Commit graph

586 commits

Author SHA1 Message Date
Peter Maydell ef9afb1855
target/arm: Add v8M stack checks for T32 load/store single
Add v8M stack checks for the instructions in the T32
"load/store single" encoding class: these are the
"immediate pre-indexed" and "immediate, post-indexed"
LDR and STR instructions.

Backports commit 0bc003bad9752afc61624cb680226c922f34f82c from qemu
2018-10-08 14:20:58 -04:00
Peter Maydell de30651f5e
target/arm: Add v8M stack checks for Thumb2 LDM/STM
Add the v8M stack checks for:
* LDM (T2 encoding)
* STM (T2 encoding)

This includes the 32-bit encodings of the instructions listed
in v8M ARM ARM rule R_YVWT as
* LDM, LDMIA, LDMFD
* LDMDB, LDMEA
* POP (multiple registers)
* PUSH (muliple registers)
* STM, STMIA, STMEA
* STMDB, STMFD

We perform the stack limit before doing any other part
of the load or store.

Backports commit 7c0ed88e7d6bee3e55c3d8935c46226cb544191a from qemu
2018-10-08 14:19:14 -04:00
Peter Maydell bb97240df6
target/arm: Add v8M stack checks for LDRD/STRD (imm)
Add the v8M stack checks for:
* LDRD (immediate)
* STRD (immediate)

Loads and stores are more complicated than ADD/SUB/MOV, because we
must ensure that memory accesses below the stack limit are not
performed, so we can't simply do the check when we actually update
SP.

For these instructions, if the stack limit check triggers
we must not:
* perform any memory access below the SP limit
* update PC, SP or the load/store base register
but it is IMPDEF whether we:
* perform any accesses above or equal to the SP limit
* update destination registers for loads

For QEMU we choose to always check the limit before doing any other
part of the load or store, so we won't update any registers or
perform any memory accesses.

It is UNKNOWN whether the limit check triggers for a load or store
where the initial SP value is below the limit and one of the stores
would be below the limit, but the writeback moves SP to above the
limit. For QEMU we choose to trigger the check in this situation.

Note that limit checks happen only for loads and stores which update
SP via writeback; they do not happen for loads and stores which
simply use SP as a base register.

Backports commit 910d7692e5b60f2c2d08cc3d6d36076e85b6a69d from qemu
2018-10-08 14:17:27 -04:00
Lioncash cb935d868e
target/arm: Add v8M stack limit checks on NS function calls 2018-10-08 14:15:15 -04:00
Peter Maydell ed3c951fb6
target/arm: Add v8M stack checks on exception entry
Add checks for breaches of the v8M stack limit when the
stack pointer is decremented to push the exception frame
for exception entry.

Note that the exception-entry case is unique in that the
stack pointer is updated to be the limit value if the limit
is hit (per rule R_ZLZG).

Backports commit c32da7aa6205a5ff62ae8d5062f7cad0eae4c1fd from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell 0fc6e2c183
target/arm: Add some comments in Thumb decode
Add some comments to the Thumb decoder indicating what bits
of the instruction have been decoded at various points in
the code.

This is not an exhaustive set of comments; we're gradually
adding comments as we work with particular bits of the code.

Backports commit a2d12f0f34e9c5ef8a193556fde983aa186fa73a from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell ca5d7b8fd2
target/arm: Add v8M stack checks on ADD/SUB/MOV of SP
Add code to insert calls to a helper function to do the stack
limit checking when we handle these forms of instruction
that write to SP:
* ADD (SP plus immediate)
* ADD (SP plus register)
* SUB (SP minus immediate)
* SUB (SP minus register)
* MOV (register)

Backports commit 5520318939fea5d659bf808157cd726cb967b761 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell b2146058c3
target/arm: Move v7m_using_psp() to internals.h
We're going to want v7m_using_psp() in op_helper.c in the
next patch, so move it from helper.c to internals.h.

Backports commit 5529bf188d996391ff52a0e1801daf9c6a6bfcb0 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell ae4900fba2
target/arm: Define new EXCP type for v8M stack overflows
Define EXCP_STKOF, and arrange for it to cause us to take
a UsageFault with CFSR.STKOF set.

Backports commit 86f026de22d8854eecc004af44895de74225794f from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell 8b3b548961
target/arm: Define new TBFLAG for v8M stack checking
The Arm v8M architecture includes hardware stack limit checking.
When certain instructions update the stack pointer, if the new
value of SP is below the limit set in the associated limit register
then an exception is taken. Add a TB flag that tracks whether
the limit-checking code needs to be emitted.

Backports commit 4730fb85035e99c909db7d14ef76cd17f28f4423 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 66ffb372e7
target/arm: Pass TCGMemOpIdx to sve memory helpers
There is quite a lot of code required to compute cpu_mem_index,
or even put together the full TCGMemOpIdx. This can easily be
done at translation time.

Backports commit 500d04843ba953dc4560e44f04001efec38c14a6 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 606e8cdb8c
target/arm: Rewrite vector gather first-fault loads
This implements the feature for softmmu, and moves the
main loop out of a macro and into a function.

Backports commit 116347ce20bb7b5cac17bf2b0e6f607530b50862 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 1cd3c2a408
target/arm: Split contiguous stores for endianness
We can choose the endianness at translation time, rather than
re-computing it at execution time.

Backports commit 28d57f2dc59c287e1c40239509b0a325fd00e32f from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson c9569b3fe0
target/arm: Split contiguous loads for endianness
We can choose the endianness at translation time, rather than
re-computing it at execution time.

Backports commit 7d0a57a2e1cea188b9023261a404d7a211117230 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 2542ad17d0
target/arm: Rewrite vector gather stores
This fixes the endianness problem for softmmu, and moves
the main loop out of a macro and into an inlined function.

Backports commit 78cf1b886aa1b95c97fc5114641515c2892bb240 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson ff63807164
target/arm: Rewrite vector gather loads
This fixes the endianness problem for softmmu, and moves
the main loop out of a macro and into an inlined function.

Backports commit d4f75f25b43041e7a46d12352b3c70ae457d8cea from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 966ea163a3
target/arm: Rewrite helper_sve_st[1234]*_r
This fixes the endianness problem for softmmu, and moves the
main loop out of a macro and into an inlined function

Backports commit 9fd46c8362e0a45d04ccceae7051d06dd65c1d57 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 4978d77039
target/arm: Rewrite helper_sve_ld[234]*_r
Use the same *_tlb primitives as we use for ld1.

For linux-user, this hoists the set of helper_retaddr. For softmmu,
hoists the computation of the current mmu_idx outside the loop,
fixes the endianness problem, and moves the main loop out of a
macro and into an inlined function.

Backports commit f27d4dc2af0de9b7b45c955882b8420905c6efe8 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 5b88176e1d
target/arm: Rewrite helper_sve_ld1*_r using pages
Uses tlb_vaddr_to_host for correct operation with softmmu.
Optimize for accesses within a single page or pair of pages.

Backports commit 9123aeb6fcb14e0955ebe4e2a613802cfa0503ea from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 935eb43b5e
target/arm: Clear unused predicate bits for LD1RQ
The 16-byte load only uses 16 predicate bits. But while
reusing the other load infrastructure, we find other bits
that are set and trigger an assert. To avoid this and
retain the assert, zero-extend the predicate that we pass
to the LD1 helper.

Backports commit 2a99ab2b3545133961de034df27e24f4c22e3707 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson a37f24aa11
target/arm: Adjust aarch64_cpu_dump_state for system mode SVE
Use the existing helpers to determine if (1) the fpu is enabled,
(2) sve state is enabled, and (3) the current sve vector length.

Backports commit ced3155141755ba244c988c72c4bde32cc819670 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 87c20b52c0
target/arm: Handle SVE vector length changes in system mode
SVE vector length can change when changing EL, or when writing
to one of the ZCR_ELn registers.

For correctness, our implementation requires that predicate bits
that are inaccessible are never set. Which means noticing length
changes and zeroing the appropriate register bits.

Backports commit 0ab5953b00b3165877d00cf75de628c51670b550 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 2fb9c4c41d
target/arm: Pass in current_el to fp and sve_exception_el
We are going to want to determine whether sve is enabled
for EL other than current.

Backports commit 2de7ace292cf7846b0cda0e940272d2cb0e06859 from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 00fc5d43fd
target/arm: Adjust sve_exception_el
Check for EL3 before testing CPTR_EL3.EZ. Return 0 when the exception
should be routed via AdvSIMDFPAccessTrap. Mirror the structure of
CheckSVEEnabled more closely.

Fixes: 5be5e8eda78

Backports commit 60eed0869d68b91eff71cc0a0facb01983726a5d from qemu
2018-10-08 14:15:15 -04:00
Richard Henderson 1081e5e7a4
target/arm: Define ID_AA64ZFR0_EL1
Given that the only field defined for this new register may only
be 0, we don't actually need to change anything except the name.

Backports commit 9516d7725ec1deaa6ef5ccc5a26d005650d6c524 from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell d82046cafc
target/arm: Don't read r4 from v8M exception stackframe twice
A cut-and-paste error meant we were reading r4 from the v8M
callee-saves exception stack frame twice. This is harmless
since it just meant we did two memory accesses to the same
location, but it's unnecessary. Delete it.

Backports commit e5ae4d0c063fbcca4cbbd26bcefbf1760cfac2aa from qemu
2018-10-08 14:15:15 -04:00
Peter Maydell f628cbdfc3
target/arm: Correct condition for v8M callee stack push
In v7m_exception_taken() we were incorrectly using a
"LR bit EXCRET.ES is 1" check when it should be 0
(compare the pseudocode ExceptionTaken() function).
This meant we didn't stack the callee-saved registers
when tailchaining from a NonSecure to a Secure exception.

Backports commit 7b73a1ca05b33d42278ce29cea4652e22d408165 from qemu
2018-10-08 14:15:15 -04:00
Lioncash b62e892b20
mips: Use DisasContext for parameters in place of TCGContext where applicable
This is more future-friendly with qemu's main repo, as it's more
generic.
2018-10-06 04:37:28 -04:00
Lioncash 47b45f1bc2
arm: Take DisasContext as a parameter instead of TCGContext where applicable
This is more future-friendly with qemu, as it's more generic.
2018-10-06 04:17:12 -04:00
Lioncash 766c70f608
arm: Move cpu_M0 to DisasContext 2018-10-06 03:32:39 -04:00
Lioncash 787fd448b1
arm: Move cpu_V1 to DisasContext 2018-10-06 03:28:42 -04:00
Lioncash 1aa20da917
arm: Move cpu_V0 to DisasContext 2018-10-06 03:26:52 -04:00
Lioncash 06c21baaa4
arm: Move cpu_F1d to DisasContext 2018-10-06 03:11:54 -04:00
Lioncash 5f3dd68f9c
arm: Move cpu_F0d to DisasContext 2018-10-06 03:07:42 -04:00
Lioncash e457ce8ccc
arm: Move cpu_F1s to DisasContext 2018-10-06 03:02:06 -04:00
Lioncash a4f23de55f
arm: Move cpu_F0 to DisasContext
Decreases the size of the TCGContext struct for targets that don't need
to use this variable.
2018-10-06 02:58:11 -04:00
Peter Maydell 04fead0dcb
target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode
The ARMv8 architecture defines that an AArch32 CPU starts
in SVC mode, unless EL2 is the highest available EL, in
which case it starts in Hyp mode. (In ARMv7 a CPU with EL2
but not EL3 was not a valid configuration, but we don't
specifically reject this if the user asks for one.)

Backports commit 060a65df056a5d6ca3a6a91e7bf150ca1fbccddf from qemu
2018-09-25 21:19:44 -04:00
Richard Henderson 994038c817
target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs
Not only are the sve-related tb_flags fields unused when SVE is
disabled, but not all of the cpu registers are initialized properly
for computing same. This can corrupt other fields by ORing in -1,
which might result in QEMU crashing.

This bug was not present in 3.0, but this patch is cc'd to
stable because adf92eab90e3f5f34c285 where the bug was
introduced was marked for stable.

Backports commit e79b445d896deb61909be52b61b87c98a9ed96f7 from qemu
2018-09-25 21:17:32 -04:00
Lioncash e81fa596bc
target/arm/cpu: Use type_register instead of type_register_static() in arm_cpu_register_types()
The lifetime of the TypeInfo instance doesn't live indefinitely, so we
should be using the regular type_register().
2018-09-03 17:34:08 -04:00
MerryMage 9b87d0f61a unicorn_arm: Allow for read/write of UC_ARM_REG_FPSCR 2018-09-03 21:03:55 +01:00
MerryMage a13d51f756 unicorn_aarch64: Use aa64_vfp_qreg instead of aa32_vfp_dreg 2018-09-03 07:47:40 +01:00
MerryMage 896a8e1320 unicorn_arm: Use ARM offset not ARM64 offset
Was introduced by 5439b4a542
2018-09-03 07:44:29 +01:00
Peter Maydell 39045d67df
target/arm: Remove a handful of stray tabs
Following the bulk conversion of the iwMMXt code, there are
just a handful of hard coded tabs in target/arm; fix them.
This is a whitespace-only patch.

Backports commit 6e0fafe2ef02378c696e7cf84ef41511e3b3b81a from qemu
2018-08-25 04:34:44 -04:00
Peter Maydell 1b8534bf31
target/arm: Untabify iwmmxt_helper.c
Untabify the arm iwmmxt_helper.c. This affects only the iwMMXt code.
We've never touched that code in years, so it's not going to get
fixed up by our "change when touched" process, and a bulk change is
not going to be too disruptive.

This commit was produced using Emacs "untabify" (plus one
by-hand removal of a space to fix a checkpatch nit); it is
a whitespace-only change.

Backports commit 67aed15551f9814712d5ac25a155919b34fbd627 from qemu
2018-08-25 04:33:44 -04:00
Peter Maydell 3619f707a6
target/arm: Clear CPSR.IL and CPSR.J on 32-bit exception entry
On 32-bit exception entry, CPSR.J must always be set to 0
(see v7A Arm ARM DDI0406C.c B1.8.5). CPSR.IL must also
be cleared on 32-bit exception entry (see v8A Arm ARM
DDI0487C.a G1.10).

Clear these bits. (This fixes a bug which will never be noticed
by non-buggy guests.)

Backports commit 829f9fd394ab082753308cbda165c13eaf8fae49 from qemu
2018-08-25 04:28:22 -04:00
Peter Maydell 16477f908e
target/arm: Implement support for taking exceptions to Hyp mode
Implement the necessary support code for taking exceptions
to Hyp mode in AArch32.

Backports commit b9bc21ff9f9bb2d841adf1dc7f6f8ddfb9ab8b5e from qemu
2018-08-25 04:27:18 -04:00
Peter Maydell 4c445c2300
target/arm: Factor out code for taking an AArch32 exception
Factor out the code which changes the CPU state so as to
actually take an exception to AArch32. We're going to want
to use this for handling exception entry to Hyp mode.

Backports commit dea8378bb3e86f2c6bd05afb3927619f7c51bb47 from qemu
2018-08-25 04:23:53 -04:00
Peter Maydell c238d5cc6b
target/arm: Implement AArch32 HCR and HCR2
The AArch32 HCR and HCR2 registers alias HCR_EL2
bits [31:0] and [63:32]; implement them.

Since HCR2 exists in ARMv8 but not ARMv7, we need new
regdef arrays for "we have EL3, not EL2, we're ARMv8"
and "we have EL2, we're ARMv8" to hold the definitions.

Backports commit ce4afed8396aabaf87cd42fbe8a4c14f7a9d5c10 from qemu
2018-08-25 04:21:57 -04:00
Peter Maydell cc57e03da4
target/arm: Implement RAZ/WI HACTLR2
The v8 AArch32 HACTLR2 register maps to bits [63:32] of ACTLR_EL2.
We implement ACTLR_EL2 as RAZ/WI, so make HACTLR2 also RAZ/WI.
(We put the regdef next to ACTLR_EL2 as a reminder in case we
ever make ACTLR_EL2 something other than RAZ/WI).

Backports commit 0e0456ab8895a5e85998904549e331d36c2692a5 from qemu
2018-08-25 04:13:37 -04:00
Richard Henderson 241fb78efc
target/arm: Use the float-to-int-scale softfloat routines
Backports commit 323cd490845acf663159ca26e35cb977ad9b85a2 from qemu
2018-08-25 04:11:51 -04:00