target-arm queue:

* mostly my latest v8M stuff, plus a couple of minor patches

The following changes since commit a0b261db8c030813e30a39eae47359ac2a37f7e2:

Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into staging (2017-10-12 10:02:09 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171012

for you to fetch changes up to cf5f7937b05c84d5565134f058c00cd48304a117:

nvic: Fix miscalculation of offsets into ITNS array (2017-10-12 16:33:16 +0100)

* v8M: SG, BLXNS, secure-return

* v8M: fixes for coverity issues in previous patches

* arm: fix armv7m_init() declaration to match definition

* watchdog/aspeed: fix variable type to store reload value

Cédric Le Goater (1):

watchdog/aspeed: fix variable type to store reload value

Igor Mammedov (1):

arm: fix armv7m_init() declaration to match definition

Peter Maydell (11):

target/arm: Add M profile secure MMU index values to get_a32_user_mem_index()

target/arm: Implement SG instruction

target/arm: Implement BLXNS

target/arm: Implement secure function return

target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1

target/arm: Pull Thumb insn word loads up to top level

target-arm: Simplify insn_crosses_page()

target/arm: Support some Thumb insns being always unconditional

target/arm: Implement SG instruction corner cases

nvic: Add missing 'break'

nvic: Fix miscalculation of offsets into ITNS array

include/hw/arm/arm.h | 2 +-

target/arm/helper.h | 1 +

target/arm/internals.h | 8 ++

hw/intc/armv7m_nvic.c | 5 +-

hw/watchdog/wdt_aspeed.c | 4 +-

target/arm/helper.c | 306 ++++++++++++++++++++++++++++++++++++++++++++--

target/arm/translate.c | 310 ++++++++++++++++++++++++++++++++---------------

7 files changed, 521 insertions(+), 115 deletions(-)

Coverity points out that we forgot the 'break' for

the SAU_CTRL write case (CID1381683). This has

no actual visible consequences because it happens

that the following case is effectively a no-op.

hw/intc/armv7m_nvic.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,

return;

}

cpu->env.sau.ctrl = value & 3;

+ break;

case 0xdd4: /* SAU_TYPE */

if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {

goto bad_offset;

2.7.4

Implement the BLXNS instruction, which allows secure code to

call non-secure code.

target/arm/helper.h | 1 +

target/arm/internals.h | 1 +

target/arm/helper.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++

target/arm/translate.c | 17 +++++++++++++--

4 files changed, 76 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.h

+++ b/target/arm/helper.h

@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(v7m_msr, void, env, i32, i32)

DEF_HELPER_2(v7m_mrs, i32, env, i32)

DEF_HELPER_2(v7m_bxns, void, env, i32)

+DEF_HELPER_2(v7m_blxns, void, env, i32)

DEF_HELPER_4(access_check_cp_reg, void, env, ptr, i32, i32)

DEF_HELPER_3(set_cp_reg, void, env, ptr, i32)

@@ -XXX,XX +XXX,XX @@ static inline bool excp_is_internal(int excp)

FIELD(V7M_CONTROL, NPRIV, 0, 1)

FIELD(V7M_CONTROL, SPSEL, 1, 1)

FIELD(V7M_CONTROL, FPCA, 2, 1)

+FIELD(V7M_CONTROL, SFPA, 3, 1)

/* Bit definitions for v7M exception return payload */

FIELD(V7M_EXCRET, ES, 0, 1)

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)

g_assert_not_reached();

+void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)

+{

+ /* translate.c should never generate calls here in user-only mode */

+ g_assert_not_reached();

+}

+

void switch_mode(CPUARMState *env, int mode)

ARMCPU *cpu = arm_env_get_cpu(env);

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)

env->regs[15] = dest & ~1;

+void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)

+{

+ /* Handle v7M BLXNS:

+ * - bit 0 of the destination address is the target security state

+ */

+

+ /* At this point regs[15] is the address just after the BLXNS */

+ uint32_t nextinst = env->regs[15] | 1;

+ uint32_t sp = env->regs[13] - 8;

+ uint32_t saved_psr;

+

+ /* translate.c will have made BLXNS UNDEF unless we're secure */

+ assert(env->v7m.secure);

+

+ if (dest & 1) {

+ /* target is Secure, so this is just a normal BLX,

+ * except that the low bit doesn't indicate Thumb/not.

+ */

+ env->regs[14] = nextinst;

+ env->thumb = 1;

+ env->regs[15] = dest & ~1;

+ return;

+static inline void gen_blxns(DisasContext *s, int rm)

+{

+ TCGv_i32 var = load_reg(s, rm);

+

+ /* We don't need to sync condexec state, for the same reason as bxns.

+ * We do however need to set the PC, because the blxns helper reads it.

+ * The blxns helper may throw an exception.

+ */

+ gen_set_pc_im(s, s->pc);

+ gen_helper_v7m_blxns(cpu_env, var);

+ tcg_temp_free_i32(var);

+ s->base.is_jmp = DISAS_EXIT;

+}

+

/* Variant of store_reg which uses branch&exchange logic when storing

to r15 in ARM architecture v7 and above. The source must be a temporary

and will be marked as dead. */

@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)

goto undef;

}

if (link) {

- /* BLXNS: not yet implemented */

- goto undef;

+ gen_blxns(s, rm);

} else {

gen_bxns(s, rm);

}

2.7.4

Implement the SG instruction, which we emulate 'by hand' in the

exception handling code path.

target/arm/helper.c | 132 ++++++++++++++++++++++++++++++++++++++++++++++++++--

1 file changed, 127 insertions(+), 5 deletions(-)

@@ -XXX,XX +XXX,XX @@ typedef struct V8M_SAttributes {

bool irvalid;

} V8M_SAttributes;

+static void v8m_security_lookup(CPUARMState *env, uint32_t address,

+ MMUAccessType access_type, ARMMMUIdx mmu_idx,

+ V8M_SAttributes *sattrs);

/* Definitions for the PMCCNTR and PMCR registers */

#define PMCRD 0x8

#define PMCRC 0x4

@@ -XXX,XX +XXX,XX @@ static void arm_log_exception(int idx)

}

}

+static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,

+ uint32_t addr, uint16_t *insn)

+{

+ /* Load a 16-bit portion of a v7M instruction, returning true on success,

+ * or false on failure (in which case we will have pended the appropriate

+ * exception).

+ * We need to do the instruction fetch's MPU and SAU checks

+ * like this because there is no MMU index that would allow

+ * doing the load with a single function call. Instead we must

+ * first check that the security attributes permit the load

+ * and that they don't mismatch on the two halves of the instruction,

+ * and then we do the load as a secure load (ie using the security

+ * attributes of the address, not the CPU, as architecturally required).

+ */

+ CPUState *cs = CPU(cpu);

+ CPUARMState *env = &cpu->env;

+ V8M_SAttributes sattrs = {};

+ MemTxAttrs attrs = {};

+ ARMMMUFaultInfo fi = {};

+ MemTxResult txres;

+ target_ulong page_size;

+ hwaddr physaddr;

+ int prot;

+ uint32_t fsr;

+

+ v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);

+ if (!sattrs.nsc || sattrs.ns) {

+ /* This must be the second half of the insn, and it straddles a

+ * region boundary with the second half not being S&NSC.

+ */

+ env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;

+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);

+ qemu_log_mask(CPU_LOG_INT,

+ "...really SecureFault with SFSR.INVEP\n");

+ return false;

+ if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,

+ &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {

+ /* the MPU lookup failed */

+ env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;

+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);

+ qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");

+ return false;

+ }

+ *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,

+ attrs, &txres);

+ if (txres != MEMTX_OK) {

+ env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;

+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);

+ qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");

+ return false;

+ }

+ return true;

+static bool v7m_handle_execute_nsc(ARMCPU *cpu)

+{

+ /* Check whether this attempt to execute code in a Secure & NS-Callable

+ * memory region is for an SG instruction; if so, then emulate the

+ * effect of the SG instruction and return true. Otherwise pend

+ * the correct kind of exception and return false.

+ */

+ CPUARMState *env = &cpu->env;

+ ARMMMUIdx mmu_idx;

+ uint16_t insn;

+

+ /* We should never get here unless get_phys_addr_pmsav8() caused

+ * an exception for NS executing in S&NSC memory.

+ */

+ assert(!env->v7m.secure);

+ assert(arm_feature(env, ARM_FEATURE_M_SECURITY));

+

+ /* We want to do the MPU lookup as secure; work out what mmu_idx that is */

+ mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);

+

+ if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {

+ return false;

+ }

+

+ if (!env->thumb) {

+ goto gen_invep;

+ }

+

+ if (insn != 0xe97f) {

+ /* Not an SG instruction first half (we choose the IMPDEF

+ * early-SG-check option).

+ */

+ goto gen_invep;

+ }

+

+ if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {

+ return false;

+ }

+

+ if (insn != 0xe97f) {

+ /* Not an SG instruction second half (yes, both halves of the SG

+ * insn have the same hex value)

+ */

+ goto gen_invep;

+ }

+

+ /* OK, we have confirmed that we really have an SG instruction.

+ * We know we're NS in S memory so don't need to repeat those checks.

+ */

+ qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32

+ ", executing it\n", env->regs[15]);

+ env->regs[14] &= ~1;

+ switch_v7m_security_state(env, true);

+ xpsr_write(env, 0, XPSR_IT);

+ env->regs[15] += 4;

+ return true;

+

+gen_invep:

+ env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;

+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);

+ qemu_log_mask(CPU_LOG_INT,

+ "...really SecureFault with SFSR.INVEP\n");

+ return false;

+}

+

void arm_v7m_cpu_do_interrupt(CPUState *cs)

{

ARMCPU *cpu = ARM_CPU(cs);

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

* the SG instruction have the same security attributes.)

* Everything else must generate an INVEP SecureFault, so we

* emulate the SG instruction here.

- * TODO: actually emulate SG.

*/

- env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;

- armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);

- qemu_log_mask(CPU_LOG_INT,

- "...really SecureFault with SFSR.INVEP\n");

+ if (v7m_handle_execute_nsc(cpu)) {

+ return;

+ }

break;

case M_FAKE_FSR_SFAULT:

/* Various flavours of SecureFault for attempts to execute or

2.7.4

From: Cédric Le Goater <clg@kaod.org>

Initially from Anton D. Kachalov" <mouse@yandex-team.ru> but the SoB was

missing.

Signed-off-by: Cédric Le Goater <clg@kaod.org>

Acked-by: Andrew Jeffery <andrew@aj.id.au>

Message-id: 20170920064915.30027-1-clg@kaod.org

[clg: change commit log and subject

replace UL suffix by ULL ]

Signed-off-by: Cédric Le Goater <clg@kaod.org>

hw/watchdog/wdt_aspeed.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c

--- a/hw/watchdog/wdt_aspeed.c

+++ b/hw/watchdog/wdt_aspeed.c

@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)

static void aspeed_wdt_reload(AspeedWDTState *s, bool pclk)

{

- uint32_t reload;

+ uint64_t reload;

if (pclk) {

reload = muldiv64(s->regs[WDT_RELOAD_VALUE], NANOSECONDS_PER_SECOND,

s->pclk_freq);

} else {

- reload = s->regs[WDT_RELOAD_VALUE] * 1000;

+ reload = s->regs[WDT_RELOAD_VALUE] * 1000ULL;

if (aspeed_wdt_is_enabled(s)) {

2.7.4