summary refs log tree commit diff stats
path: root/target/arm/helper.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* target/arm: Fix MTE0_ACTIVERichard Henderson2021-01-081-1/+1
| | | | | | | | | | | | | | In 50244cc76abc we updated mte_check_fail to match the ARM pseudocode, using the correct EL to select the TCF field. But we failed to update MTE0_ACTIVE the same way, which led to g_assert_not_reached(). Cc: qemu-stable@nongnu.org Buglink: https://bugs.launchpad.net/bugs/1907137 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201221204426.88514-1-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* qapi: Use QAPI_LIST_PREPEND() where possibleEric Blake2020-12-191-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Anywhere we create a list of just one item or by prepending items (typically because order doesn't matter), we can use QAPI_LIST_PREPEND(). But places where we must keep the list in order by appending remain open-coded until later patches. Note that as a side effect, this also performs a cleanup of two minor issues in qga/commands-posix.c: the old code was performing new = g_malloc0(sizeof(*ret)); which 1) is confusing because you have to verify whether 'new' and 'ret' are variables with the same type, and 2) would conflict with C++ compilation (not an actual problem for this file, but makes copy-and-paste harder). Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <20201113011340.463563-5-eblake@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Stefan Hajnoczi <stefanha@redhat.com> [Straightforward conflicts due to commit a8aa94b5f8 "qga: update schema for guest-get-disks 'dependents' field" and commit a10b453a52 "target/mips: Move mips_cpu_add_definition() from helper.c to cpu.c" resolved. Commit message tweaked.] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* target/arm: Implement v8.1M PXN extensionPeter Maydell2020-12-101-1/+6
| | | | | | | | | | | | | In v8.1M the PXN architecture extension adds a new PXN bit to the MPU_RLAR registers, which forbids execution of code in the region from a privileged mode. This is another feature which is just in the generic "in v8.1M" set and has no ID register field indicating its presence. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201119215617.29887-3-peter.maydell@linaro.org
* target/arm: fix stage 2 page-walks in 32-bit emulationRémi Denis-Courmont2020-11-231-2/+2
| | | | | | | | | | | | Using a target unsigned long would limit the Input Address to a LPAE page-walk to 32 bits on AArch32 and 64 bits on AArch64. This is okay for stage 1 or on AArch64, but it is insufficient for stage 2 on AArch32. In that later case, the Input Address can have up to 40 bits. Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20201118150414.18360-1-remi@remlab.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: add spaces around operatorXinhao Zhang2020-11-101-1/+1
| | | | | | | | | | Fix code style. Operator needs spaces both sides. Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com> Signed-off-by: Kai Deng <dengkai1@huawei.com> Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: fix LORID_EL1 access checkRémi Denis-Courmont2020-11-021-14/+5
| | | | | | | | | Secure mode is not exempted from checking SCR_EL3.TLOR, and in the future HCR_EL2.TLOR when S-EL2 is enabled. Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: fix handling of HCR.FBRémi Denis-Courmont2020-11-021-3/+2
| | | | | | | | HCR should be applied when NS is set, not when it is cleared. Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Ignore HCR_EL2.ATA when {E2H,TGE} != 11Richard Henderson2020-10-201-4/+5
| | | | | | | | | | | | | | | | | Unlike many other bits in HCR_EL2, the description for this bit does not contain the phrase "if ... this field behaves as 0 for all purposes other than", so do not squash the bit in arm_hcr_el2_eff. Instead, replicate the E2H+TGE test in the two places that require it. Reported-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Tested-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Message-id: 20201008162155.161886-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Use tlb_flush_page_bits_by_mmuidx*Richard Henderson2020-10-201-7/+39
| | | | | | | | | | | | | | | | | When TBI is enabled in a given regime, 56 bits of the address are significant and we need to clear out any other matching virtual addresses with differing tags. The other uses of tlb_flush_page (without mmuidx) in this file are only used by aarch32 mode. Fixes: 38d931687fa1 Reported-by: Jordan Frank <jordanfrank@fb.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20201016210754.818257-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* icount: rename functions to be consistent with the module nameClaudio Fontana2020-10-051-2/+2
| | | | | | | Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* cpu-timers, icount: new modulesClaudio Fontana2020-10-051-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | refactoring of cpus.c continues with cpu timer state extraction. cpu-timers: responsible for the softmmu cpu timers state, including cpu clocks and ticks. icount: counts the TCG instructions executed. As such it is specific to the TCG accelerator. Therefore, it is built only under CONFIG_TCG. One complication is due to qtest, which uses an icount field to warp time as part of qtest (qtest_clock_warp). In order to solve this problem, provide a separate counter for qtest. This requires fixing assumptions scattered in the code that qtest_enabled() implies icount_enabled(), checking each specific case. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [remove redundant initialization with qemu_spice_init] Reviewed-by: Alex Bennée <alex.bennee@linaro.org> [fix lingering calls to icount_get] Signed-off-by: Claudio Fontana <cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/arm: Move id_pfr0, id_pfr1 into ARMISARegistersPeter Maydell2020-10-011-2/+2
| | | | | | | | | | | | | | | Move the id_pfr0 and id_pfr1 fields into the ARMISARegisters sub-struct. We're going to want id_pfr1 for an isar_features check, and moving both at the same time avoids an odd inconsistency. Changes other than the ones to cpu.h and kvm64.c made automatically with: perl -p -i -e 's/cpu->id_pfr/cpu->isar.id_pfr/' target/arm/*.c hw/intc/armv7m_nvic.c Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200910173855.4068-3-peter.maydell@linaro.org
* target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA checkPeter Maydell2020-10-011-2/+3
| | | | | | | | | | | | The ARM_FEATURE_PXN bit indicates whether the CPU supports the PXN bit in short-descriptor translation table format descriptors. This is indicated by ID_MMFR0.VMSA being at least 0b0100. Replace the feature bit with an ID register check, in line with our preference for ID register checks over feature bits. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200910173855.4068-2-peter.maydell@linaro.org
* target/arm: Count PMU events when MDCR.SPME is setAaron Lindsay2020-09-141-1/+1
| | | | | | | | | | | | This check was backwards when introduced in commit 033614c47de78409ad3fb39bb7bd1483b71c6789: target/arm: Filter cycle counter based on PMCCFILTR_EL0 Cc: qemu-stable@nongnu.org Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Clarify HCR_EL2 ARMCPRegInfo typePhilippe Mathieu-Daudé2020-08-281-1/+0
| | | | | | | | | | | | | | | | | In commit ce4afed839 ("target/arm: Implement AArch32 HCR and HCR2") the HCR_EL2 register has been changed from type NO_RAW (no underlying state and does not support raw access for state saving/loading) to type CONST (TCG can assume the value to be constant), removing the read/write accessors. We forgot to remove the previous type ARM_CP_NO_RAW. This is not really a problem since the field is overwritten. However it makes code review confuse, so remove it. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200812111223.7787-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Convert A32 coprocessor insns to decodetreePeter Maydell2020-08-241-0/+29
| | | | | | | | | | | | | | | | | | | | | | Convert the A32 coprocessor instructions to decodetree. Note that this corrects an underdecoding: for the 64-bit access case (MRRC/MCRR) we did not check that bits [24:21] were 0b0010, so we would incorrectly treat LDC/STC as MRRC/MCRR rather than UNDEFing them. The decodetree versions of these insns assume the coprocessor is in the range 0..7 or 14..15. This is architecturally sensible (as per the comments) and OK in practice for QEMU because the only uses of the ARMCPRegInfo infrastructure we have that aren't for coprocessors 14 or 15 are the pxa2xx use of coprocessor 6. We add an assertion to the define_one_arm_cp_reg_with_opaque() function to catch any accidental future attempts to use it to define coprocessor registers for invalid coprocessors. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200803111849.13368-4-peter.maydell@linaro.org
* target/arm: Fix Rt/Rt2 in ESR_ELx for copro traps from AArch32 to 64Peter Maydell2020-08-051-1/+91
| | | | | | | | | | | | | | | | | | | | | | | | | When a coprocessor instruction in an AArch32 guest traps to AArch32 Hyp mode, the syndrome register (HSR) includes Rt and Rt2 fields which are simply copies of the Rt and Rt2 fields from the trapped instruction. However, if the instruction is trapped from AArch32 to an AArch64 higher exception level, the Rt and Rt2 fields in the syndrome register (ESR_ELx) must be the AArch64 view of the register. This makes a difference if the AArch32 guest was in a mode other than User or System and it was using r13 or r14, or if it was in FIQ mode and using r8-r14. We don't know at translate time which AArch32 CPU mode we are in, so we leave the values we generate in our prototype syndrome register value at translate time as the raw Rt/Rt2 from the instruction, and instead correct them to the AArch64 view when we find we need to take an exception from AArch32 to AArch64 with one of these syndrome values. Fixes: https://bugs.launchpad.net/qemu/+bug/1879587 Reported-by: Julien Freche <julien@bedrocksystems.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20200804193903.31240-1-peter.maydell@linaro.org
* target/arm: Always pass cacheattr in S1_ptw_translateRichard Henderson2020-07-271-13/+6
| | | | | | | | | | | | | When we changed the interface of get_phys_addr_lpae to require the cacheattr parameter, this spot was missed. The compiler is unable to detect the use of NULL vs the nonnull attribute here. Fixes: 7e98e21c098 Reported-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Jan Kiszka <jan.kiskza@siemens.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Don't do raw writes for PMINTENCLRAaron Lindsay2020-07-131-2/+2
| | | | | | | | | | | | Raw writes to this register when in KVM mode can cause interrupts to be raised (even when the PMU is disabled). Because the underlying state is already aliased to PMINTENSET (which already provides raw write functions), we can safely disable raw accesses to PMINTENCLR entirely. Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com> Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Cache the Tagged bit for a page in MemTxAttrsRichard Henderson2020-06-261-3/+45
| | | | | | | | | This "bit" is a particular value of the page's MemAttr. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-43-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Always pass cacheattr to get_phys_addrRichard Henderson2020-06-261-30/+30
| | | | | | | | | | | | | | | We need to check the memattr of a page in order to determine whether it is Tagged for MTE. Between Stage1 and Stage2, this becomes simpler if we always collect this data, instead of occasionally being presented with NULL. Use the nonnull attribute to allow the compiler to check that all pointer arguments are non-null. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-42-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Set PSTATE.TCO on exception entryRichard Henderson2020-06-261-0/+3
| | | | | | | | | D1.10 specifies that exception handlers begin with tag checks overridden. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-41-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Implement data cache set allocation tagsRichard Henderson2020-06-261-0/+16
| | | | | | | | | This is DC GVA and DC GZVA, and the tag check for DC ZVA. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-40-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add arm_tlb_bti_gpRichard Henderson2020-06-261-1/+1
| | | | | | | | | Introduce an lvalue macro to wrap target_tlb_bit0. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-33-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Move regime_tcr to internals.hRichard Henderson2020-06-261-9/+0
| | | | | | | | | We will shortly need this in mte_helper.c as well. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-23-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Move regime_el to internals.hRichard Henderson2020-06-261-36/+0
| | | | | | | | | We will shortly need this in mte_helper.c as well. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-22-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Implement the access tag cache flushesRichard Henderson2020-06-261-0/+65
| | | | | | | | | Like the regular data cache flushes, these are nops within qemu. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-21-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add MTE bits to tb_flagsRichard Henderson2020-06-261-0/+40
| | | | | | | | | | | | | Cache the composite ATA setting. Cache when MTE is fully enabled, i.e. access to tags are enabled and tag checks affect the PE. Do this for both the normal context and the UNPRIV context. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-9-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add MTE system registersRichard Henderson2020-06-261-0/+94
| | | | | | | | | | This is TFSRE0_EL1, TFSR_EL1, TFSR_EL2, TFSR_EL3, RGSR_EL1, GCR_EL1, GMID_EL1, and PSTATE.TCO. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add support for MTE to HCR_EL2 and SCR_EL3Richard Henderson2020-06-261-3/+11
| | | | | | | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add support for MTE to SCTLR_ELxRichard Henderson2020-06-261-6/+17
| | | | | | | | | | | This does not attempt to rectify all of the res0 bits, but does clear the mte bits when not enabled. Since there is no high-part mapping of SCTLR, aa32 mode cannot write to these bits. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Improve masking of SCR RES0 bitsRichard Henderson2020-06-261-7/+8
| | | | | | | | | | | Protect reads of aa64 id registers with ARM_CP_STATE_AA64. Use this as a simpler test than arm_el_is_aa64, since EL3 cannot change mode. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200626033144.790098-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* memory: Rename memory_region_do_writeback -> memory_region_writebackPhilippe Mathieu-Daudé2020-06-051-1/+1
| | | | | | | | | | | | We usually use '_do_' for internal functions. Rename memory_region_do_writeback() as memory_region_writeback(). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 20200508062456.23344-2-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* target-arm: kvm64: handle SIGBUS signal from kernel or KVMDongjiu Geng2020-05-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a SIGBUS signal handler. In this handler, it checks the SIGBUS type, translates the host VA delivered by host to guest PA, then fills this PA to guest APEI GHES memory, then notifies guest according to the SIGBUS type. When guest accesses the poisoned memory, it will generate a Synchronous External Abort(SEA). Then host kernel gets an APEI notification and calls memory_failure() to unmapped the affected page in stage 2, finally returns to guest. Guest continues to access the PG_hwpoison page, it will trap to KVM as stage2 fault, then a SIGBUS_MCEERR_AR synchronous signal is delivered to Qemu, Qemu records this error address into guest APEI GHES memory and notifes guest using Synchronous-External-Abort(SEA). In order to inject a vSEA, we introduce the kvm_inject_arm_sea() function in which we can setup the type of exception and the syndrome information. When switching to guest, the target vcpu will jump to the synchronous external abort vector table entry. The ESR_ELx.DFSC is set to synchronous external abort(0x10), and the ESR_ELx.FnV is set to not valid(0x1), which will tell guest that FAR is not valid and hold an UNKNOWN value. These values will be set to KVM register structures through KVM_SET_ONE_REG IOCTL. Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com> Signed-off-by: Xiang Zheng <zhengxiang9@huawei.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Xiang Zheng <zhengxiang9@huawei.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Message-id: 20200512030609.19593-10-gengdongjiu@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Drop access_el3_aa32ns_aa64any()Edgar E. Iglesias2020-05-111-23/+7
| | | | | | | | | | | | | | | | Calling access_el3_aa32ns() works for AArch32 only cores but it does not handle 32-bit EL2 on top of 64-bit EL3 for mixed 32/64-bit cores. Merge access_el3_aa32ns_aa64any() into access_el3_aa32ns() and only use the latter. Fixes: 68e9c2fe65 ("target-arm: Add VTCR_EL2") Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20200505141729.31930-2-edgar.iglesias@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Implement ARMv8.2-TTS2UXNPeter Maydell2020-05-041-6/+31
| | | | | | | | | | | | | The ARMv8.2-TTS2UXN feature extends the XN field in stage 2 translation table descriptors from just bit [54] to bits [54:53], allowing stage 2 to control execution permissions separately for EL0 and EL1. Implement the new semantics of the XN field and enable the feature for our 'max' CPU. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200330210400.11724-5-peter.maydell@linaro.org
* target/arm: Add new 's1_is_el0' argument to get_phys_addr_lpae()Peter Maydell2020-05-041-1/+28
| | | | | | | | | | | | | | | | | For ARMv8.2-TTS2UXN, the stage 2 page table walk wants to know whether the stage 1 access is for EL0 or not, because whether exec permission is given can depend on whether this is an EL0 or EL1 access. Add a new argument to get_phys_addr_lpae() so the call sites can pass this information in. Since get_phys_addr_lpae() doesn't already have a doc comment, add one so we have a place to put the documentation of the semantics of the new s1_is_el0 argument. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200330210400.11724-4-peter.maydell@linaro.org
* target/arm: Use enum constant in get_phys_addr_lpae() callPeter Maydell2020-05-041-2/+3
| | | | | | | | | | | The access_type argument to get_phys_addr_lpae() is an MMUAccessType; use the enum constant MMU_DATA_LOAD rather than a literal 0 when we call it in S1_ptw_translate(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200330210400.11724-3-peter.maydell@linaro.org
* target/arm: Don't use a TLB for ARMMMUIdx_Stage2Peter Maydell2020-05-041-101/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We define ARMMMUIdx_Stage2 as being an MMU index which uses a QEMU TLB. However we never actually use the TLB -- all stage 2 lookups are done by direct calls to get_phys_addr_lpae() followed by a physical address load via address_space_ld*(). Remove Stage2 from the list of ARM MMU indexes which correspond to real core MMU indexes, and instead put it in the set of "NOTLB" ARM MMU indexes. This allows us to drop NB_MMU_MODES to 11. It also means we can safely add support for the ARMv8.3-TTS2UXN extension, which adds permission bits to the stage 2 descriptors which define execute permission separatel for EL0 and EL1; supporting that while keeping Stage2 in a QEMU TLB would require us to use separate TLBs for "Stage2 for an EL0 access" and "Stage2 for an EL1 access", which is a lot of extra complication given we aren't even using the QEMU TLB. In the process of updating the comment on our MMU index use, fix a couple of other minor errors: * NS EL2 EL2&0 was missing from the list in the comment * some text hadn't been updated from when we bumped NB_MMU_MODES above 8 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200330210400.11724-2-peter.maydell@linaro.org
* target/arm: Restrict the Address Translate write operation to TCG accelPhilippe Mathieu-Daudé2020-04-301-0/+17
| | | | | | | | | | | | | | | | Under KVM these registers are written by the hardware. Restrict the writefn handlers to TCG to avoid when building without TCG: LINK aarch64-softmmu/qemu-system-aarch64 target/arm/helper.o: In function `do_ats_write': target/arm/helper.c:3524: undefined reference to `raise_exception' Suggested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200423073358.27155-2-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Remove obsolete TODO note from get_phys_addr_lpae()Peter Maydell2020-04-031-6/+1
| | | | | | | | | | | | | An old comment in get_phys_addr_lpae() claims that the code does not support the different format TCR for VTCR_EL2. This used to be true but it is not true now (in particular the aa64_va_parameters() and aa32_va_parameters() functions correctly handle the different register format by checking whether the mmu_idx is Stage2). Remove the out of date parts of the comment. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200331143407.3186-1-peter.maydell@linaro.org
* target/arm: PSTATE.PAN should not clear exec bitsPeter Maydell2020-04-031-2/+4
| | | | | | | | | | | | Our implementation of the PSTATE.PAN bit incorrectly cleared all access permission bits for privileged access to memory which is user-accessible. It should only affect the privileged read and write permissions; execute permission is dealt with via XN/PXN instead. Fixes: 81636b70c226dc27d7ebc8d Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200330170651.20901-1-peter.maydell@linaro.org
* target/arm: fix incorrect current EL bug in aarch32 exception emulationChangbin Du2020-03-301-1/+4
| | | | | | | | | | | | The arm_current_el() should be invoked after mode switching. Otherwise, we get a wrong current EL value, since current EL is also determined by current mode. Fixes: 4a2696c0d4 ("target/arm: Set PAN bit as required on exception entry") Signed-off-by: Changbin Du <changbin.du@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20200328140232.17278-1-changbin.du@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Rearrange disabled check for watchpointsRichard Henderson2020-03-231-5/+6
| | | | | | | | | | | | | | | Coverity rightly notes that ctz32(bas) on 0 will return 32, which makes the len calculation a BAD_SHIFT. A value of 0 in DBGWCR<n>_EL1.BAS is reserved. Simply move the existing check we have for this case. Reported-by: Coverity (CID 1421964) Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200320160622.8040-2-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: don't bother with id_aa64pfr0_read for USER_ONLYAlex Bennée2020-03-171-5/+15
| | | | | | | | | | | | For system emulation we need to check the state of the GIC before we report the value. However this isn't relevant to exporting of the value to linux-user and indeed breaks the exported value as set by modify_arm_cp_regs. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20200316172155.971-20-alex.bennee@linaro.org>
* target/arm: generate xml description of our SVE registersAlex Bennée2020-03-171-3/+122
| | | | | | | | | We also expose a the helpers to read/write the the registers. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200316172155.971-19-alex.bennee@linaro.org>
* target/arm: explicitly encode regnum in our XMLAlex Bennée2020-03-171-1/+1
| | | | | | | | | | This is described as optional but I'm not convinced of the numbering when multiple target fragments are sent. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200316172155.971-17-alex.bennee@linaro.org>
* target/arm: prepare for multiple dynamic XMLsAlex Bennée2020-03-171-2/+2
| | | | | | | | | | We will want to generate similar dynamic XML for gdbstub support of SVE registers (the upstream doesn't use XML). To that end lightly rename a few things to make the distinction. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200316172155.971-16-alex.bennee@linaro.org>
* gdbstub: extend GByteArray to read register helpersAlex Bennée2020-03-171-11/+8
| | | | | | | | | | | | | | | Instead of passing a pointer to memory now just extend the GByteArray to all the read register helpers. They can then safely append their data through the normal way. We don't bother with this abstraction for write registers as we have already ensured the buffer being copied from is the correct size. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: David Gibson <david@gibson.dropbear.id.au> Reviewed-by: Damien Hedde <damien.hedde@greensocs.com> Message-Id: <20200316172155.971-15-alex.bennee@linaro.org>
* target/arm: use gdb_get_reg helpersAlex Bennée2020-03-171-11/+7
| | | | | | | | | | | This is cleaner than poking memory directly and will make later clean-ups easier. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20200316172155.971-12-alex.bennee@linaro.org>