Commit graph

1155 commits

Author SHA1 Message Date
Richard Henderson febfda4e98
target/arm: Decode PAuth within disas_data_proc_2src
Backports commit b6342a9f929b5946beb6726eef2ef2c5f4a11f09 from qemu
2019-01-22 15:41:44 -05:00
Richard Henderson 999222f0a1
target/arm: Decode PAuth within disas_data_proc_1src
Backports commit 95ebd99dcd37b8574426c876502bfcc7c299584b from qemu
2019-01-22 15:39:53 -05:00
Richard Henderson 967e6a1e90
target/arm: Rearrange decode in disas_data_proc_1src
Now properly signals unallocated for REV64 with SF=0.
Allows for the opcode2 field to be decoded shortly.

Backports commit 18de2813c35e359621a24a0a2a77570e83cb73b9 from qemu
2019-01-22 15:35:44 -05:00
Richard Henderson 02fd7e2472
target/arm: Decode PAuth within system hint space
Backports commit 7c94c8343c6a0eea1633a65ed27987b6a71b9089 from qemu
2019-01-22 15:33:27 -05:00
Richard Henderson e6196b2040
target/arm: Add PAuth helpers
The cryptographic internals are stubbed out for now,
but the enable and trap bits are checked.

Backports commit 0d43e1a2d29a05f7b0d5629caaff18733cbdf3bb from qemu
2019-01-22 15:27:15 -05:00
Richard Henderson 1f7d228c8a
target/arm: Introduce raise_exception_ra
This path uses cpu_loop_exit_restore to unwind current processor state.

Backports commit 7469f6c696d74ad3b22b67c08e1e8f79e2b5d3d6 from qemu
2019-01-22 15:20:06 -05:00
Richard Henderson e6ffbc22c2
target/arm: Add PAuth active bit to tbflags
There are 5 bits of state that could be added, but to save
space within tbflags, add only a single enable bit.
Helpers will determine the rest of the state at runtime.

Backports commit 0816ef1bfcd3ac53e7454b62ca436727887f6056 from qemu
2019-01-22 15:15:59 -05:00
Richard Henderson 54721be30e
target/arm: Add SCTLR bits through ARMv8.5
Post v8.4 bits taken from SysReg_v85_xml-00bet8.

Backports commit b2af69d0b6e0edcb789ca1fcc1199bbfde6ed986 from qemu
2019-01-22 15:14:02 -05:00
Richard Henderson 8ef39cc2d5
target/arm: Add state for the ARMv8.3-PAuth extension
Add storage space for the 5 encryption keys.

Backports commit 991ad91b6a1f09a6ad62b6e6da78d83b548daec7 from qemu
2019-01-22 15:11:39 -05:00
Alexander Graf f2682ff309
target/arm: Allow Aarch32 exception return to switch from Mon->Hyp
In U-boot, we switch from S-SVC -> Mon -> Hyp mode when we want to
enter Hyp mode. The change into Hyp mode is done by doing an
exception return from Mon. This doesn't work with current QEMU.

The problem is that in bad_mode_switch() we refuse to allow
the change of mode.

Note that bad_mode_switch() is used to do validation for two situations:

(1) changes to mode by instructions writing to CPSR.M
(ie not exception take/return) -- this corresponds to the
Armv8 Arm ARM pseudocode Arch32.WriteModeByInstr
(2) changes to mode by exception return

Attempting to enter or leave Hyp mode via case (1) is forbidden in
v8 and UNPREDICTABLE in v7, and QEMU is correct to disallow it
there. However, we're already doing that check at the top of the
bad_mode_switch() function, so if that passes then we should allow
the case (2) exception return mode changes to switch into Hyp mode.

We want to test whether we're trying to return to the nonexistent
"secure Hyp" mode, so we need to look at arm_is_secure_below_el3()
rather than arm_is_secure(), since the latter is always true if
we're in Mon (EL3).

Backports commit 2d2a4549cc29850aab891495685a7b31f5254b12 from qemu
2019-01-22 15:09:30 -05:00
Vitaly Kuznetsov b6cc2c4e06
i386/kvm: add a comment explaining why .feat_names are commented out for Hyper-V feature bits
Hyper-V .feat_names are, unlike hardware features, commented out and it is
not obvious why we do that. Document the current status quo.

Backports commit abd5fc4c862d033a989552914149f01c9476bb16 from qemu
2019-01-14 15:02:35 -05:00
Vitaly Kuznetsov 2873612479
i386/kvm: expose HV_CPUID_ENLIGHTMENT_INFO.EAX and HV_CPUID_NESTED_FEATURES.EAX as feature words
It was found that QMP users of QEMU (e.g. libvirt) may need
HV_CPUID_ENLIGHTMENT_INFO.EAX/HV_CPUID_NESTED_FEATURES.EAX information. In
particular, 'hv_tlbflush' and 'hv_evmcs' enlightenments are only exposed in
HV_CPUID_ENLIGHTMENT_INFO.EAX.

HV_CPUID_NESTED_FEATURES.EAX is exposed for two reasons: convenience
(we don't need to export it from hyperv_handle_properties() and as
future-proof for Enlightened MSR-Bitmap, PV EPT invalidation and
direct virtual flush features.

Backports commit a2b107dbbd342ff2077aa5af705efaf68c375459 from qemu
2019-01-14 15:01:13 -05:00
Eduardo Habkost 3eb700bec7
x86: host-phys-bits-limit option
Backports part of commit 258fe08bd341d2e230676228307294e41f33002c from
qemu. Namely, just adding the struct member.
2019-01-14 14:56:57 -05:00
Paolo Bonzini bf6192276b
target/i386: Disable MPX support on named CPU models
MPX support is being phased out by Intel; GCC has dropped it, Linux
is also going to do that. Even though KVM will have special code
to support MPX after the kernel proper stops enabling it in XCR0,
we probably also want to deprecate that in a few years. As a start,
do not enable it by default for any named CPU model starting with
the 4.0 machine types; this include Skylake, Icelake and Cascadelake.

Backports commit ecb85fe48cacb2f8740186e81f2f38a2e02bd963 from qemu
2019-01-14 14:54:40 -05:00
Borislav Petkov 152fdb49de
target-i386: Reenable RDTSCP support on Opteron_G[345] CPU models CPU models
The missing functionality was added ~3 years ago with the Linux commit

46896c73c1a4 ("KVM: svm: add support for RDTSCP")

so reenable RDTSCP support on those CPU models.

Opteron_G2 - being family 15, model 6, doesn't have RDTSCP support
(the real hardware doesn't have it. K8 got RDTSCP support with the NPT
models, i.e., models >= 0x40).

Document the host's minimum required kernel version, while at it.

Backports commit 483c6ad426dbab72d912fe4793d7d558671aa727 from qemu
2019-01-14 14:50:22 -05:00
Peter Maydell 55bc017af4
target/arm: Emit barriers for A32/T32 load-acquire/store-release insns
Now that MTTCG is here, the comment in the 32-bit Arm decoder that
"Since the emulation does not have barriers, the acquire/release
semantics need no special handling" is no longer true. Emit the
correct barriers for the load-acquire/store-release insns, as
we already do in the A64 decoder.

Backports commit 96c552958dbb63453b5f02bea6e704006d50e39a from qemu
2019-01-13 19:48:27 -05:00
Richard Henderson 254f882efc
target/arm: SVE brk[ab] merging does not have s bit
While brk[ab] zeroing has a flags setting option, the merging variant
does not. Retain the same argument structure, to share expansion but
force the flag zero and do not decode bit 22.

Backports commit 407e6ce7f1f428cb242d424cd35381a77b5b2071 from qemu
2019-01-13 19:39:34 -05:00
Richard Henderson 4d8b7a9967
target/arm: Convert ARM_TBFLAG_* to FIELDs
Use "register" TBFLAG_ANY to indicate shared state between
A32 and A64, and "registers" TBFLAG_A32 & TBFLAG_A64 for
fields that are specific to the given cpu state.

Move ARM_TBFLAG_BE_DATA to shared state, instead of its current
placement within "Bit usage when in AArch32 state".

Backports commit aad821ac4faad369fad8941d25e59edf2514246b from qemu
2019-01-13 19:21:18 -05:00
Fredrik Noring ee4b59e981
target/mips: Support R5900 three-operand MADD1 and MADDU1 instructions
The three-operand MADD and MADDU are specific to R5900 cores.

Backports commit a95c4c26f1dc233987350e7cb1cf62d46ade5ce5 from qemu
2019-01-05 08:07:56 -05:00
Philippe Mathieu-Daudé 76bc93690f
target/mips: Support R5900 three-operand MADD and MADDU instructions
The three-operand MADD and MADDU are specific to Sony R5900 core,
and Toshiba TX19/TX39/TX79 cores as well.

The "32-Bit TX System RISC TX39 Family Architecture manual"
is available at https://wiki.qemu.org/File:DSAE0022432.pdf

Backports commit 3b948f053fc588154d95228da8a6561c61c66104 from qemu
2019-01-05 08:03:43 -05:00
Aleksandar Markovic 5729c803a7
target/mips: MXU: Add handler for an align instruction
Add translation handler for S32ALNI MXU instruction.

Backports commit 79f5fee7a3c53494c7ca4bc18c72944f5e2d5c2f from qemu
2019-01-05 08:00:09 -05:00
Aleksandar Markovic 94956d81f6
target/mips: MXU: Add handlers for max/min instructions
Add translation handlers for six max/min MXU instructions.

Backports commit bb84cbf38505bd1d800fdddcd81407a99e5c2142 from qemu
2019-01-05 07:55:39 -05:00
Aleksandar Markovic bf7da7bf57
target/mips: MXU: Add handlers for logic instructions
Add translation handlers for four logic MXU instructions.

It should be noted that there is an error in MXU documentation (dated
June 2017) regarding opcodes for this group of instructions. This was
confirmed by running tests on hardware, and also by looking up other
related public source trees (binutils, Android NDK). In initial MXU
patches to QEMU, opcodes for MXU logic instructions were created to
be in accordance with the MXU documentation, therefore the error from
was propagated. This patch corrects that, changing the involved code.
Besides that, as MXU was designed and implemented only for 32-bit
CPUs, corresponding preprosessor conditions were added around MXU
code, which allows more flexible implementation of MXU handlers.

Backports commit b621f0187ef789aeef733cf79e5ac83984752394 from qemu
2019-01-05 07:48:08 -05:00
Aleksandar Markovic ba253dd0d3
target/mips: MXU: Improve the comment containing MXU overview
Improve textual description of MXU extension. These are mostly
comment formatting changes.

Backports commit 84e2c895b12fb7056daeb7e5094656eae7b50d3d from qemu
2019-01-05 07:39:47 -05:00
Aleksandar Markovic 57bb979ce8
target/mips: MXU: Add generic naming for optn2 constants
Add generic naming involving generig suffixes OPTN0, OPTN1, OPTN2,
OPTN3 for four optn2 constants. Existing suffixes WW, LW, HW, XW
are not quite appropriate for some instructions using optn2.
2019-01-05 07:35:49 -05:00
Aleksandar Markovic b5e1ea2e08
target/mips: MXU: Add missing opcodes/decoding for LX* instructions
Add missing opcodes and decoding engine for LXB, LXH, LXW, LXBU,
and LXHU instructions. They were for some reason forgotten in
previous commits. The MXU opcode list and decoding engine should
be now complete.

Backports commit c233bf07af7cf2358b69c38150dbd2e3e4a399b6 from qemu
2019-01-05 07:34:07 -05:00
Peter Maydell b9d5e1d927
target/arm: Free name string in ARMCPRegInfo hashtable entries'
When we add a new entry to the ARMCPRegInfo hash table in
add_cpreg_to_hashtable(), we allocate memory for tehe
ARMCPRegInfo struct itself, and we also g_strdup() the
name string. So the hashtable's value destructor function
must free the name string as well as the struct.

Spotted by clang's leak sanitizer. The leak here is a
small one-off leak at startup, because we don't support
CPU hotplug, and so the only time when we destroy
hash table entries is for the case where ARM_CP_OVERRIDE
means we register a wildcard entry and then override it later.

Backports commit ac87e5072e2cbfcf8e80caac7ef43ceb6914c7af from qemu
2018-12-18 05:09:59 -05:00
Richard Henderson 8816550c10
target/arm: Implement the ARMv8.1-LOR extension
Provide a trivial implementation with zero limited ordering regions,
which causes the LDLAR and STLLR instructions to devolve into the
LDAR and STLR instructions from the base ARMv8.0 instruction set.

Backports commit 2d7137c10fafefe40a0a049ff8a7bd78b66e661f from qemu
2018-12-18 04:36:58 -05:00
Richard Henderson 32208e482b
target/arm: Use arm_hcr_el2_eff more places
Since arm_hcr_el2_eff includes a check against
arm_is_secure_below_el3, we can often remove a
nearby check against secure state.

In some cases, sort the call to arm_hcr_el2_eff
to the end of a short-circuit logical sequence.

Backports commit 7c208e0f4171c9e2cc35efc12e1bf264a45c229f from qemu
2018-12-18 04:33:07 -05:00
Richard Henderson 78798d10eb
target/arm: Introduce arm_hcr_el2_eff
Replace arm_hcr_el2_{fmo,imo,amo} with a more general routine
that also takes SCR_EL3.NS (aka arm_is_secure_below_el3) into
account, as documented for the plethora of bits in HCR_EL2.

Backports commit f77784446045231f7dfa46c9b872091241fa1557 from qemu
2018-12-18 04:27:34 -05:00
Richard Henderson 4515df5ee7
target/arm: Implement the ARMv8.2-AA32HPD extension
The bulk of the work here, beyond base HPD, is defining the
TTBCR2 register. In addition we must check TTBCR.T2E, which
is not present (RES0) for AArch64.

Backports commit ab638a328fd099ba0b23c8c818eb39f2c35414f3 from qemu
2018-12-18 04:23:37 -05:00
Richard Henderson 3cfd660814
target/arm: Implement the ARMv8.1-HPD extension
Since the TCR_*.HPD bits were RES0 in ARMv8.0, we can simply
interpret the bits as if ARMv8.1-HPD is present without checking.
We will need a slightly different check for hpd for aarch32.

Backports commit 037c13c5904f5fc67bb0ab7dd91ae07347aedee9 from qemu
2018-12-18 04:20:39 -05:00
Richard Henderson 0e08c37773
target/arm: Tidy scr_write
Because EL3 has a fixed execution mode, we can properly decide
which of the bits are RES{0,1}.

Backports commit ea22747c63c9a894777aa41a7af85c3d08e39f81 from qemu
2018-12-18 04:18:09 -05:00
Richard Henderson 52ac2b2f7c
target/arm: Fix HCR_EL2.TGE check in arm_phys_excp_target_el
The enable for TGE has already occurred within arm_hcr_el2_amo
and friends. Moreover, when E2H is also set, the sense is
supposed to be reversed, which has also already occurred within
the helpers.

Backports commit 619959c3583dad325c36f09ce670e7d091382cae from qemu
2018-12-18 04:17:08 -05:00
Richard Henderson a8fb6fc8d5
target/arm: Add SCR_EL3 bits up to ARMv8.5
Post v8.4 bits taken from SysReg_v85_xml-00bet8.

Backports commit 99f8f86d365701fad695be606266aa7dac97ca1c from qemu
2018-12-18 04:16:30 -05:00
Richard Henderson ad27526b58
target/arm: Add HCR_EL2 bits up to ARMv8.5
Post v8.3 bits taken from SysReg_v85_xml-00bet8.

Backports commit 099bf53b7a4bf69f4c4007c769895263a9c3f6f4 from qemu
2018-12-18 04:15:50 -05:00
Peter Maydell 8b69824de7
target/arm: Move id_aa64mmfr* to ARMISARegisters
At the same time, define the fields for these registers,
and use those defines in arm_pamax().

Backports commit 3dc91ddbc68391f934bf6945853e99cf6810fc00 from qemu
2018-12-18 04:03:50 -05:00
Eduardo Habkost 030aa55c08
i386: Add stibp flag name
The STIBP flag may be supported by the host KVM module, so QEMU
can allow it to be configured manually, and it can be exposed to
guests when using "-cpu host".

No additional migration code is required because the whole
contents of spec_ctrl is already migrated in the "cpu/spec_ctrl"
section.

Backports commit 0e8916582991b9fd0b94850a8444b8b80d0a0955 from qemu
2018-12-18 03:48:53 -05:00
Liu Jingqi 10d7f18674
x86/cpu: Enable MOVDIR64B cpu feature
MOVDIR64B moves 64-bytes as direct-store with 64-bytes write atomicity.
Direct store is implemented by using write combining (WC) for writing
data directly into memory without caching the data.

The bit definition:
CPUID.(EAX=7,ECX=0):ECX[bit 28] MOVDIR64B

The release document ref below link:
https://software.intel.com/sites/default/files/managed/c5/15/\
architecture-instruction-set-extensions-programming-reference.pdf

Backports commit 1c65775ffc2dbd276a8bffe592feba0e186a151c from qemu
2018-12-18 03:48:19 -05:00
Liu Jingqi 6aa3cd24fd
x86/cpu: Enable MOVDIRI cpu feature
MOVDIRI moves doubleword or quadword from register to memory through
direct store which is implemented by using write combining (WC) for
writing data directly into memory without caching the data.

The bit definition:
CPUID.(EAX=7,ECX=0):ECX[bit 27] MOVDIRI

The release document ref below link:
https://software.intel.com/sites/default/files/managed/c5/15/\
architecture-instruction-set-extensions-programming-reference.pdf

Backports commit 24261de4916596d8ab5f5fee67e9e7a19e8325a5 from qemu
2018-12-18 03:46:49 -05:00
Richard Henderson 2af9cf7113
target/i386: Generate #UD when applying LOCK to a register destination
Fixes a TCG crash due to attempting the atomic operation without
having set up the address first. This does not attempt to fix
all of the other missing checks for LOCK.

Fixes: a7cee522f35
Fixes: https://bugs.launchpad.net/qemu/+bug/1803160

Backports commit e84fcd7f662a0d8198703f6f89416d7ac2c32767 from qemu
2018-12-01 20:13:02 -05:00
Luc Michel 1ae9d988c6
target/arm: fix smc incorrectly trapping to EL3 when secure is off
This commit fixes a case where the CPU would try to go to EL3 when
executing an smc instruction, even though ARM_FEATURE_EL3 is false. This
case is raised when the PSCI conduit is set to smc, but the smc
instruction does not lead to a valid PSCI call.

QEMU crashes with an assertion failure latter on because of incoherent
mmu_idx.

This commit refactors the pre_smc helper by enumerating all the possible
way of handling an scm instruction, and covering the previously missing
case leading to the crash.

The following minimal test would crash before this commit:

.global _start
.text
_start:
ldr x0, =0xdeadbeef ; invalid PSCI call
smc #0

run with the following command line:

aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \
-o test test.s

qemu-system-aarch64 -M virt,virtualization=on,secure=off \
-cpu cortex-a57 -kernel test

Backports commit 7760da729ac88f112f98f36395ac3b55fc9e4211 from qemu
2018-11-23 18:57:23 -05:00
Aleksandar Markovic d1f2d2c57b
target/mips: Disable R5900 support
Disable R5900 support. There are some outstanding issues related
to ABI support and emulation accuracy, that were not understood
well during review process. Disable to avoid backward compatibility
issues.

Reverts commit ed4f49ba9bb56ebca6987b1083255daf6c89b5de.

Backports commit 823f2897bdd78185f3ba33292a25105ba8bad1b5 from qemu
2018-11-23 18:55:12 -05:00
Aleksandar Markovic 3b89ca7188
target/mips: Rename MMI-related functions
Rename MMI-related functions.

Backports commit 874b28797045f574adb10b69c28006ca143f9280 from qemu
2018-11-23 18:54:02 -05:00
Aleksandar Markovic f51b980772
target/mips: Rename MMI-related opcodes
Rename MMI-related opcodes.

Backports commit baa609db75057b6a84c1867049e85d553b990090 from qemu
2018-11-23 18:49:13 -05:00
Aleksandar Markovic 8f8c6e3bb5
target/mips: Rename MMI-related masks
Rename MMI-related masks.

Backports commit c8341e00007f51e777b8b00b3fc3f475b3684001 from qemu
2018-11-23 18:41:55 -05:00
Fredrik Noring ed586cfa46
target/mips: Guard check_insn with INSN_R5900 check
Explicitely mark handling of PREF instruction for R5900 as
treating the same as NOP.

Backports commit 992e8176d36882983bb04f0259f7151a36d003a1 from qemu
2018-11-23 18:39:37 -05:00
Fredrik Noring a79d4b6fe7
target/mips: Guard check_insn_opc_user_only with INSN_R5900 check
Avoid using check_opc_user_only() as a decision making code wrt
various architectures. Use ctx->insn_flags checks instead.

Backports commit 55fc7a69aa38f5ec726e862caf4e4394caca04a8 from qemu
2018-11-23 18:38:08 -05:00
Fredrik Noring b671293fe0
target/mips: Fix decoding mechanism of special R5900 opcodes
MOVN, MOVZ, MFHI, MFLO, MTHI, MTLO, MULT, MULTU, DIV, DIVU, DMULT,
DMULTU, DDIV, DDIVU and JR are decoded in decode_opc_special_tx79
instead of the generic decode_opc_special_legacy.

Backports commit 9dc324ce66807cc231fe890d4031de595ad1cf72 from qemu
2018-11-23 18:35:55 -05:00
Fredrik Noring f23c6fd006
target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1
DIV1 and DIVU1 are generated in gen_div1_tx79 instead of the generic
gen_muldiv.

Backports commit c42171c3bfe6fdc94c183f664c4d6548f8c5488b from qemu
2018-11-23 18:33:35 -05:00