.

Backports commit 3d0e3080d8b7abcddc038d18e8401861c369c4c1 from qemu
2018-08-16 06:46:09 -04:00
Peter Maydell 12248b8685
target/arm: Provide accessor functions for HCR_EL2.{IMO, FMO, AMO}
The IMO, FMO and AMO bits in HCR_EL2 are defined to "behave as
1 for all purposes other than direct reads" if HCR_EL2.TGE
is set and HCR_EL2.E2H is 0, and to "behave as 0 for all
purposes other than direct reads" if HCR_EL2.TGE is set
and HRC_EL2.E2H is 1.

To avoid having to check E2H and TGE everywhere where we test IMO and
FMO, provide accessors arm_hcr_el2_imo(), arm_hcr_el2_fmo()and
arm_hcr_el2_amo(). We don't implement ARMv8.1-VHE yet, so the E2H
case will never be true, but we include the logic to save effort when
we eventually do get to that.

(Note that in several of these callsites the change doesn't
actually make a difference as either the callsite is handling
TGE specially anyway, or the CPU can't get into that situation
with TGE set; we change everywhere for consistency.)

Backports commit ac656b166b57332ee397e9781810c956f4f5fde5 from qemu
2018-08-16 06:41:45 -04:00
Peter Maydell 3979058dcb
target/arm: Honour HCR_EL2.TGE when raising synchronous exceptions
Whene we raise a synchronous exception, if HCR_EL2.TGE is set then
exceptions targeting NS EL1 must be redirected to EL2. Implement
this in raise_exception() -- all synchronous exceptions go through
this function.

(Asynchronous exceptions go via arm_cpu_exec_interrupt(), which
already honours HCR_EL2.TGE when it determines the target EL
in arm_phys_excp_target_el().)

Backports commit 7556edfb4d7bf0583c852c8cfc49ef494c41dd8a from qemu
2018-08-16 06:41:57 -04:00
Peter Maydell 6b8d98bcd2
target/arm: Honour HCR_EL2.TGE and MDCR_EL2.TDE in debug register access checks
Some debug registers can be trapped via MDCR_EL2 bits TDRA, TDOSA,
and TDA, which we implement in the functions access_tdra(),
access_tdosa() and access_tda(). If MDCR_EL2.TDE or HCR_EL2.TGE
are 1, the TDRA, TDOSA and TDA bits should behave as if they were 1.
Implement this by having the access functions check MDCR_EL2.TDE
and HCR_EL2.TGE.

Backports commit 30ac6339dca3fe0d05a611f12eedd5af20af585a from qemu
2018-08-16 06:41:02 -04:00
Peter Maydell f0bf1160e4
target/arm: Mask virtual interrupts if HCR_EL2.TGE is set
If the "trap general exceptions" bit HCR_EL2.TGE is set, we
must mask all virtual interrupts (as per DDI0487C.a D1.14.3).
Implement this in arm_excp_unmasked().

Backports commit 2ccf0fef632f3d54b2cc9ea08f1e6904ff1f8df4 from qemu
2018-08-16 06:39:27 -04:00
Julia Suvorova 9d7deb2997
arm: Add ARMv6-M programmer's model support
Forbid stack alignment change. (CCR)
Reserve FAULTMASK, BASEPRI registers.
Report any fault as a HardFault. Disable MemManage, BusFault and
UsageFault, so they always escalated to HardFault. (SHCSR)

Backports commit 22ab3460017cfcfb6b50f05838ad142e08becce5 from qemu
2018-08-16 06:36:27 -04:00
Julia Suvorova b67b948feb
target/arm: Forbid unprivileged mode for M Baseline
MSR handling is the only place where CONTROL.nPRIV is modified.

Backports commit def183446cebc0090f6d885383a6502302249f33 from qemu
2018-08-16 06:34:29 -04:00
Peter Maydell 241c561bc3
target/arm: Correctly handle overlapping small MPU regions
To correctly handle small (less than TARGET_PAGE_SIZE) MPU regions,
we must correctly handle the case where the address being looked
up hits in an MPU region that is not small but the address is
in the same page as a small region. For instance if MPU region
1 covers an entire page from 0x2000 to 0x2400 and MPU region
2 is small and covers only 0x2200 to 0x2280, then for an access
to 0x2000 we must not return a result covering the full page
even though we hit the page-sized region 1. Otherwise we will
then cache that result in the TLB and accesses that should
hit region 2 will incorrectly find the region 1 information.

Check for the case where we miss an MPU region but it is still
within the same page, and in that case narrow the size we will
pass to tlb_set_page_with_attrs() for whatever the final
outcome is of the MPU lookup.

Backports commit 9d2b5a58f85be2d8e129c4b53d6708ecf8796e54 from qemu
2018-07-23 19:54:00 -04:00
Richard Henderson bd9975a8ab
target/arm: Fix LD1W and LDFF1W (scalar plus vector)
'I' was being double-incremented; correctly within the inner loop
and incorrectly within the outer loop.

Backports commit 628fc75f3a3bb115de3b445c1a18547c44613cfe from qemu
2018-07-17 12:33:00 -04:00
Peter Maydell 55985b40f8
target/arm: Use correct mmu_idx for exception-return unstacking
For M-profile exception returns, the mmu index to use for exception
return unstacking is supposed to be that of wherever we are returning to:
* if returning to handler mode, privileged
* if returning to thread mode, privileged or unprivileged depending on
CONTROL.nPRIV for the destination security state

We were passing the wrong thing as the 'priv' argument to
arm_v7m_mmu_idx_for_secstate_and_priv(). The effect was that guests
which programmed the MPU to behave differently for privileged and
unprivileged code could get spurious MemManage Unstack exceptions.

Backports commit 2b83714d4ea659899069a4b94aa2dfadc847a013 from qemu
2018-07-10 12:55:59 -04:00
Richard Henderson ee24dff90c
target/arm: Fix do_predset for large VL
Use MAKE_64BIT_MASK instead of open-coding. Remove an odd
vector size check that is unlikely to be more profitable
than 3 64-bit integer stores. Correct the iteration for WORD
to avoid writing too much data.

Fixes RISU tests of PTRUE for VL 256.

Backports commit 973558a3f869e591d2406dd8226ec0c4e32a3c3e from qemu
2018-07-09 16:43:15 -04:00
Richard Henderson 0fb2742a4a
target/arm: Suppress Coverity warning for PRF
These instructions must perform the sve_access_check, but
since they are implemented as NOPs there is no generated
code to elide when the access check fails.

Backports commit 2f95a3b09aebdcb5c9152a7ac434a5d57441fe82 from qemu
2018-07-09 16:40:54 -04:00
Lioncash 0cf14f0d13
target/arm: Fix ISAR6 register state
Bad patch application
2018-07-03 19:31:52 -04:00
Richard Henderson 611bc4e6db
target/arm: Add ID_ISAR6
This register was added to aa32 state by ARMv8.2.

Backports commit 802abf4024d23e48d45373ac3f2b580124b54b47 from qemu
2018-07-03 05:15:47 -04:00
Richard Henderson 0da6b74f69
target/arm: Prune a15 features from max
There is no need to re-set these 3 features already
implied by the call to aarch64_a15_initfn.

Backports commit 0b33968e7f4cf998f678b2d1a5be3d6f3f3513d8 from qemu
2018-07-03 05:09:39 -04:00
Richard Henderson d950e69174
target/arm: Prune a57 features from max
There is no need to re-set these 9 features already
implied by the call to aarch64_a57_initfn.

Backports commit 156a7065365578deb3d63c2b5b69a4b5999a8fcc from qemu
2018-07-03 05:08:47 -04:00
Richard Henderson 6d81235ebb
target/arm: Fix SVE system register access checks
Leave ARM_CP_SVE, removing ARM_CP_FPU; the sve_access_check
produced by the flag already includes fp_access_check. If
we also check ARM_CP_FPU the double fp_access_check asserts.

Backports commit 11d7870b1b4d038d7beb827f3afa72e284701351 from qemu
2018-07-03 05:07:53 -04:00
Richard Henderson f64e48dbee
target/arm: Fix SVE signed division vs x86 overflow exception
We already check for the same condition within the normal integer
sdiv and sdiv64 helpers. Use a slightly different formation that
does not require deducing the expression type.

Backports commit 7e8fafbfd0537937ba8fb366a90ea6548cc31576 from qemu
2018-07-03 05:06:06 -04:00
Aaron Lindsay 27afa92f24
target/arm: Mark PMINTENSET accesses as possibly doing IO
This makes it match its AArch64 equivalent, PMINTENSET_EL1

Backports commit b7d793ad3db06401bc817c0ca355a2d160c802d4 from qemu
2018-07-03 05:05:00 -04:00
Aaron Lindsay 4684e875d3
target/arm: Add ARM_FEATURE_V7VE for v7 Virtualization Extensions 2018-07-03 05:04:08 -04:00
Alex Bennée 85512a5121
target/arm: support reading of CNT[VCT|FRQ]_EL0 from user-space
Since kernel commit a86bd139f2 (arm64: arch_timer: Enable CNTVCT_EL0
trap..), released in kernel version v4.12, user-space has been able
to read these system registers. As we can't use QEMUTimer's in
linux-user mode we just directly call cpu_get_clock().

Backports commit 26c4a83bd4707797868174332a540f7d61288d15 from qemu
2018-07-03 05:00:06 -04:00
Richard Henderson a325de6685
target/arm: Implement ARMv8.2-DotProd
We've already added the helpers with an SVE patch, all that remains
is to wire up the aa64 and aa32 translators. Enable the feature
within -cpu max for CONFIG_USER_ONLY.

Backports commit 26c470a7bb4233454137de1062341ad48947f252 from qemu
2018-07-03 04:55:43 -04:00
Richard Henderson d4a8f1bfcb
target/arm: Enable SVE for aarch64-linux-user
Enable ARM_FEATURE_SVE for the generic "max" cpu.

Backports commit 802ac0e1e956f3b34a7cb0eda4ec28a60aa87a0a from qemu
2018-07-03 04:46:44 -04:00
Richard Henderson d343f8ac0f
target/arm: Implement SVE dot product (indexed)
Backports commit 16fcfdc7325649b187ac489f3ae0b0d2a20b6230 from qemu
2018-07-03 04:42:41 -04:00
Richard Henderson 2f6d555473
target/arm: Implement SVE dot product (vectors)
Backports commit d730ecaae77ac696515207a5ef99509240fc792b from qemu
2018-07-03 04:35:25 -04:00
Richard Henderson 01a7224cdb
target/arm: Implement SVE fp complex multiply add (indexed)
Enhance the existing helpers to support SVE, which takes the
index from each 128-bit segment. The change has no effect
for AdvSIMD, since there is only one such segment.

Backports commit 18fc24057815bf3d956cfab892a2bc2344bd1dcb from qemu
2018-07-03 04:32:46 -04:00
Richard Henderson 281deae0a9
target/arm: Pass index to AdvSIMD FCMLA (indexed)
For aa64 advsimd, we had been passing the pre-indexed vector.
However, sve applies the index to each 128-bit segment, so we
need to pass in the index separately.

For aa32 advsimd, the fp32 operation always has index 0, but
we failed to interpret the fp16 index correctly.

Backports commit 2cc99919a81a62589a4a6b0f365eabfead1db1a7 from qemu
2018-07-03 04:27:10 -04:00
Richard Henderson 63431f0c21
target/arm: Implement SVE fp complex multiply add
Backports commit 05f48bab3080fb876fbad8d8f14e6ba545432d67 from qemu
2018-07-03 04:21:41 -04:00
Richard Henderson 79220741df
target/arm: Implement SVE floating-point complex add
Backports commit 76a9d9cdc481ed79f1c2ec16eeed185f13e6a8ae from qemu
2018-07-03 04:17:41 -04:00
Richard Henderson f7847aad46
target/arm: Implement SVE MOVPRFX
Backports commit a21035822e67000b4849e31935d0ecc39a96bb9f from qemu
2018-07-03 04:14:37 -04:00
Richard Henderson 00d3671412
target/arm: Implement SVE floating-point unary operations
Backports commit ec5b375bb5a0e35c0c21dc9dd1d82894269ce215 from qemu
2018-07-03 04:11:12 -04:00
Richard Henderson 2c2c940ef8
target/arm: Implement SVE floating-point round to integral value
Backports commit cda3c75322c6fae1cc5b367ee6d7acf2cbdbcf2b from qemu
2018-07-03 04:07:21 -04:00
Richard Henderson a9160a0e08
target/arm: Implement SVE floating-point convert to integer
Backports commit df4de1affc440d6f2cdaeea329b90c0b88ece5a1 from qemu
2018-07-03 04:02:58 -04:00
Richard Henderson 524630de27
target/arm: Implement SVE floating-point convert precision
Backports commit 46d33d1e3c9c5d56d57056db55010de52c173902 from qemu
2018-07-03 03:58:07 -04:00
Richard Henderson b14793a933
target/arm: Implement SVE floating-point trig multiply-add coefficient
Backports commit 67fcd9ad35d2b38630ee34e8ced8878d334c74fb from qemu
2018-07-03 03:52:36 -04:00
Richard Henderson f7e0c9e079
target/arm: Implement SVE FP Compare with Zero Group
Backports commit 4d2e2a03384a43c641e0cbca7ac79d7d0c50f666 from qemu
2018-07-03 03:49:52 -04:00
Richard Henderson 942f3c835e
target/arm: Implement SVE Floating Point Unary Operations - Unpredicated Group
Backports commit 3887c0388d39930ab419d4ae6e8ca5ea67a74ad5 from qemu
2018-07-03 03:44:40 -04:00
Richard Henderson f9f228efec
target/arm: Implement SVE FP Fast Reduction Group
Backports commit 23fbe79faa38cb4acc59f956a63feba3c2cc73ac from qemu
2018-07-03 03:41:00 -04:00
Richard Henderson cf3c7824ff
target/arm: Implement SVE Floating Point Multiply Indexed Group
Backports commit ca40a6e6e390eb1cad7ade881dc7c622793f9324 from qemu
2018-07-03 03:35:49 -04:00
Richard Henderson c718ef4243
target/arm: Implement SVE floating-point arithmetic with immediate
Backports commit cc48affe83fff4b2886c064265d7103dee5e4a14 from qemu
2018-07-03 03:24:46 -04:00
Richard Henderson db1d39ab4a
target/arm: Implement SVE floating-point compare vectors
Backports commit abfdefd5bd444b629d16dcefc2b60ac8da37e87d from qemu
2018-07-03 03:14:24 -04:00
Richard Henderson be65f60799
target/arm: Implement SVE scatter store vector immediate
Backports commit 408ecde97bd30f8ec13f831976d0a9a6535bb569 from qemu
2018-07-03 03:09:51 -04:00
Richard Henderson 892a9a66eb
target/arm: Implement SVE first-fault gather loads
Backports commit ed67eb7fa2a63b6709ec94397d833bc3686f7833 from qemu
2018-07-03 03:06:07 -04:00
Richard Henderson 1782f20dde
target/arm: Implement SVE gather loads
Backports commit 673e9fa6c29e030f4ab6ceae5d0f50bd36fe0ee0 from qemu
2018-07-03 02:58:18 -04:00
Richard Henderson 3a5d095277
target/arm: Implement SVE prefetches
Backports commit dec6cf6b43a1e3b18626852064d1e6e863c9b681 from qemu
2018-07-03 02:42:06 -04:00
Richard Henderson b78e283513
target/arm: Implement SVE scatter stores
Backports commit f6dbf62a7e3d00e9a1dcc7fe3e53b32c3ed93e24 from qemu
2018-07-03 02:40:17 -04:00
Richard Henderson d71cdfa41f
target/arm: Implement SVE store vector/predicate register
Backports commit 5047c204d0d4a0fff616a24963b2b45c7d9ba4c4 from qemu
2018-07-03 02:32:10 -04:00
Richard Henderson c497dc0a83
target/arm: Implement SVE load and broadcast element
Backports commit 684598640dc3b28f86ccc28cc9af50ba257f4cc8 from qemu
2018-07-03 02:27:00 -04:00
Richard Henderson 2caa99929e
target/arm: Implement SVE Floating Point Accumulating Reduction Group
Backports commit 7f9ddf64d5fe5bfaa91ae0ec52217d86f4d86452 from qemu
2018-07-03 02:21:41 -04:00
Richard Henderson 44d89b4cb1
target/arm: Implement SVE FP Multiply-Add Group
Backports commit 6ceabaad1101b0b33490b0fd4bed5b6445b0a34e from qemu
2018-07-03 02:17:16 -04:00
Richard Henderson d1c5d5b728
target/arm: Implement SVE floating-point arithmetic (predicated)
Backports commit ec3b87c28eb120b6575cc1ed7bfbfbf1b0060163 from qemu
2018-07-03 02:13:04 -04:00
Richard Henderson e7f53b6d1b
target/arm: Implement SVE integer convert to floating-point
Backports commit 8092c6a314c9625d8976fb6c5b6969f2a1105cd8 from qemu
2018-07-03 02:05:50 -04:00
Richard Henderson 8a99e1bad2
target/arm: Implement SVE load and broadcast quadword
Backports commit 05abe304be2987cb3576729a14dab96e9ccfaec9 from qemu
2018-07-03 02:01:23 -04:00
Richard Henderson 3a51861c05
target/arm: Implement SVE Memory Contiguous Store Group
Backports commit 1a039c7e58533d5f9431a2064771113d5961c964 from qemu
2018-07-03 01:57:52 -04:00
Richard Henderson 22a155a5d4
target/arm: Implement SVE Contiguous Load, first-fault and no-fault
Backports commit e2654d757598d6c06d1ceb25c62ddf7d63cac32f from qemu
2018-07-03 01:52:38 -04:00
Richard Henderson da1eeb226e
target/arm: Implement SVE Memory Contiguous Load Group
Backports commit c4e7c493da2fdd2c92a7958e592e38200af2f1ba from qemu
2018-07-03 01:40:18 -04:00
Peter Maydell 4abcf14b52
target/arm: Handle small regions in get_phys_addr_pmsav8()
Allow ARMv8M to handle small MPU and SAU region sizes, by making
get_phys_add_pmsav8() set the page size to the 1 if the MPU or
SAU region covers less than a TARGET_PAGE_SIZE.

We choose to use a size of 1 because it makes no difference to
the core code, and avoids having to track both the base and
limit for SAU and MPU and then convert into an artificially
restricted "page size" that the core code will then ignore.

Since the core TCG code can't handle execution from small
MPU regions, we strip the exec permission from them so that
any execution attempts will cause an MPU exception, rather
than allowing it to end up with a cpu_abort() in
get_page_addr_code().

(The previous code's intention was to make any small page be
treated as having no permissions, but unfortunately errors
in the implementation meant that it didn't behave that way.
It's possible that some binaries using small regions were
accidentally working with our old behaviour and won't now.)

We also retain an existing bug, where we ignored the possibility
that the SAU region might not cover the entire page, in the
case of executable regions. This is necessary because some
currently-working guest code images rely on being able to
execute from addresses which are covered by a page-sized
MPU region but a smaller SAU region. We can remove this
workaround if we ever support execution from small regions.

Backports commit 720424359917887c926a33d248131fbff84c9c28 from qemu
2018-07-03 00:55:37 -04:00
Peter Maydell 5e8e8b9bf8
target/arm: Set page (region) size in get_phys_addr_pmsav7()
We want to handle small MPU region sizes for ARMv7M. To do this,
make get_phys_addr_pmsav7() set the page size to the region
size if it is less that TARGET_PAGE_SIZE, rather than working
only in TARGET_PAGE_SIZE chunks.

Since the core TCG code con't handle execution from small
MPU regions, we strip the exec permission from them so that
any execution attempts will cause an MPU exception, rather
than allowing it to end up with a cpu_abort() in
get_page_addr_code().

(The previous code's intention was to make any small page be
treated as having no permissions, but unfortunately errors
in the implementation meant that it didn't behave that way.
It's possible that some binaries using small regions were
accidentally working with our old behaviour and won't now.)

Backports commit e5e40999b5e03567ef654546e3d448431643f8f3 from qemu
2018-07-03 00:49:51 -04:00
Julia Suvorova f28514178a
target/arm: Strict alignment for ARMv6-M and ARMv8-M Baseline
Unlike ARMv7-M, ARMv6-M and ARMv8-M Baseline only supports naturally
aligned memory accesses for load/store instructions.

Backports commit 2aeba0d007d33efa12a6339bb140aa634e0d52eb from qemu
2018-06-29 14:15:33 -05:00
Julia Suvorova 65d0e176c3
target/arm: Introduce ARM_FEATURE_M_MAIN
This feature is intended to distinguish ARMv8-M variants: Baseline and
Mainline. ARMv7-M compatibility requires the Main Extension. ARMv6-M
compatibility is provided by all ARMv8-M implementations.

Backports commit cc2ae7c9de14efd72c6205825eb7cd980ac09c11 from qemu
2018-06-29 14:14:18 -05:00
Edgar E. Iglesias dfc6bd6a0b
target-arm: Add the Cortex-R5F
Add the Cortex-R5F with the optional FPU enabled.

Backports commit ebac5458c7517ed7b8ee06eb90beacc7472b295d from qemu
2018-06-29 13:53:31 -05:00
Julia Suvorova 38747fc125
target/arm: Minor cleanup for ARMv6-M 32-bit instructions
The arrays were made static, "if" was simplified because V7M and V8M
define V6 feature.

Backports commit 8297cb13e407db8a96cc7ed6b6a6c318a150759a from qemu
2018-06-29 13:50:30 -05:00
Julia Suvorova f447a6f668
target/arm: Allow ARMv6-M Thumb2 instructions
ARMv6-M supports 6 Thumb2 instructions. This patch checks for these
instructions and allows their execution.
Like Thumb2 cores, ARMv6-M always interprets BL instruction as 32-bit.

This patch is required for future Cortex-M0 support.

Backports commit 14120108f87b3f9e1beacdf0a6096e464e62bb65 from qemu
2018-06-15 14:12:20 -04:00
Richard Henderson d81cc5f5cd
target/arm: Implement SVE Floating Point Arithmetic - Unpredicated Group
Backports commit 29b80469dc51ae4064e9ef9223967882d2610523 from qemu
2018-06-15 14:10:16 -04:00
Richard Henderson e56db70fee
target/arm: Implement SVE Integer Wide Immediate - Unpredicated Group
Backports commit 6e6a157d683058d86a224cf128320d67b0915365 from qemu
2018-06-15 14:05:11 -04:00
Richard Henderson b5352c6ba1
target/arm: Implement FDUP/DUP
Backports commit ed49196125360c037d7f23c1c315a85cc234e72d from qemu
2018-06-15 13:56:03 -04:00
Richard Henderson 496bb35c97
target/arm: Implement SVE Integer Compare - Scalars Group
Backports commit caf1cefc72be98497e0907d0e07f4327fc641e96 from qemu
2018-06-15 13:54:05 -04:00
Richard Henderson bc55b3e570
target/arm: Implement SVE Predicate Count Group
Backports commit 9ee3a611de28b8d0862fa687215b04b5aad20747 from qemu
2018-06-15 13:49:58 -04:00
Richard Henderson bb930f35b0
target/arm: Implement SVE Partition Break Group
Backports commit 35da316f5e847292ffbe7b6d16cd3988043dfe22 from qemu
2018-06-15 13:42:35 -04:00
Richard Henderson ade246e87b
target/arm: Implement SVE Integer Compare - Immediate Group
Backports commit 38cadeba0daf0f16cf2aeaa5b2752b26fb0676c5 from qemu
2018-06-15 13:35:40 -04:00
Richard Henderson 2969a38d61
target/arm: Implement SVE Integer Compare - Vectors Group
Backports commit 757f9cff1b63895bfd6fc8d66a6e52d7c40baa7b from qemu
2018-06-15 13:29:15 -04:00
Richard Henderson 7211d415a4
target/arm: Implement SVE Select Vectors Group
Backports commit d3fe4a29d754dee73cbf3cb7584db222981179ac from qemu
2018-06-15 13:17:47 -04:00
Richard Henderson 7698c1634e
target/arm: Implement SVE vector splice (predicated)
Backports commit b48ff24098c72f86e187e6abb7e9ca4de40a7fb4 from qemu
2018-06-15 13:14:33 -04:00
Richard Henderson 7d930e8515
target/arm: Implement SVE reverse within elements
Backports commit dae8fb9019d2aa6ccb151a19871df40de6c98e29 from qemu
2018-06-15 13:12:14 -04:00
Richard Henderson 53d151de58
target/arm: Implement SVE copy to vector (predicated)
Backports commit 792a557847697235037fea30eaaacb9b45b4c9e5 from qemu
2018-06-15 13:03:36 -04:00
Richard Henderson 0bb2fdd752
target/arm: Implement SVE conditionally broadcast/extract element
Backports commit ef23cb726dc32375bc2fca7ac3e9f34816f6ee13 from qemu
2018-06-15 13:01:40 -04:00
Richard Henderson 8ba3bde59b
target/arm: Implement SVE compress active elements
Backports commit 3ca879aeb3412bc2be35d01a7bedf5fada960b5d from qemu
2018-06-15 12:52:19 -04:00
Richard Henderson d9ed221567
target/arm: Implement SVE Permute - Interleaving Group
Backports commit 234b48e9c68759aea78ff5a1e49c2ba806cd1d83 from qemu
2018-06-15 12:49:42 -04:00
Richard Henderson 3722ab310b
target/arm: Implement SVE Permute - Predicates Group
Backports commit d731d8cb3c74258669211f065c918353eb7b8f4a from qemu
2018-06-15 12:44:50 -04:00
Richard Henderson c57ff23c56
target/arm: Implement SVE Permute - Unpredicated Group
Backports commit 30562ab716bcec0bf718b47b5268949856b17604 from qemu
2018-06-15 12:37:56 -04:00
Richard Henderson 4dc2b5ea79
target/arm: Extend vec_reg_offset to larger sizes
Rearrange the arithmetic so that we are agnostic about the total size
of the vector and the size of the element. This will allow us to index
up to the 32nd byte and with 16-byte elements.

Backports commit 66f2dbd783d0b6172043e3679171421b2d0bac11 from qemu
2018-06-15 12:23:35 -04:00
Philippe Mathieu-Daudé 5992214b3b
target/arm: Add trailing '\n' to qemu_log() calls
Backports commit 0221c8fdf2321137b34bd4dbb2557d0725739822 from qemu
2018-06-08 19:24:38 -04:00
Richard Henderson 10e2b13650
tcg: Pass tb and index to tcg_gen_exit_tb separately
Do the cast to uintptr_t within the helper, so that the compiler
can type check the pointer argument. We can also do some more
sanity checking of the index argument.

Backports commit 07ea28b41830f946de3841b0ac61a3413679feb9 from qemu
2018-06-07 11:56:32 -04:00
Richard Henderson 533a3f6a6c
tcg: Fix helper function vs host abi for float16
Depending on the host abi, float16, aka uint16_t, values are
passed and returned either zero-extended in the host register
or with garbage at the top of the host register.

The tcg code generator has so far been assuming garbage, as that
matches the x86 abi, but this is incorrect for other host abis.
Further, target/arm has so far been assuming zero-extended results,
so that it may store the 16-bit value into a 32-bit slot with the
high 16-bits already clear.

Rectify both problems by mapping "f16" in the helper definition
to uint32_t instead of (a typedef for) uint16_t. This forces
the host compiler to assume garbage in the upper 16 bits on input
and to zero-extend the result on output.

Backports commit 6c2be133a7478e443c99757b833d0f265c48e0a6 from qemu
2018-06-02 10:10:12 -04:00
Peter Maydell 0f0b2e0bd8
target/arm: Honour FPCR.FZ in FRECPX
The FRECPX instructions should (like most other floating point operations)
honour the FPCR.FZ bit which specifies whether input denormals should
be flushed to zero (or FZ16 for the half-precision version).
We forgot to implement this, which doesn't affect the results (since
the calculation doesn't actually care about the mantissa bits) but did
mean we were failing to set the FPSR.IDC bit.

Backports commit 2cfbf36ec07f7cac1aabb3b86f1c95c8a55424ba from qemu
2018-06-02 10:02:57 -04:00
Richard Henderson 6835b2dd13
target/arm: Implement SVE Permute - Extract Group
Backports commit b94f8f60bd841c5b737185cd38263e26822f77ab from qemu
2018-05-20 05:26:55 -04:00
Richard Henderson 9917f0d536
target/arm: Implement SVE Integer Wide Immediate - Predicated Group
Backports commit f25a2361539626721dbccce14c077cad03b2e72c from qemu
2018-05-20 05:24:04 -04:00
Richard Henderson f4ecf1a152
target/arm: Implement SVE Bitwise Immediate Group
Backports commit e1fa1164f397bbd381439ed32d97d9b4b4d7eb43 from qemu
2018-05-20 05:17:53 -04:00
Richard Henderson 89038c1e4b
target/arm: Implement SVE Element Count Group
Backports commit 24e82e68341e73ec0f65534c78c13fd03395b188 from qemu
2018-05-20 05:15:35 -04:00
Richard Henderson 0249ab3f7e
target/arm: Implement SVE floating-point trig select coefficient
Backports commit a1f233f25fd502f9a5b40c14df1b4dbdda463487 from qemu
2018-05-20 05:05:20 -04:00
Richard Henderson d6c18fc788
target/arm: Implement SVE floating-point exponential accelerator
Backports commit 0762cd428fd7b471207f5cb5b4bd4bd8f141dbe0 from qemu
2018-05-20 05:01:16 -04:00
Richard Henderson cb55a3acdb
target/arm: Implement SVE Compute Vector Address Group
Backports commit 4b242d9c1b6beaf5c81d84e956243b614a4a1d84 from qemu
2018-05-20 04:57:18 -04:00
Richard Henderson 45e009269e
target/arm: Implement SVE Bitwise Shift - Unpredicated Group
Backports commit d9d78dccc86eed10ccf1c8e1ac236e41ec330b06 from qemu
2018-05-20 04:51:58 -04:00
Lioncash bf97c44a2b
target/arm: Implement SVE Stack Allocation Group 2018-05-20 04:45:53 -04:00
Richard Henderson 45a09e2f25
target/arm: Implement SVE Index Generation Group
Backports commit 9a56c9c3a955b77fe436beef7ac03c76a65fa32d from qemu
2018-05-20 04:43:01 -04:00
Richard Henderson 390bd68287
target/arm: Implement SVE Integer Arithmetic - Unpredicated Group
Backports commit fea98f9c3077e4666f6d4933030b5891fbd6bb12 from qemu
2018-05-20 04:36:54 -04:00
Richard Henderson 1730d3cff0
target/arm: Implement SVE Integer Multiply-Add Group
Backports commit 96a36e4a44bbf296ac212ed68ebf4e48d3dfb1f0 from qemu
2018-05-20 04:35:36 -04:00
Richard Henderson 32949156d2
target/arm: Implement SVE Integer Arithmetic - Unary Predicated Group
Backports commit afac6d0467c1327ad2e30a3c35347fcf5a773742 from qemu
2018-05-20 04:31:18 -04:00
Lioncash 878b862a04
target/arm: Implement SVE bitwise shift by wide elements (predicated) 2018-05-20 03:10:24 -04:00
Richard Henderson 5aa51a3a74
target/arm: Implement SVE bitwise shift by vector (predicated)
Backports commit 27721dbb7ae5e2a52f06588cf38854e4cbc613c0 from qemu
2018-05-20 03:07:02 -04:00
Richard Henderson 7bb3067b95
target/arm: Implement SVE bitwise shift by immediate (predicated)
Backports commit ccd841c3d71db6943f8b6d3d56bd2abb548ba40c from qemu
2018-05-20 03:01:07 -04:00
Richard Henderson 837e39ea63
target/arm: Implement SVE Integer Reduction Group
Excepting MOVPRFX, which isn't a reduction. Presumably it is
placed within the group because of its encoding.

Backports commit 047cec971d2791b206677b954227ea92ff7ee3db from qemu
2018-05-20 02:53:04 -04:00
Richard Henderson 331aabddeb
target/arm: Implement SVE Predicate Misc Group
Backports commit 028e2a7b876631eff165cac59eb43bdb2dcc213b and
f97cfd596ed9bd38644323cb61d19b85ac703c81 from qemu
2018-05-20 02:43:36 -04:00
Richard Henderson 65f74e3608
target/arm: Implement SVE Predicate Logical Operations Group
Backports commit 516e246a1a292f6c6f6aad5451799accbb08acd9 from qemu
2018-05-20 01:35:59 -04:00