[Qemu-devel] [PULL 00/13] target-arm queue
[PULL v2 00/11] target-arm queue
1
target-arm queue:
1
Massively slimmed down v2: MemTag broke bsd-user, and the npcm7xx
2
* mostly my latest v8M stuff, plus a couple of minor patches
2
ethernet device failed 'make check' on big-endian hosts.
3
3
4
The following changes since commit a0b261db8c030813e30a39eae47359ac2a37f7e2:
4
-- PMM
5
5
6
Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into staging (2017-10-12 10:02:09 +0100)
6
The following changes since commit 83339e21d05c824ebc9131d644f25c23d0e41ecf:
7
7
8
are available in the git repository at:
8
Merge remote-tracking branch 'remotes/stefanha-gitlab/tags/block-pull-request' into staging (2021-02-10 15:42:20 +0000)
9
9
10
git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171012
10
are available in the Git repository at:
11
11
12
for you to fetch changes up to cf5f7937b05c84d5565134f058c00cd48304a117:
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210211-1
13
13
14
nvic: Fix miscalculation of offsets into ITNS array (2017-10-12 16:33:16 +0100)
14
for you to fetch changes up to d3c1183ffeb71ca3a783eae3d7e1c51e71e8a621:
15
16
target/arm: Correctly initialize MDCR_EL2.HPMN (2021-02-11 19:48:09 +0000)
15
17
16
----------------------------------------------------------------
18
----------------------------------------------------------------
17
target-arm queue:
19
target-arm queue:
18
* v8M: SG, BLXNS, secure-return
20
* Correctly initialize MDCR_EL2.HPMN
19
* v8M: fixes for coverity issues in previous patches
21
* versal: Use nr_apu_cpus in favor of hard coding 2
20
* arm: fix armv7m_init() declaration to match definition
22
* accel/tcg: Add URL of clang bug to comment about our workaround
21
* watchdog/aspeed: fix variable type to store reload value
23
* Add support for FEAT_DIT, Data Independent Timing
24
* Remove GPIO from unimplemented NPCM7XX
25
* Fix SCR RES1 handling
26
* Don't migrate CPUARMState.features
22
27
23
----------------------------------------------------------------
28
----------------------------------------------------------------
24
Cédric Le Goater (1):
29
Aaron Lindsay (1):
25
watchdog/aspeed: fix variable type to store reload value
30
target/arm: Don't migrate CPUARMState.features
26
31
27
Igor Mammedov (1):
32
Daniel Müller (1):
28
arm: fix armv7m_init() declaration to match definition
33
target/arm: Correctly initialize MDCR_EL2.HPMN
29
34
30
Peter Maydell (11):
35
Edgar E. Iglesias (1):
31
target/arm: Add M profile secure MMU index values to get_a32_user_mem_index()
36
hw/arm: versal: Use nr_apu_cpus in favor of hard coding 2
32
target/arm: Implement SG instruction
33
target/arm: Implement BLXNS
34
target/arm: Implement secure function return
35
target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1
36
target/arm: Pull Thumb insn word loads up to top level
37
target-arm: Simplify insn_crosses_page()
38
target/arm: Support some Thumb insns being always unconditional
39
target/arm: Implement SG instruction corner cases
40
nvic: Add missing 'break'
41
nvic: Fix miscalculation of offsets into ITNS array
42
37
43
include/hw/arm/arm.h | 2 +-
38
Hao Wu (1):
44
target/arm/helper.h | 1 +
39
hw/arm: Remove GPIO from unimplemented NPCM7XX
45
target/arm/internals.h | 8 ++
46
hw/intc/armv7m_nvic.c | 5 +-
47
hw/watchdog/wdt_aspeed.c | 4 +-
48
target/arm/helper.c | 306 ++++++++++++++++++++++++++++++++++++++++++++--
49
target/arm/translate.c | 310 ++++++++++++++++++++++++++++++++---------------
50
7 files changed, 521 insertions(+), 115 deletions(-)
51
40
41
Mike Nawrocki (1):
42
target/arm: Fix SCR RES1 handling
43
44
Peter Maydell (2):
45
arm: Update infocenter.arm.com URLs
46
accel/tcg: Add URL of clang bug to comment about our workaround
47
48
Rebecca Cran (4):
49
target/arm: Add support for FEAT_DIT, Data Independent Timing
50
target/arm: Support AA32 DIT by moving PSTATE_SS from cpsr into env->pstate
51
target/arm: Set ID_AA64PFR0.DIT and ID_PFR0.DIT to 1 for "max" AA64 CPU
52
target/arm: Set ID_PFR0.DIT to 1 for "max" 32-bit CPU
53
54
include/hw/dma/pl080.h | 7 ++--
55
include/hw/misc/arm_integrator_debug.h | 2 +-
56
include/hw/ssi/pl022.h | 5 ++-
57
target/arm/cpu.h | 17 ++++++++
58
target/arm/internals.h | 6 +++
59
accel/tcg/cpu-exec.c | 25 +++++++++---
60
hw/arm/aspeed_ast2600.c | 2 +-
61
hw/arm/musca.c | 4 +-
62
hw/arm/npcm7xx.c | 8 ----
63
hw/arm/xlnx-versal.c | 4 +-
64
hw/misc/arm_integrator_debug.c | 2 +-
65
hw/timer/arm_timer.c | 7 ++--
66
target/arm/cpu.c | 4 ++
67
target/arm/cpu64.c | 5 +++
68
target/arm/helper-a64.c | 27 +++++++++++--
69
target/arm/helper.c | 71 +++++++++++++++++++++++++++-------
70
target/arm/machine.c | 2 +-
71
target/arm/op_helper.c | 9 +----
72
target/arm/translate-a64.c | 12 ++++++
73
19 files changed, 164 insertions(+), 55 deletions(-)
74
diff view generated by jsdifflib
[Qemu-devel] [PULL 01/13] watchdog/aspeed: fix variable type to store reload value
Deleted patch
1
From: Cédric Le Goater <clg@kaod.org>
2
1
3
Initially from Anton D. Kachalov" <mouse@yandex-team.ru> but the SoB was
4
missing.
5
6
Signed-off-by: Cédric Le Goater <clg@kaod.org>
7
Acked-by: Andrew Jeffery <andrew@aj.id.au>
8
Message-id: 20170920064915.30027-1-clg@kaod.org
9
[clg: change commit log and subject
10
replace UL suffix by ULL ]
11
Signed-off-by: Cédric Le Goater <clg@kaod.org>
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
---
15
hw/watchdog/wdt_aspeed.c | 4 ++--
16
1 file changed, 2 insertions(+), 2 deletions(-)
17
18
diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
19
index XXXXXXX..XXXXXXX 100644
20
--- a/hw/watchdog/wdt_aspeed.c
21
+++ b/hw/watchdog/wdt_aspeed.c
22
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
23
24
static void aspeed_wdt_reload(AspeedWDTState *s, bool pclk)
25
{
26
- uint32_t reload;
27
+ uint64_t reload;
28
29
if (pclk) {
30
reload = muldiv64(s->regs[WDT_RELOAD_VALUE], NANOSECONDS_PER_SECOND,
31
s->pclk_freq);
32
} else {
33
- reload = s->regs[WDT_RELOAD_VALUE] * 1000;
34
+ reload = s->regs[WDT_RELOAD_VALUE] * 1000ULL;
35
}
36
37
if (aspeed_wdt_is_enabled(s)) {
38
--
39
2.7.4
40
41
diff view generated by jsdifflib
[Qemu-devel] [PULL 02/13] arm: fix armv7m_init() declaration to match definition
Deleted patch
1
From: Igor Mammedov <imammedo@redhat.com>
2
1
3
s/cpu_model/cpu_type/ that has been forgotten during
4
conversion (ba1ba5cc), while touching the line also
5
fixup alignment.
6
7
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
8
Message-id: 1507710805-221721-1-git-send-email-imammedo@redhat.com
9
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
include/hw/arm/arm.h | 2 +-
13
1 file changed, 1 insertion(+), 1 deletion(-)
14
15
diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
16
index XXXXXXX..XXXXXXX 100644
17
--- a/include/hw/arm/arm.h
18
+++ b/include/hw/arm/arm.h
19
@@ -XXX,XX +XXX,XX @@ typedef enum {
20
21
/* armv7m.c */
22
DeviceState *armv7m_init(MemoryRegion *system_memory, int mem_size, int num_irq,
23
- const char *kernel_filename, const char *cpu_model);
24
+ const char *kernel_filename, const char *cpu_type);
25
/**
26
* armv7m_load_kernel:
27
* @cpu: CPU
28
--
29
2.7.4
30
31
diff view generated by jsdifflib
[Qemu-devel] [PULL 03/13] target/arm: Add M profile secure MMU index values to get_a32_user_mem_index()
Deleted patch
1
Add the M profile secure MMU index values to the switch in
2
get_a32_user_mem_index() so that LDRT/STRT work correctly
3
rather than asserting at translate time.
4
1
5
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 1507556919-24992-2-git-send-email-peter.maydell@linaro.org
8
---
9
target/arm/translate.c | 4 ++++
10
1 file changed, 4 insertions(+)
11
12
diff --git a/target/arm/translate.c b/target/arm/translate.c
13
index XXXXXXX..XXXXXXX 100644
14
--- a/target/arm/translate.c
15
+++ b/target/arm/translate.c
16
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
17
case ARMMMUIdx_MPriv:
18
case ARMMMUIdx_MNegPri:
19
return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
20
+ case ARMMMUIdx_MSUser:
21
+ case ARMMMUIdx_MSPriv:
22
+ case ARMMMUIdx_MSNegPri:
23
+ return arm_to_core_mmu_idx(ARMMMUIdx_MSUser);
24
case ARMMMUIdx_S2NS:
25
default:
26
g_assert_not_reached();
27
--
28
2.7.4
29
30
diff view generated by jsdifflib
[Qemu-devel] [PULL 04/13] target/arm: Implement SG instruction
Deleted patch
1
Implement the SG instruction, which we emulate 'by hand' in the
2
exception handling code path.
3
1
4
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
6
Message-id: 1507556919-24992-3-git-send-email-peter.maydell@linaro.org
7
---
8
target/arm/helper.c | 132 ++++++++++++++++++++++++++++++++++++++++++++++++++--
9
1 file changed, 127 insertions(+), 5 deletions(-)
10
11
diff --git a/target/arm/helper.c b/target/arm/helper.c
12
index XXXXXXX..XXXXXXX 100644
13
--- a/target/arm/helper.c
14
+++ b/target/arm/helper.c
15
@@ -XXX,XX +XXX,XX @@ typedef struct V8M_SAttributes {
16
bool irvalid;
17
} V8M_SAttributes;
18
19
+static void v8m_security_lookup(CPUARMState *env, uint32_t address,
20
+ MMUAccessType access_type, ARMMMUIdx mmu_idx,
21
+ V8M_SAttributes *sattrs);
22
+
23
/* Definitions for the PMCCNTR and PMCR registers */
24
#define PMCRD 0x8
25
#define PMCRC 0x4
26
@@ -XXX,XX +XXX,XX @@ static void arm_log_exception(int idx)
27
}
28
}
29
30
+static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
31
+ uint32_t addr, uint16_t *insn)
32
+{
33
+ /* Load a 16-bit portion of a v7M instruction, returning true on success,
34
+ * or false on failure (in which case we will have pended the appropriate
35
+ * exception).
36
+ * We need to do the instruction fetch's MPU and SAU checks
37
+ * like this because there is no MMU index that would allow
38
+ * doing the load with a single function call. Instead we must
39
+ * first check that the security attributes permit the load
40
+ * and that they don't mismatch on the two halves of the instruction,
41
+ * and then we do the load as a secure load (ie using the security
42
+ * attributes of the address, not the CPU, as architecturally required).
43
+ */
44
+ CPUState *cs = CPU(cpu);
45
+ CPUARMState *env = &cpu->env;
46
+ V8M_SAttributes sattrs = {};
47
+ MemTxAttrs attrs = {};
48
+ ARMMMUFaultInfo fi = {};
49
+ MemTxResult txres;
50
+ target_ulong page_size;
51
+ hwaddr physaddr;
52
+ int prot;
53
+ uint32_t fsr;
54
+
55
+ v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);
56
+ if (!sattrs.nsc || sattrs.ns) {
57
+ /* This must be the second half of the insn, and it straddles a
58
+ * region boundary with the second half not being S&NSC.
59
+ */
60
+ env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
61
+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
62
+ qemu_log_mask(CPU_LOG_INT,
63
+ "...really SecureFault with SFSR.INVEP\n");
64
+ return false;
65
+ }
66
+ if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
67
+ &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
68
+ /* the MPU lookup failed */
69
+ env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
70
+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
71
+ qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
72
+ return false;
73
+ }
74
+ *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,
75
+ attrs, &txres);
76
+ if (txres != MEMTX_OK) {
77
+ env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
78
+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
79
+ qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
80
+ return false;
81
+ }
82
+ return true;
83
+}
84
+
85
+static bool v7m_handle_execute_nsc(ARMCPU *cpu)
86
+{
87
+ /* Check whether this attempt to execute code in a Secure & NS-Callable
88
+ * memory region is for an SG instruction; if so, then emulate the
89
+ * effect of the SG instruction and return true. Otherwise pend
90
+ * the correct kind of exception and return false.
91
+ */
92
+ CPUARMState *env = &cpu->env;
93
+ ARMMMUIdx mmu_idx;
94
+ uint16_t insn;
95
+
96
+ /* We should never get here unless get_phys_addr_pmsav8() caused
97
+ * an exception for NS executing in S&NSC memory.
98
+ */
99
+ assert(!env->v7m.secure);
100
+ assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
101
+
102
+ /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
103
+ mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
104
+
105
+ if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
106
+ return false;
107
+ }
108
+
109
+ if (!env->thumb) {
110
+ goto gen_invep;
111
+ }
112
+
113
+ if (insn != 0xe97f) {
114
+ /* Not an SG instruction first half (we choose the IMPDEF
115
+ * early-SG-check option).
116
+ */
117
+ goto gen_invep;
118
+ }
119
+
120
+ if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
121
+ return false;
122
+ }
123
+
124
+ if (insn != 0xe97f) {
125
+ /* Not an SG instruction second half (yes, both halves of the SG
126
+ * insn have the same hex value)
127
+ */
128
+ goto gen_invep;
129
+ }
130
+
131
+ /* OK, we have confirmed that we really have an SG instruction.
132
+ * We know we're NS in S memory so don't need to repeat those checks.
133
+ */
134
+ qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
135
+ ", executing it\n", env->regs[15]);
136
+ env->regs[14] &= ~1;
137
+ switch_v7m_security_state(env, true);
138
+ xpsr_write(env, 0, XPSR_IT);
139
+ env->regs[15] += 4;
140
+ return true;
141
+
142
+gen_invep:
143
+ env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
144
+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
145
+ qemu_log_mask(CPU_LOG_INT,
146
+ "...really SecureFault with SFSR.INVEP\n");
147
+ return false;
148
+}
149
+
150
void arm_v7m_cpu_do_interrupt(CPUState *cs)
151
{
152
ARMCPU *cpu = ARM_CPU(cs);
153
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
154
* the SG instruction have the same security attributes.)
155
* Everything else must generate an INVEP SecureFault, so we
156
* emulate the SG instruction here.
157
- * TODO: actually emulate SG.
158
*/
159
- env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
160
- armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
161
- qemu_log_mask(CPU_LOG_INT,
162
- "...really SecureFault with SFSR.INVEP\n");
163
+ if (v7m_handle_execute_nsc(cpu)) {
164
+ return;
165
+ }
166
break;
167
case M_FAKE_FSR_SFAULT:
168
/* Various flavours of SecureFault for attempts to execute or
169
--
170
2.7.4
171
172
diff view generated by jsdifflib
[Qemu-devel] [PULL 05/13] target/arm: Implement BLXNS
Deleted patch
1
Implement the BLXNS instruction, which allows secure code to
2
call non-secure code.
3
1
4
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
6
Message-id: 1507556919-24992-4-git-send-email-peter.maydell@linaro.org
7
---
8
target/arm/helper.h | 1 +
9
target/arm/internals.h | 1 +
10
target/arm/helper.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++
11
target/arm/translate.c | 17 +++++++++++++--
12
4 files changed, 76 insertions(+), 2 deletions(-)
13
14
diff --git a/target/arm/helper.h b/target/arm/helper.h
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/helper.h
17
+++ b/target/arm/helper.h
18
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(v7m_msr, void, env, i32, i32)
19
DEF_HELPER_2(v7m_mrs, i32, env, i32)
20
21
DEF_HELPER_2(v7m_bxns, void, env, i32)
22
+DEF_HELPER_2(v7m_blxns, void, env, i32)
23
24
DEF_HELPER_4(access_check_cp_reg, void, env, ptr, i32, i32)
25
DEF_HELPER_3(set_cp_reg, void, env, ptr, i32)
26
diff --git a/target/arm/internals.h b/target/arm/internals.h
27
index XXXXXXX..XXXXXXX 100644
28
--- a/target/arm/internals.h
29
+++ b/target/arm/internals.h
30
@@ -XXX,XX +XXX,XX @@ static inline bool excp_is_internal(int excp)
31
FIELD(V7M_CONTROL, NPRIV, 0, 1)
32
FIELD(V7M_CONTROL, SPSEL, 1, 1)
33
FIELD(V7M_CONTROL, FPCA, 2, 1)
34
+FIELD(V7M_CONTROL, SFPA, 3, 1)
35
36
/* Bit definitions for v7M exception return payload */
37
FIELD(V7M_EXCRET, ES, 0, 1)
38
diff --git a/target/arm/helper.c b/target/arm/helper.c
39
index XXXXXXX..XXXXXXX 100644
40
--- a/target/arm/helper.c
41
+++ b/target/arm/helper.c
42
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
43
g_assert_not_reached();
44
}
45
46
+void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
47
+{
48
+ /* translate.c should never generate calls here in user-only mode */
49
+ g_assert_not_reached();
50
+}
51
+
52
void switch_mode(CPUARMState *env, int mode)
53
{
54
ARMCPU *cpu = arm_env_get_cpu(env);
55
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
56
env->regs[15] = dest & ~1;
57
}
58
59
+void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
60
+{
61
+ /* Handle v7M BLXNS:
62
+ * - bit 0 of the destination address is the target security state
63
+ */
64
+
65
+ /* At this point regs[15] is the address just after the BLXNS */
66
+ uint32_t nextinst = env->regs[15] | 1;
67
+ uint32_t sp = env->regs[13] - 8;
68
+ uint32_t saved_psr;
69
+
70
+ /* translate.c will have made BLXNS UNDEF unless we're secure */
71
+ assert(env->v7m.secure);
72
+
73
+ if (dest & 1) {
74
+ /* target is Secure, so this is just a normal BLX,
75
+ * except that the low bit doesn't indicate Thumb/not.
76
+ */
77
+ env->regs[14] = nextinst;
78
+ env->thumb = 1;
79
+ env->regs[15] = dest & ~1;
80
+ return;
81
+ }
82
+
83
+ /* Target is non-secure: first push a stack frame */
84
+ if (!QEMU_IS_ALIGNED(sp, 8)) {
85
+ qemu_log_mask(LOG_GUEST_ERROR,
86
+ "BLXNS with misaligned SP is UNPREDICTABLE\n");
87
+ }
88
+
89
+ saved_psr = env->v7m.exception;
90
+ if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
91
+ saved_psr |= XPSR_SFPA;
92
+ }
93
+
94
+ /* Note that these stores can throw exceptions on MPU faults */
95
+ cpu_stl_data(env, sp, nextinst);
96
+ cpu_stl_data(env, sp + 4, saved_psr);
97
+
98
+ env->regs[13] = sp;
99
+ env->regs[14] = 0xfeffffff;
100
+ if (arm_v7m_is_handler_mode(env)) {
101
+ /* Write a dummy value to IPSR, to avoid leaking the current secure
102
+ * exception number to non-secure code. This is guaranteed not
103
+ * to cause write_v7m_exception() to actually change stacks.
104
+ */
105
+ write_v7m_exception(env, 1);
106
+ }
107
+ switch_v7m_security_state(env, 0);
108
+ env->thumb = 1;
109
+ env->regs[15] = dest;
110
+}
111
+
112
static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
113
bool spsel)
114
{
115
diff --git a/target/arm/translate.c b/target/arm/translate.c
116
index XXXXXXX..XXXXXXX 100644
117
--- a/target/arm/translate.c
118
+++ b/target/arm/translate.c
119
@@ -XXX,XX +XXX,XX @@ static inline void gen_bxns(DisasContext *s, int rm)
120
s->base.is_jmp = DISAS_EXIT;
121
}
122
123
+static inline void gen_blxns(DisasContext *s, int rm)
124
+{
125
+ TCGv_i32 var = load_reg(s, rm);
126
+
127
+ /* We don't need to sync condexec state, for the same reason as bxns.
128
+ * We do however need to set the PC, because the blxns helper reads it.
129
+ * The blxns helper may throw an exception.
130
+ */
131
+ gen_set_pc_im(s, s->pc);
132
+ gen_helper_v7m_blxns(cpu_env, var);
133
+ tcg_temp_free_i32(var);
134
+ s->base.is_jmp = DISAS_EXIT;
135
+}
136
+
137
/* Variant of store_reg which uses branch&exchange logic when storing
138
to r15 in ARM architecture v7 and above. The source must be a temporary
139
and will be marked as dead. */
140
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
141
goto undef;
142
}
143
if (link) {
144
- /* BLXNS: not yet implemented */
145
- goto undef;
146
+ gen_blxns(s, rm);
147
} else {
148
gen_bxns(s, rm);
149
}
150
--
151
2.7.4
152
153
diff view generated by jsdifflib
[Qemu-devel] [PULL 06/13] target/arm: Implement secure function return
Deleted patch
1
Secure function return happens when a non-secure function has been
2
called using BLXNS and so has a particular magic LR value (either
3
0xfefffffe or 0xfeffffff). The function return via BX behaves
4
specially when the new PC value is this magic value, in the same
5
way that exception returns are handled.
6
1
7
Adjust our BX excret guards so that they recognize the function
8
return magic number as well, and perform the function-return
9
unstacking in do_v7m_exception_exit().
10
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 1507556919-24992-5-git-send-email-peter.maydell@linaro.org
15
---
16
target/arm/internals.h | 7 +++
17
target/arm/helper.c | 115 +++++++++++++++++++++++++++++++++++++++++++++----
18
target/arm/translate.c | 14 +++++-
19
3 files changed, 126 insertions(+), 10 deletions(-)
20
21
diff --git a/target/arm/internals.h b/target/arm/internals.h
22
index XXXXXXX..XXXXXXX 100644
23
--- a/target/arm/internals.h
24
+++ b/target/arm/internals.h
25
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_EXCRET, DCRS, 5, 1)
26
FIELD(V7M_EXCRET, S, 6, 1)
27
FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
28
29
+/* Minimum value which is a magic number for exception return */
30
+#define EXC_RETURN_MIN_MAGIC 0xff000000
31
+/* Minimum number which is a magic number for function or exception return
32
+ * when using v8M security extension
33
+ */
34
+#define FNC_RETURN_MIN_MAGIC 0xfefffffe
35
+
36
/* We use a few fake FSR values for internal purposes in M profile.
37
* M profile cores don't have A/R format FSRs, but currently our
38
* get_phys_addr() code assumes A/R profile and reports failures via
39
diff --git a/target/arm/helper.c b/target/arm/helper.c
40
index XXXXXXX..XXXXXXX 100644
41
--- a/target/arm/helper.c
42
+++ b/target/arm/helper.c
43
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
44
* - if the return value is a magic value, do exception return (like BX)
45
* - otherwise bit 0 of the return value is the target security state
46
*/
47
- if (dest >= 0xff000000) {
48
+ uint32_t min_magic;
49
+
50
+ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
51
+ /* Covers FNC_RETURN and EXC_RETURN magic */
52
+ min_magic = FNC_RETURN_MIN_MAGIC;
53
+ } else {
54
+ /* EXC_RETURN magic only */
55
+ min_magic = EXC_RETURN_MIN_MAGIC;
56
+ }
57
+
58
+ if (dest >= min_magic) {
59
/* This is an exception return magic value; put it where
60
* do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
61
* Note that if we ever add gen_ss_advance() singlestep support to
62
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
63
bool exc_secure = false;
64
bool return_to_secure;
65
66
- /* We can only get here from an EXCP_EXCEPTION_EXIT, and
67
- * gen_bx_excret() enforces the architectural rule
68
- * that jumps to magic addresses don't have magic behaviour unless
69
- * we're in Handler mode (compare pseudocode BXWritePC()).
70
+ /* If we're not in Handler mode then jumps to magic exception-exit
71
+ * addresses don't have magic behaviour. However for the v8M
72
+ * security extensions the magic secure-function-return has to
73
+ * work in thread mode too, so to avoid doing an extra check in
74
+ * the generated code we allow exception-exit magic to also cause the
75
+ * internal exception and bring us here in thread mode. Correct code
76
+ * will never try to do this (the following insn fetch will always
77
+ * fault) so we the overhead of having taken an unnecessary exception
78
+ * doesn't matter.
79
*/
80
- assert(arm_v7m_is_handler_mode(env));
81
+ if (!arm_v7m_is_handler_mode(env)) {
82
+ return;
83
+ }
84
85
/* In the spec pseudocode ExceptionReturn() is called directly
86
* from BXWritePC() and gets the full target PC value including
87
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
88
qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
89
}
90
91
+static bool do_v7m_function_return(ARMCPU *cpu)
92
+{
93
+ /* v8M security extensions magic function return.
94
+ * We may either:
95
+ * (1) throw an exception (longjump)
96
+ * (2) return true if we successfully handled the function return
97
+ * (3) return false if we failed a consistency check and have
98
+ * pended a UsageFault that needs to be taken now
99
+ *
100
+ * At this point the magic return value is split between env->regs[15]
101
+ * and env->thumb. We don't bother to reconstitute it because we don't
102
+ * need it (all values are handled the same way).
103
+ */
104
+ CPUARMState *env = &cpu->env;
105
+ uint32_t newpc, newpsr, newpsr_exc;
106
+
107
+ qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
108
+
109
+ {
110
+ bool threadmode, spsel;
111
+ TCGMemOpIdx oi;
112
+ ARMMMUIdx mmu_idx;
113
+ uint32_t *frame_sp_p;
114
+ uint32_t frameptr;
115
+
116
+ /* Pull the return address and IPSR from the Secure stack */
117
+ threadmode = !arm_v7m_is_handler_mode(env);
118
+ spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
119
+
120
+ frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
121
+ frameptr = *frame_sp_p;
122
+
123
+ /* These loads may throw an exception (for MPU faults). We want to
124
+ * do them as secure, so work out what MMU index that is.
125
+ */
126
+ mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
127
+ oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx));
128
+ newpc = helper_le_ldul_mmu(env, frameptr, oi, 0);
129
+ newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0);
130
+
131
+ /* Consistency checks on new IPSR */
132
+ newpsr_exc = newpsr & XPSR_EXCP;
133
+ if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
134
+ (env->v7m.exception == 1 && newpsr_exc != 0))) {
135
+ /* Pend the fault and tell our caller to take it */
136
+ env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
137
+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
138
+ env->v7m.secure);
139
+ qemu_log_mask(CPU_LOG_INT,
140
+ "...taking INVPC UsageFault: "
141
+ "IPSR consistency check failed\n");
142
+ return false;
143
+ }
144
+
145
+ *frame_sp_p = frameptr + 8;
146
+ }
147
+
148
+ /* This invalidates frame_sp_p */
149
+ switch_v7m_security_state(env, true);
150
+ env->v7m.exception = newpsr_exc;
151
+ env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
152
+ if (newpsr & XPSR_SFPA) {
153
+ env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
154
+ }
155
+ xpsr_write(env, 0, XPSR_IT);
156
+ env->thumb = newpc & 1;
157
+ env->regs[15] = newpc & ~1;
158
+
159
+ qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
160
+ return true;
161
+}
162
+
163
static void arm_log_exception(int idx)
164
{
165
if (qemu_loglevel_mask(CPU_LOG_INT)) {
166
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
167
case EXCP_IRQ:
168
break;
169
case EXCP_EXCEPTION_EXIT:
170
- do_v7m_exception_exit(cpu);
171
- return;
172
+ if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
173
+ /* Must be v8M security extension function return */
174
+ assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
175
+ assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
176
+ if (do_v7m_function_return(cpu)) {
177
+ return;
178
+ }
179
+ } else {
180
+ do_v7m_exception_exit(cpu);
181
+ return;
182
+ }
183
+ break;
184
default:
185
cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
186
return; /* Never happens. Keep compiler happy. */
187
diff --git a/target/arm/translate.c b/target/arm/translate.c
188
index XXXXXXX..XXXXXXX 100644
189
--- a/target/arm/translate.c
190
+++ b/target/arm/translate.c
191
@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret(DisasContext *s, TCGv_i32 var)
192
* s->base.is_jmp that we need to do the rest of the work later.
193
*/
194
gen_bx(s, var);
195
- if (s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M)) {
196
+ if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY) ||
197
+ (s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M))) {
198
s->base.is_jmp = DISAS_BX_EXCRET;
199
}
200
}
201
@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret_final_code(DisasContext *s)
202
{
203
/* Generate the code to finish possible exception return and end the TB */
204
TCGLabel *excret_label = gen_new_label();
205
+ uint32_t min_magic;
206
+
207
+ if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY)) {
208
+ /* Covers FNC_RETURN and EXC_RETURN magic */
209
+ min_magic = FNC_RETURN_MIN_MAGIC;
210
+ } else {
211
+ /* EXC_RETURN magic only */
212
+ min_magic = EXC_RETURN_MIN_MAGIC;
213
+ }
214
215
/* Is the new PC value in the magic range indicating exception return? */
216
- tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], 0xff000000, excret_label);
217
+ tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], min_magic, excret_label);
218
/* No: end the TB as we would for a DISAS_JMP */
219
if (is_singlestepping(s)) {
220
gen_singlestep_exception(s);
221
--
222
2.7.4
223
224
diff view generated by jsdifflib
[Qemu-devel] [PULL 07/13] target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1
Deleted patch
1
The code which implements the Thumb1 split BL/BLX instructions
2
is guarded by a check on "not M or THUMB2". All we really need
3
to check here is "not THUMB2" (and we assume that elsewhere too,
4
eg in the ARCH(6T2) test that UNDEFs the Thumb2 insns).
5
1
6
This doesn't change behaviour because all M profile cores
7
have Thumb2 and so ARM_FEATURE_M implies ARM_FEATURE_THUMB2.
8
(v6M implements a very restricted subset of Thumb2, but we
9
can cross that bridge when we get to it with appropriate
10
feature bits.)
11
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 1507556919-24992-6-git-send-email-peter.maydell@linaro.org
15
---
16
target/arm/translate.c | 3 +--
17
1 file changed, 1 insertion(+), 2 deletions(-)
18
19
diff --git a/target/arm/translate.c b/target/arm/translate.c
20
index XXXXXXX..XXXXXXX 100644
21
--- a/target/arm/translate.c
22
+++ b/target/arm/translate.c
23
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
24
int conds;
25
int logic_cc;
26
27
- if (!(arm_dc_feature(s, ARM_FEATURE_THUMB2)
28
- || arm_dc_feature(s, ARM_FEATURE_M))) {
29
+ if (!arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
30
/* Thumb-1 cores may need to treat bl and blx as a pair of
31
16-bit instructions to get correct prefetch abort behavior. */
32
insn = insn_hw1;
33
--
34
2.7.4
35
36
diff view generated by jsdifflib
[Qemu-devel] [PULL 08/13] target/arm: Pull Thumb insn word loads up to top level
Deleted patch
1
Refactor the Thumb decode to do the loads of the instruction words at
2
the top level rather than only loading the second half of a 32-bit
3
Thumb insn in the middle of the decode.
4
1
5
This is simple apart from the awkward case of Thumb1, where the
6
BL/BLX prefix and suffix instructions live in what in Thumb2 is the
7
32-bit insn space. To handle these we decode enough to identify
8
whether we're looking at a prefix/suffix that we handle as a 16 bit
9
insn, or a prefix that we're going to merge with the following suffix
10
to consider as a 32 bit insn. The translation of the 16 bit cases
11
then moves from disas_thumb2_insn() to disas_thumb_insn().
12
13
The refactoring has the benefit that we don't need to pass the
14
CPUARMState* down into the decoder code any more, but the major
15
reason for doing this is that some Thumb instructions must be always
16
unconditional regardless of the IT state bits, so we need to know the
17
whole insn before we emit the "skip this insn if the IT bits and cond
18
state tell us to" code. (The always unconditional insns are BKPT,
19
HLT and SG; the last of these is 32 bits.)
20
21
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
22
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
23
Message-id: 1507556919-24992-7-git-send-email-peter.maydell@linaro.org
24
---
25
target/arm/translate.c | 178 ++++++++++++++++++++++++++++++-------------------
26
1 file changed, 108 insertions(+), 70 deletions(-)
27
28
diff --git a/target/arm/translate.c b/target/arm/translate.c
29
index XXXXXXX..XXXXXXX 100644
30
--- a/target/arm/translate.c
31
+++ b/target/arm/translate.c
32
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
33
}
34
}
35
36
+static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
37
+{
38
+ /* Return true if this is a 16 bit instruction. We must be precise
39
+ * about this (matching the decode). We assume that s->pc still
40
+ * points to the first 16 bits of the insn.
41
+ */
42
+ if ((insn >> 11) < 0x1d) {
43
+ /* Definitely a 16-bit instruction */
44
+ return true;
45
+ }
46
+
47
+ /* Top five bits 0b11101 / 0b11110 / 0b11111 : this is the
48
+ * first half of a 32-bit Thumb insn. Thumb-1 cores might
49
+ * end up actually treating this as two 16-bit insns, though,
50
+ * if it's half of a bl/blx pair that might span a page boundary.
51
+ */
52
+ if (arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
53
+ /* Thumb2 cores (including all M profile ones) always treat
54
+ * 32-bit insns as 32-bit.
55
+ */
56
+ return false;
57
+ }
58
+
59
+ if ((insn >> 11) == 0x1e && (s->pc < s->next_page_start - 3)) {
60
+ /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix, and the suffix
61
+ * is not on the next page; we merge this into a 32-bit
62
+ * insn.
63
+ */
64
+ return false;
65
+ }
66
+ /* 0b1110_1xxx_xxxx_xxxx : BLX suffix (or UNDEF);
67
+ * 0b1111_1xxx_xxxx_xxxx : BL suffix;
68
+ * 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix on the end of a page
69
+ * -- handle as single 16 bit insn
70
+ */
71
+ return true;
72
+}
73
+
74
/* Return true if this is a Thumb-2 logical op. */
75
static int
76
thumb2_logic_op(int op)
77
@@ -XXX,XX +XXX,XX @@ gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out,
78
79
/* Translate a 32-bit thumb instruction. Returns nonzero if the instruction
80
is not legal. */
81
-static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw1)
82
+static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
83
{
84
- uint32_t insn, imm, shift, offset;
85
+ uint32_t imm, shift, offset;
86
uint32_t rd, rn, rm, rs;
87
TCGv_i32 tmp;
88
TCGv_i32 tmp2;
89
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
90
int conds;
91
int logic_cc;
92
93
- if (!arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
94
- /* Thumb-1 cores may need to treat bl and blx as a pair of
95
- 16-bit instructions to get correct prefetch abort behavior. */
96
- insn = insn_hw1;
97
- if ((insn & (1 << 12)) == 0) {
98
- ARCH(5);
99
- /* Second half of blx. */
100
- offset = ((insn & 0x7ff) << 1);
101
- tmp = load_reg(s, 14);
102
- tcg_gen_addi_i32(tmp, tmp, offset);
103
- tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
104
-
105
- tmp2 = tcg_temp_new_i32();
106
- tcg_gen_movi_i32(tmp2, s->pc | 1);
107
- store_reg(s, 14, tmp2);
108
- gen_bx(s, tmp);
109
- return 0;
110
- }
111
- if (insn & (1 << 11)) {
112
- /* Second half of bl. */
113
- offset = ((insn & 0x7ff) << 1) | 1;
114
- tmp = load_reg(s, 14);
115
- tcg_gen_addi_i32(tmp, tmp, offset);
116
-
117
- tmp2 = tcg_temp_new_i32();
118
- tcg_gen_movi_i32(tmp2, s->pc | 1);
119
- store_reg(s, 14, tmp2);
120
- gen_bx(s, tmp);
121
- return 0;
122
- }
123
- if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
124
- /* Instruction spans a page boundary. Implement it as two
125
- 16-bit instructions in case the second half causes an
126
- prefetch abort. */
127
- offset = ((int32_t)insn << 21) >> 9;
128
- tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + offset);
129
- return 0;
130
- }
131
- /* Fall through to 32-bit decode. */
132
- }
133
-
134
- insn = arm_lduw_code(env, s->pc, s->sctlr_b);
135
- s->pc += 2;
136
- insn |= (uint32_t)insn_hw1 << 16;
137
-
138
+ /* The only 32 bit insn that's allowed for Thumb1 is the combined
139
+ * BL/BLX prefix and suffix.
140
+ */
141
if ((insn & 0xf800e800) != 0xf000e800) {
142
ARCH(6T2);
143
}
144
@@ -XXX,XX +XXX,XX @@ illegal_op:
145
return 1;
146
}
147
148
-static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
149
+static void disas_thumb_insn(DisasContext *s, uint32_t insn)
150
{
151
- uint32_t val, insn, op, rm, rn, rd, shift, cond;
152
+ uint32_t val, op, rm, rn, rd, shift, cond;
153
int32_t offset;
154
int i;
155
TCGv_i32 tmp;
156
TCGv_i32 tmp2;
157
TCGv_i32 addr;
158
159
- if (s->condexec_mask) {
160
- cond = s->condexec_cond;
161
- if (cond != 0x0e) { /* Skip conditional when condition is AL. */
162
- s->condlabel = gen_new_label();
163
- arm_gen_test_cc(cond ^ 1, s->condlabel);
164
- s->condjmp = 1;
165
- }
166
- }
167
-
168
- insn = arm_lduw_code(env, s->pc, s->sctlr_b);
169
- s->pc += 2;
170
-
171
switch (insn >> 12) {
172
case 0: case 1:
173
174
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
175
176
case 14:
177
if (insn & (1 << 11)) {
178
- if (disas_thumb2_insn(env, s, insn))
179
- goto undef32;
180
+ /* thumb_insn_is_16bit() ensures we can't get here for
181
+ * a Thumb2 CPU, so this must be a thumb1 split BL/BLX:
182
+ * 0b1110_1xxx_xxxx_xxxx : BLX suffix (or UNDEF)
183
+ */
184
+ assert(!arm_dc_feature(s, ARM_FEATURE_THUMB2));
185
+ ARCH(5);
186
+ offset = ((insn & 0x7ff) << 1);
187
+ tmp = load_reg(s, 14);
188
+ tcg_gen_addi_i32(tmp, tmp, offset);
189
+ tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
190
+
191
+ tmp2 = tcg_temp_new_i32();
192
+ tcg_gen_movi_i32(tmp2, s->pc | 1);
193
+ store_reg(s, 14, tmp2);
194
+ gen_bx(s, tmp);
195
break;
196
}
197
/* unconditional branch */
198
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
199
break;
200
201
case 15:
202
- if (disas_thumb2_insn(env, s, insn))
203
- goto undef32;
204
+ /* thumb_insn_is_16bit() ensures we can't get here for
205
+ * a Thumb2 CPU, so this must be a thumb1 split BL/BLX.
206
+ */
207
+ assert(!arm_dc_feature(s, ARM_FEATURE_THUMB2));
208
+
209
+ if (insn & (1 << 11)) {
210
+ /* 0b1111_1xxx_xxxx_xxxx : BL suffix */
211
+ offset = ((insn & 0x7ff) << 1) | 1;
212
+ tmp = load_reg(s, 14);
213
+ tcg_gen_addi_i32(tmp, tmp, offset);
214
+
215
+ tmp2 = tcg_temp_new_i32();
216
+ tcg_gen_movi_i32(tmp2, s->pc | 1);
217
+ store_reg(s, 14, tmp2);
218
+ gen_bx(s, tmp);
219
+ } else {
220
+ /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix */
221
+ uint32_t uoffset = ((int32_t)insn << 21) >> 9;
222
+
223
+ tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + uoffset);
224
+ }
225
break;
226
}
227
return;
228
-undef32:
229
- gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
230
- default_exception_el(s));
231
- return;
232
illegal_op:
233
undef:
234
gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized(),
235
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
236
{
237
DisasContext *dc = container_of(dcbase, DisasContext, base);
238
CPUARMState *env = cpu->env_ptr;
239
+ uint32_t insn;
240
+ bool is_16bit;
241
242
if (arm_pre_translate_insn(dc)) {
243
return;
244
}
245
246
- disas_thumb_insn(env, dc);
247
+ insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
248
+ is_16bit = thumb_insn_is_16bit(dc, insn);
249
+ dc->pc += 2;
250
+ if (!is_16bit) {
251
+ uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
252
+
253
+ insn = insn << 16 | insn2;
254
+ dc->pc += 2;
255
+ }
256
+
257
+ if (dc->condexec_mask) {
258
+ uint32_t cond = dc->condexec_cond;
259
+
260
+ if (cond != 0x0e) { /* Skip conditional when condition is AL. */
261
+ dc->condlabel = gen_new_label();
262
+ arm_gen_test_cc(cond ^ 1, dc->condlabel);
263
+ dc->condjmp = 1;
264
+ }
265
+ }
266
+
267
+ if (is_16bit) {
268
+ disas_thumb_insn(dc, insn);
269
+ } else {
270
+ disas_thumb2_insn(dc, insn);
271
+ }
272
273
/* Advance the Thumb condexec condition. */
274
if (dc->condexec_mask) {
275
--
276
2.7.4
277
278
diff view generated by jsdifflib
[Qemu-devel] [PULL 09/13] target-arm: Simplify insn_crosses_page()
Deleted patch
1
Recent changes have left insn_crosses_page() more complicated
2
than it needed to be:
3
* it's only called from thumb_tr_translate_insn() so we know
4
for certain that we're looking at a Thumb insn
5
* the caller's check for dc->pc >= dc->next_page_start - 3
6
means that dc->pc can't possibly be 4 aligned, so there's
7
no need to check that (the check was partly there to ensure
8
that we didn't treat an ARM insn as Thumb, I think)
9
* we now have thumb_insn_is_16bit() which lets us do a precise
10
check of the length of the next insn, rather than opencoding
11
an inaccurate check
12
1
13
Simplify it down to just loading the first half of the insn
14
and calling thumb_insn_is_16bit() on it.
15
16
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
17
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
18
Message-id: 1507556919-24992-8-git-send-email-peter.maydell@linaro.org
19
---
20
target/arm/translate.c | 27 ++++++---------------------
21
1 file changed, 6 insertions(+), 21 deletions(-)
22
23
diff --git a/target/arm/translate.c b/target/arm/translate.c
24
index XXXXXXX..XXXXXXX 100644
25
--- a/target/arm/translate.c
26
+++ b/target/arm/translate.c
27
@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
28
{
29
/* Return true if the insn at dc->pc might cross a page boundary.
30
* (False positives are OK, false negatives are not.)
31
+ * We know this is a Thumb insn, and our caller ensures we are
32
+ * only called if dc->pc is less than 4 bytes from the page
33
+ * boundary, so we cross the page if the first 16 bits indicate
34
+ * that this is a 32 bit insn.
35
*/
36
- uint16_t insn;
37
+ uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
38
39
- if ((s->pc & 3) == 0) {
40
- /* At a 4-aligned address we can't be crossing a page */
41
- return false;
42
- }
43
-
44
- /* This must be a Thumb insn */
45
- insn = arm_lduw_code(env, s->pc, s->sctlr_b);
46
-
47
- if ((insn >> 11) >= 0x1d) {
48
- /* Top five bits 0b11101 / 0b11110 / 0b11111 : this is the
49
- * First half of a 32-bit Thumb insn. Thumb-1 cores might
50
- * end up actually treating this as two 16-bit insns (see the
51
- * code at the start of disas_thumb2_insn()) but we don't bother
52
- * to check for that as it is unlikely, and false positives here
53
- * are harmless.
54
- */
55
- return true;
56
- }
57
- /* Definitely a 16-bit insn, can't be crossing a page. */
58
- return false;
59
+ return !thumb_insn_is_16bit(s, insn);
60
}
61
62
static int arm_tr_init_disas_context(DisasContextBase *dcbase,
63
--
64
2.7.4
65
66
diff view generated by jsdifflib
[Qemu-devel] [PULL 10/13] target/arm: Support some Thumb insns being always unconditional
Deleted patch
1
A few Thumb instructions are always unconditional even inside an
2
IT block (as opposed to being UNPREDICTABLE if used inside an
3
IT block): BKPT, the v8M SG instruction, and the A profile
4
HLT (debug halt) instruction.
5
1
6
This means we need to suppress the jump-over-instruction-on-condfail
7
code generation (though the IT state still advances as usual and
8
subsequent insns in the IT block may be conditional).
9
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Message-id: 1507556919-24992-9-git-send-email-peter.maydell@linaro.org
13
---
14
target/arm/translate.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
15
1 file changed, 47 insertions(+), 1 deletion(-)
16
17
diff --git a/target/arm/translate.c b/target/arm/translate.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/translate.c
20
+++ b/target/arm/translate.c
21
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
22
in init_disas_context by adjusting max_insns. */
23
}
24
25
+static bool thumb_insn_is_unconditional(DisasContext *s, uint32_t insn)
26
+{
27
+ /* Return true if this Thumb insn is always unconditional,
28
+ * even inside an IT block. This is true of only a very few
29
+ * instructions: BKPT, HLT, and SG.
30
+ *
31
+ * A larger class of instructions are UNPREDICTABLE if used
32
+ * inside an IT block; we do not need to detect those here, because
33
+ * what we do by default (perform the cc check and update the IT
34
+ * bits state machine) is a permitted CONSTRAINED UNPREDICTABLE
35
+ * choice for those situations.
36
+ *
37
+ * insn is either a 16-bit or a 32-bit instruction; the two are
38
+ * distinguishable because for the 16-bit case the top 16 bits
39
+ * are zeroes, and that isn't a valid 32-bit encoding.
40
+ */
41
+ if ((insn & 0xffffff00) == 0xbe00) {
42
+ /* BKPT */
43
+ return true;
44
+ }
45
+
46
+ if ((insn & 0xffffffc0) == 0xba80 && arm_dc_feature(s, ARM_FEATURE_V8) &&
47
+ !arm_dc_feature(s, ARM_FEATURE_M)) {
48
+ /* HLT: v8A only. This is unconditional even when it is going to
49
+ * UNDEF; see the v8A ARM ARM DDI0487B.a H3.3.
50
+ * For v7 cores this was a plain old undefined encoding and so
51
+ * honours its cc check. (We might be using the encoding as
52
+ * a semihosting trap, but we don't change the cc check behaviour
53
+ * on that account, because a debugger connected to a real v7A
54
+ * core and emulating semihosting traps by catching the UNDEF
55
+ * exception would also only see cases where the cc check passed.
56
+ * No guest code should be trying to do a HLT semihosting trap
57
+ * in an IT block anyway.
58
+ */
59
+ return true;
60
+ }
61
+
62
+ if (insn == 0xe97fe97f && arm_dc_feature(s, ARM_FEATURE_V8) &&
63
+ arm_dc_feature(s, ARM_FEATURE_M)) {
64
+ /* SG: v8M only */
65
+ return true;
66
+ }
67
+
68
+ return false;
69
+}
70
+
71
static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
72
{
73
DisasContext *dc = container_of(dcbase, DisasContext, base);
74
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
75
dc->pc += 2;
76
}
77
78
- if (dc->condexec_mask) {
79
+ if (dc->condexec_mask && !thumb_insn_is_unconditional(dc, insn)) {
80
uint32_t cond = dc->condexec_cond;
81
82
if (cond != 0x0e) { /* Skip conditional when condition is AL. */
83
--
84
2.7.4
85
86
diff view generated by jsdifflib
[Qemu-devel] [PULL 11/13] target/arm: Implement SG instruction corner cases
Deleted patch
1
The common situation of the SG instruction is that it is
2
executed from S&NSC memory by a CPU in NS state. That case
3
is handled by v7m_handle_execute_nsc(). However the instruction
4
also has defined behaviour in a couple of other cases:
5
* SG instruction in NS memory (behaves as a NOP)
6
* SG in S memory but CPU already secure (clears IT bits and
7
does nothing else)
8
* SG instruction in v8M without Security Extension (NOP)
9
1
10
These can be implemented in translate.c.
11
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 1507556919-24992-10-git-send-email-peter.maydell@linaro.org
15
---
16
target/arm/translate.c | 23 ++++++++++++++++++++++-
17
1 file changed, 22 insertions(+), 1 deletion(-)
18
19
diff --git a/target/arm/translate.c b/target/arm/translate.c
20
index XXXXXXX..XXXXXXX 100644
21
--- a/target/arm/translate.c
22
+++ b/target/arm/translate.c
23
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
24
* - load/store doubleword, load/store exclusive, ldacq/strel,
25
* table branch.
26
*/
27
- if (insn & 0x01200000) {
28
+ if (insn == 0xe97fe97f && arm_dc_feature(s, ARM_FEATURE_M) &&
29
+ arm_dc_feature(s, ARM_FEATURE_V8)) {
30
+ /* 0b1110_1001_0111_1111_1110_1001_0111_111
31
+ * - SG (v8M only)
32
+ * The bulk of the behaviour for this instruction is implemented
33
+ * in v7m_handle_execute_nsc(), which deals with the insn when
34
+ * it is executed by a CPU in non-secure state from memory
35
+ * which is Secure & NonSecure-Callable.
36
+ * Here we only need to handle the remaining cases:
37
+ * * in NS memory (including the "security extension not
38
+ * implemented" case) : NOP
39
+ * * in S memory but CPU already secure (clear IT bits)
40
+ * We know that the attribute for the memory this insn is
41
+ * in must match the current CPU state, because otherwise
42
+ * get_phys_addr_pmsav8 would have generated an exception.
43
+ */
44
+ if (s->v8m_secure) {
45
+ /* Like the IT insn, we don't need to generate any code */
46
+ s->condexec_cond = 0;
47
+ s->condexec_mask = 0;
48
+ }
49
+ } else if (insn & 0x01200000) {
50
/* 0b1110_1000_x11x_xxxx_xxxx_xxxx_xxxx_xxxx
51
* - load/store dual (post-indexed)
52
* 0b1111_1001_x10x_xxxx_xxxx_xxxx_xxxx_xxxx
53
--
54
2.7.4
55
56
diff view generated by jsdifflib
[Qemu-devel] [PULL 12/13] nvic: Add missing 'break'
Deleted patch
1
Coverity points out that we forgot the 'break' for
2
the SAU_CTRL write case (CID1381683). This has
3
no actual visible consequences because it happens
4
that the following case is effectively a no-op.
5
1
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
8
Message-id: 1507742676-9908-1-git-send-email-peter.maydell@linaro.org
9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
---
11
hw/intc/armv7m_nvic.c | 1 +
12
1 file changed, 1 insertion(+)
13
14
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/hw/intc/armv7m_nvic.c
17
+++ b/hw/intc/armv7m_nvic.c
18
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
19
return;
20
}
21
cpu->env.sau.ctrl = value & 3;
22
+ break;
23
case 0xdd4: /* SAU_TYPE */
24
if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
25
goto bad_offset;
26
--
27
2.7.4
28
29
diff view generated by jsdifflib
[Qemu-devel] [PULL 13/13] nvic: Fix miscalculation of offsets into ITNS array
Deleted patch
1
This calculation of the first exception vector in
2
the ITNS<n> register being accessed:
3
int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
4
1
5
is incorrect, because offset is in bytes, so we only want
6
to multiply by 8.
7
8
Spotted by Coverity (CID 1381484, CID 1381488), though it is
9
not correct that it actually overflows the buffer, because
10
we have a 'startvec + i < s->num_irq' guard.
11
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 1507650856-11718-1-git-send-email-peter.maydell@linaro.org
15
---
16
hw/intc/armv7m_nvic.c | 4 ++--
17
1 file changed, 2 insertions(+), 2 deletions(-)
18
19
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
20
index XXXXXXX..XXXXXXX 100644
21
--- a/hw/intc/armv7m_nvic.c
22
+++ b/hw/intc/armv7m_nvic.c
23
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
24
return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
25
case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
26
{
27
- int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
28
+ int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
29
int i;
30
31
if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
32
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
33
switch (offset) {
34
case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
35
{
36
- int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
37
+ int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
38
int i;
39
40
if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
41
--
42
2.7.4
43
44
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.