Revision tags: v9.1.0 |
|
#
4c2c0474 |
| 09-Aug-2024 |
Peter Maydell <peter.maydell@linaro.org> |
target/arm: Fix usage of MMU indexes when EL3 is AArch32
Our current usage of MMU indexes when EL3 is AArch32 is confused. Architecturally, when EL3 is AArch32, all Secure code runs under the Secure
target/arm: Fix usage of MMU indexes when EL3 is AArch32
Our current usage of MMU indexes when EL3 is AArch32 is confused. Architecturally, when EL3 is AArch32, all Secure code runs under the Secure PL1&0 translation regime: * code at EL3, which might be Mon, or SVC, or any of the other privileged modes (PL1) * code at EL0 (Secure PL0)
This is different from when EL3 is AArch64, in which case EL3 is its own translation regime, and EL1 and EL0 (whether AArch32 or AArch64) have their own regime.
We claimed to be mapping Secure PL1 to our ARMMMUIdx_EL3, but didn't do anything special about Secure PL0, which meant it used the same ARMMMUIdx_EL10_0 that NonSecure PL0 does. This resulted in a bug where arm_sctlr() incorrectly picked the NonSecure SCTLR as the controlling register when in Secure PL0, which meant we were spuriously generating alignment faults because we were looking at the wrong SCTLR control bits.
The use of ARMMMUIdx_EL3 for Secure PL1 also resulted in the bug that we wouldn't honour the PAN bit for Secure PL1, because there's no equivalent _PAN mmu index for it.
We could fix this in one of two ways: * The most straightforward is to add new MMU indexes EL30_0, EL30_3, EL30_3_PAN to correspond to "Secure PL1&0 at PL0", "Secure PL1&0 at PL1", and "Secure PL1&0 at PL1 with PAN". This matches how we use indexes for the AArch64 regimes, and preserves propirties like being able to determine the privilege level from an MMU index without any other information. However it would add two MMU indexes (we can share one with ARMMMUIdx_EL3), and we are already using 14 of the 16 the core TLB code permits.
* The more complicated approach is the one we take here. We use the same MMU indexes (E10_0, E10_1, E10_1_PAN) for Secure PL1&0 than we do for NonSecure PL1&0. This saves on MMU indexes, but means we need to check in some places whether we're in the Secure PL1&0 regime or not before we interpret an MMU index.
The changes in this commit were created by auditing all the places where we use specific ARMMMUIdx_ values, and checking whether they needed to be changed to handle the new index value usage.
Note for potential stable backports: taking also the previous (comment-change-only) commit might make the backport easier.
Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2326 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240809160430.1144805-3-peter.maydell@linaro.org
show more ...
|
#
09a52d85 |
| 24-May-2024 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Split out gengvec.c
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@lina
target/arm: Split out gengvec.c
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240524232121.284515-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
#
db36e145 |
| 24-May-2024 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Use PLD, PLDW, PLI not NOP for t32
This fixes a bug in that neither PLI nor PLDW are present in ARMv6T2, but are introduced with ARMv7 and ARMv7MP respectively. For clarity, do not use N
target/arm: Use PLD, PLDW, PLI not NOP for t32
This fixes a bug in that neither PLI nor PLDW are present in ARMv6T2, but are introduced with ARMv7 and ARMv7MP respectively. For clarity, do not use NOP for PLD.
Note that there is no PLDW (literal). Architecturally in the T1 encoding of "PLD (literal)" bit 5 is "(0)", which means that it should be zero and if it is not then the behaviour is CONSTRAINED UNPREDICTABLE (might UNDEF, NOP, or ignore the value of the bit).
In our implementation we have patterns for both:
+ PLD 1111 1000 -001 1111 1111 ------------ # (literal) + PLD 1111 1000 -011 1111 1111 ------------ # (literal)
and so we effectively ignore the value of bit 5. (This is a permitted option for this CONSTRAINED UNPREDICTABLE.) This isn't a behaviour change in this commit, since we previously had NOP lines for both those patterns.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240524232121.284515-3-richard.henderson@linaro.org [PMM: adjusted commit message to note that PLD (lit) T1 bit 5 being 1 is an UNPREDICTABLE case.] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
#
962a145c |
| 03-Apr-2024 |
Richard Henderson <richard.henderson@linaro.org> |
accel/tcg: Provide default implementation of disas_log
Almost all of the disas_log implementations are identical. Unify them within translator_loop.
Drop extra Priv/Virt logging from target/riscv.
accel/tcg: Provide default implementation of disas_log
Almost all of the disas_log implementations are identical. Unify them within translator_loop.
Drop extra Priv/Virt logging from target/riscv.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
#
4642250e |
| 06-Apr-2024 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Use insn_start from DisasContextBase
To keep the multiple update check, replace insn_start with insn_start_updated.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by
target/arm: Use insn_start from DisasContextBase
To keep the multiple update check, replace insn_start with insn_start_updated.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
#
fbe5ac56 |
| 02-Apr-2024 |
Peter Maydell <peter.maydell@linaro.org> |
target/arm: take HSTR traps of cp15 accesses to EL2, not EL1
The HSTR_EL2 register allows the hypervisor to trap AArch32 EL1 and EL0 accesses to cp15 registers. We incorrectly implemented this so t
target/arm: take HSTR traps of cp15 accesses to EL2, not EL1
The HSTR_EL2 register allows the hypervisor to trap AArch32 EL1 and EL0 accesses to cp15 registers. We incorrectly implemented this so they trap to EL1 when we detect the need for a HSTR trap at code generation time. (The check in access_check_cp_reg() which we do at runtime to catch traps from EL0 is correctly routing them to EL2.)
Use the correct target EL when generating the code to take the trap.
Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2226 Fixes: 049edada5e93df ("target/arm: Make HSTR_EL2 traps take priority over UNDEF-at-EL1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240325133116.2075362-1-peter.maydell@linaro.org
show more ...
|
#
707ded20 |
| 01-Mar-2024 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Support 32-byte alignment in pow2_align
Now that we have removed TARGET_PAGE_BITS_MIN-6 from TLB_FLAGS_MASK, we can test for 32-byte alignment.
Reviewed-by: Philippe Mathieu-Daudé <phil
target/arm: Support 32-byte alignment in pow2_align
Now that we have removed TARGET_PAGE_BITS_MIN-6 from TLB_FLAGS_MASK, we can test for 32-byte alignment.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301204110.656742-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
#
f2b4a989 |
| 06-Feb-2024 |
Peter Maydell <peter.maydell@linaro.org> |
target/arm: Allow access to SPSR_hyp from hyp mode
Architecturally, the AArch32 MSR/MRS to/from banked register instructions are UNPREDICTABLE for attempts to access a banked register that the guest
target/arm: Allow access to SPSR_hyp from hyp mode
Architecturally, the AArch32 MSR/MRS to/from banked register instructions are UNPREDICTABLE for attempts to access a banked register that the guest could access in a more direct way (e.g. using this insn to access r8_fiq when already in FIQ mode). QEMU has chosen to UNDEF on all of these.
However, for the case of accessing SPSR_hyp from hyp mode, it turns out that real hardware permits this, with the same effect as if the guest had directly written to SPSR. Further, there is some guest code out there that assumes it can do this, because it happens to work on hardware: an example Cortex-R52 startup code fragment uses this, and it got copied into various other places, including Zephyr. Zephyr was fixed to not use this: https://github.com/zephyrproject-rtos/zephyr/issues/47330 but other examples are still out there, like the selftest binary for the MPS3-AN536.
For convenience of being able to run guest code, permit this UNPREDICTABLE access instead of UNDEFing it.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240206132931.38376-5-peter.maydell@linaro.org
show more ...
|
#
32f0c394 |
| 19-Jan-2024 |
Anton Johansson <anjo@rev.ng> |
target: Use vaddr in gen_intermediate_code
Makes gen_intermediate_code() signature target agnostic so the function can be called from accel/tcg/translate-all.c without target specifics.
Signed-off-
target: Use vaddr in gen_intermediate_code
Makes gen_intermediate_code() signature target agnostic so the function can be called from accel/tcg/translate-all.c without target specifics.
Signed-off-by: Anton Johansson <anjo@rev.ng> Message-Id: <20240119144024.14289-9-anjo@rev.ng> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
#
a530e470 |
| 27-Sep-2023 |
Peter Maydell <peter.maydell@linaro.org> |
target/arm: Permit T32 LDM with single register
For the Thumb T32 encoding of LDM, if only a single register is specified in the register list this instruction is UNPREDICTABLE, with the following c
target/arm: Permit T32 LDM with single register
For the Thumb T32 encoding of LDM, if only a single register is specified in the register list this instruction is UNPREDICTABLE, with the following choices: * instruction UNDEFs * instruction is a NOP * instruction loads a single register * instruction loads an unspecified set of registers
Currently we choose to UNDEF (a behaviour chosen in commit 4b222545dbf30 in 2019; previously we treated it as "load the specified single register").
Unfortunately there is real world code out there (which shipped in at least Android 11, 12 and 13) which incorrectly uses this UNPREDICTABLE insn on the assumption that it does a single register load, which is (presumably) what it happens to do on real hardware, and is also what it does on the equivalent A32 encoding.
Revert to the pre-4b222545dbf30 behaviour of not UNDEFing for this T32 encoding.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1799 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230927101853.39288-1-peter.maydell@linaro.org
show more ...
|
#
b77af26e |
| 13-Sep-2023 |
Richard Henderson <richard.henderson@linaro.org> |
accel/tcg: Replace CPUState.env_ptr with cpu_env()
Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
|
#
ad75a51e |
| 13-Sep-2023 |
Richard Henderson <richard.henderson@linaro.org> |
tcg: Rename cpu_env to tcg_env
Allow the name 'cpu_env' to be used for something else.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@li
tcg: Rename cpu_env to tcg_env
Allow the name 'cpu_env' to be used for something else.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
#
e8967b61 |
| 30-Aug-2023 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Use tcg_gen_gvec_cmpi for compare vs 0
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230831030904.1194667-3-r
target/arm: Use tcg_gen_gvec_cmpi for compare vs 0
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230831030904.1194667-3-richard.henderson@linaro.org>
show more ...
|
#
9cd0c0de |
| 31-Aug-2023 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Implement FEAT_TIDCP1
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230831232441.66020-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.ma
target/arm: Implement FEAT_TIDCP1
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230831232441.66020-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
#
27920d3d |
| 31-Aug-2023 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Implement HCR_EL2.TIDCP
Perform the check for EL2 enabled in the security space and the TIDCP bit in an out-of-line helper.
Signed-off-by: Richard Henderson <richard.henderson@linaro.or
target/arm: Implement HCR_EL2.TIDCP
Perform the check for EL2 enabled in the security space and the TIDCP bit in an out-of-line helper.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230831232441.66020-4-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
#
a1264259 |
| 04-Aug-2023 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Use tcg_gen_negsetcond_*
Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
|
#
cd1e4db7 |
| 22-Aug-2023 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Fix 64-bit SSRA
Typo applied byte-wise shift instead of double-word shift.
Cc: qemu-stable@nongnu.org Fixes: 631e565450c ("target/arm: Create gen_gvec_[us]sra") Resolves: https://gitlab
target/arm: Fix 64-bit SSRA
Typo applied byte-wise shift instead of double-word shift.
Cc: qemu-stable@nongnu.org Fixes: 631e565450c ("target/arm: Create gen_gvec_[us]sra") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1737 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230821022025.397682-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
#
63188a00 |
| 22-Aug-2023 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Fix 64-bit SSRA
Typo applied byte-wise shift instead of double-word shift.
Cc: qemu-stable@nongnu.org Fixes: 631e565450c ("target/arm: Create gen_gvec_[us]sra") Resolves: https://gitlab
target/arm: Fix 64-bit SSRA
Typo applied byte-wise shift instead of double-word shift.
Cc: qemu-stable@nongnu.org Fixes: 631e565450c ("target/arm: Create gen_gvec_[us]sra") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1737 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230821022025.397682-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> (cherry picked from commit cd1e4db73646006039f25879af3bff55b2295ff3) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
show more ...
|
#
2b0d656a |
| 27-Jul-2023 |
Peter Maydell <peter.maydell@linaro.org> |
target/arm: Avoid writing to constant TCGv in trans_CSEL()
In commit 0b188ea05acb5 we changed the implementation of trans_CSEL() to use tcg_constant_i32(). However, this change was incorrect, becaus
target/arm: Avoid writing to constant TCGv in trans_CSEL()
In commit 0b188ea05acb5 we changed the implementation of trans_CSEL() to use tcg_constant_i32(). However, this change was incorrect, because the implementation of the function sets up the TCGv_i32 rn and rm to be either zero or else a TCG temp created in load_reg(), and these TCG temps are then in both cases written to by the emitted TCG ops. The result is that we hit a TCG assertion:
qemu-system-arm: ../../tcg/tcg.c:4455: tcg_reg_alloc_mov: Assertion `!temp_readonly(ots)' failed.
(or on a non-debug build, just produce a garbage result)
Adjust the code so that rn and rm are always writeable temporaries whether the instruction is using the special case "0" or a normal register as input.
Cc: qemu-stable@nongnu.org Fixes: 0b188ea05acb5 ("target/arm: Use tcg_constant in trans_CSEL") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230727103906.2641264-1-peter.maydell@linaro.org
show more ...
|
#
e452ca5a |
| 06-Jun-2023 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Introduce finalize_memop_{atom,pair}
Let finalize_memop_atom be the new basic function, with finalize_memop and finalize_memop_pair testing FEAT_LSE2 to apply the appropriate atomicity.
target/arm: Introduce finalize_memop_{atom,pair}
Let finalize_memop_atom be the new basic function, with finalize_memop and finalize_memop_pair testing FEAT_LSE2 to apply the appropriate atomicity.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230530191438.411344-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
show more ...
|
Revision tags: v8.0.0 |
|
#
5d05e5a1 |
| 01-Apr-2023 |
Richard Henderson <richard.henderson@linaro.org> |
target/arm: Tidy helpers for translation
Move most includes from *translate*.c to translate.h, ensuring that we get the ordering correct. Ensure cpu.h is first. Use disas/disas.h instead of exec/lo
target/arm: Tidy helpers for translation
Move most includes from *translate*.c to translate.h, ensuring that we get the ordering correct. Ensure cpu.h is first. Use disas/disas.h instead of exec/log.h. Drop otherwise unused includes.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
#
dfd1b812 |
| 23-May-2023 |
Richard Henderson <richard.henderson@linaro.org> |
accel/tcg: Introduce translator_io_start
New wrapper around gen_io_start which takes care of the USE_ICOUNT check, as well as marking the DisasContext to end the TB. Remove exec/gen-icount.h.
Revie
accel/tcg: Introduce translator_io_start
New wrapper around gen_io_start which takes care of the USE_ICOUNT check, as well as marking the DisasContext to end the TB. Remove exec/gen-icount.h.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
#
c213ee2d |
| 31-Mar-2023 |
Richard Henderson <richard.henderson@linaro.org> |
tcg: Split helper-proto.h
Create helper-proto-common.h without the target specific portion. Use that in tcg-op-common.h. Include helper-proto.h in target/arm and target/hexagon before helper-info.c
tcg: Split helper-proto.h
Create helper-proto-common.h without the target specific portion. Use that in tcg-op-common.h. Include helper-proto.h in target/arm and target/hexagon before helper-info.c.inc; all other targets are already correct in this regard.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
#
e4eff8e4 |
| 31-Mar-2023 |
Richard Henderson <richard.henderson@linaro.org> |
tcg: Split helper-gen.h
Create helper-gen-common.h without the target specific portion. Use that in tcg-op-common.h. Reorg headers in target/arm to ensure that helper-gen.h is included before helpe
tcg: Split helper-gen.h
Create helper-gen-common.h without the target specific portion. Use that in tcg-op-common.h. Reorg headers in target/arm to ensure that helper-gen.h is included before helper-info.c.inc. All other targets are already correct in this regard.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
#
d53106c9 |
| 31-Mar-2023 |
Richard Henderson <richard.henderson@linaro.org> |
tcg: Pass TCGHelperInfo to tcg_gen_callN
In preparation for compiling tcg/ only once, eliminate the all_helpers array. Instantiate the info structs for the generic helpers in accel/tcg/, and the st
tcg: Pass TCGHelperInfo to tcg_gen_callN
In preparation for compiling tcg/ only once, eliminate the all_helpers array. Instantiate the info structs for the generic helpers in accel/tcg/, and the structs for the target-specific helpers in each translate.c.
Since we don't see all of the info structs at startup, initialize at first use, using g_once_init_* to make sure we don't race while doing so.
Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|