aboutsummaryrefslogtreecommitdiff
path: root/target-arm
AgeCommit message (Collapse)Author
2016-05-19target-arm: make cpu-qom.h not target specificPaolo Bonzini
Make ARMCPU an opaque type within cpu-qom.h, and move all definitions of private methods, as well as all type definitions that require knowledge of the layout to cpu.h. This helps making files independent of NEED_CPU_H if they only need to pass around CPU pointers. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-19cpu: make cpu-qom.h only include-able from cpu.hPaolo Bonzini
Make cpu-qom.h so that it is only included from cpu.h. Then there is no need for it to include cpu.h again. Later we will make cpu-qom.h target independent and we will _want_ to include it from elsewhere, but for now reduce the number of cases to handle. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-05-12tcg: Allow goto_tb to any target PC in user modeSergey Fedorov
In user mode, there's only a static address translation, TBs are always invalidated properly and direct jumps are reset when mapping change. Thus the destination address is always valid for direct jumps and there's no need to restrict it to the pages the TB resides in. Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Signed-off-by: Sergey Fedorov <sergey.fedorov@linaro.org> Cc: Riku Voipio <riku.voipio@iki.fi> Cc: Blue Swirl <blauwirbel@gmail.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
2016-05-12tcg: Clean up direct block chaining safety checksSergey Fedorov
We don't take care of direct jumps when address mapping changes. Thus we must be sure to generate direct jumps so that they always keep valid even if address mapping changes. Luckily, we can only allow to execute a TB if it was generated from the pages which match with current mapping. Document tcg_gen_goto_tb() declaration and note the reason for destination PC limitations. Some targets with variable length instructions allow TB to straddle a page boundary. However, we make sure that both of TB pages match the current address mapping when looking up TBs. So it is safe to do direct jumps into the both pages. Correct the checks for some of those targets. Given that, we can safely patch a TB which spans two pages. Remove the unnecessary check in cpu_exec() and allow such TBs to be patched. Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Signed-off-by: Sergey Fedorov <sergey.fedorov@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
2016-05-12tb: consistently use uint32_t for tb->flagsEmilio G. Cota
We are inconsistent with the type of tb->flags: usage varies loosely between int and uint64_t. Settle to uint32_t everywhere, which is superior to both: at least one target (aarch64) uses the most significant bit in the u32, and uint64_t is wasteful. Compile-tested for all targets. Suggested-by: Laurent Desnogues <laurent.desnogues@gmail.com> Suggested-by: Richard Henderson <rth@twiddle.net> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com> Signed-off-by: Emilio G. Cota <cota@braap.org> Signed-off-by: Richard Henderson <rth@twiddle.net> Message-Id: <1460049562-23517-1-git-send-email-cota@braap.org>
2016-05-12target-arm: Avoid unnecessary TLB flush on TCR_EL2, TCR_EL3 writesPeter Maydell
The TCR_EL2 and TCR_EL3 regdefs were incorrectly using the vmsa_tcr_el1_write function for writes. Since these registers don't have the A1 bit that TCR_EL1 does, we don't need to do a tlb_flush() when they are written. Remove the unnecessary .writefn and also the harmless but unneeded .raw_writefn and .resetfn definitions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <sergey.fedorov@linaro.org>
2016-05-12ARM: Factor out ARM on/off PSCI control functionsJean-Christophe DUBOIS
Split ARM on/off function from PSCI support code. This will allow to reuse these functions in other code. Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12target-arm/translate-a64.c: Unify some of the ldst_reg decodingEdgar E. Iglesias
The various load/store variants under disas_ldst_reg can all reuse the same decoding for opc, size, rt and is_vector. This patch unifies the decoding in preparation for generating instruction syndromes for data aborts. This will allow us to reduce the number of places to hook in updates to the load/store state needed to generate the insn syndromes. No functional change. Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1461931684-1867-7-git-send-email-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12target-arm/translate-a64.c: Use extract32 in disas_ldst_reg_imm9Edgar E. Iglesias
Use extract32 instead of open coding the bit masking when decoding is_signed and is_extended. This streamlines the decoding with some of the other ldst variants. No functional change. Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1461931684-1867-6-git-send-email-edgar.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12target-arm: Split data abort syndrome generatorPeter Maydell
Split the data abort syndrome generator into two versions: One with a valid Instruction Specific Syndrome (ISS) and another without. The following new flags are supported by the syndrome generator with ISS: * isv - Instruction syndrome valid * sas - Syndrome access size * sse - Syndrome sign extend * srt - Syndrome register transfer * sf - Sixty-Four bit register width * ar - Acquire/Release These flags are not yet used, so this patch has no functional change except that we will now correctly set the IL bit in data abort syndromes without ISS information. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1461931684-1867-5-git-send-email-edgar.iglesias@gmail.com> [PMM: squashed in with patch which was just adding the IL bit] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12target-arm: Fix descriptor address masking in ARM address translationSergey Sorokin
There is a bug in ARM address translation regime with a long-descriptor format. On the descriptor reading its address is formed from an index which is a part of the input address. And on the first iteration this index is incorrectly masked with 'grainsize' mask. But it can be wider according to pseudo-code. On the other hand on the iterations other than first the descriptor address is formed from the previous level descriptor by masking with 'descaddrmask' value. It always clears just 12 lower bits, but it must clear 'grainsize' lower bits instead according to pseudo-code. The patch fixes both cases. Signed-off-by: Sergey Sorokin <afarallax@yandex.ru> Message-id: 1460996853-22117-1-git-send-email-afarallax@yandex.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-05-12target-arm: Stage 2 permission fault was fixed in AArch32 stateSergey Sorokin
As described in AArch32.CheckS2Permission an instruction fetch fails if XN bit is set or there is no read permission for the address. Signed-off-by: Sergey Sorokin <afarallax@yandex.ru> Message-id: 1461002400-3187-1-git-send-email-afarallax@yandex.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-04target-arm: Make the 64-bit version of VTCR do the migrationPeter Maydell
Move the ALIAS tag from VTCR_EL2 to VTCR so that we migrate the 64-bit version, as is usual. (This has no particular effect now unless the guest wrote to the high RES0 bits of VTCR_EL2.) Add a comment about why it's OK that we don't have the various accessor functions that the EL1 TCR regdefs do. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <sergey.fedorov@linaro.org> Message-id: 1459435778-5526-4-git-send-email-peter.maydell@linaro.org
2016-04-04target-arm: Remove incorrect ALIAS tags from ESR_EL2 and ESR_EL3Peter Maydell
The regdefs for the ESR_EL2 and ESR_EL3 system registers should not be marked as ARM_CP_ALIAS, because these are the master copies; the DFSR regdef in vmsa_pmsa_cp_reginfo[] is marked as an alias. Remove the ALIAS tags so that these registers are correctly migrated. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <sergey.fedorov@linaro.rog> Message-id: 1459435778-5526-3-git-send-email-peter.maydell@linaro.org
2016-04-04target-arm: Correctly reset SCTLR_EL3 for 64-bit CPUsPeter Maydell
The regdef for SCTRL_EL3 was incorrectly marked as being an ARM_CP_ALIAS, with the remark that this was because the 32-bit definition would take care of reset and migration. However the intention for banked registers as documented in the comment in add_cpreg_to_hashtable() is: * 2) If ARMv8 is enabled then we can count on a 64-bit version * taking care of the secure bank. This requires that separate * 32 and 64-bit definitions are provided. and so it marks the 32-bit secure banked version as an alias. This results in the sctlr_s/sctlr_el[3] field never being reset or migrated for a 64-bit CPU with EL3 enabled. Fix this by removing the ARM_CP_ALIAS annotation from SCTLR_EL3. Since this means it now needs a real reset value, move the regdef into the same place that we define the 32-bit SCTLR. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com> Reviewed-by: Sergey Fedorov <sergey.fedorov@linaro.org> Message-id: 1459435778-5526-2-git-send-email-peter.maydell@linaro.org
2016-03-30arm: implement query-gic-capabilitiesPeter Xu
For emulated GIC capabilities, currently only gicv2 is supported. We need to add gicv3 in when emulated gicv3 ready. For KVM accelerated ARM VM, we detect the capability bits by creating a scratch VM. Signed-off-by: Peter Xu <peterx@redhat.com> Acked-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1458788142-17509-5-git-send-email-peterx@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-30arm: enhance kvm_arm_create_scratch_host_vcpuPeter Xu
Support passing NULL for the first parameter (with the same effect as passing an empty array) and for the third parameter (meaning that we should not attempt to init the vcpu). Signed-off-by: Peter Xu <peterx@redhat.com> Acked-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1458788142-17509-3-git-send-email-peterx@redhat.com [PMM: tweaked commit message, comment] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-30arm: qmp: add query-gic-capabilities interfacePeter Xu
This patch add "query-gic-capabilities" but does not implement it. The command is ARM-only. The command will return a list of GICCapability structs that describes all GIC versions that current QEMU and system support. Libvirt is possibly the first consumer of this new command. Before this patch, a libvirt user can successfully configure all kinds of GIC devices for ARM guests, no matter whether current QEMU/kernel supports them. If the specified GIC version/type is not supported, the user will get an ambiguous "QEMU boot failure" error when trying to start the VM. This is not user-friendly. With this patch, libvirt should be able to query which type (and which version) of GIC device is supported. Using this information, libvirt can warn the user during configuration of guests when specified GIC device type is not supported. Or better, we can just list those versions that we support, and filter out the unsupported ones. For example, if we got the query result: {"return": [{"emulated": false, "version": 3, "kernel": true}, {"emulated": true, "version": 2, "kernel": false}]} then it means that we support emulated GIC version 2 using: qemu-system-aarch64 -M virt,accel=tcg,gic-version=2 ... or KVM-accelerated GIC version 3 using: qemu-system-aarch64 -M virt,accel=kvm,gic-version=3 ... If we specify other explicit GIC versions rather than the above, QEMU will not be able to boot. The community is working on a more generic way to query these kinds of information about valid values of machine properties. However, due to the importance of supporting this specific use case, weecided to first implement this ad-hoc one; then when the generic method is ready, we can move on to that one smoothly. Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Message-id: 1458788142-17509-2-git-send-email-peterx@redhat.com [PMM: tweaked commit message a bit; monitor.o is CONFIG_SOFTMMU only] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-22target-arm: dfilter support for in_asmAlex Bennée
Each individual architecture needs to use the qemu_log_in_addr_range() feature for enabling in_asm output as it is part of the frontend. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Richard Henderson <rth@twiddle.net> Message-Id: <1458052224-9316-9-git-send-email-alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-22util: move declarations out of qemu-common.hVeronia Bahaa
Move declarations out of qemu-common.h for functions declared in utils/ files: e.g. include/qemu/path.h for utils/path.c. Move inline functions out of qemu-common.h and into new files (e.g. include/qemu/bcd.h) Signed-off-by: Veronia Bahaa <veroniabahaa@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-22include/qemu/osdep.h: Don't include qapi/error.hMarkus Armbruster
Commit 57cb38b included qapi/error.h into qemu/osdep.h to get the Error typedef. Since then, we've moved to include qemu/osdep.h everywhere. Its file comment explains: "To avoid getting into possible circular include dependencies, this file should not include any other QEMU headers, with the exceptions of config-host.h, compiler.h, os-posix.h and os-win32.h, all of which are doing a similar job to this file and are under similar constraints." qapi/error.h doesn't do a similar job, and it doesn't adhere to similar constraints: it includes qapi-types.h. That's in excess of 100KiB of crap most .c files don't actually need. Add the typedef to qemu/typedefs.h, and include that instead of qapi/error.h. Include qapi/error.h in .c files that need it and don't get it now. Include qapi-types.h in qom/object.h for uint16List. Update scripts/clean-includes accordingly. Update it further to match reality: replace config.h by config-target.h, add sysemu/os-posix.h, sysemu/os-win32.h. Update the list of includes in the qemu/osdep.h comment quoted above similarly. This reduces the number of objects depending on qapi/error.h from "all of them" to less than a third. Unfortunately, the number depending on qapi-types.h shrinks only a little. More work is needed for that one. Signed-off-by: Markus Armbruster <armbru@redhat.com> [Fix compilation without the spice devel packages. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-03-16target-arm: Fix translation level on early translation faultsSergey Sorokin
Qemu reports translation fault on 1st level instead of 0th level in case of AArch64 address translation if the translation table walk is disabled or the address is in the gap between the two regions. Signed-off-by: Sergey Sorokin <afarallax@yandex.ru> Message-id: 1457527503-25958-1-git-send-email-afarallax@yandex.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-16target-arm: Implement MRS (banked) and MSR (banked) instructionsPeter Maydell
Starting with the ARMv7 Virtualization Extensions, the A32 and T32 instruction sets provide instructions "MSR (banked)" and "MRS (banked)" which can be used to access registers for a mode other than the current one: * R<m>_<mode> * ELR_hyp * SPSR_<mode> Implement the missing instructions. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1456762734-23939-1-git-send-email-peter.maydell@linaro.org
2016-03-04target-arm: Only trap SRS from S-EL1 if specified mode is MONRalf-Philipp Weinmann
Commit cbc0326b6fb9 caused SRS instructions executed from Secure EL1 to trap to EL3 even if the specified mode was not monitor mode. According to the ARMv8 Architecture reference manual [F6.1.203], ALL of the following conditions need to be met for SRS to trap to EL3: * It is executed at Secure PL1. * The specified mode is monitor mode. * EL3 is using AArch64. Correct the condition governing the trap to EL3 to check the specified mode. Signed-off-by: Ralf-Philipp Weinmann <ralf+devel@comsecuris.com> Message-id: 20160222224251.GA11654@beta.comsecuris.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: tweaked comment text to read 'specified mode'; edited commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: implement BE32 mode in system emulationPaolo Bonzini
System emulation only has a little-endian target; BE32 mode is implemented by adjusting the low bits of the address for every byte and halfword load and store. 64-bit accesses flip the low and high words. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [PC changes: * rebased against master (Jan 2016) ] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: implement setendPaolo Bonzini
Since this is not a high-performance path, just use a helper to flip the E bit and force a lookup in the hash table since the flags have changed. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: introduce tbflag for endiannessPeter Crosthwaite
Introduce a tbflags for endianness, set based upon the CPUs current endianness. This in turn propagates through to the disas endianness flag. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: a64: Add endianness supportPeter Crosthwaite
Set the dc->mo_endianness flag for AA64 and use it in all ldst ops. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: introduce disas flag for endiannessPaolo Bonzini
Introduce a disas flag for setting the CPU data endianness. This allows control of the endianness from the CPU state rather than hard-coding it to TARGET_WORDS_BIGENDIAN. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [ PC changes: * Split off as new patch from original: "target-arm: introduce tbflag for CPSR.E" * Wrote commit message from scratch ] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: pass DisasContext to gen_aa32_ld*/st*Paolo Bonzini
We'll need the DisasContext in the next patch to retrieve the desired endianness, so pass it as a whole to gen_aa32_ld*/st*. Unfortunately we cannot let those functions call get_mem_index, because of user-mode load/store instructions. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [ PC changes: * Fix long lines ] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: implement SCTLR.EEPeter Crosthwaite
Implement SCTLR.EE bit which controls data endianess for exceptions and page table translations. SCTLR.EE is mirrored to the CPSR.E bit on exception entry. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04linux-user: arm: handle CPSR.E correctly in strex emulationPaolo Bonzini
Now that CPSR.E is set correctly, prepare for when setend will be able to change it; bswap data in and out of strex manually by comparing SCTLR.B, CPSR.E and TARGET_WORDS_BIGENDIAN (we do not have the luxury of using TCGMemOps). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [ PC changes: * Moved SCTLR/CPSR logic to arm_cpu_data_is_big_endian ] Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04arm: cpu: handle BE32 user-mode as BEPeter Crosthwaite
endian with address manipulations on subword accesses (to give the illusion of BE). But user-mode cannot tell the difference and is already implemented as straight BE. So handle the difference in the endianess query, where USER mode is BE and system is not. Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: cpu: Move cpu_is_big_endian to headerPeter Crosthwaite
There is a CPU data endianness test that is used to drive the virtio_big_endian test. Move this up to the header so it can be more generally used for endian tests. The KVM specific cpu_syncronize_state call is left behind in the virtio specific function. Rename it arm_cpu-data_is_big_endian() to more accurately capture that this is for data accesses only. Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: implement SCTLR.B, drop bswap_codePaolo Bonzini
bswap_code is a CPU property of sorts ("is the iside endianness the opposite way round to TARGET_WORDS_BIGENDIAN?") but it is not the actual CPU state involved here which is SCTLR.B (set for BE32 binaries, clear for BE8). Replace bswap_code with SCTLR.B, and pass that to arm_ld*_code. The next patches will make data fetches honor both SCTLR.B and CPSR.E appropriately. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> [PC changes: * rebased on master (Jan 2016) * s/TARGET_USER_ONLY/CONFIG_USER_ONLY * Use bswap_code() for disas_set_info() instead of raw sctlr_b ] Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-03-04target-arm: Correct handling of writes to CPSR mode bits from gdb in usermodePeter Maydell
In helper.c the expression (env->uncached_cpsr & CPSR_M) != CPSR_USER is always true; the right hand side was supposed to be ARM_CPU_MODE_USR (an error in commit cb01d391). Since the incorrect expression was always true, this just meant that commit cb01d391 had no effect. However simply changing the RHS here would reveal a logic error: if the mode is USR we wish to completely ignore the attempt to set the mode bits, which means that we must clear the CPSR_M bits from mask to avoid the uncached_cpsr bits being updated at the end of the function. Move the condition into the correct place in the code, fix its RHS constant, and add a comment about the fact that we must be doing a gdbstub write if we're in user mode. Fixes: https://bugs.launchpad.net/qemu/+bug/1550503 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1456764438-30015-1-git-send-email-peter.maydell@linaro.org
2016-03-01tcg: Add type for vCPU pointersLluís Vilanova
Adds the 'TCGv_env' type for pointers to 'CPUArchState' objects. The tracing infrastructure later needs to differentiate between regular pointers and pointers to vCPUs. Also changes all targets to use the new 'TCGv_env' type instead of the generic 'TCGv_ptr'. As of now, the change is merely cosmetic ('TCGv_env' translates into 'TCGv_ptr'), but that could change in the future to enforce the difference. Note that a 'TCGv_env' type (for 'CPUState') is not added, since all helpers currently receive the architecture-specific pointer ('CPUArchState'). Signed-off-by: Lluís Vilanova <vilanova@ac.upc.edu> Acked-by: Richard Henderson <rth@twiddle.net> Message-id: 145641859552.30295.7821536833590725201.stgit@localhost Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2016-02-26target-arm: Make reserved ranges in ID_AA64* spaces RAZ, not UNDEFPeter Maydell
The v8 ARM ARM defines that unused spaces in the ID_AA64* system register ranges are Reserved and must RAZ, rather than being UNDEF. Implement this. In particular, ARM v8.2 adds a new feature register ID_AA64MMFR2, and newer versions of the Linux kernel will attempt to read this, which causes them not to boot up on versions of QEMU missing this fix. Since the encoding .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6 is actually defined in ARMv8 (as ID_MMFR4), we give it an entry in the ARMCPU struct so CPUs can override it, though since none do this too will just RAZ. Cc: qemu-stable@nongnu.org Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1455890863-11203-1-git-send-email-peter.maydell@linaro.org Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org>
2016-02-26target-arm: Mark CNTHP_TVAL_EL2 as ARM_CP_NO_RAWEdgar E. Iglesias
Mark CNTHP_TVAL_EL2 as ARM_CP_NO_RAW due to the register not having any underlying state. This fixes an issue with booting KVM enabled kernels when EL2 is on. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1456490739-19343-1-git-send-email-edgar.iglesias@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-26target-arm: Implement MDCR_EL3.TPM and MDCR_EL2.TPM trapsPeter Maydell
Implement the performance monitor register traps controlled by MDCR_EL3.TPM and MDCR_EL2.TPM. Most of the performance registers already have an access function to deal with the user-enable bit, and the TPM checks can be added there. We also need a new access function which only implements the TPM checks for use by the few not-EL0-accessible registers and by PMUSERENR_EL0 (which is always EL0-readable). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1455892784-11328-3-git-send-email-peter.maydell@linaro.org Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Acked-by: Alistair Francis <alistair.francis@xilinx.com>
2016-02-26target-arm: Fix handling of SDCR for 32-bit codePeter Maydell
Fix two issues with our implementation of the SDCR: * it is only present from ARMv8 onwards * it does not contain several of the trap bits present in its 64-bit counterpart the MDCR_EL3 Put the register description in the right place so that it does not get enabled for ARMv7 and earlier, and give it a write function so that we can mask out the bits which should not be allowed to have an effect if EL3 is 32-bit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1455892784-11328-2-git-send-email-peter.maydell@linaro.org Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Acked-by: Alistair Francis <alistair.francis@xilinx.com>
2016-02-26target-arm: Make Monitor->NS PL1 mode changes illegal if HCR.TGE is 1Peter Maydell
If HCR.TGE is 1 then mode changes via CPS and MSR from Monitor to NonSecure PL1 modes are illegal mode changes. Implement this check in bad_mode_switch(). (We don't currently implement HCR.TGE, but this is the only missing check from the v8 ARM ARM G1.9.3 and so it's worth adding now; the rest of the HCR.TGE checks can be added later as necessary.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-12-git-send-email-peter.maydell@linaro.org
2016-02-26target-arm: Make mode switches from Hyp via CPS and MRS illegalPeter Maydell
Mode switches from Hyp to any other mode via the CPS and MRS instructions are illegal mode switches (though obviously switching via exception return is valid). Add this check to bad_mode_switch(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-11-git-send-email-peter.maydell@linaro.org
2016-02-26target-arm: In v8, make illegal AArch32 mode changes set PSTATE.ILPeter Maydell
In v8, the illegal mode changes which are UNPREDICTABLE in v7 are given architected behaviour: * the mode field is unchanged * PSTATE.IL is set (so any subsequent instructions will UNDEF) * any other CPSR fields are written to as normal This is pretty much the same behaviour we picked for our UNPREDICTABLE handling, with the exception that for v8 we need to set the IL bit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-10-git-send-email-peter.maydell@linaro.org
2016-02-26target-arm: Forbid mode switch to Mon from Secure EL1Peter Maydell
In v8 trying to switch mode to Mon from Secure EL1 is an illegal mode switch. (In v7 this is impossible as all secure modes except User are at EL3.) We can handle this case by making a switch to Mon valid only if the current EL is 3, which then gives the correct answer whether EL3 is AArch32 or AArch64. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-9-git-send-email-peter.maydell@linaro.org
2016-02-26target-arm: Add Hyp mode checks to bad_mode_switch()Peter Maydell
We don't actually support Hyp mode yet, but add the correct checks for it to the bad_mode_switch() function for completeness. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-8-git-send-email-peter.maydell@linaro.org
2016-02-26target-arm: Add comment about not implementing NSACR.RFRPeter Maydell
QEMU doesn't implement the NSACR.RFR bit, which is a permitted IMPDEF in choice in ARMv7 and the only permitted choice in ARMv8. Add a comment to bad_mode_switch() to note that this is why FIQ is always a valid mode regardless of the CPU's Secure state. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-7-git-send-email-peter.maydell@linaro.org
2016-02-26target-arm: In cpsr_write() ignore mode switches from User modePeter Maydell
The only case where we can attempt a cpsr_write() mode switch from User is from the gdbstub; all other cases are handled in the calling code (notably translate.c). Architecturally attempts to alter the mode bits from user mode are simply ignored (and not treated as a bad mode switch, which in v8 sets CPSR.IL). Make mode switches from User ignored in cpsr_write() as well, for consistency. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-6-git-send-email-peter.maydell@linaro.org
2016-02-26target-arm: Raw CPSR writes should skip checks and bank switchingPeter Maydell
Raw CPSR writes should skip the architectural checks for whether we're allowed to set the A or F bits and should also not do the switching of register banks if the mode changes. Handle this inside cpsr_write(), which allows us to drop the "manually set the mode bits to avoid the bank switch" code from all the callsites which are using CPSRWriteRaw. This fixes a bug in 32-bit KVM handling where we had forgotten the "manually set the mode bits" part and could thus potentially trash the register state if the mode from the last exit to userspace differed from the mode on this exit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-4-git-send-email-peter.maydell@linaro.org
2016-02-26target-arm: Add write_type argument to cpsr_write()Peter Maydell
Add an argument to cpsr_write() to indicate what kind of CPSR write is being requested, since the exact behaviour should differ for the different cases. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1455556977-3644-3-git-send-email-peter.maydell@linaro.org