[Qemu-devel] [PULL 00/10] target-arm queue
[Qemu-devel] [PULL 00/29] target-arm queue
1
target-arm queue for rc1 -- these are all bug fixes.
1
First arm pullreq of 4.2...
2
2
3
thanks
3
thanks
4
-- PMM
4
-- PMM
5
5
6
The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:
6
The following changes since commit 27608c7c66bd923eb5e5faab80e795408cbe2b51:
7
7
8
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)
8
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190814a' into staging (2019-08-16 12:00:18 +0100)
9
9
10
are available in the Git repository at:
10
are available in the Git repository at:
11
11
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190816
13
13
14
for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:
14
for you to fetch changes up to 664b7e3b97d6376f3329986c465b3782458b0f8b:
15
15
16
target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)
16
target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word (2019-08-16 14:02:53 +0100)
17
17
18
----------------------------------------------------------------
18
----------------------------------------------------------------
19
target-arm queue:
19
target-arm queue:
20
* report ARMv8-A FP support for AArch32 -cpu max
20
* target/arm: generate a custom MIDR for -cpu max
21
* hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
21
* hw/misc/zynq_slcr: refactor to use standard register definition
22
* hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
22
* Set ENET_BD_BDU in I.MX FEC controller
23
* hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
23
* target/arm: Fix routing of singlestep exceptions
24
* hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
24
* refactor a32/t32 decoder handling of PC
25
* hw/arm/virt: Fix non-secure flash mode
25
* minor optimisations/cleanups of some a32/t32 codegen
26
* pl031: Correctly migrate state when using -rtc clock=host
26
* target/arm/cpu64: Ensure kvm really supports aarch64=off
27
* fix regression that meant arm926 and arm1026 lost VFP
27
* target/arm/cpu: Ensure we can use the pmu with kvm
28
double-precision support
28
* target/arm: Minor cleanups preparatory to KVM SVE support
29
* v8M: NS BusFault on vector table fetch escalates to NS HardFault
30
29
31
----------------------------------------------------------------
30
----------------------------------------------------------------
31
Aaron Hill (1):
32
Set ENET_BD_BDU in I.MX FEC controller
33
32
Alex Bennée (1):
34
Alex Bennée (1):
33
target/arm: report ARMv8-A FP support for AArch32 -cpu max
35
target/arm: generate a custom MIDR for -cpu max
34
36
35
David Engraf (1):
37
Andrew Jones (6):
36
hw/arm/virt: Fix non-secure flash mode
38
target/arm/cpu64: Ensure kvm really supports aarch64=off
39
target/arm/cpu: Ensure we can use the pmu with kvm
40
target/arm/helper: zcr: Add build bug next to value range assumption
41
target/arm/cpu: Use div-round-up to determine predicate register array size
42
target/arm/kvm64: Fix error returns
43
target/arm/kvm64: Move the get/put of fpsimd registers out
37
44
38
Peter Maydell (3):
45
Damien Hedde (1):
39
pl031: Correctly migrate state when using -rtc clock=host
46
hw/misc/zynq_slcr: use standard register definition
40
target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
41
target/arm: NS BusFault on vector table fetch escalates to NS HardFault
42
47
43
Philippe Mathieu-Daudé (5):
48
Peter Maydell (2):
44
hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
49
target/arm: Factor out 'generate singlestep exception' function
45
hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
50
target/arm: Fix routing of singlestep exceptions
46
hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
47
hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
48
hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
49
51
50
include/hw/timer/pl031.h | 2 ++
52
Richard Henderson (18):
51
hw/arm/virt.c | 2 +-
53
target/arm: Pass in pc to thumb_insn_is_16bit
52
hw/core/machine.c | 1 +
54
target/arm: Introduce pc_curr
53
hw/display/xlnx_dp.c | 15 +++++---
55
target/arm: Introduce read_pc
54
hw/ssi/mss-spi.c | 8 ++++-
56
target/arm: Introduce add_reg_for_lit
55
hw/ssi/xilinx_spips.c | 43 +++++++++++++++-------
57
target/arm: Remove redundant s->pc & ~1
56
hw/timer/pl031.c | 92 +++++++++++++++++++++++++++++++++++++++++++++---
58
target/arm: Replace s->pc with s->base.pc_next
57
target/arm/cpu.c | 16 +++++++++
59
target/arm: Replace offset with pc in gen_exception_insn
58
target/arm/m_helper.c | 21 ++++++++---
60
target/arm: Replace offset with pc in gen_exception_internal_insn
59
9 files changed, 174 insertions(+), 26 deletions(-)
61
target/arm: Remove offset argument to gen_exception_bkpt_insn
62
target/arm: Use unallocated_encoding for aarch32
63
target/arm: Remove helper_double_saturate
64
target/arm: Use tcg_gen_extract_i32 for shifter_out_im
65
target/arm: Use tcg_gen_deposit_i32 for PKHBT, PKHTB
66
target/arm: Remove redundant shift tests
67
target/arm: Use ror32 instead of open-coding the operation
68
target/arm: Use tcg_gen_rotri_i32 for gen_swap_half
69
target/arm: Simplify SMMLA, SMMLAR, SMMLS, SMMLSR
70
target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word
60
71
72
target/arm/cpu.h | 13 +-
73
target/arm/helper.h | 1 -
74
target/arm/kvm_arm.h | 28 ++
75
target/arm/translate-a64.h | 4 +-
76
target/arm/translate.h | 39 ++-
77
hw/misc/zynq_slcr.c | 450 ++++++++++++++++----------------
78
hw/net/imx_fec.c | 4 +
79
target/arm/cpu.c | 30 ++-
80
target/arm/cpu64.c | 31 ++-
81
target/arm/helper.c | 7 +
82
target/arm/kvm.c | 7 +
83
target/arm/kvm64.c | 161 +++++++-----
84
target/arm/op_helper.c | 15 --
85
target/arm/translate-a64.c | 130 ++++------
86
target/arm/translate-vfp.inc.c | 45 +---
87
target/arm/translate.c | 572 +++++++++++++++++------------------------
88
16 files changed, 771 insertions(+), 766 deletions(-)
89
diff view generated by jsdifflib
[Qemu-devel] [PULL 01/10] target/arm: report ARMv8-A FP support for AArch32 -cpu max
[Qemu-devel] [PULL 01/29] target/arm: generate a custom MIDR for -cpu max
1
From: Alex Bennée <alex.bennee@linaro.org>
1
From: Alex Bennée <alex.bennee@linaro.org>
2
2
3
When we converted to using feature bits in 602f6e42cfbf we missed out
3
While most features are now detected by probing the ID_* registers
4
the fact (dp && arm_dc_feature(s, ARM_FEATURE_V8)) was supported for
4
kernels can (and do) use MIDR_EL1 for working out of they have to
5
-cpu max configurations. This caused a regression in the GCC test
5
apply errata. This can trip up warnings in the kernel as it tries to
6
suite. Fix this by setting the appropriate bits in mvfr1.FPHP to
6
work out if it should apply workarounds to features that don't
7
report ARMv8-A with FP support (but not ARMv8.2-FP16).
7
actually exist in the reported CPU type.
8
8
9
Fixes: https://bugs.launchpad.net/qemu/+bug/1836078
9
Avoid this problem by synthesising our own MIDR value.
10
10
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
11
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
13
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Message-id: 20190711103737.10017-1-alex.bennee@linaro.org
14
Message-id: 20190726113950.7499-1-alex.bennee@linaro.org
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
---
16
---
15
target/arm/cpu.c | 4 ++++
17
target/arm/cpu.h | 6 ++++++
16
1 file changed, 4 insertions(+)
18
target/arm/cpu64.c | 19 +++++++++++++++++++
19
2 files changed, 25 insertions(+)
17
20
18
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
21
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
19
index XXXXXXX..XXXXXXX 100644
22
index XXXXXXX..XXXXXXX 100644
20
--- a/target/arm/cpu.c
23
--- a/target/arm/cpu.h
21
+++ b/target/arm/cpu.c
24
+++ b/target/arm/cpu.h
22
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
25
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_FPCCR, ASPEN, 31, 1)
23
t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
26
/*
24
cpu->isar.id_isar6 = t;
27
* System register ID fields.
25
28
*/
26
+ t = cpu->isar.mvfr1;
29
+FIELD(MIDR_EL1, REVISION, 0, 4)
27
+ t = FIELD_DP32(t, MVFR1, FPHP, 2); /* v8.0 FP support */
30
+FIELD(MIDR_EL1, PARTNUM, 4, 12)
28
+ cpu->isar.mvfr1 = t;
31
+FIELD(MIDR_EL1, ARCHITECTURE, 16, 4)
32
+FIELD(MIDR_EL1, VARIANT, 20, 4)
33
+FIELD(MIDR_EL1, IMPLEMENTER, 24, 8)
29
+
34
+
30
t = cpu->isar.mvfr2;
35
FIELD(ID_ISAR0, SWAP, 0, 4)
31
t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
36
FIELD(ID_ISAR0, BITCOUNT, 4, 4)
32
t = FIELD_DP32(t, MVFR2, FPMISC, 4); /* FP MaxNum */
37
FIELD(ID_ISAR0, BITFIELD, 8, 4)
38
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
39
index XXXXXXX..XXXXXXX 100644
40
--- a/target/arm/cpu64.c
41
+++ b/target/arm/cpu64.c
42
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
43
uint32_t u;
44
aarch64_a57_initfn(obj);
45
46
+ /*
47
+ * Reset MIDR so the guest doesn't mistake our 'max' CPU type for a real
48
+ * one and try to apply errata workarounds or use impdef features we
49
+ * don't provide.
50
+ * An IMPLEMENTER field of 0 means "reserved for software use";
51
+ * ARCHITECTURE must be 0xf indicating "v7 or later, check ID registers
52
+ * to see which features are present";
53
+ * the VARIANT, PARTNUM and REVISION fields are all implementation
54
+ * defined and we choose to define PARTNUM just in case guest
55
+ * code needs to distinguish this QEMU CPU from other software
56
+ * implementations, though this shouldn't be needed.
57
+ */
58
+ t = FIELD_DP64(0, MIDR_EL1, IMPLEMENTER, 0);
59
+ t = FIELD_DP64(t, MIDR_EL1, ARCHITECTURE, 0xf);
60
+ t = FIELD_DP64(t, MIDR_EL1, PARTNUM, 'Q');
61
+ t = FIELD_DP64(t, MIDR_EL1, VARIANT, 0);
62
+ t = FIELD_DP64(t, MIDR_EL1, REVISION, 0);
63
+ cpu->midr = t;
64
+
65
t = cpu->isar.id_aa64isar0;
66
t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2); /* AES + PMULL */
67
t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);
33
--
68
--
34
2.20.1
69
2.20.1
35
70
36
71
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 02/29] hw/misc/zynq_slcr: use standard register definition
1
From: Damien Hedde <damien.hedde@greensocs.com>
1
2
3
Replace the zynq_slcr registers enum and macros using the
4
hw/registerfields.h macros.
5
6
Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
7
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
8
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
9
Message-id: 20190729145654.14644-30-damien.hedde@greensocs.com
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
hw/misc/zynq_slcr.c | 450 ++++++++++++++++++++++----------------------
13
1 file changed, 225 insertions(+), 225 deletions(-)
14
15
diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/hw/misc/zynq_slcr.c
18
+++ b/hw/misc/zynq_slcr.c
19
@@ -XXX,XX +XXX,XX @@
20
#include "sysemu/sysemu.h"
21
#include "qemu/log.h"
22
#include "qemu/module.h"
23
+#include "hw/registerfields.h"
24
25
#ifndef ZYNQ_SLCR_ERR_DEBUG
26
#define ZYNQ_SLCR_ERR_DEBUG 0
27
@@ -XXX,XX +XXX,XX @@
28
#define XILINX_LOCK_KEY 0x767b
29
#define XILINX_UNLOCK_KEY 0xdf0d
30
31
-#define R_PSS_RST_CTRL_SOFT_RST 0x1
32
+REG32(SCL, 0x000)
33
+REG32(LOCK, 0x004)
34
+REG32(UNLOCK, 0x008)
35
+REG32(LOCKSTA, 0x00c)
36
37
-enum {
38
- SCL = 0x000 / 4,
39
- LOCK,
40
- UNLOCK,
41
- LOCKSTA,
42
+REG32(ARM_PLL_CTRL, 0x100)
43
+REG32(DDR_PLL_CTRL, 0x104)
44
+REG32(IO_PLL_CTRL, 0x108)
45
+REG32(PLL_STATUS, 0x10c)
46
+REG32(ARM_PLL_CFG, 0x110)
47
+REG32(DDR_PLL_CFG, 0x114)
48
+REG32(IO_PLL_CFG, 0x118)
49
50
- ARM_PLL_CTRL = 0x100 / 4,
51
- DDR_PLL_CTRL,
52
- IO_PLL_CTRL,
53
- PLL_STATUS,
54
- ARM_PLL_CFG,
55
- DDR_PLL_CFG,
56
- IO_PLL_CFG,
57
-
58
- ARM_CLK_CTRL = 0x120 / 4,
59
- DDR_CLK_CTRL,
60
- DCI_CLK_CTRL,
61
- APER_CLK_CTRL,
62
- USB0_CLK_CTRL,
63
- USB1_CLK_CTRL,
64
- GEM0_RCLK_CTRL,
65
- GEM1_RCLK_CTRL,
66
- GEM0_CLK_CTRL,
67
- GEM1_CLK_CTRL,
68
- SMC_CLK_CTRL,
69
- LQSPI_CLK_CTRL,
70
- SDIO_CLK_CTRL,
71
- UART_CLK_CTRL,
72
- SPI_CLK_CTRL,
73
- CAN_CLK_CTRL,
74
- CAN_MIOCLK_CTRL,
75
- DBG_CLK_CTRL,
76
- PCAP_CLK_CTRL,
77
- TOPSW_CLK_CTRL,
78
+REG32(ARM_CLK_CTRL, 0x120)
79
+REG32(DDR_CLK_CTRL, 0x124)
80
+REG32(DCI_CLK_CTRL, 0x128)
81
+REG32(APER_CLK_CTRL, 0x12c)
82
+REG32(USB0_CLK_CTRL, 0x130)
83
+REG32(USB1_CLK_CTRL, 0x134)
84
+REG32(GEM0_RCLK_CTRL, 0x138)
85
+REG32(GEM1_RCLK_CTRL, 0x13c)
86
+REG32(GEM0_CLK_CTRL, 0x140)
87
+REG32(GEM1_CLK_CTRL, 0x144)
88
+REG32(SMC_CLK_CTRL, 0x148)
89
+REG32(LQSPI_CLK_CTRL, 0x14c)
90
+REG32(SDIO_CLK_CTRL, 0x150)
91
+REG32(UART_CLK_CTRL, 0x154)
92
+REG32(SPI_CLK_CTRL, 0x158)
93
+REG32(CAN_CLK_CTRL, 0x15c)
94
+REG32(CAN_MIOCLK_CTRL, 0x160)
95
+REG32(DBG_CLK_CTRL, 0x164)
96
+REG32(PCAP_CLK_CTRL, 0x168)
97
+REG32(TOPSW_CLK_CTRL, 0x16c)
98
99
#define FPGA_CTRL_REGS(n, start) \
100
- FPGA ## n ## _CLK_CTRL = (start) / 4, \
101
- FPGA ## n ## _THR_CTRL, \
102
- FPGA ## n ## _THR_CNT, \
103
- FPGA ## n ## _THR_STA,
104
- FPGA_CTRL_REGS(0, 0x170)
105
- FPGA_CTRL_REGS(1, 0x180)
106
- FPGA_CTRL_REGS(2, 0x190)
107
- FPGA_CTRL_REGS(3, 0x1a0)
108
+ REG32(FPGA ## n ## _CLK_CTRL, (start)) \
109
+ REG32(FPGA ## n ## _THR_CTRL, (start) + 0x4)\
110
+ REG32(FPGA ## n ## _THR_CNT, (start) + 0x8)\
111
+ REG32(FPGA ## n ## _THR_STA, (start) + 0xc)
112
+FPGA_CTRL_REGS(0, 0x170)
113
+FPGA_CTRL_REGS(1, 0x180)
114
+FPGA_CTRL_REGS(2, 0x190)
115
+FPGA_CTRL_REGS(3, 0x1a0)
116
117
- BANDGAP_TRIP = 0x1b8 / 4,
118
- PLL_PREDIVISOR = 0x1c0 / 4,
119
- CLK_621_TRUE,
120
+REG32(BANDGAP_TRIP, 0x1b8)
121
+REG32(PLL_PREDIVISOR, 0x1c0)
122
+REG32(CLK_621_TRUE, 0x1c4)
123
124
- PSS_RST_CTRL = 0x200 / 4,
125
- DDR_RST_CTRL,
126
- TOPSW_RESET_CTRL,
127
- DMAC_RST_CTRL,
128
- USB_RST_CTRL,
129
- GEM_RST_CTRL,
130
- SDIO_RST_CTRL,
131
- SPI_RST_CTRL,
132
- CAN_RST_CTRL,
133
- I2C_RST_CTRL,
134
- UART_RST_CTRL,
135
- GPIO_RST_CTRL,
136
- LQSPI_RST_CTRL,
137
- SMC_RST_CTRL,
138
- OCM_RST_CTRL,
139
- FPGA_RST_CTRL = 0x240 / 4,
140
- A9_CPU_RST_CTRL,
141
+REG32(PSS_RST_CTRL, 0x200)
142
+ FIELD(PSS_RST_CTRL, SOFT_RST, 0, 1)
143
+REG32(DDR_RST_CTRL, 0x204)
144
+REG32(TOPSW_RESET_CTRL, 0x208)
145
+REG32(DMAC_RST_CTRL, 0x20c)
146
+REG32(USB_RST_CTRL, 0x210)
147
+REG32(GEM_RST_CTRL, 0x214)
148
+REG32(SDIO_RST_CTRL, 0x218)
149
+REG32(SPI_RST_CTRL, 0x21c)
150
+REG32(CAN_RST_CTRL, 0x220)
151
+REG32(I2C_RST_CTRL, 0x224)
152
+REG32(UART_RST_CTRL, 0x228)
153
+REG32(GPIO_RST_CTRL, 0x22c)
154
+REG32(LQSPI_RST_CTRL, 0x230)
155
+REG32(SMC_RST_CTRL, 0x234)
156
+REG32(OCM_RST_CTRL, 0x238)
157
+REG32(FPGA_RST_CTRL, 0x240)
158
+REG32(A9_CPU_RST_CTRL, 0x244)
159
160
- RS_AWDT_CTRL = 0x24c / 4,
161
- RST_REASON,
162
+REG32(RS_AWDT_CTRL, 0x24c)
163
+REG32(RST_REASON, 0x250)
164
165
- REBOOT_STATUS = 0x258 / 4,
166
- BOOT_MODE,
167
+REG32(REBOOT_STATUS, 0x258)
168
+REG32(BOOT_MODE, 0x25c)
169
170
- APU_CTRL = 0x300 / 4,
171
- WDT_CLK_SEL,
172
+REG32(APU_CTRL, 0x300)
173
+REG32(WDT_CLK_SEL, 0x304)
174
175
- TZ_DMA_NS = 0x440 / 4,
176
- TZ_DMA_IRQ_NS,
177
- TZ_DMA_PERIPH_NS,
178
+REG32(TZ_DMA_NS, 0x440)
179
+REG32(TZ_DMA_IRQ_NS, 0x444)
180
+REG32(TZ_DMA_PERIPH_NS, 0x448)
181
182
- PSS_IDCODE = 0x530 / 4,
183
+REG32(PSS_IDCODE, 0x530)
184
185
- DDR_URGENT = 0x600 / 4,
186
- DDR_CAL_START = 0x60c / 4,
187
- DDR_REF_START = 0x614 / 4,
188
- DDR_CMD_STA,
189
- DDR_URGENT_SEL,
190
- DDR_DFI_STATUS,
191
+REG32(DDR_URGENT, 0x600)
192
+REG32(DDR_CAL_START, 0x60c)
193
+REG32(DDR_REF_START, 0x614)
194
+REG32(DDR_CMD_STA, 0x618)
195
+REG32(DDR_URGENT_SEL, 0x61c)
196
+REG32(DDR_DFI_STATUS, 0x620)
197
198
- MIO = 0x700 / 4,
199
+REG32(MIO, 0x700)
200
#define MIO_LENGTH 54
201
202
- MIO_LOOPBACK = 0x804 / 4,
203
- MIO_MST_TRI0,
204
- MIO_MST_TRI1,
205
+REG32(MIO_LOOPBACK, 0x804)
206
+REG32(MIO_MST_TRI0, 0x808)
207
+REG32(MIO_MST_TRI1, 0x80c)
208
209
- SD0_WP_CD_SEL = 0x830 / 4,
210
- SD1_WP_CD_SEL,
211
+REG32(SD0_WP_CD_SEL, 0x830)
212
+REG32(SD1_WP_CD_SEL, 0x834)
213
214
- LVL_SHFTR_EN = 0x900 / 4,
215
- OCM_CFG = 0x910 / 4,
216
+REG32(LVL_SHFTR_EN, 0x900)
217
+REG32(OCM_CFG, 0x910)
218
219
- CPU_RAM = 0xa00 / 4,
220
+REG32(CPU_RAM, 0xa00)
221
222
- IOU = 0xa30 / 4,
223
+REG32(IOU, 0xa30)
224
225
- DMAC_RAM = 0xa50 / 4,
226
+REG32(DMAC_RAM, 0xa50)
227
228
- AFI0 = 0xa60 / 4,
229
- AFI1 = AFI0 + 3,
230
- AFI2 = AFI1 + 3,
231
- AFI3 = AFI2 + 3,
232
+REG32(AFI0, 0xa60)
233
+REG32(AFI1, 0xa6c)
234
+REG32(AFI2, 0xa78)
235
+REG32(AFI3, 0xa84)
236
#define AFI_LENGTH 3
237
238
- OCM = 0xa90 / 4,
239
+REG32(OCM, 0xa90)
240
241
- DEVCI_RAM = 0xaa0 / 4,
242
+REG32(DEVCI_RAM, 0xaa0)
243
244
- CSG_RAM = 0xab0 / 4,
245
+REG32(CSG_RAM, 0xab0)
246
247
- GPIOB_CTRL = 0xb00 / 4,
248
- GPIOB_CFG_CMOS18,
249
- GPIOB_CFG_CMOS25,
250
- GPIOB_CFG_CMOS33,
251
- GPIOB_CFG_HSTL = 0xb14 / 4,
252
- GPIOB_DRVR_BIAS_CTRL,
253
+REG32(GPIOB_CTRL, 0xb00)
254
+REG32(GPIOB_CFG_CMOS18, 0xb04)
255
+REG32(GPIOB_CFG_CMOS25, 0xb08)
256
+REG32(GPIOB_CFG_CMOS33, 0xb0c)
257
+REG32(GPIOB_CFG_HSTL, 0xb14)
258
+REG32(GPIOB_DRVR_BIAS_CTRL, 0xb18)
259
260
- DDRIOB = 0xb40 / 4,
261
+REG32(DDRIOB, 0xb40)
262
#define DDRIOB_LENGTH 14
263
-};
264
265
#define ZYNQ_SLCR_MMIO_SIZE 0x1000
266
#define ZYNQ_SLCR_NUM_REGS (ZYNQ_SLCR_MMIO_SIZE / 4)
267
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset(DeviceState *d)
268
269
DB_PRINT("RESET\n");
270
271
- s->regs[LOCKSTA] = 1;
272
+ s->regs[R_LOCKSTA] = 1;
273
/* 0x100 - 0x11C */
274
- s->regs[ARM_PLL_CTRL] = 0x0001A008;
275
- s->regs[DDR_PLL_CTRL] = 0x0001A008;
276
- s->regs[IO_PLL_CTRL] = 0x0001A008;
277
- s->regs[PLL_STATUS] = 0x0000003F;
278
- s->regs[ARM_PLL_CFG] = 0x00014000;
279
- s->regs[DDR_PLL_CFG] = 0x00014000;
280
- s->regs[IO_PLL_CFG] = 0x00014000;
281
+ s->regs[R_ARM_PLL_CTRL] = 0x0001A008;
282
+ s->regs[R_DDR_PLL_CTRL] = 0x0001A008;
283
+ s->regs[R_IO_PLL_CTRL] = 0x0001A008;
284
+ s->regs[R_PLL_STATUS] = 0x0000003F;
285
+ s->regs[R_ARM_PLL_CFG] = 0x00014000;
286
+ s->regs[R_DDR_PLL_CFG] = 0x00014000;
287
+ s->regs[R_IO_PLL_CFG] = 0x00014000;
288
289
/* 0x120 - 0x16C */
290
- s->regs[ARM_CLK_CTRL] = 0x1F000400;
291
- s->regs[DDR_CLK_CTRL] = 0x18400003;
292
- s->regs[DCI_CLK_CTRL] = 0x01E03201;
293
- s->regs[APER_CLK_CTRL] = 0x01FFCCCD;
294
- s->regs[USB0_CLK_CTRL] = s->regs[USB1_CLK_CTRL] = 0x00101941;
295
- s->regs[GEM0_RCLK_CTRL] = s->regs[GEM1_RCLK_CTRL] = 0x00000001;
296
- s->regs[GEM0_CLK_CTRL] = s->regs[GEM1_CLK_CTRL] = 0x00003C01;
297
- s->regs[SMC_CLK_CTRL] = 0x00003C01;
298
- s->regs[LQSPI_CLK_CTRL] = 0x00002821;
299
- s->regs[SDIO_CLK_CTRL] = 0x00001E03;
300
- s->regs[UART_CLK_CTRL] = 0x00003F03;
301
- s->regs[SPI_CLK_CTRL] = 0x00003F03;
302
- s->regs[CAN_CLK_CTRL] = 0x00501903;
303
- s->regs[DBG_CLK_CTRL] = 0x00000F03;
304
- s->regs[PCAP_CLK_CTRL] = 0x00000F01;
305
+ s->regs[R_ARM_CLK_CTRL] = 0x1F000400;
306
+ s->regs[R_DDR_CLK_CTRL] = 0x18400003;
307
+ s->regs[R_DCI_CLK_CTRL] = 0x01E03201;
308
+ s->regs[R_APER_CLK_CTRL] = 0x01FFCCCD;
309
+ s->regs[R_USB0_CLK_CTRL] = s->regs[R_USB1_CLK_CTRL] = 0x00101941;
310
+ s->regs[R_GEM0_RCLK_CTRL] = s->regs[R_GEM1_RCLK_CTRL] = 0x00000001;
311
+ s->regs[R_GEM0_CLK_CTRL] = s->regs[R_GEM1_CLK_CTRL] = 0x00003C01;
312
+ s->regs[R_SMC_CLK_CTRL] = 0x00003C01;
313
+ s->regs[R_LQSPI_CLK_CTRL] = 0x00002821;
314
+ s->regs[R_SDIO_CLK_CTRL] = 0x00001E03;
315
+ s->regs[R_UART_CLK_CTRL] = 0x00003F03;
316
+ s->regs[R_SPI_CLK_CTRL] = 0x00003F03;
317
+ s->regs[R_CAN_CLK_CTRL] = 0x00501903;
318
+ s->regs[R_DBG_CLK_CTRL] = 0x00000F03;
319
+ s->regs[R_PCAP_CLK_CTRL] = 0x00000F01;
320
321
/* 0x170 - 0x1AC */
322
- s->regs[FPGA0_CLK_CTRL] = s->regs[FPGA1_CLK_CTRL] = s->regs[FPGA2_CLK_CTRL]
323
- = s->regs[FPGA3_CLK_CTRL] = 0x00101800;
324
- s->regs[FPGA0_THR_STA] = s->regs[FPGA1_THR_STA] = s->regs[FPGA2_THR_STA]
325
- = s->regs[FPGA3_THR_STA] = 0x00010000;
326
+ s->regs[R_FPGA0_CLK_CTRL] = s->regs[R_FPGA1_CLK_CTRL]
327
+ = s->regs[R_FPGA2_CLK_CTRL]
328
+ = s->regs[R_FPGA3_CLK_CTRL] = 0x00101800;
329
+ s->regs[R_FPGA0_THR_STA] = s->regs[R_FPGA1_THR_STA]
330
+ = s->regs[R_FPGA2_THR_STA]
331
+ = s->regs[R_FPGA3_THR_STA] = 0x00010000;
332
333
/* 0x1B0 - 0x1D8 */
334
- s->regs[BANDGAP_TRIP] = 0x0000001F;
335
- s->regs[PLL_PREDIVISOR] = 0x00000001;
336
- s->regs[CLK_621_TRUE] = 0x00000001;
337
+ s->regs[R_BANDGAP_TRIP] = 0x0000001F;
338
+ s->regs[R_PLL_PREDIVISOR] = 0x00000001;
339
+ s->regs[R_CLK_621_TRUE] = 0x00000001;
340
341
/* 0x200 - 0x25C */
342
- s->regs[FPGA_RST_CTRL] = 0x01F33F0F;
343
- s->regs[RST_REASON] = 0x00000040;
344
+ s->regs[R_FPGA_RST_CTRL] = 0x01F33F0F;
345
+ s->regs[R_RST_REASON] = 0x00000040;
346
347
- s->regs[BOOT_MODE] = 0x00000001;
348
+ s->regs[R_BOOT_MODE] = 0x00000001;
349
350
/* 0x700 - 0x7D4 */
351
for (i = 0; i < 54; i++) {
352
- s->regs[MIO + i] = 0x00001601;
353
+ s->regs[R_MIO + i] = 0x00001601;
354
}
355
for (i = 2; i <= 8; i++) {
356
- s->regs[MIO + i] = 0x00000601;
357
+ s->regs[R_MIO + i] = 0x00000601;
358
}
359
360
- s->regs[MIO_MST_TRI0] = s->regs[MIO_MST_TRI1] = 0xFFFFFFFF;
361
+ s->regs[R_MIO_MST_TRI0] = s->regs[R_MIO_MST_TRI1] = 0xFFFFFFFF;
362
363
- s->regs[CPU_RAM + 0] = s->regs[CPU_RAM + 1] = s->regs[CPU_RAM + 3]
364
- = s->regs[CPU_RAM + 4] = s->regs[CPU_RAM + 7]
365
- = 0x00010101;
366
- s->regs[CPU_RAM + 2] = s->regs[CPU_RAM + 5] = 0x01010101;
367
- s->regs[CPU_RAM + 6] = 0x00000001;
368
+ s->regs[R_CPU_RAM + 0] = s->regs[R_CPU_RAM + 1] = s->regs[R_CPU_RAM + 3]
369
+ = s->regs[R_CPU_RAM + 4] = s->regs[R_CPU_RAM + 7]
370
+ = 0x00010101;
371
+ s->regs[R_CPU_RAM + 2] = s->regs[R_CPU_RAM + 5] = 0x01010101;
372
+ s->regs[R_CPU_RAM + 6] = 0x00000001;
373
374
- s->regs[IOU + 0] = s->regs[IOU + 1] = s->regs[IOU + 2] = s->regs[IOU + 3]
375
- = 0x09090909;
376
- s->regs[IOU + 4] = s->regs[IOU + 5] = 0x00090909;
377
- s->regs[IOU + 6] = 0x00000909;
378
+ s->regs[R_IOU + 0] = s->regs[R_IOU + 1] = s->regs[R_IOU + 2]
379
+ = s->regs[R_IOU + 3] = 0x09090909;
380
+ s->regs[R_IOU + 4] = s->regs[R_IOU + 5] = 0x00090909;
381
+ s->regs[R_IOU + 6] = 0x00000909;
382
383
- s->regs[DMAC_RAM] = 0x00000009;
384
+ s->regs[R_DMAC_RAM] = 0x00000009;
385
386
- s->regs[AFI0 + 0] = s->regs[AFI0 + 1] = 0x09090909;
387
- s->regs[AFI1 + 0] = s->regs[AFI1 + 1] = 0x09090909;
388
- s->regs[AFI2 + 0] = s->regs[AFI2 + 1] = 0x09090909;
389
- s->regs[AFI3 + 0] = s->regs[AFI3 + 1] = 0x09090909;
390
- s->regs[AFI0 + 2] = s->regs[AFI1 + 2] = s->regs[AFI2 + 2]
391
- = s->regs[AFI3 + 2] = 0x00000909;
392
+ s->regs[R_AFI0 + 0] = s->regs[R_AFI0 + 1] = 0x09090909;
393
+ s->regs[R_AFI1 + 0] = s->regs[R_AFI1 + 1] = 0x09090909;
394
+ s->regs[R_AFI2 + 0] = s->regs[R_AFI2 + 1] = 0x09090909;
395
+ s->regs[R_AFI3 + 0] = s->regs[R_AFI3 + 1] = 0x09090909;
396
+ s->regs[R_AFI0 + 2] = s->regs[R_AFI1 + 2] = s->regs[R_AFI2 + 2]
397
+ = s->regs[R_AFI3 + 2] = 0x00000909;
398
399
- s->regs[OCM + 0] = 0x01010101;
400
- s->regs[OCM + 1] = s->regs[OCM + 2] = 0x09090909;
401
+ s->regs[R_OCM + 0] = 0x01010101;
402
+ s->regs[R_OCM + 1] = s->regs[R_OCM + 2] = 0x09090909;
403
404
- s->regs[DEVCI_RAM] = 0x00000909;
405
- s->regs[CSG_RAM] = 0x00000001;
406
+ s->regs[R_DEVCI_RAM] = 0x00000909;
407
+ s->regs[R_CSG_RAM] = 0x00000001;
408
409
- s->regs[DDRIOB + 0] = s->regs[DDRIOB + 1] = s->regs[DDRIOB + 2]
410
- = s->regs[DDRIOB + 3] = 0x00000e00;
411
- s->regs[DDRIOB + 4] = s->regs[DDRIOB + 5] = s->regs[DDRIOB + 6]
412
- = 0x00000e00;
413
- s->regs[DDRIOB + 12] = 0x00000021;
414
+ s->regs[R_DDRIOB + 0] = s->regs[R_DDRIOB + 1] = s->regs[R_DDRIOB + 2]
415
+ = s->regs[R_DDRIOB + 3] = 0x00000e00;
416
+ s->regs[R_DDRIOB + 4] = s->regs[R_DDRIOB + 5] = s->regs[R_DDRIOB + 6]
417
+ = 0x00000e00;
418
+ s->regs[R_DDRIOB + 12] = 0x00000021;
419
}
420
421
422
static bool zynq_slcr_check_offset(hwaddr offset, bool rnw)
423
{
424
switch (offset) {
425
- case LOCK:
426
- case UNLOCK:
427
- case DDR_CAL_START:
428
- case DDR_REF_START:
429
+ case R_LOCK:
430
+ case R_UNLOCK:
431
+ case R_DDR_CAL_START:
432
+ case R_DDR_REF_START:
433
return !rnw; /* Write only */
434
- case LOCKSTA:
435
- case FPGA0_THR_STA:
436
- case FPGA1_THR_STA:
437
- case FPGA2_THR_STA:
438
- case FPGA3_THR_STA:
439
- case BOOT_MODE:
440
- case PSS_IDCODE:
441
- case DDR_CMD_STA:
442
- case DDR_DFI_STATUS:
443
- case PLL_STATUS:
444
+ case R_LOCKSTA:
445
+ case R_FPGA0_THR_STA:
446
+ case R_FPGA1_THR_STA:
447
+ case R_FPGA2_THR_STA:
448
+ case R_FPGA3_THR_STA:
449
+ case R_BOOT_MODE:
450
+ case R_PSS_IDCODE:
451
+ case R_DDR_CMD_STA:
452
+ case R_DDR_DFI_STATUS:
453
+ case R_PLL_STATUS:
454
return rnw;/* read only */
455
- case SCL:
456
- case ARM_PLL_CTRL ... IO_PLL_CTRL:
457
- case ARM_PLL_CFG ... IO_PLL_CFG:
458
- case ARM_CLK_CTRL ... TOPSW_CLK_CTRL:
459
- case FPGA0_CLK_CTRL ... FPGA0_THR_CNT:
460
- case FPGA1_CLK_CTRL ... FPGA1_THR_CNT:
461
- case FPGA2_CLK_CTRL ... FPGA2_THR_CNT:
462
- case FPGA3_CLK_CTRL ... FPGA3_THR_CNT:
463
- case BANDGAP_TRIP:
464
- case PLL_PREDIVISOR:
465
- case CLK_621_TRUE:
466
- case PSS_RST_CTRL ... A9_CPU_RST_CTRL:
467
- case RS_AWDT_CTRL:
468
- case RST_REASON:
469
- case REBOOT_STATUS:
470
- case APU_CTRL:
471
- case WDT_CLK_SEL:
472
- case TZ_DMA_NS ... TZ_DMA_PERIPH_NS:
473
- case DDR_URGENT:
474
- case DDR_URGENT_SEL:
475
- case MIO ... MIO + MIO_LENGTH - 1:
476
- case MIO_LOOPBACK ... MIO_MST_TRI1:
477
- case SD0_WP_CD_SEL:
478
- case SD1_WP_CD_SEL:
479
- case LVL_SHFTR_EN:
480
- case OCM_CFG:
481
- case CPU_RAM:
482
- case IOU:
483
- case DMAC_RAM:
484
- case AFI0 ... AFI3 + AFI_LENGTH - 1:
485
- case OCM:
486
- case DEVCI_RAM:
487
- case CSG_RAM:
488
- case GPIOB_CTRL ... GPIOB_CFG_CMOS33:
489
- case GPIOB_CFG_HSTL:
490
- case GPIOB_DRVR_BIAS_CTRL:
491
- case DDRIOB ... DDRIOB + DDRIOB_LENGTH - 1:
492
+ case R_SCL:
493
+ case R_ARM_PLL_CTRL ... R_IO_PLL_CTRL:
494
+ case R_ARM_PLL_CFG ... R_IO_PLL_CFG:
495
+ case R_ARM_CLK_CTRL ... R_TOPSW_CLK_CTRL:
496
+ case R_FPGA0_CLK_CTRL ... R_FPGA0_THR_CNT:
497
+ case R_FPGA1_CLK_CTRL ... R_FPGA1_THR_CNT:
498
+ case R_FPGA2_CLK_CTRL ... R_FPGA2_THR_CNT:
499
+ case R_FPGA3_CLK_CTRL ... R_FPGA3_THR_CNT:
500
+ case R_BANDGAP_TRIP:
501
+ case R_PLL_PREDIVISOR:
502
+ case R_CLK_621_TRUE:
503
+ case R_PSS_RST_CTRL ... R_A9_CPU_RST_CTRL:
504
+ case R_RS_AWDT_CTRL:
505
+ case R_RST_REASON:
506
+ case R_REBOOT_STATUS:
507
+ case R_APU_CTRL:
508
+ case R_WDT_CLK_SEL:
509
+ case R_TZ_DMA_NS ... R_TZ_DMA_PERIPH_NS:
510
+ case R_DDR_URGENT:
511
+ case R_DDR_URGENT_SEL:
512
+ case R_MIO ... R_MIO + MIO_LENGTH - 1:
513
+ case R_MIO_LOOPBACK ... R_MIO_MST_TRI1:
514
+ case R_SD0_WP_CD_SEL:
515
+ case R_SD1_WP_CD_SEL:
516
+ case R_LVL_SHFTR_EN:
517
+ case R_OCM_CFG:
518
+ case R_CPU_RAM:
519
+ case R_IOU:
520
+ case R_DMAC_RAM:
521
+ case R_AFI0 ... R_AFI3 + AFI_LENGTH - 1:
522
+ case R_OCM:
523
+ case R_DEVCI_RAM:
524
+ case R_CSG_RAM:
525
+ case R_GPIOB_CTRL ... R_GPIOB_CFG_CMOS33:
526
+ case R_GPIOB_CFG_HSTL:
527
+ case R_GPIOB_DRVR_BIAS_CTRL:
528
+ case R_DDRIOB ... R_DDRIOB + DDRIOB_LENGTH - 1:
529
return true;
530
default:
531
return false;
532
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
533
}
534
535
switch (offset) {
536
- case SCL:
537
- s->regs[SCL] = val & 0x1;
538
+ case R_SCL:
539
+ s->regs[R_SCL] = val & 0x1;
540
return;
541
- case LOCK:
542
+ case R_LOCK:
543
if ((val & 0xFFFF) == XILINX_LOCK_KEY) {
544
DB_PRINT("XILINX LOCK 0xF8000000 + 0x%x <= 0x%x\n", (int)offset,
545
(unsigned)val & 0xFFFF);
546
- s->regs[LOCKSTA] = 1;
547
+ s->regs[R_LOCKSTA] = 1;
548
} else {
549
DB_PRINT("WRONG XILINX LOCK KEY 0xF8000000 + 0x%x <= 0x%x\n",
550
(int)offset, (unsigned)val & 0xFFFF);
551
}
552
return;
553
- case UNLOCK:
554
+ case R_UNLOCK:
555
if ((val & 0xFFFF) == XILINX_UNLOCK_KEY) {
556
DB_PRINT("XILINX UNLOCK 0xF8000000 + 0x%x <= 0x%x\n", (int)offset,
557
(unsigned)val & 0xFFFF);
558
- s->regs[LOCKSTA] = 0;
559
+ s->regs[R_LOCKSTA] = 0;
560
} else {
561
DB_PRINT("WRONG XILINX UNLOCK KEY 0xF8000000 + 0x%x <= 0x%x\n",
562
(int)offset, (unsigned)val & 0xFFFF);
563
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
564
return;
565
}
566
567
- if (s->regs[LOCKSTA]) {
568
+ if (s->regs[R_LOCKSTA]) {
569
qemu_log_mask(LOG_GUEST_ERROR,
570
"SCLR registers are locked. Unlock them first\n");
571
return;
572
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
573
s->regs[offset] = val;
574
575
switch (offset) {
576
- case PSS_RST_CTRL:
577
- if (val & R_PSS_RST_CTRL_SOFT_RST) {
578
+ case R_PSS_RST_CTRL:
579
+ if (FIELD_EX32(val, PSS_RST_CTRL, SOFT_RST)) {
580
qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
581
}
582
break;
583
--
584
2.20.1
585
586
diff view generated by jsdifflib
[Qemu-devel] [PULL 04/10] hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
[Qemu-devel] [PULL 03/29] Set ENET_BD_BDU in I.MX FEC controller
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Aaron Hill <aa1ronham@gmail.com>
2
2
3
Both lqspi_read() and lqspi_load_cache() expect a 32-bit
3
This commit properly sets the ENET_BD_BDU flag once the emulated FEC controller
4
aligned address.
4
has finished processing the last descriptor. This is done for both transmit
5
and receive descriptors.
5
6
6
>From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':
7
This allows the QNX 7.0.0 BSP for the Sabrelite board (which can be
8
found at http://blackberry.qnx.com/en/developers/bsp) to properly
9
control the FEC. Without this patch, the BSP ethernet driver will never
10
re-use FEC descriptors, as the unset ENET_BD_BDU flag will cause
11
it to believe that the descriptors are still in use by the NIC.
7
12
8
Transfer Size Limitations
13
Note that Linux does not appear to use this field at all, and is
14
unaffected by this patch.
9
15
10
Because of the 32-bit wide TX, RX, and generic FIFO, all
16
Without this patch, QNX will think that the NIC is still processing its
11
APB/AXI transfers must be an integer multiple of 4-bytes.
17
transaction descriptors, and won't send any more data over the network.
12
Shorter transfers are not possible.
13
18
14
Set MemoryRegionOps.impl values to force 32-bit accesses,
19
For reference:
15
this way we are sure we do not access the lqspi_buf[] array
16
out of bound.
17
20
18
[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
21
On page 1192 of the I.MX 6DQ reference manual revision (Rev. 5, 06/2018),
22
which can be found at https://www.nxp.com/products/processors-and-microcontrollers/arm-based-processors-and-mcus/i.mx-applications-processors/i.mx-6-processors/i.mx-6quad-processors-high-performance-3d-graphics-hd-video-arm-cortex-a9-core:i.MX6Q?&tab=Documentation_Tab&linkline=Application-Note
19
23
20
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
24
the 'BDU' field is described as follows for the 'Enhanced transmit
21
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
25
buffer descriptor':
22
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
26
27
'Last buffer descriptor update done. Indicates that the last BD data has been updated by
28
uDMA. This field is written by the user (=0) and uDMA (=1).'
29
30
The same description is used for the receive buffer descriptor.
31
32
Signed-off-by: Aaron Hill <aa1ronham@gmail.com>
33
Message-id: 20190805142417.10433-1-aaron.hill@alertinnovation.com
34
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
23
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
35
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
24
---
36
---
25
hw/ssi/xilinx_spips.c | 4 ++++
37
hw/net/imx_fec.c | 4 ++++
26
1 file changed, 4 insertions(+)
38
1 file changed, 4 insertions(+)
27
39
28
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
40
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
29
index XXXXXXX..XXXXXXX 100644
41
index XXXXXXX..XXXXXXX 100644
30
--- a/hw/ssi/xilinx_spips.c
42
--- a/hw/net/imx_fec.c
31
+++ b/hw/ssi/xilinx_spips.c
43
+++ b/hw/net/imx_fec.c
32
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps lqspi_ops = {
44
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s, uint32_t index)
33
.read_with_attrs = lqspi_read,
45
if (bd.option & ENET_BD_TX_INT) {
34
.write_with_attrs = lqspi_write,
46
s->regs[ENET_EIR] |= int_txf;
35
.endianness = DEVICE_NATIVE_ENDIAN,
47
}
36
+ .impl = {
48
+ /* Indicate that we've updated the last buffer descriptor. */
37
+ .min_access_size = 4,
49
+ bd.last_buffer = ENET_BD_BDU;
38
+ .max_access_size = 4,
50
}
39
+ },
51
if (bd.option & ENET_BD_TX_INT) {
40
.valid = {
52
s->regs[ENET_EIR] |= int_txb;
41
.min_access_size = 1,
53
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
42
.max_access_size = 4
54
/* Last buffer in frame. */
55
bd.flags |= flags | ENET_BD_L;
56
FEC_PRINTF("rx frame flags %04x\n", bd.flags);
57
+ /* Indicate that we've updated the last buffer descriptor. */
58
+ bd.last_buffer = ENET_BD_BDU;
59
if (bd.option & ENET_BD_RX_INT) {
60
s->regs[ENET_EIR] |= ENET_INT_RXF;
61
}
43
--
62
--
44
2.20.1
63
2.20.1
45
64
46
65
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 04/29] target/arm: Factor out 'generate singlestep exception' function
1
Factor out code to 'generate a singlestep exception', which is
2
currently repeated in four places.
1
3
4
To do this we need to also pull the identical copies of the
5
gen-exception() function out of translate-a64.c and translate.c
6
into translate.h.
7
8
(There is a bug in the code: we're taking the exception to the wrong
9
target EL. This will be simpler to fix if there's only one place to
10
do it.)
11
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
14
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
15
Message-id: 20190805130952.4415-2-peter.maydell@linaro.org
16
---
17
target/arm/translate.h | 23 +++++++++++++++++++++++
18
target/arm/translate-a64.c | 19 ++-----------------
19
target/arm/translate.c | 20 ++------------------
20
3 files changed, 27 insertions(+), 35 deletions(-)
21
22
diff --git a/target/arm/translate.h b/target/arm/translate.h
23
index XXXXXXX..XXXXXXX 100644
24
--- a/target/arm/translate.h
25
+++ b/target/arm/translate.h
26
@@ -XXX,XX +XXX,XX @@
27
#define TARGET_ARM_TRANSLATE_H
28
29
#include "exec/translator.h"
30
+#include "internals.h"
31
32
33
/* internal defines */
34
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
35
}
36
}
37
38
+static inline void gen_exception(int excp, uint32_t syndrome,
39
+ uint32_t target_el)
40
+{
41
+ TCGv_i32 tcg_excp = tcg_const_i32(excp);
42
+ TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
43
+ TCGv_i32 tcg_el = tcg_const_i32(target_el);
44
+
45
+ gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
46
+ tcg_syn, tcg_el);
47
+
48
+ tcg_temp_free_i32(tcg_el);
49
+ tcg_temp_free_i32(tcg_syn);
50
+ tcg_temp_free_i32(tcg_excp);
51
+}
52
+
53
+/* Generate an architectural singlestep exception */
54
+static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
55
+{
56
+ gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, isv, ex),
57
+ default_exception_el(s));
58
+}
59
+
60
/*
61
* Given a VFP floating point constant encoded into an 8 bit immediate in an
62
* instruction, expand it to the actual constant value of the specified
63
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
64
index XXXXXXX..XXXXXXX 100644
65
--- a/target/arm/translate-a64.c
66
+++ b/target/arm/translate-a64.c
67
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
68
tcg_temp_free_i32(tcg_excp);
69
}
70
71
-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
72
-{
73
- TCGv_i32 tcg_excp = tcg_const_i32(excp);
74
- TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
75
- TCGv_i32 tcg_el = tcg_const_i32(target_el);
76
-
77
- gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
78
- tcg_syn, tcg_el);
79
- tcg_temp_free_i32(tcg_el);
80
- tcg_temp_free_i32(tcg_syn);
81
- tcg_temp_free_i32(tcg_excp);
82
-}
83
-
84
static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
85
{
86
gen_a64_set_pc_im(s->pc - offset);
87
@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
88
* of the exception, and our syndrome information is always correct.
89
*/
90
gen_ss_advance(s);
91
- gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, 1, s->is_ldex),
92
- default_exception_el(s));
93
+ gen_swstep_exception(s, 1, s->is_ldex);
94
s->base.is_jmp = DISAS_NORETURN;
95
}
96
97
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
98
* bits should be zero.
99
*/
100
assert(dc->base.num_insns == 1);
101
- gen_exception(EXCP_UDEF, syn_swstep(dc->ss_same_el, 0, 0),
102
- default_exception_el(dc));
103
+ gen_swstep_exception(dc, 0, 0);
104
dc->base.is_jmp = DISAS_NORETURN;
105
} else {
106
disas_a64_insn(env, dc);
107
diff --git a/target/arm/translate.c b/target/arm/translate.c
108
index XXXXXXX..XXXXXXX 100644
109
--- a/target/arm/translate.c
110
+++ b/target/arm/translate.c
111
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
112
tcg_temp_free_i32(tcg_excp);
113
}
114
115
-static void gen_exception(int excp, uint32_t syndrome, uint32_t target_el)
116
-{
117
- TCGv_i32 tcg_excp = tcg_const_i32(excp);
118
- TCGv_i32 tcg_syn = tcg_const_i32(syndrome);
119
- TCGv_i32 tcg_el = tcg_const_i32(target_el);
120
-
121
- gen_helper_exception_with_syndrome(cpu_env, tcg_excp,
122
- tcg_syn, tcg_el);
123
-
124
- tcg_temp_free_i32(tcg_el);
125
- tcg_temp_free_i32(tcg_syn);
126
- tcg_temp_free_i32(tcg_excp);
127
-}
128
-
129
static void gen_step_complete_exception(DisasContext *s)
130
{
131
/* We just completed step of an insn. Move from Active-not-pending
132
@@ -XXX,XX +XXX,XX @@ static void gen_step_complete_exception(DisasContext *s)
133
* of the exception, and our syndrome information is always correct.
134
*/
135
gen_ss_advance(s);
136
- gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, 1, s->is_ldex),
137
- default_exception_el(s));
138
+ gen_swstep_exception(s, 1, s->is_ldex);
139
s->base.is_jmp = DISAS_NORETURN;
140
}
141
142
@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)
143
* bits should be zero.
144
*/
145
assert(dc->base.num_insns == 1);
146
- gen_exception(EXCP_UDEF, syn_swstep(dc->ss_same_el, 0, 0),
147
- default_exception_el(dc));
148
+ gen_swstep_exception(dc, 0, 0);
149
dc->base.is_jmp = DISAS_NORETURN;
150
return true;
151
}
152
--
153
2.20.1
154
155
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 05/29] target/arm: Fix routing of singlestep exceptions
1
When generating an architectural single-step exception we were
2
routing it to the "default exception level", which is to say
3
the same exception level we execute at except that EL0 exceptions
4
go to EL1. This is incorrect because the debug exception level
5
can be configured by the guest for situations such as single
6
stepping of EL0 and EL1 code by EL2.
1
7
8
We have to track the target debug exception level in the TB
9
flags, because it is dependent on CPU state like HCR_EL2.TGE
10
and MDCR_EL2.TDE. (That we were previously calling the
11
arm_debug_target_el() function to determine dc->ss_same_el
12
is itself a bug, though one that would only have manifested
13
as incorrect syndrome information.) Since we are out of TB
14
flag bits unless we want to expand into the cs_base field,
15
we share some bits with the M-profile only HANDLER and
16
STACKCHECK bits, since only A-profile has this singlestep.
17
18
Fixes: https://bugs.launchpad.net/qemu/+bug/1838913
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
21
Tested-by: Alex Bennée <alex.bennee@linaro.org>
22
Message-id: 20190805130952.4415-3-peter.maydell@linaro.org
23
---
24
target/arm/cpu.h | 5 +++++
25
target/arm/translate.h | 15 +++++++++++----
26
target/arm/helper.c | 6 ++++++
27
target/arm/translate-a64.c | 2 +-
28
target/arm/translate.c | 4 +++-
29
5 files changed, 26 insertions(+), 6 deletions(-)
30
31
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
32
index XXXXXXX..XXXXXXX 100644
33
--- a/target/arm/cpu.h
34
+++ b/target/arm/cpu.h
35
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, PSTATE_SS, 26, 1)
36
/* Target EL if we take a floating-point-disabled exception */
37
FIELD(TBFLAG_ANY, FPEXC_EL, 24, 2)
38
FIELD(TBFLAG_ANY, BE_DATA, 23, 1)
39
+/*
40
+ * For A-profile only, target EL for debug exceptions.
41
+ * Note that this overlaps with the M-profile-only HANDLER and STACKCHECK bits.
42
+ */
43
+FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 21, 2)
44
45
/* Bit usage when in AArch32 state: */
46
FIELD(TBFLAG_A32, THUMB, 0, 1)
47
diff --git a/target/arm/translate.h b/target/arm/translate.h
48
index XXXXXXX..XXXXXXX 100644
49
--- a/target/arm/translate.h
50
+++ b/target/arm/translate.h
51
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
52
uint32_t svc_imm;
53
int aarch64;
54
int current_el;
55
+ /* Debug target exception level for single-step exceptions */
56
+ int debug_target_el;
57
GHashTable *cp_regs;
58
uint64_t features; /* CPU features bits */
59
/* Because unallocated encodings generate different exception syndrome
60
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
61
* ie A64 LDX*, LDAX*, A32/T32 LDREX*, LDAEX*.
62
*/
63
bool is_ldex;
64
- /* True if a single-step exception will be taken to the current EL */
65
- bool ss_same_el;
66
/* True if v8.3-PAuth is active. */
67
bool pauth_active;
68
/* True with v8.5-BTI and SCTLR_ELx.BT* set. */
69
@@ -XXX,XX +XXX,XX @@ static inline void gen_exception(int excp, uint32_t syndrome,
70
/* Generate an architectural singlestep exception */
71
static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)
72
{
73
- gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, isv, ex),
74
- default_exception_el(s));
75
+ bool same_el = (s->debug_target_el == s->current_el);
76
+
77
+ /*
78
+ * If singlestep is targeting a lower EL than the current one,
79
+ * then s->ss_active must be false and we can never get here.
80
+ */
81
+ assert(s->debug_target_el >= s->current_el);
82
+
83
+ gen_exception(EXCP_UDEF, syn_swstep(same_el, isv, ex), s->debug_target_el);
84
}
85
86
/*
87
diff --git a/target/arm/helper.c b/target/arm/helper.c
88
index XXXXXXX..XXXXXXX 100644
89
--- a/target/arm/helper.c
90
+++ b/target/arm/helper.c
91
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
92
}
93
}
94
95
+ if (!arm_feature(env, ARM_FEATURE_M)) {
96
+ int target_el = arm_debug_target_el(env);
97
+
98
+ flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL, target_el);
99
+ }
100
+
101
*pflags = flags;
102
*cs_base = 0;
103
}
104
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
105
index XXXXXXX..XXXXXXX 100644
106
--- a/target/arm/translate-a64.c
107
+++ b/target/arm/translate-a64.c
108
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
109
dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);
110
dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);
111
dc->is_ldex = false;
112
- dc->ss_same_el = (arm_debug_target_el(env) == dc->current_el);
113
+ dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);
114
115
/* Bound the number of insns to execute to those left on the page. */
116
bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
117
diff --git a/target/arm/translate.c b/target/arm/translate.c
118
index XXXXXXX..XXXXXXX 100644
119
--- a/target/arm/translate.c
120
+++ b/target/arm/translate.c
121
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
122
dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);
123
dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);
124
dc->is_ldex = false;
125
- dc->ss_same_el = false; /* Can't be true since EL_d must be AArch64 */
126
+ if (!arm_feature(env, ARM_FEATURE_M)) {
127
+ dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);
128
+ }
129
130
dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;
131
132
--
133
2.20.1
134
135
diff view generated by jsdifflib
[Qemu-devel] [PULL 02/10] hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
[Qemu-devel] [PULL 06/29] target/arm: Pass in pc to thumb_insn_is_16bit
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
In the next commit we will implement the write_with_attrs()
3
This function is used in two different contexts, and it will be
4
handler. To avoid using different APIs, convert the read()
4
clearer if the function is given the address to which it applies.
5
handler first.
6
5
7
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
9
Message-id: 20190807045335.1361-2-richard.henderson@linaro.org
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
11
---
12
hw/ssi/xilinx_spips.c | 23 +++++++++++------------
12
target/arm/translate.c | 14 +++++++-------
13
1 file changed, 11 insertions(+), 12 deletions(-)
13
1 file changed, 7 insertions(+), 7 deletions(-)
14
14
15
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
15
diff --git a/target/arm/translate.c b/target/arm/translate.c
16
index XXXXXXX..XXXXXXX 100644
16
index XXXXXXX..XXXXXXX 100644
17
--- a/hw/ssi/xilinx_spips.c
17
--- a/target/arm/translate.c
18
+++ b/hw/ssi/xilinx_spips.c
18
+++ b/target/arm/translate.c
19
@@ -XXX,XX +XXX,XX @@ static void lqspi_load_cache(void *opaque, hwaddr addr)
19
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
20
}
20
}
21
}
21
}
22
22
23
-static uint64_t
23
-static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
24
-lqspi_read(void *opaque, hwaddr addr, unsigned int size)
24
+static bool thumb_insn_is_16bit(DisasContext *s, uint32_t pc, uint32_t insn)
25
+static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
26
+ unsigned size, MemTxAttrs attrs)
27
{
25
{
28
- XilinxQSPIPS *q = opaque;
26
- /* Return true if this is a 16 bit instruction. We must be precise
29
- uint32_t ret;
27
- * about this (matching the decode). We assume that s->pc still
30
+ XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
28
- * points to the first 16 bits of the insn.
31
29
+ /*
32
if (addr >= q->lqspi_cached_addr &&
30
+ * Return true if this is a 16 bit instruction. We must be precise
33
addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
31
+ * about this (matching the decode).
34
uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
32
*/
35
- ret = cpu_to_le32(*(uint32_t *)retp);
33
if ((insn >> 11) < 0x1d) {
36
- DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
34
/* Definitely a 16-bit instruction */
37
- (unsigned)ret);
35
@@ -XXX,XX +XXX,XX @@ static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
38
- return ret;
36
return false;
39
- } else {
40
- lqspi_load_cache(opaque, addr);
41
- return lqspi_read(opaque, addr, size);
42
+ *value = cpu_to_le32(*(uint32_t *)retp);
43
+ DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
44
+ addr, *value);
45
+ return MEMTX_OK;
46
}
37
}
47
+
38
48
+ lqspi_load_cache(opaque, addr);
39
- if ((insn >> 11) == 0x1e && s->pc - s->page_start < TARGET_PAGE_SIZE - 3) {
49
+ return lqspi_read(opaque, addr, value, size, attrs);
40
+ if ((insn >> 11) == 0x1e && pc - s->page_start < TARGET_PAGE_SIZE - 3) {
41
/* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix, and the suffix
42
* is not on the next page; we merge this into a 32-bit
43
* insn.
44
@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
45
*/
46
uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
47
48
- return !thumb_insn_is_16bit(s, insn);
49
+ return !thumb_insn_is_16bit(s, s->pc, insn);
50
}
50
}
51
51
52
static const MemoryRegionOps lqspi_ops = {
52
static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
53
- .read = lqspi_read,
53
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
54
+ .read_with_attrs = lqspi_read,
54
}
55
.endianness = DEVICE_NATIVE_ENDIAN,
55
56
.valid = {
56
insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
57
.min_access_size = 1,
57
- is_16bit = thumb_insn_is_16bit(dc, insn);
58
+ is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
59
dc->pc += 2;
60
if (!is_16bit) {
61
uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
58
--
62
--
59
2.20.1
63
2.20.1
60
64
61
65
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 07/29] target/arm: Introduce pc_curr
1
1
From: Richard Henderson <richard.henderson@linaro.org>
2
3
Add a new field to retain the address of the instruction currently
4
being translated. The 32-bit uses are all within subroutines used
5
by a32 and t32. This will become less obvious when t16 support is
6
merged with a32+t32, and having a clear definition will help.
7
8
Convert aarch64 as well for consistency. Note that there is one
9
instance of a pre-assert fprintf that used the wrong value for the
10
address of the current instruction.
11
12
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
13
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
14
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
15
Message-id: 20190807045335.1361-3-richard.henderson@linaro.org
16
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
17
---
18
target/arm/translate-a64.h | 2 +-
19
target/arm/translate.h | 2 ++
20
target/arm/translate-a64.c | 21 +++++++++++----------
21
target/arm/translate.c | 14 ++++++++------
22
4 files changed, 22 insertions(+), 17 deletions(-)
23
24
diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
25
index XXXXXXX..XXXXXXX 100644
26
--- a/target/arm/translate-a64.h
27
+++ b/target/arm/translate-a64.h
28
@@ -XXX,XX +XXX,XX @@ void unallocated_encoding(DisasContext *s);
29
qemu_log_mask(LOG_UNIMP, \
30
"%s:%d: unsupported instruction encoding 0x%08x " \
31
"at pc=%016" PRIx64 "\n", \
32
- __FILE__, __LINE__, insn, s->pc - 4); \
33
+ __FILE__, __LINE__, insn, s->pc_curr); \
34
unallocated_encoding(s); \
35
} while (0)
36
37
diff --git a/target/arm/translate.h b/target/arm/translate.h
38
index XXXXXXX..XXXXXXX 100644
39
--- a/target/arm/translate.h
40
+++ b/target/arm/translate.h
41
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
42
const ARMISARegisters *isar;
43
44
target_ulong pc;
45
+ /* The address of the current instruction being translated. */
46
+ target_ulong pc_curr;
47
target_ulong page_start;
48
uint32_t insn;
49
/* Nonzero if this instruction has been conditionally skipped. */
50
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
51
index XXXXXXX..XXXXXXX 100644
52
--- a/target/arm/translate-a64.c
53
+++ b/target/arm/translate-a64.c
54
@@ -XXX,XX +XXX,XX @@ static inline AArch64DecodeFn *lookup_disas_fn(const AArch64DecodeTable *table,
55
*/
56
static void disas_uncond_b_imm(DisasContext *s, uint32_t insn)
57
{
58
- uint64_t addr = s->pc + sextract32(insn, 0, 26) * 4 - 4;
59
+ uint64_t addr = s->pc_curr + sextract32(insn, 0, 26) * 4;
60
61
if (insn & (1U << 31)) {
62
/* BL Branch with link */
63
@@ -XXX,XX +XXX,XX @@ static void disas_comp_b_imm(DisasContext *s, uint32_t insn)
64
sf = extract32(insn, 31, 1);
65
op = extract32(insn, 24, 1); /* 0: CBZ; 1: CBNZ */
66
rt = extract32(insn, 0, 5);
67
- addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
68
+ addr = s->pc_curr + sextract32(insn, 5, 19) * 4;
69
70
tcg_cmp = read_cpu_reg(s, rt, sf);
71
label_match = gen_new_label();
72
@@ -XXX,XX +XXX,XX @@ static void disas_test_b_imm(DisasContext *s, uint32_t insn)
73
74
bit_pos = (extract32(insn, 31, 1) << 5) | extract32(insn, 19, 5);
75
op = extract32(insn, 24, 1); /* 0: TBZ; 1: TBNZ */
76
- addr = s->pc + sextract32(insn, 5, 14) * 4 - 4;
77
+ addr = s->pc_curr + sextract32(insn, 5, 14) * 4;
78
rt = extract32(insn, 0, 5);
79
80
tcg_cmp = tcg_temp_new_i64();
81
@@ -XXX,XX +XXX,XX @@ static void disas_cond_b_imm(DisasContext *s, uint32_t insn)
82
unallocated_encoding(s);
83
return;
84
}
85
- addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
86
+ addr = s->pc_curr + sextract32(insn, 5, 19) * 4;
87
cond = extract32(insn, 0, 4);
88
89
reset_btype(s);
90
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
91
TCGv_i32 tcg_syn, tcg_isread;
92
uint32_t syndrome;
93
94
- gen_a64_set_pc_im(s->pc - 4);
95
+ gen_a64_set_pc_im(s->pc_curr);
96
tmpptr = tcg_const_ptr(ri);
97
syndrome = syn_aa64_sysregtrap(op0, op1, op2, crn, crm, rt, isread);
98
tcg_syn = tcg_const_i32(syndrome);
99
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
100
/* The pre HVC helper handles cases when HVC gets trapped
101
* as an undefined insn by runtime configuration.
102
*/
103
- gen_a64_set_pc_im(s->pc - 4);
104
+ gen_a64_set_pc_im(s->pc_curr);
105
gen_helper_pre_hvc(cpu_env);
106
gen_ss_advance(s);
107
gen_exception_insn(s, 0, EXCP_HVC, syn_aa64_hvc(imm16), 2);
108
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
109
unallocated_encoding(s);
110
break;
111
}
112
- gen_a64_set_pc_im(s->pc - 4);
113
+ gen_a64_set_pc_im(s->pc_curr);
114
tmp = tcg_const_i32(syn_aa64_smc(imm16));
115
gen_helper_pre_smc(cpu_env, tmp);
116
tcg_temp_free_i32(tmp);
117
@@ -XXX,XX +XXX,XX @@ static void disas_ld_lit(DisasContext *s, uint32_t insn)
118
119
tcg_rt = cpu_reg(s, rt);
120
121
- clean_addr = tcg_const_i64((s->pc - 4) + imm);
122
+ clean_addr = tcg_const_i64(s->pc_curr + imm);
123
if (is_vector) {
124
do_fp_ld(s, rt, clean_addr, size);
125
} else {
126
@@ -XXX,XX +XXX,XX @@ static void disas_pc_rel_adr(DisasContext *s, uint32_t insn)
127
offset = sextract64(insn, 5, 19);
128
offset = offset << 2 | extract32(insn, 29, 2);
129
rd = extract32(insn, 0, 5);
130
- base = s->pc - 4;
131
+ base = s->pc_curr;
132
133
if (page) {
134
/* ADRP (page based) */
135
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
136
break;
137
default:
138
fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
139
- __func__, insn, fpopcode, s->pc);
140
+ __func__, insn, fpopcode, s->pc_curr);
141
g_assert_not_reached();
142
}
143
144
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
145
{
146
uint32_t insn;
147
148
+ s->pc_curr = s->pc;
149
insn = arm_ldl_code(env, s->pc, s->sctlr_b);
150
s->insn = insn;
151
s->pc += 4;
152
diff --git a/target/arm/translate.c b/target/arm/translate.c
153
index XXXXXXX..XXXXXXX 100644
154
--- a/target/arm/translate.c
155
+++ b/target/arm/translate.c
156
@@ -XXX,XX +XXX,XX @@ static inline void gen_hvc(DisasContext *s, int imm16)
157
* as an undefined insn by runtime configuration (ie before
158
* the insn really executes).
159
*/
160
- gen_set_pc_im(s, s->pc - 4);
161
+ gen_set_pc_im(s, s->pc_curr);
162
gen_helper_pre_hvc(cpu_env);
163
/* Otherwise we will treat this as a real exception which
164
* happens after execution of the insn. (The distinction matters
165
@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
166
*/
167
TCGv_i32 tmp;
168
169
- gen_set_pc_im(s, s->pc - 4);
170
+ gen_set_pc_im(s, s->pc_curr);
171
tmp = tcg_const_i32(syn_aa32_smc());
172
gen_helper_pre_smc(cpu_env, tmp);
173
tcg_temp_free_i32(tmp);
174
@@ -XXX,XX +XXX,XX @@ static void gen_msr_banked(DisasContext *s, int r, int sysm, int rn)
175
176
/* Sync state because msr_banked() can raise exceptions */
177
gen_set_condexec(s);
178
- gen_set_pc_im(s, s->pc - 4);
179
+ gen_set_pc_im(s, s->pc_curr);
180
tcg_reg = load_reg(s, rn);
181
tcg_tgtmode = tcg_const_i32(tgtmode);
182
tcg_regno = tcg_const_i32(regno);
183
@@ -XXX,XX +XXX,XX @@ static void gen_mrs_banked(DisasContext *s, int r, int sysm, int rn)
184
185
/* Sync state because mrs_banked() can raise exceptions */
186
gen_set_condexec(s);
187
- gen_set_pc_im(s, s->pc - 4);
188
+ gen_set_pc_im(s, s->pc_curr);
189
tcg_reg = tcg_temp_new_i32();
190
tcg_tgtmode = tcg_const_i32(tgtmode);
191
tcg_regno = tcg_const_i32(regno);
192
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
193
}
194
195
gen_set_condexec(s);
196
- gen_set_pc_im(s, s->pc - 4);
197
+ gen_set_pc_im(s, s->pc_curr);
198
tmpptr = tcg_const_ptr(ri);
199
tcg_syn = tcg_const_i32(syndrome);
200
tcg_isread = tcg_const_i32(isread);
201
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
202
tmp = tcg_const_i32(mode);
203
/* get_r13_banked() will raise an exception if called from System mode */
204
gen_set_condexec(s);
205
- gen_set_pc_im(s, s->pc - 4);
206
+ gen_set_pc_im(s, s->pc_curr);
207
gen_helper_get_r13_banked(addr, cpu_env, tmp);
208
tcg_temp_free_i32(tmp);
209
switch (amode) {
210
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
211
return;
212
}
213
214
+ dc->pc_curr = dc->pc;
215
insn = arm_ldl_code(env, dc->pc, dc->sctlr_b);
216
dc->insn = insn;
217
dc->pc += 4;
218
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
219
return;
220
}
221
222
+ dc->pc_curr = dc->pc;
223
insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
224
is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
225
dc->pc += 2;
226
--
227
2.20.1
228
229
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 08/29] target/arm: Introduce read_pc
1
1
From: Richard Henderson <richard.henderson@linaro.org>
2
3
We currently have 3 different ways of computing the architectural
4
value of "PC" as seen in the ARM ARM.
5
6
The value of s->pc has been incremented past the current insn,
7
but that is all. Thus for a32, PC = s->pc + 4; for t32, PC = s->pc;
8
for t16, PC = s->pc + 2. These differing computations make it
9
impossible at present to unify the various code paths.
10
11
With the newly introduced s->pc_curr, we can compute the correct
12
value for all cases, using the formula given in the ARM ARM.
13
14
This changes the behaviour for load_reg() and load_reg_var()
15
when called with reg==15 from a 32-bit Thumb instruction:
16
previously they would have returned the incorrect value
17
of pc_curr + 6, and now they will return the architecturally
18
correct value of PC, which is pc_curr + 4. This will not
19
affect well-behaved guest software, because all of the places
20
we call these functions from T32 code are instructions where
21
using r15 is UNPREDICTABLE. Using the architectural PC value
22
here is more consistent with the T16 and A32 behaviour.
23
24
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
25
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
26
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
27
Message-id: 20190807045335.1361-4-richard.henderson@linaro.org
28
[PMM: added commit message note about UNPREDICTABLE T32 cases]
29
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
30
---
31
target/arm/translate.c | 59 ++++++++++++++++--------------------------
32
1 file changed, 23 insertions(+), 36 deletions(-)
33
34
diff --git a/target/arm/translate.c b/target/arm/translate.c
35
index XXXXXXX..XXXXXXX 100644
36
--- a/target/arm/translate.c
37
+++ b/target/arm/translate.c
38
@@ -XXX,XX +XXX,XX @@ static inline void store_cpu_offset(TCGv_i32 var, int offset)
39
#define store_cpu_field(var, name) \
40
store_cpu_offset(var, offsetof(CPUARMState, name))
41
42
+/* The architectural value of PC. */
43
+static uint32_t read_pc(DisasContext *s)
44
+{
45
+ return s->pc_curr + (s->thumb ? 4 : 8);
46
+}
47
+
48
/* Set a variable to the value of a CPU register. */
49
static void load_reg_var(DisasContext *s, TCGv_i32 var, int reg)
50
{
51
if (reg == 15) {
52
- uint32_t addr;
53
- /* normally, since we updated PC, we need only to add one insn */
54
- if (s->thumb)
55
- addr = (long)s->pc + 2;
56
- else
57
- addr = (long)s->pc + 4;
58
- tcg_gen_movi_i32(var, addr);
59
+ tcg_gen_movi_i32(var, read_pc(s));
60
} else {
61
tcg_gen_mov_i32(var, cpu_R[reg]);
62
}
63
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
64
/* branch link and change to thumb (blx <offset>) */
65
int32_t offset;
66
67
- val = (uint32_t)s->pc;
68
tmp = tcg_temp_new_i32();
69
- tcg_gen_movi_i32(tmp, val);
70
+ tcg_gen_movi_i32(tmp, s->pc);
71
store_reg(s, 14, tmp);
72
/* Sign-extend the 24-bit offset */
73
offset = (((int32_t)insn) << 8) >> 8;
74
+ val = read_pc(s);
75
/* offset * 4 + bit24 * 2 + (thumb bit) */
76
val += (offset << 2) | ((insn >> 23) & 2) | 1;
77
- /* pipeline offset */
78
- val += 4;
79
/* protected by ARCH(5); above, near the start of uncond block */
80
gen_bx_im(s, val);
81
return;
82
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
83
} else {
84
/* store */
85
if (i == 15) {
86
- /* special case: r15 = PC + 8 */
87
- val = (long)s->pc + 4;
88
tmp = tcg_temp_new_i32();
89
- tcg_gen_movi_i32(tmp, val);
90
+ tcg_gen_movi_i32(tmp, read_pc(s));
91
} else if (user) {
92
tmp = tcg_temp_new_i32();
93
tmp2 = tcg_const_i32(i);
94
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
95
int32_t offset;
96
97
/* branch (and link) */
98
- val = (int32_t)s->pc;
99
if (insn & (1 << 24)) {
100
tmp = tcg_temp_new_i32();
101
- tcg_gen_movi_i32(tmp, val);
102
+ tcg_gen_movi_i32(tmp, s->pc);
103
store_reg(s, 14, tmp);
104
}
105
offset = sextract32(insn << 2, 0, 26);
106
- val += offset + 4;
107
- gen_jmp(s, val);
108
+ gen_jmp(s, read_pc(s) + offset);
109
}
110
break;
111
case 0xc:
112
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
113
tcg_temp_free_i32(addr);
114
} else if ((insn & (7 << 5)) == 0) {
115
/* Table Branch. */
116
- if (rn == 15) {
117
- addr = tcg_temp_new_i32();
118
- tcg_gen_movi_i32(addr, s->pc);
119
- } else {
120
- addr = load_reg(s, rn);
121
- }
122
+ addr = load_reg(s, rn);
123
tmp = load_reg(s, rm);
124
tcg_gen_add_i32(addr, addr, tmp);
125
if (insn & (1 << 4)) {
126
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
127
}
128
tcg_temp_free_i32(addr);
129
tcg_gen_shli_i32(tmp, tmp, 1);
130
- tcg_gen_addi_i32(tmp, tmp, s->pc);
131
+ tcg_gen_addi_i32(tmp, tmp, read_pc(s));
132
store_reg(s, 15, tmp);
133
} else {
134
bool is_lasr = false;
135
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
136
tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
137
}
138
139
- offset += s->pc;
140
+ offset += read_pc(s);
141
if (insn & (1 << 12)) {
142
/* b/bl */
143
gen_jmp(s, offset);
144
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
145
offset |= (insn & (1 << 11)) << 8;
146
147
/* jump to the offset */
148
- gen_jmp(s, s->pc + offset);
149
+ gen_jmp(s, read_pc(s) + offset);
150
}
151
} else {
152
/*
153
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
154
if (insn & (1 << 11)) {
155
rd = (insn >> 8) & 7;
156
/* load pc-relative. Bit 1 of PC is ignored. */
157
- val = s->pc + 2 + ((insn & 0xff) * 4);
158
+ val = read_pc(s) + ((insn & 0xff) * 4);
159
val &= ~(uint32_t)2;
160
addr = tcg_temp_new_i32();
161
tcg_gen_movi_i32(addr, val);
162
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
163
} else {
164
/* PC. bit 1 is ignored. */
165
tmp = tcg_temp_new_i32();
166
- tcg_gen_movi_i32(tmp, (s->pc + 2) & ~(uint32_t)2);
167
+ tcg_gen_movi_i32(tmp, read_pc(s) & ~(uint32_t)2);
168
}
169
val = (insn & 0xff) * 4;
170
tcg_gen_addi_i32(tmp, tmp, val);
171
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
172
tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, s->condlabel);
173
tcg_temp_free_i32(tmp);
174
offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3;
175
- val = (uint32_t)s->pc + 2;
176
- val += offset;
177
- gen_jmp(s, val);
178
+ gen_jmp(s, read_pc(s) + offset);
179
break;
180
181
case 15: /* IT, nop-hint. */
182
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
183
arm_skip_unless(s, cond);
184
185
/* jump to the offset */
186
- val = (uint32_t)s->pc + 2;
187
+ val = read_pc(s);
188
offset = ((int32_t)insn << 24) >> 24;
189
val += offset << 1;
190
gen_jmp(s, val);
191
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
192
break;
193
}
194
/* unconditional branch */
195
- val = (uint32_t)s->pc;
196
+ val = read_pc(s);
197
offset = ((int32_t)insn << 21) >> 21;
198
- val += (offset << 1) + 2;
199
+ val += offset << 1;
200
gen_jmp(s, val);
201
break;
202
203
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
204
/* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix */
205
uint32_t uoffset = ((int32_t)insn << 21) >> 9;
206
207
- tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + uoffset);
208
+ tcg_gen_movi_i32(cpu_R[14], read_pc(s) + uoffset);
209
}
210
break;
211
}
212
--
213
2.20.1
214
215
diff view generated by jsdifflib
[Qemu-devel] [PULL 07/10] hw/arm/virt: Fix non-secure flash mode
[Qemu-devel] [PULL 09/29] target/arm: Introduce add_reg_for_lit
1
From: David Engraf <david.engraf@sysgo.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
Using the whole 128 MiB flash in non-secure mode is not working because
3
Provide a common routine for the places that require ALIGN(PC, 4)
4
virt_flash_fdt() expects the same address for secure_sysmem and sysmem.
4
as the base address as opposed to plain PC. The two are always
5
This is not correctly handled by caller because it forwards NULL for
5
the same for A32, but the difference is meaningful for thumb mode.
6
secure_sysmem in non-secure flash mode.
6
7
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Fixed by using sysmem when secure_sysmem is NULL.
9
10
Signed-off-by: David Engraf <david.engraf@sysgo.com>
11
Message-id: 20190712075002.14326-1-david.engraf@sysgo.com
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
10
Message-id: 20190807045335.1361-5-richard.henderson@linaro.org
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
---
12
---
15
hw/arm/virt.c | 2 +-
13
target/arm/translate-vfp.inc.c | 38 ++------
16
1 file changed, 1 insertion(+), 1 deletion(-)
14
target/arm/translate.c | 166 +++++++++++++++------------------
17
15
2 files changed, 82 insertions(+), 122 deletions(-)
18
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
16
17
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
19
index XXXXXXX..XXXXXXX 100644
18
index XXXXXXX..XXXXXXX 100644
20
--- a/hw/arm/virt.c
19
--- a/target/arm/translate-vfp.inc.c
21
+++ b/hw/arm/virt.c
20
+++ b/target/arm/translate-vfp.inc.c
22
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
21
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
23
&machine->device_memory->mr);
22
offset = -offset;
24
}
23
}
25
24
26
- virt_flash_fdt(vms, sysmem, secure_sysmem);
25
- if (s->thumb && a->rn == 15) {
27
+ virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
26
- /* This is actually UNPREDICTABLE */
28
27
- addr = tcg_temp_new_i32();
29
create_gic(vms, pic);
28
- tcg_gen_movi_i32(addr, s->pc & ~2);
29
- } else {
30
- addr = load_reg(s, a->rn);
31
- }
32
- tcg_gen_addi_i32(addr, addr, offset);
33
+ /* For thumb, use of PC is UNPREDICTABLE. */
34
+ addr = add_reg_for_lit(s, a->rn, offset);
35
tmp = tcg_temp_new_i32();
36
if (a->l) {
37
gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
38
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
39
offset = -offset;
40
}
41
42
- if (s->thumb && a->rn == 15) {
43
- /* This is actually UNPREDICTABLE */
44
- addr = tcg_temp_new_i32();
45
- tcg_gen_movi_i32(addr, s->pc & ~2);
46
- } else {
47
- addr = load_reg(s, a->rn);
48
- }
49
- tcg_gen_addi_i32(addr, addr, offset);
50
+ /* For thumb, use of PC is UNPREDICTABLE. */
51
+ addr = add_reg_for_lit(s, a->rn, offset);
52
tmp = tcg_temp_new_i64();
53
if (a->l) {
54
gen_aa32_ld64(s, tmp, addr, get_mem_index(s));
55
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_sp(DisasContext *s, arg_VLDM_VSTM_sp *a)
56
return true;
57
}
58
59
- if (s->thumb && a->rn == 15) {
60
- /* This is actually UNPREDICTABLE */
61
- addr = tcg_temp_new_i32();
62
- tcg_gen_movi_i32(addr, s->pc & ~2);
63
- } else {
64
- addr = load_reg(s, a->rn);
65
- }
66
+ /* For thumb, use of PC is UNPREDICTABLE. */
67
+ addr = add_reg_for_lit(s, a->rn, 0);
68
if (a->p) {
69
/* pre-decrement */
70
tcg_gen_addi_i32(addr, addr, -(a->imm << 2));
71
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_dp(DisasContext *s, arg_VLDM_VSTM_dp *a)
72
return true;
73
}
74
75
- if (s->thumb && a->rn == 15) {
76
- /* This is actually UNPREDICTABLE */
77
- addr = tcg_temp_new_i32();
78
- tcg_gen_movi_i32(addr, s->pc & ~2);
79
- } else {
80
- addr = load_reg(s, a->rn);
81
- }
82
+ /* For thumb, use of PC is UNPREDICTABLE. */
83
+ addr = add_reg_for_lit(s, a->rn, 0);
84
if (a->p) {
85
/* pre-decrement */
86
tcg_gen_addi_i32(addr, addr, -(a->imm << 2));
87
diff --git a/target/arm/translate.c b/target/arm/translate.c
88
index XXXXXXX..XXXXXXX 100644
89
--- a/target/arm/translate.c
90
+++ b/target/arm/translate.c
91
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 load_reg(DisasContext *s, int reg)
92
return tmp;
93
}
94
95
+/*
96
+ * Create a new temp, REG + OFS, except PC is ALIGN(PC, 4).
97
+ * This is used for load/store for which use of PC implies (literal),
98
+ * or ADD that implies ADR.
99
+ */
100
+static TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
101
+{
102
+ TCGv_i32 tmp = tcg_temp_new_i32();
103
+
104
+ if (reg == 15) {
105
+ tcg_gen_movi_i32(tmp, (read_pc(s) & ~3) + ofs);
106
+ } else {
107
+ tcg_gen_addi_i32(tmp, cpu_R[reg], ofs);
108
+ }
109
+ return tmp;
110
+}
111
+
112
/* Set a CPU register. The source must be a temporary and will be
113
marked as dead. */
114
static void store_reg(DisasContext *s, int reg, TCGv_i32 var)
115
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
116
*/
117
bool wback = extract32(insn, 21, 1);
118
119
- if (rn == 15) {
120
- if (insn & (1 << 21)) {
121
- /* UNPREDICTABLE */
122
- goto illegal_op;
123
- }
124
- addr = tcg_temp_new_i32();
125
- tcg_gen_movi_i32(addr, s->pc & ~3);
126
- } else {
127
- addr = load_reg(s, rn);
128
+ if (rn == 15 && (insn & (1 << 21))) {
129
+ /* UNPREDICTABLE */
130
+ goto illegal_op;
131
}
132
+
133
+ addr = add_reg_for_lit(s, rn, 0);
134
offset = (insn & 0xff) * 4;
135
if ((insn & (1 << 23)) == 0) {
136
offset = -offset;
137
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
138
store_reg(s, rd, tmp);
139
} else {
140
/* Add/sub 12-bit immediate. */
141
- if (rn == 15) {
142
- offset = s->pc & ~(uint32_t)3;
143
- if (insn & (1 << 23))
144
- offset -= imm;
145
- else
146
- offset += imm;
147
- tmp = tcg_temp_new_i32();
148
- tcg_gen_movi_i32(tmp, offset);
149
- store_reg(s, rd, tmp);
150
+ if (insn & (1 << 23)) {
151
+ imm = -imm;
152
+ }
153
+ tmp = add_reg_for_lit(s, rn, imm);
154
+ if (rn == 13 && rd == 13) {
155
+ /* ADD SP, SP, imm or SUB SP, SP, imm */
156
+ store_sp_checked(s, tmp);
157
} else {
158
- tmp = load_reg(s, rn);
159
- if (insn & (1 << 23))
160
- tcg_gen_subi_i32(tmp, tmp, imm);
161
- else
162
- tcg_gen_addi_i32(tmp, tmp, imm);
163
- if (rn == 13 && rd == 13) {
164
- /* ADD SP, SP, imm or SUB SP, SP, imm */
165
- store_sp_checked(s, tmp);
166
- } else {
167
- store_reg(s, rd, tmp);
168
- }
169
+ store_reg(s, rd, tmp);
170
}
171
}
172
}
173
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
174
}
175
}
176
memidx = get_mem_index(s);
177
- if (rn == 15) {
178
- addr = tcg_temp_new_i32();
179
- /* PC relative. */
180
- /* s->pc has already been incremented by 4. */
181
- imm = s->pc & 0xfffffffc;
182
- if (insn & (1 << 23))
183
- imm += insn & 0xfff;
184
- else
185
- imm -= insn & 0xfff;
186
- tcg_gen_movi_i32(addr, imm);
187
+ imm = insn & 0xfff;
188
+ if (insn & (1 << 23)) {
189
+ /* PC relative or Positive offset. */
190
+ addr = add_reg_for_lit(s, rn, imm);
191
+ } else if (rn == 15) {
192
+ /* PC relative with negative offset. */
193
+ addr = add_reg_for_lit(s, rn, -imm);
194
} else {
195
addr = load_reg(s, rn);
196
- if (insn & (1 << 23)) {
197
- /* Positive offset. */
198
- imm = insn & 0xfff;
199
- tcg_gen_addi_i32(addr, addr, imm);
200
- } else {
201
- imm = insn & 0xff;
202
- switch ((insn >> 8) & 0xf) {
203
- case 0x0: /* Shifted Register. */
204
- shift = (insn >> 4) & 0xf;
205
- if (shift > 3) {
206
- tcg_temp_free_i32(addr);
207
- goto illegal_op;
208
- }
209
- tmp = load_reg(s, rm);
210
- if (shift)
211
- tcg_gen_shli_i32(tmp, tmp, shift);
212
- tcg_gen_add_i32(addr, addr, tmp);
213
- tcg_temp_free_i32(tmp);
214
- break;
215
- case 0xc: /* Negative offset. */
216
- tcg_gen_addi_i32(addr, addr, -imm);
217
- break;
218
- case 0xe: /* User privilege. */
219
- tcg_gen_addi_i32(addr, addr, imm);
220
- memidx = get_a32_user_mem_index(s);
221
- break;
222
- case 0x9: /* Post-decrement. */
223
- imm = -imm;
224
- /* Fall through. */
225
- case 0xb: /* Post-increment. */
226
- postinc = 1;
227
- writeback = 1;
228
- break;
229
- case 0xd: /* Pre-decrement. */
230
- imm = -imm;
231
- /* Fall through. */
232
- case 0xf: /* Pre-increment. */
233
- writeback = 1;
234
- break;
235
- default:
236
+ imm = insn & 0xff;
237
+ switch ((insn >> 8) & 0xf) {
238
+ case 0x0: /* Shifted Register. */
239
+ shift = (insn >> 4) & 0xf;
240
+ if (shift > 3) {
241
tcg_temp_free_i32(addr);
242
goto illegal_op;
243
}
244
+ tmp = load_reg(s, rm);
245
+ if (shift) {
246
+ tcg_gen_shli_i32(tmp, tmp, shift);
247
+ }
248
+ tcg_gen_add_i32(addr, addr, tmp);
249
+ tcg_temp_free_i32(tmp);
250
+ break;
251
+ case 0xc: /* Negative offset. */
252
+ tcg_gen_addi_i32(addr, addr, -imm);
253
+ break;
254
+ case 0xe: /* User privilege. */
255
+ tcg_gen_addi_i32(addr, addr, imm);
256
+ memidx = get_a32_user_mem_index(s);
257
+ break;
258
+ case 0x9: /* Post-decrement. */
259
+ imm = -imm;
260
+ /* Fall through. */
261
+ case 0xb: /* Post-increment. */
262
+ postinc = 1;
263
+ writeback = 1;
264
+ break;
265
+ case 0xd: /* Pre-decrement. */
266
+ imm = -imm;
267
+ /* Fall through. */
268
+ case 0xf: /* Pre-increment. */
269
+ writeback = 1;
270
+ break;
271
+ default:
272
+ tcg_temp_free_i32(addr);
273
+ goto illegal_op;
274
}
275
}
276
277
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
278
if (insn & (1 << 11)) {
279
rd = (insn >> 8) & 7;
280
/* load pc-relative. Bit 1 of PC is ignored. */
281
- val = read_pc(s) + ((insn & 0xff) * 4);
282
- val &= ~(uint32_t)2;
283
- addr = tcg_temp_new_i32();
284
- tcg_gen_movi_i32(addr, val);
285
+ addr = add_reg_for_lit(s, 15, (insn & 0xff) * 4);
286
tmp = tcg_temp_new_i32();
287
gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s),
288
rd | ISSIs16Bit);
289
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
290
* - Add PC/SP (immediate)
291
*/
292
rd = (insn >> 8) & 7;
293
- if (insn & (1 << 11)) {
294
- /* SP */
295
- tmp = load_reg(s, 13);
296
- } else {
297
- /* PC. bit 1 is ignored. */
298
- tmp = tcg_temp_new_i32();
299
- tcg_gen_movi_i32(tmp, read_pc(s) & ~(uint32_t)2);
300
- }
301
val = (insn & 0xff) * 4;
302
- tcg_gen_addi_i32(tmp, tmp, val);
303
+ tmp = add_reg_for_lit(s, insn & (1 << 11) ? 13 : 15, val);
304
store_reg(s, rd, tmp);
305
break;
30
306
31
--
307
--
32
2.20.1
308
2.20.1
33
309
34
310
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 10/29] target/arm: Remove redundant s->pc & ~1
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
The thumb bit has already been removed from s->pc, and is always even.
4
5
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
8
Message-id: 20190807045335.1361-6-richard.henderson@linaro.org
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/translate.c | 10 +++++-----
12
1 file changed, 5 insertions(+), 5 deletions(-)
13
14
diff --git a/target/arm/translate.c b/target/arm/translate.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/translate.c
17
+++ b/target/arm/translate.c
18
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
19
/* Force a TB lookup after an instruction that changes the CPU state. */
20
static inline void gen_lookup_tb(DisasContext *s)
21
{
22
- tcg_gen_movi_i32(cpu_R[15], s->pc & ~1);
23
+ tcg_gen_movi_i32(cpu_R[15], s->pc);
24
s->base.is_jmp = DISAS_EXIT;
25
}
26
27
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
28
* self-modifying code correctly and also to take
29
* any pending interrupts immediately.
30
*/
31
- gen_goto_tb(s, 0, s->pc & ~1);
32
+ gen_goto_tb(s, 0, s->pc);
33
return;
34
case 7: /* sb */
35
if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
36
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
37
* for TCG; MB and end the TB instead.
38
*/
39
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
40
- gen_goto_tb(s, 0, s->pc & ~1);
41
+ gen_goto_tb(s, 0, s->pc);
42
return;
43
default:
44
goto illegal_op;
45
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
46
* and also to take any pending interrupts
47
* immediately.
48
*/
49
- gen_goto_tb(s, 0, s->pc & ~1);
50
+ gen_goto_tb(s, 0, s->pc);
51
break;
52
case 7: /* sb */
53
if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
54
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
55
* for TCG; MB and end the TB instead.
56
*/
57
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
58
- gen_goto_tb(s, 0, s->pc & ~1);
59
+ gen_goto_tb(s, 0, s->pc);
60
break;
61
default:
62
goto illegal_op;
63
--
64
2.20.1
65
66
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 11/29] target/arm: Replace s->pc with s->base.pc_next
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
We must update s->base.pc_next when we return from the translate_insn
4
hook to the main translator loop. By incrementing s->base.pc_next
5
immediately after reading the insn word, "pc_next" contains the address
6
of the next instruction throughout translation.
7
8
All remaining uses of s->pc are referencing the address of the next insn,
9
so this is now a simple global replacement. Remove the "s->pc" field.
10
11
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
13
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
14
Message-id: 20190807045335.1361-7-richard.henderson@linaro.org
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
---
17
target/arm/translate.h | 1 -
18
target/arm/translate-a64.c | 51 +++++++++---------
19
target/arm/translate.c | 103 ++++++++++++++++++-------------------
20
3 files changed, 72 insertions(+), 83 deletions(-)
21
22
diff --git a/target/arm/translate.h b/target/arm/translate.h
23
index XXXXXXX..XXXXXXX 100644
24
--- a/target/arm/translate.h
25
+++ b/target/arm/translate.h
26
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
27
DisasContextBase base;
28
const ARMISARegisters *isar;
29
30
- target_ulong pc;
31
/* The address of the current instruction being translated. */
32
target_ulong pc_curr;
33
target_ulong page_start;
34
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
35
index XXXXXXX..XXXXXXX 100644
36
--- a/target/arm/translate-a64.c
37
+++ b/target/arm/translate-a64.c
38
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
39
40
static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
41
{
42
- gen_a64_set_pc_im(s->pc - offset);
43
+ gen_a64_set_pc_im(s->base.pc_next - offset);
44
gen_exception_internal(excp);
45
s->base.is_jmp = DISAS_NORETURN;
46
}
47
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
48
static void gen_exception_insn(DisasContext *s, int offset, int excp,
49
uint32_t syndrome, uint32_t target_el)
50
{
51
- gen_a64_set_pc_im(s->pc - offset);
52
+ gen_a64_set_pc_im(s->base.pc_next - offset);
53
gen_exception(excp, syndrome, target_el);
54
s->base.is_jmp = DISAS_NORETURN;
55
}
56
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset,
57
{
58
TCGv_i32 tcg_syn;
59
60
- gen_a64_set_pc_im(s->pc - offset);
61
+ gen_a64_set_pc_im(s->base.pc_next - offset);
62
tcg_syn = tcg_const_i32(syndrome);
63
gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
64
tcg_temp_free_i32(tcg_syn);
65
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_imm(DisasContext *s, uint32_t insn)
66
67
if (insn & (1U << 31)) {
68
/* BL Branch with link */
69
- tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
70
+ tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
71
}
72
73
/* B Branch / BL Branch with link */
74
@@ -XXX,XX +XXX,XX @@ static void disas_comp_b_imm(DisasContext *s, uint32_t insn)
75
tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
76
tcg_cmp, 0, label_match);
77
78
- gen_goto_tb(s, 0, s->pc);
79
+ gen_goto_tb(s, 0, s->base.pc_next);
80
gen_set_label(label_match);
81
gen_goto_tb(s, 1, addr);
82
}
83
@@ -XXX,XX +XXX,XX @@ static void disas_test_b_imm(DisasContext *s, uint32_t insn)
84
tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
85
tcg_cmp, 0, label_match);
86
tcg_temp_free_i64(tcg_cmp);
87
- gen_goto_tb(s, 0, s->pc);
88
+ gen_goto_tb(s, 0, s->base.pc_next);
89
gen_set_label(label_match);
90
gen_goto_tb(s, 1, addr);
91
}
92
@@ -XXX,XX +XXX,XX @@ static void disas_cond_b_imm(DisasContext *s, uint32_t insn)
93
/* genuinely conditional branches */
94
TCGLabel *label_match = gen_new_label();
95
arm_gen_test_cc(cond, label_match);
96
- gen_goto_tb(s, 0, s->pc);
97
+ gen_goto_tb(s, 0, s->base.pc_next);
98
gen_set_label(label_match);
99
gen_goto_tb(s, 1, addr);
100
} else {
101
@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
102
* any pending interrupts immediately.
103
*/
104
reset_btype(s);
105
- gen_goto_tb(s, 0, s->pc);
106
+ gen_goto_tb(s, 0, s->base.pc_next);
107
return;
108
109
case 7: /* SB */
110
@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
111
* MB and end the TB instead.
112
*/
113
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
114
- gen_goto_tb(s, 0, s->pc);
115
+ gen_goto_tb(s, 0, s->base.pc_next);
116
return;
117
118
default:
119
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
120
gen_a64_set_pc(s, dst);
121
/* BLR also needs to load return address */
122
if (opc == 1) {
123
- tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
124
+ tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
125
}
126
break;
127
128
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
129
gen_a64_set_pc(s, dst);
130
/* BLRAA also needs to load return address */
131
if (opc == 9) {
132
- tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
133
+ tcg_gen_movi_i64(cpu_reg(s, 30), s->base.pc_next);
134
}
135
break;
136
137
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
138
{
139
uint32_t insn;
140
141
- s->pc_curr = s->pc;
142
- insn = arm_ldl_code(env, s->pc, s->sctlr_b);
143
+ s->pc_curr = s->base.pc_next;
144
+ insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
145
s->insn = insn;
146
- s->pc += 4;
147
+ s->base.pc_next += 4;
148
149
s->fp_access_checked = false;
150
151
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
152
int bound, core_mmu_idx;
153
154
dc->isar = &arm_cpu->isar;
155
- dc->pc = dc->base.pc_first;
156
dc->condjmp = 0;
157
158
dc->aarch64 = 1;
159
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
160
{
161
DisasContext *dc = container_of(dcbase, DisasContext, base);
162
163
- tcg_gen_insn_start(dc->pc, 0, 0);
164
+ tcg_gen_insn_start(dc->base.pc_next, 0, 0);
165
dc->insn_start = tcg_last_op();
166
}
167
168
@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
169
DisasContext *dc = container_of(dcbase, DisasContext, base);
170
171
if (bp->flags & BP_CPU) {
172
- gen_a64_set_pc_im(dc->pc);
173
+ gen_a64_set_pc_im(dc->base.pc_next);
174
gen_helper_check_breakpoints(cpu_env);
175
/* End the TB early; it likely won't be executed */
176
dc->base.is_jmp = DISAS_TOO_MANY;
177
@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
178
to for it to be properly cleared -- thus we
179
increment the PC here so that the logic setting
180
tb->size below does the right thing. */
181
- dc->pc += 4;
182
+ dc->base.pc_next += 4;
183
dc->base.is_jmp = DISAS_NORETURN;
184
}
185
186
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
187
disas_a64_insn(env, dc);
188
}
189
190
- dc->base.pc_next = dc->pc;
191
translator_loop_temp_check(&dc->base);
192
}
193
194
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
195
*/
196
switch (dc->base.is_jmp) {
197
default:
198
- gen_a64_set_pc_im(dc->pc);
199
+ gen_a64_set_pc_im(dc->base.pc_next);
200
/* fall through */
201
case DISAS_EXIT:
202
case DISAS_JUMP:
203
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
204
switch (dc->base.is_jmp) {
205
case DISAS_NEXT:
206
case DISAS_TOO_MANY:
207
- gen_goto_tb(dc, 1, dc->pc);
208
+ gen_goto_tb(dc, 1, dc->base.pc_next);
209
break;
210
default:
211
case DISAS_UPDATE:
212
- gen_a64_set_pc_im(dc->pc);
213
+ gen_a64_set_pc_im(dc->base.pc_next);
214
/* fall through */
215
case DISAS_EXIT:
216
tcg_gen_exit_tb(NULL, 0);
217
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
218
case DISAS_SWI:
219
break;
220
case DISAS_WFE:
221
- gen_a64_set_pc_im(dc->pc);
222
+ gen_a64_set_pc_im(dc->base.pc_next);
223
gen_helper_wfe(cpu_env);
224
break;
225
case DISAS_YIELD:
226
- gen_a64_set_pc_im(dc->pc);
227
+ gen_a64_set_pc_im(dc->base.pc_next);
228
gen_helper_yield(cpu_env);
229
break;
230
case DISAS_WFI:
231
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
232
*/
233
TCGv_i32 tmp = tcg_const_i32(4);
234
235
- gen_a64_set_pc_im(dc->pc);
236
+ gen_a64_set_pc_im(dc->base.pc_next);
237
gen_helper_wfi(cpu_env, tmp);
238
tcg_temp_free_i32(tmp);
239
/* The helper doesn't necessarily throw an exception, but we
240
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
241
}
242
}
243
}
244
-
245
- /* Functions above can change dc->pc, so re-align db->pc_next */
246
- dc->base.pc_next = dc->pc;
247
}
248
249
static void aarch64_tr_disas_log(const DisasContextBase *dcbase,
250
diff --git a/target/arm/translate.c b/target/arm/translate.c
251
index XXXXXXX..XXXXXXX 100644
252
--- a/target/arm/translate.c
253
+++ b/target/arm/translate.c
254
@@ -XXX,XX +XXX,XX @@ static inline void gen_blxns(DisasContext *s, int rm)
255
* We do however need to set the PC, because the blxns helper reads it.
256
* The blxns helper may throw an exception.
257
*/
258
- gen_set_pc_im(s, s->pc);
259
+ gen_set_pc_im(s, s->base.pc_next);
260
gen_helper_v7m_blxns(cpu_env, var);
261
tcg_temp_free_i32(var);
262
s->base.is_jmp = DISAS_EXIT;
263
@@ -XXX,XX +XXX,XX @@ static inline void gen_hvc(DisasContext *s, int imm16)
264
* for single stepping.)
265
*/
266
s->svc_imm = imm16;
267
- gen_set_pc_im(s, s->pc);
268
+ gen_set_pc_im(s, s->base.pc_next);
269
s->base.is_jmp = DISAS_HVC;
270
}
271
272
@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
273
tmp = tcg_const_i32(syn_aa32_smc());
274
gen_helper_pre_smc(cpu_env, tmp);
275
tcg_temp_free_i32(tmp);
276
- gen_set_pc_im(s, s->pc);
277
+ gen_set_pc_im(s, s->base.pc_next);
278
s->base.is_jmp = DISAS_SMC;
279
}
280
281
static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
282
{
283
gen_set_condexec(s);
284
- gen_set_pc_im(s, s->pc - offset);
285
+ gen_set_pc_im(s, s->base.pc_next - offset);
286
gen_exception_internal(excp);
287
s->base.is_jmp = DISAS_NORETURN;
288
}
289
@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn(DisasContext *s, int offset, int excp,
290
int syn, uint32_t target_el)
291
{
292
gen_set_condexec(s);
293
- gen_set_pc_im(s, s->pc - offset);
294
+ gen_set_pc_im(s, s->base.pc_next - offset);
295
gen_exception(excp, syn, target_el);
296
s->base.is_jmp = DISAS_NORETURN;
297
}
298
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
299
TCGv_i32 tcg_syn;
300
301
gen_set_condexec(s);
302
- gen_set_pc_im(s, s->pc - offset);
303
+ gen_set_pc_im(s, s->base.pc_next - offset);
304
tcg_syn = tcg_const_i32(syn);
305
gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
306
tcg_temp_free_i32(tcg_syn);
307
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
308
/* Force a TB lookup after an instruction that changes the CPU state. */
309
static inline void gen_lookup_tb(DisasContext *s)
310
{
311
- tcg_gen_movi_i32(cpu_R[15], s->pc);
312
+ tcg_gen_movi_i32(cpu_R[15], s->base.pc_next);
313
s->base.is_jmp = DISAS_EXIT;
314
}
315
316
@@ -XXX,XX +XXX,XX @@ static inline bool use_goto_tb(DisasContext *s, target_ulong dest)
317
{
318
#ifndef CONFIG_USER_ONLY
319
return (s->base.tb->pc & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK) ||
320
- ((s->pc - 1) & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
321
+ ((s->base.pc_next - 1) & TARGET_PAGE_MASK) == (dest & TARGET_PAGE_MASK);
322
#else
323
return true;
324
#endif
325
@@ -XXX,XX +XXX,XX @@ static void gen_nop_hint(DisasContext *s, int val)
326
*/
327
case 1: /* yield */
328
if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
329
- gen_set_pc_im(s, s->pc);
330
+ gen_set_pc_im(s, s->base.pc_next);
331
s->base.is_jmp = DISAS_YIELD;
332
}
333
break;
334
case 3: /* wfi */
335
- gen_set_pc_im(s, s->pc);
336
+ gen_set_pc_im(s, s->base.pc_next);
337
s->base.is_jmp = DISAS_WFI;
338
break;
339
case 2: /* wfe */
340
if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
341
- gen_set_pc_im(s, s->pc);
342
+ gen_set_pc_im(s, s->base.pc_next);
343
s->base.is_jmp = DISAS_WFE;
344
}
345
break;
346
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
347
if (isread) {
348
return 1;
349
}
350
- gen_set_pc_im(s, s->pc);
351
+ gen_set_pc_im(s, s->base.pc_next);
352
s->base.is_jmp = DISAS_WFI;
353
return 0;
354
default:
355
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
356
* self-modifying code correctly and also to take
357
* any pending interrupts immediately.
358
*/
359
- gen_goto_tb(s, 0, s->pc);
360
+ gen_goto_tb(s, 0, s->base.pc_next);
361
return;
362
case 7: /* sb */
363
if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
364
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
365
* for TCG; MB and end the TB instead.
366
*/
367
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
368
- gen_goto_tb(s, 0, s->pc);
369
+ gen_goto_tb(s, 0, s->base.pc_next);
370
return;
371
default:
372
goto illegal_op;
373
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
374
int32_t offset;
375
376
tmp = tcg_temp_new_i32();
377
- tcg_gen_movi_i32(tmp, s->pc);
378
+ tcg_gen_movi_i32(tmp, s->base.pc_next);
379
store_reg(s, 14, tmp);
380
/* Sign-extend the 24-bit offset */
381
offset = (((int32_t)insn) << 8) >> 8;
382
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
383
/* branch link/exchange thumb (blx) */
384
tmp = load_reg(s, rm);
385
tmp2 = tcg_temp_new_i32();
386
- tcg_gen_movi_i32(tmp2, s->pc);
387
+ tcg_gen_movi_i32(tmp2, s->base.pc_next);
388
store_reg(s, 14, tmp2);
389
gen_bx(s, tmp);
390
break;
391
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
392
/* branch (and link) */
393
if (insn & (1 << 24)) {
394
tmp = tcg_temp_new_i32();
395
- tcg_gen_movi_i32(tmp, s->pc);
396
+ tcg_gen_movi_i32(tmp, s->base.pc_next);
397
store_reg(s, 14, tmp);
398
}
399
offset = sextract32(insn << 2, 0, 26);
400
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
401
break;
402
case 0xf:
403
/* swi */
404
- gen_set_pc_im(s, s->pc);
405
+ gen_set_pc_im(s, s->base.pc_next);
406
s->svc_imm = extract32(insn, 0, 24);
407
s->base.is_jmp = DISAS_SWI;
408
break;
409
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
410
411
if (insn & (1 << 14)) {
412
/* Branch and link. */
413
- tcg_gen_movi_i32(cpu_R[14], s->pc | 1);
414
+ tcg_gen_movi_i32(cpu_R[14], s->base.pc_next | 1);
415
}
416
417
offset += read_pc(s);
418
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
419
* and also to take any pending interrupts
420
* immediately.
421
*/
422
- gen_goto_tb(s, 0, s->pc);
423
+ gen_goto_tb(s, 0, s->base.pc_next);
424
break;
425
case 7: /* sb */
426
if ((insn & 0xf) || !dc_isar_feature(aa32_sb, s)) {
427
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
428
* for TCG; MB and end the TB instead.
429
*/
430
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC);
431
- gen_goto_tb(s, 0, s->pc);
432
+ gen_goto_tb(s, 0, s->base.pc_next);
433
break;
434
default:
435
goto illegal_op;
436
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
437
/* BLX/BX */
438
tmp = load_reg(s, rm);
439
if (link) {
440
- val = (uint32_t)s->pc | 1;
441
+ val = (uint32_t)s->base.pc_next | 1;
442
tmp2 = tcg_temp_new_i32();
443
tcg_gen_movi_i32(tmp2, val);
444
store_reg(s, 14, tmp2);
445
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
446
447
if (cond == 0xf) {
448
/* swi */
449
- gen_set_pc_im(s, s->pc);
450
+ gen_set_pc_im(s, s->base.pc_next);
451
s->svc_imm = extract32(insn, 0, 8);
452
s->base.is_jmp = DISAS_SWI;
453
break;
454
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
455
tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
456
457
tmp2 = tcg_temp_new_i32();
458
- tcg_gen_movi_i32(tmp2, s->pc | 1);
459
+ tcg_gen_movi_i32(tmp2, s->base.pc_next | 1);
460
store_reg(s, 14, tmp2);
461
gen_bx(s, tmp);
462
break;
463
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
464
tcg_gen_addi_i32(tmp, tmp, offset);
465
466
tmp2 = tcg_temp_new_i32();
467
- tcg_gen_movi_i32(tmp2, s->pc | 1);
468
+ tcg_gen_movi_i32(tmp2, s->base.pc_next | 1);
469
store_reg(s, 14, tmp2);
470
gen_bx(s, tmp);
471
} else {
472
@@ -XXX,XX +XXX,XX @@ undef:
473
474
static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
475
{
476
- /* Return true if the insn at dc->pc might cross a page boundary.
477
+ /* Return true if the insn at dc->base.pc_next might cross a page boundary.
478
* (False positives are OK, false negatives are not.)
479
* We know this is a Thumb insn, and our caller ensures we are
480
- * only called if dc->pc is less than 4 bytes from the page
481
+ * only called if dc->base.pc_next is less than 4 bytes from the page
482
* boundary, so we cross the page if the first 16 bits indicate
483
* that this is a 32 bit insn.
484
*/
485
- uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
486
+ uint16_t insn = arm_lduw_code(env, s->base.pc_next, s->sctlr_b);
487
488
- return !thumb_insn_is_16bit(s, s->pc, insn);
489
+ return !thumb_insn_is_16bit(s, s->base.pc_next, insn);
490
}
491
492
static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
493
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
494
uint32_t condexec, core_mmu_idx;
495
496
dc->isar = &cpu->isar;
497
- dc->pc = dc->base.pc_first;
498
dc->condjmp = 0;
499
500
dc->aarch64 = 0;
501
@@ -XXX,XX +XXX,XX @@ static void arm_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
502
{
503
DisasContext *dc = container_of(dcbase, DisasContext, base);
504
505
- tcg_gen_insn_start(dc->pc,
506
+ tcg_gen_insn_start(dc->base.pc_next,
507
(dc->condexec_cond << 4) | (dc->condexec_mask >> 1),
508
0);
509
dc->insn_start = tcg_last_op();
510
@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
511
512
if (bp->flags & BP_CPU) {
513
gen_set_condexec(dc);
514
- gen_set_pc_im(dc, dc->pc);
515
+ gen_set_pc_im(dc, dc->base.pc_next);
516
gen_helper_check_breakpoints(cpu_env);
517
/* End the TB early; it's likely not going to be executed */
518
dc->base.is_jmp = DISAS_TOO_MANY;
519
@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
520
tb->size below does the right thing. */
521
/* TODO: Advance PC by correct instruction length to
522
* avoid disassembler error messages */
523
- dc->pc += 2;
524
+ dc->base.pc_next += 2;
525
dc->base.is_jmp = DISAS_NORETURN;
526
}
527
528
@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)
529
{
530
#ifdef CONFIG_USER_ONLY
531
/* Intercept jump to the magic kernel page. */
532
- if (dc->pc >= 0xffff0000) {
533
+ if (dc->base.pc_next >= 0xffff0000) {
534
/* We always get here via a jump, so know we are not in a
535
conditional execution block. */
536
gen_exception_internal(EXCP_KERNEL_TRAP);
537
@@ -XXX,XX +XXX,XX @@ static void arm_post_translate_insn(DisasContext *dc)
538
gen_set_label(dc->condlabel);
539
dc->condjmp = 0;
540
}
541
- dc->base.pc_next = dc->pc;
542
translator_loop_temp_check(&dc->base);
543
}
544
545
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
546
return;
547
}
548
549
- dc->pc_curr = dc->pc;
550
- insn = arm_ldl_code(env, dc->pc, dc->sctlr_b);
551
+ dc->pc_curr = dc->base.pc_next;
552
+ insn = arm_ldl_code(env, dc->base.pc_next, dc->sctlr_b);
553
dc->insn = insn;
554
- dc->pc += 4;
555
+ dc->base.pc_next += 4;
556
disas_arm_insn(dc, insn);
557
558
arm_post_translate_insn(dc);
559
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
560
return;
561
}
562
563
- dc->pc_curr = dc->pc;
564
- insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
565
- is_16bit = thumb_insn_is_16bit(dc, dc->pc, insn);
566
- dc->pc += 2;
567
+ dc->pc_curr = dc->base.pc_next;
568
+ insn = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
569
+ is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
570
+ dc->base.pc_next += 2;
571
if (!is_16bit) {
572
- uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
573
+ uint32_t insn2 = arm_lduw_code(env, dc->base.pc_next, dc->sctlr_b);
574
575
insn = insn << 16 | insn2;
576
- dc->pc += 2;
577
+ dc->base.pc_next += 2;
578
}
579
dc->insn = insn;
580
581
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
582
* but isn't very efficient).
583
*/
584
if (dc->base.is_jmp == DISAS_NEXT
585
- && (dc->pc - dc->page_start >= TARGET_PAGE_SIZE
586
- || (dc->pc - dc->page_start >= TARGET_PAGE_SIZE - 3
587
+ && (dc->base.pc_next - dc->page_start >= TARGET_PAGE_SIZE
588
+ || (dc->base.pc_next - dc->page_start >= TARGET_PAGE_SIZE - 3
589
&& insn_crosses_page(env, dc)))) {
590
dc->base.is_jmp = DISAS_TOO_MANY;
591
}
592
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
593
case DISAS_NEXT:
594
case DISAS_TOO_MANY:
595
case DISAS_UPDATE:
596
- gen_set_pc_im(dc, dc->pc);
597
+ gen_set_pc_im(dc, dc->base.pc_next);
598
/* fall through */
599
default:
600
/* FIXME: Single stepping a WFI insn will not halt the CPU. */
601
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
602
switch(dc->base.is_jmp) {
603
case DISAS_NEXT:
604
case DISAS_TOO_MANY:
605
- gen_goto_tb(dc, 1, dc->pc);
606
+ gen_goto_tb(dc, 1, dc->base.pc_next);
607
break;
608
case DISAS_JUMP:
609
gen_goto_ptr();
610
break;
611
case DISAS_UPDATE:
612
- gen_set_pc_im(dc, dc->pc);
613
+ gen_set_pc_im(dc, dc->base.pc_next);
614
/* fall through */
615
default:
616
/* indicate that the hash table must be used to find the next TB */
617
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
618
gen_set_label(dc->condlabel);
619
gen_set_condexec(dc);
620
if (unlikely(is_singlestepping(dc))) {
621
- gen_set_pc_im(dc, dc->pc);
622
+ gen_set_pc_im(dc, dc->base.pc_next);
623
gen_singlestep_exception(dc);
624
} else {
625
- gen_goto_tb(dc, 1, dc->pc);
626
+ gen_goto_tb(dc, 1, dc->base.pc_next);
627
}
628
}
629
-
630
- /* Functions above can change dc->pc, so re-align db->pc_next */
631
- dc->base.pc_next = dc->pc;
632
}
633
634
static void arm_tr_disas_log(const DisasContextBase *dcbase, CPUState *cpu)
635
--
636
2.20.1
637
638
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 12/29] target/arm: Replace offset with pc in gen_exception_insn
1
1
From: Richard Henderson <richard.henderson@linaro.org>
2
3
The offset is variable depending on the instruction set, whereas
4
we have stored values for the current pc and the next pc. Passing
5
in the actual value is clearer in intent.
6
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
10
Message-id: 20190807045335.1361-8-richard.henderson@linaro.org
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
13
target/arm/translate-a64.c | 25 ++++++++++++++-----------
14
target/arm/translate-vfp.inc.c | 6 +++---
15
target/arm/translate.c | 31 ++++++++++++++++---------------
16
3 files changed, 33 insertions(+), 29 deletions(-)
17
18
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
19
index XXXXXXX..XXXXXXX 100644
20
--- a/target/arm/translate-a64.c
21
+++ b/target/arm/translate-a64.c
22
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
23
s->base.is_jmp = DISAS_NORETURN;
24
}
25
26
-static void gen_exception_insn(DisasContext *s, int offset, int excp,
27
+static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
28
uint32_t syndrome, uint32_t target_el)
29
{
30
- gen_a64_set_pc_im(s->base.pc_next - offset);
31
+ gen_a64_set_pc_im(pc);
32
gen_exception(excp, syndrome, target_el);
33
s->base.is_jmp = DISAS_NORETURN;
34
}
35
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
36
void unallocated_encoding(DisasContext *s)
37
{
38
/* Unallocated and reserved encodings are uncategorized */
39
- gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
40
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
41
default_exception_el(s));
42
}
43
44
@@ -XXX,XX +XXX,XX @@ static inline bool fp_access_check(DisasContext *s)
45
return true;
46
}
47
48
- gen_exception_insn(s, 4, EXCP_UDEF, syn_fp_access_trap(1, 0xe, false),
49
- s->fp_excp_el);
50
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
51
+ syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);
52
return false;
53
}
54
55
@@ -XXX,XX +XXX,XX @@ static inline bool fp_access_check(DisasContext *s)
56
bool sve_access_check(DisasContext *s)
57
{
58
if (s->sve_excp_el) {
59
- gen_exception_insn(s, 4, EXCP_UDEF, syn_sve_access_trap(),
60
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_sve_access_trap(),
61
s->sve_excp_el);
62
return false;
63
}
64
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
65
switch (op2_ll) {
66
case 1: /* SVC */
67
gen_ss_advance(s);
68
- gen_exception_insn(s, 0, EXCP_SWI, syn_aa64_svc(imm16),
69
- default_exception_el(s));
70
+ gen_exception_insn(s, s->base.pc_next, EXCP_SWI,
71
+ syn_aa64_svc(imm16), default_exception_el(s));
72
break;
73
case 2: /* HVC */
74
if (s->current_el == 0) {
75
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
76
gen_a64_set_pc_im(s->pc_curr);
77
gen_helper_pre_hvc(cpu_env);
78
gen_ss_advance(s);
79
- gen_exception_insn(s, 0, EXCP_HVC, syn_aa64_hvc(imm16), 2);
80
+ gen_exception_insn(s, s->base.pc_next, EXCP_HVC,
81
+ syn_aa64_hvc(imm16), 2);
82
break;
83
case 3: /* SMC */
84
if (s->current_el == 0) {
85
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
86
gen_helper_pre_smc(cpu_env, tmp);
87
tcg_temp_free_i32(tmp);
88
gen_ss_advance(s);
89
- gen_exception_insn(s, 0, EXCP_SMC, syn_aa64_smc(imm16), 3);
90
+ gen_exception_insn(s, s->base.pc_next, EXCP_SMC,
91
+ syn_aa64_smc(imm16), 3);
92
break;
93
default:
94
unallocated_encoding(s);
95
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
96
if (s->btype != 0
97
&& s->guarded_page
98
&& !btype_destination_ok(insn, s->bt, s->btype)) {
99
- gen_exception_insn(s, 4, EXCP_UDEF, syn_btitrap(s->btype),
100
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
101
+ syn_btitrap(s->btype),
102
default_exception_el(s));
103
return;
104
}
105
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
106
index XXXXXXX..XXXXXXX 100644
107
--- a/target/arm/translate-vfp.inc.c
108
+++ b/target/arm/translate-vfp.inc.c
109
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
110
{
111
if (s->fp_excp_el) {
112
if (arm_dc_feature(s, ARM_FEATURE_M)) {
113
- gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
114
+ gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
115
s->fp_excp_el);
116
} else {
117
- gen_exception_insn(s, 4, EXCP_UDEF,
118
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
119
syn_fp_access_trap(1, 0xe, false),
120
s->fp_excp_el);
121
}
122
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
123
124
if (!s->vfp_enabled && !ignore_vfp_enabled) {
125
assert(!arm_dc_feature(s, ARM_FEATURE_M));
126
- gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
127
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
128
default_exception_el(s));
129
return false;
130
}
131
diff --git a/target/arm/translate.c b/target/arm/translate.c
132
index XXXXXXX..XXXXXXX 100644
133
--- a/target/arm/translate.c
134
+++ b/target/arm/translate.c
135
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
136
s->base.is_jmp = DISAS_NORETURN;
137
}
138
139
-static void gen_exception_insn(DisasContext *s, int offset, int excp,
140
+static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
141
int syn, uint32_t target_el)
142
{
143
gen_set_condexec(s);
144
- gen_set_pc_im(s, s->base.pc_next - offset);
145
+ gen_set_pc_im(s, pc);
146
gen_exception(excp, syn, target_el);
147
s->base.is_jmp = DISAS_NORETURN;
148
}
149
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
150
return;
151
}
152
153
- gen_exception_insn(s, s->thumb ? 2 : 4, EXCP_UDEF, syn_uncategorized(),
154
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
155
default_exception_el(s));
156
}
157
158
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
159
160
undef:
161
/* If we get here then some access check did not pass */
162
- gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), exc_target);
163
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
164
+ syn_uncategorized(), exc_target);
165
return false;
166
}
167
168
@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
169
* for attempts to execute invalid vfp/neon encodings with FP disabled.
170
*/
171
if (s->fp_excp_el) {
172
- gen_exception_insn(s, 4, EXCP_UDEF,
173
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
174
syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
175
return 0;
176
}
177
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
178
* for attempts to execute invalid vfp/neon encodings with FP disabled.
179
*/
180
if (s->fp_excp_el) {
181
- gen_exception_insn(s, 4, EXCP_UDEF,
182
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
183
syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
184
return 0;
185
}
186
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
187
}
188
189
if (s->fp_excp_el) {
190
- gen_exception_insn(s, 4, EXCP_UDEF,
191
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
192
syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
193
return 0;
194
}
195
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
196
off_rm = vfp_reg_offset(0, rm);
197
}
198
if (s->fp_excp_el) {
199
- gen_exception_insn(s, 4, EXCP_UDEF,
200
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
201
syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
202
return 0;
203
}
204
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
205
* For the UNPREDICTABLE cases we choose to UNDEF.
206
*/
207
if (s->current_el == 1 && !s->ns && mode == ARM_CPU_MODE_MON) {
208
- gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), 3);
209
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(), 3);
210
return;
211
}
212
213
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
214
}
215
216
if (undef) {
217
- gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
218
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
219
default_exception_el(s));
220
return;
221
}
222
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
223
* UsageFault exception.
224
*/
225
if (arm_dc_feature(s, ARM_FEATURE_M)) {
226
- gen_exception_insn(s, 4, EXCP_INVSTATE, syn_uncategorized(),
227
+ gen_exception_insn(s, s->pc_curr, EXCP_INVSTATE, syn_uncategorized(),
228
default_exception_el(s));
229
return;
230
}
231
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
232
break;
233
default:
234
illegal_op:
235
- gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
236
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
237
default_exception_el(s));
238
break;
239
}
240
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
241
}
242
243
/* All other insns: NOCP */
244
- gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
245
+ gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
246
default_exception_el(s));
247
break;
248
}
249
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
250
}
251
return;
252
illegal_op:
253
- gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
254
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
255
default_exception_el(s));
256
}
257
258
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
259
return;
260
illegal_op:
261
undef:
262
- gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized(),
263
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
264
default_exception_el(s));
265
}
266
267
--
268
2.20.1
269
270
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 13/29] target/arm: Replace offset with pc in gen_exception_internal_insn
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
The offset is variable depending on the instruction set.
4
Passing in the actual value is clearer in intent.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
9
Message-id: 20190807045335.1361-9-richard.henderson@linaro.org
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
target/arm/translate-a64.c | 8 ++++----
13
target/arm/translate.c | 8 ++++----
14
2 files changed, 8 insertions(+), 8 deletions(-)
15
16
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
17
index XXXXXXX..XXXXXXX 100644
18
--- a/target/arm/translate-a64.c
19
+++ b/target/arm/translate-a64.c
20
@@ -XXX,XX +XXX,XX @@ static void gen_exception_internal(int excp)
21
tcg_temp_free_i32(tcg_excp);
22
}
23
24
-static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
25
+static void gen_exception_internal_insn(DisasContext *s, uint64_t pc, int excp)
26
{
27
- gen_a64_set_pc_im(s->base.pc_next - offset);
28
+ gen_a64_set_pc_im(pc);
29
gen_exception_internal(excp);
30
s->base.is_jmp = DISAS_NORETURN;
31
}
32
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
33
break;
34
}
35
#endif
36
- gen_exception_internal_insn(s, 0, EXCP_SEMIHOST);
37
+ gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
38
} else {
39
unsupported_encoding(s, insn);
40
}
41
@@ -XXX,XX +XXX,XX @@ static bool aarch64_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
42
/* End the TB early; it likely won't be executed */
43
dc->base.is_jmp = DISAS_TOO_MANY;
44
} else {
45
- gen_exception_internal_insn(dc, 0, EXCP_DEBUG);
46
+ gen_exception_internal_insn(dc, dc->base.pc_next, EXCP_DEBUG);
47
/* The address covered by the breakpoint must be
48
included in [tb->pc, tb->pc + tb->size) in order
49
to for it to be properly cleared -- thus we
50
diff --git a/target/arm/translate.c b/target/arm/translate.c
51
index XXXXXXX..XXXXXXX 100644
52
--- a/target/arm/translate.c
53
+++ b/target/arm/translate.c
54
@@ -XXX,XX +XXX,XX @@ static inline void gen_smc(DisasContext *s)
55
s->base.is_jmp = DISAS_SMC;
56
}
57
58
-static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)
59
+static void gen_exception_internal_insn(DisasContext *s, uint32_t pc, int excp)
60
{
61
gen_set_condexec(s);
62
- gen_set_pc_im(s, s->base.pc_next - offset);
63
+ gen_set_pc_im(s, pc);
64
gen_exception_internal(excp);
65
s->base.is_jmp = DISAS_NORETURN;
66
}
67
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
68
s->current_el != 0 &&
69
#endif
70
(imm == (s->thumb ? 0x3c : 0xf000))) {
71
- gen_exception_internal_insn(s, 0, EXCP_SEMIHOST);
72
+ gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
73
return;
74
}
75
76
@@ -XXX,XX +XXX,XX @@ static bool arm_tr_breakpoint_check(DisasContextBase *dcbase, CPUState *cpu,
77
/* End the TB early; it's likely not going to be executed */
78
dc->base.is_jmp = DISAS_TOO_MANY;
79
} else {
80
- gen_exception_internal_insn(dc, 0, EXCP_DEBUG);
81
+ gen_exception_internal_insn(dc, dc->base.pc_next, EXCP_DEBUG);
82
/* The address covered by the breakpoint must be
83
included in [tb->pc, tb->pc + tb->size) in order
84
to for it to be properly cleared -- thus we
85
--
86
2.20.1
87
88
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 14/29] target/arm: Remove offset argument to gen_exception_bkpt_insn
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
Unlike the other more generic gen_exception{,_internal}_insn
4
interfaces, breakpoints always refer to the current instruction.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
9
Message-id: 20190807045335.1361-10-richard.henderson@linaro.org
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
target/arm/translate-a64.c | 7 +++----
13
target/arm/translate.c | 8 ++++----
14
2 files changed, 7 insertions(+), 8 deletions(-)
15
16
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
17
index XXXXXXX..XXXXXXX 100644
18
--- a/target/arm/translate-a64.c
19
+++ b/target/arm/translate-a64.c
20
@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn(DisasContext *s, uint64_t pc, int excp,
21
s->base.is_jmp = DISAS_NORETURN;
22
}
23
24
-static void gen_exception_bkpt_insn(DisasContext *s, int offset,
25
- uint32_t syndrome)
26
+static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syndrome)
27
{
28
TCGv_i32 tcg_syn;
29
30
- gen_a64_set_pc_im(s->base.pc_next - offset);
31
+ gen_a64_set_pc_im(s->pc_curr);
32
tcg_syn = tcg_const_i32(syndrome);
33
gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
34
tcg_temp_free_i32(tcg_syn);
35
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
36
break;
37
}
38
/* BRK */
39
- gen_exception_bkpt_insn(s, 4, syn_aa64_bkpt(imm16));
40
+ gen_exception_bkpt_insn(s, syn_aa64_bkpt(imm16));
41
break;
42
case 2:
43
if (op2_ll != 0) {
44
diff --git a/target/arm/translate.c b/target/arm/translate.c
45
index XXXXXXX..XXXXXXX 100644
46
--- a/target/arm/translate.c
47
+++ b/target/arm/translate.c
48
@@ -XXX,XX +XXX,XX @@ static void gen_exception_insn(DisasContext *s, uint32_t pc, int excp,
49
s->base.is_jmp = DISAS_NORETURN;
50
}
51
52
-static void gen_exception_bkpt_insn(DisasContext *s, int offset, uint32_t syn)
53
+static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
54
{
55
TCGv_i32 tcg_syn;
56
57
gen_set_condexec(s);
58
- gen_set_pc_im(s, s->base.pc_next - offset);
59
+ gen_set_pc_im(s, s->pc_curr);
60
tcg_syn = tcg_const_i32(syn);
61
gen_helper_exception_bkpt_insn(cpu_env, tcg_syn);
62
tcg_temp_free_i32(tcg_syn);
63
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
64
case 1:
65
/* bkpt */
66
ARCH(5);
67
- gen_exception_bkpt_insn(s, 4, syn_aa32_bkpt(imm16, false));
68
+ gen_exception_bkpt_insn(s, syn_aa32_bkpt(imm16, false));
69
break;
70
case 2:
71
/* Hypervisor call (v7) */
72
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
73
{
74
int imm8 = extract32(insn, 0, 8);
75
ARCH(5);
76
- gen_exception_bkpt_insn(s, 2, syn_aa32_bkpt(imm8, true));
77
+ gen_exception_bkpt_insn(s, syn_aa32_bkpt(imm8, true));
78
break;
79
}
80
81
--
82
2.20.1
83
84
diff view generated by jsdifflib
[Qemu-devel] [PULL 10/10] target/arm: NS BusFault on vector table fetch escalates to NS HardFault
[Qemu-devel] [PULL 15/29] target/arm: Use unallocated_encoding for aarch32
1
In the M-profile architecture, when we do a vector table fetch and it
1
From: Richard Henderson <richard.henderson@linaro.org>
2
fails, we need to report a HardFault. Whether this is a Secure HF or
3
a NonSecure HF depends on several things. If AIRCR.BFHFNMINS is 0
4
then HF is always Secure, because there is no NonSecure HardFault.
5
Otherwise, the answer depends on whether the 'underlying exception'
6
(MemManage, BusFault, SecureFault) targets Secure or NonSecure. (In
7
the pseudocode, this is handled in the Vector() function: the final
8
exc.isSecure is calculated by looking at the exc.isSecure from the
9
exception returned from the memory access, not the isSecure input
10
argument.)
11
2
12
We weren't doing this correctly, because we were looking at
3
Promote this function from aarch64 to fully general use.
13
the target security domain of the exception we were trying to
4
Use it to unify the code sequences for generating illegal
14
load the vector table entry for. This produces errors of two kinds:
5
opcode exceptions.
15
* a load from the NS vector table which hits the "NS access
16
to S memory" SecureFault should end up as a Secure HardFault,
17
but we were raising an NS HardFault
18
* a load from the S vector table which causes a BusFault
19
should raise an NS HardFault if BFHFNMINS == 1 (because
20
in that case all BusFaults are NonSecure), but we were raising
21
a Secure HardFault
22
6
23
Correct the logic.
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
10
Message-id: 20190807045335.1361-11-richard.henderson@linaro.org
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
13
target/arm/translate-a64.h | 2 --
14
target/arm/translate.h | 2 ++
15
target/arm/translate-a64.c | 7 -------
16
target/arm/translate-vfp.inc.c | 3 +--
17
target/arm/translate.c | 22 ++++++++++++----------
18
5 files changed, 15 insertions(+), 21 deletions(-)
24
19
25
We also fix a comment error where we claimed that we might
20
diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
26
be escalating MemManage to HardFault, and forgot about SecureFault.
27
(Vector loads can never hit MPU access faults, because they're
28
always aligned and always use the default address map.)
29
30
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
31
Message-id: 20190705094823.28905-1-peter.maydell@linaro.org
32
---
33
target/arm/m_helper.c | 21 +++++++++++++++++----
34
1 file changed, 17 insertions(+), 4 deletions(-)
35
36
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
37
index XXXXXXX..XXXXXXX 100644
21
index XXXXXXX..XXXXXXX 100644
38
--- a/target/arm/m_helper.c
22
--- a/target/arm/translate-a64.h
39
+++ b/target/arm/m_helper.c
23
+++ b/target/arm/translate-a64.h
40
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
24
@@ -XXX,XX +XXX,XX @@
41
if (sattrs.ns) {
25
#ifndef TARGET_ARM_TRANSLATE_A64_H
42
attrs.secure = false;
26
#define TARGET_ARM_TRANSLATE_A64_H
43
} else if (!targets_secure) {
27
44
- /* NS access to S memory */
28
-void unallocated_encoding(DisasContext *s);
45
+ /*
29
-
46
+ * NS access to S memory: the underlying exception which we escalate
30
#define unsupported_encoding(s, insn) \
47
+ * to HardFault is SecureFault, which always targets Secure.
31
do { \
48
+ */
32
qemu_log_mask(LOG_UNIMP, \
49
+ exc_secure = true;
33
diff --git a/target/arm/translate.h b/target/arm/translate.h
50
goto load_fail;
34
index XXXXXXX..XXXXXXX 100644
35
--- a/target/arm/translate.h
36
+++ b/target/arm/translate.h
37
@@ -XXX,XX +XXX,XX @@ typedef struct DisasCompare {
38
bool value_global;
39
} DisasCompare;
40
41
+void unallocated_encoding(DisasContext *s);
42
+
43
/* Share the TCG temporaries common between 32 and 64 bit modes. */
44
extern TCGv_i32 cpu_NF, cpu_ZF, cpu_CF, cpu_VF;
45
extern TCGv_i64 cpu_exclusive_addr;
46
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
47
index XXXXXXX..XXXXXXX 100644
48
--- a/target/arm/translate-a64.c
49
+++ b/target/arm/translate-a64.c
50
@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)
51
}
52
}
53
54
-void unallocated_encoding(DisasContext *s)
55
-{
56
- /* Unallocated and reserved encodings are uncategorized */
57
- gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
58
- default_exception_el(s));
59
-}
60
-
61
static void init_tmp_a64_array(DisasContext *s)
62
{
63
#ifdef CONFIG_DEBUG_TCG
64
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
65
index XXXXXXX..XXXXXXX 100644
66
--- a/target/arm/translate-vfp.inc.c
67
+++ b/target/arm/translate-vfp.inc.c
68
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
69
70
if (!s->vfp_enabled && !ignore_vfp_enabled) {
71
assert(!arm_dc_feature(s, ARM_FEATURE_M));
72
- gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
73
- default_exception_el(s));
74
+ unallocated_encoding(s);
75
return false;
76
}
77
78
diff --git a/target/arm/translate.c b/target/arm/translate.c
79
index XXXXXXX..XXXXXXX 100644
80
--- a/target/arm/translate.c
81
+++ b/target/arm/translate.c
82
@@ -XXX,XX +XXX,XX @@ static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
83
s->base.is_jmp = DISAS_NORETURN;
84
}
85
86
+void unallocated_encoding(DisasContext *s)
87
+{
88
+ /* Unallocated and reserved encodings are uncategorized */
89
+ gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
90
+ default_exception_el(s));
91
+}
92
+
93
/* Force a TB lookup after an instruction that changes the CPU state. */
94
static inline void gen_lookup_tb(DisasContext *s)
95
{
96
@@ -XXX,XX +XXX,XX @@ static inline void gen_hlt(DisasContext *s, int imm)
97
return;
98
}
99
100
- gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
101
- default_exception_el(s));
102
+ unallocated_encoding(s);
103
}
104
105
static inline void gen_add_data_offset(DisasContext *s, unsigned int insn,
106
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
107
}
108
109
if (undef) {
110
- gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
111
- default_exception_el(s));
112
+ unallocated_encoding(s);
113
return;
114
}
115
116
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
117
break;
118
default:
119
illegal_op:
120
- gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
121
- default_exception_el(s));
122
+ unallocated_encoding(s);
123
break;
51
}
124
}
52
}
125
}
53
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
126
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
54
vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
55
attrs, &result);
56
if (result != MEMTX_OK) {
57
+ /*
58
+ * Underlying exception is BusFault: its target security state
59
+ * depends on BFHFNMINS.
60
+ */
61
+ exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
62
goto load_fail;
63
}
127
}
64
*pvec = vector_entry;
128
return;
65
@@ -XXX,XX +XXX,XX @@ load_fail:
129
illegal_op:
66
/*
130
- gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
67
* All vector table fetch fails are reported as HardFault, with
131
- default_exception_el(s));
68
* HFSR.VECTTBL and .FORCED set. (FORCED is set because
132
+ unallocated_encoding(s);
69
- * technically the underlying exception is a MemManage or BusFault
133
}
70
+ * technically the underlying exception is a SecureFault or BusFault
134
71
* that is escalated to HardFault.) This is a terminal exception,
135
static void disas_thumb_insn(DisasContext *s, uint32_t insn)
72
* so we will either take the HardFault immediately or else enter
136
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
73
* lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
137
return;
74
+ * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
138
illegal_op:
75
+ * secure); otherwise it targets the same security state as the
139
undef:
76
+ * underlying exception.
140
- gen_exception_insn(s, s->pc_curr, EXCP_UDEF, syn_uncategorized(),
77
*/
141
- default_exception_el(s));
78
- exc_secure = targets_secure ||
142
+ unallocated_encoding(s);
79
- !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
143
}
80
+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
144
81
+ exc_secure = true;
145
static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
82
+ }
83
env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
84
armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
85
return false;
86
--
146
--
87
2.20.1
147
2.20.1
88
148
89
149
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 16/29] target/arm: Remove helper_double_saturate
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
Replace x = double_saturate(y) with x = add_saturate(y, y).
4
There is no need for a separate more specialized helper.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
9
Message-id: 20190807045335.1361-12-richard.henderson@linaro.org
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
target/arm/helper.h | 1 -
13
target/arm/op_helper.c | 15 ---------------
14
target/arm/translate.c | 4 ++--
15
3 files changed, 2 insertions(+), 18 deletions(-)
16
17
diff --git a/target/arm/helper.h b/target/arm/helper.h
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/helper.h
20
+++ b/target/arm/helper.h
21
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(add_saturate, i32, env, i32, i32)
22
DEF_HELPER_3(sub_saturate, i32, env, i32, i32)
23
DEF_HELPER_3(add_usaturate, i32, env, i32, i32)
24
DEF_HELPER_3(sub_usaturate, i32, env, i32, i32)
25
-DEF_HELPER_2(double_saturate, i32, env, s32)
26
DEF_HELPER_FLAGS_2(sdiv, TCG_CALL_NO_RWG_SE, s32, s32, s32)
27
DEF_HELPER_FLAGS_2(udiv, TCG_CALL_NO_RWG_SE, i32, i32, i32)
28
DEF_HELPER_FLAGS_1(rbit, TCG_CALL_NO_RWG_SE, i32, i32)
29
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
30
index XXXXXXX..XXXXXXX 100644
31
--- a/target/arm/op_helper.c
32
+++ b/target/arm/op_helper.c
33
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sub_saturate)(CPUARMState *env, uint32_t a, uint32_t b)
34
return res;
35
}
36
37
-uint32_t HELPER(double_saturate)(CPUARMState *env, int32_t val)
38
-{
39
- uint32_t res;
40
- if (val >= 0x40000000) {
41
- res = ~SIGNBIT;
42
- env->QF = 1;
43
- } else if (val <= (int32_t)0xc0000000) {
44
- res = SIGNBIT;
45
- env->QF = 1;
46
- } else {
47
- res = val << 1;
48
- }
49
- return res;
50
-}
51
-
52
uint32_t HELPER(add_usaturate)(CPUARMState *env, uint32_t a, uint32_t b)
53
{
54
uint32_t res = a + b;
55
diff --git a/target/arm/translate.c b/target/arm/translate.c
56
index XXXXXXX..XXXXXXX 100644
57
--- a/target/arm/translate.c
58
+++ b/target/arm/translate.c
59
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
60
tmp = load_reg(s, rm);
61
tmp2 = load_reg(s, rn);
62
if (op1 & 2)
63
- gen_helper_double_saturate(tmp2, cpu_env, tmp2);
64
+ gen_helper_add_saturate(tmp2, cpu_env, tmp2, tmp2);
65
if (op1 & 1)
66
gen_helper_sub_saturate(tmp, cpu_env, tmp, tmp2);
67
else
68
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
69
tmp = load_reg(s, rn);
70
tmp2 = load_reg(s, rm);
71
if (op & 1)
72
- gen_helper_double_saturate(tmp, cpu_env, tmp);
73
+ gen_helper_add_saturate(tmp, cpu_env, tmp, tmp);
74
if (op & 2)
75
gen_helper_sub_saturate(tmp, cpu_env, tmp2, tmp);
76
else
77
--
78
2.20.1
79
80
diff view generated by jsdifflib
[Qemu-devel] [PULL 03/10] hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
[Qemu-devel] [PULL 17/29] target/arm/cpu64: Ensure kvm really supports aarch64=off
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Andrew Jones <drjones@redhat.com>
2
2
3
Lei Sun found while auditing the code that a CPU write would
3
If -cpu <cpu>,aarch64=off is used then KVM must also be used, and it
4
trigger a NULL pointer dereference.
4
and the host must support running the vcpu in 32-bit mode. Also, if
5
-cpu <cpu>,aarch64=on is used, then it doesn't matter if kvm is
6
enabled or not.
5
7
6
>From UG1085 datasheet [*] AXI writes in this region are ignored
8
Signed-off-by: Andrew Jones <drjones@redhat.com>
7
and generates an AXI Slave Error (SLVERR).
9
Reviewed-by: Eric Auger <eric.auger@redhat.com>
8
9
Fix by implementing the write_with_attrs() handler.
10
Return MEMTX_ERROR when the region is accessed (this error maps
11
to an AXI slave error).
12
13
[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
14
15
Reported-by: Lei Sun <slei.casper@gmail.com>
16
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
17
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
18
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
---
11
---
21
hw/ssi/xilinx_spips.c | 16 ++++++++++++++++
12
target/arm/kvm_arm.h | 14 ++++++++++++++
22
1 file changed, 16 insertions(+)
13
target/arm/cpu64.c | 12 ++++++------
14
target/arm/kvm64.c | 9 +++++++++
15
3 files changed, 29 insertions(+), 6 deletions(-)
23
16
24
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
17
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
25
index XXXXXXX..XXXXXXX 100644
18
index XXXXXXX..XXXXXXX 100644
26
--- a/hw/ssi/xilinx_spips.c
19
--- a/target/arm/kvm_arm.h
27
+++ b/hw/ssi/xilinx_spips.c
20
+++ b/target/arm/kvm_arm.h
28
@@ -XXX,XX +XXX,XX @@ static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
21
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf);
29
return lqspi_read(opaque, addr, value, size, attrs);
22
*/
23
void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
24
25
+/**
26
+ * kvm_arm_aarch32_supported:
27
+ * @cs: CPUState
28
+ *
29
+ * Returns: true if the KVM VCPU can enable AArch32 mode
30
+ * and false otherwise.
31
+ */
32
+bool kvm_arm_aarch32_supported(CPUState *cs);
33
+
34
/**
35
* kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
36
* IPA address space supported by KVM
37
@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
38
cpu->host_cpu_probe_failed = true;
30
}
39
}
31
40
32
+static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
41
+static inline bool kvm_arm_aarch32_supported(CPUState *cs)
33
+ unsigned size, MemTxAttrs attrs)
34
+{
42
+{
35
+ /*
43
+ return false;
36
+ * From UG1085, Chapter 24 (Quad-SPI controllers):
37
+ * - Writes are ignored
38
+ * - AXI writes generate an external AXI slave error (SLVERR)
39
+ */
40
+ qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
41
+ " (value: 0x%" PRIx64 "\n",
42
+ __func__, size << 3, offset, value);
43
+
44
+ return MEMTX_ERROR;
45
+}
44
+}
46
+
45
+
47
static const MemoryRegionOps lqspi_ops = {
46
static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
48
.read_with_attrs = lqspi_read,
47
{
49
+ .write_with_attrs = lqspi_write,
48
return -ENOENT;
50
.endianness = DEVICE_NATIVE_ENDIAN,
49
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
51
.valid = {
50
index XXXXXXX..XXXXXXX 100644
52
.min_access_size = 1,
51
--- a/target/arm/cpu64.c
52
+++ b/target/arm/cpu64.c
53
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_set_aarch64(Object *obj, bool value, Error **errp)
54
* restriction allows us to avoid fixing up functionality that assumes a
55
* uniform execution state like do_interrupt.
56
*/
57
- if (!kvm_enabled()) {
58
- error_setg(errp, "'aarch64' feature cannot be disabled "
59
- "unless KVM is enabled");
60
- return;
61
- }
62
-
63
if (value == false) {
64
+ if (!kvm_enabled() || !kvm_arm_aarch32_supported(CPU(cpu))) {
65
+ error_setg(errp, "'aarch64' feature cannot be disabled "
66
+ "unless KVM is enabled and 32-bit EL1 "
67
+ "is supported");
68
+ return;
69
+ }
70
unset_feature(&cpu->env, ARM_FEATURE_AARCH64);
71
} else {
72
set_feature(&cpu->env, ARM_FEATURE_AARCH64);
73
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
74
index XXXXXXX..XXXXXXX 100644
75
--- a/target/arm/kvm64.c
76
+++ b/target/arm/kvm64.c
77
@@ -XXX,XX +XXX,XX @@
78
#include "exec/gdbstub.h"
79
#include "sysemu/sysemu.h"
80
#include "sysemu/kvm.h"
81
+#include "sysemu/kvm_int.h"
82
#include "kvm_arm.h"
83
+#include "hw/boards.h"
84
#include "internals.h"
85
86
static bool have_guest_debug;
87
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
88
return true;
89
}
90
91
+bool kvm_arm_aarch32_supported(CPUState *cpu)
92
+{
93
+ KVMState *s = KVM_STATE(current_machine->accelerator);
94
+
95
+ return kvm_check_extension(s, KVM_CAP_ARM_EL1_32BIT);
96
+}
97
+
98
#define ARM_CPU_ID_MPIDR 3, 0, 0, 0, 5
99
100
int kvm_arch_init_vcpu(CPUState *cs)
53
--
101
--
54
2.20.1
102
2.20.1
55
103
56
104
diff view generated by jsdifflib
[Qemu-devel] [PULL 09/10] target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
[Qemu-devel] [PULL 18/29] target/arm/cpu: Ensure we can use the pmu with kvm
1
The ARMv5 architecture didn't specify detailed per-feature ID
1
From: Andrew Jones <drjones@redhat.com>
2
registers. Now that we're using the MVFR0 register fields to
3
gate the existence of VFP instructions, we need to set up
4
the correct values in the cpu->isar structure so that we still
5
provide an FPU to the guest.
6
2
7
This fixes a regression in the arm926 and arm1026 CPUs, which
3
We first convert the pmu property from a static property to one with
8
are the only ones that both have VFP and are ARMv5 or earlier.
4
its own accessors. Then we use the set accessor to check if the PMU is
9
This regression was introduced by the VFP refactoring, and more
5
supported when using KVM. Indeed a 32-bit KVM host does not support
10
specifically by commits 1120827fa182f0e76 and 266bd25c485597c,
6
the PMU, so this check will catch an attempt to use it at property-set
11
which accidentally disabled VFP short-vector support and
7
time.
12
double-precision support on these CPUs.
13
8
14
Fixes: 1120827fa182f0e
9
Signed-off-by: Andrew Jones <drjones@redhat.com>
15
Fixes: 266bd25c485597c
10
Reviewed-by: Eric Auger <eric.auger@redhat.com>
16
Fixes: https://bugs.launchpad.net/qemu/+bug/1836192
17
Reported-by: Christophe Lyon <christophe.lyon@linaro.org>
18
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
19
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
20
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
21
Tested-by: Christophe Lyon <christophe.lyon@linaro.org>
22
Message-id: 20190711131241.22231-1-peter.maydell@linaro.org
23
---
12
---
24
target/arm/cpu.c | 12 ++++++++++++
13
target/arm/kvm_arm.h | 14 ++++++++++++++
25
1 file changed, 12 insertions(+)
14
target/arm/cpu.c | 30 +++++++++++++++++++++++++-----
15
target/arm/kvm.c | 7 +++++++
16
3 files changed, 46 insertions(+), 5 deletions(-)
26
17
18
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
19
index XXXXXXX..XXXXXXX 100644
20
--- a/target/arm/kvm_arm.h
21
+++ b/target/arm/kvm_arm.h
22
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
23
*/
24
bool kvm_arm_aarch32_supported(CPUState *cs);
25
26
+/**
27
+ * bool kvm_arm_pmu_supported:
28
+ * @cs: CPUState
29
+ *
30
+ * Returns: true if the KVM VCPU can enable its PMU
31
+ * and false otherwise.
32
+ */
33
+bool kvm_arm_pmu_supported(CPUState *cs);
34
+
35
/**
36
* kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
37
* IPA address space supported by KVM
38
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_aarch32_supported(CPUState *cs)
39
return false;
40
}
41
42
+static inline bool kvm_arm_pmu_supported(CPUState *cs)
43
+{
44
+ return false;
45
+}
46
+
47
static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
48
{
49
return -ENOENT;
27
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
50
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
28
index XXXXXXX..XXXXXXX 100644
51
index XXXXXXX..XXXXXXX 100644
29
--- a/target/arm/cpu.c
52
--- a/target/arm/cpu.c
30
+++ b/target/arm/cpu.c
53
+++ b/target/arm/cpu.c
31
@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
54
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_el3_property =
32
* set the field to indicate Jazelle support within QEMU.
55
static Property arm_cpu_cfgend_property =
33
*/
56
DEFINE_PROP_BOOL("cfgend", ARMCPU, cfgend, false);
34
cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
57
35
+ /*
58
-/* use property name "pmu" to match other archs and virt tools */
36
+ * Similarly, we need to set MVFR0 fields to enable double precision
59
-static Property arm_cpu_has_pmu_property =
37
+ * and short vector support even though ARMv5 doesn't have this register.
60
- DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
38
+ */
61
-
39
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
62
static Property arm_cpu_has_vfp_property =
40
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
63
DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
64
65
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pmsav7_dregion_property =
66
pmsav7_dregion,
67
qdev_prop_uint32, uint32_t);
68
69
+static bool arm_get_pmu(Object *obj, Error **errp)
70
+{
71
+ ARMCPU *cpu = ARM_CPU(obj);
72
+
73
+ return cpu->has_pmu;
74
+}
75
+
76
+static void arm_set_pmu(Object *obj, bool value, Error **errp)
77
+{
78
+ ARMCPU *cpu = ARM_CPU(obj);
79
+
80
+ if (value) {
81
+ if (kvm_enabled() && !kvm_arm_pmu_supported(CPU(cpu))) {
82
+ error_setg(errp, "'pmu' feature not supported by KVM on this host");
83
+ return;
84
+ }
85
+ set_feature(&cpu->env, ARM_FEATURE_PMU);
86
+ } else {
87
+ unset_feature(&cpu->env, ARM_FEATURE_PMU);
88
+ }
89
+ cpu->has_pmu = value;
90
+}
91
+
92
static void arm_get_init_svtor(Object *obj, Visitor *v, const char *name,
93
void *opaque, Error **errp)
94
{
95
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
96
}
97
98
if (arm_feature(&cpu->env, ARM_FEATURE_PMU)) {
99
- qdev_property_add_static(DEVICE(obj), &arm_cpu_has_pmu_property,
100
+ cpu->has_pmu = true;
101
+ object_property_add_bool(obj, "pmu", arm_get_pmu, arm_set_pmu,
102
&error_abort);
103
}
104
105
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
106
index XXXXXXX..XXXXXXX 100644
107
--- a/target/arm/kvm.c
108
+++ b/target/arm/kvm.c
109
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
110
env->features = arm_host_cpu_features.features;
41
}
111
}
42
112
43
static void arm946_initfn(Object *obj)
113
+bool kvm_arm_pmu_supported(CPUState *cpu)
44
@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
114
+{
45
* set the field to indicate Jazelle support within QEMU.
115
+ KVMState *s = KVM_STATE(current_machine->accelerator);
46
*/
116
+
47
cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
117
+ return kvm_check_extension(s, KVM_CAP_ARM_PMU_V3);
48
+ /*
118
+}
49
+ * Similarly, we need to set MVFR0 fields to enable double precision
119
+
50
+ * and short vector support even though ARMv5 doesn't have this register.
120
int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
51
+ */
121
{
52
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
122
KVMState *s = KVM_STATE(ms->accelerator);
53
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
54
55
{
56
/* The 1026 had an IFAR at c6,c0,0,1 rather than the ARMv6 c6,c0,0,2 */
57
--
123
--
58
2.20.1
124
2.20.1
59
125
60
126
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 19/29] target/arm/helper: zcr: Add build bug next to value range assumption
1
From: Andrew Jones <drjones@redhat.com>
1
2
3
The current implementation of ZCR_ELx matches the architecture, only
4
implementing the lower four bits, with the rest RAZ/WI. This puts
5
a strict limit on ARM_MAX_VQ of 16. Make sure we don't let ARM_MAX_VQ
6
grow without a corresponding update here.
7
8
Suggested-by: Dave Martin <Dave.Martin@arm.com>
9
Signed-off-by: Andrew Jones <drjones@redhat.com>
10
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
11
Reviewed-by: Eric Auger <eric.auger@redhat.com>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
target/arm/helper.c | 1 +
15
1 file changed, 1 insertion(+)
16
17
diff --git a/target/arm/helper.c b/target/arm/helper.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/helper.c
20
+++ b/target/arm/helper.c
21
@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
22
int new_len;
23
24
/* Bits other than [3:0] are RAZ/WI. */
25
+ QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
26
raw_write(env, ri, value & 0xf);
27
28
/*
29
--
30
2.20.1
31
32
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 20/29] target/arm/cpu: Use div-round-up to determine predicate register array size
1
From: Andrew Jones <drjones@redhat.com>
1
2
3
Unless we're guaranteed to always increase ARM_MAX_VQ by a multiple of
4
four, then we should use DIV_ROUND_UP to ensure we get an appropriate
5
array size.
6
7
Signed-off-by: Andrew Jones <drjones@redhat.com>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/cpu.h | 2 +-
12
1 file changed, 1 insertion(+), 1 deletion(-)
13
14
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/cpu.h
17
+++ b/target/arm/cpu.h
18
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVectorReg {
19
#ifdef TARGET_AARCH64
20
/* In AArch32 mode, predicate registers do not exist at all. */
21
typedef struct ARMPredicateReg {
22
- uint64_t p[2 * ARM_MAX_VQ / 8] QEMU_ALIGNED(16);
23
+ uint64_t p[DIV_ROUND_UP(2 * ARM_MAX_VQ, 8)] QEMU_ALIGNED(16);
24
} ARMPredicateReg;
25
26
/* In AArch32 mode, PAC keys do not exist at all. */
27
--
28
2.20.1
29
30
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 21/29] target/arm/kvm64: Fix error returns
1
From: Andrew Jones <drjones@redhat.com>
1
2
3
A couple return -EINVAL's forgot their '-'s.
4
5
Signed-off-by: Andrew Jones <drjones@redhat.com>
6
Reviewed-by: Eric Auger <eric.auger@redhat.com>
7
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
---
10
target/arm/kvm64.c | 4 ++--
11
1 file changed, 2 insertions(+), 2 deletions(-)
12
13
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
14
index XXXXXXX..XXXXXXX 100644
15
--- a/target/arm/kvm64.c
16
+++ b/target/arm/kvm64.c
17
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
18
write_cpustate_to_list(cpu, true);
19
20
if (!write_list_to_kvmstate(cpu, level)) {
21
- return EINVAL;
22
+ return -EINVAL;
23
}
24
25
kvm_arm_sync_mpstate_to_kvm(cpu);
26
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
27
}
28
29
if (!write_kvmstate_to_list(cpu)) {
30
- return EINVAL;
31
+ return -EINVAL;
32
}
33
/* Note that it's OK to have registers which aren't in CPUState,
34
* so we can ignore a failure return here.
35
--
36
2.20.1
37
38
diff view generated by jsdifflib
[Qemu-devel] [PULL 08/10] pl031: Correctly migrate state when using -rtc clock=host
[Qemu-devel] [PULL 22/29] target/arm/kvm64: Move the get/put of fpsimd registers out
1
The PL031 RTC tracks the difference between the guest RTC
1
From: Andrew Jones <drjones@redhat.com>
2
and the host RTC using a tick_offset field. For migration,
2
3
however, we currently always migrate the offset between
3
Move the getting/putting of the fpsimd registers out of
4
the guest and the vm_clock, even if the RTC clock is not
4
kvm_arch_get/put_registers() into their own helper functions
5
the same as the vm_clock; this was an attempt to retain
5
to prepare for alternatively getting/putting SVE registers.
6
migration backwards compatibility.
6
7
7
No functional change.
8
Unfortunately this results in the RTC behaving oddly across
8
9
a VM state save and restore -- since the VM clock stands still
9
Signed-off-by: Andrew Jones <drjones@redhat.com>
10
across save-then-restore, regardless of how much real world
10
Reviewed-by: Eric Auger <eric.auger@redhat.com>
11
time has elapsed, the guest RTC ends up out of sync with the
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
host RTC in the restored VM.
13
14
Fix this by migrating the raw tick_offset. To retain migration
15
compatibility as far as possible, we have a new property
16
migrate-tick-offset; by default this is 'true' and we will
17
migrate the true tick offset in a new subsection; if the
18
incoming data has no subsection we fall back to the old
19
vm_clock-based offset information, so old->new migration
20
compatibility is preserved. For complete new->old migration
21
compatibility, the property is set to 'false' for 4.0 and
22
earlier machine types (this will only affect 'virt-4.0'
23
and below, as none of the other pl031-using machines are
24
versioned).
25
26
Reported-by: Russell King <rmk@armlinux.org.uk>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
29
Message-id: 20190709143912.28905-1-peter.maydell@linaro.org
30
---
13
---
31
include/hw/timer/pl031.h | 2 +
14
target/arm/kvm64.c | 148 +++++++++++++++++++++++++++------------------
32
hw/core/machine.c | 1 +
15
1 file changed, 88 insertions(+), 60 deletions(-)
33
hw/timer/pl031.c | 92 ++++++++++++++++++++++++++++++++++++++--
16
34
3 files changed, 91 insertions(+), 4 deletions(-)
17
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
35
36
diff --git a/include/hw/timer/pl031.h b/include/hw/timer/pl031.h
37
index XXXXXXX..XXXXXXX 100644
18
index XXXXXXX..XXXXXXX 100644
38
--- a/include/hw/timer/pl031.h
19
--- a/target/arm/kvm64.c
39
+++ b/include/hw/timer/pl031.h
20
+++ b/target/arm/kvm64.c
40
@@ -XXX,XX +XXX,XX @@ typedef struct PL031State {
21
@@ -XXX,XX +XXX,XX @@ int kvm_arm_cpreg_level(uint64_t regidx)
41
*/
22
#define AARCH64_SIMD_CTRL_REG(x) (KVM_REG_ARM64 | KVM_REG_SIZE_U32 | \
42
uint32_t tick_offset_vmstate;
23
KVM_REG_ARM_CORE | KVM_REG_ARM_CORE_REG(x))
43
uint32_t tick_offset;
24
44
+ bool tick_offset_migrated;
25
+static int kvm_arch_put_fpsimd(CPUState *cs)
45
+ bool migrate_tick_offset;
46
47
uint32_t mr;
48
uint32_t lr;
49
diff --git a/hw/core/machine.c b/hw/core/machine.c
50
index XXXXXXX..XXXXXXX 100644
51
--- a/hw/core/machine.c
52
+++ b/hw/core/machine.c
53
@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_4_0[] = {
54
{ "virtio-gpu-pci", "edid", "false" },
55
{ "virtio-device", "use-started", "false" },
56
{ "virtio-balloon-device", "qemu-4-0-config-size", "true" },
57
+ { "pl031", "migrate-tick-offset", "false" },
58
};
59
const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
60
61
diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
62
index XXXXXXX..XXXXXXX 100644
63
--- a/hw/timer/pl031.c
64
+++ b/hw/timer/pl031.c
65
@@ -XXX,XX +XXX,XX @@ static int pl031_pre_save(void *opaque)
66
{
67
PL031State *s = opaque;
68
69
- /* tick_offset is base_time - rtc_clock base time. Instead, we want to
70
- * store the base time relative to the QEMU_CLOCK_VIRTUAL for backwards-compatibility. */
71
+ /*
72
+ * The PL031 device model code uses the tick_offset field, which is
73
+ * the offset between what the guest RTC should read and what the
74
+ * QEMU rtc_clock reads:
75
+ * guest_rtc = rtc_clock + tick_offset
76
+ * and so
77
+ * tick_offset = guest_rtc - rtc_clock
78
+ *
79
+ * We want to migrate this offset, which sounds straightforward.
80
+ * Unfortunately older versions of QEMU migrated a conversion of this
81
+ * offset into an offset from the vm_clock. (This was in turn an
82
+ * attempt to be compatible with even older QEMU versions, but it
83
+ * has incorrect behaviour if the rtc_clock is not the same as the
84
+ * vm_clock.) So we put the actual tick_offset into a migration
85
+ * subsection, and the backwards-compatible time-relative-to-vm_clock
86
+ * in the main migration state.
87
+ *
88
+ * Calculate base time relative to QEMU_CLOCK_VIRTUAL:
89
+ */
90
int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
91
s->tick_offset_vmstate = s->tick_offset + delta / NANOSECONDS_PER_SECOND;
92
93
return 0;
94
}
95
96
+static int pl031_pre_load(void *opaque)
97
+{
26
+{
98
+ PL031State *s = opaque;
27
+ ARMCPU *cpu = ARM_CPU(cs);
99
+
28
+ CPUARMState *env = &cpu->env;
100
+ s->tick_offset_migrated = false;
29
+ struct kvm_one_reg reg;
30
+ uint32_t fpr;
31
+ int i, ret;
32
+
33
+ for (i = 0; i < 32; i++) {
34
+ uint64_t *q = aa64_vfp_qreg(env, i);
35
+#ifdef HOST_WORDS_BIGENDIAN
36
+ uint64_t fp_val[2] = { q[1], q[0] };
37
+ reg.addr = (uintptr_t)fp_val;
38
+#else
39
+ reg.addr = (uintptr_t)q;
40
+#endif
41
+ reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
42
+ ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
43
+ if (ret) {
44
+ return ret;
45
+ }
46
+ }
47
+
48
+ reg.addr = (uintptr_t)(&fpr);
49
+ fpr = vfp_get_fpsr(env);
50
+ reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
51
+ ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
52
+ if (ret) {
53
+ return ret;
54
+ }
55
+
56
+ reg.addr = (uintptr_t)(&fpr);
57
+ fpr = vfp_get_fpcr(env);
58
+ reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
59
+ ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
60
+ if (ret) {
61
+ return ret;
62
+ }
63
+
101
+ return 0;
64
+ return 0;
102
+}
65
+}
103
+
66
+
104
static int pl031_post_load(void *opaque, int version_id)
67
int kvm_arch_put_registers(CPUState *cs, int level)
105
{
68
{
106
PL031State *s = opaque;
69
struct kvm_one_reg reg;
107
70
- uint32_t fpr;
108
- int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
71
uint64_t val;
109
- s->tick_offset = s->tick_offset_vmstate - delta / NANOSECONDS_PER_SECOND;
72
- int i;
110
+ /*
73
- int ret;
111
+ * If we got the tick_offset subsection, then we can just use
74
+ int i, ret;
112
+ * the value in that. Otherwise the source is an older QEMU and
75
unsigned int el;
113
+ * has given us the offset from the vm_clock; convert it back to
76
114
+ * an offset from the rtc_clock. This will cause time to incorrectly
77
ARMCPU *cpu = ARM_CPU(cs);
115
+ * go backwards compared to the host RTC, but this is unavoidable.
78
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
116
+ */
79
}
117
+
80
}
118
+ if (!s->tick_offset_migrated) {
81
119
+ int64_t delta = qemu_clock_get_ns(rtc_clock) -
82
- /* Advanced SIMD and FP registers. */
120
+ qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
83
- for (i = 0; i < 32; i++) {
121
+ s->tick_offset = s->tick_offset_vmstate -
84
- uint64_t *q = aa64_vfp_qreg(env, i);
122
+ delta / NANOSECONDS_PER_SECOND;
85
-#ifdef HOST_WORDS_BIGENDIAN
123
+ }
86
- uint64_t fp_val[2] = { q[1], q[0] };
124
pl031_set_alarm(s);
87
- reg.addr = (uintptr_t)fp_val;
125
return 0;
88
-#else
89
- reg.addr = (uintptr_t)q;
90
-#endif
91
- reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
92
- ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
93
- if (ret) {
94
- return ret;
95
- }
96
- }
97
-
98
- reg.addr = (uintptr_t)(&fpr);
99
- fpr = vfp_get_fpsr(env);
100
- reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
101
- ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
102
- if (ret) {
103
- return ret;
104
- }
105
-
106
- fpr = vfp_get_fpcr(env);
107
- reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
108
- ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
109
+ ret = kvm_arch_put_fpsimd(cs);
110
if (ret) {
111
return ret;
112
}
113
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
114
return ret;
126
}
115
}
127
116
128
+static int pl031_tick_offset_post_load(void *opaque, int version_id)
117
+static int kvm_arch_get_fpsimd(CPUState *cs)
129
+{
118
+{
130
+ PL031State *s = opaque;
119
+ ARMCPU *cpu = ARM_CPU(cs);
131
+
120
+ CPUARMState *env = &cpu->env;
132
+ s->tick_offset_migrated = true;
121
+ struct kvm_one_reg reg;
122
+ uint32_t fpr;
123
+ int i, ret;
124
+
125
+ for (i = 0; i < 32; i++) {
126
+ uint64_t *q = aa64_vfp_qreg(env, i);
127
+ reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
128
+ reg.addr = (uintptr_t)q;
129
+ ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
130
+ if (ret) {
131
+ return ret;
132
+ } else {
133
+#ifdef HOST_WORDS_BIGENDIAN
134
+ uint64_t t;
135
+ t = q[0], q[0] = q[1], q[1] = t;
136
+#endif
137
+ }
138
+ }
139
+
140
+ reg.addr = (uintptr_t)(&fpr);
141
+ reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
142
+ ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
143
+ if (ret) {
144
+ return ret;
145
+ }
146
+ vfp_set_fpsr(env, fpr);
147
+
148
+ reg.addr = (uintptr_t)(&fpr);
149
+ reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
150
+ ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
151
+ if (ret) {
152
+ return ret;
153
+ }
154
+ vfp_set_fpcr(env, fpr);
155
+
133
+ return 0;
156
+ return 0;
134
+}
157
+}
135
+
158
+
136
+static bool pl031_tick_offset_needed(void *opaque)
159
int kvm_arch_get_registers(CPUState *cs)
137
+{
138
+ PL031State *s = opaque;
139
+
140
+ return s->migrate_tick_offset;
141
+}
142
+
143
+static const VMStateDescription vmstate_pl031_tick_offset = {
144
+ .name = "pl031/tick-offset",
145
+ .version_id = 1,
146
+ .minimum_version_id = 1,
147
+ .needed = pl031_tick_offset_needed,
148
+ .post_load = pl031_tick_offset_post_load,
149
+ .fields = (VMStateField[]) {
150
+ VMSTATE_UINT32(tick_offset, PL031State),
151
+ VMSTATE_END_OF_LIST()
152
+ }
153
+};
154
+
155
static const VMStateDescription vmstate_pl031 = {
156
.name = "pl031",
157
.version_id = 1,
158
.minimum_version_id = 1,
159
.pre_save = pl031_pre_save,
160
+ .pre_load = pl031_pre_load,
161
.post_load = pl031_post_load,
162
.fields = (VMStateField[]) {
163
VMSTATE_UINT32(tick_offset_vmstate, PL031State),
164
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pl031 = {
165
VMSTATE_UINT32(im, PL031State),
166
VMSTATE_UINT32(is, PL031State),
167
VMSTATE_END_OF_LIST()
168
+ },
169
+ .subsections = (const VMStateDescription*[]) {
170
+ &vmstate_pl031_tick_offset,
171
+ NULL
172
}
173
};
174
175
+static Property pl031_properties[] = {
176
+ /*
177
+ * True to correctly migrate the tick offset of the RTC. False to
178
+ * obtain backward migration compatibility with older QEMU versions,
179
+ * at the expense of the guest RTC going backwards compared with the
180
+ * host RTC when the VM is saved/restored if using -rtc host.
181
+ * (Even if set to 'true' older QEMU can migrate forward to newer QEMU;
182
+ * 'false' also permits newer QEMU to migrate to older QEMU.)
183
+ */
184
+ DEFINE_PROP_BOOL("migrate-tick-offset",
185
+ PL031State, migrate_tick_offset, true),
186
+ DEFINE_PROP_END_OF_LIST()
187
+};
188
+
189
static void pl031_class_init(ObjectClass *klass, void *data)
190
{
160
{
191
DeviceClass *dc = DEVICE_CLASS(klass);
161
struct kvm_one_reg reg;
192
162
uint64_t val;
193
dc->vmsd = &vmstate_pl031;
163
- uint32_t fpr;
194
+ dc->props = pl031_properties;
164
unsigned int el;
195
}
165
- int i;
196
166
- int ret;
197
static const TypeInfo pl031_info = {
167
+ int i, ret;
168
169
ARMCPU *cpu = ARM_CPU(cs);
170
CPUARMState *env = &cpu->env;
171
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
172
env->spsr = env->banked_spsr[i];
173
}
174
175
- /* Advanced SIMD and FP registers */
176
- for (i = 0; i < 32; i++) {
177
- uint64_t *q = aa64_vfp_qreg(env, i);
178
- reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
179
- reg.addr = (uintptr_t)q;
180
- ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
181
- if (ret) {
182
- return ret;
183
- } else {
184
-#ifdef HOST_WORDS_BIGENDIAN
185
- uint64_t t;
186
- t = q[0], q[0] = q[1], q[1] = t;
187
-#endif
188
- }
189
- }
190
-
191
- reg.addr = (uintptr_t)(&fpr);
192
- reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
193
- ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
194
+ ret = kvm_arch_get_fpsimd(cs);
195
if (ret) {
196
return ret;
197
}
198
- vfp_set_fpsr(env, fpr);
199
-
200
- reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
201
- ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
202
- if (ret) {
203
- return ret;
204
- }
205
- vfp_set_fpcr(env, fpr);
206
207
ret = kvm_get_vcpu_events(cpu);
208
if (ret) {
198
--
209
--
199
2.20.1
210
2.20.1
200
211
201
212
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 23/29] target/arm: Use tcg_gen_extract_i32 for shifter_out_im
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
Extract is a compact combination of shift + and.
4
5
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6
Message-id: 20190808202616.13782-2-richard.henderson@linaro.org
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
---
10
target/arm/translate.c | 9 +--------
11
1 file changed, 1 insertion(+), 8 deletions(-)
12
13
diff --git a/target/arm/translate.c b/target/arm/translate.c
14
index XXXXXXX..XXXXXXX 100644
15
--- a/target/arm/translate.c
16
+++ b/target/arm/translate.c
17
@@ -XXX,XX +XXX,XX @@ static void gen_sar(TCGv_i32 dest, TCGv_i32 t0, TCGv_i32 t1)
18
19
static void shifter_out_im(TCGv_i32 var, int shift)
20
{
21
- if (shift == 0) {
22
- tcg_gen_andi_i32(cpu_CF, var, 1);
23
- } else {
24
- tcg_gen_shri_i32(cpu_CF, var, shift);
25
- if (shift != 31) {
26
- tcg_gen_andi_i32(cpu_CF, cpu_CF, 1);
27
- }
28
- }
29
+ tcg_gen_extract_i32(cpu_CF, var, shift, 1);
30
}
31
32
/* Shift by immediate. Includes special handling for shift == 0. */
33
--
34
2.20.1
35
36
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 24/29] target/arm: Use tcg_gen_deposit_i32 for PKHBT, PKHTB
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
Use deposit as the composit operation to merge the
4
bits from the two inputs.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20190808202616.13782-3-richard.henderson@linaro.org
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/translate.c | 26 ++++++++++----------------
12
1 file changed, 10 insertions(+), 16 deletions(-)
13
14
diff --git a/target/arm/translate.c b/target/arm/translate.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/translate.c
17
+++ b/target/arm/translate.c
18
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
19
shift = (insn >> 7) & 0x1f;
20
if (insn & (1 << 6)) {
21
/* pkhtb */
22
- if (shift == 0)
23
+ if (shift == 0) {
24
shift = 31;
25
+ }
26
tcg_gen_sari_i32(tmp2, tmp2, shift);
27
- tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
28
- tcg_gen_ext16u_i32(tmp2, tmp2);
29
+ tcg_gen_deposit_i32(tmp, tmp, tmp2, 0, 16);
30
} else {
31
/* pkhbt */
32
- if (shift)
33
- tcg_gen_shli_i32(tmp2, tmp2, shift);
34
- tcg_gen_ext16u_i32(tmp, tmp);
35
- tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
36
+ tcg_gen_shli_i32(tmp2, tmp2, shift);
37
+ tcg_gen_deposit_i32(tmp, tmp2, tmp, 0, 16);
38
}
39
- tcg_gen_or_i32(tmp, tmp, tmp2);
40
tcg_temp_free_i32(tmp2);
41
store_reg(s, rd, tmp);
42
} else if ((insn & 0x00200020) == 0x00200000) {
43
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
44
shift = ((insn >> 10) & 0x1c) | ((insn >> 6) & 0x3);
45
if (insn & (1 << 5)) {
46
/* pkhtb */
47
- if (shift == 0)
48
+ if (shift == 0) {
49
shift = 31;
50
+ }
51
tcg_gen_sari_i32(tmp2, tmp2, shift);
52
- tcg_gen_andi_i32(tmp, tmp, 0xffff0000);
53
- tcg_gen_ext16u_i32(tmp2, tmp2);
54
+ tcg_gen_deposit_i32(tmp, tmp, tmp2, 0, 16);
55
} else {
56
/* pkhbt */
57
- if (shift)
58
- tcg_gen_shli_i32(tmp2, tmp2, shift);
59
- tcg_gen_ext16u_i32(tmp, tmp);
60
- tcg_gen_andi_i32(tmp2, tmp2, 0xffff0000);
61
+ tcg_gen_shli_i32(tmp2, tmp2, shift);
62
+ tcg_gen_deposit_i32(tmp, tmp2, tmp, 0, 16);
63
}
64
- tcg_gen_or_i32(tmp, tmp, tmp2);
65
tcg_temp_free_i32(tmp2);
66
store_reg(s, rd, tmp);
67
} else {
68
--
69
2.20.1
70
71
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 25/29] target/arm: Remove redundant shift tests
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
The immediate shift generator functions already test for,
4
and eliminate, the case of a shift by zero.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20190808202616.13782-4-richard.henderson@linaro.org
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/translate.c | 19 +++++++------------
12
1 file changed, 7 insertions(+), 12 deletions(-)
13
14
diff --git a/target/arm/translate.c b/target/arm/translate.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/translate.c
17
+++ b/target/arm/translate.c
18
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
19
shift = (insn >> 10) & 3;
20
/* ??? In many cases it's not necessary to do a
21
rotate, a shift is sufficient. */
22
- if (shift != 0)
23
- tcg_gen_rotri_i32(tmp, tmp, shift * 8);
24
+ tcg_gen_rotri_i32(tmp, tmp, shift * 8);
25
op1 = (insn >> 20) & 7;
26
switch (op1) {
27
case 0: gen_sxtb16(tmp); break;
28
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
29
shift = (insn >> 4) & 3;
30
/* ??? In many cases it's not necessary to do a
31
rotate, a shift is sufficient. */
32
- if (shift != 0)
33
- tcg_gen_rotri_i32(tmp, tmp, shift * 8);
34
+ tcg_gen_rotri_i32(tmp, tmp, shift * 8);
35
op = (insn >> 20) & 7;
36
switch (op) {
37
case 0: gen_sxth(tmp); break;
38
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
39
case 7:
40
goto illegal_op;
41
default: /* Saturate. */
42
- if (shift) {
43
- if (op & 1)
44
- tcg_gen_sari_i32(tmp, tmp, shift);
45
- else
46
- tcg_gen_shli_i32(tmp, tmp, shift);
47
+ if (op & 1) {
48
+ tcg_gen_sari_i32(tmp, tmp, shift);
49
+ } else {
50
+ tcg_gen_shli_i32(tmp, tmp, shift);
51
}
52
tmp2 = tcg_const_i32(imm);
53
if (op & 4) {
54
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
55
goto illegal_op;
56
}
57
tmp = load_reg(s, rm);
58
- if (shift) {
59
- tcg_gen_shli_i32(tmp, tmp, shift);
60
- }
61
+ tcg_gen_shli_i32(tmp, tmp, shift);
62
tcg_gen_add_i32(addr, addr, tmp);
63
tcg_temp_free_i32(tmp);
64
break;
65
--
66
2.20.1
67
68
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 26/29] target/arm: Use ror32 instead of open-coding the operation
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
The helper function is more documentary, and also already
4
handles the case of rotate by zero.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20190808202616.13782-5-richard.henderson@linaro.org
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/translate.c | 7 ++-----
12
1 file changed, 2 insertions(+), 5 deletions(-)
13
14
diff --git a/target/arm/translate.c b/target/arm/translate.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/translate.c
17
+++ b/target/arm/translate.c
18
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
19
/* CPSR = immediate */
20
val = insn & 0xff;
21
shift = ((insn >> 8) & 0xf) * 2;
22
- if (shift)
23
- val = (val >> shift) | (val << (32 - shift));
24
+ val = ror32(val, shift);
25
i = ((insn & (1 << 22)) != 0);
26
if (gen_set_psr_im(s, msr_mask(s, (insn >> 16) & 0xf, i),
27
i, val)) {
28
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
29
/* immediate operand */
30
val = insn & 0xff;
31
shift = ((insn >> 8) & 0xf) * 2;
32
- if (shift) {
33
- val = (val >> shift) | (val << (32 - shift));
34
- }
35
+ val = ror32(val, shift);
36
tmp2 = tcg_temp_new_i32();
37
tcg_gen_movi_i32(tmp2, val);
38
if (logic_cc && shift) {
39
--
40
2.20.1
41
42
diff view generated by jsdifflib
New patch
[Qemu-devel] [PULL 27/29] target/arm: Use tcg_gen_rotri_i32 for gen_swap_half
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
Rotate is the more compact and obvious way to swap 16-bit
4
elements of a 32-bit word.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20190808202616.13782-6-richard.henderson@linaro.org
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/translate.c | 6 +-----
12
1 file changed, 1 insertion(+), 5 deletions(-)
13
14
diff --git a/target/arm/translate.c b/target/arm/translate.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/translate.c
17
+++ b/target/arm/translate.c
18
@@ -XXX,XX +XXX,XX @@ static TCGv_i64 gen_muls_i64_i32(TCGv_i32 a, TCGv_i32 b)
19
/* Swap low and high halfwords. */
20
static void gen_swap_half(TCGv_i32 var)
21
{
22
- TCGv_i32 tmp = tcg_temp_new_i32();
23
- tcg_gen_shri_i32(tmp, var, 16);
24
- tcg_gen_shli_i32(var, var, 16);
25
- tcg_gen_or_i32(var, var, tmp);
26
- tcg_temp_free_i32(tmp);
27
+ tcg_gen_rotri_i32(var, var, 16);
28
}
29
30
/* Dual 16-bit add. Result placed in t0 and t1 is marked as dead.
31
--
32
2.20.1
33
34
diff view generated by jsdifflib
[Qemu-devel] [PULL 05/10] hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
[Qemu-devel] [PULL 28/29] target/arm: Simplify SMMLA, SMMLAR, SMMLS, SMMLSR
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
Reading the RX_DATA register when the RX_FIFO is empty triggers
3
All of the inputs to these instructions are 32-bits. Rather than
4
an abort. This can be easily reproduced:
4
extend each input to 64-bits and then extract the high 32-bits of
5
the output, use tcg_gen_muls2_i32 and other 32-bit generator functions.
5
6
6
$ qemu-system-arm -M emcraft-sf2 -monitor stdio -S
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
QEMU 4.0.50 monitor - type 'help' for more information
8
Message-id: 20190808202616.13782-7-richard.henderson@linaro.org
8
(qemu) x 0x40001010
9
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Aborted (core dumped)
10
11
(gdb) bt
12
#1 0x00007f035874f895 in abort () at /lib64/libc.so.6
13
#2 0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66
14
#3 0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137
15
#4 0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168
16
#5 0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
17
#6 0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569
18
#7 0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420
19
#8 0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447
20
#9 0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385
21
#10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423
22
#11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436
23
#12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466
24
#13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976
25
#14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730
26
#15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785
27
#16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082
28
29
From the datasheet "Actel SmartFusion Microcontroller Subsystem
30
User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this
31
register has a reset value of 0.
32
33
Check the FIFO is not empty before accessing it, else log an
34
error message.
35
36
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
37
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
38
Message-id: 20190709113715.7761-3-philmd@redhat.com
39
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
40
---
11
---
41
hw/ssi/mss-spi.c | 8 +++++++-
12
target/arm/translate.c | 72 +++++++++++++++---------------------------
42
1 file changed, 7 insertions(+), 1 deletion(-)
13
1 file changed, 26 insertions(+), 46 deletions(-)
43
14
44
diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c
15
diff --git a/target/arm/translate.c b/target/arm/translate.c
45
index XXXXXXX..XXXXXXX 100644
16
index XXXXXXX..XXXXXXX 100644
46
--- a/hw/ssi/mss-spi.c
17
--- a/target/arm/translate.c
47
+++ b/hw/ssi/mss-spi.c
18
+++ b/target/arm/translate.c
48
@@ -XXX,XX +XXX,XX @@ spi_read(void *opaque, hwaddr addr, unsigned int size)
19
@@ -XXX,XX +XXX,XX @@ static void gen_revsh(TCGv_i32 var)
49
case R_SPI_RX:
20
tcg_gen_ext16s_i32(var, var);
50
s->regs[R_SPI_STATUS] &= ~S_RXFIFOFUL;
21
}
51
s->regs[R_SPI_STATUS] &= ~S_RXCHOVRF;
22
52
- ret = fifo32_pop(&s->rx_fifo);
23
-/* Return (b << 32) + a. Mark inputs as dead */
53
+ if (fifo32_is_empty(&s->rx_fifo)) {
24
-static TCGv_i64 gen_addq_msw(TCGv_i64 a, TCGv_i32 b)
54
+ qemu_log_mask(LOG_GUEST_ERROR,
25
-{
55
+ "%s: Reading empty RX_FIFO\n",
26
- TCGv_i64 tmp64 = tcg_temp_new_i64();
56
+ __func__);
27
-
57
+ } else {
28
- tcg_gen_extu_i32_i64(tmp64, b);
58
+ ret = fifo32_pop(&s->rx_fifo);
29
- tcg_temp_free_i32(b);
59
+ }
30
- tcg_gen_shli_i64(tmp64, tmp64, 32);
60
if (fifo32_is_empty(&s->rx_fifo)) {
31
- tcg_gen_add_i64(a, tmp64, a);
61
s->regs[R_SPI_STATUS] |= S_RXFIFOEMP;
32
-
62
}
33
- tcg_temp_free_i64(tmp64);
34
- return a;
35
-}
36
-
37
-/* Return (b << 32) - a. Mark inputs as dead. */
38
-static TCGv_i64 gen_subq_msw(TCGv_i64 a, TCGv_i32 b)
39
-{
40
- TCGv_i64 tmp64 = tcg_temp_new_i64();
41
-
42
- tcg_gen_extu_i32_i64(tmp64, b);
43
- tcg_temp_free_i32(b);
44
- tcg_gen_shli_i64(tmp64, tmp64, 32);
45
- tcg_gen_sub_i64(a, tmp64, a);
46
-
47
- tcg_temp_free_i64(tmp64);
48
- return a;
49
-}
50
-
51
/* 32x32->64 multiply. Marks inputs as dead. */
52
static TCGv_i64 gen_mulu_i64_i32(TCGv_i32 a, TCGv_i32 b)
53
{
54
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
55
(SMMUL, SMMLA, SMMLS) */
56
tmp = load_reg(s, rm);
57
tmp2 = load_reg(s, rs);
58
- tmp64 = gen_muls_i64_i32(tmp, tmp2);
59
+ tcg_gen_muls2_i32(tmp2, tmp, tmp, tmp2);
60
61
if (rd != 15) {
62
- tmp = load_reg(s, rd);
63
+ tmp3 = load_reg(s, rd);
64
if (insn & (1 << 6)) {
65
- tmp64 = gen_subq_msw(tmp64, tmp);
66
+ tcg_gen_sub_i32(tmp, tmp, tmp3);
67
} else {
68
- tmp64 = gen_addq_msw(tmp64, tmp);
69
+ tcg_gen_add_i32(tmp, tmp, tmp3);
70
}
71
+ tcg_temp_free_i32(tmp3);
72
}
73
if (insn & (1 << 5)) {
74
- tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
75
+ /*
76
+ * Adding 0x80000000 to the 64-bit quantity
77
+ * means that we have carry in to the high
78
+ * word when the low word has the high bit set.
79
+ */
80
+ tcg_gen_shri_i32(tmp2, tmp2, 31);
81
+ tcg_gen_add_i32(tmp, tmp, tmp2);
82
}
83
- tcg_gen_shri_i64(tmp64, tmp64, 32);
84
- tmp = tcg_temp_new_i32();
85
- tcg_gen_extrl_i64_i32(tmp, tmp64);
86
- tcg_temp_free_i64(tmp64);
87
+ tcg_temp_free_i32(tmp2);
88
store_reg(s, rn, tmp);
89
break;
90
case 0:
91
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
92
}
93
break;
94
case 5: case 6: /* 32 * 32 -> 32msb (SMMUL, SMMLA, SMMLS) */
95
- tmp64 = gen_muls_i64_i32(tmp, tmp2);
96
+ tcg_gen_muls2_i32(tmp2, tmp, tmp, tmp2);
97
if (rs != 15) {
98
- tmp = load_reg(s, rs);
99
+ tmp3 = load_reg(s, rs);
100
if (insn & (1 << 20)) {
101
- tmp64 = gen_addq_msw(tmp64, tmp);
102
+ tcg_gen_add_i32(tmp, tmp, tmp3);
103
} else {
104
- tmp64 = gen_subq_msw(tmp64, tmp);
105
+ tcg_gen_sub_i32(tmp, tmp, tmp3);
106
}
107
+ tcg_temp_free_i32(tmp3);
108
}
109
if (insn & (1 << 4)) {
110
- tcg_gen_addi_i64(tmp64, tmp64, 0x80000000u);
111
+ /*
112
+ * Adding 0x80000000 to the 64-bit quantity
113
+ * means that we have carry in to the high
114
+ * word when the low word has the high bit set.
115
+ */
116
+ tcg_gen_shri_i32(tmp2, tmp2, 31);
117
+ tcg_gen_add_i32(tmp, tmp, tmp2);
118
}
119
- tcg_gen_shri_i64(tmp64, tmp64, 32);
120
- tmp = tcg_temp_new_i32();
121
- tcg_gen_extrl_i64_i32(tmp, tmp64);
122
- tcg_temp_free_i64(tmp64);
123
+ tcg_temp_free_i32(tmp2);
124
break;
125
case 7: /* Unsigned sum of absolute differences. */
126
gen_helper_usad8(tmp, tmp, tmp2);
63
--
127
--
64
2.20.1
128
2.20.1
65
129
66
130
diff view generated by jsdifflib
[Qemu-devel] [PULL 06/10] hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
[Qemu-devel] [PULL 29/29] target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
In the previous commit we fixed a crash when the guest read a
3
Separate shift + extract low will result in one extra insn
4
register that pop from an empty FIFO.
4
for hosts like RISC-V, MIPS, and Sparc.
5
By auditing the repository, we found another similar use with
6
an easy way to reproduce:
7
5
8
$ qemu-system-aarch64 -M xlnx-zcu102 -monitor stdio -S
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
QEMU 4.0.50 monitor - type 'help' for more information
7
Message-id: 20190808202616.13782-8-richard.henderson@linaro.org
10
(qemu) xp/b 0xfd4a0134
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11
Aborted (core dumped)
12
13
(gdb) bt
14
#0 0x00007f6936dea57f in raise () at /lib64/libc.so.6
15
#1 0x00007f6936dd4895 in abort () at /lib64/libc.so.6
16
#2 0x0000561ad32975ec in xlnx_dp_aux_pop_rx_fifo (s=0x7f692babee70) at hw/display/xlnx_dp.c:431
17
#3 0x0000561ad3297dc0 in xlnx_dp_read (opaque=0x7f692babee70, offset=77, size=4) at hw/display/xlnx_dp.c:667
18
#4 0x0000561ad321b896 in memory_region_read_accessor (mr=0x7f692babf620, addr=308, value=0x7ffe05c1db88, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
19
#5 0x0000561ad321bd70 in access_with_adjusted_size (addr=308, value=0x7ffe05c1db88, size=1, access_size_min=4, access_size_max=4, access_fn=0x561ad321b858 <memory_region_read_accessor>, mr=0x7f692babf620, attrs=...) at memory.c:569
20
#6 0x0000561ad321e9d5 in memory_region_dispatch_read1 (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1420
21
#7 0x0000561ad321ea9d in memory_region_dispatch_read (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1447
22
#8 0x0000561ad31bd742 in flatview_read_continue (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1, addr1=308, l=1, mr=0x7f692babf620) at exec.c:3385
23
#9 0x0000561ad31bd895 in flatview_read (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3423
24
#10 0x0000561ad31bd90b in address_space_read_full (as=0x561ad5bb3020, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3436
25
#11 0x0000561ad33b1c42 in address_space_read (len=1, buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", attrs=..., addr=4249485620, as=0x561ad5bb3020) at include/exec/memory.h:2131
26
#12 0x0000561ad33b1c42 in memory_dump (mon=0x561ad59c4530, count=1, format=120, wsize=1, addr=4249485620, is_physical=1) at monitor/misc.c:723
27
#13 0x0000561ad33b1fc1 in hmp_physical_memory_dump (mon=0x561ad59c4530, qdict=0x561ad6c6fd00) at monitor/misc.c:795
28
#14 0x0000561ad37b4a9f in handle_hmp_command (mon=0x561ad59c4530, cmdline=0x561ad59d0f22 "/b 0x00000000fd4a0134") at monitor/hmp.c:1082
29
30
Fix by checking the FIFO is not empty before popping from it.
31
32
The datasheet is not clear about the reset value of this register,
33
we choose to return '0'.
34
35
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
36
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
37
Message-id: 20190709113715.7761-4-philmd@redhat.com
38
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
39
---
10
---
40
hw/display/xlnx_dp.c | 15 +++++++++++----
11
target/arm/translate.c | 18 ++++++------------
41
1 file changed, 11 insertions(+), 4 deletions(-)
12
1 file changed, 6 insertions(+), 12 deletions(-)
42
13
43
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
14
diff --git a/target/arm/translate.c b/target/arm/translate.c
44
index XXXXXXX..XXXXXXX 100644
15
index XXXXXXX..XXXXXXX 100644
45
--- a/hw/display/xlnx_dp.c
16
--- a/target/arm/translate.c
46
+++ b/hw/display/xlnx_dp.c
17
+++ b/target/arm/translate.c
47
@@ -XXX,XX +XXX,XX @@ static uint8_t xlnx_dp_aux_pop_rx_fifo(XlnxDPState *s)
18
@@ -XXX,XX +XXX,XX @@ static int disas_iwmmxt_insn(DisasContext *s, uint32_t insn)
48
uint8_t ret;
19
if (insn & ARM_CP_RW_BIT) { /* TMRRC */
49
20
iwmmxt_load_reg(cpu_V0, wrd);
50
if (fifo8_is_empty(&s->rx_fifo)) {
21
tcg_gen_extrl_i64_i32(cpu_R[rdlo], cpu_V0);
51
- DPRINTF("rx_fifo underflow..\n");
22
- tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
52
- abort();
23
- tcg_gen_extrl_i64_i32(cpu_R[rdhi], cpu_V0);
53
+ qemu_log_mask(LOG_GUEST_ERROR,
24
+ tcg_gen_extrh_i64_i32(cpu_R[rdhi], cpu_V0);
54
+ "%s: Reading empty RX_FIFO\n",
25
} else { /* TMCRR */
55
+ __func__);
26
tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
56
+ /*
27
iwmmxt_store_reg(cpu_V0, wrd);
57
+ * The datasheet is not clear about the reset value, it seems
28
@@ -XXX,XX +XXX,XX @@ static int disas_dsp_insn(DisasContext *s, uint32_t insn)
58
+ * to be unspecified. We choose to return '0'.
29
if (insn & ARM_CP_RW_BIT) { /* MRA */
59
+ */
30
iwmmxt_load_reg(cpu_V0, acc);
60
+ ret = 0;
31
tcg_gen_extrl_i64_i32(cpu_R[rdlo], cpu_V0);
61
+ } else {
32
- tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
62
+ ret = fifo8_pop(&s->rx_fifo);
33
- tcg_gen_extrl_i64_i32(cpu_R[rdhi], cpu_V0);
63
+ DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
34
+ tcg_gen_extrh_i64_i32(cpu_R[rdhi], cpu_V0);
64
}
35
tcg_gen_andi_i32(cpu_R[rdhi], cpu_R[rdhi], (1 << (40 - 32)) - 1);
65
- ret = fifo8_pop(&s->rx_fifo);
36
} else { /* MAR */
66
- DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
37
tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
67
return ret;
38
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
39
gen_helper_neon_narrow_high_u16(tmp, cpu_V0);
40
break;
41
case 2:
42
- tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
43
- tcg_gen_extrl_i64_i32(tmp, cpu_V0);
44
+ tcg_gen_extrh_i64_i32(tmp, cpu_V0);
45
break;
46
default: abort();
47
}
48
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
49
break;
50
case 2:
51
tcg_gen_addi_i64(cpu_V0, cpu_V0, 1u << 31);
52
- tcg_gen_shri_i64(cpu_V0, cpu_V0, 32);
53
- tcg_gen_extrl_i64_i32(tmp, cpu_V0);
54
+ tcg_gen_extrh_i64_i32(tmp, cpu_V0);
55
break;
56
default: abort();
57
}
58
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
59
tmp = tcg_temp_new_i32();
60
tcg_gen_extrl_i64_i32(tmp, tmp64);
61
store_reg(s, rt, tmp);
62
- tcg_gen_shri_i64(tmp64, tmp64, 32);
63
tmp = tcg_temp_new_i32();
64
- tcg_gen_extrl_i64_i32(tmp, tmp64);
65
+ tcg_gen_extrh_i64_i32(tmp, tmp64);
66
tcg_temp_free_i64(tmp64);
67
store_reg(s, rt2, tmp);
68
} else {
69
@@ -XXX,XX +XXX,XX @@ static void gen_storeq_reg(DisasContext *s, int rlow, int rhigh, TCGv_i64 val)
70
tcg_gen_extrl_i64_i32(tmp, val);
71
store_reg(s, rlow, tmp);
72
tmp = tcg_temp_new_i32();
73
- tcg_gen_shri_i64(val, val, 32);
74
- tcg_gen_extrl_i64_i32(tmp, val);
75
+ tcg_gen_extrh_i64_i32(tmp, val);
76
store_reg(s, rhigh, tmp);
68
}
77
}
69
78
70
--
79
--
71
2.20.1
80
2.20.1
72
81
73
82
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.