summaryrefslogtreecommitdiffstats
path: root/target/arm/op_helper.c
Commit message (Collapse)AuthorAgeFilesLines
* target/arm: Support AA32 DIT by moving PSTATE_SS from cpsr into env->pstateRebecca Cran2021-02-111-8/+1Star
| | | | | | | | | | | | | cpsr has been treated as being the same as spsr, but it isn't. Since PSTATE_SS isn't in cpsr, remove it and move it into env->pstate. This allows us to add support for CPSR_DIT, adding helper functions to merge SPSR_ELx to and from CPSR. Signed-off-by: Rebecca Cran <rebecca@nuviainc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210208065700.19454-3-rebecca@nuviainc.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: add 64-bit S-EL2 to EL exception tableRémi Denis-Courmont2021-01-191-2/+2
| | | | | | | | | | | | | | | | With the ARMv8.4-SEL2 extension, EL2 is a legal exception level in secure mode, though it can only be AArch64. This patch adds the target EL for exceptions from 64-bit S-EL2. It also fixes the target EL to EL2 when HCR.{A,F,I}MO are set in secure mode. Those values were never used in practice as the effective value of HCR was always 0 in secure mode. Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210112104511.36576-7-remi.denis.courmont@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* arm tcg cpus: Fix Lesser GPL version numberChetan Pant2020-11-151-1/+1
| | | | | | | | | | | | There is no "version 2" of the "Lesser" General Public License. It is either "GPL version 2.0" or "Lesser GPL version 2.1". This patch replaces all occurrences of "Lesser GPL version 2" with "Lesser GPL version 2.1" in comment section. Signed-off-by: Chetan Pant <chetan4windows@gmail.com> Message-Id: <20201023122913.19561-1-chetan4windows@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
* target/arm: Fix neon VTBL/VTBX for len > 1Richard Henderson2020-11-101-10/+13
| | | | | | | | | | | | | | | | | The helper function did not get updated when we reorganized the vector register file for SVE. Since then, the neon dregs are non-sequential and cannot be simply indexed. At the same time, make the helper function operate on 64-bit quantities so that we do not have to call it twice. Fixes: c39c2b9043e Reported-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> [PMM: use aa32_vfp_dreg() rather than opencoding] Message-id: 20201105171126.88014-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Implement LDG, STG, ST2G instructionsRichard Henderson2020-06-261-0/+16
| | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-16-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Move helper_dc_zva to helper-a64.cRichard Henderson2020-03-051-93/+0Star
| | | | | | | | | | | This is an aarch64-only function. Move it out of the shared file. This patch is code movement only. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200302175829.2183-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Remove CPSR_RESERVEDRichard Henderson2020-02-131-1/+8
| | | | | | | | | | | The only remaining use was in op_helper.c. Use PSTATE_SS directly, and move the commentary so that it is more obvious what is going on. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200208125816.14954-10-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Replace CPSR_ERET_MASK with aarch32_cpsr_valid_maskRichard Henderson2020-02-131-1/+4
| | | | | | | | | | | CPSR_ERET_MASK was a useless renaming of CPSR_RESERVED. The function also takes into account bits that the cpu does not support. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200208125816.14954-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: adjust program counter for wfi exception in AArch32Jeff Kubascik2020-01-171-1/+6
| | | | | | | | | | | | | | | | | The wfi instruction can be configured to be trapped by a higher exception level, such as the EL2 hypervisor. When the instruction is trapped, the program counter should contain the address of the wfi instruction that caused the exception. The program counter is adjusted for this in the wfi op helper function. However, this correction is done to env->pc, which only applies to AArch64 mode. For AArch32, the program counter is stored in env->regs[15]. This adds an if-else statement to modify the correct program counter location based on the the current CPU mode. Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Handle AArch32 CP15 trapping via HSTR_EL2Marc Zyngier2019-12-161-0/+22
| | | | | | | | | | | | | | | | | | | | HSTR_EL2 offers a way to trap ranges of CP15 system register accesses to EL2, and it looks like this register is completely ignored by QEMU. To avoid adding extra .accessfn filters all over the place (which would have a direct performance impact), let's add a new TB flag that gets set whenever HSTR_EL2 is non-zero and that QEMU translates a context where this trap has a chance to apply, and only generate the extra access check if the hypervisor is actively using this feature. Tested with a hand-crafted KVM guest accessing CBAR. Signed-off-by: Marc Zyngier <maz@kernel.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20191201122018.25808-5-maz@kernel.org [PMM: use is_a64(); fix comment syntax] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Rebuild hflags at CPSR writesRichard Henderson2019-10-241-0/+3
| | | | | | | | | Continue setting, but not relying upon, env->hflags. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20191023150057.25731-19-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Rebuild hflags at EL changesRichard Henderson2019-10-241-0/+1
| | | | | | | | | Begin setting, but not relying upon, env->hflags. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20191023150057.25731-17-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Remove helper_double_saturateRichard Henderson2019-08-161-15/+0Star
| | | | | | | | | | | Replace x = double_saturate(y) with x = add_saturate(y, y). There is no need for a separate more specialized helper. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190807045335.1361-12-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Deliver BKPT/BRK exceptions to correct exception levelPeter Maydell2019-07-301-1/+15
| | | | | | | | | | | | | | | | | | | | Most Arm architectural debug exceptions (eg watchpoints) are ignored if the configured "debug exception level" is below the current exception level (so for example EL1 can't arrange to get debug exceptions for EL2 execution). Exceptions generated by the BRK or BPKT instructions are a special case -- they must always cause an exception, so if we're executing above the debug exception level then we must take them to the current exception level. This fixes a bug where executing BRK at EL2 could result in an exception being taken at EL1 (which is strictly forbidden by the architecture). Fixes: https://bugs.launchpad.net/qemu/+bug/1838277 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190730132522.27086-1-peter.maydell@linaro.org
* target/arm: Move debug routines to debug_helper.cPhilippe Mathieu-Daudé2019-07-041-295/+0Star
| | | | | | | | | These routines are TCG specific. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190701194942.10092-2-philmd@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Move TLB related routines to tlb_helper.cPhilippe Mathieu-Daudé2019-07-011-135/+0Star
| | | | | | | | | | | | These routines are TCG specific. The arm_deliver_fault() function is only used within the new helper. Make it static. Suggested-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190701132516.26392-13-philmd@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Move the DC ZVA helper into op_helperSamuel Ortiz2019-07-011-0/+93
| | | | | | | | | | | | | | | | | Those helpers are a software implementation of the ARM v8 memory zeroing op code. They should be moved to the op helper file, which is going to eventually be built only when TCG is enabled. Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Robert Bradford <robert.bradford@intel.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190701132516.26392-10-philmd@redhat.com [PMD: Rebased] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Fix multiline comment syntaxPhilippe Mathieu-Daudé2019-07-011-18/+36
| | | | | | | | | | | Since commit 8c06fbdf36b checkpatch.pl enforce a new multiline comment syntax. Since we'll move this code around, fix its style first. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190701132516.26392-8-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Use env_cpu, env_archcpuRichard Henderson2019-06-101-11/+10Star
| | | | | | | | | | | Cleanup in the boilerplate that each target must define. Replace arm_env_get_cpu with env_archcpu. The combination CPU(arm_env_get_cpu) should have used ENV_GET_CPU to begin; use env_cpu now. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Convert to CPUClass::tlb_fillRichard Henderson2019-05-101-25/+4Star
| | | | | | Cc: qemu-arm@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Add set/clear_pstate_bits, share gen_ss_advanceRichard Henderson2019-03-051-5/+0Star
| | | | | | | | | | We do not need an out-of-line helper for manipulating bits in pstate. While changing things, share the implementation of gen_ss_advance. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190301200501.16533-6-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Split helper_msr_i_pstate into 3Richard Henderson2019-03-051-42/+0Star
| | | | | | | | | | | | The EL0+UMA check is unique to DAIF. While SPSel had avoided the check by nature of already checking EL >= 1, the other post v8.0 extensions to MSR (imm) allow EL0 and do not require UMA. Avoid the unconditional write to pc and use raise_exception_ra to unwind. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190301200501.16533-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Move helper_exception_return to helper-a64.cRichard Henderson2019-01-211-155/+0Star
| | | | | | | | | This function is only used by AArch64. Code movement only. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20190108223129.5570-11-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Introduce raise_exception_raRichard Henderson2019-01-211-2/+17
| | | | | | | | | | This path uses cpu_loop_exit_restore to unwind current processor state. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20190108223129.5570-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Use arm_hcr_el2_eff more placesRichard Henderson2018-12-131-8/+6Star
| | | | | | | | | | | | | | Since arm_hcr_el2_eff includes a check against arm_is_secure_below_el3, we can often remove a nearby check against secure state. In some cases, sort the call to arm_hcr_el2_eff to the end of a short-circuit logical sequence. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181210150501.7990-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: fix smc incorrectly trapping to EL3 when secure is offLuc Michel2018-11-191-8/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit fixes a case where the CPU would try to go to EL3 when executing an smc instruction, even though ARM_FEATURE_EL3 is false. This case is raised when the PSCI conduit is set to smc, but the smc instruction does not lead to a valid PSCI call. QEMU crashes with an assertion failure latter on because of incoherent mmu_idx. This commit refactors the pre_smc helper by enumerating all the possible way of handling an scm instruction, and covering the previously missing case leading to the crash. The following minimal test would crash before this commit: .global _start .text _start: ldr x0, =0xdeadbeef ; invalid PSCI call smc #0 run with the following command line: aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \ -o test test.s qemu-system-aarch64 -M virt,virtualization=on,secure=off \ -cpu cortex-a57 -kernel test Signed-off-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20181117160213.18995-1-luc.michel@greensocs.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Hyp mode R14 is shared with User and SystemPeter Maydell2018-11-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hyp mode is an exception to the general rule that each AArch32 mode has its own r13, r14 and SPSR -- it has a banked r13 and SPSR but shares its r14 with User and System mode. We were incorrectly implementing it as banked, which meant that on entry to Hyp mode r14 was 0 rather than the USR/SYS r14. We provide a new function r14_bank_number() which is like the existing bank_number() but provides the index into env->banked_r14[]; bank_number() provides the index to use for env->banked_r13[] and env->banked_cpsr[]. All the points in the code that were using bank_number() to index into env->banked_r14[] are updated for consintency: * switch_mode() -- this is the only place where we fix an actual bug * aarch64_sync_32_to_64() and aarch64_sync_64_to_32(): no behavioural change as we already special-cased Hyp R14 * kvm32.c: no behavioural change since the guest can't ever be in Hyp mode, but conceptually the right thing to do * msr_banked()/mrs_banked(): we can never get to the case that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP, so no behavioural change Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20181109173553.22341-2-peter.maydell@linaro.org
* target/arm: New utility function to extract EC from syndromePeter Maydell2018-10-241-1/+1
| | | | | | | | | Create and use a utility function to extract the EC field from a syndrome, rather than open-coding the shift. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181012144235.19646-9-peter.maydell@linaro.org
* target/arm: Fix aarch64_sve_change_el wrt EL0Richard Henderson2018-10-161-1/+5
| | | | | | | | | | | | | | | | At present we assert: arm_el_is_aa64: Assertion `el >= 1 && el <= 3' failed. The comment in arm_el_is_aa64 explains why asking about EL0 without extra information is impossible. Add an extra argument to provide it from the surrounding context. Fixes: 0ab5953b00b3 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181008212205.17752-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add v8M stack limit checks on NS function callsPeter Maydell2018-10-081-2/+2
| | | | | | | | | | | | | | Check the v8M stack limits when pushing the frame for a non-secure function call via BLXNS. In order to be able to generate the exception we need to promote raise_exception() from being local to op_helper.c so we can call it from helper.c. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181002163556.10279-8-peter.maydell@linaro.org
* target/arm: Add v8M stack checks on ADD/SUB/MOV of SPPeter Maydell2018-10-081-0/+19
| | | | | | | | | | | | | | | Add code to insert calls to a helper function to do the stack limit checking when we handle these forms of instruction that write to SP: * ADD (SP plus immediate) * ADD (SP plus register) * SUB (SP minus immediate) * SUB (SP minus register) * MOV (register) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181002163556.10279-5-peter.maydell@linaro.org
* target/arm: Handle SVE vector length changes in system modeRichard Henderson2018-10-081-0/+1
| | | | | | | | | | | | | | | SVE vector length can change when changing EL, or when writing to one of the ZCR_ELn registers. For correctness, our implementation requires that predicate bits that are inaccessible are never set. Which means noticing length changes and zeroing the appropriate register bits. Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20181005175350.30752-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)Peter Maydell2018-08-201-11/+11
| | | | | | | | | | | | | | | The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp from either Monitor or Hyp mode. Our translate time check was overly strict and only permitted access from Monitor mode. The runtime check we do in msr_mrs_banked_exc_checks() had the correct code in it, but never got there because of the earlier "currmode == tgtmode" check. Special case ELR_Hyp. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Luc Michel <luc.michel@greensocs.com> Message-id: 20180814124254.5229-9-peter.maydell@linaro.org
* target/arm: Honour HCR_EL2.TGE when raising synchronous exceptionsPeter Maydell2018-08-141-0/+14
| | | | | | | | | | | | | | | Whene we raise a synchronous exception, if HCR_EL2.TGE is set then exceptions targeting NS EL1 must be redirected to EL2. Implement this in raise_exception() -- all synchronous exceptions go through this function. (Asynchronous exceptions go via arm_cpu_exec_interrupt(), which already honours HCR_EL2.TGE when it determines the target EL in arm_phys_excp_target_el().) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180724115950.17316-4-peter.maydell@linaro.org
* target/arm: Add pre-EL change hooksAaron Lindsay2018-04-261-0/+8
| | | | | | | | | | | | Because the design of the PMU requires that the counter values be converted between their delta and guest-visible forms for mode filtering, an additional hook which occurs before the EL is changed is necessary. Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org> Message-id: 1523997485-1905-8-git-send-email-alindsay@codeaurora.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* icount: fix cpu_restore_state_from_tb for non-tb-exit casesPavel Dovgalyuk2018-04-111-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In icount mode, instructions that access io memory spaces in the middle of the translation block invoke TB recompilation. After recompilation, such instructions become last in the TB and are allowed to access io memory spaces. When the code includes instruction like i386 'xchg eax, 0xffffd080' which accesses APIC, QEMU goes into an infinite loop of the recompilation. This instruction includes two memory accesses - one read and one write. After the first access, APIC calls cpu_report_tpr_access, which restores the CPU state to get the current eip. But cpu_restore_state_from_tb resets the cpu->can_do_io flag which makes the second memory access invalid. Therefore the second memory access causes a recompilation of the block. Then these operations repeat again and again. This patch moves resetting cpu->can_do_io flag from cpu_restore_state_from_tb to cpu_loop_exit* functions. It also adds a parameter for cpu_restore_state which controls restoring icount. There is no need to restore icount when we only query CPU state without breaking the TB. Restoring it in such cases leads to the incorrect flow of the virtual time. In most cases new parameter is true (icount should be recalculated). But there are two cases in i386 and openrisc when the CPU state is only queried without the need to break the TB. This patch fixes both of these cases. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Message-Id: <20180409091320.12504.35329.stgit@pasha-VirtualBox> [rth: Make can_do_io setting unconditional; move from cpu_exec; make cpu_loop_exit_{noexc,restore} call cpu_loop_exit.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Always set FAR to a known unknown value for debug exceptionsPeter Maydell2018-03-231-1/+10
| | | | | | | | | | | | | | | | | | | | For debug exceptions due to breakpoints or the BKPT instruction which are taken to AArch32, the Fault Address Register is architecturally UNKNOWN. We were using that as license to simply not set env->exception.vaddress, but this isn't correct, because it will expose to the guest whatever old value was in that field when arm_cpu_do_interrupt_aarch32() writes it to the guest IFSR. That old value might be a FAR for a previous guest EL2 or secure exception, in which case we shouldn't show it to an EL1 or non-secure exception handler. It might also be a non-deterministic value, which is bad for record-and-replay. Clear env->exception.vaddress before taking breakpoint debug exceptions, to avoid this minor information leak. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180320134114.30418-5-peter.maydell@linaro.org
* target/arm: Set FSR for BKPT, BRK when raising exceptionPeter Maydell2018-03-231-0/+2
| | | | | | | | | | | | | | | | Now that we have a helper function specifically for the BRK and BKPT instructions, we can set the exception.fsr there rather than in arm_cpu_do_interrupt_aarch32(). This allows us to use our new arm_debug_exception_fsr() helper. In particular this fixes a bug where we were hardcoding the short-form IFSR value, which is wrong if the target exception level has LPAE enabled. Fixes: https://bugs.launchpad.net/qemu/+bug/1756927 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180320134114.30418-4-peter.maydell@linaro.org
* target/arm: Factor out code to calculate FSR for debug exceptionsPeter Maydell2018-03-231-10/+2Star
| | | | | | | | | | | | | | | | | | | When a debug exception is taken to AArch32, it appears as a Prefetch Abort, and the Instruction Fault Status Register (IFSR) must be set. The IFSR has two possible formats, depending on whether LPAE is in use. Factor out the code in arm_debug_excp_handler() which picks an FSR value into its own utility function, update it to use arm_fi_to_lfsc() and arm_fi_to_sfsc() rather than hard-coded constants, and use the correct condition to select long or short format. In particular this fixes a bug where we could select the short format because we're at EL0 and the EL1 translation regime is not using LPAE, but then route the debug exception to EL2 because of MDCR_EL2.TDE and hand EL2 the wrong format FSR. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180320134114.30418-3-peter.maydell@linaro.org
* target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRKPeter Maydell2018-03-231-0/+8
| | | | | | | | | | | | | | | | The MDCR_EL2.TDE bit allows the exception level targeted by debug exceptions to be set to EL2 for code executing at EL0. We handle this in the arm_debug_target_el() function, but this is only used for hardware breakpoint and watchpoint exceptions, not for the exception generated when the guest executes an AArch32 BKPT or AArch64 BRK instruction. We don't have enough information for a translate-time equivalent of arm_debug_target_el(), so instead make BKPT and BRK call a special purpose helper which can do the routing, rather than the generic exception_with_syndrome helper. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180320134114.30418-2-peter.maydell@linaro.org
* Merge remote-tracking branch ↵Peter Maydell2018-01-261-2/+2
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'remotes/vivier/tags/m68k-for-2.12-pull-request' into staging # gpg: Signature made Thu 25 Jan 2018 15:15:03 GMT # gpg: using RSA key 0xF30C38BD3F2FBE3C # gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" # gpg: aka "Laurent Vivier <laurent@vivier.eu>" # gpg: aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" # Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F 5173 F30C 38BD 3F2F BE3C * remotes/vivier/tags/m68k-for-2.12-pull-request: target/m68k: add HMP command "info tlb" target/m68k: add pflush/ptest target/m68k: add moves target/m68k: add index parameter to gen_load()/gen_store() and Co. target/m68k: add Transparent Translation target/m68k: add MC68040 MMU accel/tcg: add size paremeter in tlb_fill() target/m68k: fix TCG variable double free Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * accel/tcg: add size paremeter in tlb_fill()Laurent Vivier2018-01-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MC68040 MMU provides the size of the access that triggers the page fault. This size is set in the Special Status Word which is written in the stack frame of the access fault exception. So we need the size in m68k_cpu_unassigned_access() and m68k_cpu_handle_mmu_fault(). To be able to do that, this patch modifies the prototype of handle_mmu_fault handler, tlb_fill() and probe_write(). do_unassigned_access() already includes a size parameter. This patch also updates handle_mmu_fault handlers and tlb_fill() of all targets (only parameter, no code change). Signed-off-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20180118193846.24953-2-laurent@vivier.eu>
* | target/arm: Use pointers in neon tbl helperRichard Henderson2018-01-251-10/+7Star
|/ | | | | | | | | | | | | | Rather than passing a regno to the helper, pass pointers to the vector register directly. This eliminates the need to pass in the environment pointer and reduces the number of places that directly access env->vfp.regs[]. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20180119045438.28582-5-richard.henderson@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Handle page table walk load failures correctlyPeter Maydell2018-01-161-6/+1Star
| | | | | | | | | | | | | | Instead of ignoring the response from address_space_ld*() (indicating an attempt to read a page table descriptor from an invalid physical address), use it to report the failure correctly. Since this is another couple of locations where we need to decide the value of the ARMMMUFaultInfo ea bit based on a MemTxResult, we factor out that operation into a helper function. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/*helper: don't check retaddr before calling cpu_restore_stateAlex Bennée2017-12-281-12/+6Star
| | | | | | | | | | | | | | | | | cpu_restore_state officially supports being passed an address it can't resolve the state for. As a result the checks in the helpers are superfluous and can be removed. This makes the code consistent with other users of cpu_restore_state. Of course this does nothing to address what to do if cpu_restore_state can't resolve the state but so far it seems this is handled elsewhere. The change was made with included coccinelle script. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> [rth: Fixed up comment indentation. Added second hunk to script to combine cpu_restore_state and cpu_loop_exit.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Remove fsr argument from get_phys_addr() and arm_tlb_fill()Peter Maydell2017-12-131-2/+1Star
| | | | | | | | | | | | All of the callers of get_phys_addr() and arm_tlb_fill() now ignore the FSR values they return, so we can just remove the argument entirely. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Stefano Stabellini <sstabellini@kernel.org> Message-id: 1512503192-2239-12-git-send-email-peter.maydell@linaro.org
* target/arm: Use ARMMMUFaultInfo in deliver_fault()Peter Maydell2017-12-131-57/+22Star
| | | | | | | | | | | | | | | | | Now that ARMMMUFaultInfo is guaranteed to have enough information to construct a fault status code, we can pass it in to the deliver_fault() function and let it generate the correct type of FSR for the destination, rather than relying on the value provided by get_phys_addr(). I don't think there are any cases the old code was getting wrong, but this is more obviously correct. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Stefano Stabellini <sstabellini@kernel.org> Message-id: 1512503192-2239-10-git-send-email-peter.maydell@linaro.org
* fix WFI/WFE length in syndrome registerStefano Stabellini2017-10-311-3/+4
| | | | | | | | | | | | | | | | | WFI/E are often, but not always, 4 bytes long. When they are, we need to set ARM_EL_IL_SHIFT in the syndrome register. Pass the instruction length to HELPER(wfi), use it to decrement pc appropriately and to pass an is_16bit flag to syn_wfx, which sets ARM_EL_IL_SHIFT if needed. Set dc->insn in both arm_tr_translate_insn and thumb_tr_translate_insn. Signed-off-by: Stefano Stabellini <sstabellini@kernel.org> Message-id: alpine.DEB.2.10.1710241055160.574@sstabellini-ThinkPad-X260 [PMM: move setting of dc->insn for Thumb so it is correct for 32 bit insns] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: check CF_PARALLEL instead of parallel_cpusEmilio G. Cota2017-10-241-7/+0Star
| | | | | | | | | Thereby decoupling the resulting translated code from the current state of the system. Reviewed-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* arm: Fix SMC reporting to EL2 when QEMU provides PSCIJan Kiszka2017-10-061-10/+17
| | | | | | | | | | | | | This properly forwards SMC events to EL2 when PSCI is provided by QEMU itself and, thus, ARM_FEATURE_EL3 is off. Found and tested with the Jailhouse hypervisor. Solution based on suggestions by Peter Maydell. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Message-id: 4f243068-aaea-776f-d18f-f9e05e7be9cd@siemens.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-12-18 12:04:36 +0100