Arm stuff, mostly patches from RTH.

The following changes since commit 01a9a51ffaf4699827ea6425cb2b834a356e159d:

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20190205-pull-request' into staging (2019-02-05 14:01:29 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190205

for you to fetch changes up to a15945d98d3a3390c3da344d1b47218e91e49d8b:

target/arm: Make FPSCR/FPCR trapped-exception bits RAZ/WI (2019-02-05 16:52:42 +0000)

* Implement Armv8.5-BTI extension for system emulation mode

* Implement the PR_PAC_RESET_KEYS prctl() for linux-user mode's Armv8.3-PAuth support

* Support TBI (top-byte-ignore) properly for linux-user mode

* gdbstub: allow killing QEMU via vKill command

* hw/arm/boot: Support DTB autoload for firmware-only boots

* target/arm: Make FPSCR/FPCR trapped-exception bits RAZ/WI

Max Filippov (1):

gdbstub: allow killing QEMU via vKill command

Peter Maydell (7):

target/arm: Compute TB_FLAGS for TBI for user-only

hw/arm/boot: Fix block comment style in arm_load_kernel()

hw/arm/boot: Factor out "direct kernel boot" code into its own function

hw/arm/boot: Factor out "set up firmware boot" code

hw/arm/boot: Clarify why arm_setup_firmware_boot() doesn't set env->boot_info

hw/arm/boot: Support DTB autoload for firmware-only boots

target/arm: Make FPSCR/FPCR trapped-exception bits RAZ/WI

Richard Henderson (14):

target/arm: Introduce isar_feature_aa64_bti

target/arm: Add PSTATE.BTYPE

target/arm: Add BT and BTYPE to tb->flags

exec: Add target-specific tlb bits to MemTxAttrs

target/arm: Cache the GP bit for a page in MemTxAttrs

target/arm: Default handling of BTYPE during translation

target/arm: Reset btype for direct branches

target/arm: Set btype for indirect branches

target/arm: Enable BTI for -cpu max

linux-user: Implement PR_PAC_RESET_KEYS

tests/tcg/aarch64: Add pauth smoke test

target/arm: Add TBFLAG_A64_TBID, split out gen_top_byte_ignore

target/arm: Clean TBI for data operations in the translator

target/arm: Enable TBI for user-only

tests/tcg/aarch64/Makefile.target | 6 +-

include/exec/memattrs.h | 10 +

linux-user/aarch64/target_syscall.h | 7 +

target/arm/cpu.h | 27 +-

target/arm/internals.h | 27 +-

target/arm/translate.h | 12 +-

gdbstub.c | 4 +

hw/arm/boot.c | 166 +++++++------

linux-user/syscall.c | 36 +++

target/arm/cpu.c | 6 +

target/arm/cpu64.c | 4 +

target/arm/helper.c | 80 +++---

target/arm/translate-a64.c | 476 +++++++++++++++++++++++++-----------

tests/tcg/aarch64/pauth-1.c | 23 ++

14 files changed, 623 insertions(+), 261 deletions(-)

create mode 100644 tests/tcg/aarch64/pauth-1.c

The {IOE, DZE, OFE, UFE, IXE, IDE} bits in the FPSCR/FPCR are for

enabling trapped IEEE floating point exceptions (where IEEE exception

conditions cause a CPU exception rather than updating the FPSR status

bits). QEMU doesn't implement this (and nor does the hardware we're

modelling), but for implementations which don't implement trapped

exception handling these control bits are supposed to be RAZ/WI.

This allows guest code to test for whether the feature is present

by trying to write to the bit and checking whether it sticks.

QEMU is incorrectly making these bits read as written. Make them

RAZ/WI as the architecture requires.

In particular this was causing problems for the NetBSD automatic

test suite.

Reported-by: Martin Husemann <martin@netbsd.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20190131130700.28392-1-peter.maydell@linaro.org

---

target/arm/cpu.h | 6 ++++++

target/arm/helper.c | 6 ++++++

2 files changed, 12 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);

#define FPSR_MASK 0xf800009f

#define FPCR_MASK 0x07ff9f00

+#define FPCR_IOE (1 << 8) /* Invalid Operation exception trap enable */

+#define FPCR_DZE (1 << 9) /* Divide by Zero exception trap enable */

+#define FPCR_OFE (1 << 10) /* Overflow exception trap enable */

+#define FPCR_UFE (1 << 11) /* Underflow exception trap enable */

+#define FPCR_IXE (1 << 12) /* Inexact exception trap enable */

+#define FPCR_IDE (1 << 15) /* Input Denormal exception trap enable */

#define FPCR_FZ16 (1 << 19) /* ARMv8.2+, FP16 flush-to-zero */

#define FPCR_FZ (1 << 24) /* Flush-to-zero enable bit */

#define FPCR_DN (1 << 25) /* Default NaN enable bit */

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)

val &= ~FPCR_FZ16;

}

+ * We don't implement trapped exception handling, so the

+ * trap enable bits are all RAZ/WI (not RES0!)

+ val &= ~(FPCR_IDE | FPCR_IXE | FPCR_UFE | FPCR_OFE | FPCR_DZE | FPCR_IOE);

changed = env->vfp.xregs[ARM_VFP_FPSCR];

env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);

env->vfp.vec_len = (val >> 16) & 7;

Factor out the "boot via firmware" code path from arm_load_kernel()

into its own function.

This commit only moves code around; no semantic changes.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Igor Mammedov <imammedo@redhat.com>

Message-id: 20190131112240.8395-4-peter.maydell@linaro.org

hw/arm/boot.c | 92 +++++++++++++++++++++++++++------------------------

1 file changed, 49 insertions(+), 43 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c

--- a/hw/arm/boot.c

+++ b/hw/arm/boot.c

@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,

}

}

+static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info)

+ /* Set up for booting firmware (which might load a kernel via fw_cfg) */

+

+ if (have_dtb(info)) {

+ /*

+ * If we have a device tree blob, but no kernel to supply it to (or

+ * the kernel is supposed to be loaded by the bootloader), copy the

+ * DTB to the base of RAM for the bootloader to pick up.

+ */

+ info->dtb_start = info->loader_start;

+ }

+

+ if (info->kernel_filename) {

+ FWCfgState *fw_cfg;

+ bool try_decompressing_kernel;

+

+ fw_cfg = fw_cfg_find();

+ try_decompressing_kernel = arm_feature(&cpu->env,

+ ARM_FEATURE_AARCH64);

+

+ /*

+ * Expose the kernel, the command line, and the initrd in fw_cfg.

+ * We don't process them here at all, it's all left to the

+ * firmware.

+ */

+ load_image_to_fw_cfg(fw_cfg,

+ FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,

+ info->kernel_filename,

+ try_decompressing_kernel);

+ load_image_to_fw_cfg(fw_cfg,

+ FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,

+ info->initrd_filename, false);

+

+ if (info->kernel_cmdline) {

+ fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,

+ strlen(info->kernel_cmdline) + 1);

+ fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,

+ info->kernel_cmdline);

+ }

+ }

+

+ /*

+ * We will start from address 0 (typically a boot ROM image) in the

+ * same way as hardware.

+ */

void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)

{

CPUState *cs;

@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)

/* Load the kernel. */

if (!info->kernel_filename || info->firmware_loaded) {

-

- if (have_dtb(info)) {

- /*

- * If we have a device tree blob, but no kernel to supply it to (or

- * the kernel is supposed to be loaded by the bootloader), copy the

- * DTB to the base of RAM for the bootloader to pick up.

- */

- info->dtb_start = info->loader_start;

- }

-

- if (info->kernel_filename) {

- FWCfgState *fw_cfg;

- bool try_decompressing_kernel;

-

- fw_cfg = fw_cfg_find();

- try_decompressing_kernel = arm_feature(&cpu->env,

- ARM_FEATURE_AARCH64);

-

- /*

- * Expose the kernel, the command line, and the initrd in fw_cfg.

- * We don't process them here at all, it's all left to the

- * firmware.

- */

- load_image_to_fw_cfg(fw_cfg,

- FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,

- info->kernel_filename,

- try_decompressing_kernel);

- load_image_to_fw_cfg(fw_cfg,

- FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,

- info->initrd_filename, false);

-

- if (info->kernel_cmdline) {

- fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,

- strlen(info->kernel_cmdline) + 1);

- fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,

- info->kernel_cmdline);

- }

- }

-

- /*

- * We will start from address 0 (typically a boot ROM image) in the

- * same way as hardware.

- */

+ arm_setup_firmware_boot(cpu, info);

return;

} else {

arm_setup_direct_kernel_boot(cpu, info);

Factor out the "direct kernel boot" code path from arm_load_kernel()

into its own function; this function is getting long enough that

the code flow is a bit confusing.

This commit only moves code around; no semantic changes.

We leave the "load the dtb" code in arm_load_kernel() -- this

is currently only used by the "direct kernel boot" path, but

this is a bug which we will fix shortly.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Igor Mammedov <imammedo@redhat.com>

Message-id: 20190131112240.8395-3-peter.maydell@linaro.org

hw/arm/boot.c | 150 +++++++++++++++++++++++++++-----------------------

1 file changed, 80 insertions(+), 70 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c

--- a/hw/arm/boot.c

+++ b/hw/arm/boot.c

@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,

return size;

}

-void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)

+static void arm_setup_direct_kernel_boot(ARMCPU *cpu,

+ struct arm_boot_info *info)

{

+ /* Set up for a direct boot of a kernel image file. */

CPUState *cs;

+ AddressSpace *as = arm_boot_address_space(cpu, info);

int kernel_size;

int initrd_size;

int is_linux = 0;

@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)

int elf_machine;

hwaddr entry;

static const ARMInsnFixup *primary_loader;

- AddressSpace *as = arm_boot_address_space(cpu, info);

-

- /*

- * CPU objects (unlike devices) are not automatically reset on system

- * reset, so we must always register a handler to do so. If we're

- * actually loading a kernel, the handler is also responsible for

- * arranging that we start it correctly.

- */

- for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

- qemu_register_reset(do_cpu_reset, ARM_CPU(cs));

- }

-

- /*

- * The board code is not supposed to set secure_board_setup unless

- * running its code in secure mode is actually possible, and KVM

- * doesn't support secure.

- */

- assert(!(info->secure_board_setup && kvm_enabled()));

-

- info->dtb_filename = qemu_opt_get(qemu_get_machine_opts(), "dtb");

- info->dtb_limit = 0;

-

- /* Load the kernel. */

- if (!info->kernel_filename || info->firmware_loaded) {

-

- if (have_dtb(info)) {

- /*

- * If we have a device tree blob, but no kernel to supply it to (or

- * the kernel is supposed to be loaded by the bootloader), copy the

- * DTB to the base of RAM for the bootloader to pick up.

- */

- info->dtb_start = info->loader_start;

- }

-

- if (info->kernel_filename) {

- FWCfgState *fw_cfg;

- bool try_decompressing_kernel;

-

- fw_cfg = fw_cfg_find();

- try_decompressing_kernel = arm_feature(&cpu->env,

- ARM_FEATURE_AARCH64);

-

- /*

- * Expose the kernel, the command line, and the initrd in fw_cfg.

- * We don't process them here at all, it's all left to the

- * firmware.

- */

- load_image_to_fw_cfg(fw_cfg,

- FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,

- info->kernel_filename,

- try_decompressing_kernel);

- load_image_to_fw_cfg(fw_cfg,

- FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,

- info->initrd_filename, false);

-

- if (info->kernel_cmdline) {

- fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,

- strlen(info->kernel_cmdline) + 1);

- fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,

- info->kernel_cmdline);

- }

- }

-

- /*

- * We will start from address 0 (typically a boot ROM image) in the

- * same way as hardware.

- */

- return;

- }

if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {

primary_loader = bootloader_aarch64;

@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)

for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

ARM_CPU(cs)->env.boot_info = info;

}

+void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)

+{

+ CPUState *cs;

+ AddressSpace *as = arm_boot_address_space(cpu, info);

+

+ /*

+ * CPU objects (unlike devices) are not automatically reset on system

+ * reset, so we must always register a handler to do so. If we're

+ * actually loading a kernel, the handler is also responsible for

+ * arranging that we start it correctly.

+ */

+ for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

+ qemu_register_reset(do_cpu_reset, ARM_CPU(cs));

+ }

+

+ /*

+ * The board code is not supposed to set secure_board_setup unless

+ * running its code in secure mode is actually possible, and KVM

+ * doesn't support secure.

+ */

+ assert(!(info->secure_board_setup && kvm_enabled()));

+

+ info->dtb_filename = qemu_opt_get(qemu_get_machine_opts(), "dtb");

+ info->dtb_limit = 0;

+

+ /* Load the kernel. */

+ if (!info->kernel_filename || info->firmware_loaded) {

+

+ if (have_dtb(info)) {

+ /*

+ * If we have a device tree blob, but no kernel to supply it to (or

+ * the kernel is supposed to be loaded by the bootloader), copy the

+ * DTB to the base of RAM for the bootloader to pick up.

+ */

+ info->dtb_start = info->loader_start;

+ }

+

+ if (info->kernel_filename) {

+ FWCfgState *fw_cfg;

+ bool try_decompressing_kernel;

+

+ fw_cfg = fw_cfg_find();

+ try_decompressing_kernel = arm_feature(&cpu->env,

+ ARM_FEATURE_AARCH64);

+

+ /*

+ * Expose the kernel, the command line, and the initrd in fw_cfg.

+ * We don't process them here at all, it's all left to the

+ * firmware.

+ */

+ load_image_to_fw_cfg(fw_cfg,

+ FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,

+ info->kernel_filename,

+ try_decompressing_kernel);

+ load_image_to_fw_cfg(fw_cfg,

+ FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,

+ info->initrd_filename, false);

+

+ if (info->kernel_cmdline) {

+ fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,

+ strlen(info->kernel_cmdline) + 1);

+ fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,

+ info->kernel_cmdline);

+ }

+ }

+

+ /*

+ * We will start from address 0 (typically a boot ROM image) in the

+ * same way as hardware.

+ */

+ return;

+ } else {

+ arm_setup_direct_kernel_boot(cpu, info);

+ }

if (!info->skip_dtb_autoload && have_dtb(info)) {

if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {

From: Richard Henderson <richard.henderson@linaro.org>

target/arm/translate-a64.c | 37 ++++++++++++++++++++++++++++++++++++-

1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void reset_btype(DisasContext *s)

}

}

+static void set_btype(DisasContext *s, int val)

+{

+ TCGv_i32 tcg_val;

+

+ /* BTYPE is a 2-bit field, and 0 should be done with reset_btype. */

+ tcg_debug_assert(val >= 1 && val <= 3);

+

+ tcg_val = tcg_const_i32(val);

+ tcg_gen_st_i32(tcg_val, cpu_env, offsetof(CPUARMState, btype));

+ tcg_temp_free_i32(tcg_val);

+ s->btype = -1;

+}

+

void aarch64_cpu_dump_state(CPUState *cs, FILE *f,

fprintf_function cpu_fprintf, int flags)

@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)

static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)

{

unsigned int opc, op2, op3, rn, op4;

+ unsigned btype_mod = 2; /* 0: BR, 1: BLR, 2: other */

TCGv_i64 dst;

TCGv_i64 modifier;

@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)

case 0: /* BR */

case 1: /* BLR */

case 2: /* RET */

+ btype_mod = opc;

switch (op3) {

case 0:

/* BR, BLR, RET */

@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)

default:

goto do_unallocated;

}

-

gen_a64_set_pc(s, dst);

/* BLR also needs to load return address */

if (opc == 1) {

@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)

if ((op3 & ~1) != 2) {

goto do_unallocated;

}

+ btype_mod = opc & 1;

if (s->pauth_active) {

dst = new_tmp_a64(s);

modifier = cpu_reg_sp(s, op4);

@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)

+ switch (btype_mod) {

+ case 0: /* BR */

+ if (dc_isar_feature(aa64_bti, s)) {

+ /* BR to {x16,x17} or !guard -> 1, else 3. */

+ set_btype(s, rn == 16 || rn == 17 || !s->guarded_page ? 1 : 3);

+ }

+ break;

+

+ case 1: /* BLR */

+ if (dc_isar_feature(aa64_bti, s)) {

+ /* BLR sets BTYPE to 2, regardless of source guarded page. */

+ set_btype(s, 2);

+ }

+ break;

+

+ default: /* RET or none of the above. */

+ /* BTYPE will be set to 0 by normal end-of-insn processing. */

+ break;

+ }

+

s->base.is_jmp = DISAS_JUMP;

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20190201195404.30486-3-richard.henderson@linaro.org

tests/tcg/aarch64/Makefile.target | 6 +++++-

tests/tcg/aarch64/pauth-1.c | 23 +++++++++++++++++++++++

2 files changed, 28 insertions(+), 1 deletion(-)

create mode 100644 tests/tcg/aarch64/pauth-1.c