summary refs log tree commit diff stats
path: root/target/arm/helper.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* target/arm: Mark up sysregs for HFGRTR bits 24..35Peter Maydell2023-02-031-0/+14
| | | | | | | | | | | Mark up the sysreg definitions for the registers trapped by HFGRTR/HFGWTR bits 24..35. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Fuad Tabba <tabba@google.com> Message-id: 20230130182459.3309057-13-peter.maydell@linaro.org Message-id: 20230127175507.2895013-13-peter.maydell@linaro.org
* target/arm: Mark up sysregs for HFGRTR bits 12..23Peter Maydell2023-02-031-0/+12
| | | | | | | | | | | Mark up the sysreg definitions for the registers trapped by HFGRTR/HFGWTR bits 12..23. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Fuad Tabba <tabba@google.com> Message-id: 20230130182459.3309057-12-peter.maydell@linaro.org Message-id: 20230127175507.2895013-12-peter.maydell@linaro.org
* target/arm: Mark up sysregs for HFGRTR bits 0..11Peter Maydell2023-02-031-0/+17
| | | | | | | | | | | Mark up the sysreg definitions for the registers trapped by HFGRTR/HFGWTR bits 0..11. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Fuad Tabba <tabba@google.com> Message-id: 20230130182459.3309057-11-peter.maydell@linaro.org Message-id: 20230127175507.2895013-11-peter.maydell@linaro.org
* target/arm: Implement FGT trapping infrastructurePeter Maydell2023-02-031-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement the machinery for fine-grained traps on normal sysregs. Any sysreg with a fine-grained trap will set the new field to indicate which FGT register bit it should trap on. FGT traps only happen when an AArch64 EL2 enables them for an AArch64 EL1. They therefore are only relevant for AArch32 cpregs when the cpreg can be accessed from EL0. The logic in access_check_cp_reg() will check this, so it is safe to add a .fgt marking to an ARM_CP_STATE_BOTH ARMCPRegInfo. The DO_BIT and DO_REV_BIT macros define enum constants FGT_##bitname which can be used to specify the FGT bit, eg .fgt = FGT_AFSR0_EL1 (We assume that there is no bit name duplication across the FGT registers, for brevity's sake.) Subsequent commits will add the .fgt fields to the relevant register definitions and define the FGT_nnn values for them. Note that some of the FGT traps are for instructions that we don't handle via the cpregs mechanisms (mostly these are instruction traps). Those we will have to handle separately. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Fuad Tabba <tabba@google.com> Message-id: 20230130182459.3309057-10-peter.maydell@linaro.org Message-id: 20230127175507.2895013-10-peter.maydell@linaro.org
* target/arm: Define the FEAT_FGT registersPeter Maydell2023-02-031-0/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Define the system registers which are provided by the FEAT_FGT fine-grained trap architectural feature: HFGRTR_EL2, HFGWTR_EL2, HDFGRTR_EL2, HDFGWTR_EL2, HFGITR_EL2 All these registers are a set of bit fields, where each bit is set for a trap and clear to not trap on a particular system register access. The R and W register pairs are for system registers, allowing trapping to be done separately for reads and writes; the I register is for system instructions where trapping is on instruction execution. The data storage in the CPU state struct is arranged as a set of arrays rather than separate fields so that when we're looking up the bits for a system register access we can just index into the array rather than having to use a switch to select a named struct member. The later FEAT_FGT2 will add extra elements to these arrays. The field definitions for the new registers are in cpregs.h because in practice the code that needs them is code that also needs the cpregs information; cpu.h is included in a lot more files. We're also going to add some FGT-specific definitions to cpregs.h in the next commit. We do not implement HAFGRTR_EL2, because we don't implement FEAT_AMUv1. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Fuad Tabba <tabba@google.com> Message-id: 20230130182459.3309057-9-peter.maydell@linaro.org Message-id: 20230127175507.2895013-9-peter.maydell@linaro.org
* target/arm: Disable HSTR_EL2 traps if EL2 is not enabledPeter Maydell2023-02-031-1/+1
| | | | | | | | | | | | | | | | | The HSTR_EL2 register is not supposed to have an effect unless EL2 is enabled in the current security state. We weren't checking for this, which meant that if the guest set up the HSTR_EL2 register we would incorrectly trap even for accesses from Secure EL0 and EL1. Add the missing checks. (Other places where we look at HSTR_EL2 for the not-in-v8A bits TTEE and TJDBX are already checking that we are in NS EL0 or EL1, so there we alredy know EL2 is enabled.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Fuad Tabba <tabba@google.com> Message-id: 20230130182459.3309057-8-peter.maydell@linaro.org Message-id: 20230127175507.2895013-8-peter.maydell@linaro.org
* target/arm: Correct syndrome for ATS12NSO* at Secure EL1Peter Maydell2023-02-031-2/+2
| | | | | | | | | | | | | | | | | | | The AArch32 ATS12NSO* address translation operations are supposed to trap to either EL2 or EL3 if they're executed at Secure EL1 (which can only happen if EL3 is AArch64). We implement this, but we got the syndrome value wrong: like other traps to EL2 or EL3 on an AArch32 cpreg access, they should report the 0x3 syndrome, not the 0x0 'uncategorized' syndrome. This is clear in the access pseudocode for these instructions. Fix the syndrome value for these operations by correcting the returned value from the ats_access() function. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Fuad Tabba <tabba@google.com> Message-id: 20230130182459.3309057-3-peter.maydell@linaro.org Message-id: 20230127175507.2895013-3-peter.maydell@linaro.org
* target/arm: Name AT_S1E1RP and AT_S1E1WP cpregs correctlyPeter Maydell2023-02-031-2/+2
| | | | | | | | | | | | | | | | The encodings 0,0,C7,C9,0 and 0,0,C7,C9,1 are AT SP1E1RP and AT S1E1WP, but our ARMCPRegInfo definitions for them incorrectly name them AT S1E1R and AT S1E1W (which are entirely different instructions). Fix the names. (This has no guest-visible effect as the names are for debug purposes only.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Fuad Tabba <tabba@google.com> Message-id: 20230130182459.3309057-2-peter.maydell@linaro.org Message-id: 20230127175507.2895013-2-peter.maydell@linaro.org
* target/arm/sme: Unify set_pstate() SM/ZA helpers as set_svcr()Richard Henderson2023-01-231-2/+0
| | | | | | | | | | | | | | Unify the two helper_set_pstate_{sm,za} in this function. Do not call helper_* functions from svcr_write. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230112102436.1913-8-philmd@linaro.org Message-Id: <20230112004322.161330-1-richard.henderson@linaro.org> [PMD: Split patch in multiple tiny steps] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm/sme: Rebuild hflags in aarch64_set_svcr()Richard Henderson2023-01-231-1/+5
| | | | | | | | | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230112102436.1913-7-philmd@linaro.org Message-Id: <20230112004322.161330-1-richard.henderson@linaro.org> [PMD: Split patch in multiple tiny steps] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm/sme: Reset ZA state in aarch64_set_svcr()Richard Henderson2023-01-231-0/+12
| | | | | | | | | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230112102436.1913-6-philmd@linaro.org Message-Id: <20230112004322.161330-1-richard.henderson@linaro.org> [PMD: Split patch in multiple tiny steps] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm/sme: Reset SVE state in aarch64_set_svcr()Richard Henderson2023-01-231-0/+13
| | | | | | | | | | | | | Move arm_reset_sve_state() calls to aarch64_set_svcr(). Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230112102436.1913-5-philmd@linaro.org Message-Id: <20230112004322.161330-1-richard.henderson@linaro.org> [PMD: Split patch in multiple tiny steps] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm/sme: Introduce aarch64_set_svcr()Richard Henderson2023-01-231-0/+8
| | | | | | | | | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230112102436.1913-4-philmd@linaro.org Message-Id: <20230112004322.161330-1-richard.henderson@linaro.org> [PMD: Split patch in multiple tiny steps] Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: allow writes to SCR_EL3.HXEn bit when FEAT_HCX is enabledEvgeny Iakovlev2023-01-131-0/+3
| | | | | | | | | | | | | | | ARM trusted firmware, when built with FEAT_HCX support, sets SCR_EL3.HXEn bit to allow EL2 to modify HCRX_EL2 register without trapping it in EL3. Qemu uses a valid mask to clear unsupported SCR_EL3 bits when emulating SCR_EL3 write, and that mask doesn't include SCR_EL3.HXEn bit even if FEAT_HCX is enabled and exposed to the guest. As a result EL3 writes of that bit are ignored. Cc: qemu-stable@nongnu.org Signed-off-by: Evgeny Iakovlev <eiakovlev@linux.microsoft.com> Message-id: 20230105221251.17896-4-eiakovlev@linux.microsoft.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: align exposed ID registers with LinuxZhuojia Shen2023-01-051-17/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In CPUID registers exposed to userspace, some registers were missing and some fields were not exposed. This patch aligns exposed ID registers and their fields with what the upstream kernel currently exposes. Specifically, the following new ID registers/fields are exposed to userspace: ID_AA64PFR1_EL1.BT: bits 3-0 ID_AA64PFR1_EL1.MTE: bits 11-8 ID_AA64PFR1_EL1.SME: bits 27-24 ID_AA64ZFR0_EL1.SVEver: bits 3-0 ID_AA64ZFR0_EL1.AES: bits 7-4 ID_AA64ZFR0_EL1.BitPerm: bits 19-16 ID_AA64ZFR0_EL1.BF16: bits 23-20 ID_AA64ZFR0_EL1.SHA3: bits 35-32 ID_AA64ZFR0_EL1.SM4: bits 43-40 ID_AA64ZFR0_EL1.I8MM: bits 47-44 ID_AA64ZFR0_EL1.F32MM: bits 55-52 ID_AA64ZFR0_EL1.F64MM: bits 59-56 ID_AA64SMFR0_EL1.F32F32: bit 32 ID_AA64SMFR0_EL1.B16F32: bit 34 ID_AA64SMFR0_EL1.F16F32: bit 35 ID_AA64SMFR0_EL1.I8I32: bits 39-36 ID_AA64SMFR0_EL1.F64F64: bit 48 ID_AA64SMFR0_EL1.I16I64: bits 55-52 ID_AA64SMFR0_EL1.FA64: bit 63 ID_AA64MMFR0_EL1.ECV: bits 63-60 ID_AA64MMFR1_EL1.AFP: bits 47-44 ID_AA64MMFR2_EL1.AT: bits 35-32 ID_AA64ISAR0_EL1.RNDR: bits 63-60 ID_AA64ISAR1_EL1.FRINTTS: bits 35-32 ID_AA64ISAR1_EL1.BF16: bits 47-44 ID_AA64ISAR1_EL1.DGH: bits 51-48 ID_AA64ISAR1_EL1.I8MM: bits 55-52 ID_AA64ISAR2_EL1.WFxT: bits 3-0 ID_AA64ISAR2_EL1.RPRES: bits 7-4 ID_AA64ISAR2_EL1.GPA3: bits 11-8 ID_AA64ISAR2_EL1.APA3: bits 15-12 The code is also refactored to use symbolic names for ID register fields for better readability and maintainability. The test case in tests/tcg/aarch64/sysregs.c is also updated to match the intended behavior. Signed-off-by: Zhuojia Shen <chaosdefinition@hotmail.com> Message-id: DS7PR12MB6309FB585E10772928F14271ACE79@DS7PR12MB6309.namprd12.prod.outlook.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: use Sn_n_Cn_Cn_n syntax to work with older assemblers that don't recognize id_aa64isar2_el1 and id_aa64mmfr2_el1] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Remove unused includes from helper.cFabiano Rosas2023-01-051-7/+0
| | | | | | | | Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20221213190537.511-6-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Fix checkpatch brace errors in helper.cFabiano Rosas2023-01-051-25/+42
| | | | | | | | | | | Fix this: ERROR: braces {} are necessary for all arms of this statement Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20221213190537.511-4-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Fix checkpatch space errors in helper.cFabiano Rosas2023-01-051-21/+21
| | | | | | | | | | | | | | | | | | Fix the following: ERROR: spaces required around that '|' (ctx:VxV) ERROR: space required before the open parenthesis '(' ERROR: spaces required around that '+' (ctx:VxB) ERROR: space prohibited between function name and open parenthesis '(' (the last two still have some occurrences in macros which I left behind because it might impact readability) Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20221213190537.511-3-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Fix checkpatch comment style warnings in helper.cFabiano Rosas2023-01-051-108/+215
| | | | | | | | | | | | | | Fix these: WARNING: Block comments use a leading /* on a separate line WARNING: Block comments use * on subsequent lines WARNING: Block comments use a trailing */ on a separate line Signed-off-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20221213190537.511-2-farosas@suse.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add PMSAv8r registersTobias Röhmel2023-01-051-0/+302
| | | | | | Signed-off-by: Tobias Röhmel <tobias.roehmel@rwth-aachen.de> Message-id: 20221206102504.165775-6-tobias.roehmel@rwth-aachen.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Make RVBAR available for all ARMv8 CPUsTobias Röhmel2023-01-051-7/+14
| | | | | | | | | | | | RVBAR shadows RVBAR_ELx where x is the highest exception level if the highest EL is not EL3. This patch also allows ARMv8 CPUs to change the reset address with the rvbar property. Signed-off-by: Tobias Röhmel <tobias.roehmel@rwth-aachen.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221206102504.165775-3-tobias.roehmel@rwth-aachen.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Don't add all MIDR aliases for cores that implement PMSATobias Röhmel2023-01-051-4/+9
| | | | | | | | | | | | | Cores with PMSA have the MPUIR register which has the same encoding as the MIDR alias with opc2=4. So we only add that alias if we are not realizing a core that implements PMSA. Signed-off-by: Tobias Röhmel <tobias.roehmel@rwth-aachen.de> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221206102504.165775-2-tobias.roehmel@rwth-aachen.de Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Implement HCR_EL2.TID4 trapsPeter Maydell2022-12-151-8/+9
| | | | | | | | | | | | | | | | For FEAT_EVT, the HCR_EL2.TID4 trap allows trapping of the cache ID registers CCSIDR_EL1, CCSIDR2_EL1, CLIDR_EL1 and CSSELR_EL1 (and their AArch32 equivalents). This is a subset of the registers trapped by HCR_EL2.TID2, which includes all of these and also the CTR_EL0 register. Our implementation already uses a separate access function for CTR_EL0 (ctr_el0_access()), so all of the registers currently using access_aa64_tid2() should also be checking TID4. Make that function check both TID2 and TID4, and rename it appropriately. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Implement HCR_EL2.TICAB,TOCU trapsPeter Maydell2022-12-151-13/+23
| | | | | | | | | | | | | | | | | | | | For FEAT_EVT, the HCR_EL2.TICAB bit allows trapping of the ICIALLUIS and IC IALLUIS cache maintenance instructions. The HCR_EL2.TOCU bit traps all the other cache maintenance instructions that operate to the point of unification: AArch64 IC IVAU, IC IALLU, DC CVAU AArch32 ICIMVAU, ICIALLU, DCCMVAU The two trap bits between them cover all of the cache maintenance instructions which must also check the HCR_TPU flag. Turn the old aa64_cacheop_pou_access() function into a helper function which takes the set of HCR_EL2 flags to check as an argument, and call it from new access_ticab() and access_tocu() functions as appropriate for each cache op. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Implement HCR_EL2.TTLBOS trapsPeter Maydell2022-12-151-10/+23
| | | | | | | | | | | | | | | | | For FEAT_EVT, the HCR_EL2.TTLBOS bit allows trapping on EL1 use of TLB maintenance instructions that operate on the outer shareable domain: TLBI VMALLE1OS, TLBI VAE1OS, TLBI ASIDE1OS,TLBI VAAE1OS, TLBI VALE1OS, TLBI VAALE1OS, TLBI RVAE1OS, TLBI RVAAE1OS, TLBI RVALE1OS, and TLBI RVAALE1OS. (There are no AArch32 outer-shareable TLB maintenance ops.) Implement the trapping. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Implement HCR_EL2.TTLBIS trapsPeter Maydell2022-12-151-16/+27
| | | | | | | | | | | | | | | | | | | | For FEAT_EVT, the HCR_EL2.TTLBIS bit allows trapping on EL1 use of TLB maintenance instructions that operate on the inner shareable domain: AArch64: TLBI VMALLE1IS, TLBI VAE1IS, TLBI ASIDE1IS, TLBI VAAE1IS, TLBI VALE1IS, TLBI VAALE1IS, TLBI RVAE1IS, TLBI RVAAE1IS, TLBI RVALE1IS, and TLBI RVAALE1IS. AArch32: TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, TLBIMVALIS, and TLBIMVAALIS. Add the trapping support. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Allow relevant HCR bits to be written for FEAT_EVTPeter Maydell2022-12-151-0/+6
| | | | | | | | | | | | | | | | | | FEAT_EVT adds five new bits to the HCR_EL2 register: TTLBIS, TTLBOS, TICAB, TOCU and TID4. These allow the guest to enable trapping of various EL1 instructions to EL2. In this commit, add the necessary code to allow the guest to set these bits if the feature is present; because the bit is always zero when the feature isn't present we won't need to use explicit feature checks in the "trap on condition" tests in the following commits. Note that although full implementation of the feature (mandatory from Armv8.5 onward) requires all five trap bits, the ID registers permit a value indicating that only TICAB, TOCU and TID4 are implemented, which might be the case for CPUs between Armv8.2 and Armv8.5. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Honor HCR_E2H and HCR_TGE in ats_write64()Ake Koomsin2022-11-041-6/+9
| | | | | | | | | | | | | | We need to check HCR_E2H and HCR_TGE to select the right MMU index for the correct translation regime. To check for EL2&0 translation regime: - For S1E0*, S1E1* and S12E* ops, check both HCR_E2H and HCR_TGE - For S1E2* ops, check only HCR_E2H Signed-off-by: Ake Koomsin <ake@igel.co.jp> Message-id: 20221101064250.12444-1-ake@igel.co.jp Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Fix Privileged Access Never (PAN) for aarch32Timofey Kutergin2022-11-041-2/+11
| | | | | | | | | | | | | | | | | | When we implemented the PAN support we theoretically wanted to support it for both AArch32 and AArch64, but in practice several bugs made it essentially unusable with an AArch32 guest. Fix all those problems: - Use CPSR.PAN to check for PAN state in aarch32 mode - throw permission fault during address translation when PAN is enabled and kernel tries to access user acessible page - ignore SCTLR_XP bit for armv7 and armv8 (conflicts with SCTLR_SPAN). Signed-off-by: Timofey Kutergin <tkutergin@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221027112619.2205229-1-tkutergin@gmail.com [PMM: tweak commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Make TLBIOS and TLBIRANGE ops trap on HCR_EL2.TTLBPeter Maydell2022-11-041-18/+18
| | | | | | | | | | The HCR_EL2.TTLB bit is supposed to trap all EL1 execution of TLB maintenance instructions. However we have added new TLB insns for FEAT_TLBIOS and FEAT_TLBIRANGE, and forgot to set their accessfn to access_ttlb. Add the missing accessfns. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Extract HA and HD in aa64_va_parametersRichard Henderson2022-10-271-1/+7
| | | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20221024051851.3074715-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Introduce regime_is_stage2Richard Henderson2022-10-271-9/+5
| | | | | | | | | | Reduce the amount of typing required for this check. Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221024051851.3074715-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Implement FEAT_E0PDPeter Maydell2022-10-271-0/+9
| | | | | | | | | | | | | | FEAT_E0PD adds new bits E0PD0 and E0PD1 to TCR_EL1, which allow the OS to forbid EL0 access to half of the address space. Since this is an EL0-specific variation on the existing TCR_ELx.{EPD0,EPD1}, we can implement it entirely in aa64_va_parameters(). This requires moving the existing regime_is_user() to internals.h so that the code in helper.c can get at it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221021160131.3531787-1-peter.maydell@linaro.org
* target/arm: Restrict tlb flush from vttbr_write to vmid changeRichard Henderson2022-10-201-2/+2
| | | | | | | | | Compare only the VMID field when considering whether we need to flush. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221011031911.2408754-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Move ARMMMUIdx_Stage2 to a real tlb mmu_idxRichard Henderson2022-10-201-38/+113
| | | | | | | | | | | We had been marking this ARM_MMU_IDX_NOTLB, move it to a real tlb. Flush the tlb when invalidating stage 1+2 translations. Re-use alle1_tlbmask() for other instances of EL1&0 + Stage2. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221011031911.2408754-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Use ARMGranuleSize in ARMVAParametersPeter Maydell2022-10-101-11/+28
| | | | | | | | | Now we have an enum for the granule size, use it in the ARMVAParameters struct instead of the using16k/using64k bools. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221003162315.2833797-3-peter.maydell@linaro.org
* target/arm: Don't allow guest to use unimplemented granule sizesPeter Maydell2022-10-101-8/+94
| | | | | | | | | | | | | | | | | | | | | | Arm CPUs support some subset of the granule (page) sizes 4K, 16K and 64K. The guest selects the one it wants using bits in the TCR_ELx registers. If it tries to program these registers with a value that is either reserved or which requests a size that the CPU does not implement, the architecture requires that the CPU behaves as if the field was programmed to some size that has been implemented. Currently we don't implement this, and instead let the guest use any granule size, even if the CPU ID register fields say it isn't present. Make aa64_va_parameters() check against the supported granule size and force use of a different one if it is not implemented. (A subsequent commit will make ARMVAParameters use the new enum rather than the current pair of using16k/using64k bools.) Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221003162315.2833797-2-peter.maydell@linaro.org
* target/arm: Use tlb_set_page_fullRichard Henderson2022-10-101-6/+6
| | | | | | | | | | | | | | | Adjust GetPhysAddrResult to fill in CPUTLBEntryFull, so that it may be passed directly to tlb_set_page_full. The change is large, but mostly mechanical. The major non-mechanical change is page_size -> lg_page_size. Most of the time this is obvious, and is related to TARGET_PAGE_BITS. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221001162318.153420-21-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Introduce arm_hcr_el2_eff_secstateRichard Henderson2022-10-101-3/+8
| | | | | | | | | | For page walking, we may require HCR for a security state that is not "current". Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221001162318.153420-14-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Fold secure and non-secure a-profile mmu indexesRichard Henderson2022-10-101-94/+50
| | | | | | | | | | | | | | | | | | For a-profile aarch64, which does not bank system registers, it takes quite a lot of code to switch between security states. In the process, registers such as TCR_EL{1,2} must be swapped, which in itself requires the flushing of softmmu tlbs. Therefore it doesn't buy us anything to separate tlbs by security state. Retain the distinction between Stage2 and Stage2_S. This will be important as we implement FEAT_RME, and do not wish to add a third set of mmu indexes for Realm state. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221001162318.153420-11-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add is_secure parameter to do_ats_writeRichard Henderson2022-10-101-5/+14
| | | | | | | | | | Use get_phys_addr_with_secure directly. For a-profile, this is the one place where the value of is_secure may not equal arm_is_secure(env). Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221001162318.153420-10-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add TBFLAG_M32.SECURERichard Henderson2022-10-101-0/+4
| | | | | | | | | | | | Remove the use of regime_is_secure from arm_tr_init_disas_context. Instead, provide the value of v8m_secure directly from tb_flags. Rather than use regime_is_secure, use the env->v7m.secure directly, as per arm_mmu_idx_el. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221001162318.153420-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: allow setting SCR_EL3.EnTP2 when FEAT_SME is implementedJerome Forissier2022-10-101-1/+4
| | | | | | | | | | | | | | | | | | Updates write_scr() to allow setting SCR_EL3.EnTP2 when FEAT_SME is implemented. SCR_EL3 being a 64-bit register, valid_mask is changed to uint64_t and the SCR_* constants in target/arm/cpu.h are extended to 64-bit so that masking and bitwise not (~) behave as expected. This enables booting Linux with Trusted Firmware-A at EL3 with "-M virt,secure=on -cpu max". Cc: qemu-stable@nongnu.org Fixes: 78cb9776662a ("target/arm: Enable SME for -cpu max") Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Andre Przywara <andre.przywara@arm.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20221004072354.27037-1-jerome.forissier@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: mark SP_EL1 with ARM_CP_EL3_NO_EL2_KEEPJerome Forissier2022-09-291-1/+1
| | | | | | | | | | | | SP_EL1 must be kept when EL3 is present but EL2 is not. Therefore mark it with ARM_CP_EL3_NO_EL2_KEEP. Cc: qemu-stable@nongnu.org Fixes: 696ba3771894 ("target/arm: Handle cpreg registration for missing EL") Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220927120058.670901-1-jerome.forissier@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Make writes to MDCR_EL3 use PMU start/finish callsPeter Maydell2022-09-291-4/+14
| | | | | | | | | | | | | | | | | | In commit 01765386a88868 we fixed a bug where we weren't correctly bracketing changes to some registers with pmu_op_start() and pmu_op_finish() calls for changes which affect whether the PMU counters might be enabled. However, we missed the case of writes to the AArch64 MDCR_EL3 register, because (unlike its AArch32 counterpart) they are currently done directly to the CPU state struct without going through the sdcr_write() function. Give MDCR_EL3 a writefn which handles the PMU start/finish calls. The SDCR writefn then simplfies to "call the MDCR_EL3 writefn after masking off the bits which don't exist in the AArch32 register". Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220923123412.1214041-3-peter.maydell@linaro.org
* target/arm: Mark registers which call pmu_op_start() as ARM_CP_IOPeter Maydell2022-09-291-6/+6
| | | | | | | | | | | | | | | | | | | | | | In commit 01765386a888 we made some system register write functions call pmu_op_start()/pmu_op_finish(). This means that they now touch timers, so for icount to work these registers must have the ARM_CP_IO flag set. This fixes a bug where when icount is enabled a guest that touches MDCR_EL3, MDCR_EL2, PMCNTENSET_EL0 or PMCNTENCLR_EL0 would cause QEMU to print an error message and exit, for example: [ 2.495971] TCP: Hash tables configured (established 1024 bind 1024) [ 2.496213] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 2.496386] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 2.496917] NET: Registered protocol family 1 qemu-system-aarch64: Bad icount read Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220923123412.1214041-2-peter.maydell@linaro.org
* target/arm: Create GetPhysAddrResultRichard Henderson2022-09-221-16/+11
| | | | | | | | | | Combine 5 output pointer arguments from get_phys_addr into a single struct. Adjust all callers. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220822152741.1617527-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Support 64-bit event counters for FEAT_PMUv3p5Peter Maydell2022-09-141-8/+54
| | | | | | | | | | | | | | | | | | | | | | | With FEAT_PMUv3p5, the event counters are now 64 bit, rather than 32 bit. (Previously, only the cycle counter could be 64 bit, and other event counters were always 32 bits). For any given event counter, whether the overflow event is noted for overflow from bit 31 or from bit 63 is controlled by a combination of PMCR.LP, MDCR_EL2.HLP and MDCR_EL2.HPMN. Implement the 64-bit event counter handling. We choose to make our counters always 64 bits, and mask out the top 32 bits on read or write of PMXEVCNTR for CPUs which don't have FEAT_PMUv3p5. (Note that the changes to pmenvcntr_op_start() and pmenvcntr_op_finish() bring their logic closer into line with that of pmccntr_op_start() and pmccntr_op_finish(), which already had to cope with the overflow being either at 32 or 64 bits.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220822132358.3524971-10-peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Implement FEAT_PMUv3p5 cycle counter disable bitsPeter Maydell2022-09-141-4/+17
| | | | | | | | | | | | | | | | | | | FEAT_PMUv3p5 introduces new bits which disable the cycle counter from counting: * MDCR_EL2.HCCD disables the counter when in EL2 * MDCR_EL3.SCCD disables the counter when Secure Add the code to support these bits. (Note that there is a third documented counter-disable bit, MDCR_EL3.MCCD, which disables the counter when in EL3. This is not present until FEAT_PMUv3p7, so is out of scope for now.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220822132358.3524971-9-peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Rename pmu_8_n feature test functionsPeter Maydell2022-09-141-9/+9
| | | | | | | | | | | | | | | Our feature test functions that check the PMU version are named isar_feature_{aa32,aa64,any}_pmu_8_{1,4}. This doesn't match the current Arm ARM official feature names, which are FEAT_PMUv3p1 and FEAT_PMUv3p4. Rename these functions to _pmuv3p1 and _pmuv3p4. This commit was created with: sed -i -e 's/pmu_8_/pmuv3p/g' target/arm/*.[ch] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220822132358.3524971-8-peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>