summaryrefslogtreecommitdiffstats
path: root/target-arm/translate.c
Commit message (Collapse)AuthorAgeFilesLines
* Initial overlay of HQEMU 2.5.2 changes onto underlying 2.5.1 QEMU GIT tree2.5.1_overlayTimothy Pearson2019-11-291-11/+313
|
* target-arm: Update condexec before arch BP check in AA32 translationSergey Fedorov2015-11-191-0/+1
| | | | | | | | | | Architectural breakpoint check could raise an exceptions, thus condexec bits should be updated before calling gen_helper_check_breakpoints(). Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1447767527-21268-3-git-send-email-serge.fdrv@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Update condexec before CP access check in AA32 translationSergey Fedorov2015-11-191-0/+1
| | | | | | | | | | | Coprocessor access instructions are allowed inside IT block. gen_helper_access_check_cp_reg() can raise an exceptions thus condexec bits should be updated before. Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1447767527-21268-2-git-send-email-serge.fdrv@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Update PC before calling gen_helper_check_breakpoints()Sergey Fedorov2015-11-121-0/+1
| | | | | | | | | | | PC should be updated in the CPU state before calling check_breakpoints() helper. Otherwise, the helper would not see the correct PC in the CPU state if it is not at the start of a TB. Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1447176222-16401-1-git-send-email-serge.fdrv@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Clean up DISAS_UPDATE usage in AArch32 translation codeSergey Fedorov2015-11-101-11/+14
| | | | | | | | | | | | | | | | | | | | | | | | | AArch32 translation code does not distinguish between DISAS_UPDATE and DISAS_JUMP. Thus, we cannot use any of them without first updating PC in CPU state. Furthermore, it is too complicated to update PC in CPU state before PC gets updated in disas context. So it is hardly possible to correctly end TB early if is is not likely to be executed before calling disas_*_insn(), e.g. just after calling breakpoint check helper. Modify DISAS_UPDATE and DISAS_JUMP usage in AArch32 translation and apply to them the same semantic as AArch64 translation does: - DISAS_UPDATE: update PC in CPU state when finishing translation - DISAS_JUMP: preserve current PC value in CPU state when finishing translation This patch fixes a bug in AArch32 breakpoint handling: when check_breakpoints helper does not generate an exception, ending the TB early with DISAS_UPDATE couldn't update PC in CPU state and execution hangs. Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Message-id: 1447097859-586-1-git-send-email-serge.fdrv@gmail.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Report S/NS status in the CPU debug logsPeter Maydell2015-11-031-1/+11
| | | | | | | | | | | If this CPU supports EL3, enhance the printing of the current CPU mode in debug logging to distinguish S from NS modes as appropriate. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1445883178-576-3-git-send-email-peter.maydell@linaro.org
* target-*: Advance pc after recognizing a breakpointRichard Henderson2015-10-281-2/+5
| | | | | | | | Some targets already had this within their logic, but make sure it's present for all targets. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* target-arm/translate.c: Handle non-executable page-straddling Thumb insnsPeter Maydell2015-10-271-1/+44
| | | | | | | | | | | | | | | | | | | When the memory we're trying to translate code from is not executable we have to turn this into a guest fault. In order to report the correct PC for this fault, and to make sure it is not reported until after any other possible faults for instructions earlier in execution, we must terminate TBs at the end of a page, in case the next instruction is in a non-executable page. This is simple for T16, A32 and A64 instructions, which are always aligned to their size. However T32 instructions may be 32-bits but only 16-aligned, so they can straddle a page boundary. Correct the condition that checks whether the next instruction will touch the following page, to ensure that if we're 2 bytes before the boundary and this insn is T32 then we end the TB. Reported-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Fix CPU breakpoint handlingSergey Fedorov2015-10-161-5/+14
| | | | | | | | | | | | | A QEMU breakpoint match is not definitely an architectural breakpoint match. If an exception is generated unconditionally during translation, it is hardly possible to ignore it in the debug exception handler. Generate a call to a helper to check CPU breakpoints and raise an exception only if any breakpoint matches architecturally. Signed-off-by: Sergey Fedorov <serge.fdrv@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Break the TB after ISB to execute self-modified code correctlySergey Sorokin2015-10-161-2/+15
| | | | | | | | | | | | | | | | If any store instruction writes the code inside the same TB after this store insn, the execution of the TB must be stopped to execute new code correctly. As described in ARMv8 manual D3.4.6 self-modifying code must do an IC invalidation to be valid, and an ISB after it. So it's enough to end the TB after ISB instruction on the code translation. Also this TB break is necessary to take any pending interrupts immediately after an ISB (as required by ARMv8 ARM D1.14.4). Signed-off-by: Sergey Sorokin <afarallax@yandex.ru> [PMM: tweaked commit message and comments slightly] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* tcg: Remove gen_intermediate_code_pcRichard Henderson2015-10-071-45/+9
| | | | | | | | | | It is no longer used, so tidy up everything reached by it. This includes the gen_opc_* arrays, the search_pc parameter and the inline gen_intermediate_code_internal functions. Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* tcg: Pass data argument to restore_state_to_opcRichard Henderson2015-10-071-4/+5
| | | | | | | | | | The gen_opc_* arrays are already redundant with the data stored in the insn_start arguments. Transition restore_state_to_opc to use data from the latter. Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* tcg: Add TCG_MAX_INSNSRichard Henderson2015-10-071-1/+5
| | | | | | | | Adjust all translators to respect it. Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* target-arm: Add condexec state to insn_startRichard Henderson2015-10-071-1/+2
| | | | | | Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* target-*: Introduce and use cpu_breakpoint_testRichard Henderson2015-10-071-15/+16
| | | | | | | | | | | | Reduce the boilerplate required for each target. At the same time, move the test for breakpoint after calling tcg_gen_insn_start. Note that arm and aarch64 do not use cpu_breakpoint_test, but still move the inline test down after tcg_gen_insn_start. Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* target-*: Increment num_insns immediately after tcg_gen_insn_startRichard Henderson2015-10-071-3/+4
| | | | | | | | This does tidy the icount test common to all targets. Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* target-*: Unconditionally emit tcg_gen_insn_startRichard Henderson2015-10-071-4/+1
| | | | | | | | | | While we're at it, emit the opcode adjacent to where we currently record data for search_pc. This puts gen_io_start et al on the "correct" side of the marker. Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* tcg: Rename debug_insn_start to insn_startRichard Henderson2015-10-071-1/+1
| | | | | | | | With an eye toward making it mandatory. Reviewed-by: Aurelien Jarno <aurelien@aurel32.net> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net>
* target-arm: Handle always condition codes within arm_test_ccRichard Henderson2015-09-141-0/+9
| | | | | | | | | | | | Handling this with TCG_COND_ALWAYS will allow these unlikely cases to be handled without special cases in the rest of the translator. The TCG optimizer ought to be able to reduce these ALWAYS conditions completely. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net> Message-id: 1441909103-24666-4-git-send-email-rth@twiddle.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Introduce DisasCompareRichard Henderson2015-09-141-46/+69
| | | | | | | | | | Split arm_gen_test_cc into 3 functions, so that it can be reused for non-branch TCG comparisons. Signed-off-by: Richard Henderson <rth@twiddle.net> Message-id: 1441909103-24666-3-git-send-email-rth@twiddle.net Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Share all common TCG temporariesRichard Henderson2015-09-141-5/+5
| | | | | | | | | | | | | | | | | | | | | | This is a bug fix for aarch64. At present, we have branches using the 32-bit (translate.c) versions of cpu_[NZCV]F, but we set the flags using the 64-bit (translate-a64.c) versions of cpu_[NZCV]F. From the view of the TCG code generator, these are unrelated variables. The bug is hard to see because we currently only read these variables from branches, and upon reaching a branch TCG will first spill live variables and then reload the arguments of the branch. Since the 32-bit versions were never live until reaching the branch, we'd re-read the data that had just been spilled from the 64-bit versions. There is currently no such problem with the cpu_exclusive_* variables, but there's no point in tempting fate. Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <rth@twiddle.net> Message-id: 1441909103-24666-2-git-send-email-rth@twiddle.net Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* maint: remove / fix many doubled wordsDaniel P. Berrange2015-09-111-1/+1
| | | | | | | | | | | | Many source files have doubled words (eg "the the", "to to", and so on). Most of these can simply be removed, but a couple were actual mis-spellings (eg "to to" instead of "to do"). There was even one triple word score "to to to" :-) Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* target-arm: Fix default_exception_el() function for the case when EL3 is not ↵Sergey Sorokin2015-09-081-1/+5
| | | | | | | | | | | | supported If EL3 is not supported in current configuration, we should not try to get EL3 bitness. Signed-off-by: Sergey Sorokin <afarallax@yandex.ru> Message-id: 1441208342-10601-2-git-send-email-afarallax@yandex.ru Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* tcg: Remove tcg_gen_trunc_i64_i32Richard Henderson2015-08-241-23/+23
| | | | | | Replacing it with tcg_gen_extrl_i64_i32. Signed-off-by: Richard Henderson <rth@twiddle.net>
* target-arm: Implement YIELD insn to yield in ARM and Thumb translatorsPeter Maydell2015-07-061-0/+7
| | | | | | | | | | Implement the YIELD instruction in the ARM and Thumb translators to actually yield control back to the top level loop rather than being a simple no-op. (We already do this for A64.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 1435672316-3311-3-git-send-email-peter.maydell@linaro.org
* disas: Remove uses of CPU envPeter Crosthwaite2015-06-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | disas does not need to access the CPU env for any reason. Change the APIs to accept CPU pointers instead. Small change pattern needs to be applied to all target translate.c. This brings us closer to making disas.o a common-obj and less architecture specific in general. Cc: Richard Henderson <rth@twiddle.net> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: "Edgar E. Iglesias" <edgar.iglesias@gmail.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Michael Walle <michael@walle.cc> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Leon Alrae <leon.alrae@imgtec.com> Cc: Jia Liu <proljc@gmail.com> Cc: Alexander Graf <agraf@suse.de> Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Cc: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Cc: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Peter Crosthwaite <crosthwaite.peter@gmail.com> Acked-by: Luiz Capitulino <lcapitulino@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
* target-arm: Correct "preferred return address" for cpreg access exceptionsPeter Maydell2015-06-151-1/+1
| | | | | | | | | | | | | | | | | The architecture defines that when taking an exception trying to access a coprocessor register, the "preferred return address" for the exception is the address of the instruction that caused the exception. Correct an off-by-4 error which meant we were returning the address after the instruction for traps which happened because of a failure of a runtime access-check function on an AArch32 register. (Traps caused by translate-time checkable permissions failures had the correct address, as did traps on AArch64 registers.) This fixes https://bugs.launchpad.net/qemu/+bug/1463338 Reported-by: Robert Buhren <robert@robertbuhren.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1433861440-30133-1-git-send-email-peter.maydell@linaro.org
* target-arm: Add the THUMB_DSP featureAurelio C. Remonda2015-06-151-10/+102
| | | | | | | | | | | | | | | | | | | Create an ARM_FEATURE_THUMB_DSP controlling the Thumb encodings of the 85 DSP instructions (these are all Thumb2). This is enabled for all non-M-profile CPUs with Thumb2 support, as the instructions are mandatory for R and A profiles. On M profile they are optional and not present in the Cortex-M3 (though they are in the M4). The effect of this commit is that we will now treat the DSP encodings as illegal instructions on M3, when previously we incorrectly implemented them. Signed-off-by: Aurelio C. Remonda <aurelioremonda@gmail.com> Message-id: 1434311355-26554-1-git-send-email-aurelioremonda@gmail.com [PMM: added clz/crc32/crc32c and default case to the early-decode switch; minor format/spacing fixups; reworded commit message a bit] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Avoid buffer overrun on UNPREDICTABLE ldrd/strdPeter Maydell2015-05-291-24/+32
| | | | | | | | | | | | | | | | A LDRD or STRD where rd is not an even number is UNPREDICTABLE. We were letting this fall through, which is OK unless rd is 15, in which case we would attempt to do a load_reg or store_reg to a nonexistent r16 for the second half of the double-word. Catch the odd-numbered-rd cases and UNDEF them instead. To do this we rearrange the structure of the code a little so we can put the UNDEF catches at the top before we've allocated TCG temporaries. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1431348973-21315-1-git-send-email-peter.maydell@linaro.org
* target-arm: Don't halt on WFI unless we don't have any workPeter Maydell2015-05-291-0/+4
| | | | | | | | | | | | | Just NOP the WFI instruction if we have work to do. This doesn't make much difference currently (though it does avoid jumping out to the top level loop and immediately restarting), but the distinction between "halt" and "don't halt" will become more important when the decision to halt requires us to trap to a higher exception level instead. Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
* target-arm: Extend FP checks to use an ELGreg Bellows2015-05-291-10/+7
| | | | | | | | | | | | | | | Extend the ARM disassemble context to take a target exception EL instead of a boolean enable. This change reverses the polarity of the check making a value of 0 indicate floating point enabled (no exception). Signed-off-by: Greg Bellows <greg.bellows@linaro.org> [PMM: Use a common TB flag field for AArch32 and AArch64; CPTR_EL2 exists in v7; CPTR_EL2 should trap for EL2 accesses; CPTR_EL2 should not trap for secure accesses; CPTR_EL3 should trap for EL3 accesses; CPACR traps for secure accesses should trap to EL3 if EL3 is AArch32] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
* target-arm: Add exception target el infrastructureGreg Bellows2015-05-291-23/+42
| | | | | | | | | | | | | | | | | | | | Add a CPU state exception target EL field that will be used for communicating the EL to which an exception should be routed. Add a disassembly context field for tracking the EL3 architecture needed for determining the target exception EL. Add a target EL argument to the generic exception helper for callers to specify the EL to which the exception should be routed. Extended the helper to set the newly added CPU state exception target el. Added a function for setting the target exception EL and updated calls to helpers to call it. Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1429722561-12651-2-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: Fix handling of STM (user) with r15 in register listPeter Maydell2015-03-161-6/+12
| | | | | | | | | | | | | The A32 encoding of LDM distinguishes LDM (user) from LDM (exception return) based on whether r15 is in the register list. However for STM (user) there is no equivalent distinction. We were incorrectly treating "r15 in list" as indicating exception return for both LDM and STM, with the result that an STM (user) involving r15 went into an infinite loop. Fix this; note that the value stored for r15 in this case is the current PC regardless of our current mode. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1426015125-5521-1-git-send-email-peter.maydell@linaro.org
* tcg: Change translator-side labels to a pointerRichard Henderson2015-03-131-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | This is improved type checking for the translators -- it's no longer possible to accidentally swap arguments to the branch functions. Note that the code generating backends still manipulate labels as int. With notable exceptions, the scope of the change is just a few lines for each target, so it's not worth building extra machinery to do this change in per-target increments. Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com> Cc: Michael Walle <michael@walle.cc> Cc: Leon Alrae <leon.alrae@imgtec.com> Cc: Anthony Green <green@moxielogic.com> Cc: Jia Liu <proljc@gmail.com> Cc: Alexander Graf <agraf@suse.de> Cc: Aurelien Jarno <aurelien@aurel32.net> Cc: Blue Swirl <blauwirbel@gmail.com> Cc: Guan Xuetao <gxt@mprc.pku.edu.cn> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Max Filippov <jcmvbkbc@gmail.com> Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
* tcg: Introduce tcg_op_buf_count and tcg_op_buf_fullRichard Henderson2015-02-121-6/+3
| | | | | | | | The method by which we count the number of ops emitted is going to change. Abstract that away into some inlines. Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
* tcg: Move emit of INDEX_op_end into gen_tb_endRichard Henderson2015-02-121-1/+0
| | | | | Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de> Signed-off-by: Richard Henderson <rth@twiddle.net>
* target-arm: Use correct mmu_idx for unprivileged loads and storesPeter Maydell2015-02-051-2/+24
| | | | | | | | | | | | | | | The MMU index to use for unprivileged loads and stores is more complicated than we currently implement: * for A64, it should be "if at EL1, access as if EL0; otherwise access at current EL" * for A32/T32, it should be "if EL2, UNPREDICTABLE; otherwise access as if at EL0". In both cases, if we want to make the access for Secure EL0 this is not the same mmu_idx as for Non-Secure EL0. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org>
* target-arm: Define correct mmu_idx values and pass them in TB flagsPeter Maydell2015-02-051-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | We currently claim that for ARM the mmu_idx should simply be the current exception level. However this isn't actually correct -- secure EL0 and EL1 should have separate indexes from non-secure EL0 and EL1 since their VA->PA mappings may differ. We also will want an index for stage 2 translations when we properly support EL2. Define and document all seven mmu index values that we require, and pass the mmu index in the TB flags rather than exception level or priv/user bit. This change doesn't update the get_phys_addr() code, so our page table walking still assumes a simplistic "user or priv?" model for the moment. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Greg Bellows <greg.bellows@linaro.org> --- This leaves some odd gaps in the TB flags usage. I will circle back and clean this up later (including moving the other common flags like the singlestep ones to the top of the flags word), but I didn't want to bloat this patchseries further.
* target-arm: check that LSB <= MSB in BFI instructionKirill Batuzov2015-02-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The documentation states that if LSB > MSB in BFI instruction behaviour is unpredictable. Currently QEMU crashes because of assertion failure in this case: tcg/tcg-op.h:2061: tcg_gen_deposit_i32: Assertion `len <= 32' failed. While assertion failure may meet the "unpredictable" definition this behaviour is undesirable because it allows an unprivileged guest program to crash the emulator with the OS and other programs. This patch addresses the issue by throwing illegal instruction exception if LSB > MSB. Only ARM decoder is affected because Thumb decoder already has this check in place. To reproduce issue run the following program int main(void) { asm volatile (".long 0x07c00c12" :: ); return 0; } compiled with gcc -marm -static badop_arm.c -o badop_arm Signed-off-by: Kirill Batuzov <batuzovk@ispras.ru> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* gen-icount: check cflags instead of use_icount globalPaolo Bonzini2015-01-031-1/+1
| | | | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* translate: check cflags instead of use_icount globalPaolo Bonzini2015-01-031-2/+2
| | | | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target-arm: add secure state bit to CPREG hashPeter Maydell2014-12-111-5/+9
| | | | | | | | | | | Added additional NS-bit to CPREG hash encoding. Updated hash lookup locations to specify hash bit currently set to non-secure. Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1416242878-876-7-git-send-email-greg.bellows@linaro.org [PMM: fix uses of ENCODE_CP_REG in kvm32.c to add extra argument] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: add non-secure Translation Block flagSergey Fedorov2014-12-111-0/+1
| | | | | | | | | | | | | | | | | This patch is based on idea found in patch at git://github.com/jowinter/qemu-trustzone.git f3d955c6c0ed8c46bc0eb10b634201032a651dd2 by Johannes Winter <johannes.winter@iaik.tugraz.at>. The TBFLAG captures the SCR NS secure state at the time when a TB is created so the correct bank is accessed on system register accesses. Signed-off-by: Sergey Fedorov <s.fedorov@samsung.com> Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch> Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1416242878-876-5-git-send-email-greg.bellows@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm/translate.c: Don't pass CPUARMState * to disas_arm_insn()Peter Maydell2014-11-041-6/+5
| | | | | | | | | | | Refactor to avoid passing a CPUARMState * to disas_arm_insn(). To do this we move the "read insn from memory" code to the callsite and pass the insn to the function instead. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1414524244-20316-6-git-send-email-peter.maydell@linaro.org Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
* target-arm/translate.c: Don't pass CPUARMState around in the decoderPeter Maydell2014-11-041-44/+50
| | | | | | | | | | | | | | | | | Passing the CPUARMState around in the decoder is a recipe for bugs where we accidentally generate code that depends on CPU state which isn't reflected in the TB flags. Stop doing this and instead use DisasContext as a way to pass around those bits of CPU state which are known to be safe to use. This commit simply removes initial "CPUARMState *env" parameters from various function definitions, and removes the initial "env" argument from the places where those functions are called. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1414524244-20316-5-git-send-email-peter.maydell@linaro.org Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
* target-arm/translate.c: Don't use IS_M()Peter Maydell2014-11-041-8/+11
| | | | | | | | | | Instead of using IS_M(), use arm_dc_feature(s, ARM_FEATURE_M), so we don't need to pass CPUARMState pointers around the decoder. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1414524244-20316-4-git-send-email-peter.maydell@linaro.org Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
* target-arm/translate.c: Use arm_dc_feature() rather than arm_feature()Peter Maydell2014-11-041-60/+80
| | | | | | | | | | Use arm_dc_feature() rather than arm_feature() to avoid using CPUARMState unnecessarily. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1414524244-20316-3-git-send-email-peter.maydell@linaro.org Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
* target-arm/translate.c: Use arm_dc_feature() in ENABLE_ARCH_ macrosPeter Maydell2014-11-041-8/+8
| | | | | | | | | | | All the places where we use the ENABLE_ARCH_* and ARCH() macros have a DisasContext* s, so switch them over to use arm_dc_feature() rather than arm_feature() so we don't need to pass the CPUARMState* env around too. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 1414524244-20316-2-git-send-email-peter.maydell@linaro.org Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
* target-arm: rename arm_current_pl to arm_current_elGreg Bellows2014-10-241-2/+2
| | | | | | | | | | | Renamed the arm_current_pl CPU function to more accurately represent that it returns the ARMv8 EL rather than ARMv7 PL. Signed-off-by: Greg Bellows <greg.bellows@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1413910544-20150-5-git-send-email-greg.bellows@linaro.org [PMM: fixed a minor merge resolution error in a couple of hunks] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target-arm: correctly UNDEF writes to FPINST/FPINST2 from EL0Peter Maydell2014-10-241-0/+3
| | | | | | | | | | | | The ARM ARM requires that the FPINST and FPINST2 VFP control registers are not accessible to code at EL0. We were already correctly implementing this for reads of these registers; add the missing check for the write code path. Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com> Message-id: 1412967447-20931-1-git-send-email-peter.maydell@linaro.org
OpenPOWER on IntegriCloud