summaryrefslogtreecommitdiff
path: root/target-arm
AgeCommit message (Collapse)AuthorFilesLines
2015-04-01target-arm: kvm64 fix save/restore of SPSR regsAlex Bennée1-2/+27
The current code was negatively indexing the cpu state array and not synchronizing banked spsr register state with the current mode's spsr state, causing occasional failures with migration. Some munging is done to take care of the aarch64 mapping and also to ensure the most current value of the spsr is updated to the banked registers (relevant for KVM<->TCG migration). Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-01target-arm: kvm64 sync FP register stateAlex Bennée1-3/+82
For migration to work we need to sync all of the register state. This is especially noticeable when GCC starts using FP registers as spill registers even with integer programs. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-01target-arm: kvm: save/restore mp stateAlex Bennée4-0/+69
This adds the saving and restore of the current Multi-Processing state of the machine. While the KVM_GET/SET_MP_STATE API exposes a number of potential states for x86 we only use two for ARM. Either the process is running or not. We then save this state into the cpu_powered TCG state to avoid changing the serialisation format. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-04-01target-arm: Store SPSR_EL1 state in banked_spsr[1] (SPSR_svc)Peter Maydell3-3/+6
The AArch64 SPSR_EL1 register is architecturally mandated to be mapped to the AArch32 SPSR_svc register. This means its state should live in QEMU's env->banked_spsr[1] field. Correct the various places in the code that incorrectly put it in banked_spsr[0]. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-16target-arm: Ignore low bit of PC in M-profile exception returnPeter Maydell1-0/+10
For the ARM M-profile cores, exception return pops various registers including the PC from the stack. The architecture defines that if the lowest bit in the new PC value is set (ie the PC is not halfword aligned) then behaviour is UNPREDICTABLE. In practice hardware implementations seem to simply ignore the low bit, and some buggy RTOSes incorrectly rely on this. QEMU's behaviour was architecturally permitted, but bringing QEMU into line with the hardware behaviour allows more guest code to run. We log the situation as a guest error. This was reported as LP:1428657. Reported-by: Anders Esbensen <anders@lyes.dk> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-16target-arm: Fix handling of STM (user) with r15 in register listPeter Maydell1-6/+12
The A32 encoding of LDM distinguishes LDM (user) from LDM (exception return) based on whether r15 is in the register list. However for STM (user) there is no equivalent distinction. We were incorrectly treating "r15 in list" as indicating exception return for both LDM and STM, with the result that an STM (user) involving r15 went into an infinite loop. Fix this; note that the value stored for r15 in this case is the current PC regardless of our current mode. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1426015125-5521-1-git-send-email-peter.maydell@linaro.org
2015-03-16target-arm: get_phys_addr_lpae: more xn controlAndrew Jones1-30/+100
This patch makes the following changes to the determination of whether an address is executable, when translating addresses using LPAE. 1. No longer assumes that PL0 can't execute when it can't read. It can in AArch64, a difference from AArch32. 2. Use va_size == 64 to determine we're in AArch64, rather than arm_feature(env, ARM_FEATURE_V8), which is insufficient. 3. Add additional XN determinants - NS && is_secure && (SCR & SCR_SIF) - WXN && (prot & PAGE_WRITE) - AArch64: (prot_PL0 & PAGE_WRITE) - AArch32: UWXN && (prot_PL0 & PAGE_WRITE) - XN determination should also work in secure mode (untested) - XN may even work in EL2 (currently impossible to test) 4. Cleans up the bloated PAGE_EXEC condition - by removing it. The helper get_S1prot is introduced. It may even work in EL2, when support for that comes, but, as the function name implies, it only works for stage 1 translations. Signed-off-by: Andrew Jones <drjones@redhat.com> Message-id: 1426099139-14463-4-git-send-email-drjones@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-16target-arm: fix get_phys_addr_v6/SCTLR_AFE access checkAndrew Jones1-7/+42
Introduce simple_ap_to_rw_prot(), which has the same behavior as ap_to_rw_prot(), but takes the 2-bit simple AP[2:1] instead of the 3-bit AP[2:0]. Use this in get_phys_addr_v6 when SCTLR_AFE is set, as that bit indicates we should be using the simple AP format. It's unlikely this path is getting used. I don't see CR_AFE getting used by Linux, so possibly not. If it had been, then the check would have been wrong for all but AP[2:1] = 0b11. Anyway, this should fix it up, in case it ever does get used. Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1426099139-14463-3-git-send-email-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-16target-arm: convert check_ap to ap_to_rw_protAndrew Jones1-30/+19
Instead of mixing access permission checking with access permissions to page protection flags translation, just do the translation, and leave it to the caller to check the protection flags against the access type. Also rename to ap_to_rw_prot to better describe the new behavior. Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1426099139-14463-2-git-send-email-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-13tcg: Change translator-side labels to a pointerRichard Henderson3-19/+19
This is improved type checking for the translators -- it's no longer possible to accidentally swap arguments to the branch functions. Note that the code generating backends still manipulate labels as int. With notable exceptions, the scope of the change is just a few lines for each target, so it's not worth building extra machinery to do this change in per-target increments. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com> Cc: Michael Walle <michael@walle.cc> Cc: Leon Alrae <leon.alrae@imgtec.com> Cc: Anthony Green <green@moxielogic.com> Cc: Jia Liu <proljc@gmail.com> Cc: Alexander Graf <agraf@suse.de> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Blue Swirl <blauwirbel@gmail.com> Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2015-03-12Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into stagingPeter Maydell1-1/+1
misc fixes and cleanups A bunch of fixes all over the place, some of the bugs fixed are actually regressions. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # gpg: Signature made Wed Mar 11 17:48:30 2015 GMT using RSA key ID D28D5469 # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * remotes/mst/tags/for_upstream: (25 commits) virtio-scsi: remove empty wrapper for cmd virtio-scsi: clean out duplicate cdb field virtio-scsi: fix cdb/sense size uapi/virtio_scsi: allow overriding CDB/SENSE size virtio-scsi: drop duplicate CDB/SENSE SIZE exec: don't include hw/boards for linux-user acpi: specify format for build_append_namestring MAINTAINERS: drop aliguori@amazon.com tpm: Move memory subregion function into realize function virtio-pci: Convert to realize() pci: Convert pci_nic_init() to Error to avoid qdev_init() machine: query mem-merge machine property machine: query dump-guest-core machine property hw/boards: make it safe to include for linux-user machine: query phandle-start machine property machine: query kvm-shadow-mem machine property kvm: add machine state to kvm_arch_init machine: query kernel-irqchip property machine: allowed/required kernel-irqchip support machine: replace qemu opts with iommu property ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-11kvm: add machine state to kvm_arch_initMarcel Apfelbaum1-1/+1
Needed to query machine's properties. Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
2015-03-11Merge remote-tracking branch ↵Peter Maydell1-0/+1
'remotes/pmaydell/tags/pull-target-arm-20150311' into staging target-arm queue: * fix a bug in bitops.h * implement SD card support on integratorcp * add a missing 'compatible' property for Cortex-A57 * add Netduino 2 machine model * fix command line parsing bug for CPU options with multiple CPUs # gpg: Signature made Wed Mar 11 14:14:22 2015 GMT using RSA key ID 14360CDE # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" * remotes/pmaydell/tags/pull-target-arm-20150311: bitops.h: sextract64() return type should be int64_t, not uint64_t integrator/cp: Implement CARDIN and WPROT signals integrator/cp: Model CP control registers as sysbus device target-arm: Add missing compatible property to A57 netduino2: Add the Netduino 2 Machine stm32f205: Add the stm32f205 SoC stm32f2xx_SYSCFG: Add the stm32f2xx SYSCFG stm32f2xx_USART: Add the stm32f2xx USART Controller stm32f2xx_timer: Add the stm32f2xx Timer hw/arm/virt: fix cmdline parsing bug with CPU options and smp > 1 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-11target-arm: Add missing compatible property to A57Ryota Ozaki1-0/+1
Signed-off-by: Ryota Ozaki <ozaki.ryota@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 1424097799-11002-1-git-send-email-ozaki.ryota@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-10cpu: Make cpu_init() return QOM CPUState objectEduardo Habkost1-8/+1
Instead of making cpu_init() return CPUArchState, return CPUState. Changes were made using the Coccinelle semantic patch below. @@ typedef CPUState; identifier e; expression args; type CPUArchState; @@ - e = + cpu = cpu_init(args); - if (!e) { + if (!cpu) { ... } - cpu = ENV_GET_CPU(env); + e = cpu->env_ptr; @@ identifier new_env, new_cpu, env, cpu; type CPUArchState; expression args; @@ -{ - CPUState *cpu = ENV_GET_CPU(env); - CPUArchState *new_env = cpu_init(args); - CPUState *new_cpu = ENV_GET_CPU(new_env); +{ + CPUState *cpu = ENV_GET_CPU(env); + CPUState *new_cpu = cpu_init(args); + CPUArchState *new_env = new_cpu->env_ptr; ... } @@ identifier c, cpu_init_func, cpu_model; type StateType, CPUType; @@ -static inline StateType* cpu_init(const char *cpu_model) -{ - CPUType *c = cpu_init_func(cpu_model); ( - if (c == NULL) { - return NULL; - } - return &c->env; | - if (c) { - return &c->env; - } - return NULL; ) -} +#define cpu_init(cpu_model) CPU(cpu_init_func(cpu_model)) @@ identifier cpu_init_func; identifier model; @@ -#define cpu_init(model) (&cpu_init_func(model)->env) +#define cpu_init(model) CPU(cpu_init_func(model)) Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Cc: Blue Swirl <blauwirbel@gmail.com> Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Cc: Riku Voipio <riku.voipio@iki.fi> Cc: Richard Henderson <rth@twiddle.net> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Michael Walle <michael@walle.cc> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Leon Alrae <leon.alrae@imgtec.com> Cc: Anthony Green <green@moxielogic.com> Cc: Jia Liu <proljc@gmail.com> Cc: Alexander Graf <agraf@suse.de> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Max Filippov <jcmvbkbc@gmail.com> [AF: Fixed up cpu_copy() manually] Signed-off-by: Andreas Färber <afaerber@suse.de>
2015-02-13Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150212' into stagingPeter Maydell2-14/+6
Convert to linked list. # gpg: Signature made Fri 13 Feb 2015 05:40:41 GMT using RSA key ID 4DD0279B # gpg: Good signature from "Richard Henderson <rth7680@gmail.com>" # gpg: aka "Richard Henderson <rth@redhat.com>" # gpg: aka "Richard Henderson <rth@twiddle.net>" * remotes/rth/tags/pull-tcg-20150212: tcg: Remove unused opcodes tcg: Implement insert_op_before tcg: Remove opcodes instead of noping them out tcg: Put opcodes in a linked list tcg: Introduce tcg_op_buf_count and tcg_op_buf_full tcg: Move emit of INDEX_op_end into gen_tb_end tcg: Reduce ifdefs in tcg-op.c tcg: Move some opcode generation functions out of line Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-13target-arm: A64: Avoid signed shifts in disas_ldst_pair()Peter Maydell1-1/+1
Avoid shifting potentially negative signed offset values in disas_ldst_pair() by keeping the offset in a uint64_t rather than an int64_t. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1423233250-15853-5-git-send-email-peter.maydell@linaro.org
2015-02-13target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addrPeter Maydell1-2/+3
Shifting a negative integer left is undefined behaviour in C. Avoid it by assembling and shifting the offset fields as unsigned values and then sign extending as the final action. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1423233250-15853-4-git-send-email-peter.maydell@linaro.org
2015-02-13target-arm: A64: Fix handling of rotate in logic_imm_decode_wmaskPeter Maydell1-1/+4
The code in logic_imm_decode_wmask attempts to rotate a mask value within the bottom 'e' bits of the value with mask = (mask >> r) | (mask << (e - r)); This has two issues: * if the element size is 64 then a rotate by zero results in a shift left by 64, which is undefined behaviour * if the element size is smaller than 64 then this will leave junk in the value at bit 'e' and above, which is not valid input to bitfield_replicate(). As it happens, the bits at bit 'e' to '2e - r' are exactly the ones which bitfield_replicate is going to copy in there, so this isn't a "wrong code generated" bug, but it's confusing and if we ever put an assert in bitfield_replicate it would fire on valid guest code. Fix the former by not doing anything if r is zero, and the latter by masking with bitmask64(e). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1423233250-15853-3-git-send-email-peter.maydell@linaro.org
2015-02-13target-arm: A64: Fix shifts into sign bitPeter Maydell1-3/+3
Fix attempts to shift into the sign bit of an int, which is undefined behaviour in C and warned about by the clang sanitizer. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1423233250-15853-2-git-send-email-peter.maydell@linaro.org
2015-02-13target-arm: Add AArch32 guest support to KVM64Greg Bellows1-3/+33
Add 32-bit to/from 64-bit register synchronization on register gets and puts. Set EL1_32BIT feature flag passed to KVM Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Message-id: 1423736974-14254-5-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-13target-arm: Add 32/64-bit register syncGreg Bellows4-8/+216
Add AArch32 to AArch64 register sychronization functions. Replace manual register synchronization with new functions in aarch64_cpu_do_interrupt() and HELPER(exception_return)(). Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1423736974-14254-4-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-13target-arm: Add CPU property to disable AArch64Greg Bellows2-1/+43
Adds registration and get/set functions for enabling/disabling the AArch64 execution state on AArch64 CPUs. By default AArch64 execution state is enabled on AArch64 CPUs, setting the property to off, will disable the execution state. The below QEMU invocation would have AArch64 execution state disabled. $ ./qemu-system-aarch64 -machine virt -cpu cortex-a57,aarch64=off Also adds stripping of features from CPU model string in acquiring the ARM CPU by name. Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1423736974-14254-2-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-12tcg: Introduce tcg_op_buf_count and tcg_op_buf_fullRichard Henderson2-12/+6
The method by which we count the number of ops emitted is going to change. Abstract that away into some inlines. Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2015-02-12tcg: Move emit of INDEX_op_end into gen_tb_endRichard Henderson2-2/+0
Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
2015-02-05target-arm: fix for exponent comparison in recpe_f64Ildar Isaev1-1/+1
f64 exponent in HELPER(recpe_f64) should be compared to 2045 rather than 1023 (FPRecipEstimate in ARMV8 spec). This fixes incorrect underflow handling when flushing denormals to zero in the FRECPE instructions operating on 64-bit values. Signed-off-by: Ildar Isaev <ild@inbox.ru> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-05target-arm: Guest cpu endianness determination for virtio KVM ARM/ARM64Pranavkumar Sawargaonkar2-0/+26
This patch implements a fucntion pointer "virtio_is_big_endian" from "CPUClass" structure for arm/arm64. Function arm_cpu_is_big_endian() is added to determine and return the guest cpu endianness to virtio. This is required for running cross endian guests with virtio on ARM/ARM64. Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org> Message-id: 1423130382-18640-3-git-send-email-pranavkumar@linaro.org [PMM: check CPSR_E in env->cpsr_uncached, not env->pstate.] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-05target-arm: KVM64: Get and Sync up guest register state like kvm32.Pranavkumar Sawargaonkar1-1/+12
This patch adds: 1. Call write_kvmstate_to_list() and write_list_to_cpustate() in kvm_arch_get_registers() to sync guest register state. 2. Call write_list_to_kvmstate() in kvm_arch_put_registers() to sync guest register state. These changes are already there for kvm32 in target-arm/kvm32.c. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org> Message-id: 1423130382-18640-2-git-send-email-pranavkumar@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-05target-arm: Fix brace style in reindented codePeter Maydell1-13/+23
This patch fixes the brace style in the code reindented in the previous commit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2015-02-05target-arm: Reindent ancient page-table-walk codePeter Maydell1-96/+96
A few of the oldest parts of the page-table-walk code have broken indent (either hardcoded tabs or two-spaces). Reindent these sections. For ease of review, this patch does not touch the brace style and so is a whitespace-only change. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2015-02-05target-arm: Use mmu_idx in get_phys_addr()Peter Maydell1-51/+163
Now we have the mmu_idx in get_phys_addr(), use it correctly to determine the behaviour of virtual to physical address translations, rather than using just an is_user flag and the current CPU state. Some TODO comments have been added to indicate where changes will need to be made to add EL2 and 64-bit EL3 support. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
2015-02-05target-arm: Pass mmu_idx to get_phys_addr()Peter Maydell1-14/+96
Make all the callers of get_phys_addr() pass it the correct mmu_idx rather than just a simple "is_user" flag. This includes properly decoding the AT/ATS system instructions; we include the logic for handling all the opc1/opc2 cases because we'll need them later for supporting EL2/EL3, even if we don't have the regdef stanzas yet. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2015-02-05target-arm: Split AArch64 cases out of ats_write()Peter Maydell1-7/+26
Instead of simply reusing ats_write() as the handler for both AArch32 and AArch64 address translation operations, use a different function for each with the common code in a third function. This is necessary because the semantics for selecting the right translation regime are different; we are only getting away with sharing currently because we don't support EL2 and only support EL3 in AArch32. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2015-02-05target-arm: Don't define any MMU_MODE*_SUFFIXesPeter Maydell1-2/+0
target-arm doesn't use any of the MMU-mode specific cpu ldst accessor functions. Suppress their generation by not defining any of the MMU_MODE*_SUFFIX macros. ("user" and "kernel" are too simplistic as descriptions of indexes 0 and 1 anyway.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
2015-02-05target-arm: Use correct mmu_idx for unprivileged loads and storesPeter Maydell2-3/+42
The MMU index to use for unprivileged loads and stores is more complicated than we currently implement: * for A64, it should be "if at EL1, access as if EL0; otherwise access at current EL" * for A32/T32, it should be "if EL2, UNPREDICTABLE; otherwise access as if at EL0". In both cases, if we want to make the access for Secure EL0 this is not the same mmu_idx as for Non-Secure EL0. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
2015-02-05target-arm: Define correct mmu_idx values and pass them in TB flagsPeter Maydell5-29/+102
We currently claim that for ARM the mmu_idx should simply be the current exception level. However this isn't actually correct -- secure EL0 and EL1 should have separate indexes from non-secure EL0 and EL1 since their VA->PA mappings may differ. We also will want an index for stage 2 translations when we properly support EL2. Define and document all seven mmu index values that we require, and pass the mmu index in the TB flags rather than exception level or priv/user bit. This change doesn't update the get_phys_addr() code, so our page table walking still assumes a simplistic "user or priv?" model for the moment. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> --- This leaves some odd gaps in the TB flags usage. I will circle back and clean this up later (including moving the other common flags like the singlestep ones to the top of the flags word), but I didn't want to bloat this patchseries further.
2015-02-05target-arm/translate-a64: Fix wrong mmu_idx usage for LDT/STTPeter Maydell1-1/+1
The LDT/STT (load/store unprivileged) instruction decode was using the wrong MMU index value. This meant that instead of these insns being "always access as if user-mode regardless of current privilege" they were "always access as if kernel-mode regardless of current privilege". This went unnoticed because AArch64 Linux doesn't use these instructions. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> --- I'm not counting this as a security issue because I'm assuming nobody treats TCG guests as a security boundary (certainly I would not recommend doing so...)
2015-02-05target-arm: Make arm_current_el() return sensible values for M profilePeter Maydell1-0/+4
Although M profile doesn't have the same concept of exception level as A profile, it does have a notion of privileged versus not, which we currently track in the privmode TB flag. Support returning this information if arm_current_el() is called on an M profile core, so that we can identify the correct MMU index to use (and put the MMU index in the TB flags) without having to special-case M profile. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
2015-02-05target-arm: check that LSB <= MSB in BFI instructionKirill Batuzov1-0/+4
The documentation states that if LSB > MSB in BFI instruction behaviour is unpredictable. Currently QEMU crashes because of assertion failure in this case: tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed. While assertion failure may meet the "unpredictable" definition this behaviour is undesirable because it allows an unprivileged guest program to crash the emulator with the OS and other programs. This patch addresses the issue by throwing illegal instruction exception if LSB > MSB. Only ARM decoder is affected because Thumb decoder already has this check in place. To reproduce issue run the following program int main(void) { asm volatile (".long 0x07c00c12" :: ); return 0; } compiled with gcc -marm -static badop_arm.c -o badop_arm Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-05target-arm: Squash input denormals in FRECPS and FRSQRTSPeter Maydell1-0/+12
The helper functions for FRECPS and FRSQRTS have special case handling that includes checks for zero inputs, so squash input denormals if necessary before those checks. This fixes incorrect output when the FPCR DZ bit is set to enable squashing of input denormals. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
2015-02-05Fix FMULX not squashing denormalized inputs when FZ is set.Xiangyu Hu1-0/+6
While FMULX returns a 2.0f float when two operators are infinity and zero, those operators should be unpacked from raw inputs first. Inconsistent cases would occur when operators are denormalized floats in flush-to-zero mode. A wrong codepath will be entered and 2.0f will not be returned without this patch. Fix by checking whether inputs need to be flushed before running into different codepaths. Signed-off-by: Xiangyu Hu <libhu.so@gmail.com> Message-id: 1422459650-12490-1-git-send-email-libhu.so@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-05target-arm: Add checks that cpreg raw accesses are handledPeter Maydell1-0/+31
Add assertion checking when cpreg structures are registered that they either forbid raw-access attempts or at least make an attempt at handling them. Also add an assert in the raw-accessor-of-last-resort, to avoid silently doing a read or write from offset zero, which is actually AArch32 CPU register r0. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1422282372-13735-3-git-send-email-peter.maydell@linaro.org Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
2015-02-05target-arm: Split NO_MIGRATE into ALIAS and NO_RAWPeter Maydell2-108/+117
We currently mark ARM coprocessor/system register definitions with the flag ARM_CP_NO_MIGRATE for two different reasons: 1) register is an alias on to state that's also visible via some other register, and that other register is the one responsible for migrating the state 2) register is not actually state at all (for instance the TLB or cache maintenance operation "registers") and it makes no sense to attempt to migrate it or otherwise access the raw state This works fine for identifying which registers should be ignored when performing migration, but we also use the same functions for synchronizing system register state between QEMU and the kernel when using KVM. In this case we don't want to try to sync state into registers in category 2, but we do want to sync into registers in category 1, because the kernel might have picked a different one of the aliases as its choice for which one to expose for migration. (In particular, on 32 bit hosts the kernel will expose the state in the AArch32 version of the register, but TCG's convention is to mark the AArch64 version as the version to migrate, even if the CPU being emulated happens to be 32 bit, so almost all system registers will hit this issue now that we've added AArch64 system emulation.) Fix this by splitting the NO_MIGRATE flag in two (ALIAS and NO_RAW) corresponding to the two different reasons we might not want to migrate a register. When setting up the TCG list of registers to migrate we honour both flags; when populating the list from KVM, only ignore registers which are NO_RAW. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> Message-id: 1422282372-13735-2-git-send-email-peter.maydell@linaro.org [PMM: changed ARM_CP_NO_MIGRATE to ARM_CP_ALIAS on new SP_EL1 and SP_EL2 reginfo stanzas since there was a (semantic) merge conflict with the patchset that added those]
2015-02-05target-arm: Add missing SP_ELx register definitionGreg Bellows1-0/+8
Added CP register definitions for SP_EL1 and SP_EL2. Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1422029835-4696-5-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-05target-arm: Change reset to highest available ELGreg Bellows1-1/+8
Update to arm_cpu_reset() to reset into the highest available exception level based on the set ARM features. Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1422029835-4696-4-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-05target-arm: Add extended RVBAR supportGreg Bellows1-6/+25
Added RVBAR_EL2 and RVBAR_EL3 CP register support. All RVBAR_EL# registers point to the same location and only the highest EL version exists at any one time. Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1422029835-4696-3-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-05target-arm: Fix RVBAR_EL1 register encodingGreg Bellows1-1/+1
Fix the RVBAR_EL1 CP register opc2 encoding from 2 to 1 Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1422029835-4696-2-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-26vmstate: accept QEMUTimer in VMSTATE_TIMER*, add VMSTATE_TIMER_PTR*Paolo Bonzini1-2/+2
Old users of VMSTATE_TIMER* are mechanically changed to VMSTATE_TIMER_PTR variants. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-01-20exec.c: Drop TARGET_HAS_ICE define and checksPeter Maydell1-2/+0
The TARGET_HAS_ICE #define is intended to indicate whether a target-* guest CPU implementation supports the breakpoint handling. However, all our guest CPUs have that support (the only two which do not define TARGET_HAS_ICE are unicore32 and openrisc, and in both those cases the bp support is present and the lack of the #define is just a bug). So remove the #define entirely: all new guest CPU support should include breakpoint handling as part of the basic implementation. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-id: 1420484960-32365-1-git-send-email-peter.maydell@linaro.org
2015-01-16target-arm: crypto: fix BE host supportArd Biesheuvel1-51/+63
The crypto emulation code in target-arm/crypto_helper.c never worked correctly on big endian hosts, due to the fact that it uses a union of array types to convert between the native VFP register size (64 bits) and the types used in the algorithms (bytes and 32 bit words) We cannot just swab between LE and BE when reading and writing the registers, as the SHA code performs word additions, so instead, add array accessors for the CRYPTO_STATE type whose LE and BE specific implementations ensure that the correct array elements are referenced. Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Acked-by: Laszlo Ersek <lersek@redhat.com> Message-id: 1420208303-24111-1-git-send-email-ard.biesheuvel@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>