Commit graph

66 commits

Author SHA1 Message Date
Peter Maydell e9d507a193
target/arm: Add assertion about FSC format for syndrome registers
In tlb_fill() we construct a syndrome register value from a
fault status register value which is filled in by arm_tlb_fill().
arm_tlb_fill() returns FSR values which might be in the format
used with short-format page descriptors, or the format used
with long-format (LPAE) descriptors. The syndrome register
always uses LPAE-format FSR status codes.

It isn't actually possible to end up delivering a syndrome
register value to the guest for a fault which is reported
with a short-format FSR (that kind of stage 1 fault will only
happen for an AArch32 translation regime which doesn't have
a syndrome register, and can never be redirected to an AArch64
or Hyp exception level). Add an assertion which checks this,
and adjust the code so that we construct a syndrome with
an invalid status code, rather than allowing set bits in
the FSR input to randomly corrupt other fields in the syndrome.

Backports commit 65ed2ed90d9d81fd4b639029be850ea5651f919f from qemu
2018-03-02 14:41:07 -05:00
Peter Maydell 1cf80d7536
arm: Move excnames[] array into arm_log_exceptions()
The excnames[] array is defined in internals.h because we used
to use it from two different source files for handling logging
of AArch32 and AArch64 exception entry. Refactoring means that
it's now used only in arm_log_exception() in helper.c, so move
the array into that function.

Backports commit 2c4a7cc5afb1bfc1728a39abd951ddd7714c476e from qemu
2018-03-02 14:39:37 -05:00
Peter Maydell 1af1944903
target/arm: Add missing entries to excnames[] for log strings
Recent changes have added new EXCP_ values to ARM but forgot
to update the excnames[] array which is used to provide
human-readable strings when printing information about the
exception for debug logging. Add the missing entries, and
add a comment to the list of #defines to help avoid the mistake
being repeated in future.

Backports commit 32b81e620ea562d56ab2733421b5da1082b237a2 from qemu
2018-03-02 14:38:23 -05:00
Richard Henderson 13242af398
target/arm: Fix aa64 ldp register writeback
For "ldp x0, x1, [x0]", if the second load is on a second page and
the second page is unmapped, the exception would be raised with x0
already modified. This means the instruction couldn't be restarted.

Backports commit 2d1bbf51c2cb948da4b6fd5f91cf3ecc80b28156 from qemu
2018-03-02 14:35:46 -05:00
Eduardo Habkost e71c7b7819
i386: Don't override -cpu options on -cpu host/max
The existing code for "host" and "max" CPU models overrides every
single feature in the CPU object at realize time, even the ones
that were explicitly enabled or disabled by the user using
"feat=on" or "feat=off", while features set using +feat/-feat are
kept.

This means "-cpu host,+invtsc" works as expected, while
"-cpu host,invtsc=on" doesn't.

This was a known bug, already documented in a comment inside
x86_cpu_expand_features(). What makes this bug worse now is that
libvirt 3.0.0 and newer now use "feat=on|off" instead of
+feat/-feat when it detects a QEMU version that supports it (see
libvirt commit d47db7b16dd5422c7e487c8c8ee5b181a2f9cd66).

Change the feature property getter/setter to set a
env->user_features field, to keep track of features that were
explicitly changed using QOM properties. Then make the
max_features code not override user features when handling "-cpu
host" and "-cpu max".

This will also allow us to remove the plus_features/minus_features
hack in the future, but I plan to do that after 2.9.0 is
released.

Backports commit d4a606b38b5d4b3689b86cc1575908e82179ecfb from qemu
2018-03-02 14:22:45 -05:00
Pranith Kumar 31b977ab3e
tcg/i386: Check the size of instruction being translated
This fixes the bug: 'user-to-root privesc inside VM via bad translation
caching' reported by Jann Horn here:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1122

Backports commit 30663fd26c0307e414622c7a8607fbc04f92ec14 from qemu
2018-03-02 14:19:35 -05:00
Yongbok Kim ce3aecf263
target/mips: fix delay slot detection in gen_msa_branch()
It is unnecessary to test R6 from delay/forbidden slot check
in gen_msa_branch().

https://bugs.launchpad.net/qemu/+bug/1663287

Backports commit 075a1fe788d36b271ec25507466c30b9a90b5d54 from qemu
2018-03-02 14:15:50 -05:00
Philippe Mathieu-Daudé d17c07b548
target-mips: replace break by goto cp0_unimplemented
this fixes many warnings like:

target/mips/translate.c:6253:13: warning: Value stored to 'rn' is never read
rn = "invalid sel";
^ ~~~~~~~~~~~~~

Backports commit 3570d7f6672836140f0a1ec9bf95dd5ea50a2aaa from qemu
2018-03-02 14:14:57 -05:00
Philippe Mathieu-Daudé 5f78f3cd80
target-mips: log bad coprocessor0 register accesses with LOG_UNIMP
Backports commit 965447eecb6b98d6dfc4dbd97f836093c7e398a0 from qemu
2018-03-02 14:12:29 -05:00
Philippe Mathieu-Daudé e7176e6c85
target-mips: remove old & unuseful comments
Backports commit 989f2aa9af7f05c323761b66c0e299059a19b7b1 from qemu
2018-03-02 14:11:20 -05:00
Philippe Mathieu-Daudé 65c69e6ccb
target-mips: fix compiler warnings (clang 5)
static code analyzer complain:

target/mips/helper.c:453:5: warning: Function call argument is an uninitialized value
qemu_log_mask(CPU_LOG_MMU,
^~~~~~~~~~~~~~~~~~~~~~~~~~

'physical' and 'prot' are uninitialized if 'ret' is not TLBRET_MATCH.

Backports commit def74c0cf05722b2e502d4b4f1219966c5b0cbd3 from qemu
2018-03-02 14:09:55 -05:00
Peter Maydell 78303d4c1b
arm: Fix APSR writes via M profile MSR
Our implementation of writes to the APSR for M-profile via the MSR
instruction was badly broken.

First and worst, we had the sense wrong on the test of bit 2 of the
SYSm field -- this is supposed to request an APSR write if bit 2 is 0
but we were doing it if bit 2 was 1. This bug was introduced in
commit 58117c9bb429cd, so hasn't been in a QEMU release.

Secondly, the choice of exactly which parts of APSR should be written
is defined by bits in the 'mask' field. We were not passing these
through from instruction decode, making it impossible to check them
in the helper.

Pass the mask bits through from the instruction decode to the helper
function and process them appropriately; fix the wrong sense of the
SYSm bit 2 check.

Invalid mask values and invalid combinations of mask and register
number are UNPREDICTABLE; we choose to treat them as if the mask
values were valid.

Backports commit b28b3377d7e9ba35611d454d5a63ef50cab1f8c5 from qemu
2018-03-02 14:08:13 -05:00
Peter Maydell bb5819cbbc
armv7m: R14 should reset to 0xffffffff
For M profile (unlike A profile) the reset value of R14 is specified
as 0xffffffff. (The rationale is that this is an illegal exception
return value, so if guest code tries to return to it it will result
in a helpful exception.)

Registers r0 to r12 and the flags are architecturally UNKNOWN on
reset, so we leave those at zero.

Backports commit 056f43df9168413f304500b69c33158d66efb7cf from qemu
2018-03-02 13:56:36 -05:00
Michael Davidsaver f42f22ec02
armv7m: FAULTMASK should be 0 on reset
For M profile CPUs, FAULTMASK should be 0 on reset, like PRIMASK.
QEMU stores FAULTMASK in the PSTATE F bit, so (as with PRIMASK in the
I bit) we have to clear these to undo the A profile default of 1.

Update the comment accordingly and move it so that it's closer to the
code it's referring to.

Backports commit dc7abe4d65ad39390b2db120f5ad18f8f6576f8b from qemu
2018-03-02 13:55:59 -05:00
Peter Maydell 8a6d746aef
armv7m: Report no-coprocessor faults correctly
For v7M attempts to access a nonexistent coprocessor are reported
differently from plain undefined instructions (as UsageFaults of type
NOCP rather than type UNDEFINSTR). Split them out into a new
EXCP_NOCP so we can report the FSR value correctly.

Backports commit 7517748e3f71a3099e57915fba95c4c308e6d842 from qemu
2018-03-02 13:54:36 -05:00
Peter Maydell fce8138187
armv7m: Report no-coprocessor faults correctly
For v7M attempts to access a nonexistent coprocessor are reported
differently from plain undefined instructions (as UsageFaults of type
NOCP rather than type UNDEFINSTR). Split them out into a new
EXCP_NOCP so we can report the FSR value correctly.

Backports commit 7517748e3f71a3099e57915fba95c4c308e6d842 from qemu
2018-03-02 13:47:14 -05:00
Michael Davidsaver eaa080e232
armv7m: set CFSR.UNDEFINSTR on undefined instructions
When we take an exception for an undefined instruction, set the
appropriate CFSR bit.

Backports commit 81dd9648c69bb89afdd6f4bb3ed6f3efdac96524 from qemu
2018-03-02 13:45:56 -05:00
Michael Davidsaver 2297b8134b
armv7m: honour CCR.STACKALIGN on exception entry
The CCR.STACKALIGN bit controls whether the CPU is supposed to force
8-alignment of the stack pointer on entry to the exception handler.

Backports commit dc858c6633a9af8b80c1509cf6f825e4390d3ad1 from qemu
2018-03-02 13:45:06 -05:00
Peter Maydell 7870bcfcb0
armv7m: add state for v7M CCR, CFSR, HFSR, DFSR, MMFAR, BFAR
Add the structure fields, VMState fields, reset code and macros for
the v7M system control registers CCR, CFSR, HFSR, DFSR, MMFAR and
BFAR.

Backports commit 2c4da50d9477fb830d778bb5d6a11215aa359b44 from qemu
2018-03-02 13:43:55 -05:00
Michael Davidsaver 7f044bf8cc
armv7m: Clear FAULTMASK on return from non-NMI exceptions
FAULTMASK must be cleared on return from all
exceptions other than NMI.

Backports commit a20ee6005564590d33eabec11ed4dc7c432db36b from qemu
2018-03-02 13:41:16 -05:00
Michael Davidsaver cc9458cf59
armv7m: Explicit error for bad vector table
Give an explicit error and abort when a load
from the vector table fails. Architecturally this
should HardFault (which will then immediately
fail to load the HardFault vector and go into Lockup).
Since we don't model Lockup, just report this guest
error via cpu_abort(). This is more helpful than the
previous behaviour of reading a zero, which is the
address of the reset stack pointer and not a sensible
location to jump to.

Backports commit 1b9ea408fca1ce8caae67b792355b023c69c5ac5 from qemu
2018-03-02 13:38:08 -05:00
Michael Davidsaver 703489071f
armv7m: Replace armv7m.hack with unassigned_access handler
For v7m we need to catch attempts to execute from special
addresses at 0xfffffff0 and above. Previously we did this
with the aid of a hacky special purpose lump of memory
in the address space and a check in translate.c for whether
we were translating code at those addresses.

We can implement this more cleanly using a CPU
unassigned access handler which throws the exception
if the unassigned access is for one of the special addresses.

Backports commit 542b3478a00cb7ef51c259255b3ab1e2a7daada2 from qemu
2018-03-02 13:33:31 -05:00
Michael Davidsaver 8828b4e595
armv7m: MRS/MSR: handle unprivileged access
The MRS and MSR instruction handling has a number of flaws:
* unprivileged accesses should only be able to read
CONTROL and the xPSR subfields, and only write APSR
(others RAZ/WI)
* privileged access should not be able to write xPSR
subfields other than APSR
* accesses to unimplemented registers should log as
guest errors, not abort QEMU

Backports commit 58117c9bb429cd9552d998687aa99088eb1d8528 from qemu
2018-03-02 13:29:59 -05:00
Michael Davidsaver 2769c6ada0
armv7m: Fix reads of CONTROL register bit 1
The v7m CONTROL register bit 1 is SPSEL, which indicates
the stack being used. We were storing this information
not in v7m.control but in the separate v7m.other_sp
structure field. Unfortunately, the code handling reads
of the CONTROL register didn't take account of this, and
so if SPSEL was updated by an exception entry or exit then
a subsequent guest read of CONTROL would get the wrong value.

Using a separate structure field doesn't really gain us
anything in efficiency, so drop this unnecessary complexity
in favour of simply storing all the bits in v7m.control.

This is a migration compatibility break for M profile
CPUs only.

Backports commit abc24d86cc0364f402e438fae3acb14289b40734 from qemu
2018-03-02 13:26:38 -05:00
Peter Maydell d8eb259032
arm: Enforce should-be-1 bits in MRS decoding
The MRS instruction requires that bits [19..16] are all 1s, and for
A/R profile also that bits [7..0] are all 0s. At this point in the
decode tree we have checked all of the rest of the instruction but
were allowing these to be any value. If these bits are not set then
the result is architecturally UNPREDICTABLE, but choosing to UNDEF is
more helpful to the user and avoids unexpected odd behaviour if the
encodings are used for some purpose in future architecture versions.

Backports commit 3d54026fb06d1aea7ebb4e9825970b06bebcacac from qemu
2018-03-02 13:09:17 -05:00
Peter Maydell dc44eded51
arm: Don't decode MRS(banked) or MSR(banked) for M profile
M profile doesn't have the MSR(banked) and MRS(banked) instructions
and uses the encodings for different kinds of M-profile MRS/MSR.
Guard the relevant bits of the decode logic to make sure we don't
accidentally fall into them by accident on M-profile.

(The bit being checked for this (bit 5) is part of the SYSm field on
M-profile, but since no currently allocated system registers have
encodings with bit 5 of SYSm set, this hasn't been a problem in
practice.)

Backports commit 43ac65742319ef5ac4461daf43316b189cd21e89 from qemu
2018-03-02 13:08:20 -05:00
Peter Maydell cc2a6a2728
arm: HVC and SMC encodings don't exist for M profile
M profile doesn't have the HVC or SMC encodings, so make them always
UNDEF rather than generating calls to helper functions that assume
A/R profile.

Backports commit 001b3cab51ebfcb13e8dd03ea25bfa3bd0c517a3 from qemu
2018-03-02 13:07:31 -05:00
Andrew Jones 0139cbc2cd
target/arm/arm-powerctl: Fix psci info return values
The power state spec section 5.1.5 AFFINITY_INFO defines the
affinity info return values as

0 ON
1 OFF
2 ON_PENDING

I grepped QEMU for power_state to ensure that no assumptions
of OFF=0 were being made.

Backports commit d5affb0d8677e1a8a8fe03fa25005b669e7cdc02 from qemu
2018-03-02 12:59:49 -05:00
Andrew Baumann 76cd64dd7e
target/arm: implement armv8 PMUSERENR (user-mode enable bits)
In armv8, this register implements more than a single bit, with
fine-grained enables for read access to event counters, cycles
counters, and write access to the software increment. This change
implements those checks using custom access functions for the relevant
registers.

Backports commit 6ecd0b6ba0591ef280ed984103924d4bdca5ac32 from qemu
2018-03-02 12:55:46 -05:00
Eduardo Habkost 9ddce7c01d
i386: Change stepping of Haswell to non-blacklisted value
glibc blacklists TSX on Haswell CPUs with model==60 and
stepping < 4. To make the Haswell CPU model more useful, make
those guests actually use TSX by changing CPU stepping to 4.

References:
* glibc commit 2702856bf45c82cf8e69f2064f5aa15c0ceb6359
https://sourceware.org/git/?p=glibc.git;a=commit;h=2702856bf45c82cf8e69f2064f5aa15c0ceb6359

Backports commit ec56a4a7b07e2943f49da273a31e3195083b1f2e from qemu
2018-03-02 12:53:11 -05:00
Eduardo Habkost f865b17639
i386: host_vendor_fms() helper function
Helper function for code that needs to check the host CPU
vendor/family/model/stepping values.

Backports commit 20271d484069f154fb262507e63adc3a37e885d2 from qemu
2018-03-02 12:51:44 -05:00
Alex Bennée b8caaac110
target/arm/helper: make it clear the EC field is also in hex
..just like the rest of the displayed ESR register. Otherwise people
might scratch their heads if a not obviously hex number is displayed
for the EC field.

Backports commit 6568da459b611845ef55526cd23afc9fa9f4647f from qemu
2018-03-02 12:50:33 -05:00
Paolo Bonzini bc7a9ccfbd
target-i386: defer VMEXIT to do_interrupt
Paths through the softmmu code during code generation now need to be audited
to check for double locking of tb_lock. In particular, VMEXIT can take tb_lock
through cpu_vmexit -> cpu_x86_update_cr4 -> tlb_flush.

To avoid this, split VMEXIT delivery in two parts, similar to what is done with
exceptions. cpu_vmexit only records the VMEXIT exit code and information, and
cc->do_interrupt can then deliver it when it is safe to take the lock.

Backports commit 10cde894b63146139f981857e4eedf756fa53dcb from qemu
2018-03-02 12:49:18 -05:00
Alex Bennée a01496e6d9
target/i386/cpu.h: declare TCG_GUEST_DEFAULT_MO
This suppresses the incorrect warning when forcing MTTCG for x86
guests on x86 hosts. A future patch will still warn when
TARGET_SUPPORT_MTTCG hasn't been defined for the guest (which is still
pending for x86).

Backports commit 72c1701f62e8d44eb24a0583a958edc280105455 from qemu
2018-03-02 12:43:37 -05:00
Eduardo Habkost 33ab5f71c9
i386: Reorganize and document CPUID initialization steps
CPU runnability checks and CPU model expansion have slightly
different requirements. Document the steps involved in loading a
CPU model and realizing a CPU, so their requirements and purpose
are clearly defined.

This patch doesn't change any implementation. It just add
comments, rename the x86_cpu_load_features() function for clarity
(so it won't be confused with x86_cpu_load_def()), and move
x86_cpu_filter_features() closer to it.

Backports commit b8d834a00fa3ed4dad7d371e1a00938a126a54a0 from qemu
2018-03-02 10:55:00 -05:00
Eduardo Habkost be606acff9
i386: Rename X86CPU::host_features to X86CPU::max_features
Rename the field and add a small comment to make its purpose
clearer.

Backports commit 44bd8e530661be1d22ae0f461a5c9bdbcc3847ec from qemu
2018-03-02 10:51:40 -05:00
Nick Reilly 4114fb2c0e
Add missing fp_access_check() to aarch64 crypto instructions
The aarch64 crypto instructions for AES and SHA are missing the
check for if the FPU is enabled.

Backports commit a4f5c5b72380deeccd53a6890ea3782f10ca8054 from qemu
2018-03-02 10:39:16 -05:00
Alex Bennée caba238b5a
tcg: enable MTTCG by default for ARM on x86 hosts
This enables the multi-threaded system emulation by default for ARMv7
and ARMv8 guests using the x86_64 TCG backend. This is because on the
guest side:

- The ARM translate.c/translate-64.c have been converted to
- use MTTCG safe atomic primitives
- emit the appropriate barrier ops
- The ARM machine has been updated to
- hold the BQL when modifying shared cross-vCPU state
- defer powerctl changes to async safe work

All the host backends support the barrier and atomic primitives but
need to provide same-or-better support for normal load/store
operations.

Backports commit ca759f9e387db87e1719911f019bc60c74be9ed8 from qemu
2018-03-02 10:32:47 -05:00
Alex Bennée ff0ff28939
target-arm: don't generate WFE/YIELD calls for MTTCG
The WFE and YIELD instructions are really only hints and in TCG's case
they were useful to move the scheduling on from one vCPU to the next. In
the parallel context (MTTCG) this just causes an unnecessary cpu_exit
and contention of the BQL.

Backports commit c22edfebff29f63d793032e4fbd42a035bb73e27 from qemu
2018-03-02 10:27:36 -05:00
Alex Bennée 454932263c
cputlb and arm/sparc targets: convert mmuidx flushes from varg to bitmap
While the vargs approach was flexible the original MTTCG ended up
having munge the bits to a bitmap so the data could be used in
deferred work helpers. Instead of hiding that in cputlb we push the
change to the API to make it take a bitmap of MMU indexes instead.

For ARM some the resulting flushes end up being quite long so to aid
readability I've tended to move the index shifting to a new line so
all the bits being or-ed together line up nicely, for example:

tlb_flush_page_by_mmuidx(other_cs, pageaddr,
(1 << ARMMMUIdx_S1SE1) |
(1 << ARMMMUIdx_S1SE0));

Backports commit 0336cbf8532935d8e23c2aabf3e2ce2c0697b6ac from qemu
2018-03-02 10:12:40 -05:00
Markus Armbruster 89d8e58718
util/cutils: Change qemu_strtosz*() from int64_t to uint64_t
This will permit its use in parse_option_size().

Backports commit f46bfdbfc8f95cf65d7818ef68a801e063c40332 from qemu
2018-03-02 08:58:55 -05:00
Markus Armbruster 8650d0213c
util/cutils: Return qemu_strtosz*() error and value separately
This makes qemu_strtosz(), qemu_strtosz_mebi() and
qemu_strtosz_metric() similar to qemu_strtoi64(), except negative
values are rejected.

Backports commit f17fd4fdf0df3d2f3444399d04c38d22b9a3e1b7 from qemu
2018-03-02 08:57:16 -05:00
Markus Armbruster 6093e67947
util/cutils: Let qemu_strtosz*() optionally reject trailing crap
Change the qemu_strtosz() & friends to return -EINVAL when @endptr is
null and the conversion doesn't consume the string completely.
Matches how qemu_strtol() & friends work.

Only test_qemu_strtosz_simple() passes a null @endptr. No functional
change there, because its conversion consumes the string.

Simplify callers that use @endptr only to fail when it doesn't point
to '\0' to pass a null @endptr instead.

Backports commit 4fcdf65ae2c00ae69f7625f26ed41f37d77b403c from qemu
2018-03-02 08:54:53 -05:00
Markus Armbruster f656cd91ec
util/cutils: New qemu_strtosz_metric()
To parse numbers with metric suffixes, we use

qemu_strtosz_suffix_unit(nptr, &eptr, QEMU_STRTOSZ_DEFSUFFIX_B, 1000)

Capture this in a new function for legibility:

qemu_strtosz_metric(nptr, &eptr)

Replace test_qemu_strtosz_suffix_unit() by test_qemu_strtosz_metric().

Rename qemu_strtosz_suffix_unit() to do_strtosz() and give it internal
linkage.

Backports commit d2734d2629266006b0413433778474d5801c60be from qemu
2018-03-02 08:47:40 -05:00
Paul Burton 411ddd16cf
target-mips: Provide function to test if a CPU supports an ISA
Provide a new cpu_supports_isa function which allows callers to
determine whether a CPU supports one of the ISA_ flags, by testing
whether the associated struct mips_def_t sets the ISA flags in its
insn_flags field.

An example use of this is to allow boards which generate bootloader code
to determine the properties of the CPU that will be used, for example
whether the CPU is 64 bit or which architecture revision it implements.

Backports commit bed9e5ceb158c886d548fe59675a6eba18baeaeb from qemu
2018-03-02 08:20:19 -05:00
Wei Huang c9bdf5e6c7
target-arm: Enable vPMU support under TCG mode
This patch contains several fixes to enable vPMU under TCG mode. It
first removes the checking of kvm_enabled() while unsetting
ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU
under TCG mode. Secondly the PMU node of DT table is now created under TCG.
The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1.

Backports commit d6f02ce3b8a43ddd8f83553fe754a34b26fb273f from qemu
2018-03-02 07:58:48 -05:00
Wei Huang 5e3349a818
target-arm: Add support for PMU register PMINTENSET_EL1
This patch adds access support for PMINTENSET_EL1.

Backports commit e6ec54571e424bb1d6e50e32fe317c616cde3e05 from qemu
2018-03-02 07:57:40 -05:00
Wei Huang 3b34b7f0f9
target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0
In order to support Linux perf, which uses PMXEVTYPER register,
this patch adds read/write access support for PMXEVTYPER. The access
is CONSTRAINED UNPREDICTABLE when PMSELR is not 0x1f. Additionally
this patch adds support for PMXEVTYPER_EL0.

Backports commit fdb8665672ded05f650d18f8b62d5c8524b4385b from qemu
2018-03-02 07:53:05 -05:00
Wei Huang 1165020022
target-arm: Add support for PMU register PMSELR_EL0
This patch adds support for AArch64 register PMSELR_EL0. The existing
PMSELR definition is revised accordingly.

Backports commit 6b0407805d46bbeba70f4be426285d0a0e669750 from qemu
2018-03-02 07:39:43 -05:00
Peter Maydell bddeac4430
target/arm: A32, T32: Create Instruction Syndromes for Data Aborts
Add support for generating the ISS (Instruction Specific Syndrome)
for Data Abort exceptions taken from AArch32. These syndromes are
used by hypervisors for example to trap and emulate memory accesses.

This is the equivalent for AArch32 guests of the work done for AArch64
guests in commit aaa1f954d4cab243.

Backports commit 9bb6558a218bf7e466e5ac1100639517d8a30d33 from qemu
2018-03-02 00:37:06 -05:00