Commit Graph

595 Commits

Author SHA1 Message Date
Stefan Weil 599d64f6dc target-arm: Fix potential buffer overflow
Report from smatch:

target-arm/helper.c:651 arm946_prbs_read(6) error:
 buffer overflow 'env->cp15.c6_region' 8 <= 8
target-arm/helper.c:661 arm946_prbs_write(6) error:
 buffer overflow 'env->cp15.c6_region' 8 <= 8

c7_region is an array with 8 elements, so the index must be less than 8.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2012-09-10 15:00:06 +02:00
Jim Meyering 396bef4b38 arm-semi: don't leak 1KB user string lock buffer upon TARGET_SYS_OPEN
Always call unlock_user before returning.

Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
2012-08-22 10:47:14 -05:00
Peter Maydell b90372ad2a target-arm: Fix typos in comments
Fix a variety of typos in comments in target-arm files.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2012-08-10 14:37:28 +01:00
Peter A. G. Crosthwaite 656267413c arm: translate: comment typo - s/middel/middle/
Signed-off-by: Peter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
2012-08-10 14:33:16 +01:00
Peter Maydell 3dde962f39 target-arm: Add support for long format translation table walks
Implement the actual table walk code for LPAE's long format
translation tables.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell e42c4db3a3 target-arm: Implement TTBCR changes for LPAE
Implement the changes to the TTBCR register required for LPAE:
 * many fewer bits should be RAZ/WI
 * since TTBCR changes can result in a change of ASID, we must
   flush the TLB on writes to it

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell 702a935789 target-arm: Implement long-descriptor PAR format
Implement the different format of the PAR when long descriptor
translation tables are in use. Note that we assume that
get_phys_addr() returns a long-descriptor format DFSR value on
failure if long descriptors are in use; this added subtlety tips
the balance and makes it worth adding a comment documenting the
API to get_phys_addr().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell 77a71dd1cb target-arm: Use target_phys_addr_t in get_phys_addr()
In the implementation of get_phys_addr(), consistently use
target_phys_addr_t to hold the physical address rather than
uint32_t.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell 891a2fe720 target-arm: Add 64 bit PAR, TTBR0, TTBR1 for LPAE
Under LPAE, the cp15 registers PAR, TTBR0 and TTBR1 are extended
to 64 bits, with a 64 bit (MRRC/MCRR) access path to read the
full width of the register. Add the state fields for the top
half and the 64 bit access path. Actual use of the top half of
the register will come with the addition of the long-descriptor
translation table format support.

For the PAR we also need to correct the masking applied for
32 bit writes (there are no bits reserved if LPAE is implemented)
and clear the high half when doing a 32 bit result VA-to-PA
lookup.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell f9fc619a0d target-arm: Add 64 bit variants of DBGDRAR and DBGDSAR for LPAE
LPAE extends the DBGDRAR and DBGDSAR debug registers to 64 bits; we
only implement these as dummy RAZ versions; provide dummies for
the 64 bit accesses as well.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell 7ac681cf2a target-arm: Add AMAIR0, AMAIR1 LPAE cp15 registers
Add implementations of the AMAIR0 and AMAIR1 LPAE
Auxiliary Memory Attribute Indirection Registers.
These are implementation defined and we choose to
implement them as RAZ/WI, matching the Cortex-A7
and Cortex-A15.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell 918f5dca18 target-arm: Extend feature flags to 64 bits
Extend feature flags to 64 bits, as we've just run out of space
in the 32 bit integer we were using for them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell de9b05b807 target-arm: Implement privileged-execute-never (PXN)
Implement the privileged-execute-never (PXN) translation table bit.
It is implementation-defined whether this is implemented, so we give
it its own ARM_FEATURE_ flag. LPAE requires PXN, so add also an
LPAE feature flag and the implication logic, as a placeholder
for actually implementing LPAE at a later date.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:54 +00:00
Peter Maydell 3cc0cd61f4 ARM: Make target_phys_addr_t 64 bits and physaddrs 40 bits
Make target_phys_addr_t 64 bits for ARM targets, and set
TARGET_PHYS_ADDR_SPACE_BITS to 40.  This should have no effect for ARM
boards where physical addresses really are 32 bits (except perhaps a
slight performance hit on 32 bit hosts for system emulation) but allows
us to implement the Large Physical Address Extensions for Cortex-A15,
which mean 40 bit physical addresses.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:53 +00:00
Peter Maydell ed336850e8 target-arm: Fix TCG temp handling in 64 bit cp writes
Fix errors in the TCG temp handling in the 64 bit coprocessor
write path: we were reusing a 32 bit temp after it had been
freed by store_reg(), and failing to free a 64 bit temp.

This bug has no visible effect at this point because there
aren't any non-NOP 64 bit registers yet; it needs to be fixed
as a prerequisite for the 64 bit registers in LPAE support.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:59:53 +00:00
Peter Maydell 091fd17ce8 target-arm: Fix some copy-and-paste errors in cp register names
Fix a couple of cases where cp register names were copy-and-pasted.
These are harmless since we don't use the name for anything (except
debugging convenience) but could be confusing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Igor Mitsyanko <i.mitsyanko@samsung.com>
2012-07-12 10:58:36 +00:00
Peter Maydell 81a60ada7e target-arm: Fix typo that meant TTBR1 accesses went to TTBR0
Fix a copy-and-paste error in the register description for TTBR1
that meant it was a duplicate of TTBR0 rather than affecting the
correct bit of CPU state.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:58:36 +00:00
Paul Brook 2bee510548 target-arm: Fix CP15 based WFI
The coprocessor register rework broke cp15 based WFI instructions.
We incorrectly fall through the normal register write case, which
incorrectly adds a forced block termination.  We've already done
a special version of this (DISAS_WFI), so return immediately.

Signed-off-by: Paul Brook <paul@codesourcery.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-07-12 10:58:35 +00:00
Peter Maydell b2d06f9607 target-arm: Remove ARM_CPUID_* macros
All the uses of ARM_CPUID() to vary behaviour have now been
removed, so we can delete the ARM_CPUID_* macros now.
The one exception is the TI915T/925T, because of its odd behaviour
where the MIDR value can be changed at runtime.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andreas Färber <afaerber@suse.de>
2012-06-20 12:13:28 +00:00
Peter Maydell 4a9a539ffb target-arm: Remove remaining old cp15 infrastructure
There are now no uses of the old cp15 infrastructure,
so it can be deleted.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:13:04 +00:00
Peter Maydell 30b05bba11 target-arm: Move block cache ops to new cp15 framework
Move the v6 optional block cache ops to the new cp15 framework.
This includes only providing them on the CPUs which implemented
them, rather than the previous blunderbuss approach of making
all MCRR instructions on all CPUs act as NOPs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:12:41 +00:00
Peter Maydell b22af022b2 target-arm: Remove c0_cachetype CPUARMState field
Remove the no-longer-used CPUARMState c0_cachetype field.
Although this was a constant register we had it in our
migration state. Drop this (with resulting version bump)
because for ARM currently we prefer cleaner migration
code and have not stabilised migration format yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:11:49 +00:00
Peter Maydell 7884849cc5 target-arm: Convert final ID registers
Convert the final ID registers to the new cp15 scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:11:45 +00:00
Peter Maydell 81bdde9dcd target-arm: Convert MPIDR
Convert the MPIDR to the new cp15 register scheme.
This includes giving it its own feature bit rather
than doing a CPUID value check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:10:54 +00:00
Peter Maydell 776d4e5c6c target-arm: Convert cp15 cache ID registers
Convert the cp15 cache ID registers to the new scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:10:05 +00:00
Peter Maydell 8515a09294 target-arm: Convert cp15 crn=0 crm={1,2} feature registers
Convert the cp15 crn=0 crm={1,2} features registers to
the new cp reg framework.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:09:11 +00:00
Peter Maydell 2771db2741 target-arm: Convert cp15 crn=1 registers
Convert the cp15 crn=1 registers to the new scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:08:22 +00:00
Peter Maydell 34f9052967 target-arm: Convert cp15 crn=9 registers
Convert cp15 crn=9 registers (mostly cache lockdown) to the new scheme.

Note that this change makes OMAPCP cores RAZ/WI the whole c9 space.  This is
a change from previous behaviour, but a return to the behaviour of commit
c3d2689d when OMAP1 support was first added -- subsequent commits have
clearly accidentally relegated the OMAPCP RAZ condition to only a subset of
the crn=9 space when adding support for other cores.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:08:16 +00:00
Peter Maydell 06d76f319f target-arm: Convert cp15 crn=6 registers
Convert the cp15 crn=6 registers to the new scheme.
Note that this includes some minor tidyup: drop an unnecessary
underdecoding of op2 on OMAPCP cores, and only implement the
pre-v6 c6,c0,0,1 IFAR on the 1026 and not on the other ARMv5
cores, which didn't have it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:08:11 +00:00
Peter Maydell c480421426 target-arm: convert cp15 crn=7 registers
Convert the cp15 crn=7 registers to the new scheme.
Note that to do this we have to distinguish some registers
used on the ARM9 and ARM10 from some which are ARM1176
only. This is because the old code returned a value of 0
but always set the Z flag (by clearing env->ZF, since we
store the Z flag in CPUState inverted). This is inconsistent
with actual ARM CPU behaviour, which only sets flags for
reads to r15 and sets them based on the top bits of the result.
However it happened to work for the two common use cases for
cp15 crn=7 reads:
 * On ARM9 and ARM10 the cache clean-and-test operations are
typically done with a destination of r15 so that you can do
a "loop: mrc ... ; bne loop" to keep cleaning until the cache
is finally clean; always setting the Z flag means this loop
terminates immediately
 * on ARM1176 the Cache Dirty Status Register reads as zero
if the cache is dirty; returning 0 means this is correctly
implemented for QEMU

Since the new coprocessor register framework does the right
thing of always setting flags based on the returned result
for reads to r15, we need to split these up so that we can
return (1<<30) for the ARM9/ARM10 registers but 0 for the
ARM1176 one.

This allows us to remove the nasty hack which always sets Z.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:07:11 +00:00
Peter Maydell 4a50160666 target-arm: Convert cp15 VA-PA translation registers
Convert the cp15 VA-PA translation registers (a subset of
the crn=7 regs) to the new scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:07:05 +00:00
Peter Maydell d929823fa1 target-arm: Convert cp15 MMU TLB control
Convert cp15 MMU TLB control (crn=8) to new scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:07:00 +00:00
Peter Maydell 1047b9d7bb target-arm: Convert cp15 crn=15 registers
Convert the cp15 crn=15 (implementation specific) registers
to the new scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:06:09 +00:00
Peter Maydell 4fdd17dd35 target-arm: Convert cp15 crn=10 registers
We RAZ/WI the entire block of crn=10 registers. Note that this
actually covers not just the implementation-defined TLB
lockdown registers but also a number of v7 VMSA memory
attribute registers which we would need to implement to
support TEX remap. We retain the previous QEMU behaviour
in this conversion, though.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:06:05 +00:00
Peter Maydell 08de207bc5 target-arm: Convert cp15 crn=13 registers
Convert the cp15 crn=13 registers (FCSEIDR, CONTEXTIDR,
and the ARM946 Trace Process Identifier Register).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:06:01 +00:00
Peter Maydell ecce5c3c90 target-arm: Convert cp15 crn=2 registers
Convert the cp15 crn=2 registers (MMU page table control,
MPU cache control) to the new scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:05:56 +00:00
Peter Maydell 18032bec5c target-arm: Convert MMU fault status cp15 registers
Convert the MMU fault status and MPU access permission cp15
registers to the new scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:05:50 +00:00
Peter Maydell c983fe6cf1 target-arm: Convert cp15 c3 register
Convert the cp15 c3 register (MMU domain access control
or MPU write buffer control). NB that this is horribly
underdecoded for modern cores (should be crn=3,crm=0,
opc1=0,opc2=0) but this change preserves the existing
QEMU behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:05:44 +00:00
Peter Maydell 6cc7a3aee6 target-arm: Convert generic timer cp15 regs
Convert the (dummy) generic timer cp15 implementation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:05:40 +00:00
Peter Maydell 200ac0ef87 target-arm: Convert performance monitor registers
Convert the v7 performance monitor cp15 registers to
the new scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:05:17 +00:00
Peter Maydell 4d31c59679 target-arm: Convert TLS registers
Convert TLS registers to the new cp15 framework

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:04:54 +00:00
Peter Maydell 7d57f40877 target-arm: Convert WFI/barriers special cases to cp_reginfo
Convert the various WFI and barrier instruction special cases to use
cp_reginfo infrastructure.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:04:32 +00:00
Peter Maydell c326b9796f target-arm: Convert TEECR, TEEHBR to new scheme
Convert the THUMB2EE cp14 registers TEECR and TEEHBR to
use arm_cp_reginfo.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:04:08 +00:00
Peter Maydell e9aa6c2148 target-arm: Convert debug registers to cp_reginfo
Convert the cp14 debug registers (DBGDIDR, DBGDRAR, DBGDSAR) to the
cp_reginfo scheme.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:03:44 +00:00
Peter Maydell 2ceb98c007 target-arm: Add register_cp_regs_for_features()
Add new function register_cp_regs_for_features() as a place to
register coprocessor registers dependent on feature flags.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:02:54 +00:00
Peter Maydell e8070a23a8 target-arm: Remove old cpu_arm_set_cp_io infrastructure
All the users of cpu_arm_set_cp_io have been converted, so we
can remove it and the infrastructure it used.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:02:01 +00:00
Peter Maydell 4b6a83fb0c target-arm: initial coprocessor register framework
Initial infrastructure for data-driven registration of
coprocessor register implementations.

We still fall back to the old-style switch statements pending
complete conversion of all existing registers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:01:02 +00:00
Peter Maydell 200bf596b9 target-arm: Fix 11MPCore cache type register value
Make the 11MPCore report a valid value in its cache type register
(the previous value appears to have been incorrectly copied from
the 1136/1176). In particular, do not report that we have an
aliasing VIPT cache, because this causes Linux to attempt to use
the v6 block cache ops which the 11MPCore doesn't actually have.
(This causes no problems currently because we over-broadly provide
those ops on all cores, but prevents us correctly narrowing the
block ops down to those cores which actually implement them.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2012-06-20 12:00:58 +00:00
Paolo Bonzini fbe37ef3e1 build: move other target-*/ objects to nested Makefile.objs
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2012-06-07 09:21:11 +02:00
Paolo Bonzini 9cdc8df314 build: move libobj-y variable to nested Makefile.objs
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2012-06-07 07:19:23 +02:00