Commit graph

4956 commits

Author SHA1 Message Date
Richard Henderson ee0d8aff72
softfloat: Add scaling int-to-float routines
Backports commit 2abdfe24402907e7e8c103bdd4166f26b74200c2 from qemu
2018-08-25 03:47:12 -04:00
Paolo Bonzini 85303e3caf
target/i386: update MPX flags when CPL changes
Backports commit 5e76d84e690954d79af357fafb1903113a00b32e from qemu
2018-08-25 03:32:22 -04:00
Andrew Oates e4b66a0ef3
target-i386: fix segment limit check in ljmp
The current implementation has three bugs,
* segment limits are not enforced in protected mode if the L bit is set
in the target segment descriptor
* segment limits are not enforced in compatibility mode (ljmp to 32-bit
code segment in long mode)
* #GP(new_cs) is generated rather than #GP(0)

Now the segment limits are enforced if we're not in long mode OR the
target code segment doesn't have the L bit set.

Backports commit db7196db5d5d932f388643baae6835f8dcda6921 from qemu
2018-08-25 03:30:55 -04:00
Andrew Oates efa10a2286
target-i386: Fix lcall/ljmp to call gate in IA-32e mode
Currently call gates are always treated as 32-bit gates. In IA-32e mode
(either compatibility or 64-bit submode), system segment descriptors are
always 64-bit. Treating them as 32-bit has the expected unfortunate
effect: only the lower 32 bits of the offset are loaded, the stack
pointer is truncated, a bad new stack pointer is loaded from the TSS (if
switching privilege levels), etc.

This change adds support for 64-bit call gate to the lcall and ljmp
instructions. Additionally, there should be a check for non-canonical
stack pointers, but I've omitted that since there doesn't seem to be
checks for non-canonical addresses in this code elsewhere.

I've left the raise_exception_err_ra lines unwapped at 80 columns to
match the style in the rest of the file.

Backports commit 0aca060526d3ff9632aaed66e8611814580c13de from qemu
2018-08-25 03:30:13 -04:00
Junyan He 6ead2c3d1f
memory, exec: Expose all memory block related flags.
We need to use these flags in other files rather than just in exec.c,
For example, RAM_SHARED should be used when create a ram block from file.
We expose them the exec/memory.h

Backports commit b0e5de93811077254a536c23b713b49e12efb742 from qemu
2018-08-22 13:00:05 -04:00
Peter Maydell 214dadf7e7
target/arm: Implement AArch32 ERET instruction
ARMv7VE introduced the ERET instruction, which is necessary to
return from an exception taken to Hyp mode. Implement this.
In A32 encoding it is a completely new encoding; in T32 it
is an adjustment of the behaviour of the existing
"SUBS PC, LR, #<imm8>" instruction.

Backports commit 55c544ed2709bd202e71e77ddfe3ea0327852211 from qemu
2018-08-22 12:56:14 -04:00
Peter Maydell 8c41572624
target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)
The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp
from either Monitor or Hyp mode. Our translate time check
was overly strict and only permitted access from Monitor mode.

The runtime check we do in msr_mrs_banked_exc_checks() had the
correct code in it, but never got there because of the earlier
"currmode == tgtmode" check. Special case ELR_Hyp.

Backports commit aec4dd09f172ee64c19222b78269d5952fd9c1dc from qemu
2018-08-22 12:51:42 -04:00
Peter Maydell 858aa2d094
target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2
The AArch32 HSR is the equivalent of AArch64 ESR_EL2;
we can implement it by marking our existing ESR_EL2 regdef
as STATE_BOTH. It also needs to be "RES0 from EL3 if
EL2 not implemented", so add the missing stanza to
el3_no_el2_cp_reginfo.

Backports commit 68e78e332cb1c3f8b0317a0443acb2b5e190f0dd from qemu
2018-08-22 12:48:35 -04:00
Peter Maydell c21d2062e4
target/arm: Implement AArch32 Hyp FARs
The AArch32 virtualization extensions support these fault address
registers:
* HDFAR: aliased with AArch64 FAR_EL2[31:0] and AArch32 DFAR(S)
* HIFAR: aliased with AArch64 FAR_EL2[63:32] and AArch32 IFAR(S)

Implement the accessors for these. This fixes in passing a bug
where we weren't implementing the "RES0 from EL3 if EL2 not
implemented" behaviour for AArch64 FAR_EL2.

Backports commit cba517c31e7df8932c4473c477a0f01d8a0adc48 from qemu
2018-08-22 12:45:23 -04:00
Peter Maydell 763a71a962
target/arm: Implement AArch32 HVBAR
Implement the AArch32 HVBAR register; we can do this just by
making the existing VBAR_EL2 regdefs be STATE_BOTH.

Backports commit d79e0c0608899428281a17c414ccf1a82d86ab85 from qemu
2018-08-22 12:37:12 -04:00
Peter Maydell e9fb085aa1
target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs
ARMCPRegInfo structs will default to .cp = 15 if they
are ARM_CP_STATE_BOTH, but not if they are ARM_CP_STATE_AA32
(because a coprocessor number of 0 is valid for AArch32).
We forgot to explicitly set .cp = 15 for the HMAIR1 and
HAMAIR1 regdefs, which meant they would UNDEF when the guest
tried to access them under cp15.

Backports commit b5ede85bfb7ba1a8f6086494c82f400b29969f65 from qemu
2018-08-22 12:36:11 -04:00
Peter Maydell 2d2c6982ce
target/arm: Correct typo in HAMAIR1 regdef name
We implement the HAMAIR1 register as RAZ/WI; we had a typo in the
regdef, though, and were incorrectly naming it HMAIR1 (which is
a different register which we also implement as RAZ/WI).

Backports commit 55b53c718b2f684793eeefcf1c1a548ee97e23aa from qemu
2018-08-22 12:33:45 -04:00
Roman Kapl 0e2dc93e5f
target/arm: Fix crash on conditional instruction in an IT block
If an instruction is conditional (like CBZ) and it is executed
conditionally (using the ITx instruction), a jump to an undefined
label is generated, and QEMU crashes.

CBZ in IT block is an UNPREDICTABLE behavior, but we should not
crash. Honouring the condition code is allowed by the spec in this
case (constrained unpredictable, ARMv8, section K1.1.7), and matches
what we do for other "UNPREDICTABLE inside an IT block" instructions.

Fix the 'skip on condition' code to create a new label only if it
does not already exist. Previously multiple labels were created, but
only the last one of them was set.

Backports commit c2d9644e6d517170bf6520f633628259a8460d48 from qemu
2018-08-22 12:27:45 -04:00
Eduardo Habkost f4879ae89f
i386: Disable TOPOEXT by default on "-cpu host"
Enabling TOPOEXT is always allowed, but it can't be enabled
blindly by "-cpu host" because it may make guests crash if the
rest of the cache topology information isn't provided or isn't
consistent.

This addresses the bug reported at:
https://bugzilla.redhat.com/show_bug.cgi?id=1613277

Backports commit 7210a02c58572b2686a3a8d610c6628f87864aed from qemu
2018-08-17 14:34:02 -04:00
Wanpeng Li 1f85fbc4d6
target-i386: adds PV_SEND_IPI CPUID feature bit
Adds PV_SEND_IPI CPUID feature bit.

Backports commit 7f710c32bb893c68b931c68265f0427c032eb7f4 from qemu
2018-08-17 14:30:57 -04:00
Robert Hoo 5e97271942
i386: Add new CPU model Icelake-{Server,Client}
New CPU models mostly inherit features from ancestor Skylake, while addin new
features: UMIP, New Instructions ( PCONIFIG (server only), WBNOINVD,
AVX512_VBMI2, GFNI, AVX512_VNNI, VPCLMULQDQ, VAES, AVX512_BITALG),
Intel PT and 5-level paging (Server only). As well as
IA32_PRED_CMD, SSBD support for speculative execution
side channel mitigations.

Note:
For 5-level paging, Guest physical address width can be configured, with
parameter "phys-bits". Unless explicitly specified, we still use its default
value, even for Icelake-Server cpu model.
At present, hold on expose IA32_ARCH_CAPABILITIES to guest, as 1) This MSR
actually presents more than 1 'feature', maintainers are considering expanding current
features presentation of only CPUIDs to MSR bits; 2) a reasonable default value
for MSR_IA32_ARCH_CAPABILITIES needs to settled first. These 2 are actully
beyond Icelake CPU model itself but fundamental. So split these work apart
and do it later.
https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00774.html
https://lists.gnu.org/archive/html/qemu-devel/2018-07/msg00796.html

Backports commit 8a11c62da9146dd89aee98947e6bd831e65a970d from qemu
2018-08-17 14:30:13 -04:00
Robert Hoo 0e16ff259b
i386: Add CPUID bit for WBNOINVD
WBNOINVD: Write back and do not invalidate cache, enumerated by
CPUID.(EAX=80000008H, ECX=0):EBX[bit 9].

Backports commit 59a80a19ca31a6fff9fdbb6b4cf55a5a0767c3bc from qemu
2018-08-17 14:29:10 -04:00
Robert Hoo 8b59666ae6
i386: Add CPUID bit for PCONFIG
PCONFIG: Platform configuration, enumerated by CPUID.(EAX=07H, ECX=0):
EDX[bit18].

Backports commit 5131dc433df54b37e8e918d8fba7fe10344e7a7b from qemu
2018-08-17 14:28:11 -04:00
Robert Hoo 44e0a97e0b
i386: Add CPUID bit and feature words for IA32_ARCH_CAPABILITIES MSR
Support of IA32_PRED_CMD MSR already be enumerated by same CPUID bit as
SPEC_CTRL.

At present, mark CPUID_7_0_EDX_ARCH_CAPABILITIES unmigratable, per Paolo's
comment.

Backports commit 3fc7c73139d2d38ae80c3b0bc963b1ac1555924c from qemu
2018-08-17 14:27:28 -04:00
Robert Hoo b3fccc4841
i386: Add new MSR indices for IA32_PRED_CMD and IA32_ARCH_CAPABILITIES
IA32_PRED_CMD MSR gives software a way to issue commands that affect the state
of indirect branch predictors. Enumerated by CPUID.(EAX=7H,ECX=0):EDX[26].
IA32_ARCH_CAPABILITIES MSR enumerates architectural features of RDCL_NO and
IBRS_ALL. Enumerated by CPUID.(EAX=07H, ECX=0):EDX[29].

https://software.intel.com/sites/default/files/managed/c5/63/336996-Speculative-Execution-Side-Channel-Mitigations.pdf

Backports commit 8c80c99fcceabd0708a5a83f08577e778c9419f5 from qemu
2018-08-17 14:26:10 -04:00
Yongbok Kim eb775926fd
target/mips: Check ELPA flag only in some cases of MFHC0 and MTHC0
MFHC0 and MTHC0 used to handle EntryLo0 and EntryLo1 registers only,
and placing ELPA flag checks before switch statement were technically
correct. However, after adding handling more registers, these checks
should be moved to act only in cases of handling EntryLo0 and
EntryLo1.

Backports commit 59488dda1f16c0259bc2610d8d71686ef436c649 from qemu
2018-08-17 14:25:22 -04:00
Yongbok Kim 9be6d4c6d2
target/mips: Don't update BadVAddr register in Debug Mode
BadVAddr should not be updated if (env->hflags & MIPS_HFLAG_DM) is
set.

Backports commit e807bcc1513f2d79c992a08b252fa32e69c6e8b2 from qemu
2018-08-17 14:24:19 -04:00
Stefan Markovic dbebd7f27f
target/mips: Implement CP0 Config1.WR bit functionality
Add testing Config1.WR bit into watch exception handling logic.

Backports commit fa192d4974de3ace960d03803ab9d2f09abd9282 from qemu
2018-08-17 14:23:35 -04:00
Stefan Markovic 4b6a9ce61b
target/mips: Add CP0 BadInstrX register
Add CP0 BadInstrX register. This register will be used in nanoMIPS.

Backports commit 25beba9bf76a677747b779e997c6540677a38311 from qemu
2018-08-17 14:22:02 -04:00
Aleksandar Markovic d70a2c1df1
target/mips: Update some CP0 registers bit definitions
Update CP0 registers Config0, Config1, Config2, Config3,
Config4, and Config5 bit definitions.

Some of these bits will be utilized by upcoming nanoMIPS changes.

Backports commit 0413d7a55a8161ebd33541ba1df4285bf180c583 from qemu
2018-08-17 14:21:18 -04:00
Aleksandar Markovic af31bc3982
target/mips: Fix two instances of shadow variables
Fix two instances of shadow variables. This cleans up entire file
translate.c from shadow variables.

Backports commit e1555d7ddf2c86fb92165e47eb092f1f5fa9e8bd from qemu
2018-08-17 14:18:38 -04:00
Aleksandar Markovic 0fd3ae0efb
target/mips: Mark switch fallthroughs with interpretable comments
Mark switch fallthroughs with comments, in cases fallthroughs
are intentional.

The comments "/* fall through */" are interpreted by compilers and
other tools, and they will not issue warnings in such cases. For gcc,
the warning is turnend on by -Wimplicit-fallthrough. With this patch,
there will be no such warnings in target/mips directory. If such
warning appears in future, it should be checked if it is intentional,
and, if yes, marked with a comment similar to those from this patch.

The comment must be just before next "case", otherwise gcc won't
understand it.

Backports commit 146dd620db815558938433eb9f57a571d424d2c6 from qemu
2018-08-17 14:17:45 -04:00
Aleksandar Rikalo 0f118a005b
target/mips: Avoid case statements formulated by ranges - part 2
Remove "range style" case statements to make code analysis easier.
This patch handles cases when the values in the range in question
were not properly defined.

Backports commit c38a1d52233c85976eeed99c9015e881de8cd68e from qemu
2018-08-17 14:16:40 -04:00
Aleksandar Markovic 0259ce5b6d
target/mips: Avoid case statements formulated by ranges - part 1
Remove "range style" case statements to make code analysis easier.

This is needed also for some upcoming nanoMIPS-related refactorings.

Backports commit c2e19f3c2b1a1bb5f4fc3c55ee8cfa28dde9b810 from qemu
2018-08-17 14:14:11 -04:00
Richard Henderson a456920fd7
softfloat: Fix missing inexact for floating-point add
For 0x1.0000000000003p+0 + 0x1.ffffffep+14 = 0x1.0001fffp+15
we dropped the sticky bit and so failed to raise inexact.

Backports commit 64d450a0eaad5f02f9d6bba1dd451446297bb4dc from qemu
2018-08-17 14:06:55 -04:00
Richard Henderson 0136ca773f
target/arm: Fix aa64 FCADD and FCMLA decode
These insns require u=1; failed to include that in the switch
cases. This probably happened during one of the rebases just
before final commit.

Fixes: d17b7cdcf4e

Backports commit b8a4a96db3639e17ab5e5cdc14fca4b19fbf5b3b from qemu
2018-08-17 14:06:01 -04:00
Richard Henderson c387d51c1d
target/arm: Use FZ not FZ16 for SVE FCVT single-half and double-half
We were using the wrong flush-to-zero bit for the non-half input.

Fixes: 46d33d1e3c9

Backports commit e4ab5124a5c2e2291006b24bdc21c3dd8d087ff4 from qemu
2018-08-17 14:05:10 -04:00
Richard Henderson 118495f4b1
target/arm: Use fp_status_fp16 for do_fmpa_zpzzz_h
This makes float16_muladd correctly use FZ16 not FZ.

Fixes: 6ceabaad110

Backports commit 52a339b11d1719a6589de40606859939875fda9a from qemu
2018-08-17 14:04:20 -04:00
Richard Henderson 15a68a354c
target/arm: Ignore float_flag_input_denormal from fp_status_f16
When FZ is set, input_denormal exceptions are recognized, but this does
not happen with FZ16. The softfloat code has no way to distinguish
these bits and will raise such exceptions into fp_status_f16.flags,
so ignore them when computing the accumulated flags.

Backports commit 19062c169e5bcdda3d60df9161228e107bf0f96e from qemu
2018-08-17 14:03:41 -04:00
Richard Henderson f787dd15fd
target/arm: Adjust FPCR_MASK for FZ16
When support for FZ16 was added, we failed to include the bit
within FPCR_MASK, which means that it could never be set.
Continue to zero FZ16 when ARMv8.2-FP16 is not enabled.

Fixes: d81ce0ef2c4

Backports commit 0b62159be33d45d00dfa34a317c6d3da30ffb480 from qemu
2018-08-17 14:02:49 -04:00
Stefan Hajnoczi d2f3a6c0d5
target/arm: add cortex-m0 CPU model
Define a "cortex-m0" ARMv6-M CPU model.

Most of the register reset values set by other CPU models are not
relevant for the cut-down ARMv6-M architecture.

Backports commit 191776b96a381b5d2b8d3f90c1c02b3e4779e5f7 from qemu
2018-08-17 14:01:00 -04:00
Richard Henderson cb11b3a6bd
target/arm: Add sve-max-vq cpu property to -cpu max
This allows the default (and maximum) vector length to be set
from the command-line. Which is extraordinarily helpful in
debugging problems depending on vector length without having to
bake knowledge of PR_SET_SVE_VL into every guest binary.

Backports relevant parts of commit
adf92eab90e3f5f34c285da6d14d48952b7a8e72 from qemu
2018-08-17 13:57:51 -04:00
Richard Henderson 1d3cf8a0b0
target/arm: Dump SVE state if enabled
Also fold the FPCR/FPSR state onto the same line as PSTATE,
and mention but do not dump disabled FPU state.

Backports commit 2bf5f3f91bb4e3faa2a19aec042138a938afbf6a from qemu
2018-08-17 13:52:28 -04:00
Richard Henderson 731bcd194b
target/arm: Fix offset scaling for LD_zprr and ST_zprr
The scaling should be solely on the memory operation size; the number
of registers being loaded does not come in to the initial computation.

Backports commit 50ef1cbf31caad21019ae6fa8036ed6f29244ba5 from qemu
2018-08-17 13:50:59 -04:00
Richard Henderson 86d6bb4d43
target/arm: Fix offset for LD1R instructions
The immediate should be scaled by the size of the memory reference,
not the size of the elements into which it is loaded.

Backports commit d0e372b0298f897993f831dbff7ad4f1c70f138e from qemu
2018-08-17 13:49:39 -04:00
Richard Henderson 7487c66bee
target/arm: Fix sign-extension in sve do_ldr/do_str
The expression (int) imm + (uint32_t) len_align turns into uint32_t
and thus with negative imm produces a memory operation at the wrong
offset. None of the numbers involved are particularly large, so
change everything to use int.

Backports commit 19f2acc915a0f8f443a959844540a6f09133cc96 from qemu
2018-08-17 13:48:44 -04:00
Richard Henderson 1ca7c30fbb
target/arm: Fix typo in helper_sve_ld1hss_r
Backports commit 573ec0fe40b9a412085ac7dfb41975a0fc2b28dd from qemu
2018-08-17 13:47:38 -04:00
Markus Armbruster f257623b9f
qapi: Fix some pycodestyle-3 complaints
Fix the following issues:

common.py:873:13: E129 visually indented line with same indent as next logical line
common.py:1766:5: E741 ambiguous variable name 'l'
common.py:1784:1: E305 expected 2 blank lines after class or function definition, found 1
common.py:1833:1: E305 expected 2 blank lines after class or function definition, found 1
common.py:1843:1: E305 expected 2 blank lines after class or function definition, found 1
visit.py:181:18: E127 continuation line over-indented for visual indent

Backports commit b736e25a1820c63f7d69baa03e624cef80c4de90 from qemu
2018-08-16 07:14:40 -04:00
Richard Henderson e2e7bb0e21
target/arm: Fix typo in helper_sve_movz_d
Backports commit 054e7adf4e64e4acb3b033348ebf7cc871baa34f from qemu
2018-08-16 07:12:18 -04:00
Lioncash 9a2581aff6
Comment out tailchaining code
Allows build to continue.
2018-08-16 07:11:31 -04:00
Richard Henderson f26356b930
target/arm: Reorganize SVE WHILE
The pseudocode for this operation is an increment + compare loop,
so comparing <= the maximum integer produces an all-true predicate.

Rather than bound in both the inline code and the helper, pass the
helper the number of predicate bits to set instead of the number
of predicate elements to set.

Backports commit bbd0968c458d48e34a08b8694fa3309a9fe1c9e7 from qemu
2018-08-16 07:09:33 -04:00
Lioncash eccda3afcc
target/arm: Fix typo in do_sat_addsub_64
Used the wrong temporary in the computation of subtractive overflow.

Backports commit 7a31e0c6c68baffab0867bdd92b8744568b1d3ba from qemu
2018-08-16 07:06:05 -04:00
Richard Henderson 46fd2c485a
target/arm: Fix sign of sve_cmpeq_ppzw/sve_cmpne_ppzw
The normal vector element is sign-extended before
comparing with the wide vector element.

Backports commit df4e001093988544d09887122ae824f18ba55c68 from qemu
2018-08-16 07:04:52 -04:00
Peter Maydell 8d34a271f6
target/arm: Implement tailchaining for M profile cores
Tailchaining is an optimization in handling of exception return
for M-profile cores: if we are about to pop the exception stack
for an exception return, but there is a pending exception which
is higher priority than the priority we are returning to, then
instead of unstacking and then immediately taking the exception
and stacking registers again, we can chain to the pending
exception without unstacking and stacking.

For v6M and v7M it is IMPDEF whether tailchaining happens for pending
exceptions; for v8M this is architecturally required. Implement it
in QEMU for all M-profile cores, since in practice v6M and v7M
hardware implementations generally do have it.

(We were already doing tailchaining for derived exceptions which
happened during exception return, like the validity checks and
stack access failures; these have always been required to be
tailchained for all versions of the architecture.)

Backports commit 5f62d3b9e67bfc3deb970e3c7fb7df7e57d46fc3 from qemu
2018-08-16 07:03:51 -04:00
Peter Maydell e3be0c4aa6
target/arm: Restore M-profile CONTROL.SPSEL before any tailchaining
On exception return for M-profile, we must restore the CONTROL.SPSEL
bit from the EXCRET value before we do any kind of tailchaining,
including for the derived exceptions on integrity check failures.
Otherwise we will give the guest an incorrect EXCRET.SPSEL value on
exception entry for the tailchained exception.

Backports commit 89b1fec193b81b6ad0bd2975f2fa179980cc722e from qemu
2018-08-16 06:58:34 -04:00