Commit graph

3957 commits

Author SHA1 Message Date
Fredrik Noring a93e15aad1
target/mips: Define the R5900 CPU
The primary purpose of this change is to support programs compiled by
GCC for the R5900 target and thereby run R5900 Linux distributions, for
example Gentoo.

GCC in version 7.3, by itself, by inspection of the GCC source code
and inspection of the generated machine code, for the R5900 target,
only emits two instructions that are specific to the R5900: the three-
operand MULT and MULTU. GCC and libc also emit certain MIPS III
instructions that are not part of the R5900 ISA. They are normally
trapped and emulated by the Linux kernel, and therefore need to be
treated accordingly by QEMU.

A program compiled by GCC is taken to mean source code compiled by GCC
under the restrictions above. One can, with the apparent limitations,
with a bit of effort obtain a fully functioning operating system such
as R5900 Gentoo. Strictly speaking, programs need not be compiled by
GCC to make use of this change.

Instructions and other facilities of the R5900 not implemented by this
change are intended to signal provisional exceptions. One such example
is the FPU that is not compliant with IEEE 754-1985 in system mode. It
is therefore provisionally disabled. In user space the FPU is trapped
and emulated by IEEE 754-1985 compliant software in the kernel, and
this is handled accordingly by QEMU. Another example is the 93
multimedia instructions specific to the R5900 that generate provisional
reserved instruction exception signals.

One of the benefits of running a Linux distribution under QEMU is that
programs can be compiled with a native compiler, where the host and
target are the same, as opposed to a cross-compiler, where they are
not the same. This is especially important in cases where the target
hardware does not have the resources to run a native compiler.

Problems with cross-compilation are often related to host and target
differences in integer sizes, pointer sizes, endianness, machine code,
ABI, etc. Sometimes cross-compilation is not even supported by the
build script for a given package. One effective way to avoid those
problems is to replace the cross-compiler with a native compiler. This
change of compilation methods does not resolve the inherent problems
with cross-compilation.

The native compiler naturally replaces the cross-compiler, because one
typically uses one or the other, and preferably the native compiler
when the circumstances admit this. The native compiler is also a good
test case for the R5900 QEMU user mode. Additionally, Gentoo is well-
known for compiling and installing its packages from sources.

This change has been tested with Gentoo compiled for R5900, including
native compilation of several packages under QEMU.

Backports commit ed4f49ba9bb56ebca6987b1083255daf6c89b5de from qemu.
2018-11-10 12:11:11 -05:00
Fredrik Noring e9a4475a35
target/mips: Make R5900 DMULT[U], DDIV[U], LL[D] and SC[D] user only
The Linux kernel traps certain reserved instruction exceptions to
emulate the corresponding instructions. QEMU plays the role of the
kernel in user mode, so those traps are emulated by accepting the
instructions.

This change adds the function check_insn_opc_user_only to signal a
reserved instruction exception for flagged CPUs in QEMU system mode.

The MIPS III instructions DMULT[U], DDIV[U], LL[D] and SC[D] are not
implemented in R5900 hardware. They are trapped and emulated by the
Linux kernel and, accordingly, therefore QEMU user only instructions.

Backports commit 96631327be14c4f54cc31f873c278d9ffedd1e00 from qemu
2018-11-10 12:10:01 -05:00
Fredrik Noring cb7b097204
target/mips: Support R5900 MOVN, MOVZ and PREF instructions from MIPS IV
The R5900 is taken to be MIPS III with certain modifications. From
MIPS IV it implements the instructions MOVN, MOVZ and PREF.

Backports commit 5601e6217d90ed322b4b9a6d68e8db607db91842 from qemu
2018-11-10 12:08:14 -05:00
Fredrik Noring 296d8bd729
target/mips: Support R5900 DIV1 and DIVU1 instructions
Backports commit be9c42c90d162100a63111ddeb8bfe50be897873 from qemu
2018-11-10 12:07:24 -05:00
Fredrik Noring b42c8e80b8
target/mips: Support R5900 MFLO1, MTLO1, MFHI1 and MTHI1 instructions
Backports commit 8d927f7cb4b3ec06d6a7cf71221fd6a48e9a8fb5 from qemu
2018-11-10 12:06:20 -05:00
Fredrik Noring 3914d65fb9
target/mips: Support R5900 three-operand MULT1 and MULTU1 instructions
Add support for MULT1 and MULTU1 instructions.

Backports commit 06de726b2d4da185dfec9d06b5f1032059ad3554 from qemu
2018-11-10 12:04:28 -05:00
Fredrik Noring 91cd7c20e5
target/mips: Support R5900 three-operand MULT and MULTU instructions
The three-operand MULT and MULTU are the only R5900-specific
instructions emitted by GCC 7.3. The R5900 also implements the three-
operand MADD and MADDU instructions, but they are omitted in QEMU for
now since they are absent in programs compiled by current GCC versions.

Likewise, the R5900-specific pipeline 1 instruction variants MULT1,
MULTU1, DIV1, DIVU1, MADD1, MADDU1, MFHI1, MFLO1, MTHI1 and MTLO1
are omitted here as well.

Backports commit 21e8e8b230af38b6bd8c953fa5f31e4a5a128e1c from qemu
2018-11-10 11:57:54 -05:00
Fredrik Noring 7da9860cf5
target/mips: Add a placeholder for R5900 MMI3 instruction subclass
Add a placeholder for MMI3 subclass.

Backports commit ec1944fc8eb862d48a0c74671105ce13acbc9c9e from qemu
2018-11-10 11:54:48 -05:00
Fredrik Noring 13d02e9aad
target/mips: Add a placeholder for R5900 MMI2 instruction subclass
Backports commit 6c1e48d38a2d26cca2d2b00f331a4ac7dbfae3ca from qemu
2018-11-10 11:52:47 -05:00
Fredrik Noring 63d9f0c6b7
target/mips: Add a placeholder for R5900 MMI1 instruction subclass
Backports commit 7a803ca23a6d6ac0d1d34469cd3f010a66cd381a from qemu
2018-11-10 11:51:47 -05:00
Fredrik Noring 685ccc52e7
target/mips: Add a placeholder for R5900 MMI0 instruction subclass
Add a placeholder for MMI0 subclass.

Backports commit 88eafe0b28c8e88ed6d38eb27dbf482f9c885745 from qemu
2018-11-10 11:50:48 -05:00
Fredrik Noring e71d43fd8d
target/mips: Add a placeholder for R5900 MMI instruction class
Add a placeholder for MMI class. This is the main palceholder for
MMI ASE.

backports commit 71b8a6b3f3d89283b094e04962c077aa01401438 from qemu
2018-11-10 11:49:19 -05:00
Fredrik Noring 496fe3ba14
target/mips: Add a placeholder for R5900 LQ
Add a placeholder for LQ instruction.

Backports commit f08099ad7a4dd32e12a3f9d4b4b04c32d7522b03 from qemu
2018-11-10 11:41:10 -05:00
Fredrik Noring cfc33249ce
target/mips: Add a placeholder for R5900 SQ, handle user mode RDHWR
Add placeholder for SQ instruction, handle RDHWR.

Backports commit bb41e74b66a8879ba5c23db145039faa27df5766 from qemu
2018-11-10 11:40:18 -05:00
Fredrik Noring 32a644a4a1
target/mips: Bunch of opcodes
Globs a bunch of MIPS commits together from qemu.
2018-11-10 11:39:20 -05:00
Fredrik Noring 5a6b86a346
target/mips: Define R5900 MMI class, and LQ and SQ opcode constants
Define MMI class, LQ, and SQ R5900 opdoces.

Backports commit f99c0d6da3424dd48ad1f0345464f63515949be6 from qemu
2018-11-10 11:32:27 -05:00
Fredrik Noring fa90149289
target/mips: Add R5900 Multimedia Instruction overview note
Add a comment on R5900 MMI ASE (short overview).

Backports commit 497f072b159effc4b19d9629e4818e6185be5776 from qemu
2018-11-10 11:30:57 -05:00
Fredrik Noring 93fb8273c8
target/mips: Define R5900 ISA, MMI ASE, and R5900 CPU preprocessor constants
The R5900 implements the 64-bit MIPS III instruction set except
DMULT, DMULTU, DDIV, DDIVU, LL, SC, LLD and SCD. The MIPS IV
instructions MOVN, MOVZ and PREF are implemented. It has the
R5900-specific three-operand instructions MADD, MADDU, MULT and
MULTU as well as pipeline 1 versions MULT1, MULTU1, DIV1, DIVU1,
MADD1, MADDU1, MFHI1, MFLO1, MTHI1 and MTLO1. A set of 93 128-bit
multimedia instructions specific to the R5900 is also implemented.

The Toshiba TX System RISC TX79 Core Architecture manual:

https://wiki.qemu.org/File:C790.pdf

describes the C790 processor that is a follow-up to the R5900. There
are a few notable differences in that the R5900 FPU

- is not IEEE 754-1985 compliant,
- does not implement double format, and
- its machine code is nonstandard.

Backports commit 6f692818a7b53630702d25a709cd61282fd139ad from qemu
2018-11-10 11:29:25 -05:00
Richard Henderson e9fe7d3c8d
target/arm: Only flush tlb if ASID changes
Since QEMU does not implement ASIDs, changes to the ASID must flush the
tlb. However, if the ASID does not change there is no reason to flush.

In testing a boot of the Ubuntu installer to the first menu, this reduces
the number of flushes by 30%, or nearly 600k instances.

Backports commit 93f379b0c43617b1361f742f261479eaed4959cb from qemu
2018-11-10 11:26:24 -05:00
Richard Henderson 15a6b3f771
target/arm: Remove writefn from TTBR0_EL3
The EL3 version of this register does not include an ASID,
and so the tlb_flush performed by vmsa_ttbr_write is not needed.

Backports commit f478847f1ee0df9397f561025ab2f687fd923571 from qemu
2018-11-10 11:25:39 -05:00
Richard Henderson 1bcba0737e
target/arm: Reorg NEON VLD/VST single element to one lane
Instead of shifts and masks, use direct loads and stores from
the neon register file.

Backports commit 2d6ac920837f558be214ad2ddd28cad7f3b15e5c from qemu
2018-11-10 11:24:37 -05:00
Richard Henderson 37103f1bc4
target/arm: Promote consecutive memory ops for aa32
For a sequence of loads or stores from a single register,
little-endian operations can be promoted to an 8-byte op.
This can reduce the number of operations by a factor of 8.

Backports commit e23f12b3a252352b575908ca7b94587acd004641 from qemu
2018-11-10 11:19:15 -05:00
Richard Henderson 1cab7a41ac
target/arm: Reorg NEON VLD/VST all elements
Instead of shifts and masks, use direct loads and stores from the neon
register file. Mirror the iteration structure of the ARM pseudocode
more closely. Correct the parameters of the VLD2 A2 insn.

Note that this includes a bugfix for handling of the insn
"VLD2 (multiple 2-element structures)" -- we were using an
incorrect stride value.

Backports commit ac55d00709e78cd39dfa298dcaac7aecb58762e8 from qemu
2018-11-10 11:18:45 -05:00
Richard Henderson a2239b9f5b
target/arm: Use gvec for NEON VLD all lanes
Backports commit 7377c2c97e20e64ed9b481eb2d9b9084bfd5b7e9 from qemu
2018-11-10 11:08:29 -05:00
Richard Henderson 985acb9cde
target/arm: Use gvec for NEON_3R_VTST_VCEQ, NEON_3R_VCGT, NEON_3R_VCGE
Move cmtst_op expanders from translate-a64.c.

Backports commit ea580fa312674c1ba82a8b137caf42b0609ce3e3 from qemu
2018-11-10 11:03:42 -05:00
Richard Henderson 5d9c0e52bf
target/arm: Use gvec for NEON_3R_VML
Move mla_op and mls_op expanders from translate-a64.c.

Backports commit 4a7832b095b9ce97a815749a13516f5cfb3c5dd4 from qemu
2018-11-10 10:58:44 -05:00
Richard Henderson 79bbb7c730
target/arm: Use gvec for VSRI, VSLI
Move shi_op and sli_op expanders from translate-a64.c.

Backports commit f3cd8218d1d3e534877ce3f3cb61c6757d10f9df from qemu
2018-11-10 10:53:28 -05:00
Lioncash edb36c7505
target/arm: Use gvec for VSRA 2018-11-10 10:32:29 -05:00
Richard Henderson b5877f1dfb
target/arm: Use gvec for VSHR, VSHL
Backports commit 1dc8425e551be1371d657e94367f37130cd7aede from qemu
2018-11-10 10:14:31 -05:00
Lioncash 7790ca1ccb
target/arm: Use gvec for NEON_3R_VMUL 2018-11-10 10:11:10 -05:00
Richard Henderson dfdc6bc05c
target/arm: Use gvec for NEON_2RM_VMN, NEON_2RM_VNEG
Backports commit 4bf940bebad273e4b3534ae3f83f2c9d1191d3a2 from qemu
2018-11-10 10:09:38 -05:00
Richard Henderson 7b4b5ac249
target/arm: Use gvec for NEON_3R_VADD_VSUB insns
Backports commit e4717ae02dd0c2e544a07302c1ed473775209aba from qemu
2018-11-10 10:08:23 -05:00
Richard Henderson 0965b9513a
target/arm: Use gvec for NEON_3R_LOGIC insns
Move expanders for VBSL, VBIT, and VBIF from translate-a64.c.

Backports commit eabcd6faa90461e0b7463f4ebe75b8d050487c9c from qemu
2018-11-10 10:06:13 -05:00
Richard Henderson 9f767248a2
target/arm: Use gvec for NEON VMOV, VMVN, VBIC & VORR (immediate)
Backports commit 246fa4aca95e213fba10c8222dbc6bd0a9a2a8d4 from qemu
2018-11-10 09:56:30 -05:00
Richard Henderson c1251a19e1
target/arm: Use gvec for NEON VDUP
Also introduces neon_element_offset to find the env offset
of a specific element within a neon register.

Backports commit 32f91fb71f4c32113ec8c2af5f74f14abe6c7162 from qemu
2018-11-10 09:51:40 -05:00
Richard Henderson 3d5f040608
target/arm: Mark some arrays const
Backports commit 308e5636152594daa4c5597b1188d44d7266db04 from qemu
2018-11-10 09:49:25 -05:00
Richard Henderson 931b49fb06
target/arm: Promote consecutive memory ops for aa64
For a sequence of loads or stores from a single register,
little-endian operations can be promoted to an 8-byte op.
This can reduce the number of operations by a factor of 8.

Backports commit 87f9a7f0c8d5122c36743885158782c2348a6d21 from qemu
2018-11-10 09:46:04 -05:00
Richard Henderson e6707b900c
target/arm: Use tcg_gen_gvec_dup_i64 for LD[1-4]R
Backports commit 10e0b33c676b4e8ac80d5929980f4fa6be617c5a from qemu
2018-11-10 09:41:14 -05:00
Richard Henderson 74aba4ba51
target/arm: Don't call tcg_clear_temp_count
This is done generically in translator_loop.

Backports commit 7108e255c2d95b44c9dfee8075d0d6fb391281a8 from qemu
2018-11-10 09:40:06 -05:00
Richard Henderson 9bbc412c66
target/arm: Hoist address increment for vector memory ops
This can reduce the number of opcodes required for certain
complex forms of load-multiple (e.g. ld4.16b).

Backports commit a7d8143aed2268f147cc1abfebc848ed6282a313 from qemu
2018-11-10 09:39:20 -05:00
Peter Maydell d60fe610bb
target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode
For traps of FP/SIMD instructions to AArch32 Hyp mode, the syndrome
provided in HSR has more information than is reported to AArch64.
Specifically, there are extra fields TA and coproc which indicate
whether the trapped instruction was FP or SIMD. Add this extra
information to the syndromes we construct, and mask it out when
taking the exception to AArch64.

Backports commit 4be42f4013fa1a9df47b48aae5148767bed8e80c from qemu
2018-11-10 09:36:41 -05:00
Peter Maydell 075bac4d57
target/arm: Get IL bit correct for v7 syndrome values
For the v7 version of the Arm architecture, the IL bit in
syndrome register values where the field is not valid was
defined to be UNK/SBZP. In v8 this is RES1, which is what
QEMU currently implements. Handle the desired v7 behaviour
by squashing the IL bit for the affected cases:
* EC == EC_UNCATEGORIZED
* prefetch aborts
* data aborts where ISV is 0

(The fourth case listed in the v8 Arm ARM DDI 0487C.a in
section G7.2.70, "illegal state exception", can't happen
on a v7 CPU.)

This deals with a corner case noted in a comment.

Backports commit 2ed08180db096ea5e44573529b85e09b1ed10b08 from qemu
2018-11-10 09:29:13 -05:00
Peter Maydell 99516b43a3
target/arm: New utility function to extract EC from syndrome
Create and use a utility function to extract the EC field
from a syndrome, rather than open-coding the shift.

Backports commit 64b91e3f890a8c221b65c6820a5ee39107ee40f5 from qemu
2018-11-10 09:28:23 -05:00
Peter Maydell ebe442b1d4
target/arm: Implement HCR.PTW
If the HCR_EL2 PTW virtualizaiton configuration register bit
is set, then this means that a stage 2 Permission fault must
be generated if a stage 1 translation table access is made
to an address that is mapped as Device memory in stage 2.
Implement this.

Backports commit eadb2febf05452bd8062c4c7823d7d789142500c from qemu
2018-11-10 09:25:57 -05:00
Peter Maydell 28fcb58c69
target/arm: Implement HCR.VI and VF
The HCR_EL2 VI and VF bits are supposed to track whether there is
a pending virtual IRQ or virtual FIQ. For QEMU we store the
pending VIRQ/VFIQ status in cs->interrupt_request, so this means:
* if the register is read we must get these bit values from
cs->interrupt_request
* if the register is written then we must write the bit
values back into cs->interrupt_request

Backports commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f from qemu
2018-11-10 09:23:21 -05:00
Peter Maydell 0f0befc90a
target/arm: ISR_EL1 bits track virtual interrupts if IMO/FMO set
The A/I/F bits in ISR_EL1 should track the virtual interrupt
status, not the physical interrupt status, if the associated
HCR_EL2.AMO/IMO/FMO bit is set. Implement this, rather than
always showing the physical interrupt status.

We don't currently implement anything to do with external
aborts, so this applies only to the I and F bits (though it
ought to be possible for the outer guest to present a virtual
external abort to the inner guest, even if QEMU doesn't
emulate physical external aborts, so there is missing
functionality in this area).

Backports commit 636540e9c40bd0931ef3022cb953bb7dbecd74ed from qemu
2018-11-10 09:20:58 -05:00
Peter Maydell f0c9e690fb
target/arm: Implement HCR.DC
The HCR.DC virtualization configuration register bit has the
following effects:
* SCTLR.M behaves as if it is 0 for all purposes except
direct reads of the bit
* HCR.VM behaves as if it is 1 for all purposes except
direct reads of the bit
* the memory type produced by the first stage of the EL1&EL0
translation regime is Normal Non-Shareable,
Inner Write-Back Read-Allocate Write-Allocate,
Outer Write-Back Read-Allocate Write-Allocate.

Implement this behaviour.

Backports commit 9d1bab337caf2324a233e5937f415fad4ce1641b from qemu
2018-11-10 09:19:44 -05:00
Peter Maydell b9e7fa2d80
target/arm: Implement HCR.FB
The HCR.FB virtualization configuration register bit requests that
TLB maintenance, branch predictor invalidate-all and icache
invalidate-all operations performed in NS EL1 should be upgraded
from "local CPU only to "broadcast within Inner Shareable domain".
For QEMU we NOP the branch predictor and icache operations, so
we only need to upgrade the TLB invalidates:
AArch32 TLBIALL, TLBIMVA, TLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID,
ITLBIALL, ITLBIMVA, ITLBIASID, TLBIMVAA, TLBIMVAL, TLBIMVAAL
AArch64 TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1,
TLBI VALE1, TLBI VAALE1

Backports commit b4ab8ce98b8c482c8986785800f238d32a1578a9 from qemu
2018-11-10 09:17:51 -05:00
Lioncash a0358202a7
target/arm: Improve debug logging of AArch32 exception return
For AArch32, exception return happens through certain kinds
of CPSR write. We don't currently have any CPU_LOG_INT logging
of these events (unlike AArch64, where we log in the ERET
instruction). Add some suitable logging.

This will log exception returns like this:
Exception return from AArch32 hyp to usr PC 0x80100374

paralleling the existing logging in the exception_return
helper for AArch64 exception returns:
Exception return from AArch64 EL2 to AArch64 EL0 PC 0x8003045c
Exception return from AArch64 EL2 to AArch32 EL0 PC 0x8003045c

(Note that an AArch32 exception return can only be
AArch32->AArch32, never to AArch64.)

Backports commit 81e3728407bf4a12f83e14fd410d5f0a7d29b5b4 from qemu
2018-11-10 09:09:52 -05:00
Richard Henderson 03ec90f39b
target/arm: Convert v8.2-fp16 from feature bit to aa64pfr0 test
Backports commit 5763190fa8705863b4b725aa1657661a97113eb4 from qemu
2018-11-10 08:34:32 -05:00
Richard Henderson 0286f9525d
target/arm: Convert sve from feature bit to aa64pfr0 test
Backports commit cd208a1c3923bc097ec55c5b207d79294ab0e719 from qemu
2018-11-10 08:27:35 -05:00
Richard Henderson 03e2d64aed
target/arm: Convert jazelle from feature bit to isar1 test
Having V6 alone imply jazelle was wrong for cortex-m0.
Change to an assertion for V6 & !M.

This was harmless, because the only place we tested ARM_FEATURE_JAZELLE
was for 'bxj' in disas_arm(), which is unreachable for M-profile cores.

Backports commit 09cbd50198d5dcac8bea2e47fa5dd641ec505fae from qemu
2018-11-10 08:24:11 -05:00
Richard Henderson 4a58a81e31
target/arm: Convert division from feature bits to isar0 tests
Both arm and thumb2 division are controlled by the same ISAR field,
which takes care of the arm implies thumb case. Having M imply
thumb2 division was wrong for cortex-m0, which is v6m and does not
have thumb2 at all, much less thumb2 division.

Backports commit 7e0cf8b47f0e67cebbc3dfa73f304e56ad1a090f from qemu
2018-11-10 08:21:02 -05:00
Richard Henderson 4221703f18
target/arm: Convert v8 extensions from feature bits to isar tests
Most of the v8 extensions are self-contained within the ISAR
registers and are not implied by other feature bits, which
makes them the easiest to convert.

Backports commit 962fcbf2efe57231a9f5df0ae0f40c05e35628ba from qemu
2018-11-10 08:17:57 -05:00
Richard Henderson e5797bb0b7
target/arm: V8M should not imply V7VE
Instantiating mps2-an505 (cortex-m33) will fail make check when
V7VE asserts that ID_ISAR0.Divide includes ARM division. It is
also wrong to include ARM_FEATURE_LPAE.

Backports commit 5256df880d1312a58472af3fb0a3c51e708f2161 from qemu
2018-11-10 08:02:26 -05:00
Richard Henderson 1a714e97af
target/arm: Move some system registers into a substructure
Create struct ARMISARegisters, to be accessed during translation.

Backports commit 47576b94af5c406fc6521fb336fb5c12beeac3f8 from qemu
2018-11-10 08:00:32 -05:00
Dongjiu Geng 7087f7f398
target/arm: Add support for VCPU event states
This patch extends the qemu-kvm state sync logic with support for
KVM_GET/SET_VCPU_EVENTS, giving access to yet missing SError exception.
And also it can support the exception state migration.

The SError exception states include SError pending state and ESR value,
the kvm_put/get_vcpu_events() will be called when set or get system
registers. When do migration, if source machine has SError pending,
QEMU will do this migration regardless whether the target machine supports
to specify guest ESR value, because if target machine does not support that,
it can also inject the SError with zero ESR value.

Backports the relevant parts of commit
202ccb6bab5fe26bca2c82bff23302f7acfd1940 from qemu
2018-11-10 07:49:15 -05:00
Emilio G. Cota 1677898a09
cputlb: read CPUTLBEntry.addr_write atomically
Updates can come from other threads, so readers that do not
take tlb_lock must use atomic_read to avoid undefined
behaviour (UB).

This completes the conversion to tlb_lock. This conversion results
on average in no performance loss, as the following experiments
(run on an Intel i7-6700K CPU @ 4.00GHz) show.

1. aarch64 bootup+shutdown test:

- Before:
Performance counter stats for 'taskset -c 0 ../img/aarch64/die.sh' (10 runs):

7487.087786 task-clock (msec) # 0.998 CPUs utilized ( +- 0.12% )
31,574,905,303 cycles # 4.217 GHz ( +- 0.12% )
57,097,908,812 instructions # 1.81 insns per cycle ( +- 0.08% )
10,255,415,367 branches # 1369.747 M/sec ( +- 0.08% )
173,278,962 branch-misses # 1.69% of all branches ( +- 0.18% )

7.504481349 seconds time elapsed ( +- 0.14% )

- After:
Performance counter stats for 'taskset -c 0 ../img/aarch64/die.sh' (10 runs):

7462.441328 task-clock (msec) # 0.998 CPUs utilized ( +- 0.07% )
31,478,476,520 cycles # 4.218 GHz ( +- 0.07% )
57,017,330,084 instructions # 1.81 insns per cycle ( +- 0.05% )
10,251,929,667 branches # 1373.804 M/sec ( +- 0.05% )
173,023,787 branch-misses # 1.69% of all branches ( +- 0.11% )

7.474970463 seconds time elapsed ( +- 0.07% )

2. SPEC06int:
SPEC06int (test set)
[Y axis: Speedup over master]
1.15 +-+----+------+------+------+------+------+-------+------+------+------+------+------+------+----+-+
| |
1.1 +-+.................................+++.............................+ tlb-lock-v2 (m+++x) +-+
| +++ | +++ tlb-lock-v3 (spinl|ck) |
| +++ | | +++ +++ | | |
1.05 +-+....+++...........####.........|####.+++.|......|.....###....+++...........+++....###.........+-+
| ### ++#| # |# |# ***### +++### +++#+# | +++ | #|# ### |
1 +-+++***+#++++####+++#++#++++++++++#++#+*+*++#++++#+#+****+#++++###++++###++++###++++#+#++++#+#+++-+
| *+* # #++# *** # #### *** # * *++# ****+# *| * # ****|# |# # #|# #+# # # |
0.95 +-+..*.*.#....#..#.*|*..#...#..#.*|*..#.*.*..#.*|.*.#.*++*.#.*++*+#.****.#....#+#....#.#..++#.#..+-+
| * * # # # *|* # # # *|* # * * # *++* # * * # * * # * |* # ++# # # # *** # |
| * * # ++# # *+* # # # *|* # * * # * * # * * # * * # *++* # **** # ++# # * * # |
0.9 +-+..*.*.#...|#..#.*.*..#.++#..#.*|*..#.*.*..#.*..*.#.*..*.#.*..*.#.*..*.#.*.|*.#...|#.#..*.*.#..+-+
| * * # *** # * * # |# # *+* # * * # * * # * * # * * # * * # *++* # |# # * * # |
0.85 +-+..*.*.#..*|*..#.*.*..#.***..#.*.*..#.*.*..#.*..*.#.*..*.#.*..*.#.*..*.#.*..*.#.****.#..*.*.#..+-+
| * * # *+* # * * # *|* # * * # * * # * * # * * # * * # * * # * * # * |* # * * # |
| * * # * * # * * # *+* # * * # * * # * * # * * # * * # * * # * * # * |* # * * # |
0.8 +-+..*.*.#..*.*..#.*.*..#.*.*..#.*.*..#.*.*..#.*..*.#.*..*.#.*..*.#.*..*.#.*..*.#.*++*.#..*.*.#..+-+
| * * # * * # * * # * * # * * # * * # * * # * * # * * # * * # * * # * * # * * # |
0.75 +-+--***##--***###-***###-***###-***###-***###-****##-****##-****##-****##-****##-****##--***##--+-+
400.perlben401.bzip2403.gcc429.m445.gob456.hmme45462.libqua464.h26471.omnet473483.xalancbmkgeomean

png: https://imgur.com/a/BHzpPTW

Notes:
- tlb-lock-v2 corresponds to an implementation with a mutex.
- tlb-lock-v3 corresponds to the current implementation, i.e.
a spinlock and a single lock acquisition in tlb_set_page_with_attrs.

Backports commit 403f290c0603f35f2d09c982bf5549b6d0803ec1 from qemu
2018-10-23 15:37:43 -04:00
Richard Henderson af6c47e192
target/arm: Check HAVE_CMPXCHG128 at translate time
Backports part of commit 62823083b8a2da8e126bb82b7b70f68eaa27b338 from
qemu
2018-10-23 15:29:46 -04:00
Richard Henderson 65beab9dd9
target/arm: Convert to HAVE_CMPXCHG128
Backports commit 1ec182c3337993a7d8b3983a1ac4f608c1d0fd64 from qemu
2018-10-23 15:25:30 -04:00
Richard Henderson 4bb71a98c0
target/i386: Convert to HAVE_CMPXCHG128
Backports commit e1ed709fbe687b1c92b31014b0ecfcd059252ec1 from qemu
2018-10-23 15:21:03 -04:00
Richard Henderson d74e00a30a
tcg: Split CONFIG_ATOMIC128
GCC7+ will no longer advertise support for 16-byte __atomic operations
if only cmpxchg is supported, as for x86_64. Fortunately, x86_64 still
has support for __sync_compare_and_swap_16 and we can make use of that.
AArch64 does not have, nor ever has had such support, so open-code it.

Backports commit e6cd4bb59b8154fa00da611200beef7eb4e8ec56 from qemu
2018-10-23 15:17:39 -04:00
Richard Henderson c911ea7128
tcg: Add tlb_index and tlb_entry helpers
Isolate the computation of an index from an address into a
helper before we change that function.

Backports commit 383beda9cf32f795616c3b93f7d6154d70372d4b from qemu
2018-10-23 15:04:27 -04:00
Emilio G. Cota dfb3954571
exec: introduce tlb_init
Paves the way for the addition of a per-TLB lock.

Backports commit 5005e2537d090bee87aca3b924dcd17920fd146a from qemu
2018-10-23 14:41:29 -04:00
Emilio G. Cota e5b43d2794
tcg: plug holes in struct TCGProfile
This plugs two 4-byte holes in 64-bit.

Backports commit dd1d7da23b0abef87f46d9ab39ba9b0974eaec04 from qemu
2018-10-23 14:38:16 -04:00
Emilio G. Cota 223975ada0
tcg: fix use of uninitialized variable under CONFIG_PROFILER
We forgot to initialize n in commit 15fa08f845 ("tcg: Dynamically
allocate TCGOps", 2017-12-29).

Backports commit c1f543b739086733024e31d74a52d9e41553f316 from qemu
2018-10-23 14:37:37 -04:00
Emilio G. Cota 9ce38c20b9
tcg: access cpu->icount_decr.u16.high with atomics
Consistently access u16.high with atomics to avoid
undefined behaviour in MTTCG.

Note that icount_decr.u16.low is only used in icount mode,
so regular accesses to it are OK.

Backports part of commit fff42f183ea4c3967405d4c1dce6d97dae4d64c8 from
qemu
2018-10-23 14:36:46 -04:00
Richard Henderson e01deeb9ba
tcg: Implement CPU_LOG_TB_NOCHAIN during expansion
Rather than test NOCHAIN before linking, do not emit the
goto_tb opcode at all. We already do this for goto_ptr.

Backports commit d7f425fdea991f052241c6479acd9feae834063b from qemu
2018-10-23 14:35:12 -04:00
Dimitrije Nikolic 856974c7b2
target/mips: Add opcodes for nanoMIPS EVA instructions
Add opcodes for nanoMIPS EVA instructions: CACHEE, LBE, LBUE, LHE,
LHUE, LLE, LLWPE, LWE, PREFE, SBE, SCE, SCWPE, SHE, SWE.

Backports commit 0d30b3bbc5fed12da8f8d1bfd28f2803d65a4cb0 from qemu
2018-10-23 14:33:08 -04:00
Stefan Markovic c3541a4b48
target/mips: Fix misplaced 'break' in handling of NM_SHRA_R_PH
Fix misplaced 'break' in handling of NM_SHRA_R_PH. Found by
Coverity (CID 1395627).

Backports commit d5ebcbaf09e8c14e62b2966446195be5eeabcbab from qemu
2018-10-23 14:32:22 -04:00
Matthew Fortune 255ced3c1a
target/mips: Fix emulation of microMIPS R6 <SELEQZ|SELNEZ>.<D|S>
Fix emulation of microMIPS R6 <SELEQZ|SELNEZ>.<D|S> instructions.
Their handling was permuted.

Backports commit fdac60cd0458f34b2e79d74a55bec10836e26471 from qemu
2018-10-23 14:31:26 -04:00
Yongbok Kim 73c2955d2b
target/mips: Implement hardware page table walker for MIPS32
Implement hardware page table walker. This implementation is
limiter only to MIPS32.

Backports commit 074cfcb4daedf59ccbbbc83c24eee80e0e8f4c71 from qemu
2018-10-23 14:29:27 -04:00
Yongbok Kim e1ea411300
target/mips: Add reset state for PWSize and PWField registers
Add reset state for PWSize and PWField registers. The reset state
is different for pre-R6 and R6 (and post-R6) ISAa

Backports commit 630107955757b9dfc5c09f105caa267eded2e3b1 from qemu
2018-10-23 14:23:59 -04:00
Yongbok Kim a35a59bda6
target/mips: Add CP0 PWCtl register
Add PWCtl register (CP0 Register 5, Select 6).

The PWCtl register configures hardware page table walking for TLB
refills.

This register is required for the hardware page walker feature. It
exists only if Config3 PW bit is set to 1. It contains following
fields:

PWEn (31) - Hardware Page Table walker enable
PWDirExt (30) - If 1, 4-th level implemented (MIPS64 only)
XK (28) - If 1, walker handles xkseg (MIPS64 only)
XS (27) - If 1, walker handles xsseg (MIPS64 only)
XU (26) - If 1, walker handles xuseg (MIPS64 only)
DPH (7) - Dual Page format of Huge Page support
HugePg (6) - Huge Page PTE supported in Directory levels
PSn (5..0) - Bit position of PTEvld in Huge Page PTE

Backports commit 103be64c26c166f12b3e1308edadef3443723ff1 from qemu
2018-10-23 14:23:04 -04:00
Yongbok Kim a5194f6dfc
target/mips: Add CP0 PWSize register
Add PWSize register (CP0 Register 5, Select 7).

The PWSize register configures hardware page table walking for TLB
refills.

This register is required for the hardware page walker feature. It
exists only if Config3 PW bit is set to 1. It contains following
fields:

BDW (37..32) Base Directory index width (MIPS64 only)
GDW (29..24) Global Directory index width
UDW (23..18) Upper Directory index width
MDW (17..12) Middle Directory index width
PTW (11..6 ) Page Table index width
PTEW ( 5..0 ) Left shift applied to the Page Table index

Backports commit 20b28ebc49945583d7191b57755cfd92433de9ff from qemu
2018-10-23 14:08:55 -04:00
Yongbok Kim 0597704314
target/mips: Add CP0 PWField register
Add PWField register (CP0 Register 5, Select 6).

The PWField register configures hardware page table walking for TLB
refills.

This register is required for the hardware page walker feature. It
exists only if Config3 PW bit is set to 1. It contains following
fields:

MIPS64:
BDI (37..32) - Base Directory index
GDI (29..24) - Global Directory index
UDI (23..18) - Upper Directory index
MDI (17..12) - Middle Directory index
PTI (11..6 ) - Page Table index
PTEI ( 5..0 ) - Page Table Entry shift

MIPS32:
GDW (29..24) - Global Directory index
UDW (23..18) - Upper Directory index
MDW (17..12) - Middle Directory index
PTW (11..6 ) - Page Table index
PTEW ( 5..0 ) - Page Table Entry shift

Backports commit fa75ad1459f4f6abbeb6d375a812dfad61320f58 from qemu
2018-10-23 13:52:31 -04:00
Yongbok Kim 2414d1fe05
target/mips: Add CP0 PWBase register
Add PWBase register (CP0 Register 5, Select 5).

The PWBase register contains the Page Table Base virtual address.

This register is required for the hardware page walker feature. It
exists only if Config3 PW bit is set to 1.

Backports commit 5e31fdd59fda5c4ba9eb0daadc2a26273a29a0b6 from qemu
2018-10-23 13:47:49 -04:00
Stefan Markovic 06cb2b1420
target/mips: Add CP0 Config2 to DisasContext
Add field corresponding to CP0 Config2 to DisasContext. This is
needed for availability control via Config2 bits.

Backports commit 49735f76db25bf10f57973d5249f17151b801760 from qemu
2018-10-23 13:43:02 -04:00
Stefan Markovic 64bec62433
target/mips: Improve DSP R2/R3-related naming
Do following replacements:

ASE_DSPR2 -> ASE_DSP_R2
ASE_DSPR3 -> ASE_DSP_R3
MIPS_HFLAG_DSPR2 -> MIPS_HFLAG_DSP_R2
MIPS_HFLAG_DSPR3 -> MIPS_HFLAG_DSP_R3
check_dspr2() -> check_dsp_r2()
check_dspr3() -> check_dsp_r3()

and several other similar minor replacements.

Backports commit 908f6be1b9cbc270470230f805d6f7474ab3178d from qemu
2018-10-23 13:42:01 -04:00
Stefan Markovic 6dd29739a9
target/mips: Add availability control for DSP R3 ASE
Add infrastructure for availability control for DSP R3 ASE MIPS
instructions. Only BPOSGE32C currently belongs to DSP R3 ASE, but
this is likely to be changed in near future.

Backports commit 59e781fbf13a2dede15437d055b09d7ea120dcac from qemu
2018-10-23 13:36:07 -04:00
Stefan Markovic 071fe91d6a
target/mips: Add bit definitions for DSP R3 ASE
Add DSP R3 ASE related bit definition for insn_flags and hflags.

Backports commit 6208f09441dcf8d142ff0e1624ef12da298776a4 from qemu
2018-10-23 13:19:18 -04:00
Philippe Mathieu-Daudé 2a27a61c51
target/mips: Reorganize bit definitions for insn_flags (ISAs/ASEs flags)
Distribute bits 56-63 vendor-specific ASEs as follows:

- bits 0-31 MIPS base instruction sets
- bits 32-47 MIPS ASEs
- bits 48-55 vendor-specific base instruction sets
- bits 56-63 vendor-specific ASEs

Backports commit 45ebdd24c3de158890ce390df39855a891e80701 from qemu
2018-10-23 13:18:11 -04:00
Philippe Mathieu-Daudé 055b2e4bdc
target/mips: Increase 'supported ISAs/ASEs' flag holder size
Increase the size of insn_flags holder size to 64 bits. This is
needed for future extensions since existing bits are almost all used.

Backports commit f9c9cd63e3dd84c5f052deec880ec92046bbe305 from qemu
2018-10-23 13:17:08 -04:00
Aleksandar Markovic e52c27e21c
target/mips: Add opcode values of MXU ASE
Add opcode values for all instructions in MXU ASE.

Backports commit 8bacd1ffc702c35d34ccd29b1a20c0273c9759cb from qemu
2018-10-23 13:15:43 -04:00
Aleksandar Markovic b6c9c13c4e
target/mips: Add organizational chart of MXU ASE
Add a comment that contains an organizational chart of MXU ASE
instructions.

Backports commit 9ef5bff97b0d033e20446c83fc61bae7c054b03e from qemu
2018-10-23 13:14:52 -04:00
Aleksandar Markovic 120b8c24b4
target/mips: Add assembler mnemonics list for MXU ASE
Add a comment that contains a list all MXU instructions,
expressed in assembler mnemonics.

Backports commit 1d0e663c5f25345a6702d8a83c051b83f3462299 from qemu
2018-10-23 13:13:34 -04:00
Aleksandar Markovic 96d299bd6f
target/mips: Add basic description of MXU ASE
Add a comment that contains a basic description of MXU ASE.

Backports commit b158d449bbfe71bb203fdce978a4a33c38a4e821 from qemu
2018-10-23 13:12:35 -04:00
Aleksandar Markovic 2cf0f05c27
target/mips: Add a comment before each CP0 register section in cpu.h
Add a comment before each CP0 register section in CPUMIPSState
definition, thus visually separating these sections.

Backports commit 50e7edc5ac25af2faaacd1f91e177c7de7d696c3 from qemu
2018-10-23 13:12:04 -04:00
Aleksandar Markovic d9ae47e2da
target/mips: Add a comment with an overview of CP0 registers
Add a comment with an overview of CP0 registers close to the
definition of their corresponding fields in CPUMIPSState.

Backports commit a86d421e18d58b32d6eaba1e79160e2b4e5a0a6c from qemu
2018-10-23 13:06:39 -04:00
Lioncash 5f12065284
sve_helper: Use the QEMU_FLATTEN macro instead of the compiler attribute directly
Keeps the code compiler-independent.
2018-10-23 13:05:02 -04:00
Peter Maydell 64661a9165
target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
The get_phys_addr() functions take a pointer to an ARMMMUFaultInfo
struct, which they fill in only if a fault occurs. This means that
the caller must always zero-initialize the struct before passing
it in. We forgot to do this in v7m_stack_read() and v7m_stack_write().
Correct the error.

Backports commit ab44c7b71fa683b9402bea0d367b87c881704188 from qemu
2018-10-23 12:58:39 -04:00
Aaron Lindsay 1596801693
target/arm: Mask PMOVSR writes based on supported counters
This is an amendment to my earlier patch:
commit 7ece99b17e832065236c07a158dfac62619ef99b

Backports commit 599b71e277ac7e92807191b20b7163a28c5450ad from qemu
2018-10-23 12:56:45 -04:00
Aaron Lindsay 10c6887e0b
target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
I previously fixed this for PMINTENSET_EL1, but missed these.

Backports commit fc5f6856a02168864a5c1a46866a12839322222f from qemu
2018-10-23 12:56:06 -04:00
Edgar E. Iglesias 0595aa5ade
target/arm: Add the Cortex-A72
Backports commit f11b452b95df4a0fc6561c278721cad03b24098b from qemu
2018-10-23 12:54:57 -04:00
Edgar E. Iglesias fa9828845f
target-arm: powerctl: Enable HVC when starting CPUs to EL2
When QEMU provides the equivalent of the EL3 firmware, we
need to enable HVCs in scr_el3 when turning on CPUs that
target EL2.

Backports commit 86278c33d1d71196f5e22ce3ce82a1b34a199754 from qemu
2018-10-23 12:53:40 -04:00
Richard Henderson 3b3bce7d4e
target/arm: Fix cortex-a7 id_isar0
The incorrect value advertised only thumb2 div without arm div.

Backports commit 37bdda89eb7615cb225f781c9fb552e144c68ea7 from qemu
2018-10-23 12:47:15 -04:00
Richard Henderson 3023a9723a
target/arm: Align cortex-r5 id_isar0
The missing nibble made it more difficult to read.

Backports commit aaab8f3400ea5ec9c6cce3607ff26f9be89321d6 from qemu
2018-10-23 12:46:28 -04:00
Richard Henderson 767242174a
target/arm: Define fields of ISAR registers
Backports commit a62e62af9f26bf655fe95ada796f28a6a16c0561 from qemu
2018-10-23 12:45:55 -04:00
Richard Henderson ce9485a63e
target/arm: Fix aarch64_sve_change_el wrt EL0
At present we assert:

arm_el_is_aa64: Assertion `el >= 1 && el <= 3' failed.

The comment in arm_el_is_aa64 explains why asking about EL0 without
extra information is impossible. Add an extra argument to provide
it from the surrounding context.

Fixes: 0ab5953b00b3

Backports commit 9a05f7b67436abdc52bce899f56acfde2e831454 from qemu
2018-10-23 12:44:04 -04:00
Peter Maydell ff812cc152
target/arm: Add v8M stack checks for MSR to SP_NS
Updating the NS stack pointer via MSR to SP_NS should include
a check whether the new SP value is below the stack limit.
No other kinds of update to the various stack pointer and
limit registers via MSR should perform a check.

Backports commit 167765f0739e4a108e8c2e2ff2f37917df5658f9 from qemu
2018-10-08 14:24:30 -04:00
Peter Maydell 76f521e6c3
target/arm: Add v8M stack checks for VLDM/VSTM
Add the v8M stack checks for the VLDM/VSTM
(aka VPUSH/VPOP) instructions. This code is currently
unreachable because we haven't yet implemented M profile
floating point support, but since the change is simple,
we add it now because otherwise we're likely to forget to
do it later.

Backports commit 8a954faf5412d5073d585d85a1da63a09bb5d84e from qemu
2018-10-08 14:23:02 -04:00
Peter Maydell 37d0c7fcf1
target/arm: Add v8M stack checks for Thumb push/pop
Add v8M stack checks for the 16-bit Thumb push/pop
encodings: STMDB, STMFD, LDM, LDMIA, LDMFD.

Backports commit aa369e5c08bbe2748d2be96f13f4ef469a4d3080 from qemu
2018-10-08 14:22:08 -04:00
Peter Maydell ef9afb1855
target/arm: Add v8M stack checks for T32 load/store single
Add v8M stack checks for the instructions in the T32
"load/store single" encoding class: these are the
"immediate pre-indexed" and "immediate, post-indexed"
LDR and STR instructions.

Backports commit 0bc003bad9752afc61624cb680226c922f34f82c from qemu
2018-10-08 14:20:58 -04:00
Peter Maydell de30651f5e
target/arm: Add v8M stack checks for Thumb2 LDM/STM
Add the v8M stack checks for:
* LDM (T2 encoding)
* STM (T2 encoding)

This includes the 32-bit encodings of the instructions listed
in v8M ARM ARM rule R_YVWT as
* LDM, LDMIA, LDMFD
* LDMDB, LDMEA
* POP (multiple registers)
* PUSH (muliple registers)
* STM, STMIA, STMEA
* STMDB, STMFD

We perform the stack limit before doing any other part
of the load or store.

Backports commit 7c0ed88e7d6bee3e55c3d8935c46226cb544191a from qemu
2018-10-08 14:19:14 -04:00
Peter Maydell bb97240df6
target/arm: Add v8M stack checks for LDRD/STRD (imm)
Add the v8M stack checks for:
* LDRD (immediate)
* STRD (immediate)

Loads and stores are more complicated than ADD/SUB/MOV, because we
must ensure that memory accesses below the stack limit are not
performed, so we can't simply do the check when we actually update
SP.

For these instructions, if the stack limit check triggers
we must not:
* perform any memory access below the SP limit
* update PC, SP or the load/store base register
but it is IMPDEF whether we:
* perform any accesses above or equal to the SP limit
* update destination registers for loads

For QEMU we choose to always check the limit before doing any other
part of the load or store, so we won't update any registers or
perform any memory accesses.

It is UNKNOWN whether the limit check triggers for a load or store
where the initial SP value is below the limit and one of the stores
would be below the limit, but the writeback moves SP to above the
limit. For QEMU we choose to trigger the check in this situation.

Note that limit checks happen only for loads and stores which update
SP via writeback; they do not happen for loads and stores which
simply use SP as a base register.

Backports commit 910d7692e5b60f2c2d08cc3d6d36076e85b6a69d from qemu
2018-10-08 14:17:27 -04:00
Lioncash cb935d868e
target/arm: Add v8M stack limit checks on NS function calls 2018-10-08 14:15:15 -04:00
Peter Maydell ed3c951fb6
target/arm: Add v8M stack checks on exception entry
Add checks for breaches of the v8M stack limit when the
stack pointer is decremented to push the exception frame
for exception entry.

Note that the exception-entry case is unique in that the
stack pointer is updated to be the limit value if the limit
is hit (per rule R_ZLZG).

Backports commit c32da7aa6205a5ff62ae8d5062f7cad0eae4c1fd from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell 0fc6e2c183
target/arm: Add some comments in Thumb decode
Add some comments to the Thumb decoder indicating what bits
of the instruction have been decoded at various points in
the code.

This is not an exhaustive set of comments; we're gradually
adding comments as we work with particular bits of the code.

Backports commit a2d12f0f34e9c5ef8a193556fde983aa186fa73a from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell ca5d7b8fd2
target/arm: Add v8M stack checks on ADD/SUB/MOV of SP
Add code to insert calls to a helper function to do the stack
limit checking when we handle these forms of instruction
that write to SP:
* ADD (SP plus immediate)
* ADD (SP plus register)
* SUB (SP minus immediate)
* SUB (SP minus register)
* MOV (register)

Backports commit 5520318939fea5d659bf808157cd726cb967b761 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell b2146058c3
target/arm: Move v7m_using_psp() to internals.h
We're going to want v7m_using_psp() in op_helper.c in the
next patch, so move it from helper.c to internals.h.

Backports commit 5529bf188d996391ff52a0e1801daf9c6a6bfcb0 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell ae4900fba2
target/arm: Define new EXCP type for v8M stack overflows
Define EXCP_STKOF, and arrange for it to cause us to take
a UsageFault with CFSR.STKOF set.

Backports commit 86f026de22d8854eecc004af44895de74225794f from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell 8b3b548961
target/arm: Define new TBFLAG for v8M stack checking
The Arm v8M architecture includes hardware stack limit checking.
When certain instructions update the stack pointer, if the new
value of SP is below the limit set in the associated limit register
then an exception is taken. Add a TB flag that tracks whether
the limit-checking code needs to be emitted.

Backports commit 4730fb85035e99c909db7d14ef76cd17f28f4423 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 66ffb372e7
target/arm: Pass TCGMemOpIdx to sve memory helpers
There is quite a lot of code required to compute cpu_mem_index,
or even put together the full TCGMemOpIdx. This can easily be
done at translation time.

Backports commit 500d04843ba953dc4560e44f04001efec38c14a6 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 606e8cdb8c
target/arm: Rewrite vector gather first-fault loads
This implements the feature for softmmu, and moves the
main loop out of a macro and into a function.

Backports commit 116347ce20bb7b5cac17bf2b0e6f607530b50862 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 1cd3c2a408
target/arm: Split contiguous stores for endianness
We can choose the endianness at translation time, rather than
re-computing it at execution time.

Backports commit 28d57f2dc59c287e1c40239509b0a325fd00e32f from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson c9569b3fe0
target/arm: Split contiguous loads for endianness
We can choose the endianness at translation time, rather than
re-computing it at execution time.

Backports commit 7d0a57a2e1cea188b9023261a404d7a211117230 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 2542ad17d0
target/arm: Rewrite vector gather stores
This fixes the endianness problem for softmmu, and moves
the main loop out of a macro and into an inlined function.

Backports commit 78cf1b886aa1b95c97fc5114641515c2892bb240 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson ff63807164
target/arm: Rewrite vector gather loads
This fixes the endianness problem for softmmu, and moves
the main loop out of a macro and into an inlined function.

Backports commit d4f75f25b43041e7a46d12352b3c70ae457d8cea from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 966ea163a3
target/arm: Rewrite helper_sve_st[1234]*_r
This fixes the endianness problem for softmmu, and moves the
main loop out of a macro and into an inlined function

Backports commit 9fd46c8362e0a45d04ccceae7051d06dd65c1d57 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 4978d77039
target/arm: Rewrite helper_sve_ld[234]*_r
Use the same *_tlb primitives as we use for ld1.

For linux-user, this hoists the set of helper_retaddr. For softmmu,
hoists the computation of the current mmu_idx outside the loop,
fixes the endianness problem, and moves the main loop out of a
macro and into an inlined function.

Backports commit f27d4dc2af0de9b7b45c955882b8420905c6efe8 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 5b88176e1d
target/arm: Rewrite helper_sve_ld1*_r using pages
Uses tlb_vaddr_to_host for correct operation with softmmu.
Optimize for accesses within a single page or pair of pages.

Backports commit 9123aeb6fcb14e0955ebe4e2a613802cfa0503ea from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 935eb43b5e
target/arm: Clear unused predicate bits for LD1RQ
The 16-byte load only uses 16 predicate bits. But while
reusing the other load infrastructure, we find other bits
that are set and trigger an assert. To avoid this and
retain the assert, zero-extend the predicate that we pass
to the LD1 helper.

Backports commit 2a99ab2b3545133961de034df27e24f4c22e3707 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson a37f24aa11
target/arm: Adjust aarch64_cpu_dump_state for system mode SVE
Use the existing helpers to determine if (1) the fpu is enabled,
(2) sve state is enabled, and (3) the current sve vector length.

Backports commit ced3155141755ba244c988c72c4bde32cc819670 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 87c20b52c0
target/arm: Handle SVE vector length changes in system mode
SVE vector length can change when changing EL, or when writing
to one of the ZCR_ELn registers.

For correctness, our implementation requires that predicate bits
that are inaccessible are never set. Which means noticing length
changes and zeroing the appropriate register bits.

Backports commit 0ab5953b00b3165877d00cf75de628c51670b550 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 2fb9c4c41d
target/arm: Pass in current_el to fp and sve_exception_el
We are going to want to determine whether sve is enabled
for EL other than current.

Backports commit 2de7ace292cf7846b0cda0e940272d2cb0e06859 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 00fc5d43fd
target/arm: Adjust sve_exception_el
Check for EL3 before testing CPTR_EL3.EZ. Return 0 when the exception
should be routed via AdvSIMDFPAccessTrap. Mirror the structure of
CheckSVEEnabled more closely.

Fixes: 5be5e8eda78

Backports commit 60eed0869d68b91eff71cc0a0facb01983726a5d from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 1081e5e7a4
target/arm: Define ID_AA64ZFR0_EL1
Given that the only field defined for this new register may only
be 0, we don't actually need to change anything except the name.

Backports commit 9516d7725ec1deaa6ef5ccc5a26d005650d6c524 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell d82046cafc
target/arm: Don't read r4 from v8M exception stackframe twice
A cut-and-paste error meant we were reading r4 from the v8M
callee-saves exception stack frame twice. This is harmless
since it just meant we did two memory accesses to the same
location, but it's unnecessary. Delete it.

Backports commit e5ae4d0c063fbcca4cbbd26bcefbf1760cfac2aa from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell f628cbdfc3
target/arm: Correct condition for v8M callee stack push
In v7m_exception_taken() we were incorrectly using a
"LR bit EXCRET.ES is 1" check when it should be 0
(compare the pseudocode ExceptionTaken() function).
This meant we didn't stack the callee-saved registers
when tailchaining from a NonSecure to a Secure exception.

Backports commit 7b73a1ca05b33d42278ce29cea4652e22d408165 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson e54a2b65c0
softfloat: Specialize udiv_qrnnd for ppc64
The ISA has a 128/64-bit division instruction, though it assumes the
low 64-bits of the numerator are 0, and so requires a bit more fixup
than a full 128-bit division insn.

Backports commit 27ae5109a2ba8b6b679cce3e03e16570a34390a0 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 0fd568871e
softfloat: Specialize udiv_qrnnd for s390x
The ISA has a 128/64-bit division instruction.

Backports commit 739df333dc8853ae6578492675a26a601d6be077 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 8de4da1475
softfloat: Specialize udiv_qrnnd for x86_64
The ISA has a 128/64-bit division instruction.

Backports commit b299e88d4261b0af30190e74005ad930e04f3a11 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 90fdf9b598
softfloat: Fix division
The __udiv_qrnnd primitive that we nicked from gmp requires its
inputs to be normalized. We were not doing that. Because the
inputs are nearly normalized already, finishing that is trivial.

Replace div128to64 with a "proper" udiv_qrnnd, so that this
remains a reusable primitive.

Fixes: cf07323d494
Fixes: https://bugs.launchpad.net/qemu/+bug/1793119

Backports commit 5dfbc9e4903c0121140f2945f05df48cea72dd82 from qemu
2018-10-08 14:15:15 -04:00
Thomas Huth bd116582e8
softfloat: Replace countLeadingZeros32/64 with clz32/64
Our minimum required compiler for compiling QEMU is GCC 4.1 these days,
so we can drop the support for compilers which do not provide the
__builtin_clz*() functions yet. Since the countLeadingZeros32/64 are
then identical to the clz32/64 functions, and we do not have to sync
the softloat 2 codebase with upstream anymore (softloat 3 is a complete
rewrite) we can simply replace the functions with our QEMU versions.

Backports commit 0019d5c3a18c31604fb55f9cec3ceb13999c4866 from qemu
2018-10-08 14:15:15 -04:00
Emilio G. Cota 9f08fb35bc
softfloat: remove float64_trunc_to_int
It has not had users since f83311e476 ("target-m68k: use floatx80
internally", 2017-06-21).

Note that no other bit-width has floatX_trunc_to_int.

Backports commit c953da8f0be5e026d1c9128660736d72294feb3e from qemu
2018-10-08 14:15:11 -04:00
Marc-André Lureau df8790284f
qom/object: register 'type' property as class property
Let's save a few byte in each object instance.

Backports commit 7439a036d58f0def85751d6d4d3232461a35ebee from qemu
2018-10-08 14:14:45 -04:00
Lioncash cc3d618e61
tcg: Remove unnecessary MSVC ifdef
All relevant arrays have at least one member in them now, making this
unnecessary.
2018-10-06 05:08:17 -04:00
Catena cyber 4199ce83bb
Removes accessible assert
Backports commit 333bfdf65e55bcf6e3b03526a50f8c43aa6d4ca5 from qemu
2018-10-06 05:02:20 -04:00
Catena cyber 2c9b6df879
Mips undefined shift fix
Backports commit 46999575fb9e82ccd925e835d0d7db47200e010d from unicorn
2018-10-06 05:00:27 -04:00
Catena cyber e3b8ea18bf
Prevents abort with m68K
* Prevents abort with m68K

Raises exception instead

* M68K remove one uses of abort

* Less aborts and logs instead for M68K

Backports commit 910999d3969b682d8376db1266f9885866cd785c from unicorn
2018-10-06 04:59:11 -04:00
Catena cyber 43c48b72ea
Initializes i386 prefix value
Backports commit 4a86318cf45b7f0b8e01748ce700de1b7688d1e3 from unicorn
2018-10-06 04:57:06 -04:00
Catena cyber 6bcc61f082
Sparc increase ttl number
Backports commit b8df0675145c592da3777395f23b4ee91c09b46c from unicorn
2018-10-06 04:55:52 -04:00
Lioncash b62e892b20
mips: Use DisasContext for parameters in place of TCGContext where applicable
This is more future-friendly with qemu's main repo, as it's more
generic.
2018-10-06 04:37:28 -04:00
Lioncash 47b45f1bc2
arm: Take DisasContext as a parameter instead of TCGContext where applicable
This is more future-friendly with qemu, as it's more generic.
2018-10-06 04:17:12 -04:00
Lioncash 766c70f608
arm: Move cpu_M0 to DisasContext 2018-10-06 03:32:39 -04:00
Lioncash 787fd448b1
arm: Move cpu_V1 to DisasContext 2018-10-06 03:28:42 -04:00
Lioncash 1aa20da917
arm: Move cpu_V0 to DisasContext 2018-10-06 03:26:52 -04:00
Lioncash 06c21baaa4
arm: Move cpu_F1d to DisasContext 2018-10-06 03:11:54 -04:00
Lioncash 5f3dd68f9c
arm: Move cpu_F0d to DisasContext 2018-10-06 03:07:42 -04:00
Lioncash e457ce8ccc
arm: Move cpu_F1s to DisasContext 2018-10-06 03:02:06 -04:00